Affiliation:
1. School of Electronic Science, National University of Defense Technology (NUDT), Changsha 410073, China
2. Test Center, National University of Defense Technology (NUDT), Xi’an 710100, China
Abstract
Recent research has revealed that the deep neural network (DNN)-based synthetic-aperture radar (SAR) automatic target recognition (ATR) techniques are vulnerable to adversarial examples, which poses significant security risks for their deployment in real-world systems. At the same time, the adversarial examples often exhibit transferability across DNN models, whereby when they are generated on the surrogate model they can also attack other target models. As the significant property in black-box scenarios, transferability has been enhanced by various methods, among which input transformations have demonstrated excellent effectiveness. However, we find that existing transformations suffer from limited enhancement of transferability due to the unique imaging mechanism and scattering characteristics of SAR images. To overcome this issue, we propose a novel method called intra-class transformations and inter-class nonlinear fusion attack (ITINFA). It enhances transferability from two perspectives: intra-class single image transformations and inter-class multiple images fusion. The intra-class transformations module utilizes a series of diverse transformations that align with the intrinsic characteristics of SAR images to obtain a more stable gradient update direction and prevent the adversarial examples from overfitting the surrogate model. The inter-class fusion strategy incorporates the information from other categories in a nonlinear manner, effectively enhances the feature fusion effect, and guides the misclassification of adversarial examples. Extensive experiments on the MSTAR dataset and SEN1-2 dataset demonstrate that ITINFA exhibits significantly better transferability than the existing transfer-based methods, with the average transfer attack success rate increases exceeding 8% for single models and over 4% for ensemble models.
Funder
National Natural Science Foundation of China
Changsha Outstanding Innovative Youth Training Program
Reference63 articles.
1. An Advanced Scheme for Range Ambiguity Suppression of Spaceborne SAR Based on Blind Source Separation;Chang;IEEE Trans. Geosci. Remote Sens.,2022
2. Synthetic Aperture Radar Image Statistical Modeling: Part One-Single-Pixel Statistical Models;Yue;IEEE Geosci. Remote Sens. Mag.,2020
3. Target Classification Using the Deep Convolutional Networks for SAR Images;Chen;IEEE Trans. Geosci. Remote Sens.,2016
4. Wang, C., Pei, J., Wang, Z., Huang, Y., Wu, J., Yang, H., and Yang, J. (2020). When Deep Learning Meets Multi-Task Learning in SAR ATR: Simultaneous Target Recognition and Segmentation. Remote Sens., 12.
5. Deep Learning Meets SAR: Concepts, Models, Pitfalls, and Perspectives;Zhu;IEEE Geosci. Remote Sens. Mag.,2021