ULAN: A Universal Local Adversarial Network for SAR Target Recognition Based on Layer-Wise Relevance Propagation

Abstract

Recent studies have proven that synthetic aperture radar (SAR) automatic target recognition (ATR) models based on deep neural networks (DNN) are vulnerable to adversarial examples. However, existing attacks easily fail in the case where adversarial perturbations cannot be fully fed to victim models. We call this situation perturbation offset. Moreover, since background clutter takes up most of the area in SAR images and has low relevance to recognition results, fooling models with global perturbations is quite inefficient. This paper proposes a semi-white-box attack network called Universal Local Adversarial Network (ULAN) to generate universal adversarial perturbations (UAP) for the target regions of SAR images. In the proposed method, we calculate the model’s attention heatmaps through layer-wise relevance propagation (LRP), which is used to locate the target regions of SAR images that have high relevance to recognition results. In particular, we utilize a generator based on U-Net to learn the mapping from noise to UAPs and craft adversarial examples by adding the generated local perturbations to target regions. Experiments indicate that the proposed method effectively prevents perturbation offset and achieves comparable attack performance to conventional global UAPs by perturbing only a quarter or less of SAR image areas.

Black-Box Universal Adversarial Attack for DNN-Based Models of SAR Automatic Target Recognition

“…Even though there are numerous improved networks [33], [34] based on U-Net, but the U-Net model has its unique advantages in SAR attacks and it is widely used in mainstream SAR adversarial attack algorithms [18], [35], [36]. The reasons for selecting U-Net as the network architecture can be outlined as follows:…”

“…Xia et al [17] combined the principle of SAR interference to generate UAP in the signal domain. Du et al [18] proposed an adversarial attack algorithm based on the universal local adversarial network. This algorithm only needs to perturb 1/4 of the original SAR image to achieve an attack success rate comparable to that of global perturbation.…”

“…Finally, as shown in (18), by introducing the traditional p L norm to limit the deformation amplitude, the attenuator ( ) A ⋅ is prevented from producing serious image deformation:…”

TAN: A Transferable Adversarial Network for DNN-based UAV SAR Automatic Target Recognition Models

“…Du et al [26] designed a Fast C&W algorithm to improve the efficiency of generating adversarial examples by introducing an encoderdecoder model. To enhance the universality and feasibility of adversarial perturbations, the work in [27] presented a universal local adversarial network to generate universal adversarial perturbations for the target region of SAR images. Furthermore, the latest research [28] has broken through the limitations of the digital domain and implemented the adversarial example of SAR images in the signal domain by transmitting a two-dimensional jamming signal.…”

TAN: A Transferable Adversarial Network for DNN-Based UAV SAR Automatic Target Recognition Models

“…Du et al [26] designed a Fast C&W algorithm to improve the efficiency of generating adversarial examples by introducing an encoder-decoder model. To enhance the universality and feasibility of adversarial perturbations, the work in [27] presented a universal local adversarial network to generate universal adversarial perturbations for the target region of SAR images. Furthermore, the latest research [28] has broken through the limitations of the digital domain and implemented the adversarial example of SAR images in the signal domain by transmitting a two-dimensional jamming signal.…”