Boosting Adversarial Transferability with Shallow-Feature Attack on SAR Images

Abstract

Adversarial example generation on Synthetic Aperture Radar (SAR) images is an important research area that could have significant impacts on security and environmental monitoring. However, most current adversarial attack methods on SAR images are designed for white-box situations by end-to-end means, which are often difficult to achieve in real-world situations. This article proposes a novel black-box targeted attack method, called Shallow-Feature Attack (SFA). Specifically, SFA assumes that the shallow features of the model are more capable of reflecting spatial and semantic information such as target contours and textures in the image. The proposed SFA generates ghost data packages for input images and generates critical features by extracting gradients and feature maps at shallow layers of the model. The feature-level loss is then constructed using the critical features from both clean images and target images, which is combined with the end-to-end loss to form a hybrid loss function. By fitting the critical features of the input image at specific shallow layers of the neural network to the target critical features, our attack method generates more powerful and transferable adversarial examples. Experimental results show that the adversarial examples generated by the SFA attack method improved the success rate of single-model attack under a black-box scenario by an average of 3.73%, and 4.61% after combining them with ensemble-model attack without victim models.

Black-Box Universal Adversarial Attack for DNN-Based Models of SAR Automatic Target Recognition

“…On the contrary, in the black-box attack scenario, > REPLACE THIS LINE WITH YOUR MANUSCRIPT ID NUMBER (DOUBLE-CLICK HERE TO EDIT) < it is difficult for the attacker to obtain the information of the victim model. In general, black-box attacks can be divided into probabilistic label-based attacks [24]- [26] decision-based attacks [27], and transferred attacks [28], [29]. Among the above three black-box attacks, the first two black-box attacks usually require a large number of queries to the neural network.…”