Abstract:Deep learning methods have been proven effective in remote sensing image analysis and interpretation, where semantic segmentation plays a vital role. These deep segmentation methods are susceptible to adversarial attacks, while most of the existing attack methods tend to manipulate the image globally, leading to noticeable perturbations and chaotic segmentation. In this work, we propose a novel stealthy attack for semantic segmentation (SASS), which can largely increase the effectiveness and stealthiness from the existing attack methods on remote sensing images. SASS manipulates specific victim classes or objects of interest while preserving the original segmentation results for other classes or objects. In practice, as different inference mechanisms, overlapped inference, can be applied in segmentation, the efficacy of SASS may be degraded. To this end, we further introduce the masked SASS (MSASS), which generates augmented adversarial perturbations that only affect victim areas. We evaluate the effectiveness of SASS and MSASS using four state-of-the-art semantic segmentation models on the Vaihingen and Zurich Summer datasets. Extensive experiments demonstrate that our SASS and MSASS methods achieve superior attack performances on victim areas while maintaining high accuracies of other areas (drop less than 2%). The detection success rates of adversarial examples for segmentation, as characterized by Xiao et al., significantly drop from 97.78% for the untargeted projected gradient descent (PGD) attack to 28.71% for our MSASS method on the Zurich Summer dataset. Our work contributes to the field of adversarial attacks in semantic segmentation for remote sensing images by improving stealthiness, flexibility, and robustness. We anticipate that our findings will inspire the development of defense methods to enhance the security and reliability of semantic segmentation models against our stealthy attack.

Fashion-Guided Adversarial Attack on Person Segmentation

Adversarial Texture for Fooling Person Detectors in the Physical World

Real-World Adversarial Examples Via Makeup

Adversarial Examples for Semantic Segmentation and Object Detection

Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition

AdvART: Adversarial Art for Camouflaged Object Detection Attacks

Adversarial Image Generation by Spatial Transformation in Perceptual Colorspaces

Evading Forensic Classifiers with Attribute-Conditioned Adversarial Faces

Adversarial Attacks on Video Object Segmentation with Hard Region Discovery

Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model

Stealthy Adversarial Examples for Semantic Segmentation in Remote Sensing

Fast Geometrically-Perturbed Adversarial Faces

Defense against adversarial attacks based on color space transformation

Face3DAdv: Exploiting Robust Adversarial 3D Patches on Physical Face Recognition

Investigating Human-Identifiable Features Hidden in Adversarial Perturbations

Imperceptible Face Forgery Attack via Adversarial Semantic Mask

Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles

advPattern: Physical-World Attacks on Deep Person Re-Identification via Adversarially Transformable Patterns

Adversarial Examples: Generation Proposal in the Context of Facial Recognition Systems

Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similarity

SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing