# Sub-Band Backdoor Attack in Remote Sensing Imagery
## 1 Introduction  
The first satellite-based remote sensing data acquisition system was started in the 1960s. Remote sensing datasets can be acquired through satellites, airplanes, or an unmanned aerial vehicle (UAV). Different sensors can have different spatial and spectral resolutions and can capture more proprieties of objects of interest. For example, satellite sensors can take images of spatial resolutions from 0.25 m to 30 m with different electromagnetics, e.g., near-infrared (NIR), red-edge, or other wide range of wavelengths that help identify vegetation, lands, or objects, making remote sensing imagery a good candidate for monitoring objects on Earth from a distance [1, 2]. Many government or private organizations use high-resolution satellite imagery to monitor natural resources. National Aeronautics and Space Administration (NASA), the Department of Commerce's National Oceanic and Atmospheric Administration (NOAA), and the Department of Defense (DOD) utilize remote sensing data for various applications,including environment management, aviation, homeland security, public health, urban planning, and disaster relief. In the tragic event of 11 September 2001, remote sensing was a vital asset in responding to and recovering ground zero by generating a ground map from geographic information system (GIS) data [3]. In recent years, deep learning models have been integrated with remote sensing imagery for applications such as image classification [1], semantic segmentation [4], pan-sharpening [5], change detection [2], and image super-resolution [6]. However, deep learning models are vulnerable and can be compromised by various attacks. A backdoor attack is a model poisoning-based attack where the poisoned model performs similarly to the clean model in the validation dataset. However, once a poisonous trigger is present in the dataset, the model predicts the attacker's chosen label. This backdoor attack may create a catastrophic failure in deep learning systems. Backdoor attacks have been extensively studied in computer vision applications but mostly with natural images [7; 8], and much less research has been conducted in remote sensing applications. Remote sensing images can have various multispectral bands, depending on their sensors. For example, WorldView-2 has eight bands [9; 10], in contrast to natural images which have red, green, and blue bands. The stealthiness of backdoor attacks can be improved by distributing the backdoor trigger across these sub-bands of multispectral images. Traditional defense methods may quickly fail because they often assume that the attacker has planted the backdoor in all image bands. In this paper, we investigate backdoor attacks in remote sensing data; our contributions are the following. * We extensively evaluated the popular backdoor attack, BadNets [11], as applied to various remote sensing datasets, including EuroSat, Sat-4, Sat-6, and so2 Sat. Our results showed that even SOTA defense mechanisms, including Neural Cleanse [12], TABOR [13], Activation Clustering [14], Fine-Pruning [15], GangSwep [16], STRIP [17], DeepInspect [18], and Pixel Backdoor [19], struggled to identify and mitigate this attack. * We developed an explainable AI-guided backdoor attack using sub-bands of multispectral remote sensing datasets. The proposed approach posed even more severe threats to SOTA defense mechanisms, as demonstrated by our extensive comparative experiments. In this paper, we first formulate the traditional BadNets and the proposed sub-band attacks. Then, we experimentally show that our proposed sub-band-based attack improves the stealthiness of the attack and penetrates more state-of-the-art (SOTA) defense approaches. In summary, our research revealed a novel and explainable backdoor attack for remote sensing AI models, highlighting the need for increased attention in this emerging field. The rest of the paper is organized as follows: Sections 2 and 3 discuss related work and the traditional all-bands BadNets attacks, respectively.