Universal adversarial perturbation for remote sensing images

TL;DR

This paper introduces a novel method to generate universal adversarial perturbations for remote sensing images, significantly fooling classification models with high success rates, revealing vulnerabilities in deep learning-based RSI analysis.

Contribution

It proposes a combined encoder-decoder and attention mechanism approach to generate effective UAPs specifically for remote sensing images, a previously underexplored area.

Findings

UAP can cause high misclassification rates in RSI models

Proposed method achieves up to 97.09% attack success rate

The approach effectively identifies sensitive regions in RSIs

Abstract

Recently, with the application of deep learning in the remote sensing image (RSI) field, the classification accuracy of the RSI has been dramatically improved compared with traditional technology. However, even the state-of-the-art object recognition convolutional neural networks are fooled by the universal adversarial perturbation (UAP). The research on UAP is mostly limited to ordinary images, and RSIs have not been studied. To explore the basic characteristics of UAPs of RSIs, this paper proposes a novel method combining an encoder-decoder network with an attention mechanism to generate the UAP of RSIs. Firstly, the former is used to generate the UAP, which can learn the distribution of perturbations better, and then the latter is used to find the sensitive regions concerned by the RSI classification model. Finally, the generated regions are used to fine-tune the perturbation making the model misclassified with fewer perturbations. The experimental results show that the UAP can make the classification model misclassify, and the attack success rate of our proposed method on the RSI data set is as high as 97.09%.