Adversarial Attacks Disrupt Vision Algorithms on Autonomous Agricultural Sensing Platforms

Autonomous agricultural machinery increasingly relies on vision-based deep learning pipelines to inspect orchard canopies, count fruit loads, and navigate tree rows in real time. A comprehensive investigation conducted by Hari Krishna Parvatham, Shiyu Liu, Yiannis Ampatzidis, and Prabhat Mishra evaluates how these perception models behave when exposed to intentional, gradient-based adversarial perturbations. Because deployed agricultural robots aggregate individual frame detections into geo-referenced field maps and operational farm inventories, minor image-level corruptions do not remain isolated. Instead, they cascade directly into large-scale counting errors, distorting automated yield estimation, variable-rate chemical spraying, selective crop thinning, and autonomous tractor navigation.

Modern precision agriculture systems deploy single-stage neural architectures directly onto resource-constrained edge computing hardware to process continuous visual streams without constant human supervision. The Agrosense v2 platform exemplifies this operational design, carrying vehicle-mounted RGB-D cameras alongside Real-Time Kinematic Global Navigation Satellite Systems and Inertial Measurement Units to generate tree-level citrus orchard maps during field traversal. Prior investigations into smart agriculture security focused almost exclusively on network infrastructure, internet-of-things devices, cloud interfaces, and wireless communication channels. In contrast, the vulnerability of the primary perception layer, which converts raw camera pixels into actionable bounding boxes and class probabilities, remained largely unexamined despite operating without downstream safety filters. When an autonomous harvester or sprayer ingests corrupted imagery, erroneous detections are immediately executed as field actions, making visual robustness an essential system-level reliability requirement rather than a purely academic benchmark.

To rigorously quantify this threat surface, the authors subjected state-of-the-art YOLOv11n detectors to two standard gradient-guided attack formulations across seven perturbation budgets scaled from one to sixty-four on a standard zero-to-two-hundred-fifty-five pixel range. The Fast Gradient Sign Method applied single-step updates along the loss gradient sign to maximally degrade model outputs with minimal computational effort. Projected Gradient Descent extended this attack into an iterative regime, applying ten successive small steps scaled to one-fourth of the perturbation budget, projecting intermediate tensors back into an infinity-norm bounded sphere after each iteration. In parallel, researchers implemented a complementary label-aware diagnostic that maximized native Ultralytics detection losses, penalizing bounding box regression, classification, and distribution focal loss terms simultaneously.

Experimental evaluations probed two distinct vision tasks trained on citrus orchard imagery: single-class tree-trunk detection and two-class fruit detection distinguishing fruit on the tree from fruit on the ground. The trunk dataset incorporated seventeen hundred sixteen training images, two hundred fifteen validation images, and two hundred fourteen held-out test images gathered by Agrosense v2 at the Southwest Florida Research and Education Center, utilizing depth-filtered distance masking to isolate immediate rows. The fruit dataset combined field captures from two commercial citrus orchards with the public CitDet repository, totaling eleven hundred thirty-two training images, one hundred forty-two validation images, and one hundred forty-one test images. Under clean, unperturbed testing conditions, the baseline YOLOv11n trunk detector achieved an exceptional mean average precision of ninety-nine point thirty-six percent at an intersection-over-union threshold of zero point five, while the more visually complex fruit detector reached fifty-four point ninety-nine percent.

Exposing undefended detectors to iterative Projected Gradient Descent triggered immediate and steep performance collapses across both agricultural tasks. For trunk detection, mean average precision fell from ninety-nine point thirty-six percent on clean inputs to fifty-two point sixty-five percent at a subtle perturbation budget of four, sinking further to thirteen point eighty-four percent at budget eight and collapsing entirely to zero point thirteen percent under severe budget sixty-four perturbations. Fruit detection exhibited an even narrower robustness margin due to small object scales, heavy foliage occlusion, and background visual clutter. At a perturbation budget of merely two, undefended fruit detection accuracy dropped by nearly half to twenty-eight point seventy-five percent, falling to eight point sixteen percent at budget four, zero point fifty-four percent at budget eight, and zero point zero one percent at budget sixty-four, demonstrating extreme vulnerability.

The study demonstrated that these algorithmic collapses translate directly into catastrophic losses for automated agricultural recordkeeping. Evaluating preserved detections against clean pipeline references containing exactly two hundred seventy-four trunks and four thousand fifty-eight fruits exposed the operational hazard. Under iterative attack at budget eight, the undefended trunk detector preserved only fifteen point six trunk instances, while complete detection disruption, representing images that lost all valid targets, surged to ninety-two point seventy-seven percent. For fruit detection at budget eight, preserved detections plummeted from four thousand fifty-eight down to nine point eight fruits, with complete disruption reaching ninety-four point eighty-two percent and count mean absolute error climbing to thirty-four point zero one objects per image. Furthermore, detection expected calibration error quadrupled on surviving boxes, confirming that reported confidence scores no longer reflected prediction correctness under adversarial disruption.

To investigate remediation strategies, the authors benchmarked three defensive families: input-level JPEG compression at quality factors fifty and seventy-five, a learned clean autoencoder reconstruction network, and model-level adversarial fine-tuning. The autoencoder utilized a convolutional U-Net topology comprising one million nine hundred twenty-eight thousand four hundred eighty-three trainable parameters, trained strictly on clean training imagery using an absolute error loss function. Clean test evaluations confirmed high image reconstruction fidelity, maintaining peak signal-to-noise ratios of forty-four point zero decibels for trunk images and thirty-nine point ninety-nine decibels for fruit images. Under non-adaptive attacks, input preprocessing provided noticeable recovery; for example, JPEG quality fifty raised trunk accuracy at budget eight from thirteen point eighty-four percent back up to eighty-nine point twenty-two percent, while the autoencoder recovered forty-eight point zero four percent.

However, the apparent protection offered by input transformations diminished sharply when subjected to rigorous defense-aware evaluations. When attackers deployed backward pass differentiable approximations through JPEG quantizers or differentiated directly through the autoencoder bottleneck, defensive recovery decayed substantially. Under defense-aware iterative attacks at budget eight, trunk accuracy for JPEG quality fifty dropped from eighty-nine point twenty-two percent down to forty-seven point thirty-nine percent, while the autoencoder dropped to thirty point ninety-eight percent. In fruit detection, defense-aware testing reduced JPEG performance at budget eight to six point eighty percent and autoencoder accuracy to zero point sixty-two percent. These empirical findings demonstrate that input-level denoising mechanisms primarily introduce gradient obstruction rather than true structural security, proving incapable of reshaping the underlying neural decision boundaries required to defend fine visual details against adaptive threats.

In contrast, model-level adversarial fine-tuning over ten epochs using a balanced mixture of clean and attacked images produced the highest robustness gains against transfer confidence suppression attacks. When fine-tuned on budget sixty-four examples, the trunk detector maintained fifty-nine point fifty-eight percent accuracy at budget sixty-four under iterative attack, preserving one hundred nine point four trunk detections and cutting complete disruption to twelve point fifty-one percent at budget eight. Nonetheless, fine-tuning introduced complex performance trade-offs, particularly for fruit perception where clean baseline accuracy declined from fifty-four point ninety-nine percent down to thirty-eight point ninety percent. Furthermore, when challenged with native detection-loss attacks optimized directly against fine-tuned checkpoints, trunk accuracy dropped to thirty-six point eighty-nine percent at budget two and fruit accuracy fell to one point eighteen percent, showing that model hardening remained highly specialized to specific training objectives.

Computational overhead and architectural trade-offs further constrain deployment on agricultural field platforms. On an enterprise graphics processor, baseline YOLOv11n inference required eight point sixty-two milliseconds per frame for trunk detection and seventeen point sixty-five milliseconds for fruit detection. While JPEG compression added modest latency and preserved memory footprints, the autoencoder reconstruction defense more than doubled trunk processing time to twenty-one point zero four milliseconds and increased fruit inference to seventy-nine point seventy-three milliseconds, consuming over nine hundred megabytes of dedicated memory. The researchers concluded that vision detectors cannot serve as standalone points of failure. Future autonomous agricultural platforms must incorporate cross-modal sensor verification, using depth geometry, inertial motion constraints, and temporal tracking consistency to detect perception anomalies before corrupted image detections propagate into automated farm management decisions.

Subject of Research: Adversarial robustness and defense evaluations in agricultural vision perception systems

Article Title: Adversarial robustness of vision-based perception in precision agriculture: Attacks, defenses, and a case study on the Agrosense v2 platform

Article References: Parvatham, H. K., Liu, S., Ampatzidis, Y., & Mishra, P. (2026). Adversarial robustness of vision-based perception in precision agriculture: Attacks, defenses, and a case study on the Agrosense v2 platform. Smart Agricultural Technology, 15, Article 102697. https://doi.org/10.1016/j.atech.2026.102697

Image Credits: AI Generated

DOI: 10.1016/j.atech.2026.102697

Keywords: precision agriculture, adversarial robustness, Agrosense v2, YOLOv11n, Fast Gradient Sign Method, Projected Gradient Descent, tree trunk detection, fruit detection, adversarial fine-tuning, autoencoder reconstruction, JPEG compression, edge computing, downstream mapping, computer vision security, threat modeling, cross-architecture transfer