SAR image adversarial sample detection system and method based on optimal feature attribution selection

Abstract

The application discloses a synthetic aperture radar image adversarial sample detection system and method based on multi-target optimal feature attribution selection. Historical SAR images are collected from a SAR system monitoring database, and after data standardization and normalization, the historical SAR images are used as input data sets. The number of sub-samples generated by a feature analysis process based on sliding scanning and the area under the receiver operating characteristic curve of a logistic regression model are used as optimization targets. A feature scanning block parameter optimization platform based on a multi-target optimization method is designed to obtain optimal feature attribution scanning blocks and an optimal regression model. The optimal regression model is used for online detection of real-time SAR image data in a real-time database of a SAR system. The application can automatically obtain the best feature analysis granularity according to different scenes, efficiently realize various adversarial sample detections in the SAR image recognition field, and improve the calculation efficiency and AUC performance index of the SAR image adversarial detection.

Description

Technical Field

[0001] This invention relates to adversarial example detection technology in the field of synthetic aperture radar image recognition security, and particularly to an adversarial example detection system and method based on multi-target optimal feature attribution selection. Background Technology

[0002] Synthetic Aperture Radar (SAR), as an active remote sensing system, can acquire high-resolution images of target areas at any time, unaffected by weather factors such as clouds, fog, and lighting conditions. Compared to traditional passive sensors like optical and infrared sensors, which are susceptible to weather conditions, SAR provides an effective solution for target detection tasks and is widely used in fields such as mountain monitoring and maritime management. In recent years, the development of deep learning technology has further improved the accuracy of SAR recognition systems and promoted their deployment and adoption. However, it has also exposed SAR systems to the threat of deep learning security issues. Among many security problems, adversarial attacks that cause model misclassification severely impact the robustness of SAR recognition models and reduce their recognition performance. In critical mission scenarios such as military surveillance, a single misclassification can have unacceptable consequences. This necessitates that modern SAR systems incorporate corresponding defensive designs against potential adversarial attacks.

[0003] Adversarial example detection (AEP) is a defense method against adversarial examples that does not affect the structure and parameters of the recognition model. Faced with adversarial example images that are visually indistinguishable from normal images, AEP can detect the differences between normal and adversarial examples and issue early warnings. Because it does not affect model accuracy, AEP is well-suited for SAR recognition systems that require stable model performance. However, the characteristics of SAR images make AEP extremely difficult. For example, SAR images are riddled with speckle noise that is difficult to remove. This noise mixes with the noise from adversarial examples, misleading the model into making incorrect classifications. Existing traditional AEP methods based on kernel density estimation, Bayesian estimation, and intrinsic dimensionality struggle to obtain features that effectively distinguish adversarial examples within the model. Furthermore, SAR images have higher resolution than traditional images, resulting in an extremely large number of intermediate features within the model. Existing analysis methods based on intermediate features used in traditional image processing struggle to handle these numerous features. Moreover, targets in different application scenarios have different latent features, making it difficult for existing analysis methods to automatically adjust to the task objectives. Therefore, there is an urgent need to develop a detection technology that can automatically adjust according to the scene, process high-resolution SAR images, and effectively distinguish adversarial sample features. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by providing a SAR image adversarial sample detection system and method based on multi-target optimal feature attribution selection.

[0005] The objective of this invention is achieved through the following technical solution: a SAR image adversarial example detection system based on multi-target optimal feature attribution selection includes a SAR image adversarial example detection data preprocessing module, a SAR image adversarial example detection offline optimal feature attribution selection training module, and a SAR image adversarial example detection online detection module;

[0006] The SAR image adversarial example detection data preprocessing module collects real-time image data from the target SAR system's real-time database during the monitoring process. After image data normalization and standardization, it obtains an online detection dataset, which is then transmitted to the SAR image adversarial example detection online detection module. The SAR image adversarial example detection data preprocessing module also collects historical image data from the target SAR system's historical database. After image data normalization and standardization, it obtains standard historical image data, generates adversarial example image data corresponding to the standard historical image data, and merges the standard historical image data and the adversarial example image data to obtain an offline training dataset. This offline training dataset is then transmitted to the SAR image adversarial example detection offline optimal feature attribution selection training module.

[0007] The SAR image adversarial example detection offline optimal feature attribution selection training module first encodes the size, stride, padding (whether to perform padding operation when scanning image edges), and number of hidden layers (Layers) of the feature attribution scan block into integers, randomly generating an initial population. Then, the sliding scan submodule performs a sliding scan on the SAR image data in the offline training dataset using feature attribution scan blocks corresponding to different individual codes. The hidden feature extraction submodule extracts features, and the feature expression calculation submodule calculates the feature expression set corresponding to the offline training dataset. The regression model training submodule uses the obtained feature expression set of the offline training dataset as training data for logistic regression training, thereby obtaining a logistic regression model for identifying adversarial examples. The number of subsamples generated during the feature analysis process and the area under the receiver operating characteristic curve (AUC) of the regression model are statistically analyzed as the fitness index of the individual fitness function evaluation submodule. The individuals in the initial population are sorted using the fast non-dominated sorting and fitness comprehensive evaluation submodule to obtain Pareto front individuals, and the optimal individual is selected from the Pareto front individuals. The offspring population is generated through selection, crossover, and mutation. The parent and offspring populations are merged to generate a new population. The new population is then subjected to rapid non-dominated sorting and crowding distance calculation. The next generation population is generated based on the population size. The above evolutionary process is repeated until the maximum evolutionary round is reached, thereby obtaining individuals with Pareto optimality. The optimal feature attribution scan block and optimal regression model corresponding to the optimal individual are transmitted to the SAR image adversarial example detection online detection module.

[0008] The SAR image adversarial example detection online detection module uses an optimal feature attribution scan block to perform a sliding scan on the SAR image data in the online detection dataset through a sliding scan submodule, extracts features through a latent feature extraction submodule, and calculates the feature representation set of the online detection dataset through a feature representation calculation submodule. Then, it uses the obtained optimal regression model as the adversarial example detection model to determine whether the feature representations in the online detection dataset belong to the feature representations of adversarial examples. If a feature representation is detected to belong to the feature representations of adversarial examples, a warning message is issued; otherwise, the sample is considered a normal sample.

[0009] The SAR image adversarial example detection method based on multi-target optimal feature attribution selection includes the following steps:

[0010] (1) The SAR image adversarial sample detection data preprocessing module obtains historical SAR image data stored during the monitoring process from the SAR system as the raw dataset and marks it as O; performs image data normalization operation on O to obtain normalized dataset X, and then performs image data normalization operation through formula (1) to obtain offline standard dataset X. o ;

[0011]

[0012] The SAR image data normalization module consists of segmentation, scaling, and dimensionality reduction operations. The segmentation operation divides the original image into regions. When the input SAR historical monitoring image is a single image of a monitoring area containing multiple identified targets, the image needs to be segmented according to the identified targets so that the segmented SAR image contains only a single identified target. If the input SAR historical image data has already been segmented, and each SAR historical image contains only a single identified target, then no further segmentation is needed. The scaling operation adjusts the size of each SAR image in the dataset to ensure that its size parameters are consistent with the parameters of the target model. The dimensionality reduction operation performs single-channel processing on the SAR images in the dataset. If the input SAR historical image data is already a single-channel image, then no further dimensionality reduction is needed.

[0013] Offline standard dataset X o The data is transmitted to an adversarial example generation platform for adversarial example generation, which uses five adversarial example generation methods to generate X. o Adversarial example dataset X under the target model adv These five adversarial example generation methods include: the Fast Gradient Sign Method (FGSM) attack based on fast gradient signs, the Project Gradient Descent (PGD) attack based on gradient iteration, the Carlini & Wagner (CW) attack based on optimization, the Deepfool attack based on boundary decision, and the Noise attack based on random noise; X o With X adv The data was split in a 4:1 ratio to obtain a clean training set X. o_train Training set X containing adversarial examples adv_train Validation set X of clean data o_val The validation set X containing adversarial examples adv_val ;

[0014] (2) Set the relevant parameter values ​​in the offline optimal feature attribution selection training module. The parameter values ​​include the population size N and the maximum size of the feature attribution scan block Size. maxMinimum Size min Maximum step size Stride max Minimum step size Stride min Maximum number of feature layers L, training epochs EP train Crossover rate β, mutation rate σ, maximum number of evolutionary rounds E max ;

[0015] (3) Encode the set of parameters Size, Stride, Padding, and Layers in a feature attribution scan block into integers, and use them as an individual in the multi-objective evolution strategy. Initialize N individuals as the initial population Q, where the encoding form of each individual is Indi = [Size, Stride, Padding, Layers], where Indi represents any individual in the population, where Size represents the size of the feature attribution scan block, Stride represents the scanning interval of the feature attribution scan block, Padding represents the marker of whether the feature attribution scan block performs an expansion operation when scanning the image edge, and Layers represents the number of hidden layers of the model used for feature analysis. The specific implementation process of initializing Size, Stride, Padding, and Layers is shown in formulas (2) to (5):

[0016] Size = Ranint(Size) min Size max ) (18)

[0018] Stride = Ranint(Stride) min Stride max (19)

[0019] Padding = Randint(0,1) (20)

[0020] Layers = Randint(1,L) (21)

[0021] Here, `Randint(a,b)` represents a randomly generated integer between `a` and `b`, with the value range including both `a` and `b` themselves. When `Padding` = 0, the feature scanning process does not perform edge augmentation; when `Padding` = 1, the feature scanning process performs edge augmentation. X... o The length and width of the SAR image are labeled as h and w, respectively. Usually, h = w. The number of row scans of the feature attribution scan block is labeled as m. The calculation process of m is shown in formula (6). The width of the edge pixels not covered by the row scan process is labeled as k. The calculation process of k is shown in formula (7).

[0022]

[0023] k = (h - Size) - m × Stride (23)

[0024] in This indicates a rounding down operation. When Padding = 0 and k ≠ 0, it means that the current Size and Stride parameter values ​​cannot scan the function edges, and some edge pixels of the SAR image will not participate in the subsequent feature extraction process. When Padding = 1 and k ≠ 0, the SAR image will be edge-padded before feature attribution analysis, and the value of the filled pixel will be fixed at 0, so that all pixels in the SAR image will participate in the subsequent feature attribution analysis process.

[0025] The hidden feature extraction operation extracts the output features of the hidden layers sequentially, starting from the last hidden layer of the target model, based on the value of Layers, until the number of hidden layers extracted is equal to the value of Layers.

[0026] (4) Label the current evolutionary round of the multi-objective optimization technique as E, and set E = 0;

[0027] (5) The fitness function of the initial population Q is evaluated. That is, the SAR image adversarial example detection offline optimal feature attribution selection training module first calculates the dataset X according to the feature attribution scan block corresponding to the individual in Q. o_train X adv_train X o_val X adv_val The feature representation; then, using the training set X o_train X adv_train The feature representation set is used for logistic regression training, with a training epoch of EP. train The validation set X is used during training. o_val X adv_val The feature set is used to validate the obtained regression model, calculate the AUC value of the regression model, and evaluate the number of subsamples generated during the feature analysis process.

[0028] The specific calculation process for the feature attribution representation of a single dataset is as follows:

[0029] (5.1) Let i = 0, and label the maximum number of images in this dataset as i. max ;

[0030] (5.2) Set the subsample image set F subFor an empty set, the i-th image x in the dataset is selected as the image for this feature analysis. A sliding scan of this image is performed using a feature attribution scan block. The scan operation starts at position (0,0) in the pixel matrix of image x, and a square region of size Size in the pixel matrix of image x is selected according to the Size parameter for subsample generation. The subsample generation operation clones a new image with the same pixel values ​​as the original x, then sets the pixel values ​​of the scanned region of the new image to 0, and then adds this image to the subsample image set F. sub In the process of subsample generation, after completing one subsample generation operation, the feature attribution scan block slides row by row according to the Stride parameter, performing a subsample generation operation with each slide scan. This process is repeated until the next scan of the scan block exceeds the width of the pixel matrix. Then, the scan block is moved to the next row scan position in the x-image pixel matrix according to the Stride parameter, and the row-by-row sliding scan begins again. This process is repeated until the feature attribution scan block has completed all row-by-row scan operations in the x-matrix pixels. Finally, the original image x is also added to the subsample image set F. sub In the sliding scan operation, the starting position of the p-th scan in the l-th row can be denoted as (l×Stride, p×Stride), and the coordinates of the four points of the corresponding square scan area are: (l×Stride, p×Stride), (l×Stride, p×Stride+Size), (l×Stride+Size, p×Stride), (l×Stride+Size, p×Stride+Size).

[0031] (5.3) The subset F of this image sub Input the target model, select the corresponding hidden layer according to the given Layers parameters, and obtain the output of the corresponding hidden layer in the model for each image in the subsample set; perform average pooling on the output of the hidden layer to obtain the subsample set F. sub The corresponding set of latent features;

[0032] (5.4) Subtract the latent features corresponding to the original image x from the latent features corresponding to the subsample images other than the original image x in the latent feature set to obtain the image feature change matrix that can characterize the influence of image pixel changes;

[0033] (5.5) Perform interquartile range (IQR) statistics on the image feature change matrix to obtain the feature expression vector that can characterize the image;

[0034] (5.6) Let i=i+1;

[0035] (5.7) Repeat steps (5.2) to (5.6) until i = imax ;

[0036] (5.8) Merge all the feature representation vectors obtained in step (5.7) to obtain the feature representation set corresponding to the dataset.

[0037] The specific implementation process for AUC value evaluation is as follows:

[0038] Let the verification set X be... o_val The sample size in the dataset is R, labeled as positive samples; the validation set is X. adv_val The sample size in the regression model is T, and the samples are labeled as negative samples. The predicted scores of the validation set samples in the regression model are denoted as P, where P is the negative sample. 正样本 P represents the prediction score of the regression model for a single positive sample. 负样本 I(P) represents the prediction score of the regression model for a single negative sample; denoted as I(P) 正样本 ,P 负样本 ) represents the sample prediction evaluation value for a positive-negative sample pair; when P 正样本 >P 负样本 At that time, I(P) 正样本 ,P 负样本 ) = 1; when P 正样本 =P 负样本 At that time, I(P) 正样本 ,P 负样本 ) = 0.5; when P 正样本 <P 负样本 At that time, I(P) 正样本 ,P 负样本 =0; Calculate the sample prediction evaluation value for all positive and negative sample pairs, and calculate the AUC value of the regression model for the validation set sample according to formula (8):

[0039]

[0040] The specific implementation process for calculating the number of subsamples generated by the feature analysis process is as follows: using the feature attribution scan block parameters Size, Stride, and Padding corresponding to the individual, calculate k and m corresponding to the current individual through formulas (6) and (7); when Padding = 0, the number of subsamples corresponding to the individual is m × m + 1; when Padding = 1, if k = 0, the number of subsamples corresponding to the individual is m × m + 1; when Padding = 1, if k ≠ 0, the number of subsamples corresponding to the individual is (m + 1) × (m + 1) + 1.

[0041] (6) Perform fast non-dominated ordination and fitness comprehensive evaluation on individuals in population Q. Fast non-dominated ordination finds the Pareto front of population Q by measuring the individual's performance on two evaluation metrics: AUC value and subsample size. Fitness comprehensive evaluation selects the optimal individual in population Q by combining the two evaluation metrics from the set of individuals at the Pareto front. In specific operations, the negative value of the individual's AUC value and the subsample size are used as the optimization objective functions, labeled as f1 and f2 respectively; let n i S is the number of individuals in the population that dominate the i-th individual. i Let be the set of individuals dominated by the i-th individual. One individual dominating another means that, for both the AUC value and the subsample size, the dominant individual outperforms the dominated individual; that is, the model AUC value is higher than that of the dominated individual, and the subsample size is smaller than that of the dominated individual. A fast non-dominated ranking is used to obtain the set of dominant individuals, and the optimal individual is selected by combining this with a fitness-based comprehensive evaluation. The specific implementation process is as follows:

[0042] (6.1) Iterate through all individuals in the current population Q and calculate n for each individual. i Value and the individual controlled by that individual

[0043] Volume set S i ;

[0044] (6.2) All n i Individuals with a value of 0 are stored in set F1;

[0045] (6.3) Let j = 1;

[0046] (6.4) Let H be an empty set;

[0047] (6.5) Traversing F j Let S be any of the individuals. u For F j The set of individuals controlled by the u-th individual, n q To dominate S u The number of individuals of the q-th individual; obtain F j S corresponding to each individual u ;

[0048] (6.6) For all S u Iterate through each S u For all individuals, calculate the n corresponding to each individual. q Value, and let n q =n q -1;

[0049] (6.7) If n q =0, then S u The q-th individual is placed into set H;

[0050] (6.8) Let j = j + 1;

[0051] (6.9) Let F j =H;

[0052] (6.10) Repeat steps (6.4) to (6.9) until F is obtained. j It is an empty set;

[0053] (6.11) All individuals in F1 are dominant individuals. These individuals are considered the Pareto front of population Q. The optimal individual is selected by combining two evaluation indicators. The specific selection process is as follows: If F1 contains only one individual, that individual is selected as the optimal individual Indi in this evaluation. best If F1 contains two individuals, the individual with the higher AUC value is selected as the optimal individual in this evaluation. best When F1 contains 3 or more individuals, the fitness comprehensive evaluation value f of the i-th individual is calculated according to formula (9). i all f1 i f1 represents the objective value of the i-th individual, and f2 represents the objective value of the i-th individual. i Let f represent the f² optimization objective value for the i-th individual. Choose f... i all The smallest individual is considered the optimal individual, Indi. best When multiple individuals simultaneously possess the smallest f i all When selecting an individual with a higher AUC value, choose the individual with the best AUC value as the optimal individual in the model. best ;

[0054]

[0055] (7) For each individual in population Q, a binary bidding selection method is used, i.e., pairwise comparison. Each comparison selects the individual with smaller f according to the optimal individual evaluation method in step (6). i all Individuals with a value of Q enter the parent population. p ;

[0056] (8) For population Q p For each individual in the population, a simulated binary crossover method is used for crossover. The resulting population is labeled Q. x The specific implementation process is as follows:

[0057] (8.1) For the current individual, generate a uniformly distributed random number β1 in the range of 0 to 1. When β1≤β, the current individual and another random individual are used as the parent for subsequent operations. When β1>β, no operation is performed.

[0058] (8.2) Generate a uniformly distributed random number g1 in the range of 0 to 1, and denote k1 as the same encoding position of the two individuals in the crossover operation;

[0059] (8.3) Calculate the cross-intermediate variable β according to formula (10). g1 ;

[0060]

[0061] (8.4) Calculate the parental influence factor β according to formula (11). k1 ;

[0062]

[0063] (8.5) For two individuals Indi1 and Indi2, let Indi be the two offspring individuals generated by the crossover operation. c1 and Indi c2 Indi c1 The value of the k1th position on is calculated by formula (12), Indi c2 The value of the k1th position is calculated according to formula (13). Where Indi c1 (k1) is Indi c1 The value at the k1-th position on Indi1, Indi1(k1) is the value at the k1-th position on Indi1, and so on;

[0064]

[0065]

[0066] (8.6) Indi c1 and Indi c2 Non-integer values ​​are rounded to the nearest integer.

[0067] (8.7) Repeat steps (8.1) to (8.6) until Q. p Each individual in the population underwent a crossover operation. All the resulting crossover offspring were then added to population Q. x middle;

[0068] (9) For population Q x For each individual in the population, a polynomial mutation method is used to perform the mutation operation, and the mutated population is labeled as Q. m The specific implementation process is as follows:

[0069] (9.1) For the current individual, generate a uniformly distributed random number σ1 in the range of 0 to 1. When σ1≤σ, perform subsequent operations on the individual; when σ1>σ, do not perform any operations.

[0070] (9.2) Generate a uniformly distributed random number g2 in the range of 0 to 1, and denote k2 as the encoding position of the individual in the mutation operation;

[0071] (9.3) Calculate the intermediate variable β according to formula (14). g2 ;

[0072]

[0073] (9.4) Let Indi(k2) be the upper bound of the value of the k2 position of individual Indi. up The lower bound of the value at position k2 of individual Indi is Indi(k2). low Let Indi be the offspring generated by the mutation operation. mut Indi mut The value of the k2th position is calculated by formula (15);

[0074] Indi mut (k2)=Indi(k2)+(Indi(k2) up -Indi(k2) low )×β g2 (31)

[0075] (9.5) Indi mut Non-integer values ​​are rounded to the nearest integer.

[0076] (9.6) Repeat steps (9.1) to (9.5) until Q. x Each individual in the population underwent a mutation operation. All the mutated offspring were then added to the population Q. m middle;

[0077] (10) Population Q p With subpopulation Q x subpopulation Q m Merge into a new population Q n ;

[0078] (11) Regarding the new population Q n An elite strategy is implemented to select and generate the next generation of the population. Q n This includes the set Q of individuals selected from the previous generation through a binary bidding process. p This includes Indi, the best individual from the previous generation of the population. best The elite strategy selects the best individuals from the previous generation...best Together with the new offspring, fitness assessments and other operations are performed to generate the next generation population. Let the next generation population be denoted as Q. p+1 The specific process of its elite selection strategy is as follows:

[0079] (11.1) The new population Q was evaluated according to the methods in steps (5) and (6). n Perform a fast non-dominated sort operation on all individuals to obtain Q. n All non-dominated sets F j .

[0080] (11.2) Let Q p+1 It is an empty set, j = 1;

[0081] (11.3) Calculate F j The crowding distance of all individuals in the group. Let d be the distance between them. i For F j The crowding distance of the i-th individual is calculated using f1 and f2 respectively against F. j The individuals in the data are sorted, and the two individuals with the largest f1 value and the largest f2 value are taken as boundary individuals. The crowding degree d corresponding to the boundary individuals is... i It is considered to be infinite. Except for boundary individuals, the crowding distance of other individuals is calculated according to formula (16). Where f z i+1 F represents j f of the (i+1)th individual z Target fitness value, f z i-1 F represents j f of the (i-1)th individual z Target fitness value;

[0082]

[0083] (11.4) Note | Q p+1 |For Q p+1 The number of individuals in the middle, |F j |For F j The number of individuals in the group. When |Q p+1 |+|F j When |≤N, F j Put all individuals into Q p+1 In the middle. When |Q p+1 |+|F j When |>N, F j Individuals are sorted from largest to smallest based on their crowding distance, and the sorted F... j Choose N-|Q in sequence p+1 | Individuals are placed in Q p+1 middle;

[0084] (11.5) Let j = j + 1;

[0085] (11.6) Repeat steps (11.1) to (11.5) until |Q p+1 |=N;

[0086] (12) Let Q = Q p+1 E = E + 1;

[0087] (13) Repeat steps (5) to (12) until E = E max ;

[0088] (14) For the passage through E max The population Q undergoes rapid non-dominated ranking and fitness comprehensive evaluation in steps (5) and (6) to obtain the optimal individual Indi. best The optimal individual Indi best The corresponding feature attribution scanning block and logistic regression model are passed to the SAR image adversarial example detection online detection module;

[0089] (15) The SAR image adversarial sample detection data preprocessing module collects real-time image data from the target SAR system during the monitoring process, and obtains the online detection dataset X after data normalization and data standardization processing. t The online detection dataset X t Transmitted to the online detection module;

[0090] (16) The SAR image adversarial example detection online detection module uses the obtained optimal feature attribution scanning block to calculate the online detection dataset X according to the feature attribution expression calculation method in step (5). t The feature representation; then use the obtained optimal regression model to determine X. t The system determines whether a sample's feature representation belongs to the adversarial sample and issues an alert for any discovered adversarial sample feature representation; otherwise, the sample is considered a normal sample.

[0091] The beneficial effects of this invention are: the technology of this invention can automatically obtain the optimal feature analysis granularity according to different scenarios, and efficiently realize the detection of various adversarial examples in the field of SAR image recognition; compared with the prior art, the technology of this invention also improves the computational efficiency and AUC performance index of SAR image adversarial detection. Attached Figure Description

[0092] Figure 1 This is a schematic diagram illustrating the principle of a SAR image adversarial example detection system and method based on multi-target optimal feature attribution selection;

[0093] Figure 2This is an example image of the encoding of a randomly generated single individual. The encoding information of this individual is [34,15,1,2], that is, the size of the feature attribution scan block corresponding to this individual is 34 pixels (Size=34), the scan interval is 15 pixels (Stride=15), padding is performed when scanning the image edges (Padding=1), and the number of hidden layers of the model used when performing feature analysis using this feature attribution scan block is 2 (Layers=2);

[0094] Figure 3 This is an example diagram of the cross operation during the feature scan block parameter optimization process;

[0095] Figure 4 This is an example diagram of the mutation operation during the feature scan block parameter optimization process;

[0096] Figure 5 It is the final Pareto front obtained through multi-objective optimization techniques;

[0097] Figure 6 This paper compares the AUC performance of the present invention and existing adversarial example detection techniques on the FUSAR-Ship dataset across five types of adversarial attack samples. KDBU represents the adversarial example detection technique based on kernel density and Bayesian estimation, LID represents the adversarial example detection technique based on intrinsic dimension, and MAHA represents the adversarial example detection technique based on Mahalanobis distance score.

[0098] Figure 7 This invention compares the number of subsamples between this invention and adversarial example detection techniques based on Leave One Out (LOO). Compared to the three existing adversarial example detection techniques, the LOO-based technique sacrifices operational efficiency to achieve better detection results. In its implementation, this technique successively modifies individual pixels in the input sample to generate subsamples, analyzes the obtained subsample set, and calculates the corresponding feature representation of the sample. When the size of the input sample is large, the implementation time of this technique will increase significantly. Detailed Implementation

[0099] The present invention will be further described below with reference to the accompanying drawings, and the purpose and effects of the present invention will become more apparent.

[0100] Using the FUSAR-Ship image dataset as an example of adversarial example detection in synthetic aperture radar images, Figure 1A schematic diagram of the principle of a SAR image adversarial example detection system and method based on multi-target optimal feature attribution selection is presented. The SAR image adversarial example detection system based on multi-target optimal feature attribution selection includes a SAR image adversarial example detection data preprocessing module, a SAR image adversarial example detection offline optimal feature attribution selection training module, and a SAR image adversarial example detection online detection module;

[0101] The SAR image adversarial example detection data preprocessing module collects real-time image data from the target SAR system's real-time database during the monitoring process. After image data normalization and standardization, it obtains an online detection dataset, which is then transmitted to the SAR image adversarial example detection online detection module. The SAR image adversarial example detection data preprocessing module also collects historical image data from the target SAR system's historical database. After image data normalization and standardization, it obtains standard historical image data, generates adversarial example image data corresponding to the standard historical image data, and merges the standard historical image data and the adversarial example image data to obtain an offline training dataset. This offline training dataset is then transmitted to the SAR image adversarial example detection offline optimal feature attribution selection training module.

[0102] The SAR image adversarial example detection offline optimal feature attribution selection training module first encodes the size, stride, padding (whether to perform padding operation when scanning image edges), and number of hidden layers (Layers) of the feature attribution scan block into integers, randomly generating an initial population. Then, the sliding scan submodule performs a sliding scan on the SAR image data in the offline training dataset using feature attribution scan blocks corresponding to different individual codes. The hidden feature extraction submodule extracts features, and the feature expression calculation submodule calculates the feature expression set corresponding to the offline training dataset. The regression model training submodule uses the obtained feature expression set of the offline training dataset as training data for logistic regression training, thereby obtaining a logistic regression model for identifying adversarial examples. The number of subsamples generated during the feature analysis process and the area under the receiver operating characteristic curve (AUC) of the regression model are statistically analyzed as the fitness index of the individual fitness function evaluation submodule. The individuals in the initial population are sorted using the fast non-dominated sorting and fitness comprehensive evaluation submodule to obtain Pareto front individuals, and the optimal individual is selected from the Pareto front individuals. The offspring population is generated through selection, crossover, and mutation. The parent and offspring populations are merged to generate a new population. The new population is then subjected to rapid non-dominated sorting and crowding distance calculation. The next generation population is generated based on the population size. The above evolutionary process is repeated until the maximum evolutionary round is reached, thereby obtaining individuals with Pareto optimality. The optimal feature attribution scan block and optimal regression model corresponding to the optimal individual are transmitted to the SAR image adversarial example detection online detection module.

[0103] The SAR image adversarial example detection online detection module uses an optimal feature attribution scan block to perform a sliding scan on the SAR image data in the online detection dataset through a sliding scan submodule, extracts features through a latent feature extraction submodule, and calculates the feature representation set of the online detection dataset through a feature representation calculation submodule. Then, it uses the obtained optimal regression model as the adversarial example detection model to determine whether the feature representations in the online detection dataset belong to the feature representations of adversarial examples. If a feature representation is detected to belong to the feature representations of adversarial examples, a warning message is issued; otherwise, the sample is considered a normal sample.

[0104] The SAR image adversarial example detection method based on multi-target optimal feature attribution selection includes the following steps:

[0105] (1) The SAR image adversarial sample detection data preprocessing module obtains historical SAR image data stored during the monitoring process from the SAR system as the raw dataset and marks it as O; performs image data normalization operation on O to obtain normalized dataset X, and then performs image data normalization operation through formula (1) to obtain offline standard dataset X. o ;

[0106]

[0107] The SAR image data normalization module consists of segmentation, scaling, and dimensionality reduction operations. The segmentation operation divides the original image into regions. When the input SAR historical monitoring image is a single image of a monitoring area containing multiple identified targets, the image needs to be segmented according to the identified targets so that the segmented SAR image contains only a single identified target. If the input SAR historical image data has already been segmented, and each SAR historical image contains only a single identified target, then no further segmentation is needed. The scaling operation adjusts the size of each SAR image in the dataset to ensure that its size parameters are consistent with the parameters of the target model. The dimensionality reduction operation performs single-channel processing on the SAR images in the dataset. If the input SAR historical image data is already a single-channel image, then no further dimensionality reduction is needed.

[0108] Offline standard dataset X o The data is transmitted to an adversarial example generation platform for adversarial example generation, which uses five adversarial example generation methods to generate X. o Adversarial example dataset X under the target model adv These five adversarial example generation methods include: the Fast Gradient Sign Method (FGSM) attack based on fast gradient signs, the Project Gradient Descent (PGD) attack based on gradient iteration, the Carlini & Wagner (CW) attack based on optimization, the Deepfool attack based on boundary decision, and the Noise attack based on random noise; X o With X adv The data was split in a 4:1 ratio to obtain a clean training set X. o_train Training set X containing adversarial examples adv_train Validation set X of clean data o_val The validation set X containing adversarial examples adv_val ;

[0109] (2) Set the relevant parameter values ​​in the offline optimal feature attribution selection training module. The parameter values ​​include the population size N=20 and the maximum size of the feature attribution scan block Size. max=64, minimum size min =8, maximum step size Stride max =64, minimum step size Stride min =8, maximum number of feature layers L=3, training epochs EP train =100, crossover rate β = 1.0, mutation rate σ = 0.5, maximum evolutionary cycle E max =20;

[0110] (3) Encode the set of parameters Size, Stride, Padding, and Layers in a feature attribution scan block into integers, and use them as an individual in the multi-objective evolution strategy. Initialize N individuals as the initial population Q, where the encoding form of each individual is Indi = [Size, Stride, Padding, Layers], where Indi represents any individual in the population, where Size represents the size of the feature attribution scan block, Stride represents the scanning interval of the feature attribution scan block, Padding represents the marker of whether the feature attribution scan block performs an expansion operation when scanning the image edge, and Layers represents the number of hidden layers of the model used for feature analysis. The specific implementation process of initializing Size, Stride, Padding, and Layers is shown in formulas (2) to (5):

[0111] Size = Ranint(Size) min Size max ) (34)

[0113] Stride = Ranint(Stride) min Stride max (35)

[0114] Padding = Randint(0,1) (36)

[0115] Layers = Randint(1,L) (37)

[0116] Here, `Randint(a,b)` represents a randomly generated integer between `a` and `b`, with the value range including both `a` and `b` themselves. When `Padding` = 0, the feature scanning process does not perform edge augmentation; when `Padding` = 1, the feature scanning process performs edge augmentation. X... oThe length and width of the SAR image are labeled as h and w, respectively. Usually, h = w. The number of row scans of the feature attribution scan block is labeled as m. The calculation process of m is shown in formula (6). The width of the edge pixels not covered by the row scan process is labeled as k. The calculation process of k is shown in formula (7).

[0117]

[0118] k = (h - Size) - m × Stride (39)

[0119] in This indicates a rounding down operation. When Padding = 0 and k ≠ 0, it means that the current Size and Stride parameter values ​​cannot scan the function edges, and some edge pixels of the SAR image will not participate in the subsequent feature extraction process. When Padding = 1 and k ≠ 0, the SAR image will be edge-padded before feature attribution analysis, and the value of the filled pixel will be fixed at 0, so that all pixels in the SAR image will participate in the subsequent feature attribution analysis process.

[0120] The hidden feature extraction operation extracts output features from the hidden layers sequentially, starting from the last hidden layer of the target model, based on the Layers value, until the number of extracted hidden layers equals the Layers value. Figure 2 An example encoding of one of the initial individuals is given, whose encoding information is [34,15,1,2].

[0121] (4) Label the current evolutionary round of the multi-objective optimization technique as E, and set E = 0;

[0122] (5) The fitness function of the initial population Q is evaluated. That is, the SAR image adversarial example detection offline optimal feature attribution selection training module first calculates the dataset X according to the feature attribution scan block corresponding to the individual in Q. o_train X adv_train X o_val X adv_val The feature representation; then, using the training set X o_train X adv_train The feature representation set is used for logistic regression training, with a training epoch of EP. train The validation set X is used during training. o_val X adv_val The feature set is used to validate the obtained regression model, calculate the AUC value of the regression model, and evaluate the number of subsamples generated during the feature analysis process.

[0123] The specific calculation process for the feature attribution representation of a single dataset is as follows:

[0124] (5.1) Let i = 0, and label the maximum number of images in this dataset as i. max ;

[0125] (5.2) Set the subsample image set F sub For an empty set, the i-th image x in the dataset is selected as the image for this feature analysis. A sliding scan of this image is performed using a feature attribution scan block. The scan operation starts at position (0,0) in the pixel matrix of image x, and a square region of size Size in the pixel matrix of image x is selected according to the Size parameter for subsample generation. The subsample generation operation clones a new image with the same pixel values ​​as the original x, then sets the pixel values ​​of the scanned region of the new image to 0, and then adds this image to the subsample image set F. sub In the process of subsample generation, after completing one subsample generation operation, the feature attribution scan block slides row by row according to the Stride parameter, performing a subsample generation operation with each slide scan. This process is repeated until the next scan of the scan block exceeds the width of the pixel matrix. Then, the scan block is moved to the next row scan position in the x-image pixel matrix according to the Stride parameter, and the row-by-row sliding scan begins again. This process is repeated until the feature attribution scan block has completed all row-by-row scan operations in the x-matrix pixels. Finally, the original image x is also added to the subsample image set F. sub In the sliding scan operation, the starting position of the p-th scan in the l-th row can be recorded as (l×Stride, p×Stride), and the coordinates of the four points of the corresponding square scan area are: (l×Stride, p×Stride), (l×Stride, p×Stride+Size), (l×Stride+Size, p×Stride), (l×Stride+Size, p×Stride+Size). Taking the individual [34, 15, 1, 2] as an example, if the image is slid scanned using the feature attribution scan block corresponding to this individual, the starting position of the p-th scan in the l-th row can be recorded as (15×l, 15×p), and the coordinates of the four points of the corresponding square scan area are: (15×l, 15×p), (15×l, 15×p+34), (15×l+34, 15×p), (15×l+34, 15×p+34).

[0126] (5.3) The subset F of this image sub Input the target model, select the corresponding hidden layer according to the given Layers parameters, and obtain the output of the corresponding hidden layer in the model for each image in the subsample set; perform average pooling on the output of the hidden layer to obtain the subsample set F. sub The corresponding set of latent features;

[0127] (5.4) Subtract the latent features corresponding to the original image x from the latent features corresponding to the subsample images other than the original image x in the latent feature set to obtain the image feature change matrix that can characterize the influence of image pixel changes;

[0128] (5.5) Perform interquartile range (IQR) statistics on the image feature change matrix to obtain the feature expression vector that can characterize the image;

[0129] (5.6) Let i=i+1;

[0130] (5.7) Repeat steps (5.2) to (5.6) until i = i max ;

[0131] (5.8) Merge all the feature representation vectors obtained in step (5.7) to obtain the feature representation set corresponding to the dataset.

[0132] The specific implementation process for AUC value evaluation is as follows:

[0133] Let the verification set X be... o_val The sample size in the dataset is R, labeled as positive samples; the validation set is X. adv_val The sample size in the regression model is T, and the samples are labeled as negative samples. The predicted scores of the validation set samples in the regression model are denoted as P, where P is the negative sample. 正样本 P represents the prediction score of the regression model for a single positive sample. 负样本 I(P) represents the prediction score of the regression model for a single negative sample; denoted as I(P) 正样本 ,P 负样本 ) represents the sample prediction evaluation value for a positive-negative sample pair; when P 正样本 >P 负样本 At that time, I(P) 正样本 ,P 负样本 ) = 1; when P 正样本 =P 负样本 At that time, I(P) 正样本 ,P 负样本 ) = 0.5; when P 正样本 <P 负样本 At that time, I(P) 正样本 ,P 负样本 =0; Calculate the sample prediction evaluation value for all positive and negative sample pairs, and calculate the AUC value of the regression model for the validation set sample according to formula (8):

[0134]

[0135] The specific implementation process for calculating the number of subsamples generated by the feature analysis process is as follows: Using the feature attribution scan block parameters Size, Stride, and Padding corresponding to the individual, k and m corresponding to the current individual are calculated using formulas (6) and (7); when Padding = 0, the number of subsamples corresponding to the individual is m × m + 1; when Padding = 1, if k = 0, the number of subsamples corresponding to the individual is m × m + 1; when Padding = 1, if k ≠ 0, the number of subsamples corresponding to the individual is (m + 1) × (m + 1) + 1. Taking the individual [34, 15, 1, 2] as an example, its Padding = 1, and we calculate m = 31 and k = 13, then the number of subsamples corresponding to this individual is (31 + 1) × (31 + 1) + 1 = 1025;

[0136] (6) Perform fast non-dominated ordination and fitness comprehensive evaluation on individuals in population Q. Fast non-dominated ordination finds the Pareto front of population Q by measuring the individual's performance on two evaluation metrics: AUC value and subsample size. Fitness comprehensive evaluation selects the optimal individual in population Q by combining the two evaluation metrics from the set of individuals at the Pareto front. In specific operations, the negative value of the individual's AUC value and the subsample size are used as the optimization objective functions, labeled as f1 and f2 respectively; let n i S is the number of individuals in the population that dominate the i-th individual. i Let be the set of individuals dominated by the i-th individual. One individual dominating another means that, for both the AUC value and the subsample size, the dominant individual outperforms the dominated individual; that is, the model AUC value is higher than that of the dominated individual, and the subsample size is smaller than that of the dominated individual. A fast non-dominated ranking is used to obtain the set of dominant individuals, and the optimal individual is selected by combining this with a fitness-based comprehensive evaluation. The specific implementation process is as follows:

[0137] (6.1) Iterate through all individuals in the current population Q and calculate n for each individual. i Value and the individual controlled by that individual

[0138] Volume set S i ;

[0139] (6.2) All n i Individuals with a value of 0 are stored in set F1;

[0140] (6.3) Let j = 1;

[0141] (6.4) Let H be an empty set;

[0142] (6.5) Traversing F j Let S be any of the individuals. u For F jThe set of individuals controlled by the u-th individual, n q To dominate S u The number of individuals of the q-th individual; obtain F j S corresponding to each individual u ;

[0143] (6.6) For all S u Iterate through each S u For all individuals, calculate the n corresponding to each individual. q Value, and let n q =n q -1;

[0144] (6.7) If n q =0, then S u The q-th individual is placed into set H;

[0145] (6.8) Let j = j + 1;

[0146] (6.9) Let F j =H;

[0147] (6.10) Repeat steps (6.4) to (6.9) until F is obtained. j It is an empty set;

[0148] (6.11) All individuals in F1 are dominant individuals. These individuals are considered the Pareto front of population Q. The optimal individual is selected by combining two evaluation indicators. The specific selection process is as follows: If F1 contains only one individual, that individual is selected as the optimal individual Indi in this evaluation. best If F1 contains two individuals, the individual with the higher AUC value is selected as the optimal individual in this evaluation. best When F1 contains 3 or more individuals, the fitness comprehensive evaluation value f of the i-th individual is calculated according to formula (9). i all f1 i f1 represents the objective value of the i-th individual, and f2 represents the objective value of the i-th individual. i Let f represent the f² optimization objective value for the i-th individual. Choose f... i all The smallest individual is considered the optimal individual, Indi. best When multiple individuals simultaneously possess the smallest f i all When selecting an individual with a higher AUC value, choose the individual with the best AUC value as the optimal individual in the model. best ;

[0149]

[0150] (7) For each individual in population Q, a binary bidding selection method is used, i.e., pairwise comparison. Each comparison selects the individual with smaller f according to the optimal individual evaluation method in step (6). i all Individuals with a value of Q enter the parent population. p ;

[0151] (8) For population Q p For each individual in the population, a simulated binary crossover method is used for crossover. The resulting population is labeled Q. x The specific implementation process is as follows:

[0152] (8.1) For the current individual, generate a uniformly distributed random number β1 in the range of 0 to 1. When β1≤β, the current individual and another random individual are used as the parent for subsequent operations. When β1>β, no operation is performed.

[0153] (8.2) Generate a uniformly distributed random number g1 in the range of 0 to 1, and denote k1 as the same encoding position of the two individuals in the crossover operation;

[0154] (8.3) Calculate the cross-intermediate variable β according to formula (10). g1 ;

[0155]

[0156] (8.4) Calculate the parental influence factor β according to formula (11). k1 ;

[0157]

[0158] (8.5) For two individuals Indi1 and Indi2, let Indi be the two offspring individuals generated by the crossover operation. c1 and Indi c2 Indi c1 The value of the k1th position on is calculated by formula (12), Indi c2 The value of the k1th position is calculated according to formula (13). Where Indi c1 (k1) is Indi c1 The value at the k1-th position on Indi1, Indi1(k1) is the value at the k1-th position on Indi1, and so on;

[0159]

[0160]

[0161] (8.6) Indi c1 and Indi c2Non-integer values ​​are rounded to the nearest integer.

[0162] (8.7) Repeat steps (8.1) to (8.6) until Q. p Each individual in the population underwent a crossover operation. All the resulting crossover offspring were then added to population Q. x middle. Figure 3 An example of the crossover operation is given, where k1 = 2;

[0163] (9) For population Q x For each individual in the population, a polynomial mutation method is used to perform the mutation operation, and the mutated population is labeled as Q. m The specific implementation process is as follows:

[0164] (9.1) For the current individual, generate a uniformly distributed random number σ1 in the range of 0 to 1. When σ1≤σ, perform subsequent operations on the individual; when σ1>σ, do not perform any operations.

[0165] (9.2) Generate a uniformly distributed random number g2 in the range of 0 to 1, and denote k2 as the encoding position of the individual in the mutation operation;

[0166] (9.3) Calculate the intermediate variable β according to formula (14). g2 ;

[0167]

[0168] (9.4) Let Indi(k2) be the upper bound of the value of the k2 position of individual Indi. up The lower bound of the value at position k2 of individual Indi is Indi(k2). low Let Indi be the offspring generated by the mutation operation. mut Indi mut The value of the k2th position is calculated by formula (15);

[0169] Indi mut (k2)=Indi(k2)+(Indi(k2) up -Indi(k2) low )×β g2 (47)

[0170] (9.5) Indi mut Non-integer values ​​are rounded to the nearest integer.

[0171] (9.6) Repeat steps (9.1) to (9.5) until Q. x Each individual in the population underwent a mutation operation. All the mutated offspring were then added to the population Q. mmiddle. Figure 4 An example of a mutation operation is given, where k2 = 1;

[0172] (10) Population Q p With subpopulation Q x subpopulation Q m Merge into a new population Q n ;

[0173] (11) Regarding the new population Q n An elite strategy is implemented to select and generate the next generation of the population. Q n This includes the set Q of individuals selected from the previous generation through a binary bidding process. p This includes Indi, the best individual from the previous generation of the population. best The elite strategy selects the best individuals from the previous generation... best Together with the new offspring, fitness assessments and other operations are performed to generate the next generation population. Let the next generation population be denoted as Q. p+1 The specific process of its elite selection strategy is as follows:

[0174] (11.1) The new population Q was evaluated according to the methods in steps (5) and (6). n Perform a fast non-dominated sort operation on all individuals to obtain Q. n All non-dominated sets F j .

[0175] (11.2) Let Q p+1 It is an empty set, j = 1;

[0176] (11.3) Calculate F j The crowding distance of all individuals in the group. Let d be the distance between them. i For F j The crowding distance of the i-th individual is calculated using f1 and f2 respectively against F. j The individuals in the data are sorted, and the two individuals with the largest f1 value and the largest f2 value are taken as boundary individuals. The crowding degree d corresponding to the boundary individuals is... i It is considered to be infinite. Except for boundary individuals, the crowding distance of other individuals is calculated according to formula (16). Where f z i+1 F represents j f of the (i+1)th individual z Target fitness value, f z i-1 F represents j f of the (i-1)th individual z Target fitness value;

[0177]

[0178] (11.4) Note | Q p+1 |For Q p+1 The number of individuals in the middle, |F j |For F j The number of individuals in the group. When |Q p+1 |+|F j When |≤N, F j Put all individuals into Q p+1 In the middle. When |Q p+1 |+|F j When |>N, F j Individuals are sorted from largest to smallest based on their crowding distance, and the sorted F... j Choose N-|Q in sequence p+1 | Individuals are placed in Q p+1 middle;

[0179] (11.5) Let j = j + 1;

[0180] (11.6) Repeat steps (11.1) to (11.5) until |Q p+1 |=N;

[0181] (12) Let Q = Q p+1 E = E + 1;

[0182] (13) Repeat steps (5) to (12) until E = E max ;

[0183] (14) For the passage through E max The population Q undergoes rapid non-dominated ranking and fitness comprehensive evaluation in steps (5) and (6) to obtain the optimal individual Indi. best The optimal individual Indi best The corresponding feature attribution scan block and logistic regression model are passed to the SAR image adversarial sample detection online detection module. Figure 5 The Pareto front plot of individuals in the F1 group after the maximum number of evolutionary rounds is given. In this example, the optimal individual is coded as [24,117,1,3].

[0184] (15) The SAR image adversarial sample detection data preprocessing module collects real-time image data from the target SAR system during the monitoring process, and obtains the online detection dataset X after data normalization and data standardization processing. t The online detection dataset X t Transmitted to the online detection module;

[0185] (16) The SAR image adversarial example detection online detection module uses the obtained optimal feature attribution scanning block to calculate the online detection dataset X according to the feature attribution expression calculation method in step (5).t The feature representation; then use the obtained optimal regression model to determine X. t The system determines whether a sample's feature representation belongs to the adversarial sample and issues an alert for any discovered adversarial sample feature representation; otherwise, the sample is considered a normal sample.

[0186] Adversarial example detection experiments were conducted on the FUSAR-Ship dataset to compare the proposed technique with three existing adversarial example detection techniques. The experiments selected five types of adversarial examples involved in the proposed technique: FGSM, PGD, CW, Deepfool, and Noise. The optimal individual Indi obtained by the proposed technique was also tested. best =[24,117,1,3]; A regression model is established based on three existing adversarial example detection techniques: kernel density and Bayesian estimation (KDBU), intrinsic dimensionality (LID), and Mahalanobis distance score (MAHA). The AUC value of the regression model for each type of adversarial example data and normal FUSAR-Ship data is calculated. Simultaneously, the optimal feature attribution scan block obtained in this embodiment is used to process the adversarial example data and normal FUSAR-Ship data participating in the experiment, and the AUC value of the regression model obtained in this embodiment for each type of adversarial example data and normal FUSAR-Ship data is calculated. The results are compared as follows: Figure 6 As shown, we can observe that compared to the three existing traditional adversarial example detection methods, the regression model AUC value obtained using the technique of this invention is superior in most adversarial attack samples. Furthermore, compared to adversarial example detection techniques based on Leave One Out (LOO), the technique of this invention reduces the number of subsamples required for samples of different sizes as follows: Figure 7 As shown, it is easy to see that the technology of this invention significantly improves computational efficiency compared to the LOO technology.

[0187] In summary, the beneficial effects of this invention are: the technology of this invention can automatically obtain the optimal feature analysis granularity according to different scenarios, and efficiently realize the detection of various adversarial examples in the field of SAR image recognition; compared with the prior art, the technology of this invention also improves the computational efficiency and AUC performance index of SAR image adversarial detection.

Claims

1. A synthetic aperture radar image adversarial example detection system based on multi-target optimal feature attribution selection, characterized in that, The system includes a SAR image adversarial example detection data preprocessing module, a SAR image adversarial example detection offline optimal feature attribution selection training module, and a SAR image adversarial example detection online detection module; The SAR image adversarial sample detection data preprocessing module collects real-time image data during the monitoring process from the real-time database of the target SAR system. After image data normalization and image data standardization processing, an online detection dataset is obtained, and the online detection dataset is transmitted to the SAR image adversarial sample detection online detection module. The SAR image adversarial sample detection data preprocessing module collects historical image data from the historical database of the target SAR system. After image data normalization and image data standardization processing, standard historical image data is obtained, and adversarial sample image data corresponding to the standard historical image data is generated. The standard historical image data and adversarial sample image data are merged to obtain an offline training dataset. The offline training dataset is then transmitted to the SAR image adversarial sample detection offline optimal feature attribution selection training module. The SAR image adversarial example detection offline optimal feature attribution selection training module first encodes the size (Size), sweep interval (Stride), padding (whether to perform padding operation when scanning image edges), and number of hidden layers (Layers) in the feature attribution scan block into integers, randomly generating an initial population. Then, a sliding scan submodule performs a sliding scan of the SAR image data in the offline training dataset using feature attribution scan blocks corresponding to different individual codes. A hidden feature extraction submodule extracts features, a feature representation calculation submodule calculates the feature representation set corresponding to the offline training dataset, and a regression model training submodule uses the obtained feature representation set from the offline training dataset as training data for logistic regression training, thereby obtaining a model for discrimination. The logistic regression model for adversarial examples is used. The fitness index of the individual fitness function evaluation submodule is calculated by statistically analyzing the number of subsamples generated during feature analysis and the area under the receiver operating characteristic (ROC) curve of the regression model. Individuals in the initial population are ranked using a fast non-dominated sorting and fitness comprehensive evaluation submodule to obtain Pareto front individuals. The optimal individual is selected from the Pareto front individuals. Offspring populations are generated through selection, crossover, and mutation. Parent and offspring populations are merged to generate a new population. The new population undergoes fast non-dominated sorting and crowding distance calculation. The next generation population is generated based on the population size. This evolutionary process is repeated until the maximum evolutionary round is reached, thus obtaining Pareto optimal individuals. The optimal feature attribution scan block and optimal regression model corresponding to this optimal individual are transmitted to the SAR image adversarial example detection online detection module. The SAR image adversarial sample detection online detection module performs sliding scans on the SAR image data in the online detection dataset using the optimal feature attribution scan block through the sliding scan submodule, extracts features through the latent feature extraction submodule, and calculates the feature expression set of the online detection dataset through the feature expression calculation submodule. Then, the obtained optimal regression model is used as the adversarial example detection model to determine whether the feature representation of the online detection dataset belongs to the feature representation of adversarial examples. If a feature expression is detected to belong to the feature expression of an adversarial example, an early warning message will be issued; Otherwise, the sample is a normal sample.

2. A SAR image adversarial example detection method based on multi-target optimal feature attribution selection using the system of claim 1, characterized in that, Includes the following steps: (1) The SAR image adversarial sample detection data preprocessing module obtains historical SAR image data stored during the monitoring process from the SAR system as the raw dataset and marks it as O; Image data normalization is performed on O to obtain a normalized dataset X. Then, image data normalization is performed using formula (1) to obtain an offline standard dataset X. o ; The SAR image data normalization module consists of segmentation, scaling, and dimensionality reduction operations. Segmentation involves dividing the original image into regions. When the input SAR historical monitoring image is a single image of a monitoring area containing multiple identified targets, the image needs to be segmented according to the identified targets, so that the segmented SAR image contains only a single identified target. If the input SAR historical image data has already been segmented, and each SAR historical image contains only a single identified target, then no further segmentation is needed. Scaling adjusts the size of each SAR image in the dataset to ensure that its size parameters are consistent with the parameters of the target model. Dimensionality reduction performs single-channel processing on the SAR images in the dataset. If the input SAR historical image data is already a single-channel image, then no further dimensionality reduction is needed. Offline standard dataset X o The data is transmitted to an adversarial example generation platform for adversarial example generation, which uses five adversarial example generation methods to generate X. o Adversarial example dataset X under the target model adv These five adversarial example generation methods include: Fast Gradient Sign-Based (FGSM) attack, Gradient Iteration-Based (PGD) attack, Optimization-Based (CW) attack, Boundary Decision-Based (Deepfool) attack, and Noise attack based on random noise; X o With X adv The data was split in a 4:1 ratio to obtain a clean training set X. o_train Training set X containing adversarial examples adv_train Validation set X of clean data o_val The validation set X containing adversarial examples adv_val ; (2) Set the relevant parameter values ​​in the offline optimal feature attribution selection training module. The parameter values ​​include the population size N and the maximum size of the feature attribution scan block Size. max Minimum Size min Maximum step size Stride max Minimum step size Stride min Maximum number of feature layers L, training epochs EP train Crossover rate β, mutation rate σ, maximum number of evolutionary rounds E max ; (3) Encode the set of parameters Size, Stride, Padding, and Layers in a feature attribution scan block into integers, and use them as an individual in the multi-objective evolution strategy. Initialize N individuals as the initial population Q, where the encoding form of each individual is Indi = [Size, Stride, Padding, Layers], where Indi represents any individual in the population, where Size represents the size of the feature attribution scan block, Stride represents the scanning interval of the feature attribution scan block, Padding represents the marker of whether the feature attribution scan block performs an expansion operation when scanning the image edge, and Layers represents the number of hidden layers of the model used for feature analysis. The specific implementation process of initializing Size, Stride, Padding, and Layers is shown in formulas (2) to (5): Size=Randint(Size min ,Size max ) (2) Stride=Randint(Stride min ,Stride max ) (3) Padding = Randint(0,1) (4) Layers = Randint(1,L) (5) Here, `Randint(a,b)` represents a randomly generated integer between `a` and `b`, with the value range including both `a` and `b` themselves. When `Padding` = 0, the feature scanning process does not perform edge augmentation; when `Padding` = 1, the feature scanning process performs edge augmentation. X... o The length and width of the SAR image are labeled as h and w, respectively. Usually, h = w. The number of row scans of the feature attribution scan block is labeled as m. The calculation process of m is shown in formula (6). The width of the edge pixels not covered by the row scan process is labeled as k. The calculation process of k is shown in formula (7). k = (h - Size) - m × Stride (7) in This indicates a rounding down operation. When Padding = 0 and k ≠ 0, it means that the current Size and Stride parameter values ​​cannot scan the function edges, and some edge pixels of the SAR image will not participate in the subsequent feature extraction process. When Padding = 1 and k ≠ 0, the SAR image will be edge-padded before feature attribution analysis, and the value of the filled pixel will be fixed at 0, so that all pixels in the SAR image will participate in the subsequent feature attribution analysis process. The hidden feature extraction operation extracts the output features of the hidden layers sequentially, starting from the last hidden layer of the target model, based on the value of Layers, until the number of hidden layers extracted is equal to the value of Layers. (4) Label the current evolutionary round of the multi-objective optimization technique as E, and set E = 0; (5) The fitness function of the initial population Q is evaluated. That is, the SAR image adversarial example detection offline optimal feature attribution selection training module first calculates the dataset X according to the feature attribution scan block corresponding to the individual in Q. o_train X adv_train X o_val X adv_val The feature representation; then, using the training set X o_train X adv_train The feature representation set is used for logistic regression training, with a training epoch of EP. train The validation set X is used during training. o_val X adv_val The feature set is used to validate the obtained regression model, calculate the AUC value of the regression model, and evaluate the number of subsamples generated during the feature analysis process. (6) Perform fast non-dominated ordination and fitness comprehensive evaluation on individuals in population Q; fast non-dominated ordination finds the Pareto front of population Q by measuring the individual's performance on two evaluation indicators: AUC value and subsample size; fitness comprehensive evaluation selects the optimal individual of population Q by combining the two evaluation indicators from the set of individuals at the Pareto front; in specific operation, the negative value of the individual's AUC value and the subsample size are used as the optimization objective function, labeled as f1 and f2 respectively; let n i S is the number of individuals in the population that dominate the i-th individual. i Let be the set of individuals dominated by the i-th individual; the meaning of one individual dominating another is that, for the AUC value and the number of subsamples corresponding to the individual, the dominant individual performs better than the dominated individual, that is, the model AUC value is higher than that of the dominated individual and the number of subsamples is smaller than that of the dominated individual. (7) For each individual in population Q, a binary bidding selection method is used, i.e., pairwise comparison. Each comparison selects the individual with smaller f according to the optimal individual evaluation method in step (6). i all Individuals with a value of Q enter the parent population. p ; (8) For population Q p For each individual in the population, a simulated binary crossover method is used for crossover; the resulting population is labeled as Q. x ; (9) For population Q x For each individual in the population, a polynomial mutation method is used to perform the mutation operation, and the mutated population is labeled as Q. m ; (10) Population Q p With subpopulation Q x subpopulation Q m Merge into a new population Q n ; (11) Regarding the new population Q n Implementing an elite strategy to select and generate the next generation of the population; Q n This includes the set Q of individuals selected from the previous generation through a binary bidding process. p This includes Indi, the best individual from the previous generation of the population. best The elite strategy selects the best individuals from the previous generation. best Together with the new offspring, fitness assessments and other operations are performed to generate the next generation population; denoted as Q, this next generation population is... p+1 ; (12) Let Q = Q p+1 E = E + 1; (13) Repeat steps (5) to (12) until E = E max ; (14) For the passage through E max The population Q undergoes rapid non-dominated ranking and fitness comprehensive evaluation in steps (5) and (6) to obtain the optimal individual Indi. best ;The optimal individual Indi best The corresponding feature attribution scanning block and logistic regression model are passed to the SAR image adversarial example detection online detection module; (15) The SAR image adversarial sample detection data preprocessing module collects real-time image data from the target SAR system during the monitoring process, and obtains the online detection dataset X after data normalization and data standardization processing. t The online detection dataset X t Transmitted to the online detection module; (16) The SAR image adversarial example detection online detection module uses the obtained optimal feature attribution scanning block to calculate the online detection dataset X according to the feature attribution expression calculation method in step (5). t The feature representation; then use the obtained optimal regression model to determine X. t The system determines whether a sample's feature representation belongs to the adversarial sample and issues an alert for any discovered adversarial sample feature representation; otherwise, the sample is considered a normal sample.

3. The SAR image adversarial example detection method according to claim 2, characterized in that, The specific calculation process of step (5) is as follows: (5.1) Let i = 0, and label the maximum number of images in this dataset as i. max ; (5.2) Set the subsample image set F sub For an empty set, the i-th image x in the dataset is selected as the image for this feature analysis. A sliding scan of this image is performed using a feature attribution scan block. The scan operation starts at position (0,0) in the pixel matrix of image x, and a square region of size Size in the pixel matrix of image x is selected according to the Size parameter for subsample generation. The subsample generation operation clones a new image with the same pixel values ​​as the original x, then sets the pixel values ​​of the scanned region of the new image to 0, and then adds this image to the subsample image set F. sub In the middle, after completing one subsample generation operation, the feature attribution scan block slides row by row according to the Stride parameter, performing a subsample generation operation with each slide scan; this process is repeated until the next scan of the scan block exceeds the width of the pixel matrix, then the scan block is moved to the next row scan position in the x image pixel matrix according to the Stride parameter, and the row-by-row sliding scan begins again; this process is repeated until the feature attribution scan block has completed all row-by-row scan operations in the x matrix pixels; finally, the original image x is also added to the subsample image set F. sub In the sliding scan operation, the starting position of the p-th scan in the l-th row can be denoted as (l×Stride, p×Stride), and the coordinates of the four points of the corresponding square scan area are: (l×Stride, p×Stride), (l×Stride, p×Stride+Size), (l×Stride+Size, p×Stride), (l×Stride+Size, p×Stride+Size). (5.3) The subset F of this image sub Input the target model, select the corresponding hidden layer according to the given Layers parameters, and obtain the output of the corresponding hidden layer in the model for each image in the subsample set; perform average pooling on the output of the hidden layer to obtain the subsample set F. sub The corresponding set of latent features; (5.4) Subtract the latent features corresponding to the original image x from the latent features corresponding to the subsample images other than the original image x in the latent feature set to obtain the image feature change matrix that can characterize the influence of image pixel changes; (5.5) Perform interquartile range (IQR) statistics on the image feature change matrix to obtain the feature expression vector that can characterize the image; (5.6) Let i=i+1; (5.7) Repeat steps (5.2) to (5.6) until i = i max ; (5.8) Merge all the feature representation vectors obtained in step (5.7) to obtain the feature representation set corresponding to the dataset; The specific implementation process for AUC value evaluation is as follows: Let the verification set X be... o_val The sample size in the dataset is R, labeled as positive samples; the validation set is X. adv_val The sample size in the regression model is T, labeled as negative samples; the predicted scores of the validation set samples in the regression model are denoted as P, P 正样本 P represents the prediction score of the regression model for a single positive sample. 负样本 I(P) represents the prediction score of the regression model for a single negative sample; denoted as I(P) 正样本 ,P 负样本 ) represents the sample prediction evaluation value for a positive-negative sample pair; when P 正样本 >P 负样本 At that time, I(P) 正样本 ,P 负样本 ) = 1; when P 正样本 =P 负样本 At that time, I(P) 正样本 ,P 负样本 ) = 0.5; when P 正样本 <P 负样本 At that time, I(P) 正样本 ,P 负样本 =0; Calculate the sample prediction evaluation value for all positive and negative sample pairs, and calculate the AUC value of the regression model for the validation set sample according to formula (8): The specific implementation process for calculating the number of subsamples generated by the feature analysis process is as follows: using the feature attribution scan block parameters Size, Stride, and Padding corresponding to the individual, calculate k and m corresponding to the current individual through formulas (6) and (7); when Padding = 0, the number of subsamples corresponding to the individual is m × m + 1; when Padding = 1, if k = 0, the number of subsamples corresponding to the individual is m × m + 1; when Padding = 1, if k ≠ 0, the number of subsamples corresponding to the individual is (m + 1) × (m + 1) + 1.

4. The SAR image adversarial example detection method according to claim 2, characterized in that, The specific implementation process of step (6) is as follows: (6.1) Iterate through all individuals in the current population Q and calculate n for each individual. i The value and the set S of individuals dominated by that individual. i ; (6.2) All n i Individuals with a value of 0 are stored in set F1; (6.3) Let j = 1; (6.4) Let H be an empty set; (6.5) Traversing F j Let S be all the individuals. u For F j The set of individuals controlled by the u-th individual, n q To dominate S u The number of individuals of the q-th individual; obtain F j S corresponding to each individual u ; (6.6) For all S u Iterate through each S u For all individuals, calculate the n corresponding to each individual. q Value, and let n q =n q -1; (6.7) If n q =0, then S u The q-th individual is placed into set H; (6.8) Let j = j + 1; (6.9) Let F j =H; (6.10) Repeat steps (6.4) to (6.9) until F is obtained. j It is an empty set; (6.11) All individuals in F1 are dominant individuals. These individuals are considered the Pareto front of population Q. The optimal individual is selected by combining two evaluation indicators. The specific selection process is as follows: If F1 contains only one individual, that individual is selected as the optimal individual Indi in this evaluation. best If F1 contains two individuals, the individual with the higher AUC value is selected as the optimal individual in this evaluation. best When F1 contains 3 or more individuals, the fitness comprehensive evaluation value f of the i-th individual is calculated according to formula (9). i all f1 i f1 represents the objective value of the i-th individual, and f2 represents the objective value of the i-th individual. i f² represents the objective value for the i-th individual; select f i all The smallest individual is considered the optimal individual, Indi. best When multiple individuals simultaneously possess the smallest f i all When selecting an individual with a higher AUC value, choose the individual with the best AUC value as the optimal individual in the model. best ; 5. The SAR image adversarial example detection method according to claim 2, characterized in that, The specific implementation process of step (8) is as follows: (8.1) For the current individual, generate a uniformly distributed random number β1 in the range of 0 to 1. When β1≤β, the current individual and another random individual are used as the parent for subsequent operations. When β1>β, no operation is performed. (8.2) Generate a uniformly distributed random number g1 in the range of 0 to 1, and denote k1 as the same encoding position of the two individuals in the crossover operation; (8.3) Calculate the cross-intermediate variable β according to formula (10). g1 ; (8.4) Calculate the parental influence factor β according to formula (11). k1 ; (8.5) For two individuals Indi1 and Indi2, let Indi be the two offspring individuals generated by the crossover operation. c1 and Indi c2 Indi c1 The value of the k1th position on is calculated by formula (12), Indi c2 The value of the k1th position is calculated according to formula (13); where Indi c1 (k1) is Indi c1 The value at the k1-th position on Indi1, Indi1(k1) is the value at the k1-th position on Indi1, and so on; (8.6) Indi c1 and Indi c2 Non-integer values ​​are rounded to the nearest integer. (8.7) Repeat steps (8.1) to (8.6) until Q. p Each individual in the population underwent a crossover operation; all the resulting crossover offspring were then placed into population Q. x middle.

6. The SAR image adversarial example detection method according to claim 2, characterized in that, The specific implementation process of step (9) is as follows: (9.1) For the current individual, generate a uniformly distributed random number σ1 in the range of 0 to 1. When σ1≤σ, perform subsequent operations on the individual; when σ1>σ, do not perform any operations. (9.2) Generate a uniformly distributed random number g2 in the range of 0 to 1, and denote k2 as the encoding position of the individual in the mutation operation; (9.3) Calculate the intermediate variable β according to formula (14). g2 ; (9.4) Let Indi(k2) be the upper bound of the value of the k2 position of individual Indi. up The lower bound of the value at position k2 of individual Indi is Indi(k2). low Let Indi be the offspring generated by the mutation operation. mut Indi mut The value of the k2th position is calculated by formula (15); Now mut (k2)=Now(k2)+(Now(k2) up -Now(k2) low )×β g2 (15) (9.5) Indi mut Non-integer values ​​are rounded to the nearest integer. (9.6) Repeat steps (9.1) to (9.5) until Q. x Each individual in the population underwent a mutation operation; all the mutated offspring were then placed into the population Q. m middle.

7. The SAR image adversarial example detection method according to claim 2, characterized in that, The specific process of its elite selection strategy is as follows: (11.1) The new population Q was evaluated according to the methods in steps (5) and (6). n Perform a fast non-dominated sort operation on all individuals to obtain Q. n All non-dominated sets F j ; ( 11.2) Let Q p+1 It is an empty set, j = 1; (11.3) Calculate F j The crowding distance of all individuals in the group; denoted by d. i For F j The crowding distance of the i-th individual is calculated using f1 and f2 respectively against F. j The individuals in the data are sorted, and the two individuals with the largest f1 value and the largest f2 value are taken as boundary individuals. The crowding degree d corresponding to the boundary individuals is... i It is considered to be infinite; except for the boundary individuals, the crowding distance of the remaining individuals is calculated according to formula (16); where f z i+1 F represents j f of the (i+1)th individual z Target fitness value, f z i-1 F represents j f of the (i-1)th individual z Target fitness value; (11.4) Note | Q p+1 |For Q p+1 The number of individuals in the middle, |F j |For F j The number of individuals in the middle; when |Q p+1 |+|F j When |≤N, F j Put all individuals into Q p+1 In the middle; when |Q p+1 |+|F j When |>N, F j Individuals are sorted from largest to smallest based on their crowding distance, and the sorted F... j Choose N-|Q in sequence p+1 | Individuals are placed in Q p+1 middle; (11.5) Let j = j + 1; (11.6) Repeat steps (11.1) to (11.5) until |Q p+1 |=N.

Images