An Adaptive Physical-World Adversarial Patch for Remote Sensing Image Object Detection Models Considering the Structural Characteristics

Abstract

Remote sensing image object detection represents a typical application in the field of remote sensing image processing. Rapid advancements in artificial intelligence have established deep learning as a prevalent method for detecting critical targets, such as aircraft, vehicles, and vessels, in remote sensing imagery. However, empirical evidence indicates that deep learning networks frequently exhibit vulnerabilities that minimal pixel perturbations in digital images can compromise their output. Adversarial attack techniques exploit this vulnerability by adding imperceptible perturbations to input data, causing erroneous outputs in deep learning models, which compromises object detection accuracy. Such attacks could be applied in military or civilian domains, such as enhancing airport security systems to prevent confidential information leaks. However, existing physical attack methods in remote sensing are limited by their lack of consideration for dynamic factors such as target characteristics and distortions. This article introduces an adaptive adversarial attack framework with emphasis on representative targets such as aircraft, which generates aircraft-attachable patches by incorporating target-specific structural characteristics. The research especially designed cross-shaped patches and improved the loss function by incorporating gradient variance loss and image quality assessment loss to enhance the physical-world transferability of the generated adversarial patches. Comprehensive validation experiments were conducted in both digital and physical domains, for which different classical object detection methods are chosen as the target models. Results demonstrate that the adversarial patch generated by our method achieve effective attacks in digital environments and can be seamlessly transferred to physical scenarios, significantly degrading detection capabilities, where the average attack effectiveness reached 32.99% in the digital domain and 62.52% in the physical domain. This substantiates the practical potential of our proposed framework and future work could extend this methodology to autonomous driving and related fields.