Adversarial perturbation in remote sensing image recognition

Abstract Recent works have demonstrated that current deep neural networks suffer from small but intentional perturbation during the testing phase of the model. Such perturbations aiming at misclassifying the model’s inputs produce adversarial examples. To explain the origin of adversarial examples, the threat they pose towards deep learning networks, and their transferability property across models learning on the same data distribution, many works have been proposed without reaching any consensus. On the other hand, the study of adversarial examples in remote sensing imagery has gained popularity thanks to the availability of very high spatial resolution images, and the rapid development of deep learning algorithms in image recognition. Although many constructions aiming at mitigating adversarial examples in remote sensing imagery have been proposed, not all of them are realizable for they are based on unrealistic assumptions, or incur a lot of computation overhead. In this paper, we revisit adversarial examples in remote sensing imagery. First, we discuss the origin of adversarial perturbations, the various methods to generate them, as well as propose a framework to construct them under real-world constraints in remote sensing imagery. Second, we investigate the property of adversarial transferability or cross-model generalization, and detail its origin. Third, we revisit the various defense mechanisms to achieve certified robustness against adversarial perturbations in remote sensing imagery. Fourth, we discuss some important trade-offs regarding adversarial examples. Finally, we present the direction for future research aiming at more secure machine learning models against adversarial examples in remote sensing imagery.