[论文解读] Adversarial Example in Remote Sensing Image Recognition

Li Chen, Guowei Zhu+2 more|arXiv (Cornell University)|Oct 29, 2019

Adversarial Robustness in Machine Learning参考文献 40被引用 31

一句话总结

本文首次分析了基于深度卷积神经网络（CNN）的遥感图像（RSI）识别中对抗样本的存在。结果表明，微小且难以察觉的扰动即可欺骗高精度的RSI模型，揭示了模型的脆弱性以及攻击选择性——即错误分类倾向于发生在CNN特征空间中具有相似特征的类别上。

ABSTRACT

With the wide application of remote sensing technology in various fields, the accuracy and security requirements for remote sensing images (RSIs) recognition are also increasing. In recent years, due to the rapid development of deep learning in the field of image recognition, RSI recognition models based on deep convolution neural networks (CNNs) outperform traditional hand-craft feature techniques. However, CNNs also pose security issues when they show their capability of accurate classification. By adding a very small variation of the adversarial perturbation to the input image, the CNN model can be caused to produce erroneous results with extremely high confidence, and the modification of the image is not perceived by the human eye. This added adversarial perturbation image is called an adversarial example, which poses a serious security problem for systems based on CNN model recognition results. This paper, for the first time, analyzes adversarial example problem of RSI recognition under CNN models. In the experiments, we used different attack algorithms to fool multiple high-accuracy RSI recognition models trained on multiple RSI datasets. The results show that RSI recognition models are also vulnerable to adversarial examples, and the models with different structures trained on the same RSI dataset also have different vulnerabilities. For each RSI dataset, the number of features also affects the vulnerability of the model. Many features are good for defensive adversarial examples. Further, we find that the attacked class of RSI has an attack selectivity property. The misclassification of adversarial examples of the RSIs are related to the similarity of the original classes in the CNN feature space. In addition, adversarial examples in RSI recognition are of great significance for the security of remote sensing applications, showing a huge potential for future research.

研究动机与目标

• 研究基于深度卷积神经网络（CNN）的遥感图像（RSI）识别系统中对抗样本的存在及其影响。
• 评估多种高精度RSI识别模型对不同对抗攻击算法的脆弱性。
• 分析模型架构、数据集特征与对抗扰动敏感性之间的关系。
• 探索对抗错误分类背后的几何特性和特征空间属性，特别是攻击选择性。
• 为未来在安全且鲁棒的基于CNN的RSI应用中构建防御机制提供基础性见解。

提出的方法

• 对预训练的RSI识别模型应用多种对抗攻击算法（如FGSM、PGD），在多样化的RSI数据集上实施攻击。
• 在相同RSI数据集上训练具有不同架构的多个CNN模型，以比较其对对抗样本的脆弱性差异。
• 从训练模型的最后一个全连接层提取特征，分析RSI类别在CNN特征空间中的几何分布。
• 通过t-SNE降维计算RSI样本与聚类中心之间的L2距离，评估特征相似性。
• 使用t-SNE可视化将高维RSI特征映射至低维空间，以分析对抗样本的聚类特性。
• 评估攻击成功率及对抗样本的类别分布，以识别错误分类的模式与攻击选择性。

实验结果

研究问题

• RQ1 基于深度CNN的RSI识别模型即使在高分类准确率下，是否仍对对抗样本表现出脆弱性？
• RQ2 模型架构与训练数据集规模如何影响RSI模型对对抗攻击的敏感性？
• RQ3 CNN特征空间中类别之间的相似性是否与对抗错误分类的可能性存在相关性？
• RQ4 对抗样本是否倾向于被错误分类到特定类别？若是，这种选择性由什么决定？
• RQ5 数据点在特征空间中相对于聚类边界的几何位置，能否解释某些RSI样本对对抗扰动的脆弱性？

主要发现

• 基于深度CNN的RSI识别模型对对抗样本具有脆弱性，仅通过极小且难以察觉的扰动即可实现成功攻击。
• 在相同RSI数据集上训练的不同架构模型，对同一攻击算法表现出不同程度的脆弱性。
• 模型中的特征数量影响其敏感性，通常特征数量越多，脆弱性越低。
• 对抗样本表现出强烈的攻击选择性，错误分类主要发生在CNN特征空间中相似的类别上。
• 特征空间中靠近聚类边界的样本比靠近聚类中心的样本更容易受到对抗扰动的影响。
• 在所有实验中，对抗样本最常见的目标类别是“beach”（海滩），表明某些类别可能因特征特性而固有地更易受攻击。