Recent advances in artificial intelligence (AI) have significantly intensified research in the geoscience and remote sensing (RS) field. AI algorithms, especially deep learning-based ones, have been developed and applied widely to RS data analysis. The successful application of AI covers almost all aspects of Earth-observation (EO) missions, from low-level vision tasks like superresolution, denoising, and inpainting, to high-level vision tasks like scene classification, object detection, and semantic segmentation. Although AI techniques enable researchers to observe and understand the earth more accurately, the vulnerability and uncertainty of AI models deserve further attention, considering that many geoscience and RS tasks are highly safety critical. This article reviews the current development of AI security in the geoscience and RS field, covering the following five important aspects: adversarial attack, backdoor attack, federated learning (FL), uncertainty, and explainability. Moreover, the potential opportunities and trends are discussed to provide insights for future research. To the best of the authors’ knowledge, this article is the first attempt to provide a systematic review of AI security-related research in the geoscience and RS community. Available code and datasets are also listed in the article to move this vibrant field of research forward.

Deep-learning-based image-recognition systems have been widely deployed on mobile devices in today’s world. In recent studies, however, deep learning models are shown vulnerable to adversarial examples. One variant of adversarial examples, called the adversarial patch, draws researchers’ attention due to its strong attack abilities. Though adversarial patches achieve high attack success rates, they are easily being detected because of the visual inconsistency between the patches and the original images. Besides, it usually requires a large amount of data for adversarial patch generation in the literature, which is computationally expensive and time consuming. To tackle these challenges, we propose an approach to generate inconspicuous adversarial patches with one single image. In our approach, we first decide the patch locations based on the perceptual sensitivity of victim models, then produce adversarial patches in a coarse-to-fine way by utilizing multiple-scale generators and discriminators. The patches are encouraged to be consistent with the background images with adversarial training while preserving strong attack abilities. Our approach shows the strong attack abilities in white-box settings and the excellent transferability in black-box settings through extensive experiments on various models with different architectures and training methods. Compared to other adversarial patches, our adversarial patches hold the most negligible risks to be detected and can evade human observations, which is supported by the illustrations of saliency maps and results of user evaluations. Finally, we show that our adversarial patches can be applied in the physical world.

Researchers are focusing on the vulnerabilities of deep learning models for remote sensing; various attack methods have been proposed, including universal adversarial examples. Existing universal adversarial examples, however, are only designed to fool deep learning models rather than target specific goals, i.e., targeted attacks. To this end, we propose two variants of universal adversarial examples called targeted universal adversarial examples and source-targeted universal adversarial examples. Extensive experiments on three popular datasets showed strong attackability of the two targeted adversarial variants. We hope such strong attacks can inspire and motivate research on the defenses against adversarial examples in remote sensing.

Knowledge distillation is an effective approach to transfer knowledge across models. Existing distillation methods for image classification are primarily focusing on transferring knowledge for recognizing natural images but ignoring the models’ robustness to adversarial examples. To benchmark the knowledge distillation methods on transferring adversarial robustness, we conduct an empirical study on eight popular distillation methods with adversarially robust teacher models, showing that student models can hardly inherit adversarial robustness from teacher models through existing methods. To alleviate such limitation, we propose a novel Guided Adversarial Contrastive Distillation (GACD) to transfer adversarial robustness from the teacher to students through latent representations. Specifically, given a robust teacher model, student models are trained adversarially to extract representations that align with the teacher. We adopt a re-weighting strategy during distillation so that student models can learn from teacher models wisely. To the best of our knowledge, GACD is the first attempt to simultaneously transfer knowledge and adversarial robustness from teacher to student models through latent representations. By extensive experiments evaluating student models on several popular datasets such as CIFAR-10 and CIFAR-100, we demonstrate that GACD can effectively transfer robustness across different models and achieve comparable or better results than existing methods. We also fine-tune the models on different tasks and show encouraging results, demonstrating the transferability of learned representations. Lastly, we visualize the latent representations of different student models for qualitative analysis.

Deep learning methods have been proven effective in remote sensing image analysis and interpretation, where semantic segmentation plays a vital role. These deep segmentation methods are susceptible to adversarial attacks, while most of the existing attack methods tend to manipulate the image globally, leading to noticeable perturbations and chaotic segmentation. In this work, we propose a novel Stealthy Attack for Semantic Segmentation (SASS), which can largely increase the effectiveness and stealthiness from the existing attack methods on remote sensing images. SASS manipulates specific victim classes or objects of interest while preserving the original segmentation results for other classes or objects. In practice, as different inference mechanisms, overlapped inference, can be applied in segmentation, the efficacy of SASS may be degraded. To this end, we further introduce the Masked Stealthy Attack for Semantic Segmentation (MSASS), which generates augmented adversarial perturbations that only affect victim areas. We evaluate the effectiveness of SASS and MSASS using four state-of-the-art semantic segmentation models on the Vaihingen and Zurich Summer datasets. Extensive experiments demonstrate that our SASS and MSASS methods achieve superior attack performances on victim areas while maintaining high accuracies of other areas (drop less than 2%). The detection success rates of adversarial examples for segmentation, as characterized by Xiao et al . [1], significantly drop from 97.78% for the untargeted PGD attack to 28.71% for our MSASS method on Zurich Summer dataset. Our work contributes to the field of adversarial attacks in semantic segmentation for remote sensing images by improving stealthiness, flexibility, and robustness. We anticipate that our findings will inspire the development of defense methods to enhance the security and reliability of semantic segmentation models against our stealthy attack.

The vulnerability of deep neural networks against adversarial attacks, i.e ., imperceptible adversarial perturbations can easily give rise to wrong predictions, poses a huge threat to the security of their real-world deployments. In this paper, a novel Adversarial Detection method via Disentangling Natural images and Perturbations (ADDNP) is proposed. Compared to natural images that can typically be modeled by lower-dimensional subspaces or manifolds, the distributions of adversarial perturbations are much more complex, e.g ., one normal example’s adversarial counterparts generated by different attack strategies can be significantly distinct. The proposed ADDNP exploits such distinct properties for the detection of adversarial attacks amongst normal examples. Specifically, we use a dual-branch disentangling framework to encode natural images and perturbations of inputs separately, followed by joint reconstruction. During inference, the reconstruction discrepancy (RD) measured in the learned latent feature space is used as an indicator of adversarial perturbations. The proposed ADDNP algorithm is evaluated on three popular datasets, i.e ., CIFAR-10, CIFAR-100, and mini ImageNet with increasing data complexity, across multiple popular attack strategies. Compared to the existing and state-of-the-art detection methods, ADDNP has demonstrated promising performance on adversarial detection, with significant improvements on more challenging datasets.