arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2403.01210cs.CVcs.AI

SAR-AE-SFP:真实物理域中具有目标散射特征参数的SAR图像对抗样本

SAR-AE-SFP: SAR Imagery Adversarial Example in Real Physics domain with Target Scattering Feature Parameters

School of Geosciences and Info-Physics, Central South University(中南大学地球科学与信息物理学院)

Jiahao Cui, Jiale Duan, Binyan Luo, Hang Cao, Wang Guo, Haifeng Li

AI总结:

针对SAR对抗攻击局限于二维数字域或伪物理域的问题,提出SAR-AE-SFP-Attack,通过优化三维目标散射参数并经RaySAR成像生成真实物理对抗样本,显著提升跨模型与视角攻击效果。

摘要:

基于深度神经网络的合成孔径雷达(SAR)目标识别模型容易受到对抗样本的影响。当前用于SAR图像的对抗样本生成方法主要在二维数字域中运行,被称为图像对抗样本。近期工作虽然考虑了SAR成像散射机制,但未能考虑实际成像过程,导致三维物理域中的攻击不可行,被称为伪物理对抗样本。为应对这些挑战,本文提出SAR-AE-SFP-Attack,这是一种通过改变目标物体散射特征参数来生成真实物理对抗样本的方法。具体而言,我们通过扰动三维目标物体散射特征参数中的反射系数和散射系数,迭代优化目标回波的相干能量积累,并在RaySAR仿真器中经过回波信号处理和成像处理后获得对抗样本。实验结果表明,与数字对抗攻击方法相比,SAR-AE-SFP Attack显著提升了对基于CNN的模型(超过30%)和基于Transformer的模型(超过13%)的攻击效率,证明了攻击效果在不同模型和视角之间具有显著的可迁移性。

英文摘要:

Deep neural network-based Synthetic Aperture Radar (SAR) target recognition models are susceptible to adversarial examples. Current adversarial example generation methods for SAR imagery primarily operate in the 2D digital domain, known as image adversarial examples. Recent work, while considering SAR imaging scatter mechanisms, fails to account for the actual imaging process, rendering attacks in the three-dimensional physical domain infeasible, termed pseudo physics adversarial examples. To address these challenges, this paper proposes SAR-AE-SFP-Attack, a method to generate real physics adversarial examples by altering the scattering feature parameters of target objects. Specifically, we iteratively optimize the coherent energy accumulation of the target echo by perturbing the reflection coefficient and scattering coefficient in the scattering feature parameters of the three-dimensional target object, and obtain the adversarial example after echo signal processing and imaging processing in the RaySAR simulator. Experimental results show that compared to digital adversarial attack methods, SAR-AE-SFP Attack significantly improves attack efficiency on CNN-based models (over 30\%) and Transformer-based models (over 13\%), demonstrating significant transferability of attack effects across different models and perspectives.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑