Universal Adversarial Examples in Remote Sensing: Methodology and Benchmark

Yonghao Xu and Pedram Ghamisi

<br

This research has been conducted at the Institute of Advanced Research in Artificial Intelligence (IARAI).

This is the official PyTorch implementation of the black-box adversarial attack methods for remote sensing data in our paper Universal adversarial examples in remote sensing: Methodology and benchmark.

Presentation

Table of content

1. Dataset
2. Supported methods and models
3. Preparation
4. Adversarial attacks on scene classification
5. Adversarial attacks on semantic segmentation
6. Performance evaluation on the UAE-RS dataset
7. Paper
8. Acknowledgement
9. License

Dataset

We collect the generated universal adversarial examples in the dataset named UAE-RS, which is the first dataset that provides black-box adversarial samples in the remote sensing field.

📡 Download links:  Google Drive        Baidu NetDisk (Code: 8g1r)

To build UAE-RS, we use the Mixcut-Attack method to attack ResNet18 with 1050 test samples from the UCM dataset and 5000 test samples from the AID dataset for scene classification, and use the Mixup-Attack method to attack FCN-8s with 5 test images from the Vaihingen dataset (image IDs: 11, 15, 28, 30, 34) and 5 test images from the Zurich Summer dataset (image IDs: 16, 17, 18, 19, 20) for semantic segmentation.

Example images in the UCM dataset and the corresponding adversarial examples in the UAE-RS dataset.

Example images in the AID dataset and the corresponding adversarial examples in the UAE-RS dataset.

Qualitative results of the black-box adversarial attacks from FCN-8s → SegNet on the Vaihingen dataset.

(a) The original clean test images in the Vaihingen dataset. (b) The corresponding adversarial examples in the UAE-RS dataset. (c) Segmentation results of SegNet on the clean images. (d) Segmentation results of SegNet on the adversarial images. (e) Ground-truth annotations.

Supported methods and models

This repo contains implementations of black-box adversarial attacks for remote sensing data on both scene classification and semantic segmentation tasks.

• Adversarial attack methods:
  • FGSM
  • I-FGSM
  • C&W
  • TPGD
  • Jitter
  • Mixup-Attack
  • Mixcut-Attack
• Scene classification models:
  • AlexNet
  • VGG11, VGG16, VGG19
  • Inception-v3
  • ResNet18, ResNet50, ResNet101
  • ResNeXt50, ResNeXt101
  • DenseNet121, DenseNet169, DenseNet201
  • RegNetX-400MF, RegNetX-8GF, RegNetX-16GF
• Semantic segmentation models:
  • FCN-32s, FCN-16s, FCN-8s
  • DeepLab-v2
  • DeepLab-v3+
  • SegNet
  • ICNet
  • ContextNet
  • SQNet
  • PSPNet
  • U-Net
  • LinkNet
  • FRRNet-A, FRRNet-B

    Preparation

• Package requirements: The scripts in this repo are tested with torch==1.10 and torchvision==0.11 using two NVIDIA Tesla V100 GPUs.
• Remote sensing datasets used in this repo:
  • UCM dataset
  • AID dataset
  • Vaihingen dataset
  • Zurich Summer dataset
• Data folder structure
  • The data folder is structured as follows:

    ├── <THE-ROOT-PATH-OF-DATA>/
    │   ├── UCMerced_LandUse/     
    |   |   ├── Images/
    |   |   |   ├── agricultural/
    |   |   |   ├── airplane/
    |   |   |   |── ...
    │   ├── AID/     
    |   |   ├── Airport/
    |   |   ├── BareLand/
    |   |   |── ...
    │   ├── Vaihingen/     
    |   |   ├── img/
    |   |   ├── gt/
    |   |   ├── ...
    │   ├── Zurich/    
    |   |   ├── img/
    |   |   ├── gt/
    |   |   ├── ...
    │   ├── UAE-RS/    
    |   |   ├── UCM/
    |   |   ├── AID/
    |   |   ├── Vaihingen/
    |   |   ├── Zurich/

• Pretraining the models for scene classification

  CUDA_VISIBLE_DEVICES=0,1 python pretrain_cls.py --network 'alexnet' --dataID 1 --root_dir <THE-ROOT-PATH-OF-DATA>
  CUDA_VISIBLE_DEVICES=0,1 python pretrain_cls.py --network 'resnet18' --dataID 1 --root_dir <THE-ROOT-PATH-OF-DATA>
  CUDA_VISIBLE_DEVICES=0,1 python pretrain_cls.py --network 'inception' --dataID 1 --root_dir <THE-ROOT-PATH-OF-DATA>
  ...

• Pretraining the models for semantic segmentation

  cd ./segmentation
  CUDA_VISIBLE_DEVICES=0 python pretrain_seg.py --model 'fcn8s' --dataID 1 --root_dir <THE-ROOT-PATH-OF-DATA>
  CUDA_VISIBLE_DEVICES=0 python pretrain_seg.py --model 'deeplabv2' --dataID 1 --root_dir <THE-ROOT-PATH-OF-DATA>
  CUDA_VISIBLE_DEVICES=0 python pretrain_seg.py --model 'segnet' --dataID 1 --root_dir <THE-ROOT-PATH-OF-DATA>
  ...

  Please replace <THE-ROOT-PATH-OF-DATA> with the local path where you store the remote sensing datasets.

  Adversarial attacks on scene classification

• Generate adversarial examples:

  CUDA_VISIBLE_DEVICES=0 python attack_cls.py --surrogate_model 'resnet18' \
                                          --attack_func 'fgsm' \
                                          --dataID 1 \
                                          --root_dir <THE-ROOT-PATH-OF-DATA>

• Performance evaluation on the adversarial test set:

  CUDA_VISIBLE_DEVICES=0 python test_cls.py --surrogate_model 'resnet18' \
                                        --target_model 'inception' \
                                        --attack_func 'fgsm' \
                                        --dataID 1 \
                                        --root_dir <THE-ROOT-PATH-OF-DATA>

  You can change parameters --surrogate_model, --attack_func, and --target_model to evaluate the performance with different attacking scenarios.

  Adversarial attacks on semantic segmentation

• Generate adversarial examples:

  cd ./segmentation
  CUDA_VISIBLE_DEVICES=0 python attack_seg.py --surrogate_model 'fcn8s' \
                                          --attack_func 'fgsm' \
                                          --dataID 1 \
                                          --root_dir <THE-ROOT-PATH-OF-DATA>

• Performance evaluation on the adversarial test set:

  CUDA_VISIBLE_DEVICES=0 python test_seg.py --surrogate_model 'fcn8s' \
                                        --target_model 'segnet' \
                                        --attack_func 'fgsm' \
                                        --dataID 1 \
                                        --root_dir <THE-ROOT-PATH-OF-DATA>

  You can change parameters --surrogate_model, --attack_func, and --target_model to evaluate the performance with different attacking scenarios.

  Performance evaluation on the UAE-RS dataset

• Scene classification:

  CUDA_VISIBLE_DEVICES=0 python test_cls_uae_rs.py --target_model 'inception' \
                                               --dataID 1 \
                                               --root_dir <THE-ROOT-PATH-OF-DATA>

  Scene classification results of different deep neural networks on the clean and UAE-RS test sets:

• Semantic segmentation:

  cd ./segmentation
  CUDA_VISIBLE_DEVICES=0 python test_seg_uae_rs.py --target_model 'segnet' \
                                               --dataID 1 \
                                               --root_dir <THE-ROOT-PATH-OF-DATA>

  Semantic segmentation results of different deep neural networks on the clean and UAE-RS test sets:

Paper

Universal adversarial examples in remote sensing: Methodology and benchmark

Please cite the following paper if you use the data or the code:

@article{uaers,
  title={Universal adversarial examples in remote sensing: Methodology and benchmark}, 
  author={Xu, Yonghao and Ghamisi, Pedram},
  journal={IEEE Trans. Geos. Remote Sens.},  
  volume={60},
  pages={1--15},
  year={2022},
}

Acknowledgement

The authors would like to thank Prof. Shawn Newsam for making the UCM dataset public available, Prof. Gui-Song Xia for providing the AID dataset, the International Society for Photogrammetry and Remote Sensing (ISPRS), and the German Society for Photogrammetry, Remote Sensing and Geoinformation (DGPF) for providing the Vaihingen dataset, and Dr. Michele Volpi for providing the Zurich Summer dataset.

Efficient-Segmentation-Networks

segmentation_models.pytorch

Adversarial-Attacks-PyTorch

License

This repo is distributed under MIT License. The UAE-RS dataset can be used for academic purposes only.