Deep Neural Networks (DNNs) based Synthetic Aperture Radar (SAR) Automatic Target Recognition (ATR) systems have shown to be highly vulnerable to adversarial perturbations that are deliberately designed yet almost imperceptible but can bias DNN inference when added to targeted objects. This leads to serious safety concerns when applying DNNs to high-stake SAR ATR applications. Therefore, enhancing the adversarial robustness of DNNs is essential for implementing DNNs to modern real-world SAR ATR systems. Toward building more robust DNN-based SAR ATR models, this article explores the domain knowledge of SAR imaging process and proposes a novel Scattering Model Guided Adversarial Attack (SMGAA) algorithm which can generate adversarial perturbations in the form of electromagnetic scattering response (called adversarial scatterers). The proposed SMGAA consists of two parts: 1) a parametric scattering model and corresponding imaging method and 2) a customized gradient-based optimization algorithm. First, we introduce the effective Attributed Scattering Center Model (ASCM) and a general imaging method to describe the scattering behavior of typical geometric structures in the SAR imaging process. By further devising several strategies to take the domain knowledge of SAR target images into account and relax the greedy search procedure, the proposed method does not need to be prudentially finetuned, but can efficiently to find the effective ASCM parameters to fool the SAR classifiers and facilitate the robust model training. Comprehensive evaluations on the MSTAR dataset show that the adversarial scatterers generated by SMGAA are more robust to perturbations and transformations in the SAR processing chain than the currently studied attacks, and are effective to construct a defensive model against the malicious scatterers.
Neural networks are vulnerable to adversarial examples, which poses a threat to their application in security sensitive systems. We propose high-level representation guided denoiser (HGD) as a defense for image classification. Standard denoiser suffers from the error amplification effect, in which small residual adversarial noise is progressively amplified and leads to wrong classifications. HGD overcomes this problem by using a loss function defined as the difference between the target model's outputs activated by the clean image and denoised image. Compared with ensemble adversarial training…
Advances in the development of adversarial attacks have been fundamental to the progress of adversarial defense research. Efficient and effective attacks are crucial for reliable evaluation of defenses, and also for developing robust models. Adversarial attacks are often generated by maximizing standard losses such as the cross-entropy loss or maximum-margin loss within a constraint set using Projected Gradient Descent (PGD). In this work, we introduce a relaxation term to the standard loss, that finds more suitable gradient-directions, increases attack efficacy and leads to more efficient adv…
Though deep neural networks perform challenging tasks excellently, they are susceptible to adversarial examples, which mislead classifiers by applying human-imperceptible perturbations on clean inputs. Under the query-free black-box scenario, adversarial examples are hard to transfer to unknown models, and several methods have been proposed with the low transferability. To settle such issue, we design a max-min framework inspired by input transformations, which are benificial to both the adversarial attack and defense. Explicitly, we decrease loss values with inputs' affline transformations as…
University of Electronic Science and Technology of China（电子科技大学）
How to fully utilize polarization to enhance synthetic aperture radar (SAR) ship classification remains an unresolved issue. Thus, we propose a dual-polarization information guided network (DPIG-Net) to solve it.
University Parthenope（帕特诺佩大学）；University Federico II（费德里科二世大学）
We propose a new method for SAR image despeckling which leverages information drawn from co-registered optical imagery. Filtering is performed by plain patch-wise nonlocal means, operating exclusively on SAR data. However, the filtering weights are computed by taking into account also the optical guide, which is much cleaner than the SAR data, and hence more discriminative. To avoid injecting optical-domain information into the filtered image, a SAR-domain statistical test is preliminarily performed to reject right away any risky predictor. Experiments on two SAR-optical datasets prove the pro…
Adversarial robustness through Lipschitz-Guided Stochastic Depth in Neural Networks
Laboratory of Multimodal Research in Industry（产业多模态研究实验室）；Innopolis University（因诺普里斯大学）；LLC NUHA TECH（NUHA技术公司）；Laboratory of Innovative Technologies for Processing Video Content（视频内容处理创新技术实验室）
Unlocking Optical Prior: Spectrum-Guided Knowledge Transfer for SAR Generalized Category Discovery
College of Electronic Science and Technology, National University of Defense Technology（电子科学与技术学院，国防科技大学）；State Key Laboratory of Complex System Simulation and Modeling Technology（复杂系统仿真与建模技术国家重点实验室）
Spaceborne synthetic aperture radar can provide meters scale images of the ocean surface roughness day or night in nearly all weather conditions. This makes it a unique asset for many geophysical applications. Sentinel 1 SAR wave mode vignettes have made possible to capture many important oceanic and atmospheric phenomena since 2014. However, considering the amount of data provided, expanding applications requires a strategy to automatically process and extract geophysical parameters. In this study, we propose to apply subaperture decomposition as a preprocessing stage for SAR deep learning mo…
School of Automation, Northwestern Polytechnical University（西北工业大学自动化学院）；Aerospace Information Research Institute, Chinese Academy of Sciences（中国科学院空天信息创新研究院）
Noise-Aware and Dynamically Adaptive Federated Defense Framework for SAR Image Target Recognition
Shanxi Key Laboratory of Cryptography and Data Security, School of Computer Science and Artificial Intelligence, Shanxi Normal University（山西密码与数据安全重点实验室，计算机科学与人工智能学院，山西师范大学）；School of Computer Science and Technology, Guizhou University（贵州大学计算机科学与技术学院）；School of Computer Science and Engineering, Nanyang Technological University（南洋理工大学计算机科学与工程学院）；School of Electrical Engineering, Guangxi University（广西大学电气工程学院）；School of Computing, Engineering and Mathematical Science, La Trobe University（拉筹伯大学计算、工程与数学科学学院）；College of Cyber Security, Jinan University（济南大学网络安全学院）
Sparsity-regularized synthetic aperture radar (SAR) imaging framework has shown its remarkable performance to generate a feature enhanced high resolution image, in which a sparsity-inducing regularizer is involved by exploiting the sparsity priors of some visual features in the underlying image. However, since the simple prior of low level features are insufficient to describe different semantic contents in the image, this type of regularizer will be incapable of distinguishing between the target of interest and unconcerned background clutters. As a consequence, the features belonging to the t…
Adversarial Attacks Already Tell the Answer: Directional Bias-Guided Test-time Defense for Vision-Language Models
University of Science and Technology of China（中国科学技术大学）；National Key Laboratory of Deep Space Exploration, Deep Space Exploration Laboratory（国家深空探测重点实验室，深空探测实验室）；The Chinese University of Hong Kong（香港中文大学）；Zhejiang University（浙江大学）；Ant Group（蚂蚁集团）
Prior-guided Fusion of Multimodal Features for Change Detection from Optical-SAR Images
Institute of Geospatial Information, Information Engineering University（地理信息研究所，信息工程大学）；Academy of Digital China (Fujian), Fuzhou University（数字中国研究院（福建），福州大学）；The School of Electronics and Communication Engineering, Sun Yat-sen University（电子与通信工程学院，中山大学）；The Department of Information Engineering and Computer Science, University of Trento（信息工程与计算机科学系，特伦托大学）
Optical-Guided Neural Collapse for SAR Few-Shot Class Incremental Learning
Beihang University, Beijing 100191, China（北航，北京100191，中国）；Aerospace Information Research Institute, Chinese Academy of Sciences, Beijing 100190, China（航天信息研究所，中国科学院，北京100190，中国）
GeoDiff-SAR: A Geometric Prior Guided Diffusion Model for SAR Image Generation
College of Information Science and Technology, Beijing University of Chemical Technology（信息科学与技术学院，北京化工大学）；Aerospace Information Research Institute, Chinese Academy of Sciences（航天信息研究所，中国科学院）
Seg-CycleGAN : SAR-to-optical image translation guided by a downstream task
Gina Cody School of Engineering and Computer Science, Concordia University（康考迪亚大学吉娜·科迪工程与计算机科学学院）；School of Automation, Northwestern Polytechnical University（西北工业大学自动化学院）；School of Cybersecurity, Northwestern Polytechnical University（西北工业大学网络空间安全学院）
Unpaired Object-Level SAR-to-Optical Image Translation for Aircraft with Keypoints-Guided Diffusion Models
School of Information Science and Technology, Fudan University（复旦大学信息科学与技术学院）；Key Laboratory for Information Science of Electromagnetic Waves (Ministry of Education)（电磁波信息科学教育部重点实验室）
PriSAR: 3D Geometric-Prior-Guided Diffusion for Parameter-Controlled SAR Image Generation
College of Information Science and Technology, Beijing University of Chemical Technology（北京化工大学信息科学与技术学院）；Aerospace Information Research Institute, Chinese Academy of Sciences（中国科学院空天信息研究院）
BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning
National University of Singapore（新加坡国立大学）；The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳））；Beihang University（北京航空航天大学）；Sun Yat-sen University-Shenzhen（中山大学（深圳））
Nanyang Technological University（南洋理工大学）；Chinese University of Hong Kong（香港中文大学）
Adversarial example attack endangers the mobile edge systems such as vehicles and drones that adopt deep neural networks for visual sensing. This paper presents {\em Sardino}, an active and dynamic defense approach that renews the inference ensemble at run time to develop security against the adaptive adversary who tries to exfiltrate the ensemble and construct the corresponding effective adversarial examples. By applying consistency check and data fusion on the ensemble's predictions, Sardino can detect and thwart adversarial inputs. Compared with the training-based ensemble renewal, we use H…
Stony Brook University（石溪大学）；Brookhaven National Laboratory（布鲁克海文国家实验室）
While deep neural networks have shown impressive performance in many tasks, they are fragile to carefully designed adversarial attacks. We propose a novel adversarial training-based model by Attention Guided Knowledge Distillation and Bi-directional Metric Learning (AGKD-BML). The attention knowledge is obtained from a weight-fixed model trained on a clean dataset, referred to as a teacher model, and transferred to a model that is under training on adversarial examples (AEs), referred to as a student model. In this way, the student model is able to focus on the correct region, as well as corre…
AEGIS: A Mechanism-Guided Defense against Visual Synonym Jailbreaks in Text-to-Image Models
Fudan University（复旦大学）；Alibaba Group（阿里巴巴集团）；Shanghai Pudong Research Institute of Cryptology（上海浦东密码研究所）；Engineering Research Center of Cyber Security Auditing and Monitoring, Ministry of Education（教育部网络安全审计与监测工程研究中心）
Adversarial-Guided Diffusion for Multimodal LLM Attacks
School of Information Science and Engineering, Lanzhou University（兰州大学信息科学与工程学院）；College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）；College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）
Structure-Guided Visual Perturbation Neutralization for LVLMs
Beijing University of Posts and Telecommunications（北京邮电大学）；University of Science and Technology of China（中国科学技术大学）；JIUTIAN Research（中移九天）；Nanyang Technological University（南洋理工大学）；Chongqing University of Posts and Telecommunications（重庆邮电大学）
Dual Attention Guided Defense Against Malicious Edits
State Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences (CAS)（人工智能安全国家重点实验室，计算技术研究所，中国科学院）；University of China Academy of Sciences（中国科学院大学）；School of Computer Science, China University of Geosciences（中国地质大学（武汉）计算机学院）
Medical image segmentation is challenging especially in dealing with small dataset of 3D MR images. Encoding the variation of brain anatomical struc-tures from individual subjects cannot be easily achieved, which is further chal-lenged by only a limited number of well labeled subjects for training. In this study, we aim to address the issue of brain MR image segmentation in small da-taset. First, concerning the limited number of training images, we adopt adver-sarial defense to augment the training data and therefore increase the robustness of the network. Second, inspired by the prior knowled…
Knowledge-Informed Neural Network for Complex-Valued SAR Image Recognition
School of Automation, Northwestern Polytechnical University（西北工业大学自动化学院）；Shenzhen Research Institute of Northwestern Polytechnical University（西北工业大学深圳研究院）；School of Artificial Intelligence, Chongqing University of Posts and Telecommunications（重庆邮电大学人工智能学院）；Aerospace Information Technology University（航天信息大学）；Suzhou Aerospace Information Research Institute（苏州航天信息研究所）；National Key Laboratory of Microwave Imaging（微波成像国家重点实验室）；Aerospace Information Research Institute, CAS（中国科学院航天信息研究所）；School of Electronic, Electrical and Communication Engineering, University of Chinese Academy of Sciences（中国科学院大学电子、电气与通信工程学院）
Hong Kong Baptist University（香港浸会大学）；AWS AI Labs（亚马逊云科技人工智能实验室）；Johns Hopkins University（约翰斯·霍普金斯大学）
Open-set recognition and adversarial defense study two key aspects of deep learning that are vital for real-world deployment. The objective of open-set recognition is to identify samples from open-set classes during testing, while adversarial defense aims to robustify the network against images perturbed by imperceptible adversarial noise. This paper demonstrates that open-set recognition systems are vulnerable to adversarial samples. Furthermore, this paper shows that adversarial defense mechanisms trained on known classes are unable to generalize well to open-set samples. Motivated by these …
Enhancing Cross Domain SAR Oil Spill Segmentation via Morphological Region Perturbation and Synthetic Label-to-SAR Generation
Círculo de Investigación de Máquinas de Aprendizaje (CIMA), Universidad Nacional Agraria La Molina（机器学习研究圈（CIMA）、拉莫林农业国立大学）；Departamento de Estadística e Informática, Facultad de Economía y Planificación, Universidad Nacional Agraria La Molina（统计与信息技术系、经济与规划学院、拉莫林农业国立大学）
