Abstract
We evaluate perturbation support and image-restoration controls on a locked remote sensing object-detection benchmark. On 100 FAIR1M images, a perturbation-free 640-pixel attack/export path loses 113 of 1247 original clean matches and gains 104 new matches, giving 9.06% target-conditioned ASR despite similar pooled Recall. Relative to the clean image passed through that same path, Global, Box, Polygon and SAM PGD-ZS yield 61.47%, 32.55%, 26.66% and 24.39% ASR. A separate equal-area comparison gives a source-referenced ASR of 28.39% for target-aligned SAM versus 11.73% averaged over random offsets; SAM minus target-aligned geometry is −0.88 percentage points (95% CI, −2.42 to 0.42), leaving a SAM-specific contour benefit unresolved. Five-fold held-out restoration and two additional repetitions separate resampling, learned correction and confidence selection. The correction-disabled 384-pixel path lowers envelope-IoU Recall from 42.37% to 32.89%; learned correction at gain 0.15 raises it to 36.40%. With the same confidence gate, correction-disabled and learned paths give 43.80% and 44.24% Recall. Incremental learned-versus-control Recall and native Ultralytics ProbIoU-based AP intervals span zero at both gains; gain 0.5 adds 48 false positives (95% CI, 1 to 103). Bilateral filtering improves native mAP50 by 2.75 points (0.78 to 4.82) and Recall by 1.60 points (0.47 to 2.84). Exact-forward BPDA gives pipeline Recall values of 23.40% and 26.86% at gains 0.15 and 0.5. These results support a controlled evaluation protocol while leaving contour-specific and incremental gated-learning benefits unestablished. Restoration uses paired-clean oracle masks, and intervals condition on the fixed detector, attacks and saved models.