{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:35:35Z","timestamp":1760146535988,"version":"build-2065373602"},"reference-count":59,"publisher":"MDPI AG","issue":"22","license":[{"start":{"date-parts":[[2024,11,16]],"date-time":"2024-11-16T00:00:00Z","timestamp":1731715200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Remote Sensing"],"abstract":"<jats:p>Deep neural networks (DNNs) have achieved great success in various computer vision tasks. However, they are susceptible to artificially designed adversarial perturbations, which limit their deployment in security-critical applications. In this paper, we propose a gradual adversarial training (GAT) method for remote sensing image segmentation. Our method incorporates a domain-adaptive mechanism that dynamically modulates input data, effectively reducing adversarial perturbations. GAT not only improves segmentation accuracy on clean images but also significantly enhances robustness against adversarial attacks, all without necessitating changes to the network architecture. The experimental results demonstrate that GAT consistently outperforms conventional standard adversarial training (SAT), showing increased resilience to adversarial attacks of varying intensities on both optical and Synthetic Aperture Radar (SAR) images. Compared to the SAT defense method, GAT achieves a notable defense performance improvement of 1% to 12%.<\/jats:p>","DOI":"10.3390\/rs16224277","type":"journal-article","created":{"date-parts":[[2024,11,19]],"date-time":"2024-11-19T06:06:54Z","timestamp":1731996414000},"page":"4277","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["A Gradual Adversarial Training Method for Semantic Segmentation"],"prefix":"10.3390","volume":"16","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6153-2033","authenticated-orcid":false,"given":"Yinkai","family":"Zan","sequence":"first","affiliation":[{"name":"National Key Laboratory of Microwave Imaging, Aerospace Information Research Institute, Chinese Academy of Sciences, Beijing 100190, China"},{"name":"School of Electronic, Electrical and Communication Engineering, University of Chinese Academy of Sciences, Beijing 100049, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1486-7580","authenticated-orcid":false,"given":"Pingping","family":"Lu","sequence":"additional","affiliation":[{"name":"National Key Laboratory of Microwave Imaging, Aerospace Information Research Institute, Chinese Academy of Sciences, Beijing 100190, China"},{"name":"School of Electronic, Electrical and Communication Engineering, University of Chinese Academy of Sciences, Beijing 100049, China"}]},{"given":"Tingyu","family":"Meng","sequence":"additional","affiliation":[{"name":"National Key Laboratory of Microwave Imaging, Aerospace Information Research Institute, Chinese Academy of Sciences, Beijing 100190, China"}]}],"member":"1968","published-online":{"date-parts":[[2024,11,16]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Rony, J., Pesquet, J.C., and Ben Ayed, I. (2023, January 18\u201322). Proximal splitting adversarial attack for semantic segmentation. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.01966"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Wang, Z., Yang, H., Feng, Y., Sun, P., Guo, H., Zhang, Z., and Ren, K. (2023, January 18\u201322). Towards transferable targeted adversarial examples. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.01967"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Williams, P.N., and Li, K. (2023, January 18\u201322). Black-box sparse adversarial attack via multi-objective optimisation. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.01183"},{"key":"ref_4","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2013). Intriguing properties of neural networks. arXiv."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Maslovskiy, A., Vasilets, V., Nechitaylo, S., and Sukharevsky, O. (2019, January 2\u20136). The Antiradar Camouflage Method for Ground Military Objects. Proceedings of the 2019 IEEE 2nd Ukraine Conference on Electrical and Computer Engineering (UKRCON), Lviv, Ukraine.","DOI":"10.1109\/UKRCON.2019.8879815"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"2447","DOI":"10.1109\/LAWP.2021.3114302","article-title":"Investigation of radar cross-section reduction for dihedral corner reflectors based on camouflage grass","volume":"20","author":"He","year":"2021","journal-title":"IEEE Antennas Wirel. Propag. Lett."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"226866","DOI":"10.1109\/ACCESS.2020.3045753","article-title":"Surface susceptibility synthesis of metasurface skins\/holograms for electromagnetic camouflage\/illusions","volume":"8","author":"Smy","year":"2020","journal-title":"IEEE Access"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3594869","article-title":"Interpreting adversarial examples in deep learning: A review","volume":"55","author":"Han","year":"2023","journal-title":"ACM Comput. Surv."},{"key":"ref_9","first-page":"15","article-title":"Deceiving ai","volume":"64","author":"Monroe","year":"2021","journal-title":"Commun. ACM"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Siegelmann, H. (2019, February 06). Defending Against Adversarial Artificial Intelligence. Technical Report. Available online: https:\/\/www.darpa.mil\/news-events\/2019-02-06.","DOI":"10.4236\/oalib.1105221"},{"key":"ref_11","unstructured":"Nicolae, M.I., Sinn, M., Tran, M.N., Buesser, B., Rawat, A., Wistuba, M., Zantedeschi, V., Baracaldo, N., Chen, B., and Ludwig, H. (2018). Adversarial Robustness Toolbox v1. 0.0. arXiv."},{"key":"ref_12","unstructured":"Sreeram, A., Mehlman, N., Peri, R., Knox, D., and Narayanan, S. (2021). Perceptual-based deep-learning denoiser as a defense against adversarial attacks on ASR systems. arXiv."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"4811","DOI":"10.1109\/TIFS.2021.3116438","article-title":"Study of Pre-Processing Defenses Against Adversarial Attacks on State-of-the-Art Speaker Recognition Systems","volume":"16","author":"Joshi","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_14","unstructured":"Lo, S.Y. (2023). Robust Computer Vision Against Adversarial Examples and Domain Shifts. [Ph.D. Thesis, Johns Hopkins University]."},{"key":"ref_15","unstructured":"Chen, J., Wu, X., Guo, Y., Liang, Y., and Jha, S. (2021). Towards evaluating the robustness of neural networks learned by transduction. arXiv."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Jiang, Z., Villalba, J., and Dehak, N. (2020, January 25\u201329). Black-Box Attacks on Spoofing Countermeasures Using Transferability of Adversarial Examples. Proceedings of the Interspeech, Shanghai, China.","DOI":"10.21437\/Interspeech.2020-2834"},{"key":"ref_17","unstructured":"Cherepanova, V., Goldblum, M., Foley, H., Duan, S., Dickerson, J., Taylor, G., and Goldstein, T. (2021). Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition. arXiv."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"4280328","DOI":"10.1155\/2021\/4280328","article-title":"A novel defensive strategy for facial manipulation detection combining bilateral filtering and joint adversarial training","volume":"2021","author":"Luo","year":"2021","journal-title":"Secur. Commun. Netw."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"2194","DOI":"10.1109\/TCAD.2020.3033746","article-title":"Attack-aware detection and defense to resist adversarial examples","volume":"40","author":"Jiang","year":"2020","journal-title":"IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst."},{"key":"ref_20","unstructured":"Xie, C., Wang, J., Zhang, Z., Ren, Z., and Yuille, A. (2017). Mitigating adversarial effects through randomization. arXiv."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"231","DOI":"10.1109\/TNSE.2021.3057071","article-title":"Detecting adversarial samples for deep learning models: A comparative study","volume":"9","author":"Zhang","year":"2021","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Cao, X., and Gong, N.Z. (2017, January 4\u20138). Mitigating evasion attacks to deep neural networks via region-based classification. Proceedings of the 33rd Annual Computer Security Applications Conference, Orlando, FL, USA.","DOI":"10.1145\/3134600.3134606"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"86","DOI":"10.1145\/3468507.3468519","article-title":"Adversarial attacks and defenses: An interpretation perspective","volume":"23","author":"Liu","year":"2021","journal-title":"ACM SIGKDD Explor. Newsl."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Wei, Z., Wang, Y., Guo, Y., and Wang, Y. (2023, January 18\u201322). Cfa: Class-wise calibrated fair adversarial training. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.00792"},{"key":"ref_25","unstructured":"Boenisch, F., Sperl, P., and B\u00f6ttinger, K. (2021). Gradient masking and the underestimated robustness threats of differential privacy in deep learning. arXiv."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Tomar, D., Vray, G., Bozorgtabar, B., and Thiran, J.P. (2023, January 18\u201322). Tesla: Test-time self-learning with automatic adversarial augmentation. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.01948"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Qiu, S., Liu, Q., Zhou, S., and Wu, C. (2019). Review of artificial intelligence adversarial attack and defense technologies. Appl. Sci., 9.","DOI":"10.3390\/app9050909"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"6367","DOI":"10.1109\/TPAMI.2024.3381180","article-title":"Improving fast adversarial training with prior-guided knowledge","volume":"46","author":"Jia","year":"2024","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_29","unstructured":"Bae, H., Jang, J., Jung, D., Jang, H., Ha, H., Lee, H., and Yoon, S. (2018). Security and privacy issues in deep learning. arXiv."},{"key":"ref_30","unstructured":"Dhillon, G.S., Azizzadenesheli, K., Lipton, Z.C., Bernstein, J., Kossaifi, J., Khanna, A., and Anandkumar, A. (2018). Stochastic activation pruning for robust adversarial defense. arXiv."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"203","DOI":"10.18178\/ijmlc.2018.8.3.688","article-title":"Gradient masking is a type of overfitting","volume":"8","author":"Yanagita","year":"2018","journal-title":"Int. J. Mach. Learn. Comput."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"5306","DOI":"10.1109\/TPAMI.2024.3365699","article-title":"Adversarial attack and defense in deep ranking","volume":"46","author":"Zhou","year":"2024","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Wu, X., Jha, S., and Swami, A. (2016, January 23\u201325). Distillation as a defense to adversarial perturbations against deep neural networks. Proceedings of the 2016 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2016.41"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"109955","DOI":"10.1016\/j.patcog.2023.109955","article-title":"Attack-invariant attention feature for adversarial defense in hyperspectral image classification","volume":"145","author":"Shi","year":"2024","journal-title":"Pattern Recognit."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"109902","DOI":"10.1016\/j.patcog.2023.109902","article-title":"Jacobian norm with selective input gradient regularization for interpretable adversarial defense","volume":"145","author":"Liu","year":"2024","journal-title":"Pattern Recognit."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Lo, S.Y., and Patel, V.M. (2024). Adaptive Batch Normalization Networks for Adversarial Robustness. arXiv.","DOI":"10.1109\/AVSS61716.2024.10672619"},{"key":"ref_37","unstructured":"Hamidi, S.M., and Ye, L. (2024). Adversarial Training via Adaptive Knowledge Amalgamation of an Ensemble of Teachers. arXiv."},{"key":"ref_38","unstructured":"Zhang, K., Weng, J., Luo, Z., and Li, S. (2024). Towards Adversarial Robustness via Debiased High-Confidence Logit Alignment. arXiv."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"1711","DOI":"10.1109\/TIP.2019.2940533","article-title":"Image super-resolution as a defense against adversarial attacks","volume":"29","author":"Mustafa","year":"2019","journal-title":"IEEE Trans. Image Process."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Yu, S., and Wang, S. (2023, January 6\u20138). Multi-intermediate Feature with Multi-stage Fusion for Domain Adaptive Person Re-ID. Proceedings of the 2023 6th International Conference on Image and Graphics Processing, Chongqing, China.","DOI":"10.1145\/3582649.3582672"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"109466","DOI":"10.1016\/j.patcog.2023.109466","article-title":"Adversarial pan-sharpening attacks for object detection in remote sensing","volume":"139","author":"Wei","year":"2023","journal-title":"Pattern Recognit."},{"key":"ref_42","first-page":"5623613","article-title":"DeMPAA: Deployable Multi-Mini-Patch Adversarial Attack for Remote Sensing Image Classification","volume":"62","author":"Huang","year":"2024","journal-title":"IEEE Trans. Geosci. Remote Sens."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Liu, L., Xu, Z., He, D., Yang, D., and Guo, H. (2023). Local pixel attack based on sensitive pixel location for remote sensing images. Electronics, 12.","DOI":"10.3390\/electronics12091987"},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"5614817","DOI":"10.1109\/TGRS.2024.3377009","article-title":"Stealthy Adversarial Examples for Semantic Segmentation in Remote Sensing","volume":"62","author":"Bai","year":"2024","journal-title":"IEEE Trans. Geosci. Remote Sens."},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Yu, Z., Yang, W., Xie, X., and Shi, Z. (2024, January 20\u201327). Attacks on Continual Semantic Segmentation by Perturbing Incremental Samples. Proceedings of the AAAI Conference on Artificial Intelligence, Vancouver, BC, Canada.","DOI":"10.1609\/aaai.v38i7.28509"},{"key":"ref_46","unstructured":"Agnihotri, S., Jung, S., and Keuper, M. (2024, January 21\u201327). CosPGD: An efficient white-box adversarial attack for pixel-wise prediction tasks. Proceedings of the Forty-First International Conference on Machine Learning, Vienna, Austria."},{"key":"ref_47","first-page":"17864","article-title":"Per-pixel classification is not all you need for semantic segmentation","volume":"34","author":"Cheng","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_48","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv."},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., and Yuille, A. (2017, January 22\u201329). Adversarial examples for semantic segmentation and object detection. Proceedings of the IEEE International Conference on Computer Vision, Venice, Italy.","DOI":"10.1109\/ICCV.2017.153"},{"key":"ref_50","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2017). Towards deep learning models resistant to adversarial attacks. arXiv."},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Gu, J., Zhao, H., Tresp, V., and Torr, P.H. (2022, January 23\u201327). Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness. Proceedings of the European Conference on Computer Vision, Tel Aviv, Israel.","DOI":"10.1007\/978-3-031-19818-2_18"},{"key":"ref_52","unstructured":"Kurakin, A., Goodfellow, I., and Bengio, S. (2016). Adversarial machine learning at scale. arXiv."},{"key":"ref_53","unstructured":"Malinin, A., and Gales, M. (2018). Prior networks for detection of adversarial attacks. arXiv."},{"key":"ref_54","doi-asserted-by":"crossref","unstructured":"Gong, Z., and Wang, W. (2023, January 18). Adversarial and clean data are not twins. Proceedings of the Sixth International Workshop on Exploiting Artificial Intelligence Techniques for Data Management, Seattle, WA, USA.","DOI":"10.1145\/3593078.3593935"},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Liu, X., Jiao, L., Liu, F., Zhang, D., and Tang, X. (2022, January 28\u201331). PolSF: PolSAR image datasets on san Francisco. Proceedings of the International Conference on Intelligence Science, Xi\u2019an, China.","DOI":"10.1007\/978-3-031-14903-0_23"},{"key":"ref_56","doi-asserted-by":"crossref","first-page":"1795","DOI":"10.1109\/JSTARS.2023.3322344","article-title":"Adversarial network with higher order potential conditional random field for PolSAR image classification","volume":"17","author":"Zhang","year":"2023","journal-title":"IEEE J. Sel. Top. Appl. Earth Obs. Remote Sens."},{"key":"ref_57","doi-asserted-by":"crossref","first-page":"181","DOI":"10.1007\/s44196-023-00364-w","article-title":"Semantic segmentation of high-resolution remote sensing images with improved U-Net based on transfer learning","volume":"16","author":"Zhang","year":"2023","journal-title":"Int. J. Comput. Intell. Syst."},{"key":"ref_58","doi-asserted-by":"crossref","first-page":"5317","DOI":"10.1109\/JSTARS.2024.3365664","article-title":"Unsupervised Semantic Segmentation of PolSAR Images Based on Multi-view Similarity","volume":"17","author":"Li","year":"2024","journal-title":"IEEE J. Sel. Top. Appl. Earth Obs. Remote Sens."},{"key":"ref_59","doi-asserted-by":"crossref","unstructured":"Zhang, S., Cui, L., Dong, Z., and An, W. (2024). A Deep Learning Classification Scheme for PolSAR Image Based on Polarimetric Features. Remote Sens., 16.","DOI":"10.20944\/preprints202404.0594.v1"}],"container-title":["Remote Sensing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2072-4292\/16\/22\/4277\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T16:33:46Z","timestamp":1760114026000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2072-4292\/16\/22\/4277"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,11,16]]},"references-count":59,"journal-issue":{"issue":"22","published-online":{"date-parts":[[2024,11]]}},"alternative-id":["rs16224277"],"URL":"https:\/\/doi.org\/10.3390\/rs16224277","relation":{},"ISSN":["2072-4292"],"issn-type":[{"type":"electronic","value":"2072-4292"}],"subject":[],"published":{"date-parts":[[2024,11,16]]}}}