Towards a Better Characterization of Adversarial Attacks in Geospatial Imagery

Manipulated satellite imagery threatens analytic workflows, policy decisions, and trust in geospatial intelligence. Operational systems increasingly benefit from capabilities for both manipulation detection and manipulation-family attribution to support verification, triage, and downstream analysis. We present a unified benchmark for characterizing three representative manipulation families in geospatial imagery—generative manipulations, pixel-level perturbations, and adversarial patches—using a controlled, class-balanced design and 20 modern vision architectures spanning conventional, Earth-observation-pretrained, and vision-language models. Across architectures, the dominant failure boundary is between authentic imagery and subtle pixel-level perturbations, whereas generative manipulations and adversarial patches are generally more separable under matched in-domain conditions. Additional analyses reveal important generalization limitations under unseen manipulation variants and external-domain transfer, demonstrating that strong benchmark performance does not necessarily translate to reliable operational screening. The framework also enables systematic comparison of unified multi-attack and specialized detection strategies, providing insight into their relative strengths and limitations. Rather than proposing a new defense, this work provides a reproducible methodology for characterizing manipulation artifacts, model failure modes, and deployment-relevant screening behavior in geospatial imagery, with applications to analyst triage, verification workflows, and trustworthy use of satellite data.