On the Adversarial Robustness of Remote Sensing Semantic Change Detection

Weikang Yu; Yonghao Xu; Pedram Ghamisi

cs.CVAug 15, 2026

On the Adversarial Robustness of Remote Sensing Semantic Change Detection

Authors: Weikang Yu, Yonghao Xu, Pedram Ghamisi

Organizations: Helmholtz Institute Freiberg for Resource Technology, Helmholtz-Zentrum Dresden-Rossendorf, 09599 Freiberg, Germany · Department of Electrical Engineering, Linköping University, 58183 Linköping, Sweden

Abstract

Semantic change detection (SCD) is a bitemporal dense-prediction task that jointly identifies changed regions and their semantic states before and after change. Unlike single-image segmentation or binary change detection, SCD couples two temporal inputs with timestamp-wise semantic prediction, change localization, and final semantic-change decoding, creating adversarial dependencies that are not captured by conventional robustness protocols. We present a task-specific evaluation framework that separates output-side attack objectives from input-side temporal perturbation access, enabling systematic analysis of component vulnerability and cross-temporal propagation. Experiments on four datasets and six representative CNN-, Transformer-, and state-space-based models evaluate component-level and temporal objectives, single- and dual-timestamp perturbations, multiple attack methods, and cross-architecture transferability. The results show that final semantic-change predictions can be severely corrupted even when binary change localization remains comparatively stable, and that perturbations or attack objectives associated with one timestamp can propagate to the prediction of the other. These behaviors occur across different architecture families, while direct cross-model transfer remains considerably weaker than white-box attacks. The study demonstrates that adversarial robustness in SCD depends on the complete bitemporal prediction pathway rather than on an individual branch or backbone family, and provides a structured protocol for evaluating robustness in coupled bitemporal image analysis. Code is available at https://github.com/EricYu97/AdvSCD.

Figures & tables

Figure 1: Adversarial vulnerability and task-specific robustness evaluation in SCD. Norm-bounded perturbations affect timestamp-wise semantics, change localization, and semantic-change decoding. The framework evaluates attack objectives, temporal access, attack methods, transferability, and failure modes. Perturbations are magnified for visibility.

Figure 2: Task-specific adversarial robustness framework for SCD. Input access covers $T_{1}$ , $T_{2}$ , or both; output objectives target timestamp-wise semantics, binary change, or semantic change. Their combinations expose branch vulnerability, cross-temporal propagation, and final-output degradation.

Dataset	Image size	Resolution	Channels	Classes	Scene type	Dataset split (Patches) Train/Val./Test
HiUCD-Mini [ 39 ]	$256\times 256$	0.1 m	3 (RGB)	10	Urban	4800/944/6176
JL1 [ 4 ]	$256\times 256$	0.75 m	3 (RGB)	6	Cropland	4050/1950/1950
LandsatSCD [ 3 ]	$416\times 416$	30 m	3 (RGB)	5	Dryland	1431/477/477
SECOND [ 2 ]	$512\times 512$	0.5–3 m	3 (RGB)	7	Urban	2968/1694/1694

Table 1: Evaluated SCD datasets. Class counts include the no-change/no-label class.

Model	Family	Encoder	Fusion	Params. (M)	FLOPs (G)
HRSCD4 [ 16 ]	CNN	UNet-like	Concat.	13.71	36.73
EGMSNet [ 21 ]	CNN	ResNet-34	Diff.	30.73	215.61
BGSNet [ 22 ]	Transformer	PVTv2-B2	Cross-Attn.+Diff.	25.18	117.05
CPGNet [ 6 ]	Transformer	PVTv2-B2	Diff.+Concat.	55.38	87.24
ChangeMamba [ 7 ]	Mamba	VSSM-Base	SSM+Concat.	97.04	226.30
FoBa [ 23 ]	Mamba	VSSM-Small	Mul.+Concat.	53.95	107.33

Table 2: SCD models evaluated in the main experiments. FLOPs are for one

512\times 512

bitemporal image pair.

Model	OA	$P_{\mathrm{scd}}$	$R_{\mathrm{scd}}$	$F_{\mathrm{scd}}$	mIoU	SeK
HRSCD4	89.17	60.79	62.36	61.51	72.85	22.40
EGMSNet	92.97	74.48	74.23	74.28	80.26	40.46
BGSNet	91.09	78.19	65.08	70.57	76.58	33.82
CPGNet	93.24	74.89	75.75	75.15	80.45	40.84
ChangeMamba	93.81	74.51	77.72	76.00	81.40	42.66
FoBa	93.42	70.83	76.58	73.50	79.59	39.12

Table 3: Clean performance of the evaluated models averaged on four SCD datasets (%).

Model	$F_{\mathrm{bcd}}^{clean}$	$F_{\mathrm{bcd}}^{adv}$	$\mathrm{ASR}_{\mathrm{bcd}}$	$F_{\mathrm{seg}}^{clean}$	$F_{\mathrm{seg}}^{adv}$	$\mathrm{ASR}_{\mathrm{seg}}$	$F_{\mathrm{scd}}^{clean}$	$F_{\mathrm{scd}}^{adv}$	$\mathrm{ASR}_{\mathrm{scd}}$
HRSCD4	71.39	52.98	25.46	29.00	12.28	57.06	61.51	10.77	85.36
EGMSNet	80.12	60.85	23.11	46.48	14.55	70.57	74.28	8.36	89.62
BGSNet	76.60	52.25	31.76	44.66	13.17	73.52	70.57	8.01	89.20
CPGNet	80.12	57.48	27.63	42.23	15.41	68.25	75.15	8.15	89.59
ChangeMamba	80.95	57.77	27.67	45.25	16.57	66.97	76.00	8.29	89.69
FoBa	78.40	58.31	23.45	46.10	13.25	71.39	73.50	11.27	85.20

Table 4: Robustness under the default white-box setting: joint bitemporal PGD with the semantic-change target. Attack success rates are relative F-score reductions. The values are the average of results from four datasets.

Model	Sem.			BCD			Sem.+BCD			SCD			Joint
Model	$\mathrm{ASR}_{\mathrm{bcd}}$	$\mathrm{ASR}_{\mathrm{seg}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{bcd}}$	$\mathrm{ASR}_{\mathrm{seg}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{bcd}}$	$\mathrm{ASR}_{\mathrm{seg}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{bcd}}$	$\mathrm{ASR}_{\mathrm{seg}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{bcd}}$	$\mathrm{ASR}_{\mathrm{seg}}$	$\mathrm{ASR}_{\mathrm{scd}}$
HRSCD4	18.40	58.62	59.06	70.20	24.05	73.33	61.12	55.85	71.30	25.46	57.06	85.36	53.67	64.31	81.27
EGMSNet	44.07	57.79	66.08	85.57	60.15	88.60	45.81	58.15	67.01	23.11	70.57	89.62	44.24	67.12	77.78
BGSNet	49.94	67.75	68.80	72.28	51.50	76.24	63.73	63.53	72.46	31.76	73.52	89.20	53.07	72.58	77.95
CPGNet	35.68	57.39	60.70	75.53	48.79	78.92	60.50	55.31	69.50	27.63	68.25	89.59	55.03	66.98	80.91
ChangeMamba	46.51	73.82	71.96	79.69	55.37	83.45	72.09	73.29	78.89	27.67	66.97	89.69	55.23	77.38	82.71

Table 5: Attack success rates for component-level targets under joint bitemporal PGD. The values are the average of results from four datasets.

Model	Fusion	Target $\mathcal{L}_{\mathrm{scd}}^{T_{1}}$			Target $\mathcal{L}_{\mathrm{scd}}^{T_{2}}$			Target $\mathcal{L}_{\mathrm{scd}}$
Model	Fusion	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$
HRSCD4	Concat.	90.16	41.82	66.51	43.64	89.84	66.22	86.28	84.51	85.36
EGMSNet	Diff.	91.51	55.20	73.56	57.41	89.37	73.15	90.96	88.49	89.62
BGSNet	Cross-Attn.+Diff.	92.94	70.02	81.82	70.92	93.95	82.05	89.12	89.47	89.20
CPGNet	Diff.+Concat.	95.27	71.39	83.44	69.05	94.75	81.65	88.89	90.48	89.59
ChangeMamba	SSM+Concat.	95.57	70.39	83.07	69.64	95.02	82.25	90.05	89.33	89.69

Table 6: Attack success rates for temporal semantic-change targets under joint bitemporal PGD. The loss targets the

T_{1}

output, the

T_{2}

output, or both. The values are the average of results from four datasets.

Model	Fusion	$T_{1}$ Perturbed			$T_{2}$ Perturbed			$T_{1}+T_{2}$ Perturbed
Model	Fusion	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$
HRSCD4	Concat.	85.15	36.38	61.12	34.53	82.94	58.20	86.25	84.57	85.36
EGMSNet	Diff.	88.26	29.95	59.66	24.89	82.30	53.04	90.92	88.40	89.62
BGSNet	Cross-Attn.+Diff.	83.95	52.20	68.45	48.99	88.17	68.02	89.13	89.35	89.20
CPGNet	Diff.+Concat.	90.61	45.83	68.46	40.95	89.12	64.61	88.97	90.25	89.59
ChangeMamba	SSM+Concat.	90.19	31.86	61.23	27.35	89.39	58.05	90.11	89.29	89.69

Table 7: Attack success rates for PGD access to

T_{1}

T_{2}

, or both inputs, using the semantic-change target. The values are the average of results from four datasets.

Model	Gaussian	Jitter	FGSM	I-FGSM	C&W	PGD
HRSCD4	0.02	1.41	48.61	86.46	74.47	85.36
EGMSNet	0.02	3.16	59.78	90.66	72.68	89.62
BGSNet	0.02	1.95	49.80	89.75	76.10	89.20
CPGNet	0.05	2.38	48.55	90.95	73.01	89.59
ChangeMamba	0.05	2.07	47.43	90.95	67.46	89.69
FoBa	0.02	1.55	49.55	85.92	68.52	85.20

Table 8:

\mathrm{ASR}_{\mathrm{scd}}

(%) for perturbation methods. All methods are applied to both temporal inputs; gradient-based attacks use the semantic-change target. The values are the average of results from four datasets.

Source	Family	Target model
Source	Family	HRSCD4	EGMSNet	BGSNet	CPGNet	ChangeMamba	FoBa
HRSCD4	CNN	85.36	0.62	0.53	0.80	0.73	0.59
EGMSNet	CNN	1.05	89.62	2.72	3.47	3.64	3.35
BGSNet	Transformer	0.59	1.94	89.20	12.76	3.55	3.05
CPGNet	Transformer	0.87	3.42	26.59	89.59	7.29	6.18
ChangeMamba	Mamba	0.76	2.92	4.72	5.82	89.69	10.34

Table 9: Cross-architecture PGD transferability with the semantic-change target. Rows are source models, columns are target models, and entries are

\mathrm{ASR}_{\mathrm{scd}}

values. The values are the average of results from four datasets. Diagonal entries are white-box attacks noted in bold .

Model	HiUCD-Mini				JL1				LandsatSCD				SECOND
Model	ASR	$R_{\mathrm{sup}}$	$R_{\mathrm{hal}}$	$R_{\mathrm{trans}}$	ASR	$R_{\mathrm{sup}}$	$R_{\mathrm{hal}}$	$R_{\mathrm{trans}}$	ASR	$R_{\mathrm{sup}}$	$R_{\mathrm{hal}}$	$R_{\mathrm{trans}}$	ASR	$R_{\mathrm{sup}}$	$R_{\mathrm{hal}}$	$R_{\mathrm{trans}}$
HRSCD4	97.97	10.13	12.04	99.96	99.08	5.68	67.44	99.96	55.53	33.17	3.90	70.31	88.87	32.04	28.72	98.85
EGMSNet	96.68	2.54	10.39	99.69	97.34	1.82	44.11	99.98	75.18	26.11	14.31	75.15	89.29	6.44	24.09	98.71
BGSNet	92.78	2.35	17.57	99.26	89.19	34.38	18.76	98.44	83.42	20.90	23.53	84.02	91.42	3.46	47.14	97.76
CPGNet	89.62	7.88	7.91	98.69	86.29	33.01	18.07	98.09	87.66	34.82	10.09	89.60	94.77	17.56	33.64	98.85
ChangeMamba	94.56	9.30	7.28	99.41	88.88	40.48	20.12	98.53	83.69	18.35	17.94	90.68	91.62	5.54	36.93	98.12

Table 10: Error-mode rates (%) under default joint bitemporal PGD with the semantic-change target. Columns report attack success on

F_{\mathrm{scd}}

, change suppression, false-change hallucination, and transition corruption.

Figure 3: SCD error modes for BGSNet under default joint bitemporal PGD with the semantic-change target. Rows are datasets; columns show inputs, ground truth, clean and adversarial predictions, and masks for suppression ( $R_{\mathrm{sup}}$ ), hallucination ( $R_{\mathrm{hal}}$ ), and transition corruption ( $R_{\mathrm{trans}}$ ). Black marks affected pixels; percentages follow Eq. ( 9 ).

Figure S1: Component-level attack objectives on one SECOND sample under joint bitemporal perturbation. Paired columns show the final $T_{1}$ and $T_{2}$ semantic-change predictions. The examples illustrate distinct failure modes, including semantic replacement, change suppression, change-region expansion, and widespread corruption. These observations illustrate individual model behavior on the selected sample and are not intended as general architectural conclusions.

Figure S2: Temporal semantic-change targets on one LandsatSCD sample. Both inputs are perturbed while the loss targets the $T_{1}$ output, the $T_{2}$ output, or both.

Figure S3: Temporal perturbation access on one SECOND sample. Each model row shows paired $T_{1}$ and $T_{2}$ predictions for clean, $T_{1}$ -only, $T_{2}$ -only, and joint perturbations. Opposite-side changes indicate cross-temporal propagation.

Figure S4: Perturbation methods on one JL1 sample. Gaussian noise and jitter largely preserve the clean outputs, whereas gradient-based attacks cause semantic corruption; PGD is the default.

Dataset	Model	OA	$P_{\mathrm{scd}}$	$R_{\mathrm{scd}}$	$F_{\mathrm{scd}}$	mIoU	SeK
HiUCD-Mini	HRSCD4	94.03	42.31	47.68	44.83	68.04	8.67
	EGMSNet	95.02	61.78	56.35	58.94	73.79	20.37
	BGSNet	92.83	69.08	43.03	53.03	69.63	16.36
	CPGNet	94.96	65.38	56.10	60.39	73.69	21.27
	ChangeMamba	95.56	60.05	62.20	61.11	74.81	22.43
	FoBa	94.88	47.14	57.89	51.96	70.03	13.79

Table S1: Clean performance of the evaluated models on four SCD datasets (%).

Dataset	Model	$F_{\mathrm{bcd}}^{clean}$	$F_{\mathrm{bcd}}^{adv}$	$\mathrm{ASR}_{\mathrm{bcd}}$	$F_{\mathrm{seg}}^{clean}$	$F_{\mathrm{seg}}^{adv}$	$\mathrm{ASR}_{\mathrm{seg}}$	$F_{\mathrm{scd}}^{clean}$	$F_{\mathrm{scd}}^{adv}$	$\mathrm{ASR}_{\mathrm{scd}}$
HiUCD-Mini	HRSCD4	58.06	49.65	14.48	37.53	27.02	28.01	44.83	0.91	97.97
	EGMSNet	69.07	57.00	17.48	61.42	41.47	32.48	58.94	1.95	96.68
	BGSNet	64.25	43.84	31.77	56.48	37.77	33.13	53.03	3.83	92.78
	CPGNet	68.30	59.56	12.80	57.90	41.25	28.76	60.39	6.27	89.62
	ChangeMamba	69.40	59.89	13.70	53.71	36.21	32.58	61.11	3.33	94.56
	FoBa	61.24	60.33	1.48	47.43	35.28	25.63	51.96	4.28	91.77

Table S2: Robustness under the default white-box setting: joint bitemporal PGD with the semantic-change target. Attack success rates are relative F-score reductions.

Dataset	Model	Sem.			BCD			Sem.+BCD			SCD			Joint
Dataset	Model	$\mathrm{ASR}_{\mathrm{bcd}}$	$\mathrm{ASR}_{\mathrm{seg}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{bcd}}$	$\mathrm{ASR}_{\mathrm{seg}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{bcd}}$	$\mathrm{ASR}_{\mathrm{seg}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{bcd}}$	$\mathrm{ASR}_{\mathrm{seg}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{bcd}}$	$\mathrm{ASR}_{\mathrm{seg}}$	$\mathrm{ASR}_{\mathrm{scd}}$
HiUCD-Mini	HRSCD4	16.50	86.69	87.50	92.48	25.12	93.85	87.13	83.85	95.69	14.48	28.01	97.97	73.29	84.35	98.19
	EGMSNet	61.52	75.38	90.15	98.30	53.72	98.97	66.07	75.84	91.81	17.48	32.48	96.68	58.30	77.47	95.84
	BGSNet	64.64	84.04	92.53	88.22	58.76	91.01	84.92	74.29	94.22	31.77	33.13	92.78	76.77	75.44	96.01
	CPGNet	57.49	76.72	90.28	93.84	58.05	95.12	85.21	69.01	94.23	12.80	28.76	89.62	72.03	70.35	95.52
	ChangeMamba	63.94	87.29	94.94	95.72	66.22	97.64	93.28	87.57	98.05	13.70	32.58	94.56	78.87	86.98	97.52

Table S3: Attack success rates for component-level targets under joint bitemporal PGD.

Dataset	Model	Fusion	Target $\mathcal{L}_{\mathrm{scd}}^{T_{1}}$			Target $\mathcal{L}_{\mathrm{scd}}^{T_{2}}$			Target $\mathcal{L}_{\mathrm{scd}}$
Dataset	Model	Fusion	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$
HiUCD-Mini	HRSCD4	Concat.	99.36	34.19	69.91	38.20	98.62	65.54	98.14	97.76	97.97
	EGMSNet	Diff.	98.04	61.20	81.38	62.46	97.37	78.26	96.77	96.60	96.68
	BGSNet	Cross-Attn.+Diff.	96.55	60.03	80.11	60.86	96.43	76.89	92.11	93.65	92.78
	CPGNet	Diff.+Concat.	96.43	64.06	81.27	53.69	95.07	73.09	88.88	90.51	89.62
	ChangeMamba	SSM+Concat.	98.35	73.25	86.56	75.56	98.13	86.17	94.84	94.17	94.56

Table S4: Attack success rates for temporal semantic-change targets under joint bitemporal PGD. The loss targets the

T_{1}

output, the

T_{2}

output, or both.

Dataset	Model	Fusion	$T_{1}$ Perturbed			$T_{2}$ Perturbed			$T_{1}+T_{2}$ Perturbed
Dataset	Model	Fusion	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{1}}$	$\mathrm{ASR}_{\mathrm{scd}}^{T_{2}}$	$\mathrm{ASR}_{\mathrm{scd}}$
HiUCD-Mini	HRSCD4	Concat.	99.02	46.43	75.36	36.82	97.85	64.30	98.10	97.81	97.97
	EGMSNet	Diff.	96.19	21.68	62.54	21.71	95.16	54.90	96.77	96.58	96.68
	BGSNet	Cross-Attn.+Diff.	90.84	42.68	69.18	33.76	92.08	59.99	92.19	93.50	92.78
	CPGNet	Diff.+Concat.	91.49	32.19	63.75	21.11	90.38	53.52	88.94	90.38	89.62
	ChangeMamba	SSM+Concat.	95.18	30.43	64.85	18.88	95.60	54.81	94.81	94.27	94.56

Table S5: Attack success rates for PGD access to

T_{1}

T_{2}

, or both inputs, using the semantic-change target.

Dataset	Model	Gaussian	Jitter	FGSM	I-FGSM	C&W	PGD
HiUCD-Mini	HRSCD4	0.07	0.23	75.48	98.00	97.58	97.97
	EGMSNet	0.02	2.18	78.66	96.61	95.82	96.68
	BGSNet	0.01	0.00	63.27	93.61	91.42	92.78
	CPGNet	0.06	0.84	54.98	90.98	88.82	89.62
	ChangeMamba	0.04	1.23	62.37	95.54	90.79	94.56
	FoBa	0.00	0.59	73.35	92.27	90.17	91.77

Table S6:

\mathrm{ASR}_{\mathrm{scd}}

(%) for perturbation methods. All methods are applied to both temporal inputs; gradient-based attacks use the semantic-change target.

Dataset	Source	Family	Target model
Dataset	Source	Family	HRSCD4	EGMSNet	BGSNet	CPGNet	ChangeMamba	FoBa
HiUCD-Mini	HRSCD4	CNN	97.97	0.20	0.39	0.28	0.22	0.16
	EGMSNet	CNN	1.14	96.68	3.90	4.21	4.61	4.40
	BGSNet	Transformer	0.74	3.10	92.78	19.51	5.32	5.21
	CPGNet	Transformer	1.17	3.83	27.74	89.62	8.28	8.03
	ChangeMamba	Mamba	1.08	4.36	7.16	9.12	94.56	18.98

Table S7: Cross-architecture PGD transferability with the semantic-change target. Rows are source models, columns are target models, and entries are

\mathrm{ASR}_{\mathrm{scd}}

values. Diagonal entries are white-box attacks noted in bold .

Model / Stat.	Water	Grass	Building	Green House	Road	Bridge	Others	Bareland	Woodland
Frequency	0.44	20.87	11.74	0.23	23.89	0.45	12.31	26.40	1.19
HRSCD4	0.00/0.00	49.11/14.94	77.02/13.25	0.00/0.00	70.44/11.95	0.00/0.00	49.80/95.15	62.72/35.35	66.21/14.52
EGMSNet	60.62/48.89	49.06/14.02	83.38/8.25	69.38/80.68	73.35/12.04	74.14/7.42	63.79/89.71	66.72/32.25	73.71/9.50
BGSNet	64.62/52.69	52.58/13.13	78.21/8.36	69.13/77.96	73.89/11.00	15.89/2.43	64.17/76.64	70.11/31.84	76.23/7.51
CPGNet	67.04/41.20	51.13/11.34	80.07/6.63	74.78/58.10	74.79/8.96	15.99/5.35	65.47/77.67	71.04/29.17	78.72/6.65
ChangeMamba	65.95/41.95	56.43/13.25	74.33/10.26	58.80/73.42	73.83/11.45	5.81/16.49	60.57/89.40	67.12/31.95	74.31/5.48

Table S8: Class-wise vulnerability (%) under joint bitemporal PGD with the semantic-change target. The first row gives each class’s source-or-target frequency among changed transitions; model entries give

F_{\mathrm{scd}}^{c,\mathrm{clean}}/\mathrm{ASR}_{\mathrm{scd}}^{c}

. HiUCD-Mini frequencies do not sum to 100% because about 3% of changed transitions involve the omitted unlabeled class.

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 481 papers

Learning Semantic-Robust Change Detection via Semantic-Invariant Self-Distillation
Jul 21, 2026Jiuhe Qu, Yingping Liang, Ying FuDistribution Shift Robustness Remote Sensing Change Detection
Beijing Institute of Technology, Beijing, China
SemDINO: A DINOv3-Driven Network for Cross-Temporal Semantic Alignment in Change Detection
Jun 8, 2026Xinyu Tong, Meihua Zhou, Jinxiao Sun +2Remote Sensing Change Detection Semantic Change Detection
Xinjiang Institute of Ecology and Geography, Chinese Academy of Sciences, Urumqi 830011, China · University of Chinese Academy of Sciences, Beijing 100049, China · School of Computer Science, Xiangtan University, Xiangtan 411105, China +1
ChangeT $^3$ : Evaluating Vision Test-Time Training for Remote Sensing Change Detection
Oct 11, 2026Sharukshan Niranjan, Oshadha Samarakoon, Nichula Wasalathilaka +3Remote Sensing Change Detection Test-Time Training
University of Peradeniya, Peradeniya, Sri Lanka

Jul 21, 2026J/K move · Enter open · S save

Learning Semantic-Robust Change Detection via Semantic-Invariant Self-Distillation

Jiuhe Qu, Yingping Liang, Ying Fu

Beijing Institute of Technology, Beijing, China

Distribution Shift Robustness Remote Sensing Change Detection Self-Distillation Semantic Change Detection Diffusion-Based Data Augmentation

Open paper AskPDF arXiv

Change detection aims to identify semantic changes between remote sensing images. However, features from models are easily disturbed by non-semantic variations, such as illumination, shadows, and atmospheric changes, leading to false alarms and limited generalization in real-world scenarios. In this paper, we propose SCDistill, a framework for learning semantic-robust change detection via semantic-invariant self-distillation. First, to strengthen semantic consistency, we introduce a semantic-invariant self-distillation strategy that learns semantic robustness from perturbed yet semantically consistent data, empowering the change detector to extract disturbance-resistant features and achieve more reliable and accurate semantic change identification. Second, to expand paired data with non-semantic variations, we design a diffusion-based perturbation simulation pipeline that synthesizes complex environmental changes, enabling the model to explicitly learn to distinguish semantic changes from appearance-level fluctuations and reduce false alarms caused by non-semantic disturbances. These components promote robustness from data and representation perspectives, leading to synergistic performance gains. Extensive experiments demonstrate that SCDistill achieves state-of-the-art performance on multiple semantic change detection benchmarks and exhibits strong generalization to binary change detection and change captioning tasks. Code is accessible at https://github.com/elecreak/SCDistill.

Abstract

Adversarial Robustness

Explore similar work

Learning Semantic-Robust Change Detection via Semantic-Invariant Self-Distillation

SemDINO: A DINOv3-Driven Network for Cross-Temporal Semantic Alignment in Change Detection

ChangeT3^33: Evaluating Vision Test-Time Training for Remote Sensing Change Detection

ChangeT $^3$ : Evaluating Vision Test-Time Training for Remote Sensing Change Detection