A method for generating an adversarial sample of a SAR image and application

Abstract

The application discloses a kind of SAR image's adversarial sample generation method and application, belong to synthetic aperture radar automatic target identification security technical field;The application proposes the concept of teacher adversarial sample and student adversarial sample, first using gradient-based iterative attack method to the gradient vector of teacher adversarial sample and teacher adversarial sample is alternately updated, obtains the gradient vector of teacher adversarial sample obtained in last update, then in subsequent iterative process Guiding student adversarial sample gradient vector update;The application considers that SAR image is prone to cause the problem that gradient direction changes too much in gradient calculation process due to the existence of coherent noise, by using the gradient information of teacher adversarial sample, it is fused into the generation process of student adversarial sample, can well fit SAR data characteristics, to generate high-quality adversarial sample in real black box scene.

Description

Technical Field

[0001] This invention belongs to the field of automatic target recognition security technology for synthetic aperture radar, and more specifically, relates to a method for generating adversarial samples for SAR images and its application. Background Technology

[0002] Synthetic Aperture Radar (SAR) is widely used in both civilian and military fields because it can emit microwaves and capture high-resolution radar images under various weather conditions. In recent years, with the development of artificial intelligence and machine learning, deep learning models have been widely applied in SAR target recognition tasks. However, Szegedy et al. demonstrated in 2014 that deep learning models are easily affected by carefully designed small adversarial perturbations added to clean samples. Therefore, researching the security and robustness of deep learning models for automatic target recognition of SAR images will be a challenging task.

[0003] Adversarial attacks are a common method used to study the security and robustness of deep learning models. Generally, adversarial attacks can be divided into two categories: white-box attacks and black-box attacks. White-box attacks involve attackers possessing detailed internal information about the target deep learning model, including its architecture, parameters, and training data. Black-box attacks, on the other hand, do not know this specific information and can only explore the model's behavior through experimentation and attempt to construct deceptive inputs to cause the model to make incorrect predictions. Because SAR (Automatic Target Recognition) tasks, whether in military or civilian applications, inherently possess high levels of secrecy, attackers find it difficult to obtain information about the deep learning model used. Therefore, in real-world scenarios, black-box attacks are often more suitable for SAR automatic target recognition tasks.

[0004] In black-box attacks, the quality of the generated adversarial examples determines the success rate of the attack, thus affecting the accuracy of security detection. In addition, adversarial examples can be used to strengthen deep learning models. For example, during model training, adding perturbed samples to the dataset can build a more robust model that can effectively defend against adversarial attacks.

[0005] A common black-box attack method is gradient-based attack. Gradient-based attacks obtain the gradient information of the source model, use optimization algorithms to calculate the model's gradient, and adjust the input to generate adversarial examples to attack the target model. Common methods include FGSM, I-FGSM, and MI-FGSM. FGSM (Fast Gradient Sign Method) is a targetless attack algorithm. Its basic idea is to shift the gradient of the loss function along the direction of its maximum value by a certain step, thereby generating an adversarial example similar to the original sample but misclassified. I-FGSM (Iterative-FGSM) is an improved version of FGSM. It iteratively perturbs the original sample with small perturbations and recalculates the gradient direction, thus constructing more accurate and diverse adversarial examples. MI-FGSM (Momentum Iterative-FGSM) introduces momentum to further accelerate I-FGSM.

[0006] However, among the aforementioned adversarial attack methods, those for generating adversarial examples are primarily designed for visual image data. A significant difference between SAR data and visual images is that SAR images are also affected by noise from speckle patterns. When using these methods to generate SAR adversarial examples, the presence of speckle noise leads to excessive differences in gradient directions before and after the calculation process, resulting in poor attack performance of the generated adversarial examples. This is a factor that does not need to be considered in visual images. Therefore, when using adversarial attack methods proposed for visual images to generate adversarial examples on SAR data, the initial and final gradient directions differ significantly, failing to accurately reflect the characteristics of SAR data and unable to generate high-quality adversarial examples in real-world black-box scenarios. Summary of the Invention

[0007] In view of the above-mentioned defects or improvement needs of the existing technology, the present invention provides a method and application for generating adversarial examples of SAR images, so as to solve the technical problems that the existing technology cannot well fit the characteristics of SAR data and cannot generate high-quality adversarial examples in real black box scenarios.

[0008] To achieve the above objectives, in a first aspect, the present invention provides a method for generating adversarial examples for SAR images, comprising:

[0009] S1. For any pre-collected SAR image sample x carrying a target identification tag y, initialize the corresponding teacher adversarial sample as an image sample with random perturbation added to x, initialize the gradient vector of the corresponding teacher adversarial sample to 0, and use a gradient-based iterative attack method to alternately update the teacher adversarial sample and its gradient vector, obtaining the gradient vector g' of the teacher adversarial sample obtained from the last update; let t = 0, and under the iteration index t, let the gradient vector g' of the teacher adversarial sample be... t =g', the gradient vector g of the student's adversarial example t =0, the student adversarial sample corresponding to x

[0010] S2, Using the teacher's adversarial example x' t The initialization is performed on the SAR image sample after adding random perturbations; the gradient update formula in the gradient-based iterative attack method is used to continue updating the gradient vector of the teacher adversarial sample, resulting in g'. t+1 The gradient vector of the student adversarial example is updated using the above gradient update formula, and g' is added at a preset ratio during the update process. t+1 , to obtain g t+1 This guides students to update adversarial samples and obtain...

[0011] S3. Determine if t is less than T. If so, let t = t + 1 and go to step S2. Otherwise, take the last obtained student adversarial sample as the adversarial sample corresponding to x. T is a positive integer.

[0012] More preferably, the above-mentioned gradient-based iterative attack method is an iterative attack method based on gradient and momentum.

[0013] More preferably, in step S2, Where μ is momentum; J(x') t Let y) be the loss function for the automatic recognition task of SAR images, representing the loss function of the teacher adversarial sample x'. t The difference between the target recognition result obtained by automatic target recognition of SAR images after inputting into a deep learning model and the target recognition label y; J(x') represents t ,y) against teacher adversarial sample x' t The derivative of ; ||·||1 denotes the first norm.

[0014] More preferably, in step S2, Where μ is momentum and γ is a preset weight value.

[0015] More preferably, γ is a parameter that gradually decreases as the number of iterations in step S2 increases.

[0016] More preferably,

[0017] More preferably, in step S2, Here, sign(·) represents the sign function.

[0018] More preferably, in step S1, the teacher adversarial sample corresponding to x is initialized as an image sample in x after adding a random perturbation that satisfies a uniform distribution, specifically as follows: in, This represents the uniform distribution function; α is a preset parameter.

[0019] More preferably, in step S2, the teacher adversarial example x' is... t The initialization involves adding image samples to the SAR image sample whose amplitude gradually decreases with the increase of the iteration number in step S2 and satisfies a uniform distribution of random perturbation. Specifically: in, Let represent the uniform distribution function; α is a preset parameter; β is a parameter that gradually decreases as the number of iterations in step S2 increases.

[0020] More preferably,

[0021] Secondly, the present invention provides a security assessment method for an automatic target recognition model for SAR images, comprising:

[0022] For each SAR image sample in the pre-collected SAR sample dataset, the adversarial sample generation method provided in the first aspect of the present invention is used to generate a corresponding adversarial sample; each adversarial sample is input into the SAR automatic target recognition model to be evaluated to obtain the corresponding target recognition result;

[0023] The accuracy of the identification results is calculated by comparing the differences between the identification results of each adversarial example and the corresponding real results; the higher the accuracy of the identification results, the better the security of the SAR automatic target identification model.

[0024] Thirdly, the present invention provides a security assessment method system for an automatic target recognition model of SAR, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor executes the security assessment method provided in the second aspect of the present invention when executing the computer program.

[0025] Fourthly, the present invention also provides a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed by a processor, it controls the device where the storage medium is located to execute the adversarial example generation method for SAR images provided in the first aspect of the present invention and / or the security assessment method provided in the second aspect of the present invention.

[0026] In summary, the above-described technical solutions conceived in this invention can achieve the following beneficial effects:

[0027] 1. This invention provides a method for generating adversarial examples for SAR images. It proposes the concepts of teacher adversarial examples and student adversarial examples. A gradient-based iterative attack method is used to alternately update the gradient vectors of the teacher adversarial examples and the student adversarial examples in advance. The gradient vector of the teacher adversarial example obtained in the last update is obtained to guide the update of the gradient vector of the student adversarial example in subsequent iterations. This invention takes into account the problem that the gradient direction of SAR images is easily changed too much during the gradient calculation process due to coherent noise. By using the gradient information of the teacher adversarial example, it is integrated into the generation process of the student adversarial example, which can better fit the characteristics of SAR data, thereby generating high-quality adversarial examples in real black-box scenarios.

[0028] 2. Furthermore, the adversarial example generation method provided by the present invention employs a gradient-based iterative attack method that is based on gradient and momentum. By adding momentum to the gradient iteration process, the direction of gradient update can be stabilized. At the same time, after considering the difference between the initial and final perturbation directions, future gradient information is fully utilized to guide the current gradient iteration process, thereby further improving the quality of adversarial examples generated in real-world black-box scenarios.

[0029] 3. Furthermore, to prevent overfitting and adversarial examples from getting trapped in local optima, the adversarial example generation method provided in this invention uses the teacher adversarial example x' t The initialization is to add random perturbation to the SAR image sample, the amplitude of which gradually decreases with the increase of the iteration number of step S2 and satisfies uniform distribution. By adding random perturbation to the student adversarial sample in each iteration, the mobility of the adversarial sample is further improved.

[0030] 4. Furthermore, the adversarial example generation method provided by this invention can improve the success rate of attacks in black-box attacks, thereby affecting the accuracy of security detection. In addition, it can also be used to strengthen deep learning models. For example, during the training process, if the generated adversarial examples are added to the dataset, a more robust model can be built, thereby effectively defending against adversarial example attacks.

[0031] 5. Furthermore, the adversarial example generation method provided by this invention can not only improve the success rate of migration attacks in black-box scenarios, but also improve the success rate of white-box attacks. It is an effective method for evaluating the security and robustness of SAR automatic identification models. Attached Figure Description

[0032] Figure 1 A flowchart of the adversarial sample generation method for SAR images provided by the present invention;

[0033] Figure 2 A flowchart of an adversarial example generation method for SAR images provided in an embodiment of the present invention;

[0034] Figure 3 The attack success rate curves of the adversarial sample generation method provided by this invention under different perturbation sizes. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0036] Firstly, the present invention provides a method for generating adversarial examples for SAR images, such as... Figure 1 As shown, it includes:

[0037] S1. For any pre-collected SAR image sample x carrying a target identification tag y, initialize the corresponding teacher adversarial sample as an image sample with random perturbation added to x, initialize the gradient vector of the corresponding teacher adversarial sample to 0, and use a gradient-based iterative attack method to alternately update the teacher adversarial sample and its gradient vector, obtaining the gradient vector g' of the teacher adversarial sample obtained from the last update; let t = 0, and under the iteration index t, let the gradient vector g' of the teacher adversarial sample be... t =g', the gradient vector g of the student's adversarial example t =0, the student adversarial sample corresponding to x

[0038] S2, Using the teacher's adversarial example x' t The initialization is performed on the SAR image sample after adding random perturbations; the gradient update formula in the gradient-based iterative attack method is used to continue updating the gradient vector of the teacher adversarial sample, resulting in g'. t+1The gradient vector of the student adversarial example is updated using the above gradient update formula, and g' is added at a preset ratio during the update process. t+1 , to obtain g t+1 This guides students to update adversarial samples and obtain...

[0039] S3. Determine if t is less than T. If so, let t = t + 1 and go to step S2. Otherwise, take the last obtained student adversarial sample as the adversarial sample corresponding to x. T is a positive integer.

[0040] In one optional implementation, in step S1, the teacher adversarial sample corresponding to x is initialized as an image sample in x after adding a random perturbation that satisfies a uniform distribution, specifically as follows: in, This represents the uniform distribution function; α is a preset parameter.

[0041] In one alternative implementation, in step S2, the teacher adversarial example x' is... t The initialization involves adding image samples to the SAR image sample whose amplitude gradually decreases with the increase of the iteration number in step S2 and satisfies a uniform distribution of random perturbation. Specifically: in, Let represent a uniform distribution function; α be a preset parameter; β be a parameter that gradually decreases as the number of iterations in step S2 increases; preferably,

[0042] It should be noted that there are various gradient-based iterative attack methods, including FGSM, I-FGSM, MI-FGSM, NI-FGSM, etc. Different gradient-based iterative attack methods have different gradient update formulas, all of which are applicable here. This invention preferably employs gradient-and-momentum-based iterative attack methods, such as MI-FGSM and NI-FGSM.

[0043] Specifically, in one optional implementation, in step S2, Where μ is momentum; J(x') t Let y) be the loss function for the automatic recognition task of SAR images, representing the loss function of the teacher adversarial sample x'. t The difference between the target recognition result obtained by automatic target recognition of SAR images after inputting into a deep learning model and the target recognition label y; J(x') represents t ,y) against teacher adversarial sample x' tThe derivative of ||·||1 represents the first norm. It should be noted that the deep learning model mentioned above is a deep learning model for the automatic recognition of SAR images, and can be CNN, AConvNet, ResNet-18, VGG-16, Inception-v3, ResNet-50, Inception-ResNetV2, etc., without limitation here.

[0044] In one alternative implementation, in step S2, Where μ is momentum and γ is a preset weight value. In this embodiment, γ is a parameter that gradually decreases as the number of iterations in step S2 increases; preferably, It should be noted that if other gradient-based attack methods such as FGSM, I-FGSM, or NI-FGSM are chosen, the form of the update formula is the same. The difference is that the weight parameter γ can be further optimized by fine-tuning.

[0045] In one alternative implementation, in step S2, Here, sign(·) represents the sign function.

[0046] It should be noted that this invention proposes the concepts of teacher adversarial examples and student adversarial examples. A gradient-based iterative attack method is used to alternately update the gradient vectors of both teacher and student adversarial examples, obtaining the gradient vector of the teacher adversarial example obtained from the last update. This gradient vector guides the update of the student adversarial example's gradient vector in subsequent iterations. Considering the problem that SAR images are prone to significant gradient direction changes during gradient calculation due to coherent noise, this invention integrates the gradient information of the teacher adversarial example into the generation process of the student adversarial example. This effectively matches the characteristics of SAR data, generating high-quality adversarial examples in real-world black-box scenarios. This improves the success rate of attacks in black-box attacks, thereby affecting the accuracy of security detection. Furthermore, it can be used to strengthen deep learning models. For example, during model training, adding the generated adversarial examples to the dataset can further build a more robust model, effectively defending against adversarial example attacks.

[0047] To further illustrate the adversarial example generation method for SAR images provided by this invention, a specific embodiment is described in detail below:

[0048] This embodiment provides a gradient-optimized adversarial example generation method, denoted as the STEG method. This embodiment selects a gradient-based and momentum-based iterative attack method as the gradient-based iterative attack method, and elaborates on the process of alternately updating the teacher adversarial example and the gradient vector of the teacher adversarial example using the gradient-based iterative attack method in step S1. In addition, the total number of iterations in step S1 and the total number of iterations in step S2 are both set to T = 10 (it should be noted that the number of iterations in these two parts can be the same or different, this is just an example).

[0049] like Figure 2 As shown, the specific steps are as follows:

[0050] Step 1: Input a clean SAR sample dataset X = {x1, x2, ... x} n} and the corresponding label set Y = {y1, y2, ... y n}

[0051] Step 2: For each clean sample, initialize its corresponding adversarial sample. The STEG method requires initializing two adversarial samples, one for the "teacher" and one for the "student." In subsequent iterations, the gradient update of the "student" sample is guided by the "teacher." Specifically, the student adversarial sample is initialized in the same way as the clean sample, i.e. The teacher initializes the adversarial examples with a random perturbation that satisfies a uniform distribution, i.e. In this embodiment, the preset parameter α = ∈ / T represents the step size of each iteration. The gradient vectors of the student adversarial examples and the teacher adversarial examples are initialized: g0 = 0, g'0 = 0.

[0052] Step 3: This invention introduces teacher adversarial examples to guide the updating of student adversarial example gradients. In implementation, we use adversarial examples generated by gradient and momentum-based iterative attack methods (such as MI-FGSM, NI-FGSM, etc.) as teacher adversarial examples. Therefore, the gradient of the "teacher" needs to be updated first using momentum:

[0053]

[0054] Step 4: Update the "teacher" adversarial example using gradient information:

[0055] x' t+1 =x' t +α·sign(g' t+1 )

[0056] Steps 5 and 6: Determine if the current iteration t is less than the iteration count T. If yes, then t = t + 1, return to step 3, and continue iterating the teacher adversarial example. If no, it means the teacher adversarial example has been generated. Record its final perturbation direction, which will be used to guide the gradient update of the "student" adversarial example later. Set the iteration count t to zero and restart the iteration of the "student" round.

[0057] Step 7: To prevent overfitting and adversarial examples from getting stuck in local optima, this invention adds a random perturbation to the "student" adversarial example in each iteration to further improve its transferability. Specifically, a random perturbation with an initial step size of α and an amplitude that gradually decreases with each iteration is added, conforming to a uniform distribution. Because the gradient update is gradually stable, in this embodiment...

[0058]

[0059] Step 8: Continue to update the gradient of the "teacher's" adversarial example using momentum, and use the new final perturbation direction to guide the update of the "student's" gradient, ensuring that the "teacher" is also learning a better gradient optimization direction while guiding the student.

[0060]

[0061] Step 9: This invention uses the final perturbation direction of the "teacher's" adversarial example to guide the updating of the "student's" adversarial example gradient. Specifically, the "student," based on historical momentum, considers its current average gradient direction only in proportion to γ, and receives guidance from the "teacher" on the perturbation direction after multiple T iterations in proportions of 1-γ. The "student" needs the "teacher's" guidance most at the beginning of the iteration, and the importance of subsequent guidance decreases. In this embodiment, The formula for updating the "student" gradient is as follows:

[0062]

[0063] Step 10: Update the "student" adversarial example using the gradient calculated in Step 9:

[0064]

[0065] Steps 11 and 12: Determine if the current iteration t is less than the iteration number T. If yes, then t = t + 1, return to step 7, and continue to iterate the "student" adversarial example. If no, then output and save the current "student" adversarial example.

[0066] Specifically, for the input sample x, the pseudocode for generating SAR image adversarial examples is shown in Table 1.

[0067] Table 1

[0068]

[0069] To further illustrate the performance of the adversarial example generation method provided by this invention in model security detection, a specific experimental example is analyzed below:

[0070] This experimental example uses the typical SAR target dataset MSTAR (The Moving and Stationary Target Acquisition and Recognition). The MSTAR dataset was collected and released by Sandia National Laboratories in the United States. It contains various ground targets and variants captured by synthetic aperture radar, different scenes and observation conditions, and variations in rotation angle and grazing angle. The example uses the Standard Operating Conditions (SOCs) dataset constructed from MSTAR. The adversarial example generation method provided in this invention is used to attack the model under different perturbation sizes to test the model's security.

[0071] like Figure 3 The figure shows the attack success rate curves of the adversarial example generation method (STEG) provided by this invention under different perturbation sizes; where the x-axis represents the teacher's iteration steps and the y-axis represents the attack success rate. The adversarial examples were generated on the AConvNet network, and the white-box attack effects on the AConvNet network and the black-box attack effects on ResNet-18, VGG-16, and Inception-v3 networks were tested respectively. Figure 2 It can be seen that STEG with different iteration steps for different teachers can improve the attack success rate, and the improvement generally increases with the increase of the number of iteration steps for different teachers. Specifically, the highest attack success rates for AConvNet, ResNet-18, VGG-16, and Inception-v3 reached 95.30%, 60.70%, 74.39%, and 51.68%, respectively. This demonstrates that the adversarial example generator provided by this invention exhibits superior attack transferability in real-world black-box scenarios.

[0072] In summary, this invention aims to improve the attack performance of SAR automatic target recognition models in real-world black-box scenarios by utilizing the relevant characteristics of SAR images. This invention can effectively generate SAR image adversarial samples with a high attack success rate, thereby effectively deceiving SAR automatic target recognition models in black-box scenarios. This invention has the following advantages: (1) It is more in line with the characteristics of SAR data and is suitable for military and civilian SAR-ATR practical application scenarios; (2) It performs well in black-box attacks and fully considers the strategies of attackers to improve the attack success rate when lacking detailed information about the target model; (3) It has stronger adaptability and robustness and can cope with different target models and defense strategies.

[0073] This invention fully considers attackers' strategies to increase attack success rates when detailed target model information is lacking, and the generated adversarial examples achieve better attack performance compared to existing benchmark methods. This invention is more consistent with the characteristics of SAR image data and can play a better role in practical military and civilian SAR-ATR applications.

[0074] Secondly, the present invention provides a security assessment method for an automatic target recognition model for SAR images, comprising:

[0075] For each SAR image sample in the pre-collected SAR sample dataset, the adversarial sample generation method provided in the first aspect of the present invention is used to generate a corresponding adversarial sample; each adversarial sample is input into the SAR automatic target recognition model to be evaluated to obtain the corresponding target recognition result;

[0076] The accuracy of the identification results is calculated by comparing the differences between the identification results of each adversarial example and the corresponding real results; the higher the accuracy of the identification results, the better the security of the SAR automatic target identification model.

[0077] The related technical solutions are the same as the adversarial example generation method provided in the first aspect of this invention, and will not be described in detail here.

[0078] Thirdly, the present invention provides a security assessment method system for an automatic target recognition model of SAR, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor executes the security assessment method provided in the second aspect of the present invention when executing the computer program.

[0079] The relevant technical solutions are the same as the safety assessment method provided in the second aspect of this invention, and will not be described in detail here.

[0080] Fourthly, the present invention also provides a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed by a processor, it controls the device where the storage medium is located to execute the adversarial example generation method for SAR images provided in the first aspect of the present invention and / or the security assessment method provided in the second aspect of the present invention.

[0081] The related technical solutions are the same as the adversarial sample generation method provided in the first aspect of this invention and the security assessment method provided in the second aspect of this invention, and will not be described in detail here.

[0082] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for generating adversarial examples for SAR images, characterized in that, include: S1. For any pre-collected SAR image sample x carrying a target identification tag y, initialize the corresponding teacher adversarial sample as an image sample with random perturbation added to x, initialize the gradient vector of the corresponding teacher adversarial sample to 0, and use a gradient-based iterative attack method to alternately update the teacher adversarial sample and its gradient vector, obtaining the gradient vector g' of the teacher adversarial sample obtained from the last update; let t = 0, and under the iteration index t, let the gradient vector g' of the teacher adversarial sample be... t =g', the gradient vector g of the student's adversarial example t =0, the student adversarial sample corresponding to x S2, Using the teacher's adversarial example x' t The initialization is performed on the SAR image sample after adding random perturbations; the gradient update formula in the gradient-based iterative attack method is used to continue updating the gradient vector of the teacher adversarial sample, resulting in g'. t+1 ; The gradient update formula is used to update the gradient vector of the student adversarial example, and g' is added at a preset ratio during the update process. t+1 , to obtain g t+1 This guides students to update adversarial samples and obtain... S3. Determine if t is less than T. If so, let t = t + 1 and go to step S2. Otherwise, take the last obtained student adversarial sample as the adversarial sample corresponding to x. T is a positive integer.

2. The adversarial example generation method according to claim 1, characterized in that, The gradient-based iterative attack method is an iterative attack method based on gradient and momentum.

3. The adversarial example generation method according to claim 2, characterized in that, In step S2, Where μ is momentum; J(x') t Let y) be the loss function for the automatic recognition task of SAR images, representing the loss function of the teacher adversarial sample x'. t The difference between the target recognition result obtained by automatic target recognition of SAR images after inputting into a deep learning model and the target recognition label y; J(x') represents t ,y) against teacher adversarial sample x' t The derivative of ; ||·||1 denotes the first norm.

4. The adversarial example generation method according to claim 3, characterized in that, In step S2, Where μ is momentum and γ is a preset weight value.

5. The adversarial example generation method according to claim 4, characterized in that, γ is a parameter that gradually decreases as the number of iterations in step S2 increases.

6. The adversarial example generation method according to any one of claims 1-5, characterized in that, In step S1, the teacher adversarial sample corresponding to x is initialized as an image sample in x after adding a random perturbation that satisfies a uniform distribution, specifically as follows: in, This represents the uniform distribution function; α is a preset parameter.

7. The adversarial example generation method according to any one of claims 1-5, characterized in that, In step S2, the teacher adversarial sample x' t The initialization involves adding image samples to the SAR image sample whose amplitude gradually decreases with the increase of the iteration number in step S2 and satisfies a uniform distribution of random perturbation. Specifically: in, Let represent the uniform distribution function; α is a preset parameter; β is a parameter that gradually decreases as the number of iterations in step S2 increases.

8. A security assessment method for an automatic target recognition model of SAR images, characterized in that, include: For each SAR image sample in the pre-collected SAR sample dataset, the adversarial sample generation method described in any one of claims 1-7 is used to generate a corresponding adversarial sample; each adversarial sample is input into the SAR automatic target recognition model to be evaluated to obtain the corresponding target recognition result; The accuracy of the identification results is calculated by comparing the differences between the identification results of each adversarial example and the corresponding real results. A higher accuracy rate in the identification results indicates better security of the SAR automatic target identification model.

9. A security assessment method system for an automatic target recognition model of SAR, characterized in that, include: A memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the security assessment method of claim 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed by a processor, it controls the device on which the storage medium is located to perform the adversarial example generation method for SAR images according to any one of claims 1-7 and / or the security assessment method according to claim 8.

Images