2026· IEEE Transactions on Geoscience and Remote Sensing· Vol 64, pp. 5633213-5633213· 0 citations· 40 references
Abstract
Deep learning has boosted remote sensing (RS) scene classification, but adversarial examples can still cause high-confidence misclassification with imperceptible perturbations. Adversarial purification (AP) offers a practical test-time defense without retraining the classifier. However, most existing methods are confined to pixel-space restoration, which may leave residual adversarial effects that persist and amplify through feature extraction, ultimately biasing the prediction. To address these issues, a dual-domain AP (DDAP) framework is proposed to mitigate adversarial effects at both the pixel and feature levels in a unified pipeline. In the pixel domain, a pixel-domain frequency-aware diffusion purification (PFDP) module performs diffusion-based restoration through a frequency-aware dual-stream U-Net (FD-UNet). By integrating adaptive spectral filtering with multidomain consistency constraints, PFDP reduces adversarial-perturbation-dominated high-frequency responses while preserving structural details and semantic information in RS imagery. In the feature domain, an adversarial vulnerable channel dropout (AVCD) strategy models unshifted shallow-feature statistics with a Gaussian mixture model (GMM) and adaptively assigns channelwise dropout probabilities based on a samplewise shift score and channel vulnerability, thereby suppressing residual adversarial influence before downstream classification. Extensive experiments on UC Merced (UCM) and aerial image dataset (AID) across multiple backbones and attack types demonstrate that DDAP consistently improves robustness while maintaining a favorable clean–robust balance compared with representative baselines.
In unsupervised cross-domain remote sensing road extraction, severe data distribution shifts and heterogeneous background interference significantly constrain model performance. In addition to appearance shift, source and target images acquired by different sensors often present roads at unequal physical scales. To address this, MAIG-Net combines a target-label-free ground-sampling-distance (GSD) rule that matches the physical field of view of the two domains, an intermediate domain constructed by Fourier domain adaptation (FDA) that transfers only low-frequency target appearance onto labeled source images while preserving the complete source phase and road labels, and Domain-Invariant Feature Alignment (DIFA) modules that perform reliability-weighted, topology-conditioned adversarial alignment at three encoder depths. An exponential-moving-average (EMA) teacher supplies detached reliability and topology conditions for the domain discriminators; no target prediction is used as a direct segmentation label. Under a matched protocol with a fixed 30-epoch budget and three seeds, MAIG-Net improves the mean road IoU from 0.327 to 0.376 on SpaceNet→DeepGlobe and from 0.450 to 0.458 on SpaceNet→Massachusetts relative to source-only training, with consistent per-seed gains in both directions; the smaller Massachusetts effect is directionally reproduced on a previously untouched validation holdout. Reverse adaptation, reliability perturbations, computational cost, and failure cases are further reported to delimit the applicability of the method.
Chengqi Bao, Guangwu Chen, Wenbo Jin et al.· Italian National Conference...· 0 citations
The core challenge of heterogeneous change detection in remote sensing imagery lies in effectively decoupling genuine land-cover changes from significant modal disparities caused by distinct imaging mechanisms. These intrinsic inconsistencies are prone to introducing pseudo-changes, thereby constraining detection accuracy. To address this, we propose a novel, end-to-end adversarial spatio-frequency refinement network (ASFR-Net). Initially, a modality-invariant representation learner (MIR-Learner) guides the backbone to extract modality-invariant features, effectively bridging the primary domain gap. Subsequently, to address persistent residual modal differences, we design an innovative spatio-frequency synergistic enhancement module (SFEM), which identifies and suppresses sensor-specific noise and artifacts that are difficult to discern in the spatial domain by leveraging frequency-domain processing. Multi-level difference features are then computed from these refined representations and fed into a decoder equipped with cascaded hierarchical guided fusion module (HGFM) blocks to generate precise change maps. To alleviate the data scarcity in heterogeneous tasks, we construct and release a new high-resolution benchmark specifically focused on building changes: the visible-near-infrared heterogeneous change detection (VisNIR-HCD) dataset. It presents unique scientific challenges arising from deceptive visual similarity and non-linear spectral inversions, providing a robust platform for evaluating model generalization. Extensive experiments on VisNIR-HCD and public datasets demonstrate that ASFR-Net achieves state-of-the-art (SOTA) performance, significantly outperforming existing methods. The source code and the VisNIR-HCD dataset are publicly available at https://github.com/LuoYang2024/ASFR-Net.
Xingye Wu, Zhi-Hui You, Sibao Chen et al.· 0 citations
FDT-PC (Frequency Domain Transformation with Perceptual Constraints), a novel method that enhances adversarial transferability across different model architectures, is proposed, which achieves superior black-box attack performance on both CNNs and Vision Transformers, outperforming existing state-of-the-art input transformation methods.
Bo Li, Li Tang, Xin Jin et al.· ACM Transactions on Multimed...· 0 citations
Deep learning-based object detection models are widely applied in remote sensing fields such as remote sensing image interpretation and maritime surveillance, yet their poor robustness against adversarial perturbations has become a critical security risk for the deployment of remote sensing vision systems. Existing FGSM-based adversarial example generation methods rely on gradients from a single model and apply perturbations across the entire image, suffering from insufficient cross-model attack transferability, low perturbation concealment and utilization efficiency, and thus failing to adapt to the characteristics of remote sensing images including large target scale variations and complex backgrounds. To address this, this paper proposes a target-region constrained cross-model FGSM adversarial example generation method for remote sensing images, which fuses the loss function gradients of YOLOv5 and RetinaNet to generate adversarial directions, and combines a region constraint mechanism based on detection box dilation to confine perturbations to targets and their surrounding areas. Experiments on the SSDD remote sensing ship dataset demonstrate that, compared with the traditional single-model FGSM, the proposed method significantly reduces the recall rate of remote sensing detection models while achieving better performance in the SSIM metric. It realizes an effective trade-off between attack intensity and visual concealment, verifying its feasibility and effectiveness in the remote sensing domain.
LiDAR semantic segmentation is a key perception task in autonomous driving, where false predictions can affect downstream planning and safety-critical decision-making. Although adversarial attacks, and specifically adversarial examples, have been widely studied for image classification and 3D point cloud segmentation, unrestricted adversarial examples remain largely unexplored in the space of 2D range images, which are projections of 3D point clouds. The proposed method is, to the best of our knowledge, the first diffusion-based unrestricted adversarial attack against 2D range-image segmentation, using adversarial guidance from a segmentation loss. By applying guidance directly during sampling, the method produces unrestricted adversarial examples that remain close to the learned LiDAR data manifold while inducing structured segmentation errors. Experiments on the SemanticKITTI dataset using RangeNet++ and CENet segmentation networks demonstrate that the attack provides adjustable degradation across guidance strengths and transfers across segmentation architectures. Compared with norm-bounded FGSM and SegPGD baselines, the proposed attack offers a distinct effectiveness-realism trade-off, achieving controllable white-box and transfer degradation while maintaining competitive distributional and visual realism.
Stavros Bouras, Antonios Makris, A. Gkillas et al.· 0 citations
Remote sensing change detection (RSCD) remains vulnerable to pseudo-changes caused by seasonal, illumination, and atmospheric discrepancies between bi-temporal images. Existing deep models often ignore this temporal distribution gap or align entangled features directly, which may corrupt change-relevant semantics and cause negative transfer. To address this challenge, this article proposes the disentangled adversarial alignment network (DAANet), establishing a novel “Disentangle to Align” paradigm and introducing a domain adaptation (DA)-inspired temporal distribution alignment framework for time-invariant feature learning (IFL) in change detection. DAANet first uses a content-style gate (CSG) to separate content-preserving features from style-biased residuals, and then applies adversarial alignment only to the residual branch. This targeted alignment encourages the backbone to learn time-invariant representations while preserving semantic cues for real changes. A dual-dimensional dynamic balancing strategy further stabilizes the adversarial optimization. Extensive experiments on WHU-CD, LEVIR-CD, SYSU-CD, and MSRSCD, together with backbone-universality analyses, demonstrate the effectiveness and robustness of DAANet under complex imaging conditions.