Adversarial Robustness of Deep Learning Models for Inland Water Body Segmentation from SAR Images

TL;DR

The paper tackles the robustness of inland water body segmentation from SAR imagery to manual labeling errors by introducing morphological label noise as a data-poisoning adversary in training U-Net models. A new dataset based on the Amazon River Basin is created with NDWI-derived ground-truth masks and accompanying adversarial examples, and several segmentation models (U-Net, DeepLabV3+, SegFormer, Mask2Former) are benchmarked. Results show that U-Net and peers maintain high performance on clean data and tolerate substantial boundary-level corruption (up to ~17–20%), but performance degrades under higher levels of adversarial noise, with dilation-induced corruption being more damaging than erosion. The work highlights the critical impact of ground-truth quality on segmentation performance and provides publicly available code and dataset to support robust geospatial water-body delineation for flood mapping and environmental monitoring.

Abstract

Inland water body segmentation from Synthetic Aperture Radar (SAR) images is an important task needed for several applications, such as flood mapping. While SAR sensors capture data in all-weather conditions as high-resolution images, differentiating water and water-like surfaces from SAR images is not straightforward. Inland water bodies, such as large river basins, have complex geometry, which adds to the challenge of segmentation. U-Net is a widely used deep learning model for land-water segmentation of SAR images. In practice, manual annotation is often used to generate the corresponding water masks as ground truth. Manual annotation of the images is prone to label noise owing to data poisoning attacks, especially due to complex geometry. In this work, we simulate manual errors in the form of adversarial attacks on the U-Net model and study the robustness of the model to human errors in annotation. Our results indicate that U-Net can tolerate a certain level of corruption before its performance drops significantly. This finding highlights the crucial role that the quality of manual annotations plays in determining the effectiveness of the segmentation model. The code and the new dataset, along with adversarial examples for robust training, are publicly available. (GitHub link - https://github.com/GVCL/IWSeg-SAR-Poison.git)

Figures (13)

• Figure 1: Samples of SAR images from Sentinel-1 with inland water bodies with complex geometry in the Amazon River Basin, which is a region of interest in our work.
• Figure 2: The workflow of our proposed method used for simulating adversarial attacks in ground truth generation for inland water body segmentation.
• Figure 3: Examples of Sentinel-1 SAR images of the Amazon River Basin (left) in our dataset, along with their generated binary water masks (right).
• Figure 4: Regions of the Amazon River Basin used as images in our curated dataset for both training and testing. The images are taken from six non-overlapping regions, marked as regions A to F, capturing the complexity of the geometry of the river system. This image has been generated using QGIS.
• Figure 5: Zoomed-in version of regions A to F from Figure \ref{['fig:regions']}, where the rectangles indicate the images used in our curated dataset. These images have been generated using QGIS.