Objective

Deep neural networks have demonstrated significant superiority in hyperspectral image classification tasks. However， the emergence of adversarial examples poses a serious threat to their robustness. Research on adversarial training methods provides an effective defense strategy for protecting deep neural networks. However， existing adversarial training methods often require a large number of labeled examples to enhance the robustness of deep neural networks， which increases the difficulty of labeling hyperspectral image examples. In addition， a critical limitation of current adversarial training approaches is that they usually do not capture intermediate layer features in the target network and pay less attention to challenging adversarial samples. This oversight can lead to the reduced generalization ability of the defense model. To further enhance the adversarial robustness of hyperspectral image classification networks with limited labeled examples， this paper proposes a contrastive semi-supervised adversarial training method.

Method

First， the target model is pre-trained using a small number of labeled examples. Second， for a large number of unlabeled examples， the corresponding adversarial examples are generated by maximizing the feature difference between clean unlabeled examples and adversarial examples on the target model. Adversarial samples generated using intermediate layer features of the network exhibit higher transferability compared with those generated only using output layer features. In contrast， feature-based adversarial sample generation methods do not rely on example labels. Therefore， we generate adversarial examples based on the intermediate layer features of the network. Third， the generated adversarial examples are used to enhance the robustness of the target model. The defense capabilities of the target model for the challenging adversarial samples are enhanced by defining the robust upper bound and robust lower bound of the target network based on the pre-trained target model， and a contrastive adversarial loss is designed on both intermediate feature layer and output layer to optimize the model based on the defined robust upper bound and robust lower bound. The defined contrastive loss function consists of three terms： classification loss， output contrastive loss， and feature contrastive loss. The classification loss is designed to maintain the classification accuracy of the target model for clean examples. The output contrastive loss encourages the output layer of the adversarial examples to move closer to the pre-defined output layer robust upper bound and away from the pre-defined output layer robust lower bound. The feature contrastive loss pushes the intermediate layer feature of the adversarial example closer to the pre-defined intermediate robust upper bound and away from the pre-defined intermediate robust lower bound. The proposed output contrastive adversarial loss and feature contrastive loss help improve the classification accuracy and generalization ability of the target network against challenging adversarial examples. The training process of adversarial example generation and target network optimization is performed iteratively， and example labels are not required in the training process. By incorporating a limited number of labeled examples in model training， both the output layer and intermediate feature layer are used to enhance the defense ability of the target model against known and unknown attack methods.

Result

We compared the proposed method with five mainstream adversarial training methods， two supervised adversarial training methods and three semi-supervised adversarial training methods， on the PaviaU and Indian Pines hyperspectral image datasets. Compared with the mainstream adversarial training methods， the proposed method demonstrates significant superiority in defending against both known and various unknown attacks. Faced with six unknown attacks， compared with the supervised adversarial training methods AT and TRADES， our method showed an average improvement in classification accuracy of 13.3% and 16%， respectively. Compared with the semi-supervised adversarial training methods SRT， RST， and MART， our method achieved an average improvement in classification accuracy of 5.6% and 4.4%， respectively. Compared with the target model without defense method， for example on the Inception_V3， the defense performance of the proposed method in the face of different attacks improved by 34.63%–92.78%.

Conclusion

The proposed contrastive semi-supervised adversarial training method can improve the defense performance of hyperspectral image classification networks with limited labeled examples. By maximizing the feature distance between clean examples and adversarial examples on the target model， we can generate highly transferable adversarial examples. To address the limitation of defense generalization ability imposed by the number of labeled examples， we define the concept of robust upper bound and robust lower bound based on the pre-trained target model and design an optimization model according to a contrastive semi-supervised loss function. By extensively leveraging the feature information provided by a few labeled examples and incorporating a large number of unlabeled examples， we can further enhance the generalization ability of the target model. The defense performance of the proposed method is superior to that of the supervised adversarial training methods.