A fast adversarial sample generation method based on SAR target recognition network

Abstract

The present invention discloses a method for quickly generating adversarial samples based on a SAR target recognition network, comprising the following steps: acquiring a SAR image data set for model training, constructing a SAR image target recognition model based on deep learning according to a general target recognition model, and obtaining a general adversarial perturbation of the SAR image target recognition model by adopting an adversarial perturbation generation algorithm; acquiring radar parameters for SAR imaging and performing two-dimensional phase interference modulation to obtain a modulation interference strategy; and adopting an Adam optimizer according to an unconstrained minimum optimization algorithm to iteratively solve a two-dimensional phase modulation sequence; and according to the modulation interference strategy, obtaining a general generated perturbation for interference recognition effect, and obtaining an adversarial sample of the SAR image target recognition model by adding the general generated perturbation to the SAR image data set; the present invention provides technical support for physically realizing the generation of general adversarial perturbations of SAR images.

Description

Technical Field

[0001] The present application relates to the field of radar image technology, and in particular to a method for quickly generating adversarial samples based on a SAR target recognition network. Background Art

[0002] In order to protect high-value targets and important strategic areas, adversarial sample generation based on SAR target recognition networks is a key research issue in the field of radar adversarial. Compared with SAR image target recognition, which relies too much on feature extraction of experts' obvious knowledge, SAR target recognition based on deep learning has a simpler process and better recognition performance.

[0003] However, studies have shown that SAR image recognition methods based on deep learning are vulnerable to adversarial samples. After adding a slight perturbation to the input sample, it becomes aggressive. At present, the SAR target recognition model is mainly aimed at a single input sample, which depends on the gradient of the target recognition model. This type of adversarial sample is not applicable to actual radar countermeasure applications. Traditional jamming technology is mainly divided into suppression jamming and deception jamming. Suppression is to transmit high-power radio frequency signals to interfere with the enemy's SAR signal, and deception is to form a false target in the enemy's SAR imaging results through the "intercept-modulate-forward" method. Both have the disadvantages of high transmission power, difficulty in obtaining target radar parameters, and easy perception.

[0004] According to the SAR image two-dimensional phase modulation jamming mechanism, by controlling the phase characteristics of the SAR two-dimensional signal, the two-dimensional modulation jamming is not easy to detect, and can achieve the purpose of jamming SAR image target recognition. Therefore, there is an urgent need for a fast generation method of SAR image adversarial samples that can be physically realized based on deep learning to meet the needs of existing application scenarios. Summary of the invention

[0005] In view of the above problems, the purpose of the present invention is to provide a method for quickly generating adversarial samples based on a SAR target recognition network. The classic general adversarial perturbation generation algorithm is adopted, and combined with a passive metasurface, the SAR two-dimensional phase modulation interference characteristics can be realized, which is used to solve the problem of quickly generating SAR adversarial samples based on deep learning.

[0006] In order to achieve the above object, the present invention provides a method for quickly generating adversarial samples based on a SAR target recognition network, comprising the following steps:

[0007] Collect SAR image data sets for model training, build a SAR image target recognition model based on deep learning according to the general target recognition model, and obtain the general adversarial perturbation of the SAR image target recognition model by adopting the adversarial perturbation generation algorithm. Among them, the general target recognition model is used to represent the commonly used SAR image recognition model;

[0008] Collect radar parameters for SAR imaging and perform two-dimensional phase interference modulation to obtain a modulation interference strategy for interfering with the recognition effect of the SAR image target recognition model. The modulation interference strategy is used to indicate the number and location of phase modulation areas;

[0009] Based on the general anti-disturbance and modulation interference strategy, the Adam optimizer is used according to the unconstrained minimum optimization algorithm to iteratively solve the two-dimensional phase modulation sequence;

[0010] Based on the two-dimensional phase modulation sequence and the modulation interference strategy, a universal generated perturbation for interference recognition effect is obtained. By adding the universal generated perturbation to the SAR image dataset, adversarial samples of the SAR image target recognition model are obtained.

[0011] Preferably, in the process of constructing a SAR image target recognition model based on deep learning, the general target recognition model includes at least a LeNet model, a VGGNet16 model, a ResNet18 model, and a ResNet50 model.

[0012] Preferably, in the process of obtaining the universal adversarial perturbation, the step of obtaining the universal adversarial perturbation includes:

[0013] S101. Collect the expected fooling rate and the maximum perturbation value of the SAR image target recognition model, and obtain the general adversarial perturbation by inputting the SAR image data set and generating the adversarial perturbation algorithm;

[0014] S102. Determine whether the SAR adversarial sample obtained by superimposing the universal adversarial perturbation obtained in step 101 on the original image can meet the expected fooling rate; if so, end; if not, execute step 101.

[0015] Preferably, in the process of obtaining the universal adversarial perturbation of the SAR image target recognition model, the algorithm expression of the adversarial perturbation generation algorithm is:

[0016] f(x+υ)≠f(x),for most x~μ

[0017] In the formula, the input sample x satisfies the distribution μ, υ represents the universal adversarial perturbation, and f(x) represents the expected output result of the target recognition model.

[0018] Preferably, in the process of adopting the adversarial perturbation generation algorithm, the adversarial perturbation generation algorithm further includes an algorithm constraint condition, and a general adversarial perturbation is obtained by selecting an adversarial perturbation generation algorithm that satisfies the algorithm constraint condition, wherein the algorithm constraint condition is:

[0019]

[0020] where ξ represents the maximum value of the universal adversarial perturbation υ and δ represents the expected fooling rate in the entire SAR image dataset.

[0021] Preferably, in the process of acquiring the modulation interference strategy, two-dimensional phase interference modulation is performed according to a two-dimensional phase modulation interference mechanism of the SAR image, wherein the two-dimensional phase modulation interference mechanism of the SAR image is:

[0022] s j (t,η)=s0(t,η)·p r (t)·p a (η)

[0023] Where: t is the distance time, η is the azimuth time, s j (t,η) is the SAR image two-dimensional modulation interference imaging result, s0(t,η) is the SAR image original imaging result, p r (t) is the phase modulation result in the range direction, p a (η) is the azimuth phase modulation result.

[0024] Preferably, during the two-dimensional phase interference modulation, the original imaging result of the SAR image is:

[0025]

[0026] Among them, σ0 represents the scattering intensity of the target, f0 is the carrier frequency, K r is the linear modulation frequency, and R(η) is the instantaneous slant distance.

[0027] Preferably, in the process of iteratively solving the two-dimensional phase modulation sequence, the algorithm formula of the unconstrained minimization optimization algorithm is:

[0028]

[0029] In the formula, s represents the two-dimensional phase modulation sequence, υ represents the universal adversarial disturbance, and F(s) is the two-dimensional phase modulation result after being processed by the RDA algorithm. represents the loss function;

[0030] The loss function is the SmoothL1 loss function, and the loss function is:

[0031]

[0032] Preferably, the process of iteratively solving the two-dimensional phase modulation sequence includes the following steps:

[0033] Step a: obtaining the number and position of regions used for two-dimensional phase modulation in the two-dimensional interference samples of the SAR image, randomly selecting a disordered sequence as an initial two-dimensional phase modulation sequence, and obtaining an initial two-dimensional phase modulation interference sample of the SAR image;

[0034] Step b: setting a threshold for stopping optimization update of the unconstrained minimization optimization algorithm;

[0035] Step c: Based on the universal adversarial perturbation and the two-dimensional phase modulation interference samples of the initial SAR image, the Adam optimizer is used according to the unconstrained minimization optimization algorithm to optimize and find the best two-dimensional phase modulation sequence, and the loss value is updated;

[0036] Step d: Compare the loss value obtained in step c with the threshold set in step b. If the loss value is ≤ the threshold, execute step c; if the loss value is > the threshold, stop updating and save the current two-dimensional phase modulation sequence result.

[0037] Preferably, the adversarial sample rapid generation system for implementing the adversarial sample rapid generation method comprises:

[0038] A data acquisition module, used to collect SAR image data sets for model training;

[0039] A general adversarial perturbation acquisition module is used to construct a SAR image target recognition model based on deep learning according to a general target recognition model, and to obtain a general adversarial perturbation of the SAR image target recognition model by adopting an adversarial perturbation generation algorithm, wherein the general target recognition model is used to represent a commonly used SAR image recognition model;

[0040] An interference strategy formulation module is used to collect radar parameters for SAR imaging and perform two-dimensional phase interference modulation to obtain a modulation interference strategy for interfering with the recognition effect of a SAR image target recognition model, wherein the modulation interference strategy is used to indicate the number and position of phase modulation regions;

[0041] Interference modulation module, which is used to iteratively solve the two-dimensional phase modulation sequence based on the general anti-disturbance and modulation interference strategy, according to the unconstrained minimum optimization algorithm and the Adam optimizer;

[0042] The adversarial sample generation module is used to obtain a universal generated perturbation for interfering with the recognition effect based on a two-dimensional phase modulation sequence and a modulation interference strategy, and to obtain adversarial samples of the SAR image target recognition model by adding the universal generated perturbation to the SAR image dataset.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] 1. This invention is aimed at a method for rapidly generating adversarial samples based on a SAR image target recognition network. This method provides theoretical support for the physical realization of universal adversarial perturbation generation for SAR images.

[0045] 2. The present invention takes universal countermeasure disturbance as the goal, combines the two-dimensional modulation interference of SAR images, and proposes an unconstrained minimum optimization algorithm to iteratively solve the two-dimensional phase modulation sequence, so that the universal generated disturbance countermeasure effect is more significant;

[0046] 3. The present invention adopts analytical methods such as gradient descent and iterative threshold convergence to solve the two-dimensional phase modulation sequence, which improves the calculation efficiency. The solved universal generation perturbation has a higher similarity with the universal adversarial perturbation. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0048] Figure 1 A system schematic diagram of the method for quickly generating adversarial samples proposed by the present invention;

[0049] Figure 2 This is a flowchart of the steps of the method for quickly generating adversarial samples proposed by the present invention;

[0050] Figure 3 This is a schematic diagram of a universal adversarial perturbation (after 5 times the strength enhancement) obtained by optimizing the search for a specific instance pre-trained target recognition model using the classic universal adversarial perturbation generation algorithm mentioned in the present invention;

[0051] Figure 4 The radar imaging parameters sorted out by the present invention according to the SAR image data set are schematic diagrams using two-dimensional phase modulation interference;

[0052] Figure 5 The present invention takes universal counter-disturbance as the goal, combines SAR image two-dimensional modulation interference, and uses unconstrained minimum optimization algorithm to iteratively solve the two-dimensional phase modulation sequence, and obtains a universal generated disturbance schematic diagram (after the intensity is enhanced by 5 times);

[0053] Figure 6 Schematic diagram of adversarial samples obtained on various target recognition models by the adversarial sample rapid generation method based on SAR target recognition network proposed in the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0055] like Figure 1-6 As shown, the present invention discloses a method for quickly generating adversarial samples based on a SAR target recognition network, comprising the following steps:

[0056] Collect SAR image data sets for model training, build a SAR image target recognition model based on deep learning according to the general target recognition model, and obtain the general adversarial perturbation of the SAR image target recognition model by adopting the adversarial perturbation generation algorithm. Among them, the general target recognition model is used to represent the commonly used SAR image recognition model;

[0057] Collect radar parameters for SAR imaging and perform two-dimensional phase interference modulation to obtain a modulation interference strategy for interfering with the recognition effect of the SAR image target recognition model. The modulation interference strategy is used to indicate the number and location of phase modulation areas;

[0058] Based on the general anti-disturbance and modulation interference strategy, the Adam optimizer is used according to the unconstrained minimum optimization algorithm to iteratively solve the two-dimensional phase modulation sequence;

[0059] Based on the two-dimensional phase modulation sequence and the modulation interference strategy, a universal generated perturbation for interference recognition effect is obtained. By adding the universal generated perturbation to the SAR image dataset, adversarial samples of the SAR image target recognition model are obtained.

[0060] Further preferably, in the process of constructing a SAR image target recognition model based on deep learning, the general target recognition model includes at least a LeNet model, a VGGNet16 model, a ResNet18 model, and a ResNet50 model.

[0061] Further preferably, in the process of obtaining the universal adversarial disturbance, the step of obtaining the universal adversarial disturbance includes:

[0062] S101. Collect the expected fooling rate and the maximum perturbation value of the SAR image target recognition model, and obtain the general adversarial perturbation by inputting the SAR image data set and generating the adversarial perturbation algorithm;

[0063] S102. Determine whether the SAR adversarial sample obtained by superimposing the universal adversarial perturbation obtained in step 101 on the original image can meet the expected fooling rate; if so, end; if not, execute step 101.

[0064] Further preferably, in the process of obtaining the universal adversarial disturbance of the SAR image target recognition model, the algorithm expression of the adversarial disturbance generation algorithm is:

[0065] f(x+υ)≠f(x),for most x~μ

[0066] In the formula, the input sample x satisfies the distribution μ, υ represents the universal adversarial perturbation, and f(x) represents the expected output result of the target recognition model.

[0067] Further preferably, in the process of adopting the adversarial perturbation generation algorithm, the adversarial perturbation generation algorithm also includes an algorithm constraint condition, and a general adversarial perturbation is obtained by selecting an adversarial perturbation generation algorithm that satisfies the algorithm constraint condition, wherein the algorithm constraint condition is:

[0068]

[0069] where ξ represents the maximum value of the universal adversarial perturbation υ and δ represents the expected fooling rate in the entire SAR image dataset.

[0070] Further preferably, in the process of acquiring the modulation interference strategy, two-dimensional phase interference modulation is performed according to the two-dimensional phase modulation interference mechanism of the SAR image, wherein the two-dimensional phase modulation interference mechanism of the SAR image is:

[0071] s j (t,η)=s0(t,η)·p r (t)·p a (η)

[0072] Where: t is the distance time, η is the azimuth time, s j (t,η) is the SAR image two-dimensional modulation interference imaging result, s0(t,η) is the SAR image original imaging result, p r (t) is the range phase modulation result, p a (η) is the azimuth phase modulation result.

[0073] Further preferably, during the two-dimensional phase interference modulation, the original imaging result of the SAR image is:

[0074]

[0075] Among them, σ0 represents the scattering intensity of the target, f0 is the carrier frequency, K r is the linear modulation frequency, and R(η) is the instantaneous slant distance.

[0076] Further preferably, in the process of iteratively solving the two-dimensional phase modulation sequence, the algorithm formula of the unconstrained minimization optimization algorithm is:

[0077]

[0078] In the formula, s represents the two-dimensional phase modulation sequence, υ represents the universal adversarial disturbance, and F(s) is the two-dimensional phase modulation result after being processed by the RDA algorithm. represents the loss function;

[0079] The loss function is the SmoothL1 loss function, and the loss function is:

[0080]

[0081] Further preferably, in the process of iteratively solving the two-dimensional phase modulation sequence, the following steps are included:

[0082] Step a: obtaining the number and position of regions used for two-dimensional phase modulation in the two-dimensional interference samples of the SAR image, randomly selecting a disordered sequence as an initial two-dimensional phase modulation sequence, and obtaining an initial SAR image two-dimensional phase modulation interference sample;

[0083] Step b: setting a threshold for stopping optimization update of the unconstrained minimization optimization algorithm;

[0084] Step c: Based on the universal adversarial perturbation and the two-dimensional phase modulation interference samples of the initial SAR image, the Adam optimizer is used according to the unconstrained minimization optimization algorithm to optimize and find the best two-dimensional phase modulation sequence, and the loss value is updated;

[0085] Step d: Compare the loss value obtained in step c with the threshold set in step b. If the loss value is ≤ the threshold, execute step c; if the loss value is > the threshold, stop updating and save the current two-dimensional phase modulation sequence result.

[0086] Further preferably, the adversarial sample rapid generation system for implementing the adversarial sample rapid generation method comprises:

[0087] A data acquisition module, used to collect SAR image data sets for model training;

[0088] A general adversarial perturbation acquisition module is used to construct a SAR image target recognition model based on deep learning according to a general target recognition model, and to obtain a general adversarial perturbation of the SAR image target recognition model by adopting an adversarial perturbation generation algorithm, wherein the general target recognition model is used to represent a commonly used SAR image recognition model;

[0089] An interference strategy formulation module is used to collect radar parameters for SAR imaging and perform two-dimensional phase interference modulation to obtain a modulation interference strategy for interfering with the recognition effect of a SAR image target recognition model, wherein the modulation interference strategy is used to indicate the number and position of phase modulation regions;

[0090] Interference modulation module, which is used to iteratively solve the two-dimensional phase modulation sequence based on the general anti-disturbance and modulation interference strategy, according to the unconstrained minimum optimization algorithm and the Adam optimizer;

[0091] The adversarial sample generation module is used to obtain a universal generated perturbation for interfering with the recognition effect based on a two-dimensional phase modulation sequence and a modulation interference strategy, and to obtain adversarial samples of the SAR image target recognition model by adding the universal generated perturbation to the SAR image dataset.

[0092] Embodiment 1: The specific implementation steps of the present invention are described in detail below:

[0093] The adversarial sample fast generation method based on SAR target recognition network takes universal adversarial perturbation as the target, combines the two-dimensional modulation interference of SAR image, and uses unconstrained minimum optimization algorithm to iteratively solve the two-dimensional phase modulation sequence to generate adversarial samples. The specific process is as follows:

[0094] Step 1: Organize the SAR image dataset and pre-train the SAR image target recognition model based on deep learning;

[0095] Step 2: Use the classic universal adversarial perturbation generation algorithm to optimize the search for the pre-trained target recognition model to obtain the universal adversarial perturbation υ;

[0096] Step 3: Arrange the radar parameters required for SAR imaging, combine the SAR image two-dimensional phase modulation interference mechanism, and obtain the SAR image two-dimensional modulation interference imaging results to achieve the effect of interfering with the SAR image target recognition model;

[0097] Step 4: Taking the universal countermeasure disturbance as the goal, combined with the two-dimensional modulation interference of SAR images, an unconstrained minimum optimization algorithm is used to iteratively solve the two-dimensional phase modulation sequence s;

[0098] Step 5: Based on the solved two-dimensional phase modulation sequence and the two-dimensional phase modulation interference mechanism of SAR images, a physically feasible general generation perturbation for the deep learning-based SAR image target recognition network is generated.

[0099] Step 6: Add universal generated perturbations to the original image and attack the pre-trained SAR target recognition model to verify the adversarial effect of SAR image adversarial samples.

[0100] The classic universal adversarial perturbation generation algorithm is used to optimize the search for the pre-trained SAR image target recognition model to obtain the universal adversarial perturbation. The classic universal adversarial perturbation generation algorithm is:

[0101] f(x+υ)≠f(x),for most x~μ

[0102] In this formula, the input sample x satisfies the distribution μ, υ represents the universal adversarial perturbation, and f(x) represents the expected output result of the target recognition model.

[0103] The algorithm must meet the following constraints:

[0104]

[0105] where ξ represents the maximum value of the universal adversarial perturbation υ and δ represents the expected fooling rate in the entire SAR image dataset.

[0106] The classic universal adversarial perturbation generation algorithm is applied to the field of SAR images to obtain universal adversarial perturbations in the field of SAR images, and to achieve universal adversarial perturbation optimization search for SAR image target recognition networks. The steps are as follows:

[0107] Step a: According to the SAR image target recognition model, set the expected fooling rate and the maximum perturbation value;

[0108] Step b: Input the SAR image dataset and use the universal adversarial perturbation generation algorithm to optimize the search for universal adversarial perturbations of SAR images;

[0109] Step c: Determine whether the SAR adversarial sample obtained by superimposing the universal adversarial perturbation of the SAR image obtained in step b on the original image can meet the expected fooling rate. If it does, end; if not, execute step b.

[0110] According to the SAR image two-dimensional phase modulation jamming mechanism, the SAR image two-dimensional modulation jamming achieves the effect of jamming the SAR image target recognition model. The SAR image two-dimensional phase modulation jamming mechanism is shown in the following formula:

[0111] s j (t,η)=s0(t,η)·p r (t)·p a (η)

[0112] In this formula: t is the distance time, η is the azimuth time, s j(t,η) is the SAR image two-dimensional modulation interference imaging result, s0(t,η) is the SAR image original imaging result, p r (t) is the phase modulation result in the range direction, p a (η) is the azimuth phase modulation result. s0(t,η) is the original imaging result of the SAR image:

[0113]

[0114] Among them, σ0 represents the scattering intensity of the target, f0 is the carrier frequency, K r is the linear modulation frequency, and R(η) is the instantaneous slant distance.

[0115] Combined with the two-dimensional phase modulation interference results of the SAR image, different disordered sequences are selected as the initial two-dimensional phase modulation sequences. At the same time, in order to achieve the effect of interfering with the SAR image target recognition model, the number and position of the areas that need to be two-dimensional phase modulation in the two-dimensional interference samples of the SAR image are determined.

[0116] The present invention also discloses an algorithm for iteratively solving a two-dimensional phase modulation sequence. With the general anti-disturbance as the goal, combined with the two-dimensional modulation interference of SAR images, an unconstrained minimum optimization algorithm is used to iteratively solve the two-dimensional phase modulation sequence, as follows:

[0117] The formula of the unconstrained minimization optimization algorithm based on deep learning is as follows:

[0118]

[0119] Where s represents the two-dimensional phase modulation sequence, υ represents the universal adversarial perturbation, and F(s) is the two-dimensional phase modulation result after being processed by the RDA algorithm. Represents the loss function.

[0120] The loss function used is the SmoothL1 loss function, the formula is as follows:

[0121]

[0122] In the deep learning algorithm, the gradient backpropagation idea is used to optimize parameters and update them, and the Adam optimizer is used to update the gradient.

[0123] The specific steps for solving the two-dimensional phase modulation sequence are as follows:

[0124] Step a: setting the number and position of regions to be subjected to two-dimensional phase modulation in the two-dimensional interference samples of the SAR image, randomly selecting a disordered sequence as an initial two-dimensional phase modulation sequence, and obtaining an initial two-dimensional phase modulation interference sample of the SAR image;

[0125] Step b: Setting the threshold for the unconstrained minimization optimization algorithm to stop optimizing and updating;

[0126] Step c: Bring the universal adversarial perturbation and the initial SAR image two-dimensional phase modulation interference samples into the unconstrained minimization optimization algorithm, use the Adam optimizer to optimize and find the best two-dimensional phase modulation sequence, and update the loss value;

[0127] Step d: Compare the loss value obtained in step c with the threshold set in step b. If the loss value is ≤ the threshold, execute step c; if the loss value is > the threshold, stop updating and save the current two-dimensional phase modulation sequence result.

[0128] Embodiment 2: The structure and working process of the present invention are further described below in conjunction with the accompanying drawings:

[0129] The present invention proposes a method for quickly generating adversarial samples based on a SAR target recognition network. The overall system framework of the method is as follows: Figure 1 As shown in FIG. 1 , it is mainly divided into a generative interference model and a deep learning model. The generative interference model is a SAR image adversarial sample generation module, and the deep learning model is a pre-trained SAR target recognition model. The specific steps of the method described in the present invention are as follows: Figure 2 As shown, the specific process is as follows.

[0130] Step 1: Organize the SAR image dataset and pre-train the SAR image target recognition model based on deep learning;

[0131] The present invention uses the measured SAR ground dynamic and static target acquisition and recognition (MSTAR) data set as experimental data. The experimental data used in this experiment includes ten types of targets, of which 2733 images at a pitch angle of 17° are used as training sets, and 2424 images at a pitch angle of 15° are used as test sets. The original images are preprocessed and their size is set to 96×96 pixels.

[0132] In this experiment, the Adam optimizer was used for pre-training of the SAR target recognition model. The recognition accuracy of each classic target recognition model is shown in Table 1. The recognition accuracy on the training set reached more than 99%, and the recognition accuracy on the test set reached more than 93%.

[0133] Table 1

[0134]

[0135] Step 2: Use the classic universal adversarial perturbation generation algorithm to optimize the search for the pre-trained target recognition model to obtain the universal adversarial perturbation υ;

[0136] The universal adversarial perturbation generation algorithm UAP is used to optimize the search for the universal adversarial perturbation υ. A part of the training set images N are selected for optimized search, and the universal adversarial perturbation that satisfies the fooling rate δ on the test set can be obtained.

[0137] In the experiments involved in the present invention, the parameters involved are as follows:

[0138] N = 100

[0139] δ=0.85

[0140] In the specific example of the present invention, the universal adversarial perturbation υ (after the intensity is enhanced by 5 times) obtained by optimizing the search of each classic target recognition network is as follows: Figure 3 As shown, it can be seen that the strength and distribution of the universal adversarial perturbations of various target recognition models are not the same, which also verifies that the perturbations obtained by the universal adversarial perturbation generation algorithm UAP are not unique.

[0141] Step 3: Arrange the radar parameters required for SAR imaging, combine the SAR image two-dimensional phase modulation interference mechanism, and obtain the SAR image two-dimensional modulation interference imaging results to achieve the effect of interfering with the SAR image target recognition model;

[0142] The principle of two-dimensional phase modulation of radar images is as follows:

[0143] s j (t,η)=s0(t,η)·p r (t)·p a (η)

[0144] Among them, s0(t,η) is the original imaging result of SAR image, p r (t) is the phase modulation result in the range direction, p a (η) is the azimuth phase modulation result.

[0145] In the present invention, the formulas for the phase modulation result in the range direction and the phase modulation result in the azimuth direction are as follows:

[0146] p r (t) = exp(jm fr n r (t))

[0147] p a (η) = exp(jm fa n a (η))

[0148] Among them, m fr and m fa They represent the modulation coefficients in the range direction and the azimuth direction respectively, and are empirical values ​​selected in the specific implementation examples of the present invention, and n r (t) and na (t) represent the phase modulation sequence in the range direction and the azimuth direction respectively, and the initial selected value in the specific implementation example of the present invention is a random sequence.

[0149] In order to keep the imaging results of radar image two-dimensional phase modulation interference consistent with the benchmark of MSTAR data set, the imaging parameters of radar image two-dimensional modulation interference are selected in accordance with the original imaging parameters in MSTAR data set in the present invention. Figure 4 shown.

[0150] Step 4: Taking the universal countermeasure disturbance as the goal, combined with the two-dimensional modulation interference of SAR images, an unconstrained minimum optimization algorithm is used to iteratively solve the two-dimensional phase modulation sequence s;

[0151] The formula of the unconstrained minimization optimization algorithm based on deep learning is as follows:

[0152]

[0153] Where s represents the two-dimensional phase modulation sequence, υ represents the universal adversarial perturbation, and F(s) is the two-dimensional phase modulation result after being processed by the RDA algorithm. represents the loss function.

[0154] In the present invention, a general anti-disturbance ( Figure 3 ) as the target, combined with SAR image two-dimensional modulation interference ( Figure 4 ), an unconstrained minimum optimization algorithm is used to iteratively solve the two-dimensional phase modulation sequence s, and the distribution of the solved two-dimensional phase modulation sequence is still a random distribution.

[0155] Step 5: Based on the solved two-dimensional phase modulation sequence and the two-dimensional phase modulation interference mechanism of SAR images, a physically feasible general generation perturbation of the deep learning-based SAR image target recognition network is generated;

[0156] In the present invention, step 4 is used to solve and obtain the two-dimensional phase modulation sequence s, and the universal generation perturbation of the SAR image target recognition network based on deep learning is obtained through the two-dimensional phase modulation mechanism. The specific implementation example target recognition network in the present invention is based on the universal generation perturbation of the SAR image target recognition network based on deep learning as shown in Figure 5 shown.

[0157] Step 6: Add universal generated perturbations to the original image and attack the pre-trained SAR target recognition model to verify the adversarial effect of SAR image adversarial samples.

[0158] Step a: Add the universal adversarial perturbation obtained in step 5 to the SAR test dataset to obtain an adversarial sample. The adversarial sample of the ResNet50 target recognition model in the specific implementation example of the present invention is as follows: Figure 6 As shown, it can be seen that the intensity of the universal generated perturbation is almost imperceptible relative to the SAR image and is almost unrecognizable to the naked eye.

[0159] Step b: Use the SAR adversarial samples on the SAR test set obtained in step a to attack the target recognition model trained in the specific implementation case of the present invention. The fooling rates obtained are shown in Table 2. The fooling rates of various target recognition models are all above 72%.

[0160] Table 2

[0161]

[0162] The following example simulation is carried out to explain in detail the implementation process of the algorithm of the present invention.

[0163] The present invention aims to propose a method for quickly generating adversarial samples based on a SAR target recognition network. In order to verify the effectiveness of the method proposed in the present invention on different types of target recognition networks, the following target recognition networks are used for experiments:

[0164] Experiment 1:

[0165] This experiment uses the classic target recognition network LeNet to verify the effectiveness of the method proposed in this invention on the target recognition network.

[0166] The LeNet network is cleverly designed to extract features using operations such as convolution, parameter sharing, and pooling, and finally uses a fully connected neural network for classification and recognition. Since the LeNet network has fewer layers, the attack effect of the present invention on a small target recognition network can be verified by following the steps described in the specific implementation method.

[0167] Experiment 2:

[0168] This experiment uses the classic target recognition network VGGNet to verify the effectiveness of the method proposed in the present invention on the target recognition network. The VGGNet model consists of 16 to 19 layers, and this experiment uses VGGNet16. In the model, 3×3 convolution kernels and 2×2 maximum pooling layers are repeatedly stacked to improve the recognition performance of the algorithm. However, as the number of network layers increases, the parameters to be trained will also increase, which means that the VGGNet16 model requires more training data. The MSTAR dataset used in this experiment is sufficient in image quality and quantity to meet the training requirements of the VGGNet16 model. This experiment uses VGGNet16, and the attack effect of the present invention on a medium-sized target recognition network can be verified according to the specific implementation steps.

[0169] Experiment 3:

[0170] This experiment uses the classic target recognition network ResNet to verify the effectiveness of the method proposed in the present invention on the target recognition network. Compared with the LeNet and VGGNet models, the ResNet model has a deeper network layer. As the number of layers of the network model increases, its feature expression ability becomes stronger. However, as the number of network layers increases, gradient diffusion occurs, resulting in a decrease in model performance. The ResNet model uses the same size convolution kernel as the VGGNet model, but ResNet has a lower training error and a higher test accuracy, so the ResNet model has been widely used in target recognition tasks in various fields. In this experiment, in order to verify the attack effect of the method proposed in the present invention on the ResNet model, this experiment used the ResNet18 network and the ResNet50 network respectively. According to the specific implementation steps, the attack effect of the present invention on a deeper target recognition network can be verified.

[0171] The invention discloses a method for quickly generating adversarial samples for SAR image target recognition network. The method includes: pre-training a SAR image target recognition model based on deep learning according to a SAR image data set; using a classic universal adversarial perturbations (UAP) generation algorithm to optimize the search for the pre-trained target recognition model to obtain universal adversarial perturbations; sorting out the radar parameters required for SAR imaging, and obtaining the SAR image two-dimensional modulation interference imaging result according to the SAR image two-dimensional phase modulation interference mechanism and the radar parameters required for SAR imaging; combining universal adversarial perturbations and SAR image two-dimensional modulation interference, using an unconstrained minimum optimization algorithm to iteratively solve the two-dimensional phase modulation sequence; obtaining a physically achievable universal generation perturbation of a SAR image target recognition network based on deep learning according to the solved two-dimensional phase modulation sequence, and finally verifying the adversarial effect of the SAR image adversarial sample.

[0172] Compared with the prior art, the present invention has the following beneficial effects:

[0173] 1. This invention is aimed at a method for rapidly generating adversarial samples based on a SAR image target recognition network. This method provides theoretical support for the physical realization of universal adversarial perturbation generation for SAR images.

[0174] 2. The present invention takes universal countermeasure disturbance as the goal, combines the two-dimensional modulation interference of SAR images, and proposes an unconstrained minimum optimization algorithm to iteratively solve the two-dimensional phase modulation sequence, so that the universal generated disturbance countermeasure effect is more significant;

[0175] 3. The present invention adopts analytical methods such as gradient descent and iterative threshold convergence to solve the two-dimensional phase modulation sequence, which improves the calculation efficiency. The solved universal generation perturbation has a higher similarity with the universal adversarial perturbation.

[0176] The implementation examples are only for illustrating the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the present invention.

Claims

1. A method for rapidly generating adversarial samples based on a SAR target recognition network, characterized in that: The following steps are involved: Collecting a SAR image data set for model training, building a SAR image target recognition model based on deep learning according to a general target recognition model, and obtaining a general adversarial perturbation of the SAR image target recognition model by adopting an adversarial perturbation generation algorithm; wherein the general target recognition model is used to represent a commonly used SAR image recognition model; Collect radar parameters for SAR imaging and perform two-dimensional phase interference modulation to obtain a modulation interference strategy for interfering with the recognition effect of the SAR image target recognition model; wherein the modulation interference strategy is used to indicate the number and position of phase modulation regions; Based on the universal anti-disturbance and the modulation interference strategy, according to the unconstrained minimum optimization algorithm, the Adam optimizer is used to iteratively solve the two-dimensional phase modulation sequence; In the process of iteratively solving the two-dimensional phase modulation sequence, the algorithm formula of the unconstrained minimization optimization algorithm is: In the formula, s represents the two-dimensional phase modulation sequence, υ represents the universal adversarial disturbance, and F(s) is the two-dimensional phase modulation result after being processed by the RDA algorithm. represents the loss function; The loss function is the SmoothL1 loss function, and the loss function is: Based on the two-dimensional phase modulation sequence and in accordance with the modulation interference strategy, a universal generated disturbance for interfering with the recognition effect is obtained, and an adversarial sample of the SAR image target recognition model is obtained by adding the universal generated disturbance to the SAR image data set.

2. The method for rapidly generating adversarial samples based on a SAR target recognition network according to claim 1, characterized in that: In the process of building a SAR image target recognition model based on deep learning, the general target recognition model includes at least a LeNet model, a VGGNet16 model, a ResNet18 model, and a ResNet50 model.

3. The method for rapidly generating adversarial samples based on a SAR target recognition network according to claim 2, characterized in that: In the process of obtaining the universal adversarial disturbance, the step of obtaining the universal adversarial disturbance includes: S101. Collect the expected fooling rate and the maximum perturbation value of the SAR image target recognition model, and obtain the general adversarial perturbation by inputting the SAR image data set and according to the adversarial perturbation generation algorithm; S102. Determine whether the SAR adversarial sample obtained by superimposing the universal adversarial perturbation obtained in step 101 on the original image can meet the expected fooling rate; if so, end; if not, execute step 101.

4. The method for rapidly generating adversarial samples based on a SAR target recognition network according to claim 3, characterized in that: In the process of obtaining the universal adversarial perturbation of the SAR image target recognition model, the algorithm expression of the adversarial perturbation generation algorithm is: f(x+υ)≠f(x),for most x~μ In the formula, the input sample x satisfies the distribution μ, υ represents the universal adversarial perturbation, and f(x) represents the expected output result of the target recognition model.

5. The method for rapidly generating adversarial samples based on a SAR target recognition network according to claim 4, characterized in that: In the process of adopting the adversarial perturbation generation algorithm, the adversarial perturbation generation algorithm also includes an algorithm constraint condition, and the general adversarial perturbation is obtained by selecting the adversarial perturbation generation algorithm that satisfies the algorithm constraint condition, wherein the algorithm constraint condition is: ||u|| p ≤ξ where ξ represents the maximum value of the universal adversarial perturbation υ and δ represents the expected fooling rate in the entire SAR image dataset.

6. The method for rapidly generating adversarial samples based on a SAR target recognition network according to claim 5, characterized in that: In the process of acquiring the modulation interference strategy, the two-dimensional phase interference modulation is performed according to the two-dimensional phase modulation interference mechanism of the SAR image, wherein the two-dimensional phase modulation interference mechanism of the SAR image is: s j (t,η)=s0(t,η)·p r (t)·p a (η) Where: t is the distance time, η is the azimuth time, s j (t,η) is the SAR image two-dimensional modulation interference imaging result, s0(t,η) is the SAR image original imaging result, p r (t) is the range phase modulation result, p a (η) is the azimuth phase modulation result.

7. The method for rapidly generating adversarial samples based on a SAR target recognition network according to claim 6, characterized in that: During the two-dimensional phase interference modulation, the original imaging result of the SAR image is: Among them, σ0 represents the scattering intensity of the target, f0 is the carrier frequency, K r is the linear modulation frequency, and R(η) is the instantaneous slant distance.

8. The method for rapidly generating adversarial samples based on a SAR target recognition network according to claim 1, characterized in that: The process of iteratively solving the two-dimensional phase modulation sequence includes the following steps: Step a: obtaining the number and position of the regions used for two-dimensional phase modulation in the two-dimensional interference samples of the SAR image, randomly selecting a disordered sequence as an initial two-dimensional phase modulation sequence, and obtaining an initial SAR image two-dimensional phase modulation interference sample; Step b: setting a threshold for stopping optimization update of the unconstrained minimization optimization algorithm; Step c: Based on the universal adversarial perturbation and the initial SAR image two-dimensional phase modulation interference sample, according to the unconstrained minimization optimization algorithm, using the Adam optimizer, optimizing and searching for the best two-dimensional phase modulation sequence, and updating the loss value; Step d: Compare the loss value obtained in step c with the threshold set in step b. If the loss value is ≤ the threshold, execute step c; if the loss value is > the threshold, stop updating and save the current two-dimensional phase modulation sequence result.

9. The method for rapidly generating adversarial samples based on a SAR target recognition network according to claim 1, characterized in that: An adversarial sample rapid generation system for implementing the adversarial sample rapid generation method includes: A data acquisition module, used to collect SAR image data sets for model training; A universal adversarial perturbation acquisition module is used to construct a deep learning-based SAR image target recognition model according to a universal target recognition model, and to acquire a universal adversarial perturbation of the SAR image target recognition model by adopting an adversarial perturbation generation algorithm, wherein the universal target recognition model is used to represent a commonly used SAR image recognition model; An interference strategy formulation module, used to collect radar parameters for SAR imaging and perform two-dimensional phase interference modulation to obtain a modulation interference strategy for interfering with the recognition effect of the SAR image target recognition model, wherein the modulation interference strategy is used to indicate the number and position of phase modulation areas; An interference modulation module, used for iteratively solving a two-dimensional phase modulation sequence based on the universal anti-disturbance and the modulation interference strategy and using an Adam optimizer according to an unconstrained minimum optimization algorithm; The adversarial sample generation module is used to obtain a universal generated disturbance for interfering with the recognition effect based on the two-dimensional phase modulation sequence and according to the modulation interference strategy, and obtain an adversarial sample of the SAR image target recognition model by adding the universal generated disturbance to the SAR image data set.

Images