A remote sensing image adversarial sample detection method based on spectral features

Abstract

This invention specifically provides a method for detecting adversarial examples in remote sensing images based on spectral features, comprising: acquiring remote sensing images and performing discrete wavelet transform decomposition on the images to obtain low-frequency and high-frequency components; enhancing the high-frequency components by introducing enhancement coefficients to weight and amplify the high-frequency information, highlighting the differential features of adversarial perturbations in the frequency domain; constructing a dual-stream feature extraction structure, including a high-frequency branch and a low-frequency branch; the high-frequency branch is used to extract the enhanced high-frequency perturbation features, and the low-frequency branch is used to obtain the predicted confidence gradient features based on the low-frequency components; fusing the high-frequency perturbation features and the low-frequency confidence gradient features to obtain a joint feature representation, which is then input into a detection network to obtain and output the discrimination results between adversarial examples and clean examples. This invention can effectively improve the detection accuracy of adversarial examples in scenarios with small perturbations and enhance the security and robustness of remote sensing image classification systems.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence technology, and in particular relates to the application of deep learning technology in remote sensing image recognition, specifically a method for detecting adversarial examples in remote sensing images based on spectral features. Background Technology

[0002] With the rapid development of remote sensing technology and deep learning methods, remote sensing image classification has been widely used in fields such as ecological monitoring, resource surveys, and disaster early warning. Intelligent interpretation technology for remote sensing images based on convolutional neural networks and related models can extract high-level semantic information from complex scenes, significantly improving classification accuracy and automation.

[0003] However, existing deep learning models exhibit significant vulnerability to adversarial examples. Attackers can induce models to output incorrect classification results by adding tiny and imperceptible perturbations to the input image, thereby affecting the accuracy and reliability of remote sensing interpretation. In remote sensing scenarios, due to the characteristics of complex backgrounds, large target scale variations, and significant long-distance spatial dependencies, adversarial perturbations are more easily hidden in image details, making adversarial example detection even more difficult.

[0004] Currently, defense methods against adversarial examples mainly include adversarial training, adversarial example detection, and adversarial example cleanup. Among these, adversarial example detection methods have attracted widespread attention due to their flexibility and deployability, as they do not require modification of the original classification model structure. However, most existing detection methods are derived from the natural image domain and fail to fully consider the frequency domain characteristics of remote sensing images. This makes it difficult to effectively capture adversarial perturbation features in scenarios with small perturbations, resulting in low detection accuracy.

[0005] Furthermore, adversarial perturbations in remote sensing images are often concentrated in high-frequency detail regions, while traditional methods do not make sufficient use of high-frequency information and fail to effectively amplify the differences between adversarial examples and clean examples. At the same time, existing methods mostly rely on single features for discrimination and lack the ability to jointly model image frequency domain information and model decision information, which limits further improvement in detection performance. Summary of the Invention

[0006] The purpose of this invention is to provide a method for detecting adversarial examples in remote sensing images based on spectral features, aiming to solve the technical problems that existing detection methods cannot effectively capture weak adversarial disturbances and have low detection accuracy.

[0007] To achieve the above objectives, the present invention provides the following technical solution.

[0008] According to an embodiment of the present invention, a method for detecting adversarial examples in remote sensing images based on spectral features is provided, comprising the following steps:

[0009] Remote sensing images are acquired and decomposed using discrete wavelet transform to obtain low-frequency and high-frequency components. The low-frequency components are used to characterize the basic semantic information of the image, while the high-frequency components are used to characterize the details.

[0010] The high-frequency components are enhanced by introducing enhancement coefficients to weight and amplify the high-frequency information, highlighting the difference characteristics of the anti-disturbance in the frequency domain;

[0011] A dual-stream feature extraction structure is constructed, including a high-frequency branch and a low-frequency branch; the high-frequency branch is used to extract enhanced high-frequency perturbation features, and the low-frequency branch is used to obtain prediction confidence gradient features based on low-frequency components.

[0012] The high-frequency perturbation features are fused with the low-frequency confidence gradient features to obtain a joint feature representation, which is then input into the detection network to obtain the discrimination results between adversarial examples and clean examples and output them.

[0013] Furthermore, the step of performing discrete wavelet transform decomposition on the remote sensing image includes:

[0014] Preprocessed image Perform a single-level Haar discrete wavelet transform on a channel-by-channel basis;

[0015] Specifically, a one-dimensional wavelet transform is performed on each row of the image to separate low-frequency and high-frequency information in the row direction;

[0016] Perform a one-dimensional wavelet transform on each column to separate low-frequency and high-frequency information in the column direction; output four single-channel components, including a low-frequency approximation component. Horizontal high-frequency components Vertical high frequency components and diagonal high frequency components ;

[0017] For images After decomposing the RGB three channels separately, the low-frequency components of the three channels are obtained by splicing them together. With three-channel high-frequency components The high-frequency components are represented as: .

[0018] Furthermore, the steps of performing a single-level Haar discrete wavelet transform channel by channel include:

[0019] For two-dimensional image signals The discrete wavelet transform achieves decomposition through two sets of orthogonal basis functions, expressed as:

[0020]

[0021]

[0022] In the formula, Represents the scaling function. Represents the wavelet function; To decompose the scale, This indicates a single-level decomposition; m and n are spatial location indices. , Represents high-frequency levels, Represents vertical high frequency, Represents diagonal high frequencies.

[0023] Furthermore, the step of enhancing the high-frequency components includes:

[0024] The original high-frequency components are The enhancement coefficient is The enhanced high-frequency components are , is represented as:

[0025]

[0026] The enhancement coefficient was determined through ablation experiments. ;

[0027] Only for high-frequency components Execution enhancement, low-frequency components Remain unchanged;

[0028] After enhancement, pixel cropping is performed on high-frequency components;

[0029] The three channels share the same enhancement factor, enhancing the high-frequency components. Compared with the original low-frequency components Combine the components and perform the inverse discrete wavelet transform (IDWT) to obtain the high-frequency enhanced image. , is represented as:

[0030]

[0031] In the formula, This represents the enhanced horizontal high-frequency components. This represents the enhanced vertical high-frequency component. This represents the enhanced diagonal high-frequency component.

[0032] Furthermore, in the high-frequency branch, the high-frequency branch is used for the extraction of enhanced high-frequency features. Based on the high-frequency region where the adversarial disturbance is located, disturbance features are extracted, specifically including:

[0033] From the enhanced image The high-frequency components are extracted again using wavelet transform. ;

[0034] The high-frequency feature map is input into the high-frequency sub-network, and the high-frequency perturbation feature vector is output to characterize the intensity, distribution and morphology of the perturbation.

[0035] Furthermore, in the low-frequency branch, the low-frequency branch is used to extract the confidence gradient features. The low-frequency branch uses the low-frequency semantic computing model of the image to predict the gradient of the confidence and capture the model's decision sensitivity to perturbations.

[0036] In the calculation of prediction confidence, low-frequency components are input into the pre-trained classification model. To obtain the model output logic value , is represented as: ,in, This represents the total number of remote sensing scene categories. Low-frequency components;

[0037] The Softmax function is used to convert the logical values ​​into class prediction probabilities. , is represented as:

[0038]

[0039] In the formula, i represents the category index. ; This represents the summation index for all categories during the Softmax normalization process; This represents the i-th class logical value output by the classification model; This represents the j-th class logical value output by the classification model; This represents the predicted probability that the input sample belongs to the i-th class;

[0040] The confidence loss function L uses cross-entropy and is expressed as:

[0041]

[0042] In the formula, This represents the value of the one-hot vector corresponding to the model's predicted label in the i-th class, where the i-th class is the model's predicted class. =1, otherwise =0;

[0043] Calculate loss Regarding low-frequency components The gradient is used to obtain the prediction confidence gradient map. gradient map The sensitivity of the model's prediction results to changes in input is characterized by:

[0044]

[0045] In the formula, This represents the low-frequency approximation component obtained by discrete wavelet transform, used to preserve the basic semantic information, land feature outlines, and global structural features of remote sensing images; This represents the cross-entropy loss function.

[0046] Furthermore, the joint feature representation is obtained through the following steps:

[0047] Input the gradient map G into the low-frequency sub-network and output the low-frequency confidence gradient feature. ;

[0048] High-frequency disturbance characteristics Low-frequency gradient features The execution channels are spliced ​​and merged to obtain joint features. The joint features simultaneously include explicit features of frequency domain perturbation and implicit features of model decision. Represented as: , This indicates feature splicing and fusion.

[0049] Furthermore, the splicing and fusion adopts an adaptive weighted fusion method; wherein, the adaptive weighted fusion achieves dynamic weight allocation by setting a first learnable hyperparameter and a second learnable hyperparameter, including:

[0050] A first response value is obtained by performing global feature mapping on the high-frequency perturbation feature map using a first learnable hyperparameter;

[0051] The second response value is obtained by performing global feature mapping on the low-frequency confidence gradient feature map using the second learnable hyperparameter;

[0052] The first and second response values ​​are normalized to generate high-frequency weighting coefficients and low-frequency weighting coefficients. The high-frequency weighting coefficients are used to weight the high-frequency perturbation feature map, and the low-frequency weighting coefficients are used to weight the low-frequency confidence gradient feature map. The two weighted feature maps are added element by element to obtain a fused feature map with the same number of channels.

[0053] Furthermore, the detection network is a lightweight binary classification detection network for remote sensing adversarial example detection tasks, including a remote sensing scene perception feature extraction module, a scene attention enhancement module, and a classification and discrimination module;

[0054] in:

[0055] The remote sensing scene perception feature extraction module includes multiple parallel feature extraction branches. Each branch uses convolutional feature extraction units of different scales to process the input features in order to obtain perturbation response features at different scales.

[0056] The scene attention enhancement module adopts a channel attention mechanism, which generates importance weights for each channel through global feature aggregation and recalibrates the input features to obtain enhanced features;

[0057] The classification and discrimination module performs global feature aggregation on the enhanced features to obtain a discriminative feature representation; then, the prediction result is output through the classification layer.

[0058] Furthermore, in the detection network, a scene-adaptive discrimination strategy is introduced to dynamically adjust the detection threshold based on the texture complexity and information uncertainty of the input sample. Discrimination is then performed based on the relationship between the dynamic threshold T' and the predicted probability Padv: when... If the input sample is deemed adversarial, it is considered an adversarial sample; otherwise, it is considered a clean sample.

[0059] Compared with existing technologies, the beneficial effects of the remote sensing image adversarial example detection method based on spectral features of this invention are:

[0060] The detection method of the present invention decomposes remote sensing images by performing discrete wavelet transform to obtain low-frequency components and high-frequency components; wherein, the low-frequency components are used to characterize the basic semantic information of the image, and the high-frequency components are used to characterize the details; by introducing a frequency domain decomposition mechanism, the high- and low-frequency information of the remote sensing image is effectively decoupled, so that the anti-disturbance is more clearly expressed in the frequency domain.

[0061] This invention enhances high-frequency components by introducing enhancement coefficients to weight and amplify high-frequency information, highlighting the differential characteristics of adversarial perturbations in the frequency domain. Through high-frequency component enhancement strategies, it effectively amplifies the characteristics of weak adversarial perturbations, significantly improving the detection capability in small perturbation attack scenarios.

[0062] This invention constructs a dual-stream feature extraction structure. The high-frequency branch is used to extract enhanced high-frequency perturbation features, while the low-frequency branch is used to obtain prediction confidence gradient features based on low-frequency components. By constructing a dual-stream detection structure that integrates high-frequency perturbation features and low-frequency confidence gradient features, collaborative modeling of frequency domain information and model decision information is achieved, improving detection accuracy and robustness. Finally, the high-frequency perturbation features and low-frequency confidence gradient features are fused to obtain a joint feature representation, which is then input into the detection network to obtain the discrimination results between adversarial examples and clean examples.

[0063] In summary, compared with existing detection methods, this invention can effectively improve the detection accuracy of adversarial examples in scenarios with small perturbations, and enhance the security and robustness of remote sensing image classification systems. Attached Figure Description

[0064] The accompanying drawings, which form part of this application, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0065] In the attached diagram:

[0066] Figure 1 This is a flowchart illustrating the implementation of a remote sensing image adversarial example detection method based on spectral features according to the present invention.

[0067] Figure 2 This is a flowchart illustrating the adversarial example detection method for remote sensing images based on spectral features according to the present invention.

[0068] Figure 3 This is a schematic diagram of the frequency domain decomposition and high-frequency component enhancement process based on discrete wavelet transform in an embodiment of the present invention;

[0069] Figure 4 This is a schematic diagram of the low-frequency component confidence gradient extraction process in an embodiment of the present invention. Detailed Implementation

[0070] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0071] This invention addresses the problem of strong concealment of adversarial perturbations and difficulty in detecting small perturbations in remote sensing images by constructing an adversarial sample detection mechanism that combines frequency domain feature enhancement and multi-feature fusion.

[0072] Specifically:

[0073] This invention performs discrete wavelet transform on the input remote sensing image to decouple the high-frequency and low-frequency components of the image.

[0074] Secondly, high-frequency information is amplified through a high-frequency component enhancement strategy to highlight the characteristic differences of the counter-disturbance in the frequency domain.

[0075] This invention further constructs a dual-stream detection architecture, which extracts enhanced high-frequency perturbation features on the one hand and predictive confidence gradient features from low-frequency components on the other hand, and fuses the two types of features.

[0076] Finally, the fused features are input into the detection network to distinguish between adversarial and clean samples.

[0077] This invention requires no modification to the existing remote sensing image classification model structure and can be flexibly integrated as a front-end module, exhibiting good versatility and scalability. Compared to existing methods, this invention can effectively improve the accuracy of adversarial example detection in scenarios with small perturbations, enhancing the security and robustness of the remote sensing image classification system.

[0078] The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

[0079] like Figure 1 and Figure 2 As shown, this is a preferred embodiment of the present invention, in which a method for detecting adversarial examples in remote sensing images based on spectral features is provided;

[0080] The detection method specifically includes the following steps:

[0081] Step S101: Acquire a remote sensing image and perform discrete wavelet transform decomposition on the remote sensing image to obtain low-frequency components and high-frequency components; wherein, the low-frequency components are used to characterize the basic semantic information of the image, and the high-frequency components are used to characterize the details.

[0082] In step S101, before performing frequency domain decomposition and feature extraction, the input remote sensing image is first standardized preprocessed to eliminate distribution differences caused by different imaging conditions, illumination, and resolution, ensuring the stability of subsequent frequency domain operations;

[0083] Furthermore, the image pixel values ​​are normalized from [0,255] to the [0,1] range. If the input image is not 256×256, bicubic interpolation is used to scale the image to the standard size to avoid scale distortion during frequency domain decomposition.

[0084] The RGB three-channel structure remains unchanged, and grayscale operation is not performed to preserve the color and texture features of land features in the remote sensing image;

[0085] After preprocessing, the standard input image I is obtained, which serves as the input data for the discrete wavelet transform.

[0086] Furthermore, in step S101, the step of performing discrete wavelet transform decomposition on the remote sensing image includes: processing the preprocessed image... Perform a single-level Haar discrete wavelet transform channel by channel; specifically, perform a one-dimensional wavelet transform on each row of the image to separate low-frequency and high-frequency information in the row direction; perform a one-dimensional wavelet transform on each column to separate low-frequency and high-frequency information in the column direction; output four single-channel components, including a low-frequency approximation component. Horizontal high-frequency components Vertical high frequency components and diagonal high frequency components ;

[0087] For images After decomposing the RGB three channels separately, the low-frequency components of the three channels are obtained by splicing them together. With three-channel high-frequency components The high-frequency components are represented as: .

[0088] Furthermore, the steps of performing a single-level Haar discrete wavelet transform channel by channel include:

[0089] For two-dimensional image signals The discrete wavelet transform achieves decomposition through two sets of orthogonal basis functions, expressed as:

[0090]

[0091]

[0092] In the formula, Represents the scaling function. Represents the wavelet function; To decompose the scale, This indicates a single-level decomposition; m and n are spatial location indices. , Represents high-frequency levels, Represents vertical high frequency, Represents diagonal high frequencies.

[0093] This invention employs Haar Discrete Wavelet Transform (Haar DWT) to perform single-level frequency domain decomposition, decoupling remote sensing images into low-frequency approximate components and three-directional high-frequency detail components. This accurately separates the image's fundamental semantics from the high-frequency regions where adversarial disturbances reside, solving the problem that traditional spatial domain methods cannot capture minute disturbances.

[0094] In this embodiment:

[0095] Low-frequency approximate components It can preserve the basic semantics of the image, the outline of ground features, the global structure, and the corresponding low-frequency information of the image;

[0096] Horizontal high frequency components Capable of capturing horizontal edges and texture details of an image;

[0097] Vertical high frequency components It can capture the vertical edges and texture details of an image;

[0098] Diagonal high frequency components It can capture texture, noise, and disturbance information in the diagonal direction of an image.

[0099] The characteristics of the disturbance are concentrated in the high-frequency region and have randomness, locality and imperceptibility. Therefore, the wavelet transform of this invention can naturally separate the disturbance from the clean semantics.

[0100] This invention decomposes the RGB three channels separately and then splices them together to obtain the three-channel low-frequency components. With three-channel high-frequency components The decomposition results are visualized as follows: Figure 3 As shown, the high-frequency components of clean samples contain only normal texture noise, while the high-frequency components of adversarial samples contain obvious abnormal perturbation signals, providing a basis for subsequent detection.

[0101] Please continue to refer to Figure 1 and Figure 2 The present invention provides a remote sensing image adversarial example detection method based on spectral features, which further includes the following steps:

[0102] Step S102: Enhance the high-frequency components by introducing enhancement coefficients to weight and amplify the high-frequency information, highlighting the difference characteristics of the anti-disturbance in the frequency domain;

[0103] To address the problem that minute adversarial perturbations are visually invisible and have weak feature differences, this invention designs a high-frequency component linear enhancement strategy. This strategy amplifies the perturbation features in the high-frequency region without compromising low-frequency semantics, significantly improving the detector's ability to recognize minute perturbations. To this end, the high-frequency component enhancement process includes the following steps:

[0104] The original high-frequency components are The enhancement coefficient is The enhanced high-frequency components are , is represented as: ;

[0105] in: To enhance the mode, Attenuation mode;

[0106] Preferably, in this embodiment of the invention, the optimal enhancement coefficient is determined through ablation experiments. This allows the present invention to achieve the best balance between amplifying disturbances and suppressing noise.

[0107] Furthermore, the enhancement rule is as follows: only for high-frequency components. Execution enhancement, low-frequency components The image remains unchanged to avoid disrupting its fundamental semantics; after enhancement, pixel cropping is performed on high-frequency components to ensure that the numerical range remains within [0,1], preventing numerical overflow that could lead to feature distortion; the three channels share the same enhancement coefficient to ensure feature consistency between channels.

[0108] Enhanced high-frequency components Compared with the original low-frequency components Combine the images and perform inverse discrete wavelet transform (IDWT) to obtain the high-frequency enhanced image. , is represented as:

[0109]

[0110] In the formula, This represents the enhanced horizontal high-frequency components. This represents the enhanced vertical high-frequency component. This represents the enhanced diagonal high-frequency components;

[0111] This transformation operation maps the frequency domain amplified perturbation features back to the spatial domain, transforming the originally imperceptible minute perturbations into explicit feature differences that can be captured by the detection network, while preserving the original semantic structure of the image and not affecting subsequent classification tasks.

[0112] Please continue to refer to Figure 1 and Figure 2 The present invention, a remote sensing image adversarial example detection method based on spectral features, further includes:

[0113] Step S103: Construct a dual-stream feature extraction structure, including a high-frequency branch and a low-frequency branch; the high-frequency branch is used to extract enhanced high-frequency perturbation features, and the low-frequency branch is used to obtain prediction confidence gradient features based on low-frequency components.

[0114] This invention constructs a dual-stream detection architecture consisting of a high-frequency feature stream and a low-frequency gradient stream. It also utilizes frequency domain perturbation features and model decision-sensitive features to achieve accurate discrimination of adversarial examples, thus solving the problem of insufficient robustness of single-feature discrimination.

[0115] In the high-frequency branch, the high-frequency branch is used for the extraction of enhanced high-frequency features. Based on the high-frequency region where the adversarial perturbation is located, perturbation features are extracted, specifically including:

[0116] From the enhanced image The high-frequency components are extracted again using wavelet transform. ;

[0117] The high-frequency feature map is input into the high-frequency subnetwork (which has the same structure and independent parameters as the low-frequency subnetwork) and outputs a high-frequency perturbation feature vector, which is used to characterize the intensity, distribution and morphology of the perturbation. This is the core basis for distinguishing adversarial examples from clean examples.

[0118] In the low-frequency branch, the low-frequency branch is used to extract the prediction confidence gradient features. The low-frequency branch uses the low-frequency semantic calculation model of the image to predict the gradient of the confidence, capturing the model's decision sensitivity to perturbations. The specific process is as follows: Figure 4 As shown.

[0119] In the calculation of prediction confidence, low-frequency components are input into the pre-trained classification model. To obtain the model output logic value , is represented as: ,in, This represents the total number of remote sensing scene categories. Low-frequency components;

[0120] The Softmax function is used to convert the logical values ​​into class prediction probabilities. , is represented as:

[0121]

[0122] In the formula, i represents the category index. ; This represents the summation index for all categories during the Softmax normalization process; This represents the i-th class logical value output by the classification model; This represents the j-th class logical value output by the classification model; This represents the predicted probability that the input sample belongs to the i-th class;

[0123] Furthermore, the confidence loss function L in this invention adopts cross-entropy, and is expressed as:

[0124]

[0125] In the formula, This represents the value of the one-hot vector corresponding to the model's predicted label in the i-th class, where the i-th class is the model's predicted class. =1, otherwise =0;

[0126] Calculate loss Regarding low-frequency components The gradient is used to obtain the prediction confidence gradient map. gradient map Gradient plot is used to characterize the sensitivity of the model's prediction results to changes in input. Represented as:

[0127]

[0128] In the formula, This represents the low-frequency approximation component obtained by discrete wavelet transform, used to preserve the basic semantic information, land feature outlines, and global structural features of remote sensing images; This represents the cross-entropy loss function.

[0129] In this invention, the gradient distribution of adversarial examples exhibits abnormal clustering and abrupt amplitude changes, while the gradient distribution of clean examples is uniform and the amplitude is flat, which can be used as strong discriminative features.

[0130] Step S104: Fuse the high-frequency perturbation features with the low-frequency confidence gradient features to obtain a joint feature representation, and input it into the detection network to obtain the discrimination results of adversarial examples and clean samples and output them.

[0131] Furthermore, the joint feature representation is obtained through the following steps:

[0132] Input the gradient map G into the low-frequency sub-network and output the low-frequency confidence gradient feature. ;

[0133] High-frequency disturbance characteristics Low-frequency gradient features The execution channels are spliced ​​and merged to obtain joint features. The joint features simultaneously include explicit features of frequency domain perturbation and implicit features of model decision. Represented as:

[0134] ;

[0135] in, Indicates feature splicing and fusion. It is the set of real numbers.

[0136] Furthermore, the splicing and fusion adopts an adaptive weighted fusion method, which dynamically fuses high-frequency perturbation features and low-frequency confidence gradient features through learnable weights. Specifically, the adaptive weighted fusion achieves dynamic weight allocation by setting a first learnable hyperparameter and a second learnable hyperparameter.

[0137] A first response value is obtained by performing global feature mapping on the high-frequency perturbation feature map using a first learnable hyperparameter;

[0138] The second response value is obtained by performing global feature mapping on the low-frequency confidence gradient feature map using the second learnable hyperparameter;

[0139] The first and second response values ​​are normalized to generate high-frequency weighting coefficients and low-frequency weighting coefficients. The high-frequency weighting coefficients are used to weight the high-frequency perturbation feature map, and the low-frequency weighting coefficients are used to weight the low-frequency confidence gradient feature map. The two weighted feature maps are added element by element to obtain a fused feature map with the same number of channels.

[0140] Preferably, the first learnable hyperparameter and the second learnable hyperparameter are jointly optimized during the training of the detection model, so that the high-frequency weight coefficient and the low-frequency weight coefficient can be automatically adjusted according to the perturbation strength of the input sample, the scene complexity and the feature contribution degree, so as to strengthen the dominant role of high-frequency perturbation features when there is strong perturbation, emphasize low-frequency confidence gradient features when there is weak and hidden perturbation, and balance the weights of the two features when there are clean samples.

[0141] Specifically, high-frequency disturbance characteristics: Low-frequency gradient features: After undergoing global average pooling (GAP), the corresponding channel description vectors are obtained, as follows:

[0142]

[0143]

[0144] in: ;

[0145] Feature compression is performed using the corresponding fully connected mapping layer:

[0146]

[0147]

[0148] in: For the first set of learnable parameters, This is the second set of learnable parameters;

[0149] Furthermore, Softmax normalization is performed on the obtained response values:

[0150]

[0151]

[0152] in, , satisfy: Ultimately, by utilizing , The high-frequency perturbation features and low-frequency gradient features are fused to obtain the final fused features. Represented as:

[0153]

[0154] In this way, the model can adaptively adjust the weight ratio of high-frequency perturbation information and low-frequency decision information according to the perturbation intensity, scene complexity and feature contribution in the current input sample, so as to achieve dynamic feature fusion.

[0155] This invention abandons the traditional static fusion method of fixed splicing, element-by-element addition, or manual weight setting. Instead, it adopts an adaptive weighted fusion strategy where the model learns the weight allocation autonomously. By setting two learnable hyperparameters, the detection model automatically adjusts the proportion of high-frequency perturbation features and low-frequency gradient features in the final judgment based on the strength of perturbation in the input sample, scene complexity, and feature contribution during training. This eliminates the need for manual weight setting. It can strengthen the dominant role of high-frequency perturbation features when facing strong perturbation attacks, rely more on low-frequency confidence gradient features to achieve accurate judgment when facing weak and hidden perturbations, and balance the weights of the two features to reduce the probability of misjudgment when receiving clean sample inputs. Compared with the shortcomings of simple channel splicing, which greatly increases feature dimensionality and computational cost, element-by-element addition, which can easily cause key perturbation information to be buried, and fixed weight fusion, which cannot adapt to various attack scenarios, this method is superior.

[0156] Furthermore, the adaptive feature fusion method adopted in this invention can retain the effective discriminative information of the two features to the maximum extent without increasing the feature dimension. It can dynamically adapt to different types and intensities of adversarial attacks and diverse remote sensing ground object scenarios, significantly improving the detection stability and generalization ability of the model under small perturbations, complex backgrounds, and cross-dataset and cross-model conditions. At the same time, it can effectively suppress redundant feature interference and overfitting risks, taking into account both detection accuracy and the need for lightweight model deployment.

[0157] Furthermore, this invention abandons the traditional static fusion method of fixed splicing, element-by-element addition, or manual weight setting, and adopts an adaptive weighted fusion strategy in which the model learns the weight allocation autonomously. By setting two learnable hyperparameters, the detection model automatically adjusts the proportion of high-frequency perturbation features and low-frequency gradient features in the final discrimination based on the strength of perturbation in the input samples, scene complexity, and feature contribution during the training process. There is no need to manually set the weight ratio, and the feature emphasis can be dynamically switched under different perturbation conditions.

[0158] Compared to the drawbacks of simple channel splicing, which increases feature dimensionality and computational overhead, causes key perturbation information to be buried due to element-by-element addition, and fixed-weight fusion cannot adapt to various attack scenarios, the adaptive fusion method of this invention can retain effective discrimination information to the maximum extent without increasing feature dimensionality, dynamically adapt to various adversarial attacks and remote sensing scenarios, suppress redundant feature interference and overfitting risks, significantly improve detection stability and generalization ability under small perturbations and complex backgrounds, and take into account both detection accuracy and lightweight deployment requirements.

[0159] Furthermore, the detection network is a lightweight binary classification detection network designed for remote sensing adversarial example detection tasks, including a remote sensing scene perception feature extraction module, a scene attention enhancement module, and a classification and discrimination module. The lightweight binary classification detection network is used to achieve adversarial example discrimination. The network is an improvement on the classic visual backbone network, which can well adapt to dual-stream fusion feature input. While ensuring feature representation capabilities, it simplifies the structure, reduces inference time, and better meets the engineering requirements of real-time remote sensing image detection.

[0160] The detection network uses a binary cross-entropy loss function as its optimization objective and employs an adaptive optimizer for training. It does not rely on large-scale labeled data or complex training strategies, and features high training efficiency, stable convergence, and strong generalization. During the inference phase, the network takes fused features as input and outputs the judgment result of adversarial examples or clean examples based on a discrimination threshold. It has low forward computation and can be stably embedded into practical interpretation systems.

[0161] During training, clean samples are labeled as negative class samples, and adversarial samples are labeled as positive class samples. Input samples first pass through a frequency domain enhancement module, a high-frequency perturbation feature extraction module, and a low-frequency gradient feature extraction module to obtain dual-stream feature representations. Then, an adaptive fusion module generates fused features, which are input into the detection network to complete forward prediction. Finally, backpropagation is performed based on binary cross-entropy loss to jointly optimize the parameters of the fusion module and the detection network, thereby achieving the training of the remote sensing adversarial sample detection model.

[0162] The fusion feature First, input the remote sensing scene perception feature extraction module;

[0163] Considering the significant differences in the scale of ground objects in remote sensing images, the complexity of the background, and the fact that adversarial disturbances are easily hidden in texture details, the remote sensing scene perception feature extraction module adopts a multi-scale feature extraction strategy to encode the fused features under different receptive fields, so as to simultaneously capture local disturbance information and large-scale scene structure information, thereby improving the model's ability to represent complex ground object textures, small-scale disturbances, and long-distance spatial dependencies.

[0164] Preferably, the remote sensing scene perception feature extraction module includes multiple parallel feature extraction branches. Each branch uses convolutional feature extraction units of different scales to process the input features to obtain perturbation response features at different scales. Let the output feature of the i-th branch be... Then the multi-scale features are represented as:

[0165]

[0166] in, This indicates a feature concatenation operation, where n represents the number of feature extraction branches.

[0167] Subsequently, the multi-scale feature F ms Input scene attention enhancement module.

[0168] Considering the complex background, abundant redundant information, and varying sensitivities to adversarial perturbations in different regions of remote sensing images, the scene attention enhancement module adaptively adjusts the feature response intensity based on the importance of different feature channels and scene regions to adversarial sample discrimination, thereby strengthening key perturbation features and suppressing background noise interference.

[0169] Preferably, the scene attention enhancement module is implemented using a channel attention mechanism, which generates importance weights for each channel through global feature aggregation and recalibrates the input features to obtain the enhanced feature representation:

[0170]

[0171] in: This represents the attention weight generation function; This indicates a feature-weighted operation; This represents the enhanced scene perception features.

[0172] Subsequently, the features will be enhanced. The input classification and discrimination module includes a feature aggregation layer, a classification layer, and a regularization module, which is used to output the prediction result of whether the input sample belongs to an adversarial sample or a clean sample.

[0173] Preferably, the classification and discrimination module first performs global feature aggregation on the enhanced features to obtain the discriminative feature representation; then, it outputs the prediction results through the classification layer; at the same time, a regularization mechanism is introduced to reduce the risk of model overfitting and improve the model's generalization ability in different remote sensing scenarios.

[0174] Furthermore, considering the differences in the complexity of ground features and the distribution of adversarial disturbances in different remote sensing scenarios, this invention adopts a scene-adaptive discrimination strategy, dynamically adjusting the detection threshold based on the texture complexity and information uncertainty of the input samples. Let the scene complexity index be:

[0175]

[0176] in, The variance of the enhanced features is used to measure the complexity of scene textures; Information entropy, representing the enhanced features, is used to characterize scene uncertainty; and This is the adjustment coefficient.

[0177] The dynamic discrimination threshold is expressed as: Where T is the basic discrimination threshold; This is the adjustment coefficient; The threshold is used for scene-adaptive discrimination.

[0178] Ultimately based on the predicted probability P adv The relationship with the dynamic threshold T' is used to determine: when If the input sample is deemed adversarial, it is considered an adversarial sample; otherwise, it is considered a clean sample.

[0179] This invention integrates explicit features of frequency domain perturbation with sensitive features of model decision-making, and combines remote sensing scene perception feature extraction, scene attention enhancement, and scene adaptive discrimination mechanism. While ensuring detection accuracy, it effectively reduces model complexity and improves detection stability and generalization ability in complex remote sensing scenes, small perturbation attacks, and cross-model conditions. It is more suitable for real-time adversarial sample detection tasks in remote sensing images.

[0180] In a preferred embodiment, the multi-scale feature extraction module is implemented using convolutional structures of different scales; the scene attention enhancement module is implemented using a channel attention mechanism; and the classification and discrimination module uses a regularization mechanism to improve the robustness of the model.

[0181] The detection method proposed in this invention consists of five modules that work in sequence and collaboratively: discrete wavelet frequency domain decomposition, high-frequency component enhancement, dual-stream feature extraction, adaptive feature fusion, and detection network discrimination. These modules form a complete closed-loop detection process without requiring modification of the original remote sensing image classification model structure and can be directly embedded into existing systems as an independent pre-detection unit.

[0182] The discrete wavelet decomposition module effectively separates high- and low-frequency information in the image, the high-frequency enhancement module amplifies weak perturbation features, the dual-stream feature module completes multi-dimensional discrimination information mining, the adaptive fusion module realizes dynamic feature weighting, and the detection module completes the final discrimination output. The overall architecture is simple and efficient, with strong engineering feasibility and system compatibility.

[0183] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting adversarial examples in remote sensing images based on spectral features, characterized in that, Includes the following steps: Remote sensing images are acquired and decomposed using discrete wavelet transform to obtain low-frequency and high-frequency components. The low-frequency components are used to characterize the basic semantic information of the image, while the high-frequency components are used to characterize the details. The high-frequency components are enhanced by introducing enhancement coefficients to weight and amplify the high-frequency information, highlighting the difference characteristics of the anti-disturbance in the frequency domain; A dual-stream feature extraction structure is constructed, including a high-frequency branch and a low-frequency branch; the high-frequency branch is used to extract enhanced high-frequency perturbation features, and the low-frequency branch is used to obtain prediction confidence gradient features based on low-frequency components. The high-frequency perturbation features are fused with the low-frequency confidence gradient features to obtain a joint feature representation, which is then input into the detection network to obtain the discrimination results between adversarial examples and clean examples and output them.

2. The method for detecting adversarial examples in remote sensing images based on spectral features according to claim 1, characterized in that, The step of performing discrete wavelet transform decomposition on the remote sensing image includes: Preprocessed image Perform a single-level Haar discrete wavelet transform on a channel-by-channel basis; Specifically, a one-dimensional wavelet transform is performed on each row of the image to separate low-frequency and high-frequency information in the row direction; Perform a one-dimensional wavelet transform on each column to separate low-frequency and high-frequency information in the column direction; output four single-channel components, including a low-frequency approximation component. Horizontal high-frequency components Vertical high frequency components and diagonal high frequency components ; For images After decomposing the RGB three channels separately, the low-frequency components of the three channels are obtained by splicing them together. With three-channel high-frequency components The high-frequency components are represented as: .

3. The method for detecting adversarial examples in remote sensing images based on spectral features according to claim 2, characterized in that, The steps for performing a single-level Haar discrete wavelet transform channel by channel include: For two-dimensional image signals The discrete wavelet transform achieves decomposition through two sets of orthogonal basis functions, expressed as: In the formula, Represents the scaling function. Represents the wavelet function; To decompose the scale, This indicates a single-level decomposition; m and n are spatial location indices. , Represents high-frequency levels, Represents vertical high frequency, Represents diagonal high frequencies.

4. The method for detecting adversarial examples in remote sensing images based on spectral features according to claim 2 or 3, characterized in that, The step of enhancing the high-frequency components includes: The enhancement coefficient was determined by ablation experiments, and the original high-frequency components were enhanced using the enhancement coefficient. Among them, only high-frequency components Execution enhancement, low-frequency components Remain unchanged; After enhancement, pixel cropping is performed on high-frequency components; The three channels share the same enhancement coefficient. The enhanced high-frequency components are combined with the original low-frequency components, and the inverse discrete wavelet transform (IDWT) is performed to obtain the high-frequency enhanced image. , represented as: In the formula, This represents the enhanced horizontal high-frequency components. This represents the enhanced vertical high-frequency component. This represents the enhanced diagonal high-frequency component.

5. The method for detecting adversarial examples in remote sensing images based on spectral features according to claim 4, characterized in that, In the high-frequency branch, the high-frequency branch is used for the extraction of enhanced high-frequency features. Based on the high-frequency region where the adversarial perturbation is located, perturbation features are extracted, specifically including: From the enhanced image The high-frequency components are extracted again using wavelet transform. ; The high-frequency feature map is input into the high-frequency sub-network, and the high-frequency perturbation feature vector is output to characterize the intensity, distribution and morphology of the perturbation.

6. The method for detecting adversarial examples in remote sensing images based on spectral features according to claim 2, characterized in that, In the low-frequency branch, the low-frequency branch is used to extract the confidence gradient feature. The low-frequency branch uses the low-frequency semantic computing model of the image to predict the gradient of the confidence and capture the model's decision sensitivity to perturbations. In calculating the prediction confidence, low-frequency components are input into the pre-trained classification model. To obtain the model output logic value , represented as: ,in, Represents the set of real numbers. This represents the total number of remote sensing scene categories. For low-frequency components; the logical values ​​are converted into class prediction probabilities using the Softmax function. ; The confidence loss function L uses cross-entropy; Calculate loss Regarding low-frequency components The gradient is used to obtain the prediction confidence gradient map. gradient map Used to characterize how sensitive the model's prediction results are to changes in the input.

7. The method for detecting adversarial examples in remote sensing images based on spectral features according to claim 6, characterized in that, The joint feature representation is obtained through the following steps: Input the gradient map G into the low-frequency sub-network and output the low-frequency confidence gradient feature. ; High-frequency disturbance characteristics Low-frequency gradient features The execution channels are spliced ​​and merged to obtain joint features. The joint features simultaneously include explicit features of frequency domain perturbation and implicit features of model decision.

8. The method for detecting adversarial examples in remote sensing images based on spectral features according to claim 7, characterized in that, The splicing and fusion adopts an adaptive weighted fusion method; wherein, the adaptive weighted fusion achieves dynamic weight allocation by setting a first learnable hyperparameter and a second learnable hyperparameter, including: A first response value is obtained by performing global feature mapping on the high-frequency perturbation feature map using a first learnable hyperparameter; The second response value is obtained by performing global feature mapping on the low-frequency confidence gradient feature map using the second learnable hyperparameter; The first and second response values ​​are normalized to generate high-frequency weighting coefficients and low-frequency weighting coefficients. The high-frequency weighting coefficients are used to weight the high-frequency perturbation feature map, and the low-frequency weighting coefficients are used to weight the low-frequency confidence gradient feature map. The two weighted feature maps are then added element by element to obtain a fused feature map with the same number of channels.

9. The method for detecting adversarial examples in remote sensing images based on spectral features according to claim 8, characterized in that, The detection network is a lightweight binary classification detection network for remote sensing adversarial example detection tasks, including a remote sensing scene perception feature extraction module, a scene attention enhancement module, and a classification and discrimination module; in: The remote sensing scene perception feature extraction module includes multiple parallel feature extraction branches. Each branch uses convolutional feature extraction units of different scales to process the input features in order to obtain perturbation response features at different scales. The scene attention enhancement module adopts a channel attention mechanism, which generates importance weights for each channel through global feature aggregation and recalibrates the input features to obtain enhanced features; The classification and discrimination module performs global feature aggregation on the enhanced features to obtain a discriminative feature representation; then, the prediction result is output through the classification layer.

10. The method for detecting adversarial examples in remote sensing images based on spectral features according to claim 9, characterized in that, In the detection network, a scene-adaptive discrimination strategy is introduced to dynamically adjust the detection threshold based on the texture complexity and information uncertainty of the input samples. This is achieved by using the dynamic threshold T' and the predicted probability P. adv Determine the relationship: when When this happens, the input sample is determined to be an adversarial sample; Otherwise, the input sample is determined to be a clean sample.

Images