2026· IEEE Transactions on Geoscience and Remote Sensing· Vol 64, pp. 5633213-5633213· 0 citations· 40 references
Abstract
Deep learning has boosted remote sensing (RS) scene classification, but adversarial examples can still cause high-confidence misclassification with imperceptible perturbations. Adversarial purification (AP) offers a practical test-time defense without retraining the classifier. However, most existing methods are confined to pixel-space restoration, which may leave residual adversarial effects that persist and amplify through feature extraction, ultimately biasing the prediction. To address these issues, a dual-domain AP (DDAP) framework is proposed to mitigate adversarial effects at both the pixel and feature levels in a unified pipeline. In the pixel domain, a pixel-domain frequency-aware diffusion purification (PFDP) module performs diffusion-based restoration through a frequency-aware dual-stream U-Net (FD-UNet). By integrating adaptive spectral filtering with multidomain consistency constraints, PFDP reduces adversarial-perturbation-dominated high-frequency responses while preserving structural details and semantic information in RS imagery. In the feature domain, an adversarial vulnerable channel dropout (AVCD) strategy models unshifted shallow-feature statistics with a Gaussian mixture model (GMM) and adaptively assigns channelwise dropout probabilities based on a samplewise shift score and channel vulnerability, thereby suppressing residual adversarial influence before downstream classification. Extensive experiments on UC Merced (UCM) and aerial image dataset (AID) across multiple backbones and attack types demonstrate that DDAP consistently improves robustness while maintaining a favorable clean–robust balance compared with representative baselines.
MAIG-Net combines a target-label-free ground-sampling-distance rule, an intermediate domain constructed by Fourier domain adaptation (FDA) that transfers only low-frequency target appearance onto labeled source images while preserving the complete source phase and road labels, and Domain-Invariant Feature Alignment modules that perform reliability-weighted, topology-conditioned adversarial alignment at three encoder depths.
Chengqi Bao, Guangwu Chen, Wenbo Jin et al.· Italian National Conference...· 0 citations
FDT-PC (Frequency Domain Transformation with Perceptual Constraints), a novel method that enhances adversarial transferability across different model architectures, is proposed, which achieves superior black-box attack performance on both CNNs and Vision Transformers, outperforming existing state-of-the-art input transformation methods.
Bo Li, Li Tang, Xin Jin et al.· ACM Transactions on Multimed...· 0 citations
Deep learning-based object detection models are widely applied in remote sensing fields such as remote sensing image interpretation and maritime surveillance, yet their poor robustness against adversarial perturbations has become a critical security risk for the deployment of remote sensing vision systems. Existing FGSM-based adversarial example generation methods rely on gradients from a single model and apply perturbations across the entire image, suffering from insufficient cross-model attack transferability, low perturbation concealment and utilization efficiency, and thus failing to adapt to the characteristics of remote sensing images including large target scale variations and complex backgrounds. To address this, this paper proposes a target-region constrained cross-model FGSM adversarial example generation method for remote sensing images, which fuses the loss function gradients of YOLOv5 and RetinaNet to generate adversarial directions, and combines a region constraint mechanism based on detection box dilation to confine perturbations to targets and their surrounding areas. Experiments on the SSDD remote sensing ship dataset demonstrate that, compared with the traditional single-model FGSM, the proposed method significantly reduces the recall rate of remote sensing detection models while achieving better performance in the SSIM metric. It realizes an effective trade-off between attack intensity and visual concealment, verifying its feasibility and effectiveness in the remote sensing domain.
LiDAR semantic segmentation is a key perception task in autonomous driving, where false predictions can affect downstream planning and safety-critical decision-making. Although adversarial attacks, and specifically adversarial examples, have been widely studied for image classification and 3D point cloud segmentation, unrestricted adversarial examples remain largely unexplored in the space of 2D range images, which are projections of 3D point clouds. The proposed method is, to the best of our knowledge, the first diffusion-based unrestricted adversarial attack against 2D range-image segmentation, using adversarial guidance from a segmentation loss. By applying guidance directly during sampling, the method produces unrestricted adversarial examples that remain close to the learned LiDAR data manifold while inducing structured segmentation errors. Experiments on the SemanticKITTI dataset using RangeNet++ and CENet segmentation networks demonstrate that the attack provides adjustable degradation across guidance strengths and transfers across segmentation architectures. Compared with norm-bounded FGSM and SegPGD baselines, the proposed attack offers a distinct effectiveness-realism trade-off, achieving controllable white-box and transfer degradation while maintaining competitive distributional and visual realism.
Stavros Bouras, Antonios Makris, A. Gkillas et al.· 0 citations
Remote sensing change detection (RSCD) remains vulnerable to pseudo-changes caused by seasonal, illumination, and atmospheric discrepancies between bi-temporal images. Existing deep models often ignore this temporal distribution gap or align entangled features directly, which may corrupt change-relevant semantics and cause negative transfer. To address this challenge, this article proposes the disentangled adversarial alignment network (DAANet), establishing a novel “Disentangle to Align” paradigm and introducing a domain adaptation (DA)-inspired temporal distribution alignment framework for time-invariant feature learning (IFL) in change detection. DAANet first uses a content-style gate (CSG) to separate content-preserving features from style-biased residuals, and then applies adversarial alignment only to the residual branch. This targeted alignment encourages the backbone to learn time-invariant representations while preserving semantic cues for real changes. A dual-dimensional dynamic balancing strategy further stabilizes the adversarial optimization. Extensive experiments on WHU-CD, LEVIR-CD, SYSU-CD, and MSRSCD, together with backbone-universality analyses, demonstrate the effectiveness and robustness of DAANet under complex imaging conditions.