Adversarial Attacks as a Diagnostic Tool for a Mining Detection Network in the Brazilian Legal Amazon - Grupioni, Leonardo Fajardo; Santos, Gabriel Stephano; Cugnasca, Paulo Sérgio; Almeida, Felipe Valencia de (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais Estendidos do XXVI Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg_estendido.2026.33861, 2026)
Convolutional neural networks (CNNs) applied to satellite imagery are increasingly adopted as the standard tool to detect mining in the Brazilian Legal Amazon, as their predicition start to feed environmental enforcement pipelines. We trained such a CNN and obtained an F1-Score of 0.9247 with an AUC of 0.9930. Adversarial attacks show that these numbers hide what the model learned. With the addition of random noise in the data, up to 45% of the of forest patches were missclassified as mining, while low-pass noise with the same budget and the same mean shift turns 0.5%, so the decision rests on high frequency texture. The fragility is asymmetric, since one FGSM step at 4/255 converts every forest patch into mining but evades only 5% of the real mining.