IEEE Geoscience and Remote Sensing Magazine - June 2022 - 283

the same as the original clean images to the human vision
system, the experimental result in [267] shows that deep
NNs can misclassify adversarial examples into an incorrect
category with high confidence.
In [268], Xu et al. presented an example of adversarial attacks
on DL models for RS scene classification, which demonstrated
that the minimal difference between adversarial
images and the original ones cannot be detected by the human
vision system but can fool deep NNs with high confidence.
This phenomenon may undoubtedly limit the practical
deployment of DL models in the safety-critical RS field.
The detailed idea of adversarial attacks is first illustrated
in [267]. Later, a more efficient algorithm and a few of its
extensions are proposed [269], [270]. Although existing literature
mainly assumes that adversarial examples can be
fed directly into a machine learning classifier, this is not always
the case for systems operating in the physical world. In
many cases, AI systems may use signals from cameras and
other sensors as input. A natural question is thus whether
adversarial attacks can also be implemented in real-world
scenarios. In [271], Kurakin et al. discovered that machine
learning systems are also vulnerable to such adversarial examples,
even in physical-world scenarios.
ADVERSARIAL DEFENSES
The defense for adversarial attacks can be grouped into two
categories, the first of which is improved training schemes.
Adversarial examples can fool state-of-the-art deep NNs because
they have never been seen in the training set by classifiers,
despite looking almost the same as the original clean
training samples to a human observer. A natural adversarial
defense is to extend the training set with these generated
adversarial examples and train the deep NNs with a mixed
clean and adversarial samples. This scheme is known as adversarial
training [267], [269], which can not only resist adversarial
attacks but also help regularize a deep NN [269].
The second category is improved network architectures.
Here, recent studies have also attempted to directly improve
network architectures to acquire immunity from adversarial
attacks. Gu and Rigazio [272] first explored the influence
of network topology on adversarial attacks. The representative
algorithms in this category include defense-GAN [273]
and Jacobian regularization [274].
THREAT OF ADVERSARIAL EXAMPLES IN RS
In a preliminary analysis of adversarial attacks in the context
of RS image classification tasks, In [266], the authors
discovered that adversarial examples also occur in the field
of RS. The experimental results indicate that adversarial attacks
on a small patch inside a satellite image can also cause
a deep NN to make an incorrect interpretation. Chen et al.
showed that the vulnerability of a model to adversarial examples
is related to RS image data sets; those with high variety
are minimally susceptible to adversarial attacks [275],
[276]. Furthermore, the severity of the adversarial problem
has a negative relationship with the richness of feature
JUNE 2022 IEEE GEOSCIENCE AND REMOTE SENSING MAGAZINE
information for optical data [277]. Xu et al. investigated the
adversarial training strategy to alleviate the vulnerability of
deep models to adversarial examples in RS tasks. Similar to
[269], the original clean RS images are first used to train a
deep NN. Adversarial examples are then generated using
fast gradient sign method. Adversarial training is achieved
by simultaneously minimizing the cross-entropy loss from
the original clean images and the adversarial examples. The
results demonstrate that such a simple training strategy is
also effective in increasing the resistibility of deep models to
adversarial examples for RS scene classification tasks [268].
Adversarial examples are also found in SAR images. The
experimental results in [278] showed that adversarial SAR
images are relatively effective in misleading CNN models,
as indicated by the obtained high attack success rate. Li
et al. proposed a sample boundary-based, adversarial example
selectivity distance to explain the attack selectivity
of adversarial SAR images [279]. To conduct more efficient
adversarial attacks, the authors in [101] further offered an
accelerated adversarial attack algorithm for SAR images.
Pioneering research has been carried out on adversarial
defenses of RS image classification tasks. Cheng et al. proposed
an effective defense framework specified for RS image
scene classification in which a new training framework
is designed to train the classifier by introducing the generated
examples with random and unknown attacks [127]. The
authors in [168] presented a soft-threshold-defense method
to determine whether or not an image is an adversarial example,
and experimental results confirmed that the incorrect
prediction rates of a few attack algorithms declined in
several scenarios.
CONCLUSIONS AND REMARKS
In this technical review, we systematically discussed stateof-the-art
AI techniques in RS data analysis. In detail, this
review covered six fundamental facets of AI in RS from the
most attractive topic (i.e., machine learning) to recently
emerging areas (e.g., NAS strategies, AI explicability, and
security). The latest research showed that AI approaches
are increasingly used to extract information and analytical
data from the continuously growing stream of RS data.
However, applications of AI approaches to problems in RS
remain in their infancy, and many open questions are worthy
of further investigation. The challenges specific to RS
tasks are expected to further stimulate the development of
methodologies. A few potentially interesting topics include
the following:
◗ AI approaches for real-world RS tasks-The following four
issues merit notice under this topic: 1) Numerous current
studies are built and evaluated on simulated data
sets or a limited size of real-world data sets. The accuracy
of RS image pixel classification on existing standard
data sets has reached 100%, even before the DL era. Nevertheless,
the performance remains far from satisfactory
when these classification algorithms are applied in
practice due to reconsideration of many factors. 2) The
283
IEEE Geoscience and Remote Sensing Magazine - June 2022

Table of Contents for the Digital Edition of IEEE Geoscience and Remote Sensing Magazine - June 2022
