Adversarial Attack for SAR Target Recognition Based on UNet-Generative Adversarial Network

Du, Chuan; Zhang, Lei

doi:10.3390/rs13214358

Cited by 23 publications

(6 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Even though there are numerous improved networks [33], [34] based on U-Net, but the U-Net model has its unique advantages in SAR attacks and it is widely used in mainstream SAR adversarial attack algorithms [18], [35], [36]. The reasons for selecting U-Net as the network architecture can be outlined as follows:…”

Section: A Network Structure Of the Generator And Attenuatormentioning

confidence: 99%

Black-Box Universal Adversarial Attack for DNN-Based Models of SAR Automatic Target Recognition

Wan,

Liu,

Niu

et al. 2024

IEEE J. Sel. Top. Appl. Earth Observations Remote Sensing

View full text Add to dashboard Cite

Synthetic aperture radar automatic target recognition (SAR-ATR) models based on deep neural networks (DNNs) are vulnerable to attacks of adversarial examples. Universal adversarial attack algorithms can help evaluate and improve the robustness of the SAR-ATR models and have become a research hotspot. However, current universal adversarial attack algorithms have limitations. First, considering the difficulty in obtaining information on the attacking SAR-ATR models, there is an urgent need to design a universal adversarial attack algorithm under a black-box scenario. Second, given the difficulty of acquiring SAR images, the effectiveness of attacks under smallsample conditions requires improvement. To address these limitations, this study proposed a black-box universal adversarial attack algorithm: Transferable Universal Adversarial Network (TUAN). Based on the idea of the generative adversarial network, we implemented the game of generator and attenuator to improve the transferability of universal adversarial perturbation (UAP). We designed loss functions for the generator and attenuator respectively, which can effectively improve the success rate of black-box attacks and the stealthiness of attacks. Additionally, U-Net was used as a network structure of generator and attenuator to fully learn the distribution of examples, thereby enhancing the attack success rate under small-sample conditions. TUAN attained a higher black-box attack success rate and superior stealthiness than up-to-date UAP algorithms in non-targeted and targeted attacks.

show abstract

Section: A Network Structure Of the Generator And Attenuatormentioning

confidence: 99%

Black-Box Universal Adversarial Attack for DNN-Based Models of SAR Automatic Target Recognition

Wan,

Liu,

Niu

et al. 2024

IEEE J. Sel. Top. Appl. Earth Observations Remote Sensing

View full text Add to dashboard Cite

show abstract

“…The study [239] The proposed approach aims to differentiate the target distribution by utilizing a feature dictionary model, without any prior knowledge of the classifier. Finally, we summarize adversarial attacks against image classification in RS ( [195], [234]- [248]) in Table IX.…”

Section: ) Image Classificationmentioning

confidence: 99%

Benchmarking Adversarial Patch Against Aerial Detection

Lian

Mei

Zhang

et al. 2022

IEEE Trans. Geosci. Remote Sensing

View full text Add to dashboard Cite

Deep neural networks (DNNs) have found widespread applications in interpreting remote sensing (RS) imagery. However, it has been demonstrated in previous works that DNNs are vulnerable to different types of noises, particularly adversarial noises. Surprisingly, there has been a lack of comprehensive studies on the robustness of RS tasks, prompting us to undertake a thorough survey and benchmark on the robustness of image classification and object detection in RS. To our best knowledge, this study represents the first comprehensive examination of both natural robustness and adversarial robustness in RS tasks. Specifically, we have curated and made publicly available datasets that contain natural and adversarial noises. These datasets serve as valuable resources for evaluating the robustness of DNNs-based models. To provide a comprehensive assessment of model robustness, we conducted meticulous experiments with numerous different classifiers and detectors, encompassing a wide range of mainstream methods. Through rigorous evaluation, we have uncovered insightful and intriguing findings, which shed light on the relationship between adversarial noise crafting and model training, yielding a deeper understanding of the susceptibility and limitations of various models, and providing guidance for the development of more resilient and robust models

show abstract

“…Specifically, simpler network structures result in more robustness against adversarial attacks. Further, Du et al introduced generative models to accelerate the attack process and to refine the scattering features [32,33]. Most recently, Liu et al illustrated the physical feasibility of the digital adversarial examples by exploiting the phase modulation jamming metasurface [34][35][36].…”

Section: Introductionmentioning

confidence: 99%

An Empirical Study of Fully Black-Box and Universal Adversarial Attack for SAR Target Recognition

Peng

Yong

et al. 2022

Remote Sensing

View full text Add to dashboard Cite

It has been demonstrated that deep neural network (DNN)-based synthetic aperture radar (SAR) automatic target recognition (ATR) techniques are extremely susceptible to adversarial intrusions, that is, malicious SAR images including deliberately generated perturbations that are imperceptible to the human eye but can deflect DNN inference. Attack algorithms in previous studies are based on direct access to a ATR model such as gradients or training data to generate adversarial examples for a target SAR image, which is against the non-cooperative nature of ATR applications. In this article, we establish a fully black-box universal attack (FBUA) framework to craft one single universal adversarial perturbation (UAP) against a wide range of DNN architectures as well as a large fraction of target images. It is of both high practical relevance for an attacker and a risk for ATR systems that the UAP can be designed by an FBUA in advance and without any access to the victim DNN. The proposed FBUA can be decomposed to three main phases: (1) SAR images simulation, (2) substitute model training, and (3) UAP generation. Comprehensive evaluations on the MSTAR and SARSIM datasets demonstrate the efficacy of the FBUA, i.e., can achieve an average fooling ratio of 64.6% on eight cutting-edge DNNs (when the magnitude of the UAP is set to 16/255). Furthermore, we empirically find that the black-box UAP mainly functions by activating spurious features which can effectively couple with clean features to force the ATR models to concentrate on several categories and exhibit a class-wise vulnerability. The proposed FBUA aligns with the non-cooperative nature and reveals the access-free adversarial vulnerability of DNN-based SAR ATR techniques, providing a foundation for future defense against black-box threats.

show abstract

Adversarial Attack for SAR Target Recognition Based on UNet-Generative Adversarial Network

Cited by 23 publications

References 34 publications

Black-Box Universal Adversarial Attack for DNN-Based Models of SAR Automatic Target Recognition

Black-Box Universal Adversarial Attack for DNN-Based Models of SAR Automatic Target Recognition

Benchmarking Adversarial Patch Against Aerial Detection

An Empirical Study of Fully Black-Box and Universal Adversarial Attack for SAR Target Recognition

Contact Info

Product

Resources

About