Adaptive Rotation-Scaling Ensemble Patch Attack for Ship Detection in Remote Sensing Images

Existing adversarial patch generation methods for remote sensing ship detection suffer from several limitations, including insufficient adaptability to patch size, inability to handle orientation variations of rotated ships, and poor transferability of adversarial patches. Considering these problems, this paper first proposes an adaptive rotation-scaling ensemble patch attack method, named ARSEA, to enhance suitability of adversarial patches for ship sizes and orientations. Specifically, a adversarial patch is scaled according to the size of the rotated bounding box of the ship and rotated using the angle information combined with a location-aware mask, enabling precise alignment with ship targets of various sizes and orientations. For the last problem, a model ensemble attack strategy based on gradient direction consistency is proposed, where weights are adaptively assigned according to the cosine similarity between the gradients of multiple surrogate models. This guides the patch optimization toward the commonly vulnerable regions shared by multiple models, reduces gradient conflicts, and enhances the transferability of the patch. Experimental results on multiple datasets demonstrate that the proposed method significantly reduces the detection accuracy of ship targets. When integrating multiple detectors, the generated patch achieves approximately 60% mAP reduction and 50% target vanishing rate on three unknown black-box detection models. Furthermore, in multi-class attack scenarios, the proposed method also achieves an attack success rate of around 40%, showing strong transferability.