Speckle-Variant Attack: Toward Transferable Adversarial Attack to SAR Target Recognition

Peng, Bowen; Peng, Bo; Zhou, Jie; Xia, Jingyuan; Liu, Li

doi:10.1109/lgrs.2022.3184311

Cited by 32 publications

(9 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Chen et al [36] proposed conducting adversarial attacks on the attention maps of input images, which can achieve better results. Peng et al [37] proposed the SVA attack, which consists of two major modules, an iterative gradient-based perturbation generator and a target region extractor, that can generate more transferable adversarial examples. Deepfool [38] is a transfer-based adversarial attack algorithm that aims to generate minimal perturbations to an input sample in order to mislead a neural network model.…”

Section: Black-box Attack Methodsmentioning

confidence: 99%

Boosting Adversarial Transferability with Shallow-Feature Attack on SAR Images

et al. 2023

View full text Add to dashboard Cite

Adversarial example generation on Synthetic Aperture Radar (SAR) images is an important research area that could have significant impacts on security and environmental monitoring. However, most current adversarial attack methods on SAR images are designed for white-box situations by end-to-end means, which are often difficult to achieve in real-world situations. This article proposes a novel black-box targeted attack method, called Shallow-Feature Attack (SFA). Specifically, SFA assumes that the shallow features of the model are more capable of reflecting spatial and semantic information such as target contours and textures in the image. The proposed SFA generates ghost data packages for input images and generates critical features by extracting gradients and feature maps at shallow layers of the model. The feature-level loss is then constructed using the critical features from both clean images and target images, which is combined with the end-to-end loss to form a hybrid loss function. By fitting the critical features of the input image at specific shallow layers of the neural network to the target critical features, our attack method generates more powerful and transferable adversarial examples. Experimental results show that the adversarial examples generated by the SFA attack method improved the success rate of single-model attack under a black-box scenario by an average of 3.73%, and 4.61% after combining them with ensemble-model attack without victim models.

show abstract

Section: Black-box Attack Methodsmentioning

confidence: 99%

Boosting Adversarial Transferability with Shallow-Feature Attack on SAR Images

et al. 2023

View full text Add to dashboard Cite

show abstract

“…Moreover, causal features (i.e., target signatures) are unstable under different imaging conditions. Current adversarial attack studies have shown that deep learning is affected by small shifts in target signatures [26], [27]. A small dataset such as MSTAR can not adequately reflect target and background variations across imaging conditions, even with reduced data bias.…”

Section: Explaining the Non-causalitymentioning

confidence: 99%

Performance Evaluation of Deep Learning Classification Network for Image Features

Yang

Guo

et al. 2021

IEEE Access

View full text Add to dashboard Cite

This is the pre-acceptance version, to read the final version please go to IEEE Geoscience and Remote Sensing Letters on IEEE Xplore. In recent years, deep learning has been widely used in SAR ATR and achieved excellent performance on the MSTAR dataset. However, due to constrained imaging conditions, MSTAR has data biases such as background correlation, i.e., background clutter properties have a spurious correlation with target classes. Deep learning can overfit clutter to reduce training errors. Therefore, the degree of overfitting for clutter reflects the non-causality of deep learning in SAR ATR. Existing methods only qualitatively analyze this phenomenon. In this paper, we quantify the contributions of different regions to target recognition based on the Shapley value. The Shapley value of clutter measures the degree of overfitting. Moreover, we explain how data bias and model bias contribute to noncausality. Concisely, data bias leads to comparable signal-toclutter ratios and clutter textures in training and test sets. And various model structures have different degrees of overfitting for these biases. The experimental results of various models under standard operating conditions on the MSTAR dataset support our conclusions. Index Terms-Synthetic aperture radar (SAR), automatic target recognition (ATR), deep learning, data bias, Shapley value, causality 2 Texture refers to the spatial organization of a set of basic elements [7]. As shown in Fig. 1, the scattering point amplitude has different spatial distributions in the target, clutter, and shadow regions. These spatial distributions create texture signatures of different regions in SAR images.

show abstract

“…Most recently, Liu et al illustrated the physical feasibility of the digital adversarial examples by exploiting the phase modulation jamming metasurface [34][35][36]. Meanwhile, Peng et al proposed that regional restricted design also potential to be implemented in real-world [37]. It is worth noting that all the current studies comply with a default setting with which the attacker can access the same training data of the victim model.…”

Section: Introductionmentioning

confidence: 99%

An Empirical Study of Fully Black-Box and Universal Adversarial Attack for SAR Target Recognition

Peng

Yong

et al. 2022

Remote Sensing

Self Cite

View full text Add to dashboard Cite

It has been demonstrated that deep neural network (DNN)-based synthetic aperture radar (SAR) automatic target recognition (ATR) techniques are extremely susceptible to adversarial intrusions, that is, malicious SAR images including deliberately generated perturbations that are imperceptible to the human eye but can deflect DNN inference. Attack algorithms in previous studies are based on direct access to a ATR model such as gradients or training data to generate adversarial examples for a target SAR image, which is against the non-cooperative nature of ATR applications. In this article, we establish a fully black-box universal attack (FBUA) framework to craft one single universal adversarial perturbation (UAP) against a wide range of DNN architectures as well as a large fraction of target images. It is of both high practical relevance for an attacker and a risk for ATR systems that the UAP can be designed by an FBUA in advance and without any access to the victim DNN. The proposed FBUA can be decomposed to three main phases: (1) SAR images simulation, (2) substitute model training, and (3) UAP generation. Comprehensive evaluations on the MSTAR and SARSIM datasets demonstrate the efficacy of the FBUA, i.e., can achieve an average fooling ratio of 64.6% on eight cutting-edge DNNs (when the magnitude of the UAP is set to 16/255). Furthermore, we empirically find that the black-box UAP mainly functions by activating spurious features which can effectively couple with clean features to force the ATR models to concentrate on several categories and exhibit a class-wise vulnerability. The proposed FBUA aligns with the non-cooperative nature and reveals the access-free adversarial vulnerability of DNN-based SAR ATR techniques, providing a foundation for future defense against black-box threats.

show abstract

Speckle-Variant Attack: Toward Transferable Adversarial Attack to SAR Target Recognition

Cited by 32 publications

References 29 publications

Boosting Adversarial Transferability with Shallow-Feature Attack on SAR Images

Boosting Adversarial Transferability with Shallow-Feature Attack on SAR Images

Performance Evaluation of Deep Learning Classification Network for Image Features

An Empirical Study of Fully Black-Box and Universal Adversarial Attack for SAR Target Recognition

Contact Info

Product

Resources

About