The DOI matches its Crossref record; 12 of the 12 references it cites were found in a registry or an index.
From Pixel to Peril: Investigating Adversarial Attacks on Aerial Imagery Through Comprehensive Review and Prospective Trajectories
Open accessAbstract
Deep models’ feature learning capabilities have gained traction in recent years, driving significant progress in various Artificial Intelligence (AI) domains. The use of Deep Neural Networks (DNNs) has expanded the scope of Computer Vision (CV) and revealed their vulnerability to deliberate adversarial attacks. These attacks involve the careful introduction of perturbations crafted through complex optimization problems. Exploiting vulnerabilities in advanced deep neural network algorithms present security concerns, particularly in practical applications with high stakes like unmanned aerial vehicles (UAVs) and satellite imagery in computer vision. Adversarial attacks, both in digital and physical dimensions, pose a serious threat in the field. This research provides a comprehensive examination of state-of-the-art adversarial attacks specific to aerial imagery using autonomous platforms such as UAVs and satellites. This review covers fundamental concepts, techniques, and the latest advancements, identifying research gaps and suggesting future directions. It aims to deepen researchers’ understanding of the challenges and threats related to adversarial attacks on aerial imagery, serving as a valuable resource to guide future research and enhance the security of computer vision systems in aerial environments.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Afurther challenge is YOLO's vulnerability to adversarial attacks, which can manipulate the model by introducing imperceptible perturbations to input images [146].”
From The YOLO Framework: A Comprehensive Review of Evolution, Applications, and Benchmarks in Object Detection (2024) · cites this paper as [146]
Citations
Cites
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155
You Only Look Once: Unified, Real-Time Object Detection
Redmon, J., Divvala, S., Girshick, R., & Farhadi, A. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.91 · Cited by 53,803
Swin Transformer: Hierarchical Vision Transformer using Shifted Windows
Liu, Z., Lin, Y., Cao, Y., Hu, H., Wei, Y., Zhang, Z., Lin, S., & Guo, B. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00986 · Cited by 35,534
Jocher, G., Stoken, A., Borovec, J., NanoCode012, ChristopherSTAN, Changyu, L., Laughing, Hogan, A., Lorenzomammana, Tkianai, et al. (2020) · Zenodo · doi:10.5281/zenodo.3983579 · Cited by 2,738
Adversarial machine learning at scale
Kurakin, A., Goodfellow, I., & Bengio, S. (2016) · arXiv · doi:10.48550/arxiv.1611.01236 · Cited by 2,325
Learning RoI Transformer for Oriented Object Detection in Aerial Images
Ding, J., Xue, N., Long, Y., Xia, G.-S., & Lu, Q. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2019.00296 · Cited by 1,666
Benchmarking Neural Network Robustness to Common Corruptions and Perturbations
Hendrycks, D., & Dietterich, T. (2019) · arXiv · doi:10.48550/arxiv.1903.12261 · Cited by 1,335
Decision-based adversarial attacks: Reliable attacks against black-box machine learning models
Brendel, W., Rauber, J., & Bethge, M. (2017) · arXiv · doi:10.48550/arxiv.1712.04248 · Cited by 1,018
Cheng, G., Han, J., Zhou, P., & Guo, L. (2014) · ISPRS Journal of Photogrammetry and Remote Sensing · doi:10.1016/j.isprsjprs.2014.10.002 · Cited by 1,007 · cited 1×
“Yolo-family object detction models [182], [183], [185] and NWPU-VHR10 [157], DOTA [151] and RSOD [158] datasets were utilized during the study.”
MethodEvasion Attacks against Machine Learning at Test Time
Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šrndić, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-40994-3_25 · Cited by 890
PatternNet: A benchmark dataset for performance evaluation of remote sensing image retrieval
Zhou, W., Newsam, S., Li, C., & Shao, Z. (2018) · ISPRS Journal of Photogrammetry and Remote Sensing · doi:10.1016/j.isprsjprs.2018.01.004 · Cited by 571
A Large Contextual Dataset for Classification, Detection and Counting of Cars with Deep Learning
Mundhenk, T. N., Konjevod, G., Sakla, W. A., & Boakye, K. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-46487-9_48 · Cited by 386
Research works printed but not linked: 177
- 10.1109/PerCom45495.2020.9127389 · DOI
- 10.1109/TVT.2021.3061065 · DOI
- 10.1109/JIOT.2020.3016145 · DOI
- 10.1109/IV51971.2022.9827222 · DOI
- 10.3390/electronics9081284 · DOI
- 10.1007/s11042-019-7262-8 · DOI
- 10.1109/AIPR50011.2020.9425267 · DOI
- 10.1109/AIPR57179.2022.10092201 · DOI
- 10.1109/ACCESS.2020.3024149 · DOI
- wise, 2022, Developing imperceptible adversarial patches to camouflage military assets from computer vision enabled technologies, arXiv 2202 08892
- 10.1007/978-1-4842-6168-2_6 · DOI
- 10.1109/CVPR.2015.7298594 · DOI · Paper page
- 10.24963/ijcai.2021/173 · DOI
- 10.3390/electronics12091987 · DOI
- 10.1007/978-3-030-87664-7_7 · DOI
- 10.1016/j.neucom.2023.03.050 · DOI
- 10.1109/TGRS.2022.3183022 · DOI
- 10.1109/TGRS.2023.3264839 · DOI
- 10.1109/TGRS.2022.3225306 · DOI
- 10.1109/TGRS.2023.3273287 · DOI
- 10.1109/CVPRW.2019.00012 · DOI
- 10.1007/978-3-030-58558-7_39 · DOI
- 10.1109/CVPR.2019.00790 · DOI
- cherepanova, 2021, LowKey: Leveraging adversarial attacks to protect social media users from facial recognition, arXiv 2101 07922
- wei, 2022, Physical adversarial attacks and defenses in computer vision: A survey, arXiv 2211 01671
- 10.1109/CVPR.2016.282 · DOI · Paper page
- lei, 2022, Using frequency attention to make adversarial patch powerful against person detector, arXiv 2205 04638
- simonyan, 2014, Very deep convolutional networks for large-scale image recognition, arXiv 1409 1556
- 10.1609/aaai.v35i4.16477 · DOI
- 10.1016/j.patrec.2021.04.004 · DOI
- 10.1061/(ASCE)IS.1943-555X.0000477 · DOI
- 10.1007/s42452-021-04897-7 · DOI
- 10.1016/B978-0-12-818464-6.00006-8 · DOI
- 10.1007/978-3-031-09753-9_7 · DOI
- 10.1016/j.compag.2021.106014 · DOI
- 10.3390/rs13030516 · DOI
- steven, 2013, Applications of Remote Sensing in Agriculture
- abid, 2022, A review on the application of remote sensing and geographic information system in flood crisis management, Proc Conf Broad Exposure Sci Technol, 1
- 10.1609/aaai.v36i2.20141 · DOI
- liu, 2016, SSD: Single shot multibox detector, Proc 14th Eur Conf, 21
- 10.1109/CVPR46437.2021.00846 · DOI
- 10.1109/SP.2017.49 · DOI · Paper page
- lee, 2019, On physical adversarial patches for object detection, arXiv 1906 11897
- 10.1109/CVPR.2017.690 · DOI · Paper page
- 10.1109/ICCV.2015.169 · DOI · Paper page
- bochkovskiy, 2020, YOLOv4: Optimal speed and accuracy of object detection, arXiv 2004 10934
- redmon, 2018, YOLOv3: An incremental improvement, arXiv 1804 02767
- madry, 2017, Towards deep learning models resistant to adversarial attacks, arXiv 1706 06083
- 10.1016/j.cosrev.2019.100199 · DOI
- 10.1109/SP.2016.41 · DOI
- 10.1109/MMSP55362.2022.9948869 · DOI
- gu, 2014, Towards deep neural network architectures robust to adversarial examples, arXiv 1412 5068 [cs]
- 10.1145/3274895.3274904 · DOI
- kannan, 2018, Adversarial logit pairing, arXiv 1803 06373
- 10.1109/JPROC.2022.3223186 · DOI
- wang, 2016, A theoretical framework for robustness of (deep) classifiers against adversarial examples, arXiv 1612 00334
- 10.1109/CVPR.2018.00957 · DOI
- biggio, 2012, Poisoning attacks against support vector machines, arXiv 1206 6389
- 10.3390/s20041226 · DOI
- 10.3390/rs13204078 · DOI
- 10.1109/JPROC.2017.2675998 · DOI · Paper page
- 10.1145/1869790.1869829 · DOI
- 10.1109/CVPR.2018.00418 · DOI · Paper page
- chen, 2019, Adversarial example in remote sensing image recognition, arXiv 1910 13222
- 10.1109/CVPR.2018.00646 · DOI · Paper page
- 10.1109/TIFS.2022.3226905 · DOI
- szegedy, 2013, Intriguing properties of neural networks, arXiv 1312 6199
- goodfellow, 2014, Explaining and harnessing adversarial examples, arXiv 1412 6572
- 10.1109/LGRS.2019.2930308 · DOI
- 10.1109/TGRS.2022.3156392 · DOI
- 10.1109/AIPR.2017.8457969 · DOI
- 10.1145/3097983.3098070 · DOI
- 10.1109/TGRS.2016.2645610 · DOI
- papernot, 2016, Transferability in machine learning: From phenomena to black-box attacks using adversarial samples, arXiv 1605 07277
- 10.1201/9781351251389-8 · DOI · Paper page
- carlini, 2017, MagNet and ‘efficient defenses against adversarial attacks’ are not robust to adversarial examples, arXiv 1711 08478
- 10.3390/rs14215298 · DOI
- 10.1109/ICCVW.2019.00030 · DOI
- lin, 2014, Microsoft COCO: Common objects in context, Proc 13th Eur Conf, 740
- 10.3390/rs9040368 · DOI
- 10.1109/WACV51458.2022.00385 · DOI
- 10.1109/TGRS.2017.2685945 · DOI · Paper page
- 10.1109/CVPRW.2015.7301377 · DOI · Paper page
- 10.1109/TASL.2011.2109382 · DOI
- 10.1109/TAI.2021.3134190 · DOI
- 10.1109/CVPR42600.2020.01291 · DOI
- qin, 2020, BiPointNet: Binary neural network for point clouds, arXiv 2010 05501
- guo, 2020, Backpropagating linearly improves transferability of adversarial examples, Proc Adv Neural Inf Process Syst, 33, 85
- 10.1109/ICPR48806.2021.9412236 · DOI · Paper page
- 10.1109/CVPR.2019.00445 · DOI
- li, 2019, Adversarial camera stickers: A physical camera-based attack on deep learning systems, Proc Int Conf Mach Learn, 3896
- 10.1109/CVPR.2019.01161 · DOI
- 10.1145/3355390 · DOI
- 10.1109/CVPR46437.2021.01498 · DOI
- 10.1109/CVPR46437.2021.01579 · DOI
- 10.1007/s10846-016-0464-7 · DOI
- wu, 2020, Physical adversarial attack on vehicle detector in the Carla simulator, arXiv 2007 16118
- 10.1109/CVPR.2017.17 · DOI · Paper page
- 10.1109/TMM.2022.3146005 · DOI
- 10.1109/CVPR.2019.01277 · DOI
- 10.1155/2022/9580991 · DOI
- 10.1016/j.jksues.2020.06.001 · DOI
- 10.1109/WACV51458.2022.00288 · DOI
- 10.1109/CVPR42600.2020.00044 · DOI
- 10.1007/978-3-030-58601-0_24 · DOI
- 10.1109/CVPR42600.2020.00130 · DOI
- zhang, 2018, CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild, Proc Int Conf Learn Represent, 1
- 10.1109/CVPR42600.2020.00847 · DOI
- 10.1145/3548606.3560566 · DOI
- 10.1109/CVPR42600.2020.00111 · DOI
- sriramanan, 2020, Guided adversarial attack for evaluating and enhancing adversarial defenses, Proc Adv Neural Inf Process Syst, 33, 20297
- 10.1109/SIBIRCON48586.2019.8958134 · DOI
- 10.1109/ICCV.2019.00843 · DOI
- 10.1609/aaai.v33i01.33011028 · DOI
- 10.1109/TPAMI.2022.3169802 · DOI
- 10.1145/2810103.2813677 · DOI · Paper page
- wei, 2023, Adversarial sticker: A stealthy attack method in the physical world, IEEE Trans Pattern Anal Mach Intell, 45, 2711
- 10.1109/CVPR.2018.00175 · DOI · Paper page
- 10.1109/ACCESS.2023.3234313 · DOI
- brown, 2017, Adversarial patch, arXiv 1712 09665
- ru, 2020, BayesOpt adversarial attack, Proc Int Conf Learn Represent, 1
- dickson, 2023, New Deep Learning Model Brings Image Segmentation to Edge Devices
- wei, 2021, Generating transferable adversarial patch by simultaneously optimizing its position and perturbations, Proc ICLR, 1
- 10.1145/3243734.3264418 · DOI
- 10.3390/urbansci5030068 · DOI
- 10.1109/EuroSP.2016.36 · DOI · Paper page
- 10.1109/ROBOT.2010.5509934 · DOI
- xu, 2017, Feature squeezing: Detecting adversarial examples in deep neural networks, arXiv 1704 01155
- 10.1109/IJCNN.2016.7727230 · DOI
- 10.1117/12.2575907 · DOI
- 10.1109/TPAMI.2018.2858821 · DOI
- 10.1109/TEVC.2019.2890858 · DOI · Paper page
- 10.1109/ICAI58407.2023.10136660 · DOI
- bhambri, 2019, A survey of black-box adversarial attacks on computer vision models, arXiv 1912 01667
- 10.1007/978-3-030-58548-8_1 · DOI
- jin, 2020, Adversarial attacks and defenses on graphs: A review, a tool and empirical studies, arXiv 2003 00653
- 10.1109/ICCV48922.2021.00775 · DOI
- athalye, 2018, Synthesizing robust adversarial examples, Proc Int Conf Mach Learn, 284
- 10.1109/CVPR42600.2020.00080 · DOI
- 10.1109/TGRS.2020.2999962 · DOI
- 10.1109/CVPR52688.2022.01295 · DOI
- 10.1145/3398394 · DOI
- 10.24963/ijcai.2022/125 · DOI
- kong, 2022, Digital and physical face attacks: Reviewing and one step further, arXiv 2209 14692
- 10.1145/3503161.3548171 · DOI
- debicha, 2023, Review on the feasibility of adversarial evasion attacks and defenses for network intrusion detection systems, arXiv 2303 07003
- 10.1109/CVPR52688.2022.01487 · DOI
- 10.1016/j.inffus.2021.02.012 · DOI
- 10.1016/j.eswa.2020.114417 · DOI
- 10.1109/TPAMI.2020.2974745 · DOI
- 10.1016/j.cosrev.2020.100270 · DOI
- 10.1109/CVPR52688.2022.01296 · DOI
- 10.3390/app9050909 · DOI
- 10.1145/2976749.2978392 · DOI · Paper page
- 10.1080/00031305.2021.2006781 · DOI
- 10.1145/3485133 · DOI
- 10.1145/3474085.3475653 · DOI
- reza wiyatno, 2019, Adversarial examples in modern machine learning: A review, arXiv 1911 05268
- 10.1109/ICCVW54120.2021.00016 · DOI
- 10.1109/ICCV48922.2021.00769 · DOI
- chakraborty, 2018, Adversarial attacks and defences: A survey, arXiv 1810 00069
- 10.1109/CVPRW50498.2020.00415 · DOI
- 10.1109/TNNLS.2018.2886017 · DOI · Paper page
- 10.1109/CVPR42600.2020.00108 · DOI
- wei, 2022, Physical adversarial attack meets computer vision: A decade survey, arXiv 2209 15179
- 10.1109/CVPR42600.2020.01426 · DOI
- 10.1109/MASSW.2019.00012 · DOI
- chen, 2018, ShapeShifter: Robust physical adversarial attack on faster R-CNN object detector, Proc Eur Conf Mach Learn Knowl Discovery Databases, 52
- 10.1016/j.procs.2018.10.315 · DOI
- song, 2018, Physical adversarial examples for object detectors, Proc 12th USENIX Workshop Offensive Technol (WOOT), 1
- wang, 2022, A survey on physical adversarial attack in computer vision, arXiv 2209 14262
- 10.1109/CVPR52688.2022.01491 · DOI
- 10.1109/CVPR46437.2021.01443 · DOI
- 10.1109/ACCESS.2021.3127960 · DOI
- 10.1109/CVPR46437.2021.01580 · DOI
- 10.1109/ACCESS.2018.2807385 · DOI · Paper page
- lovisotto, 2021, SLAP: Improving physical adversarial examples with short-lived adversarial perturbations, Proc USENIX, 1
Cited by
Sorted by citations
Ali, M. L., & Zhang, Z. (2024) · Computers · doi:10.3390/computers13120336 · Cited by 383
Metadata
- Authors
- Kazmi, S. M. K. A., Aafaq, N., Khan, M. A., Khalil, M., & Saleem, A.
- Affiliations
- National University of Sciences and Technology (PK)
- Venue
- IEEE Access
- Published
- 2023
- Volume
- 11
- Pages
- 81256-81278
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W4385338774
- Cited by
- 13
- References
- 12
- Citations by year
- 2026: 3 · 2025: 6 · 2024: 2 · 2023: 2
- FWCI
- 1.23
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- IEEE Access (publishedVersion, cc-by-nc-nd)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- National University of Science and Technology (NUST), Islamabad, Pakistan
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Neural Network Applications
- Keywords
- adversarial attacks, aerial imagery, unmanned aerial vehicles, satellite imagery, deep neural network vulnerabilities, adversarial perturbations, physical adversarial attacks, UAV security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
