In recent years, deep learning algorithms have been widely used in the field of Geographic Information Science (GIS), especially in the fields of environmental monitoring and management, urban planning and management. In these emerging application areas, the training data used for deep learning are mostly open datasets, and their collection and sharing processes make them vulnerable to backdoor attacks by injecting triggers. We propose a method, named Principal component analysis and Singular value decomposition-based Backdoor Attack (PSBA). The method achieves a double concealment effect by suppressing the high-frequency noise component and detail features of the trigger image. It also masks the spatial perturbation traces, which eliminates the visualization anomaly of the trigger at the perceptual level. This approach circumvents the sensitivity of traditional detection methods to data perturbation, resulting in the poisoning of the hidden data. We conducted extensive experiments on scene classification and semantic segmentation, two typical tasks in the GIS domain, based on four representative remote sensing benchmark datasets, and PSBA demonstrated a high success rate of backdoor attacks with good stealth performance. Among them, the success rate of the backdoor attack in the scene classification task is close to 97%, while the classification accuracy of benign samples is 93.81%, which is only 0.4% different from the clean model.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Backdoor Attacks for Geographic Information Science with Principal Component Analysis and Singular Value Decomposition

  • Wenyin Yang,
  • Zhiliang Zhang,
  • Fen Liu,
  • Li Ma,
  • Weidong Wu,
  • Miaoji Zheng

摘要

In recent years, deep learning algorithms have been widely used in the field of Geographic Information Science (GIS), especially in the fields of environmental monitoring and management, urban planning and management. In these emerging application areas, the training data used for deep learning are mostly open datasets, and their collection and sharing processes make them vulnerable to backdoor attacks by injecting triggers. We propose a method, named Principal component analysis and Singular value decomposition-based Backdoor Attack (PSBA). The method achieves a double concealment effect by suppressing the high-frequency noise component and detail features of the trigger image. It also masks the spatial perturbation traces, which eliminates the visualization anomaly of the trigger at the perceptual level. This approach circumvents the sensitivity of traditional detection methods to data perturbation, resulting in the poisoning of the hidden data. We conducted extensive experiments on scene classification and semantic segmentation, two typical tasks in the GIS domain, based on four representative remote sensing benchmark datasets, and PSBA demonstrated a high success rate of backdoor attacks with good stealth performance. Among them, the success rate of the backdoor attack in the scene classification task is close to 97%, while the classification accuracy of benign samples is 93.81%, which is only 0.4% different from the clean model.