Improving adversarial robustness in remote sensing scene classification via non-local feature decoupling and soft self-attention masking recalibration

Despite the tremendous success of Deep Neural Networks (DNNs) in Remote Sensing (RS) scene classification, their vulnerability to adversarial examples leads to significant performance degradation, which can severely impact the accuracy of tasks such as RS scene classification. Therefore, it is essential to conduct a comprehensive study of the impact of adversarial attacks on RS scene classification and to develop effective defense methods to ensure the security of these tasks. In this article, we proposed a novel defense framework, named Non-local feature Decoupling and Soft-thresholding Masking (NDSM), to purify adversarial perturbations in adversarial samples. The Non-local feature Decoupling (ND) module decouples the intermediate feature map into robust and non-robust features by using denoising blocks containing non-local means operations as feature decoupling modules. The Soft-threshold Masking (SM) module further suppresses features with insignificant correlation by soft-thresholding the output of the self-attention matrix, selectively extracting valuable information for classification from non-robust features, and combining it with robust features to obtain a reconstructed robust feature map. The proposed NDSM has demonstrated its effectiveness in purifying various adversarial attacks and achieving superior defense performance on three RS classification benchmark datasets, namely UC Merced (UCM), Aerial Image Dataset (AID), and NWPU-RESISC45, when confronted with both known and unknown attacks.