Backdoor Attacks for Remote Sensing Data with Wavelet Transform

TL;DR

This paper introduces a wavelet transform-based backdoor attack method for remote sensing data, enabling stealthy, invisible triggers that can deceive deep learning models in critical geoscience applications.

Contribution

The paper proposes a novel wavelet transform-based attack (WABA) that creates invisible triggers in remote sensing data, enhancing stealthiness over existing visible trigger methods.

Findings

High attack success rate on multiple remote sensing datasets

Effective for both scene classification and semantic segmentation

Stealthy triggers are less detectable due to low-frequency domain injection

Abstract

Recent years have witnessed the great success of deep learning algorithms in the geoscience and remote sensing realm. Nevertheless, the security and robustness of deep learning models deserve special attention when addressing safety-critical remote sensing tasks. In this paper, we provide a systematic analysis of backdoor attacks for remote sensing data, where both scene classification and semantic segmentation tasks are considered. While most of the existing backdoor attack algorithms rely on visible triggers like squared patches with well-designed patterns, we propose a novel wavelet transform-based attack (WABA) method, which can achieve invisible attacks by injecting the trigger image into the poisoned image in the low-frequency domain. In this way, the high-frequency information in the trigger image can be filtered out in the attack, resulting in stealthy data poisoning. Despite its simplicity, the proposed method can significantly cheat the current state-of-the-art deep learning models with a high attack success rate. We further analyze how different trigger images and the hyper-parameters in the wavelet transform would influence the performance of the proposed method. Extensive experiments on four benchmark remote sensing datasets demonstrate the effectiveness of the proposed method for both scene classification and semantic segmentation tasks and thus highlight the importance of designing advanced backdoor defense algorithms to address this threat in remote sensing scenarios. The code will be available online at \url{https://github.com/ndraeger/waba}.