SAR-PATT: A Physical Adversarial Attack for SAR Image Automatic Target Recognition
Deep neural network-based synthetic aperture radar (SAR) automatic target recognition (ATR) systems are susceptible to attack by adversarial examples, which leads to misclassification by the SAR ATR system, resulting in theoretical model robustness problems and security problems in practice. Inspire...
Saved in:
| Main Authors: | , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2024-12-01
|
| Series: | Remote Sensing |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2072-4292/17/1/21 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1841548984501403648 |
|---|---|
| author | Binyan Luo Hang Cao Jiahao Cui Xun Lv Jinqiang He Haifeng Li Chengli Peng |
| author_facet | Binyan Luo Hang Cao Jiahao Cui Xun Lv Jinqiang He Haifeng Li Chengli Peng |
| author_sort | Binyan Luo |
| collection | DOAJ |
| description | Deep neural network-based synthetic aperture radar (SAR) automatic target recognition (ATR) systems are susceptible to attack by adversarial examples, which leads to misclassification by the SAR ATR system, resulting in theoretical model robustness problems and security problems in practice. Inspired by optical images, current SAR ATR adversarial example generation is performed in the image domain. However, the imaging principle of SAR images is based on the imaging of the echo signals interacting between the SAR and objects. Generating adversarial examples only in the image domain cannot change the physical world to achieve adversarial attacks. To solve these problems, this article proposes a framework for generating SAR adversarial examples in a 3D physical scene. First, adversarial attacks are implemented in the 2D image space, and the perturbation in the image space is converted into simulated rays that constitute SAR images through backpropagation optimization methods. The mapping between the simulated rays constituting SAR images and the 3D model is established through coordinate transformation, and point correspondence to triangular faces and intensity values to texture parameters are established. Thus, the simulated rays constituting SAR images are mapped to the 3D model, and the perturbation in the 2D image space is converted back to the 3D physical space to obtain the position and intensity of the perturbation in the 3D physical space, thereby achieving physical adversarial attacks. The experimental results show that our attack method can effectively perform SAR adversarial attacks in the physical world. In the digital world, we achieved an average fooling rate of up to 99.02% for three objects in six classification networks. In the physical world, we achieved an average fooling rate of up to 97.87% for these objects, with a certain degree of transferability across the six different network architectures. To the best of our knowledge, this is the first work to implement physical attacks in a full physical simulation condition. Our research establishes a theoretical foundation for the future concealment of SAR targets in practical settings and offers valuable insights for enhancing the attack and defense capabilities of subsequent DNNs in SAR ATR systems. |
| format | Article |
| id | doaj-art-42bfe17c5eae40ab9e5d51683da14a07 |
| institution | Kabale University |
| issn | 2072-4292 |
| language | English |
| publishDate | 2024-12-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Remote Sensing |
| spelling | doaj-art-42bfe17c5eae40ab9e5d51683da14a072025-01-10T13:19:58ZengMDPI AGRemote Sensing2072-42922024-12-011712110.3390/rs17010021SAR-PATT: A Physical Adversarial Attack for SAR Image Automatic Target RecognitionBinyan Luo0Hang Cao1Jiahao Cui2Xun Lv3Jinqiang He4Haifeng Li5Chengli Peng6School of Geosciences and Info-Physics, Central South University, South Lushan Road, Changsha 410083, ChinaSchool of Geosciences and Info-Physics, Central South University, South Lushan Road, Changsha 410083, ChinaSchool of Geosciences and Info-Physics, Central South University, South Lushan Road, Changsha 410083, ChinaSchool of Geosciences and Info-Physics, Central South University, South Lushan Road, Changsha 410083, ChinaSchool of Geosciences and Info-Physics, Central South University, South Lushan Road, Changsha 410083, ChinaSchool of Geosciences and Info-Physics, Central South University, South Lushan Road, Changsha 410083, ChinaSchool of Geosciences and Info-Physics, Central South University, South Lushan Road, Changsha 410083, ChinaDeep neural network-based synthetic aperture radar (SAR) automatic target recognition (ATR) systems are susceptible to attack by adversarial examples, which leads to misclassification by the SAR ATR system, resulting in theoretical model robustness problems and security problems in practice. Inspired by optical images, current SAR ATR adversarial example generation is performed in the image domain. However, the imaging principle of SAR images is based on the imaging of the echo signals interacting between the SAR and objects. Generating adversarial examples only in the image domain cannot change the physical world to achieve adversarial attacks. To solve these problems, this article proposes a framework for generating SAR adversarial examples in a 3D physical scene. First, adversarial attacks are implemented in the 2D image space, and the perturbation in the image space is converted into simulated rays that constitute SAR images through backpropagation optimization methods. The mapping between the simulated rays constituting SAR images and the 3D model is established through coordinate transformation, and point correspondence to triangular faces and intensity values to texture parameters are established. Thus, the simulated rays constituting SAR images are mapped to the 3D model, and the perturbation in the 2D image space is converted back to the 3D physical space to obtain the position and intensity of the perturbation in the 3D physical space, thereby achieving physical adversarial attacks. The experimental results show that our attack method can effectively perform SAR adversarial attacks in the physical world. In the digital world, we achieved an average fooling rate of up to 99.02% for three objects in six classification networks. In the physical world, we achieved an average fooling rate of up to 97.87% for these objects, with a certain degree of transferability across the six different network architectures. To the best of our knowledge, this is the first work to implement physical attacks in a full physical simulation condition. Our research establishes a theoretical foundation for the future concealment of SAR targets in practical settings and offers valuable insights for enhancing the attack and defense capabilities of subsequent DNNs in SAR ATR systems.https://www.mdpi.com/2072-4292/17/1/21synthetic aperture radar (SAR)deep neural networkadversarial attackphysical attackSAR simulation |
| spellingShingle | Binyan Luo Hang Cao Jiahao Cui Xun Lv Jinqiang He Haifeng Li Chengli Peng SAR-PATT: A Physical Adversarial Attack for SAR Image Automatic Target Recognition Remote Sensing synthetic aperture radar (SAR) deep neural network adversarial attack physical attack SAR simulation |
| title | SAR-PATT: A Physical Adversarial Attack for SAR Image Automatic Target Recognition |
| title_full | SAR-PATT: A Physical Adversarial Attack for SAR Image Automatic Target Recognition |
| title_fullStr | SAR-PATT: A Physical Adversarial Attack for SAR Image Automatic Target Recognition |
| title_full_unstemmed | SAR-PATT: A Physical Adversarial Attack for SAR Image Automatic Target Recognition |
| title_short | SAR-PATT: A Physical Adversarial Attack for SAR Image Automatic Target Recognition |
| title_sort | sar patt a physical adversarial attack for sar image automatic target recognition |
| topic | synthetic aperture radar (SAR) deep neural network adversarial attack physical attack SAR simulation |
| url | https://www.mdpi.com/2072-4292/17/1/21 |
| work_keys_str_mv | AT binyanluo sarpattaphysicaladversarialattackforsarimageautomatictargetrecognition AT hangcao sarpattaphysicaladversarialattackforsarimageautomatictargetrecognition AT jiahaocui sarpattaphysicaladversarialattackforsarimageautomatictargetrecognition AT xunlv sarpattaphysicaladversarialattackforsarimageautomatictargetrecognition AT jinqianghe sarpattaphysicaladversarialattackforsarimageautomatictargetrecognition AT haifengli sarpattaphysicaladversarialattackforsarimageautomatictargetrecognition AT chenglipeng sarpattaphysicaladversarialattackforsarimageautomatictargetrecognition |