ColorFD: A Finite-Difference Guided Black-Box Physical Adversarial Attack for Remote Sensing Object Detection

2026-08-05

AI Summary

This work addresses the poor physical feasibility and inefficient high-dimensional optimization inherent in black-box physical adversarial attacks for remote sensing object detection by proposing ColorFD, a novel method that employs solid-color patches as physical perturbations. ColorFD jointly optimizes patch location and color via differential evolution, significantly reducing the search space through an innovative integration of finite-difference-guided critical region localization and class-level spatial priors. Furthermore, it introduces a target-aware fitness mechanism to enhance both attack specificity and transferability. Experimental results demonstrate that ColorFD consistently outperforms existing black-box approaches across YOLOv3u, YOLOv5u, and Faster R-CNN detectors, achieving performance close to white-box baselines, with digital-domain optimizations effectively transferring to real-world imaging conditions.

Abstract

Although deep neural network-based remote sensing object detectors have achieved strong performance, they remain vulnerable to adversarial perturbations. Existing studies mainly focus on digital or white-box settings, whereas black-box physical attacks remain underexplored. These attacks are often constrained by limited physical feasibility and inefficient optimization in high-dimensional search spaces. To address these challenges, this paper proposes ColorFD, a black-box physical attack based on multiple pure-color patches. The patch positions and color parameters are jointly optimized using Differential Evolution (DE). A target-wise fitness and selection mechanism evaluates the attack state of each target and preserves target-specific improvements during evolution. Two guidance strategies further constrain the patch search space. Key-region localization identifies sensitive regions through finite-difference color probing. Common-feature extraction provides category-level spatial priors and avoids repeated localization. Although evaluated on aircraft, the formulation is not inherently restricted to this category. Experiments on YOLOv3u, YOLOv5u, and Faster R-CNN show that ColorFD outperforms the tested black-box patch method across all evaluated detectors and remains competitive with strong white-box baselines. Physical-world experiments further demonstrate that the optimized pure-color patches can be transferred from the digital domain to real imaging conditions.

Problem

• black-box physical attack
• remote sensing object detection
• adversarial perturbations
• high-dimensional optimization
• physical feasibility

Innovation

• black-box physical attack
• finite-difference probing
• differential evolution
• pure-color patches
• remote sensing object detection