Multi-patch Adversarial Attack for Remote Sensing Image Classification.

Deep Neural Networks (DNNs) have shown excellent image classification performance both in accuracy and efficiency. Therefore, it is of great value to deploy adversarial patch to protect critical facilities from DNNs-based scene classification in Remote Sensing Image (RSI). However, adversarial patch attack for RSI scene classification has not been investigated. The existing adversarial patch attack methods are designed for natural images and need to generate a single large adversarial patch which is of too large size to be physically feasible for RSI applications. In this paper, we propose a Multi-Patch Adversarial Attack (MPAA) method for RSI scene classification task. We propose to deploy multiple small adversarial patches on key locations and formulate the problem as a constrained optimization problem which jointly optimize patch locations and adversarial patches. The proposed MPAA takes a searching and optimization strategy to tackle it and consists of an Effective Location Selection module and a Patch Optimization module. Extensive experimental results on Aerial Image Dataset show that the proposed MPAA achieves 96.98% attacking success rate by using 16 small patches where each patch only occupies 0.0625% of the image size, which significantly outperforms other adversarial patch methods.