Adversarial sample generation method and application of SAR (Synthetic Aperture Radar) image

Abstract

The invention belongs to the technical field of synthetic aperture radar automatic target identification security, and discloses an SAR image adversarial sample generation method and application, and the method comprises the steps: generating a more stable gradient prediction look-ahead direction through combining the gradient and accumulated momentum of a current data point, so as to reduce the influence of speckle noise; then, performing effective sampling on the periphery of the data point, and adjusting the weight of the data point according to the confidence score of the data point so as to reduce the negative influence of semantic inconsistency of the sampled data point and further stabilize gradient updating; according to the method, the problem that the gradient direction of an SAR image is easy to change too much in the gradient calculation process due to the existence of coherent noise is considered, the gradient prediction direction is stabilized by combining the current data point gradient and the accumulated momentum, and a more stable adversarial sample updating direction is achieved by sampling surrounding data points through confidence; and SAR data characteristics can be well fit, so that an adversarial sample with relatively high quality can be generated in a real black box scene.

Description

Technical Field

[0001] The present invention belongs to the field of synthetic aperture radar automatic target recognition security technology, and more specifically, relates to a method for generating adversarial samples of SAR images and applications thereof. Background Art

[0002] Since synthetic aperture radar (SAR) can emit microwaves and capture high-resolution radar images under various climatic conditions, it has been widely used in civil and military fields. In recent years, with the development of artificial intelligence and machine learning, deep models have been widely used in SAR target recognition tasks. However, Szegedy et al. have proved in 2014 that deep learning models are easily affected by carefully designed small adversarial perturbations added to clean samples. Therefore, for the use of deep learning models for SAR image automatic target recognition tasks, the study of its security and robustness will become a challenging task.

[0003] Adversarial attack is a method commonly used to study the security and robustness of deep learning models. Adversarial attacks can generally be divided into two categories: white-box attacks and black-box attacks. White-box attacks refer to attackers having detailed internal information about the target deep learning model, including the model's architecture, parameters, and training data, while black-box attacks cannot know this specific information and can only explore the model's behavior through experiments and try to construct deceptive inputs to make the model produce incorrect predictions. Since the SAR automatic target recognition task has a high degree of confidentiality, both in military and civilian applications, it is difficult for attackers to obtain the deep model information used. Therefore, in real scenarios, black-box attacks are often more suitable for SAR automatic target recognition tasks.

[0004] A commonly used black-box attack method is a transfer attack based on gradient optimization. The transfer attack generates adversarial samples by fully accessing an alternative model, and then uses these samples to attack the target model. One of the common strategies for implementing transfer attacks is gradient optimization, which aims to find a better local maximum in the adversarial search space to generate highly transferable adversarial samples. In the prior art, NI-FGSM (Nesterov Iterative Fast Gradient Sign Method) and EMI-FGSM (Enhanced Momentum Iterative Fast Gradient Sign Method) are commonly used to generate highly transferable adversarial samples. However, NI-FGSM and EMI-FGSM are mainly used to generate highly transferable adversarial samples for visual image data, while the significant difference between SAR data and visual images is that SAR images are also affected by the noise caused by the speckle effect. When using the NI-FGSM and EMI-FGSM methods to generate SAR adversarial samples, due to the presence of coherent speckle noise, the difference in the gradient direction before and after the SAR adversarial sample generation process will be too large, which will lead to poor attack effects of the generated adversarial samples, which is a factor that does not need to be considered for visual images. Therefore, when directly using the adversarial attack method proposed for visual image data to generate adversarial samples on SAR data, there is a large difference between the initial and final gradient directions of the iteration, which cannot fit the characteristics of SAR data well, nor can it generate high-quality transferable adversarial samples in realistic black-box scenarios. Summary of the invention

[0005] In view of the above defects or improvement needs of the prior art, the present invention provides a method and application for generating adversarial samples of SAR images, which aims to generate adversarial samples of SAR images with higher quality against migration attacks in black box scenarios.

[0006] To achieve the above object, according to a first aspect of the present invention, a method for generating adversarial samples of SAR images is provided, comprising:

[0007] S1. Take the adversarial sample of each SAR image sample x in the SAR sample dataset Initialize to x and initialize momentum g 0 =0;

[0008] S2, at the tth iteration, based on the momentum g of the previous iteration t-1 And the current adversarial sample The gradient of , calculate the current adversarial sample The forward gradient g′ t ;

[0009] S3. Using the current adversarial sample is the starting point of the data, along the forward gradient g′ t The direction of the current adversarial sample is generated with a preset step size. The corresponding N predicted data points are perturbed and the integrated gradient of the N predicted data points after adding perturbations is calculated by using confidence weighting. With the integrated gradient Update the current adversarial example The gradient vector Get the updated gradient vector With the gradient vector Update the current adversarial example Get the updated adversarial sample And the gradient vector As the momentum g of the current t-th iteration t ; Among them, adversarial samples Initial value of the gradient vector

[0010] S4. Determine whether t is less than a preset number of iterations T. If so, set t=t+1 and go to S2; otherwise, use the updated adversarial sample obtained at the Tth iteration as the adversarial sample of the SAR image sample x.

[0011] Furthermore, in S3, the N predicted data points after adding disturbance are:

[0012]

[0013] in, is the i-th predicted data point after adding disturbance, i is 1, 2, ..., or N; k is the disturbance factor, ∈ is the disturbance amplitude, α is the preset step size, δ i represents the i-th sampling value uniformly sampled within the preset sampling interval [-δ,δ]; sign(·) represents the sign function.

[0014] Furthermore, in S3, the integrated gradient of the N predicted data points after adding disturbance is calculated by using confidence weighting for:

[0015]

[0016] Among them, scores[i] represents the i-th predicted data point Confidence score of Indicates that the i-th predicted data point The difference between the target recognition result obtained by inputting into the deep learning model for automatic target recognition of SAR images and the target recognition label y; express For the i-th predicted data point The derivative of .

[0017] Furthermore, the forward gradient g′ t for:

[0018]

[0019] Where, μ is the attenuation factor; Indicates that the adversarial sample The difference between the target recognition result obtained by inputting into the deep learning model for automatic target recognition of SAR images and the target recognition label y; express right The derivative of , ‖·‖ 1 Represents a norm.

[0020] Furthermore, the updated gradient vector for:

[0021]

[0022] The updated adversarial example for:

[0023]

[0024] Wherein, α is the preset step size, and sign(·) represents the sign function.

[0025] According to a second aspect of the present invention, a method for evaluating the safety of a SAR image automatic target recognition model is provided, comprising:

[0026] For each SAR image sample in the pre-collected SAR sample data set, the adversarial sample generation method for the SAR image described in any one of the first aspects is used to generate a corresponding adversarial sample; and each adversarial sample is respectively input into the SAR automatic target recognition model to be evaluated to obtain a corresponding target recognition result;

[0027] By comparing the difference between the target recognition result of each adversarial sample and the corresponding target recognition label, the accuracy of the target recognition result is statistically calculated; wherein, the higher the accuracy of the target recognition result, the better the security of the SAR automatic target recognition model.

[0028] According to a third aspect of the present invention, there is provided a system for generating adversarial samples of SAR images, comprising a computer-readable storage medium and a processor;

[0029] The computer-readable storage medium is used to store executable instructions;

[0030] The processor is used to read the executable instructions stored in the computer-readable storage medium to execute the adversarial sample generation method for SAR images described in any one of the first aspects.

[0031] According to a fourth aspect of the present invention, there is provided a safety assessment system for a SAR image automatic target recognition model, comprising a computer-readable storage medium and a processor;

[0032] The computer-readable storage medium is used to store executable instructions;

[0033] The processor is used to read the executable instructions stored in the computer-readable storage medium to execute the safety assessment method of the SAR image automatic target recognition model described in the second aspect.

[0034] According to a fifth aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method for generating adversarial samples for SAR images as described in any one of the first aspects and / or the method for assessing the security of the SAR image automatic target recognition model as described in the second aspect are implemented.

[0035] According to a sixth aspect of the present invention, a computer program product is provided. When the computer program product is run on a computer, the computer executes the adversarial sample generation method for SAR images described in any one of the first aspects, and / or executes the security assessment method for the SAR image automatic target recognition model described in the second aspect.

[0036] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

[0037] (1) The adversarial sample generation method of SAR images in the present invention combines the current adversarial sample The gradient and cumulative momentum (the momentum g obtained in the previous iteration) t-1 , that is, the gradient vector obtained by updating the gradient vector of the adversarial sample with the integrated gradient of N predicted data points is used to reflect the enhanced momentum of semantic preservation) to generate a more stable forward gradient direction to stabilize the update direction of the adversarial sample, thereby reducing the impact of coherent speckle noise; then, along the forward gradient direction, at the current adversarial sample Effective sampling is performed around, and according to its confidence score, the gradient of the N predicted data points after weighted sampling is obtained to obtain the integrated gradient of the predicted data point Since the integrated gradient By weighting the gradients of N predicted data points, the negative impact of semantic inconsistency of sampled data points (predicted data points) can be reduced and the gradient update direction can be further stabilized, thereby further alleviating the problem of excessive difference in the directions of the previous and next gradients. The momentum enhancement attack method based on semantic preservation of the present invention can generate adversarial samples of SAR images with higher quality for migration attacks in black box scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 Schematic diagram of a method for generating adversarial samples of SAR images in an embodiment of the present invention.

[0039] Figure 2 It is the average attack success rate (ASR) of eight target models attacked by adversarial samples generated by different methods in the embodiments of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0041] Example 1

[0042] like Figure 1 As shown, in an embodiment of the present invention, a method for generating adversarial samples of SAR images is provided, comprising:

[0043] S1, let t = 0; for any pre-collected SAR image sample x carrying target identification label y, Initialize to x and initialize momentum g 0 =0; where t represents the number of iterations;

[0044] S2, at the current iteration t, based on the momentum g of the previous iteration t-1 And the current adversarial sample The gradient of , calculate the current adversarial sample The forward gradient g′ t ;

[0045] S3. Using the current adversarial sample As the starting point of the data, along the forward gradient g′ t The direction of the current adversarial sample is generated with a preset step size. The corresponding N predicted data points are perturbed and the integrated gradient of the N predicted data points after adding perturbations is calculated by using confidence weighting. Using integrated gradient Update the current adversarial example The gradient vector Get the updated gradient vector And use the updated gradient vector Update the current adversarial example Get the updated adversarial sample The updated adversarial sample As the current adversarial sample for the next iteration, and the updated gradient vector As the momentum g of the current t-th iteration t ; Among them, adversarial samples Initial value of the gradient vector

[0046] S4. Determine whether t is less than the preset number of iterations T. If so, set t=t+1 and go to step S2; otherwise, use the updated adversarial sample obtained in the Tth iteration as the adversarial sample of the SAR image sample x; where T is a positive integer.

[0047] As a preferred implementation, in S2, based on the momentum g of the previous iteration t-1 And the current adversarial sample The gradient of the current adversarial sample is calculated The forward gradient g′ t for:

[0048]

[0049] Wherein, μ is the attenuation factor. In the embodiment of the present invention, the attenuation factor μ=1. In other embodiments, it can also be selected based on experience or through experiments. Function J() represents the loss function of the SAR image automatic target recognition model. Indicates that the adversarial sample The difference between the target recognition result obtained by inputting into the SAR image automatic target recognition model for SAR image automatic target recognition and the target recognition label y; express right The derivative of , ‖·‖ 1 Represents a norm.

[0050] As a preferred implementation, in S3, the i-th predicted data point after adding the disturbance for:

[0051]

[0052] Where i is 1, 2, ..., or N; α is the preset step size; sign(·) represents the sign function; δ irepresents the i-th sample value uniformly sampled within the preset sampling interval [-δ, δ]; k is the disturbance factor, ∈ is the disturbance amplitude. The relevant parameters can be selected based on experience or through experiments. In the embodiment of the present invention, N=5, and the value of α is the disturbance size ∈ divided by the number of iterations T, that is: Used to control the size of the updated adversarial sample in each round of iteration; perturbation factor k = 5; δ = 3.

[0053] As a preferred implementation, in S3, the integrated gradient of the N predicted data points after adding disturbance is calculated by using confidence weighting for:

[0054]

[0055] Among them, scores[i] represents the i-th predicted data point , in the embodiment of the present invention, scores[i] represents the white box confidence score, that is, the confidence score of the predicted data point on the alternative model; is the loss function of the SAR image automatic recognition task, which means that the i-th predicted data point The difference between the target recognition result obtained by automatic target recognition of SAR images after input into the deep learning model and the target recognition label y; express For the i-th predicted data point The derivative of .

[0056] As a preferred implementation, use integrated gradient Update the current adversarial example The gradient vector The updated gradient vector obtained for:

[0057]

[0058] Use the updated gradient vector Update the current adversarial example The updated adversarial sample obtained for:

[0059]

[0060] The adversarial sample generation method of the SAR image in the present invention combines the current adversarial sample The gradient and cumulative momentum (the momentum g obtained in the previous iteration) t-1, that is, the gradient vector obtained by updating the gradient vector of the adversarial sample with the integrated gradient of N predicted data points is used to reflect the enhanced momentum of semantic preservation) to generate a more stable forward gradient direction to stabilize the update direction of the adversarial sample, thereby reducing the impact of coherent speckle noise; then, along the forward gradient direction, at the current adversarial sample Effective sampling is performed around, and according to its confidence score, the gradient of the N predicted data points after weighted sampling is obtained to obtain the integrated gradient of the predicted data point Since the integrated gradient By weighting the gradients of N predicted data points, the negative impact of semantic inconsistency of sampled data points (predicted data points) can be reduced and the gradient update direction can be further stabilized, thereby further alleviating the problem of excessive difference in the directions of the previous and next gradients. The momentum enhancement attack method based on semantic preservation of the present invention can generate adversarial samples of SAR images with higher quality for migration attacks in black box scenarios.

[0061] The present invention takes into account the problem that the gradient direction changes too much during the gradient calculation process due to the presence of coherent noise in SAR images. By combining the current adversarial samples The gradient and accumulated momentum stabilize the gradient prediction direction, and a more stable adversarial sample update direction is achieved by sampling surrounding data points with confidence, which can well fit the characteristics of SAR data, thereby generating high-quality adversarial samples suitable for migration attacks in black-box scenarios.

[0062] Experiments have shown that the adversarial sample generation method provided by the present invention can improve the success rate of black-box migration attacks and enhance the accuracy of security detection. In addition, it can also be used to reinforce deep learning models. For example, in the process of training the model, if the generated adversarial samples are added to the data set, a more robust model can be further constructed, which can effectively defend against the attacks of adversarial samples.

[0063] The adversarial sample generation method provided by the present invention can not only improve the success rate of migration attacks in black-box scenarios, but also improve the success rate of white-box attacks. It is an effective method for evaluating the security and robustness of SAR automatic recognition models.

[0064] The method of the present invention is further described below with reference to specific examples.

[0065] Input clean SAR sample data set X = {x 1 ,x 2 ,…x n} and the corresponding label set Y = {y 1 ,y 2 ,…y n}, wherein the embodiment of the present invention uses a typical SAR target dataset MSTAR (The Moving and Stationary Target Acquisition and Recognition). The MSTAR dataset is collected and released by Sandia National Laboratory in the United States, and contains ground objects and variants photographed by various synthetic aperture radars, different scenes and observation conditions, and rotation angle and ground rubbing angle transformations. The Standard Operating Conditions (SOCs) dataset constructed by MSTAR is selected in the embodiment.

[0066] For each clean sample, initialize its corresponding adversarial sample to be the same as the clean sample, that is: And initialize the momentum g 0 =0, number of iterations T = 10, initial value t = 0, attenuation factor μ = 1, Perturbation factor k=5, δ=3, N=5.

[0067] Through the above loop iteration, the current adversarial sample is output and saved. The generated adversarial sample is used to attack the model under different perturbation sizes to test the security of the model.

[0068] like Figure 2 The figure shows the average attack success rate (ASR) of adversarial samples generated by different methods against eight target models; the x-axis represents the source model and the y-axis represents the attack success rate. Adversarial samples were made on ResNet18, ResNet50, VGG16, VGG19, ResNext50 and InceptionV3 networks, and the average attack success rate in the black box scenario was tested. Figure 2 It can be seen that the adversarial sample generation method (denoted as SPMEA) provided by the present invention is significantly better than other baseline methods. Specifically, the average attack success rate of SPMEA is 13.1%, 5.3%, 21.9%, and 9.7% higher than that of NI-FGSM, MI-FGSM, VMI-FGSM, and EMI-FGSM, respectively. It can be seen that the adversarial sample generation method provided by the present invention shows superior attack transferability in actual black box scenarios.

[0069] In summary, the present invention aims to utilize the relevant characteristics of SAR images (with obvious coherent speckle noise) to improve the attack performance on the SAR automatic target recognition model in a realistic black box scenario; the present invention can effectively generate SAR image adversarial samples with a high attack success rate, thereby effectively deceiving the SAR automatic target recognition model in a black box scenario. The present invention has the following advantages: (1) It is more in line with the characteristics of SAR data and is suitable for military and civilian SAR-ATR practical application scenarios; (2) It performs well in black box attacks and fully considers the attacker's strategy to improve the attack success rate in the absence of detailed information on the target model; (3) It has stronger adaptability and robustness and can cope with different target models and defense strategies.

[0070] The present invention fully considers the attacker's strategy to improve the success rate of the attack in the absence of detailed information on the target model, and the generated adversarial samples achieve better attack performance than the existing benchmark methods. The present invention is more in line with the characteristics of SAR image data and can play a better role in the actual application scenarios of military and civilian SAR-ATR.

[0071] Example 2

[0072] The embodiment of the present invention provides a method for evaluating the safety of a SAR image automatic target recognition model, comprising:

[0073] For each SAR image sample in the pre-collected SAR sample data set, the adversarial sample generation method provided by Embodiment 1 of the present invention is used to generate a corresponding adversarial sample; each adversarial sample is respectively input into the SAR automatic target recognition model to be evaluated to obtain a corresponding target recognition result;

[0074] By comparing the differences between the target recognition results of each adversarial sample and the corresponding true results (labels), the accuracy of the target recognition results is statistically analyzed; the higher the accuracy of the target recognition results, the better the security of the SAR automatic target recognition model.

[0075] For the related technical solutions, please refer to the corresponding description in Example 1, which will not be repeated here.

[0076] Example 3

[0077] An embodiment of the present invention provides an adversarial sample generation system for SAR images, including a computer-readable storage medium and a processor;

[0078] Computer-readable storage media for storing executable instructions;

[0079] The processor is used to read the executable instructions stored in the computer-readable storage medium to execute the method in Example 1.

[0080] For the related technical solutions, please refer to the corresponding description in Example 1, which will not be repeated here.

[0081] Example 4

[0082] An embodiment of the present invention provides a safety assessment system for a SAR image automatic target recognition model, including a computer-readable storage medium and a processor;

[0083] Computer-readable storage media for storing executable instructions;

[0084] The processor is used to read the executable instructions stored in the computer-readable storage medium to execute the method in Example 2.

[0085] For the related technical solutions, please refer to the corresponding description in Example 2, which will not be repeated here.

[0086] Example 5

[0087] An embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the method in Embodiment 1 is implemented, and / or when executed, the method in Embodiment 2 is implemented.

[0088] For the related technical solutions, please refer to the corresponding descriptions in Example 1 and Example 2, which will not be repeated here.

[0089] Example 6

[0090] The embodiment of the present invention provides a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the method in embodiment 1 and / or the method in embodiment 2.

[0091] For the related technical solutions, please refer to the corresponding descriptions in Example 1 and Example 2, which will not be repeated here.

[0092] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for generating adversarial samples of SAR images, characterized in that: include: S1. Take the adversarial sample of each SAR image sample x in the SAR sample dataset Initialize to x, and initialize momentum g0 = 0; S2, at the tth iteration, based on the momentum g of the previous iteration t-1 And the current adversarial sample The gradient of , calculate the current adversarial sample The forward gradient g ′ t ; S3. Using the current adversarial sample As the data starting point, along the forward gradient g ′ t The direction of the current adversarial sample is generated with a preset step size. The corresponding N predicted data points are perturbed and the integrated gradient of the N predicted data points after adding perturbations is calculated by using confidence weighting. With the integrated gradient Update the current adversarial example The gradient vector Get the updated gradient vector With the gradient vector Update the current adversarial example Get the updated adversarial sample And the gradient vector As the momentum g of the current t-th iteration t ; Among them, adversarial samples Initial value of the gradient vector S4. Determine whether t is less than a preset number of iterations T. If so, set t=t+1 and go to S2; otherwise, use the updated adversarial sample obtained at the Tth iteration as the adversarial sample of the SAR image sample x.

2. The adversarial sample generation method for SAR images according to claim 1, characterized in that: In S3, the N predicted data points after adding disturbance are: in, is the i-th predicted data point after adding disturbance, i is 1, 2, ..., or N; k is the disturbance factor, ∈ is the disturbance amplitude, α is the preset step size, δ i represents the i-th sampling value uniformly sampled within the preset sampling interval [-δ,δ]; sign(·) represents the sign function.

3. The adversarial sample generation method for SAR images according to claim 2, characterized in that: In S3, the integrated gradient of the N predicted data points after adding disturbance is calculated by using confidence weighting for: Among them, scores[i] represents the i-th predicted data point Confidence score of Indicates that the i-th predicted data point The difference between the target recognition result obtained by inputting into the deep learning model for automatic target recognition of SAR images and the target recognition label y; express For the i-th predicted data point The derivative of .

4. The method for generating adversarial samples of SAR images according to any one of claims 1 to 3, characterized in that: The forward gradient g ′ t for: Where, μ is the attenuation factor; Indicates that the adversarial sample The difference between the target recognition result obtained by inputting into the deep learning model for automatic target recognition of SAR images and the target recognition label y; express right The derivative of , ‖·‖1 represents the first norm.

5. The method for generating adversarial samples of SAR images according to claim 4, characterized in that: The updated gradient vector for: The updated adversarial example for: Wherein, α is the preset step size, and sign(·) represents the sign function.

6. A safety assessment method for a SAR image automatic target recognition model, characterized in that: include: For each SAR image sample in the pre-collected SAR sample data set, the adversarial sample generation method of the SAR image according to any one of claims 1 to 5 is used to generate a corresponding adversarial sample; and each adversarial sample is respectively input into the SAR automatic target recognition model to be evaluated to obtain a corresponding target recognition result; By comparing the difference between the target recognition result of each adversarial sample and the corresponding target recognition label, the accuracy of the target recognition result is statistically calculated; wherein, the higher the accuracy of the target recognition result, the better the security of the SAR automatic target recognition model.

7. A system for generating adversarial samples of SAR images, characterized in that: comprising a computer readable storage medium and a processor; The computer-readable storage medium is used to store executable instructions; The processor is used to read the executable instructions stored in the computer-readable storage medium to execute the adversarial sample generation method for SAR images according to any one of claims 1 to 5.

8. A safety assessment system for a SAR image automatic target recognition model, characterized in that: comprising a computer readable storage medium and a processor; The computer-readable storage medium is used to store executable instructions; The processor is used to read the executable instructions stored in the computer-readable storage medium to execute the safety assessment method of the SAR image automatic target recognition model according to claim 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the adversarial sample generation method for SAR images as described in any one of claims 1 to 5 is implemented, and / or the security assessment method for the SAR image automatic target recognition model as described in claim 6 is implemented.

10. A computer program product, characterized in that When the computer program product runs on a computer, the computer executes the adversarial sample generation method for SAR images described in any one of claims 1 to 5, and / or executes the security assessment method for the SAR image automatic target recognition model described in claim 6.

Images