Boosting Adversarial Transferability for Hyperspectral Image Classification Using 3D Structure-invariant Transformation and Intermediate Feature Distance

2025-06-12

AI Summary

To address the poor transferability of adversarial attacks against hyperspectral image (HSI) classification models, this paper proposes a block-wise random transformation mechanism that preserves the intrinsic 3D spatial-spectral structure of HSIs, coupled with a multi-objective collaborative optimization framework—prioritizing intermediate-layer feature distance while incorporating output-layer prediction loss as a secondary objective. Notably, this work is the first to integrate explicit 3D structural constraints into HSI adversarial sample generation, thereby significantly enhancing the perturbation’s capacity to disrupt discriminative deep features. Extensive experiments on the Indian Pines and Pavia University benchmark datasets demonstrate that the proposed method substantially improves transfer success rates under black-box, cross-model attack settings. Moreover, it maintains strong robustness against prevalent defenses, including input preprocessing and adversarial training. This study advances the security analysis of HSIs by offering both a novel conceptual framework and an effective practical tool.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Data transparency and provenance
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Deep Neural Networks (DNNs) are vulnerable to adversarial attacks, which pose security challenges to hyperspectral image (HSI) classification technologies based on DNNs. In the domain of natural images, numerous transfer-based adversarial attack methods have been studied. However, HSIs differ from natural images due to their high-dimensional and rich spectral information. Current research on HSI adversarial examples remains limited and faces challenges in fully utilizing the structural and feature information of images. To address these issues, this paper proposes a novel method to enhance the transferability of the adversarial examples for HSI classification models. First, while keeping the image structure unchanged, the proposed method randomly divides the image into blocks in both spatial and spectral dimensions. Then, various transformations are applied on a block by block basis to increase input diversity and mitigate overfitting. Second, a feature distancing loss targeting intermediate layers is designed, which measures the distance between the amplified features of the original examples and the features of the adversarial examples as the primary loss, while the output layer prediction serves as the auxiliary loss. This guides the perturbation to disrupt the features of the true class in adversarial examples, effectively enhancing transferability. Extensive experiments demonstrate that the adversarial examples generated by the proposed method achieve effective transferability to black-box models on two public HSI datasets. Furthermore, the method maintains robust attack performance even under defense strategies.

Problem

• Enhancing adversarial transferability for HSI classification models
• Utilizing 3D structure-invariant transformations for input diversity
• Designing feature distancing loss to disrupt true class features

Innovation

• 3D structure-invariant transformation for HSI blocks
• Intermediate feature distance loss design
• Enhanced adversarial example transferability