# Robust Airport Surface Object Detection Based on Graph Neural Network
## 2 Materials and Methods
### Adversarial Training  
Adversarial sample generation. Given a clean image \(I\) and object detector \(D_{\theta}\), we generate adversarial perturbation based on the gradient derived from the loss function [29]:  
\[\hat{I}=\mathbb{B}(I+\epsilon\cdot sign(\
abla_{I}\mathcal{L}(D_{\theta}(I), GT))) \tag{1}\]  
where \(\hat{I}\) denotes the adversarial sample derived from the clean image \(I\); \(\mathbb{B}(\cdot)\) is a boundary function that restricts the amplitude of perturbation, s.t. \(\left\{I\|\hat{I}-I\|_{\infty}\leq\epsilon\right\}\); \(\epsilon\) is the step size of adversarial perturbation; \(sign(\cdot)\) is a signum function, \(sign(x)=1\) when \(x\geq 0\) and vice versa; \(\mathcal{L}(\cdot)\) is a loss function of the object detector in the training phase, e.g., classification loss, location loss, and so on; \(D_{\theta}(I)\) is the prediction of the object detector according to the clean image \(I\); \(\theta\) denotes the detector's parameters; \(GT\) denotes ground truth of image \(I\), i.e., classification label, ground truth bounding box.  
According to Equation (1) above, we first apply the model \(D_{\theta}\) to detect clean image \(I\) and calculate its loss with ground truth \(GT\). Then, we calculate the gradient vector of loss \(\mathcal{L}\) w.r.t the clean image \(I\) and implement a step of gradient ascent on image \(I\) with step size \(\epsilon\). Adding this adversarial perturbation may cause the model to obtain the wrong detection results. If step size \(\epsilon\) is small enough, the perturbation cannot be perceived by human eyes. What is more, we can iterate Equation (1) several times to obtain an adversarial sample by different adversarial iterations.  
Contrary to adversarial sample generation, updating the model is based on gradient descent:  
\[\theta^{\prime}=\mathbb{B}(\theta-\epsilon\cdot\
abla_{\theta}\mathcal{L}(D_ {\theta}(I),GT)) \tag{2}\]  
where \(\theta^{\prime}\) denotes the updated parameters.  
Equation (2) calculates gradient w.r.t model parameters \(\theta\). It aims to modulate model parameters to decrease the loss value. Meanwhile, Equation (1) aims to add some imperceptible perturbation on the image to increase the loss value, i.e., causing the wrong detection.  
Adversarial training. For a clean image \(I\), we can generate amounts of adversarial samples by attacking different losses or attacking several times. After calculating the loss  
Figure 4: Framework of YOLOv5s with a ViGE block.  
of clean image \(I\), we implement an adversarial attack on it and obtain adversarial samples. Then, we apply the same model to detect these adversarial images and calculate loss with the same ground truth as \(I\)'s to form the total training objective:  
\[\mathcal{L}=\mathcal{L}_{OD}+\lambda_{adv}\cdot\mathcal{L}_{adv}\]  
where \(\lambda_{adv}\) is the weight that balances the gradients calculated from the clean image and adversarial samples and is set as 0.2. The pseudo-code of adversarial training is in the following Algorithm 1.  
```
Input: Dataset \(\mathcal{D}\) Output: Updated network parameters \(\theta\)
1 for each training epochdo
2 Sample a batch \(\{I,GT\}\in\mathcal{D}\);
3 Compute object detection loss \(\mathcal{L}_{\text{OD}}(\mathbf{D}_{\theta}(I),GT)\);
4 Generate adversarial sample; \(\hat{I}=B(I+\epsilon\cdot sign(\
abla_{I}\mathcal{L}_{\text{od}}(\mathbf{D}_{ \theta}(I),GT)))\), which \(\mathcal{L}_{\text{od}}\) can be part of \(\mathcal{L}_{\text{OD}}\);
5 Compute adversarial loss \(\mathcal{L}_{\text{adv}}=\mathcal{L}_{\text{OD}}\big{(}\mathbf{D}_{\theta}( \hat{I}),GT\big{)}\);
6 Compute total loss \(\mathcal{L}=\mathcal{L}_{\text{OD}}+\lambda_{adv}\cdot\mathcal{L}_{\text{adv}}\);
7 Perform a step of gradient descent w.r.t. \(\theta\): min \(\mathcal{L}\)
8 end
```  
**Algorithm 1**Pseudo code of Adversarial training