Robust Remote Sensing Scene Classification by Adversarial Self-Supervised Learning

Adversarial training is an effective method to enhance adversarial robustness for deep neural networks. However, it qequires large amounts of labeled data, which are often difficult to acquire. Recent research has shown that self-supervised learning can help to improve model performance and model uncertainty using unlabeled data. In this paper, we introduce a new adversarial self-supervised learning framework to learn a robust pretrained model for remote sensing scene classification. The proposed method exploits the advantage of dual network structure, and it requires neither labeled data for adversarial example generation nor negative samples for contrastive learning. Specifically, it consists of three major steps. Firstly, we train the online model and the target model to extract deep image features. Secondly, we generate two kinds of instance-wise adversarial examples. Finally, we iteratively learn a robust model by implicit comparing the difference between clean data and their perturbed counterpart. Preliminary experimental results on remote sensing scene classification dataset shows that our method can obtain higher robust accuracy. Our method can also be combined with other adversarial defense techniques to further promote model robustness.

1. Introduction

With the rapid development of remote sensing technology, lots of remote sensing images are available. The early research for the remote sensing scene classification task mainly concentrates on handcrafted features. Along with the great development of deep learning methods, recent research for remote sensing scene classification mainly focuses on deep features. Though the great success deep learning achieves, it is proved to be fragile when facing artificial perturbations on natural images (adversarial example). Adversarial training (AT) [1] and its derivative method, i.e., training with adversarial example, has been proved to be the most effective method to defense adversarial attacks. Yet it requires large amounts of labeled data, which is often difficult to acquire for remote sensing applications.