Physically-Induced Atmospheric Adversarial Perturbations: Enhancing Transferability and Robustness in Remote Sensing Image Classification

2026-04-16

AI Summary

This work addresses the limitations of existing adversarial attacks on remote sensing imagery, which predominantly rely on pixel-level perturbations that fail to emulate realistic atmospheric degradations, resulting in poor transferability and robustness. To overcome this, the authors propose FogFool, a novel framework that incorporates atmospheric physical properties into adversarial attack generation for the first time. By leveraging Perlin noise to model natural fog-like low- and mid-frequency spatial-phase perturbations and iteratively optimizing for physical plausibility, FogFool produces highly effective adversarial examples. Evaluated on two remote sensing benchmark datasets, the method achieves an 83.74% black-box attack success rate—significantly outperforming current approaches—and demonstrates strong robustness against common defenses such as JPEG compression and filtering. Furthermore, class activation mapping (CAM) visualizations reveal the underlying attention shift mechanism induced by the attack.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web

Abstract

Adversarial attacks pose a severe threat to the reliability of deep learning models in remote sensing (RS) image classification. Most existing methods rely on direct pixel-wise perturbations, failing to exploit the inherent atmospheric characteristics of RS imagery or survive real-world image degradations. In this paper, we propose FogFool, a physically plausible adversarial framework that generates fog-based perturbations by iteratively optimizing atmospheric patterns based on Perlin noise. By modeling fog formations with natural, irregular structures, FogFool generates adversarial examples that are not only visually consistent with authentic RS scenes but also deceptive. By leveraging the spatial coherence and mid-to-low-frequency nature of atmospheric phenomena, FogFool embeds adversarial information into structural features shared across diverse architectures. Extensive experiments on two benchmark RS datasets demonstrate that FogFool achieves superior performance: not only does it exceed in white-box settings, but also exhibits exceptional black-box transferability (reaching 83.74% TASR) and robustness against common preprocessing-based defenses such as JPEG compression and filtering. Detailed analyses, including confusion matrices and Class Activation Map (CAM) visualizations, reveal that our atmospheric-driven perturbations induce a universal shift in model attention. These results indicate that FogFool represents a practical, stealthy, and highly persistent threat to RS classification systems, providing a robust benchmark for evaluating model reliability in complex environments.

Problem

• adversarial attacks
• remote sensing
• atmospheric perturbations
• transferability
• robustness

Innovation

• physically plausible adversarial attack
• atmospheric perturbation
• Perlin noise
• transferability
• remote sensing image classification