IEEE Geoscience and Remote Sensing Magazine - June 2023 - 65

ADVERSARIAL DEFENSES
Adversarial attacks reveal the drawbacks of current deep
learning-based systems for EO and raise public concerns
about RS applications. Thus, it is urgent to develop corresponding
adversarial defenses against such attacks and
avoid severe consequences. Adversarial training [41] is
recognized as one of the most effective adversarial defenses
against adversarial examples and has been applied
widely in computer vision tasks. The idea behind adversarial
training is intuitive: it trains directly deep learning
models on adversarial examples generated in each loop. Xu
et al. [32] took the first step and empirically demonstrated
adversarial training for the RS scene classification task. Their
extensive experiments showed that adversarial training significantly
increased the resistance of deep models to adversarial
examples, although evaluation was limited to the naive
attack fast gradient descent method [27]. Similar methods
and conclusions were also obtained in [42] and [43]. However,
adversarial training requires labeled data and suffers
significant decreases in accuracy on testing data [44]. Xu
et al. [44] introduced self-supervised learning into adversarial
training to extend the training set with unlabeled
data to train more robust models. Cheng et al. [45] proposed
another variant of adversarial
training, where a
generator is utilized to model the distributions of adversarial
perturbations.
Unlike the aforementioned research, which mainly
used the adversarial training technique, some further attempts
were made to improve adversarial robustness by
modifying model architectures. Xu et al. [36] introduced
a self-attention context network, which extracts both local
and global context information simultaneously. By
extracting global context information, pixels are connected
to other pixels in the whole image and obtain resistance
to local perturbations. It is also reasonable to add
preprocessing modules before the original models. For
example, Xu et al. [46] proposed purifying adversarial examples
using a denoising network. As the adversarial examples
and original images have different distributions,
such discrepancies have inspired researchers to develop
methods to detect adversarial examples. Chen et al. [47]
noticed the class selectivity of adversarial examples, (i.e.,
the misclassified classes are not random). They compared
the confidence scores of original samples and adversarial
examples and obtained classwise soft thresholds for use
as an indicator for adversarial detection. Similarly, from
the energy perspective, Zhang et al. [48] captured an inherent
energy gap between the adversarial examples and
original samples.
FUTURE PERSPECTIVES
Although much research related to security issues in RS was
discussed in the previous section, the threats from adversarial
examples have not been eliminated completely. Here
we summarize some potential directions for studying adversarial
examples.
JUNE 2023 IEEE GEOSCIENCE AND REMOTE SENSING MAGAZINE
ADVERSARIAL ATTACKS AND DEFENSES
BEYOND SCENE CLASSIFICATION
As in the literature review introduced earlier, the focus of
most adversarial attacks in RS is scene classification. Many
other tasks like object detection [10] and video tracking [13]
remain untouched, where DNNs are deployed as widely as
in scene classification. Thus, it is equally important to study
these tasks from an adversarial perspective.
DIFFERENT FORMS OF ADVERSARIAL ATTACKS
When talking about adversarial examples, we usually refer to
adversarial perturbations. Nevertheless, crafting adversarial
examples is not limited to adding perturbations because the
existence of adversarial examples is actually caused by the
gap between human vision and machine vision. Such gaps
have not been well defined yet, which may enable us to explore
adversarial examples in different forms. For example,
scholars have explored the use of adversarial patches [49],
[50], where a patch is added to an input image to deceive
the machine, as well as the concept of natural adversarial
examples [51], where an image looks the same to humans
but is misclassified by the machine due to subtle differences.
These approaches may offer insights into the mechanisms
underlying adversarial examples. By better understanding
the existence of adversarial examples in different forms, we
can develop more comprehensive and effective defenses to
protect against these attacks.
DIFFERENT SCENARIOS OF ADVERSARIAL ATTACKS
Despite white-box settings being the most common type
when discussing the robustness of DNNs, black-box settings
are more practical for real-world applications, where
the adversary has no or limited access to the trained models
in deployment. Typically, there are two strategies that
adversaries can employ in a black-box scenario. The first is
adversarial transferability [52], [53], which involves creating
a substitute model that imitates the behavior of the target
model based on a limited set of queries or inputs. Once
the substitute model is created, the adversary can generate
adversarial examples on the substitute model and transfer
these examples to the target model. The second strategy is
to directly query the target model using input-output pairs
and use the responses to generate adversarial examples.
This approach is known as a query-based attack [54], [55].
Future research in this area will likely focus on the development
of more effective black-box attacks.
PHYSICAL ADVERSARIAL EXAMPLES
The current research on adversarial examples in the literature
focuses on digital space without considering the physical constraints
that may exist in the real world. Thus, one natural question
that arises in the context of physical adversarial examples
is whether the adversarial perturbations will be detectable or
distorted when applied in the real world, where the imaging
environment is more complex and unpredictable, leading to
a reduction in their effectiveness. Therefore, it is crucial to
65
IEEE Geoscience and Remote Sensing Magazine - June 2023

Table of Contents for the Digital Edition of IEEE Geoscience and Remote Sensing Magazine - June 2023
