Pith. sign in

REVIEW 3 major objections 4 minor 60 references

Boosting Adversarial Transferability for Hyperspectral Image Classification Using 3D Structure-invariant Transformation and Weighted Intermediate Feature Divergence

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A new attack method boosts adversarial transferability for HSI classification by combining 3D structure-invariant transformations with a weighted feature divergence loss.

desk verdict A useful incremental attack for HSI transferability, but the evaluation is compromised by tuning on the test models and the reported SIA gains don't match the tables. read the letter →

arxiv 2506.10459 v2 pith:NZ5JCF5Y submitted 2025-06-12 cs.CV eess.IV

Chun Liu , Bingqian Zhu , Tao Xu , Zheng Zheng , Zheng Li , Wei Yang , Zhigang Han , Jiayao Wang This is my paper · ORCID
classification cs.CVeess.IV
keywords HyperspectralimageclassificationAdversarialtransferability3Dstructure-invarianttransformationWeightedfeaturedivergenceBlack-boxattackInputdiversitySpatial-spectralNon-robustfeatures
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that adversarial examples for hyperspectral image (HSI) classifiers can be made to transfer across different model architectures much better than standard gradient-based attacks, by exploiting the unique spatial-spectral structure of HSIs. The authors propose a two-part method: a 3D structure-invariant transformation that divides the HSI into spatial-spectral blocks and applies random transformations per block, and a weighted intermediate feature divergence loss that suppresses high-variance (non-robust) feature channels. If correct, attacks crafted on a known substitute model (VGG-11 or ResNet-18) would lower black-box classification accuracy on HoustonU 2018, PaviaU, and Indian Pines datasets more than FGSM, MI-FGSM, SS, SIA, and BSR baselines, while retaining effectiveness under random noise and spectral filtering defenses.

What carries the argument

The central object is the total loss $L = L_F + \eta L_A$, where $L_A$ is the cross-entropy classification loss and $L_F$ is the weighted feature divergence loss defined as the weighted Chi-squared distance between the intermediate feature maps of the adversarial and original examples. The weighting assigns each channel a weight $W_k$ proportional to its variance in the enlarged original feature map, so channels with larger variance (claimed to be non-robust features) are suppressed more. The 3D structure-invariant transformation $T()$ divides the HSI into spatial-spectral blocks and applies random transformations per block; gradients are averaged over $N$ transformed copies to stabilize the optimization and reduce overfitting to the substitute model.

What would settle it

A targeted experiment that trains two HSI classifiers with different architectures on the same dataset, then compares the transfer success of attacks where the high-variance channels of the substitute are suppressed versus attacks where random channels are suppressed, would reveal whether the variance-weighting is responsible for the transferability gain.

Watch

Extended reading notes

Core claim

The paper claims that combining a 3D structure-invariant input transformation with a weighted intermediate feature divergence loss boosts the transferability of adversarial examples for HSI classification. The transformation randomly partitions the input image into $a\times a\times b$ blocks along both spatial and spectral dimensions and applies different operations (e.g., shift, flip, scale, rotate, resize, dropout, DCT, noise) to each block, preserving global structure while increasing input diversity. The weighted feature divergence loss computes the Chi-squared distance between the original and adversarial feature maps at an intermediate layer, enlarges the original features by a factor $\lambda$, and weights each channel by its variance in the original feature map so that high-variance channels, presumed to encode non-robust class-related features, are disrupted more strongly. Combined with the cross-entropy classification loss, the total loss guides the perturbation generation. Experiments on three public HSI datasets show that the method outperforms baseline approaches and maintains attack effectiveness under random noise and spectral filtering defenses; an ablation study confirms that both components contribute to the improvement.

Load-bearing premise

The assumption that the variance of each channel in the substitute model's intermediate feature map identifies non-robust features shared by other architectures, so suppressing high-variance channels transfers the attack; this is borrowed from [33] without proof or independent validation on HSI classifiers.

Editorial extensions

If this is right

  • Adversarial examples crafted on one HSI classifier architecture can be made to fool several unseen architectures, raising the practical threat level for deployed HSI classifiers built on public models.
  • The method gives a black-box stress test for HSI classifiers without needing target-model access, supporting the design of classifiers that are harder to fool.
  • If the mechanism holds, defenses built only on random noise or spectral filtering will not stop transferable attacks on HSI classifiers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not prove that the variance-based weighting identifies features shared across architectures; it only shows empirical gains on a few models. A test that swaps substitute and target models, or ablates weighting while controlling for the enlargement factor, would clarify the mechanism.
  • The method's reliance on intermediate-layer features assumes those features are the right ones to disrupt; deeper layers worked better in VGG-11 than shallower layers, suggesting the layer choice is not settled and may need per-architecture tuning.
  • The same block-and-weight recipe could plausibly transfer to other high-dimensional data with spatial and spectral structure, but the paper does not test that; adapting the block partition and channel weighting would be a natural extension.
  • The claim of structure invariance is tied to preserving relative block layout; the paper does not measure whether the transformed inputs remain semantically meaningful, so a semantic or perceptual evaluation of the transformed HSIs would test that premise.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a transfer-based black-box adversarial attack for hyperspectral image (HSI) classification. The method combines a 3D structure-invariant transformation, which partitions an HSI into spatial and spectral blocks and applies random per-block transformations, with a weighted intermediate feature divergence loss that enlarges original-example features and weights channels by their variance. The method is instantiated on FGSM and MI-FGSM and evaluated on HoustonU 2018, PaviaU, and Indian Pines against five classifiers, including two defenses. The central claim is that this framework substantially improves black-box transferability relative to FGSM, MI-FGSM, SS, SIA, and BSR.

Significance. If the claimed gains survive an unbiased evaluation protocol, this is a useful contribution to adversarial robustness for HSI classification, extending natural-image transferability techniques to the spectral dimension. The paper provides broad empirical coverage: three datasets, two substitute architectures, five target models, two defense settings, and an ablation study. The 3D block transformation and the channel-variance weighting are clearly described and reasonably motivated. However, the main empirical claim is currently weakened by an evaluation-protocol issue, and the reported advantage over SIA is not uniformly supported by the tables.

major comments (3)
  1. [Section IV.E and Section IV.A.5] The hyperparameters of the proposed method are selected using the same black-box target models that later appear in the main evaluation tables. The spatial and spectral division parameters are chosen from Fig. 6, the feature layer from Fig. 7(a), the iteration count and copy count from Figs. 7(b) and 7(c), the classification-loss weight eta from Fig. 8(a), and the enlargement factor lambda from Fig. 8(b), all measured on PaviaU with VGG-11 as substitute and the other four architectures as black-box models. These same models and the same PaviaU condition appear in the main experiments in Tables VII, X, and XI. No equivalent tuning is reported for FGSM, MI-FGSM, SS, SIA, or BSR. This makes the reported gains over the baselines difficult to interpret, because the comparison may reflect selection on the evaluation set rather than an intrinsic property of the method. Please either fix all hyperparameters before evaluation on a held-out validation set, apply the same tuning protocol to the baselines, or report results under a pre-registered default configuration.
  2. [Section IV.B, Tables IV-IX] The claim of significant advantages over SIA is not reproducible from the tables. For example, in Table V (HoustonU 2018, VGG-11 substitute, perturbation budget 0.03) ours-MI-FGSM yields OA 21.88 on VGG-19, 28.55 on Inc-V3, and 25.29 on IncRes-V2, all higher (worse for the attacker) than SIA-MI-FGSM's 19.92, 26.67, and 24.31. Several other configurations in Tables IV and VI also show ours-MI-FGSM with higher OA than SIA-MI-FGSM, e.g., Table VI, epsilon=0.01, ResNet-18 substitute, IncRes-V2: 88.57 versus 88.23. The text states average improvements over SIA without specifying the exact averaging set, and those averages are not supported by per-configuration results. Please replace the aggregate claim with a transparent summary that includes the number of configurations in which the proposed method is better, equal, or worse than each baseline, and report variability across trials.
  3. [Section III.A, Eq. (1), Algorithm 1] The stated threat model is inconsistent with the implemented update. Equation (1) and the text say the l1-norm is used, with constraint ||delta||_1 <= epsilon, but Algorithm 1 uses coordinate-wise clipping Clip_epsilon and sign(momentum), which enforces ||delta||_infinity <= epsilon. These are different perturbation sets, especially for high-dimensional HSI inputs. Please correct the formulation in Eq. (1) and the discussion in Section III.A, or change the algorithm to a true l1-projected update, and state which norm was used in all experiments.
minor comments (4)
  1. [Section III.D, Eq. (4)] The summation limits in the definitions of M_k and N_k use D1, which appears to be a typo for D_l. Please make the notation consistent with Eq. (2).
  2. [Algorithm 1, line 4] The notation 'X_adv_T = T(x+delta_i)*N' is ambiguous; clarify that N transformed copies are generated and that the average gradient is computed over these copies.
  3. [Section IV.A.5 and IV.E] The paper says results are averages of multiple trials but no standard deviations or number of trials are reported. Please add error bars or at least state the number of independent runs, since the random transformation component makes variance a relevant quantity.
  4. [Section IV.B, HoustonU 2018 discussion] The paragraph reports average improvements over SIA without stating whether the average is over FGSM/MI variants, budgets, or target models. Please state the exact aggregation procedure and ideally provide per-cell deltas in a supplementary table.

Circularity Check

1 steps flagged · score 5.0 of 10

The headline transferability gains are partly in-sample: every hyperparameter is selected on the same black-box models and PaviaU evaluation used in the main tables, so the reported advantage is substantially a fitted result; no step in the derivation is circular by construction.

  1. fitted input called prediction [Section IV.E (Parameter Sensitivity Analysis Experiments) and Section IV.B / Tables IV-IX; cf. Section I contribution 3 and Section IV.A.5]
    "The experiments were conducted mainly on the PaviaU dataset, with VGG-11 selected as the substitute model for generating adversarial examples, while the other models were treated as black-box models. The perturbation budget was set to 0.03. ... the strongest attack effectiveness against black-box models is achieved when the weight η is set to 0.01 or 0.03. ... Therefore, setting η to 0.03 yields superior experimental results."

    All six method hyperparameters (spatial division = 3, spectral division = 3, layer = 3, iterations = 20, copies = 10, λ = 1.2, η = 0.03) were selected from Fig. 6, Fig. 7(a)-(c), and Fig. 8(a)-(b), which plot overall accuracy under attack on exactly the five models (VGG-11, ResNet-18, VGG-19, Inc-V3, IncRes-V2) with VGG-11 as substitute on the PaviaU dataset. The main transferability tables then report attack accuracy on the same five models on the same dataset as evidence of 'significant advantages,' so the reported improvement is the quantity the sensitivity analysis minimized.

full rationale

No step in the derivation reduces to its own inputs by construction: the 3D block transformation, the variance-weighted feature divergence loss (Eqs. 2-4), the classification loss (Eq. 5), and the combined objective (Eq. 6) are all defined independently of the transferability quantities they are claimed to improve, and the optimization in Eq. (7) maximizes a well-specified loss. The variance-as-non-robustness premise is borrowed from Zhu et al. [33] and supported only by the ablation (Table XII); that is an unproven assumption, not a circular step, and there is no evidence that [33] is a self-citation. The one concrete defect is the evaluation protocol: Section IV.E chooses every hyperparameter by reading black-box overall accuracy from Figs. 6-8 on exactly the five models and the same PaviaU dataset used in Tables VI-VII, so the PaviaU transferability numbers are in-sample statistics, and the untuned baselines make the reported 'significant advantages' (contribution 3) partly a fitted result. The HoustonU 2018 and Indian Pines results are less affected because the parameters were selected on PaviaU and reused across datasets, though the target models are identical; the defense experiments (Tables X-XI) and ablations provide additional independent evidence. Overall, the method is not circular by definition, but the central empirical claim is partially a product of selection on the evaluation set, warranting a moderate score.

Assumptions & free parameters 7 free parameters · 3 assumptions · 0 invented entities

The central claim rests on three borrowed domain assumptions: feature transferability, variance as feature importance, and structure-preserving block transformations. No new entities are introduced. The main free parameters were tuned on the evaluation protocol itself, which inflates the apparent transferability and limits the out-of-sample strength of the results.

free parameters (7)
  • spatial division parameter a = 3
    Selected from the sensitivity sweep in Section IV-E as a compromise between attack effectiveness and computational cost.
  • spectral division parameter b = 3
    Selected from the sensitivity sweep in Section IV-E; spectral division improves transferability but increases cost.
  • feature extraction layer l = layer 3
    Chosen as a compromise between VGG-11 (deeper layers best) and ResNet-18 (layer 1 best) in Section IV-E.
  • original feature enlargement factor lambda = 1.2
    Tuned on PaviaU; the sensitivity analysis shows optimal lambda differs by substitute model (3 for VGG-11, 1.2 for ResNet-18).
  • cross-entropy classification loss weight eta = 0.03
    Tuned in Section IV-E; black-box accuracy is lowest for eta between 0.01 and 0.03.
  • number of transformed copies N = 10
    Chosen from the saturation curve in Fig. 7(c); gains stabilize around N=6.
  • number of iterations I = 20
    Chosen from the saturation curve in Fig. 7(b); further iterations give little improvement.
assumptions (3)
  • domain assumption Intermediate features are transferable across model architectures
    Relied on in Section III.D and justified by citation to Yosinski et al. [28]; not independently verified for HSI classifiers.
  • domain assumption Per-channel variance identifies non-robust features related to the true class
    Stated in Section III.D and credited to Zhu et al. [33]; the paper does not prove this holds for hyperspectral models.
  • domain assumption Structure-invariant block transformations preserve semantic information
    Borrowed from SIA [58] and asserted in Section III.C; applied to the spectral dimension without separate validation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Boosting Adversarial Transferability for Hyperspectral Image Classification Using 3D Structure-invariant Transformation and Weighted Intermediate Feature Divergence." pith.science (2026). https://pith.science/paper/NZ5JCF5Y

@misc{pith2026250610459,
  author       = {Pith},
  title        = {Pith review of: Boosting Adversarial Transferability for Hyperspectral Image Classification Using 3D Structure-invariant Transformation and Weighted Intermediate Feature Divergence},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NZ5JCF5Y}},
  note         = {Machine review of arXiv:2506.10459}
}
read the original abstract

Deep Neural Networks (DNNs) are vulnerable to adversarial attacks, which pose security challenges to hyperspectral image (HSI) classification based on DNNs. Numerous adversarial attack methods have been designed in the domain of natural images. However, different from natural images, HSIs contains high-dimensional rich spectral information, which presents new challenges for generating adversarial examples. Based on the specific characteristics of HSIs, this paper proposes a novel method to enhance the transferability of the adversarial examples for HSI classification using 3D structure-invariant transformation and weighted intermediate feature divergence. While keeping the HSIs structure invariant, the proposed method divides the image into blocks in both spatial and spectral dimensions. Then, various transformations are applied on each block to increase input diversity and mitigate the overfitting to substitute models. Moreover, a weighted intermediate feature divergence loss is also designed by leveraging the differences between the intermediate features of original and adversarial examples. It constrains the perturbation direction by enlarging the feature maps of the original examples, and assigns different weights to different feature channels to destroy the features that have a greater impact on HSI classification. Extensive experiments demonstrate that the adversarial examples generated by the proposed method achieve more effective adversarial transferability on three public HSI datasets. Furthermore, the method maintains robust attack performance even under defense strategies.

Figures

Figures reproduced from arXiv: 2506.10459 by the authors.

Figure 1
Figure 1. The overall workflow of the proposed method. Before feeding the image into the substitute model, the 3D structure-invariant transformation method is [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. (a) Schematic of image division. If the spatial dimension division [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. This figure compares the attention maps of the original example and its transformed examples. The first and second rows represent the spatial and [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Feature maps of different channels in the same layer of the VGG-11 model, along with their variances. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: False color images and ground-truth maps of the (a) HoustonU 2018, [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: The impact of different division parameters used in the spatial and spectral dimensions on the results. [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]
Figure 7
Figure 7. Figure 7: The impact of (a) the network extraction layer parameter [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: The impact of (a) the weight coefficient [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]
Figure 9
Figure 9. Figure 9: The first row shows the false color images of the original example and its adversarial examples, while the second row shows the feature maps extracted [PITH_FULL_IMAGE:figures/full_fig_p016_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 52 canonical work pages

  1. [1]

    Recent advances in techniques for hyperspectral image processing,

    A. Plaza, J. A. Benediktsson, J. W. Boardman, J. Brazile, L. Bruzzone, G. Camps-Valls, J. Chanussot, M. Fauvel, P. Gamba, A. Gualtieriet al., “Recent advances in techniques for hyperspectral image processing,” Remote sensing of environment, vol. 113, pp. S110–S122, 2009

    2009

  2. [2]

    W. Xu, M. Wooster, and C. Grimmond, “Modelling of urban sensible heat flux at multiple spatial scales: A demonstration using airborne hy- perspectral imagery of shanghai and a temperature–emissivity separation approach,”Remote Sensing of Environment, vol. 112, no. 9, pp. 3493– 3510, 2008

    work page 2008

  3. [3]

    Synergies between vswir and tir data for the urban environment: An evaluation of the potential for the hyperspectral infrared imager (hyspiri) decadal survey mission,

    D. A. Roberts, D. A. Quattrochi, G. C. Hulley, S. J. Hook, and R. O. Green, “Synergies between vswir and tir data for the urban environment: An evaluation of the potential for the hyperspectral infrared imager (hyspiri) decadal survey mission,”Remote Sensing of Environment, vol. 117, pp. 83–101, 2012

    work page 2012

  4. [4]

    Recent advances of hyperspectral imaging technology and applications in agriculture,

    B. Lu, P. D. Dao, J. Liu, Y . He, and J. Shang, “Recent advances of hyperspectral imaging technology and applications in agriculture,” Remote Sensing, vol. 12, no. 16, p. 2659, 2020

    2020

  5. [5]

    Hypersectral imaging for military and security applications: Combining myriad processing and sensing techniques,

    M. Shimoni, R. Haelterman, and C. Perneel, “Hypersectral imaging for military and security applications: Combining myriad processing and sensing techniques,”IEEE Geoscience and Remote Sensing Magazine, vol. 7, no. 2, pp. 101–117, 2019

    work page 2019

  6. [6]

    Spectral–spatial feature extraction for hyperspectral image classification: A dimension reduction and deep learning ap- proach,

    W. Zhao and S. Du, “Spectral–spatial feature extraction for hyperspectral image classification: A dimension reduction and deep learning ap- proach,”IEEE Transactions on Geoscience and Remote Sensing, vol. 54, no. 8, pp. 4544–4554, 2016

    work page 2016

  7. [7]

    Convolutional neural networks for hyperspec- tral image classification,

    S. Yu, S. Jia, and C. Xu, “Convolutional neural networks for hyperspec- tral image classification,”Neurocomputing, vol. 219, pp. 88–98, 2017

    work page 2017

  8. [8]

    Deep learning for hyperspectral image classification: An overview,

    S. Li, W. Song, L. Fang, Y . Chen, P. Ghamisi, and J. A. Benediktsson, “Deep learning for hyperspectral image classification: An overview,” IEEE transactions on geoscience and remote sensing, vol. 57, no. 9, pp. 6690–6709, 2019

    work page 2019

Show all 60 references
  1. [9]

    Beyond the patchwise classification: Spectral-spatial fully convolutional networks for hyperspectral image classification,

    Y . Xu, B. Du, and L. Zhang, “Beyond the patchwise classification: Spectral-spatial fully convolutional networks for hyperspectral image classification,”IEEE Transactions on Big Data, vol. 6, no. 3, pp. 492– 506, 2019. 16 Original SS SIA BSR Ours Fig. 9. The first row shows th...

    2019

  2. [10]

    Dynamic super-pixel nor- malization for robust hyperspectral image classification,

    C. Wang, L. Zhang, W. Wei, and Y . Zhang, “Dynamic super-pixel nor- malization for robust hyperspectral image classification,”IEEE Trans- actions on Geoscience and Remote Sensing, vol. 61, pp. 1–13, 2023

    2023

  3. [11]

    Dessa-net model: Hyperspectral image classification using an entropy filter with spatial and spectral attention modules on deepnet,

    J. Mahmoodi, D. Abbasi-Moghadam, A. Sharifi, H. Nezamabadi-Pour, M. Esmaeili, and A. Vafaeinejad, “Dessa-net model: Hyperspectral image classification using an entropy filter with spatial and spectral attention modules on deepnet,”IEEE Journal of Selected Topics in Applied Ear...

    2024

  4. [12]

    Atsfcnn: a novel attention-based triple-stream fused cnn model for hyperspectral image classification,

    J. Cai, C. Boust, and A. Mansouri, “Atsfcnn: a novel attention-based triple-stream fused cnn model for hyperspectral image classification,” Machine Learning: Science and Technology, vol. 5, no. 1, p. 015024, 2024

    2024

  5. [13]

    Graph information aggregation cross-domain few-shot learning for hyperspec- tral image classification,

    Y . Zhang, W. Li, M. Zhang, S. Wang, R. Tao, and Q. Du, “Graph information aggregation cross-domain few-shot learning for hyperspec- tral image classification,”IEEE Transactions on Neural Networks and Learning Systems, vol. 35, no. 2, pp. 1912–1925, 2024

    1912

  6. [14]

    Deep cross- domain few-shot learning for hyperspectral image classification,

    Z. Li, M. Liu, Y . Chen, Y . Xu, W. Li, and Q. Du, “Deep cross- domain few-shot learning for hyperspectral image classification,”IEEE Transactions on Geoscience and Remote Sensing, vol. 60, pp. 1–18, 2022

    2022

  7. [15]

    Refined prototypical contrastive learning for few-shot hyperspectral image classification,

    Q. Liu, J. Peng, Y . Ning, N. Chen, W. Sun, Q. Du, and Y . Zhou, “Refined prototypical contrastive learning for few-shot hyperspectral image classification,”IEEE Transactions on Geoscience and Remote Sensing, vol. 61, pp. 1–14, 2023

    2023

  8. [16]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations, 2014

    2014

  9. [17]

    Adversarial examples in the physical world

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world.” inInternational Conference on Learning Representa- tions, 2016

    2016

  10. [18]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” inInternational Conference on Learning Repre- sentations, 2014

    2014

  11. [19]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations, 2018

    2018

  12. [20]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,”2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9185–9193, 2017

    2018

  13. [21]

    Black-box adversarial at- tacks with limited queries and information,

    A. Ilyas, L. Engstrom, A. Athalye, and J. Lin, “Black-box adversarial at- tacks with limited queries and information,” inInternational Conference on Machine Learning, vol. 80, 2018, pp. 2137–2146

    2018

  14. [22]

    Curls & whey: Boosting black-box adversarial attacks,

    Y . Shi, S. Wang, and Y . Han, “Curls & whey: Boosting black-box adversarial attacks,” in2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 6512–6520

    2019

  15. [23]

    Delving into transferable adver- sarial examples and black-box attacks

    Y . Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adver- sarial examples and black-box attacks.” inInternational Conference on Learning Representations, 2017

    2017

  16. [24]

    Transferable adversarial perturbations,

    W. Zhou, X. Hou, Y . Chen, M. Tang, and X. Huang, “Transferable adversarial perturbations,” inComputer Vision – ECCV 2018, 2018, pp. 471–486

    2018

  17. [25]

    Nesterov accelerated gradient and scale invariance for adversarial attacks,

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” in International Conference on Learning Representations, 2020

    2020

  18. [26]

    Improving transferability of adversarial examples with input diversity,

    C. Xie, Z. Zhang, Y . Zhou, S. Bai, J. Wang, Z. Ren, and A. L. 17 Yuille, “Improving transferability of adversarial examples with input diversity,” in2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 2725–2734

    2019

  19. [27]

    Admix: Enhancing the transferability of adversarial attacks,

    X. Wang, X. He, J. Wang, and K. He, “Admix: Enhancing the transferability of adversarial attacks,” in2021 IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 16 138–16 147

    2021

  20. [28]

    How transferable are features in deep neural networks?

    J. Yosinski, J. Clune, Y . Bengio, and H. Lipson, “How transferable are features in deep neural networks?”Advances in neural information processing systems, vol. 27, pp. 3320–3328, 2014

    2014

  21. [29]

    Fda: Feature disruptive attack,

    A. Ganeshan, V . B. S, and V . B. Radhakrishnan, “Fda: Feature disruptive attack,” in2019 IEEE/CVF International Conference on Computer Vision (ICCV), 2019, pp. 8068–8078

    2019

  22. [30]

    Feature space perturba- tions yield more transferable adversarial examples,

    N. Inkawhich, W. Wen, H. H. Li, and Y . Chen, “Feature space perturba- tions yield more transferable adversarial examples,” in2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 7059–7067

    2019

  23. [31]

    Universal adversarial examples in remote sens- ing: Methodology and benchmark,

    Y . Xu and P. Ghamisi, “Universal adversarial examples in remote sens- ing: Methodology and benchmark,”IEEE Transactions on Geoscience and Remote Sensing, vol. 60, pp. 1–15, 2022

    2022

  24. [32]

    Universal object- level adversarial attack in hyperspectral image classification,

    C. Shi, M. Zhang, Z. Lv, Q. Miao, and C.-M. Pun, “Universal object- level adversarial attack in hyperspectral image classification,”IEEE Transactions on Geoscience and Remote Sensing, vol. 61, pp. 1–14, 2023

    2023

  25. [33]

    Boosting transferability of targeted adversarial examples with non-robust feature alignment,

    H. Zhu, X. Sui, Y . Ren, Y . Jia, and L. Zhang, “Boosting transferability of targeted adversarial examples with non-robust feature alignment,”Expert Systems with Applications, vol. 227, p. 120248, 2023

    2023

  26. [34]

    Generating adversarial examples against remote sensing scene classification via feature approxi- mation,

    R. Zhu, S. Ma, J. Lian, L. He, and S. Mei, “Generating adversarial examples against remote sensing scene classification via feature approxi- mation,”IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, vol. 17, pp. 10 174–10 187, 2024

    2024

  27. [35]

    Enhancing the transferability of adversarial attacks through variance tuning,

    X. Wang and K. He, “Enhancing the transferability of adversarial attacks through variance tuning,” in2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021, pp. 1924–1933

    2021

  28. [36]

    Evading defenses to trans- ferable adversarial examples by translation-invariant attacks,

    Y . Dong, T. Pang, H. Su, and J. Zhu, “Evading defenses to trans- ferable adversarial examples by translation-invariant attacks,” in2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 4307–4316

    2019

  29. [37]

    Robust superpixel-guided attentional adversarial attack,

    X. Dong, J. Han, D. Chen, J. Liu, H. Bian, Z. Ma, H. Li, X. Wang, W. Zhang, and N. Yu, “Robust superpixel-guided attentional adversarial attack,” in2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 12 892–12 901

    2020

  30. [38]

    Frequency domain model augmentation for adversarial attack,

    Y . Long, Q. Zhang, B. Zeng, L. Gao, X. Liu, J. Zhang, and J. Song, “Frequency domain model augmentation for adversarial attack,”Euro- pean Conference on Computer Vision, pp. 549–566, 2022

    2022

  31. [39]

    Mixcam-attack: Boosting the transferability of adversarial examples with targeted data augmentation,

    S. Guo, X. Li, P. Zhu, B. Wang, Z. Mu, and J. Zhao, “Mixcam-attack: Boosting the transferability of adversarial examples with targeted data augmentation,”INFORMATION SCIENCES, vol. 657, p. 119918, 2024

    2024

  32. [40]

    Boosting adversarial trans- ferability by block shuffle and rotation,

    K. Wang, X. He, W. Wang, and X. Wang, “Boosting adversarial trans- ferability by block shuffle and rotation,” in2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024, pp. 24 336– 24 346

    2024

  33. [41]

    Boosting the transferability of adversarial examples via local mixup and adaptive step size,

    J. Liu, C. Zhang, and X. Lyu, “Boosting the transferability of adversarial examples via local mixup and adaptive step size,” inICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2025, pp. 1–5

    2025

  34. [42]

    Boosting the transferabil- ity of adversarial samples via attention,

    W. Wu, Y . Su, X. Chen, S. Zhao, and I. King, “Boosting the transferabil- ity of adversarial samples via attention,” in2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 1158– 1167

    2020

  35. [43]

    Improving adversarial transfer- ability via intermediate-level perturbation decay,

    Q. Li, Y . Guo, W. Zuo, and H. Chen, “Improving adversarial transfer- ability via intermediate-level perturbation decay,” inAdvances in Neural Information Processing Systems, vol. 36, 2023, pp. 32 900–32 912

    2023

  36. [44]

    Diversifying the high-level features for better adversarial transferability,

    Z. Wang, Z. Zhang, S. Liang, and X. Wang, “Diversifying the high-level features for better adversarial transferability,” in34th British Machine Vision Conference 2023, 2023

    2023

  37. [45]

    Adversarial example in remote sensing image recognition,

    L. Chen, G. Zhu, Q. Li, and H. Li, “Adversarial example in remote sensing image recognition,”arXiv preprint arXiv:1910.13222, 2019

    1910 arXiv

  38. [46]

    Assessing the threat of adversarial ex- amples on deep neural networks for remote sensing scene classification: Attacks and defenses,

    Y . Xu, B. Du, and L. Zhang, “Assessing the threat of adversarial ex- amples on deep neural networks for remote sensing scene classification: Attacks and defenses,”IEEE Transactions on Geoscience and Remote Sensing, vol. 59, no. 2, pp. 1604–1617, 2021

    2021

  39. [47]

    An empirical study of adversarial examples on remote sensing image scene classification,

    L. Chen, Z. Xu, Q. Li, J. Peng, S. Wang, and H. Li, “An empirical study of adversarial examples on remote sensing image scene classification,” IEEE Transactions on Geoscience and Remote Sensing, vol. 59, no. 9, pp. 7419–7433, 2021

    2021

  40. [48]

    Generating natural adversarial remote sensing images,

    J.-C. Burnel, K. Fatras, R. Flamary, and N. Courty, “Generating natural adversarial remote sensing images,”IEEE Transactions on Geoscience and Remote Sensing, vol. 60, pp. 1–14, 2022

    2022

  41. [49]

    Generating imperceptible and cross-resolution remote sensing adversarial examples based on implicit neural representations,

    Y . Zhang, J. Chen, L. Liu, K. Chen, Z. Shi, and Z. Zou, “Generating imperceptible and cross-resolution remote sensing adversarial examples based on implicit neural representations,”IEEE Transactions on Geo- science and Remote Sensing, vol. 62, pp. 1–15, 2024

    2024

  42. [50]

    Distillation-based cross-model transfer- able adversarial attack for remote sensing image classification,

    X. Peng, J. Zhou, and X. Wu, “Distillation-based cross-model transfer- able adversarial attack for remote sensing image classification,”Remote Sensing, vol. 17, no. 10, 2025

    2025

  43. [51]

    Iopa-fracat: Research on improved one-pixel adversarial attack and fractional defense in hyperspectral image classification,

    X. Peng, J. Shi, D. Zhou, and Y . Hu, “Iopa-fracat: Research on improved one-pixel adversarial attack and fractional defense in hyperspectral image classification,” in2024 36th Chinese Control and Decision Conference (CCDC), 2024, pp. 1527–1532

    2024

  44. [52]

    Attack-invariant attention feature for adversarial defense in hyperspectral image classifi- cation,

    C. Shi, Y . Liu, M. Zhao, C.-M. Pun, and Q. Miao, “Attack-invariant attention feature for adversarial defense in hyperspectral image classifi- cation,”Pattern Recognition, vol. 145, p. 109955, 2024

    2024

  45. [53]

    Self-attention context network: Addressing the threat of adversarial attacks for hyperspectral image classification

    Y . Xu, B. Du, and L. Zhang, “Self-attention context network: Addressing the threat of adversarial attacks for hyperspectral image classification.” IEEE Transactions on Image Processing, vol. 30, pp. 8671–8685, 2021

    2021

  46. [54]

    S³anet: Spatial–spectral self-attention learning network for defending against adversarial attacks in hyperspectral image classification,

    Y . Xu, Y . Xu, H. Jiao, Z. Gao, and L. Zhang, “S³anet: Spatial–spectral self-attention learning network for defending against adversarial attacks in hyperspectral image classification,”IEEE Transactions on Geoscience and Remote Sensing, vol. 62, pp. 1–13, 2024

    2024

  47. [55]

    Wfss: weighted fusion of spectral transformer and spatial self-attention for robust hyperspectral image classification against adversarial attacks,

    L. Tang, Z. Yin, H. Su, W. Lyu, and B. Luo, “Wfss: weighted fusion of spectral transformer and spatial self-attention for robust hyperspectral image classification against adversarial attacks,”Visual Intelligence, vol. 2, 2024

    2024

  48. [56]

    Masked spatial–spectral autoencoders are excellent hyperspectral defenders,

    J. Qi, Z. Gong, X. Liu, C. Chen, and P. Zhong, “Masked spatial–spectral autoencoders are excellent hyperspectral defenders,”IEEE Transactions on Neural Networks and Learning Systems, vol. 36, no. 2, pp. 3012– 3026, 2025

    2025

  49. [57]

    Apnet: A novel antiperturbation network for robust hyperspectral image classification against adversarial attacks,

    L. Zhao, Y . Zhang, C. Shi, M. Zhao, J. Wu, and W. Li, “Apnet: A novel antiperturbation network for robust hyperspectral image classification against adversarial attacks,”IEEE Transactions on Geoscience and Remote Sensing, vol. 62, pp. 1–14, 2024

    2024

  50. [58]

    Structure invariant transformation for better adversarial transferability,

    X. Wang, Z. Zhang, and J. Zhang, “Structure invariant transformation for better adversarial transferability,” in2023 IEEE/CVF International Conference on Computer Vision (ICCV), 2023, pp. 4584–4596

    2023

  51. [59]

    Transferable adversarial attacks for object detection using object-aware significant feature distortion,

    X. Ding, J. Chen, H. Yu, and Y . Shang, “Transferable adversarial attacks for object detection using object-aware significant feature distortion,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 2, pp. 1546–1554, 2024

    2024

  52. [60]

    Perturbing across the feature hierarchy to improve standard and strict blackbox attack transferability,

    N. Inkawhich, K. Liang, B. Wang, and M. Inkawhich, “Perturbing across the feature hierarchy to improve standard and strict blackbox attack transferability,” inAdvances in Neural Information Processing Systems, vol. 33, 2020, pp. 20 791–20 801

    2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.