Lie to Me: A Soft Threshold Defense Method for Adversarial Examples of Remote Sensing Images

Adversarial examples fool the models into predicting wrong results through generated perturbations, demonstrating the vulnerability of convolutional neural networks (CNNs). Recent studies also show that many CNNs applied to remote sensing image (RSI) scene classification are still subject to adversarial example attacks. Through further analysis of adversarial examples of RSIs, it is found that the misclassified classes are not random, and these adversarial examples have demonstrated attack selectivity. Based on this finding, we propose a soft threshold defense method. First, we take the images with the correct prediction of each class as positive samples and adversarial examples as negative samples. Then, we take their output confidence as input and get the decision boundaries by the logistic regression algorithm. Finally, the confidence threshold of each class can be further obtained based on the decision boundary. It is the soft threshold used for defense, which can determine whether the image is an adversarial example or not. When the model predicts the new RSI, the input is an original image if the output confidence is higher than the soft threshold of the corresponding class, and the opposite is an adversarial example. Our proposed algorithm does not require modification of the model structure and is computationally uncomplicated, and it is simple and effective. For the FGSM, BIM, Deepfool, and C&W attack algorithms, their fooling rates are reduced by an average of 97.76%, 99.77%, 68.18%, and 97.95% in several scenarios. The soft threshold defense method can effectively defend against adversarial examples.

Automated summary

Adversarial examples generated through perturbations deceive models into predicting incorrect results, showcasing the vulnerability of CNNs. Research indicates that adversarial example attacks are prevalent in remote sensing image scene classification, exhibiting selectivity in misclassification. A proposed soft threshold defense method efficiently distinguishes adversarial examples based on decision boundaries, reducing fooling rates significantly in various attack scenarios.