# Sub-Band Backdoor Attack in Remote Sensing Imagery
## 10 Discussion  
We implemented the all-band and sub-band BadNets attacks on the EuroSat remote sensing dataset, where the BadNets attack achieved an attack success rate of 100% across various trigger sizes. The sub-band BadNets attack comprises two types: the less-important-band attack and the important-band attack. In these attacks, triggers were embedded into bands categorized as less important or important, as identified by the Score-CAM algorithm. Subsequently, we applied defense approaches, including Neural Cleanse, TABOR, Deep Inspect, Gang-sweep, Pixel Backdoor, and Activation Clustering, to counter the backdoor attacks. In most cases, the defense mechanisms failed to eliminate the backdoor. Notably, the important-band BadNets posed a more severe threat compared to other types of attacks.  
Neural Cleanse is a popular backdoor defense method, capable of evaluating a back-doored model offline and reverse engineering the trigger. We applied Neural Cleanse to  
Figure 8: Entropy distributions computed by STRIP for benign and poisoned samples for the less-important-band BadNets backdoor attack with the EuroSat dataset. Some poisoned samples have larger entropy, making them less easy to be detected for a trigger size of \(10\times 10\).  
Figure 10: Reverse engineered triggers by Gangsweep for important-band BadNets backdoored deep convolutional neural network (DCNN) model with EuroSat dataset.  
Figure 9: Reverse engineered triggers by Gangsweep for all-band BadNets backdoored deep convolutional neural network (DCNN) model with EuroSat dataset.  
various BadNets settings on a multispectral remote sensing dataset, utilizing a variety of convolutional network backbones, such as DCNN, ResNet-20, ResNet-56, and Efficient-Net. Although the Efficient-Net architecture achieved the highest classification accuracy compared to the other backbones, it was more vulnerable to backdoor attacks than the other architectures. Neural Cleanse correctly detected the poisoned target label in only five out of nine instances, proving less effective in satellite imagery, in contrast to its success in natural imagery [12].  
If the victim is aware of the backdoor target label, they can use the reverse-engineered trigger, as shown in Table 7, to remove the backdoor from the deep learning model. During the unlearning process, we embedded the reverse-engineered trigger in 20% of the clean training dataset and then combined these poisoned samples with an additional 10% of the clean dataset to remove the backdoor. The model was trained for 50 epochs in each scenario, as detailed in Table 7. The unlearning process proved most effective in the all-band BadNets attack models. Upon comparing the unlearning performance across different patch sizes in Table 7, we managed to reduce the ASR from 99% to 10%. While TABOR achieved similar performance in the unlearning settings, its trigger detection performance was less effective compared to the Neural Cleanse approach. These results underscore the challenge of detecting and mitigating backdoors without prior knowledge of the target label.  
We investigated the sub-band BadNets attack in the EuroSat satellite imagery and discovered that defending against the important-band BadNets attacks, where the trigger is embedded in bands identified as important by the Score-CAM algorithm, is particularly challenging. Even when the target class is known, Neural Cleanse is unable to remove the backdoor in these cases. In contrast, Neural Cleanse can effectively remove the BadNets backdoor if the trigger is embedded in less important bands or all bands of the EuroSat dataset. Additionally, we implemented defense strategies such as TABOR, Strip, Fine-pruning, and GangSweep against the BadNets attack. TABOR and GangSweep showed performances similar to that of the Neural Cleanse approach.