A property scattering center model driven backdoor injection method and system
The backdoor injection method driven by the attribute scattering center model solves the problems of insufficient effectiveness and stealth in synthetic aperture radar and automatic target recognition systems, and achieves efficient backdoor injection and image classification result modification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SUN YAT SEN UNIV
- Filing Date
- 2023-12-19
- Publication Date
- 2026-06-09
AI Technical Summary
Existing backdoor injection methods lack effectiveness and stealth in synthetic aperture radar (SAR) and automatic target recognition (ATR) systems. They fail to effectively consider the radar's prior knowledge and real-world scenarios, resulting in trigger designs that lack radar characteristics and physical meaning, making them easy to detect.
A backdoor injection method driven by the attribute scattering center model is adopted. By acquiring a synthetic aperture radar dataset, preprocessing and standardizing it, constructing a trigger, and injecting it into a clean sample to form a backdoor sample, the backdoor sample is constructed using the parameters of the attribute scattering center model and the radar echo response. This backdoor sample is then injected to improve effectiveness and stealth.
Efficient backdoor injection in synthetic aperture radar systems was achieved, improving the effectiveness and stealth of triggers, making backdoor samples difficult to detect in image classification, and effectively altering model classification results.
Smart Images
Figure CN117872287B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of image classification technology, and in particular to a backdoor injection method and system driven by an attribute scattering center model. Background Technology
[0002] With the widespread application of deep learning, backdoor injection strategies occurring during the training phase primarily utilize the internal mechanisms of neural network models. By introducing subtle, imperceptible changes, they induce the model to make incorrect classifications or detections, exhibiting significant vulnerability to minor perturbations. Currently, backdoor injection strategies represent a new and more threatening attack paradigm against deep learning, ensuring the model still performs well on normal test sets. However, existing methods mainly focus on optical images, neglecting prior knowledge from Synthetic Aperture Radar (SAR) or Automatic Target Recognition (ATR) systems and the expertise in SAR image acquisition, resulting in lower injection effectiveness. Furthermore, existing methods are mostly digital attacks, while real-world radar-based attacks primarily occur in the physical world. These methods fail to consider real-world scenarios such as targets being injected with triggers before being captured and imaged by radar. Trigger designs lack clear radar characteristics and physical meaning, making them easily detectable by radar. In conclusion, current backdoor injection methods suffer from low effectiveness and low stealth. Summary of the Invention
[0003] The following is an overview of the subject matter described in detail herein. This overview is not intended to limit the scope of the claims.
[0004] This invention provides a backdoor injection method and system driven by an attribute scattering center model, which effectively improves effectiveness and stealth.
[0005] On one hand, embodiments of the present invention provide a backdoor injection method driven by an attribute scattering center model, comprising the following steps:
[0006] Obtain the raw binary dataset of synthetic aperture radar;
[0007] The original binary dataset of the synthetic aperture radar is preprocessed to obtain pixel amplitude, pixel phase, azimuth angle, radar center frequency and radar signal bandwidth.
[0008] Based on the attribute scattering center model, the azimuth angle, the radar center frequency, and the radar signal bandwidth, the backscattering field of the radar target is conceptualized as the superposition of local scattering fields to obtain the first radar echo response.
[0009] The first radar echo response is standardized to obtain the target radar echo response.
[0010] A trigger is constructed based on the radar parameters, the parameters of the attribute scattering center model, and the target radar echo response;
[0011] Based on the pixel amplitude and the pixel phase, the trigger is injected into a clean sample to obtain a backdoor sample, which is used to characterize the backdoor injection result.
[0012] In some embodiments, the preprocessing of the raw binary dataset of the synthetic aperture radar to obtain pixel amplitude, pixel phase, azimuth angle, radar center frequency, and radar signal bandwidth includes:
[0013] Based on the target category, the pixel amplitude and pixel phase are extracted from the target center of the raw binary dataset of the synthetic aperture radar.
[0014] The azimuth angle during synthetic aperture imaging is extracted from the raw binary dataset of the synthetic aperture radar.
[0015] Extract the radar center frequency and radar signal bandwidth from the metadata of the synthetic aperture radar raw binary dataset.
[0016] In some embodiments, the standardization process of the first radar echo response to obtain the target radar echo response includes:
[0017] At the scattering center in the polarization plane, the first radar echo response is sampled to obtain the second radar echo response;
[0018] Based on the frequency range and angular range, the second radar echo response is sampled onto a rectangular grid in the Cartesian plane to obtain the third radar echo response;
[0019] The third radar echo response is normalized to obtain the target radar echo response.
[0020] In some embodiments, constructing a trigger based on radar parameters, parameters of the attribute scattering center model, and the target radar echo response includes:
[0021] Calculate radar echo frequency domain data based on radar parameters, the parameters of the attribute scattering center model, and the target radar echo response;
[0022] The radar echo frequency domain data is windowed.
[0023] The radar echo frequency domain data after windowing is zero-padding to obtain the radar echo data matrix.
[0024] Clutter is filtered out from the radar echo data matrix according to a preset clutter threshold.
[0025] A two-dimensional inverse Fourier transform is performed on the radar echo data matrix after clutter filtering to obtain first image domain complex data. The first image domain complex data includes the scattering center amplitude and scattering center phase. The first image domain complex data is used to characterize the trigger.
[0026] In some embodiments, injecting the trigger into a clean sample based on the pixel amplitude and the pixel phase to obtain a backdoor sample includes:
[0027] Based on the poisoning rate, a predetermined number of clean samples are selected from the training set;
[0028] Based on the pixel amplitude and pixel phase in the clean sample, a first complex expression is constructed, the first complex expression including a first real part and a first imaginary part;
[0029] Based on the scattering center amplitude and scattering center phase of the first image domain complex data in the trigger, a second complex expression is constructed, the second complex expression including a second real part and a second imaginary part;
[0030] Add the first real part and the second real part to obtain the third real part;
[0031] Add the first imaginary part and the second imaginary part to obtain the third imaginary part;
[0032] Calculate the second image domain complex data based on the third real part and the third imaginary part;
[0033] Take the absolute value of the second image domain complex data to obtain the target image domain complex data;
[0034] The backdoor sample is obtained by injecting complex data of the target image domain into the clean sample through a trigger.
[0035] In some embodiments, after obtaining the backdoor sample, the method further includes:
[0036] Obtain the sample to be classified;
[0037] The sample to be classified is input into the target classification model to obtain the classification result;
[0038] The target classification model is obtained through the following steps:
[0039] Obtain a clean sample;
[0040] Based on the model loss function, attack success rate, and clean sample accuracy, the backdoor sample and the clean sample are input into a preset classification model to train the preset classification model and obtain the target classification model.
[0041] In some embodiments, the calculation formula for the target radar echo response is as follows:
[0042]
[0043] In the formula, E(f) x f y ;θ) is the target radar echo response, f x f is the frequency in the upward direction of the distance. y Here, A is the frequency in the azimuth direction, A is the relative amplitude of the echo, j is the complex unit, and f is the frequency in the azimuth direction. c γ is the center frequency. p The relationship is azimuth-dependent, where c is the propagation speed of the electromagnetic signal, and φ is the azimuth angle dependence. m It is the azimuth angle. L is the angle between the scattering center and the normal to the radar beam. p For pixel-level length, η y For zero-padding in the azimuth direction, (x p y p ) represents the pixel location of the scattering center, (p x p y () represents the distance between adjacent pixels.
[0044] In some embodiments, the model loss function is calculated using the following formula:
[0045]
[0046] In the formula, ML is the model loss function, f w The injected model is represented by w, the model parameters are represented by N, the total number of samples is represented by L, and the cross-entropy loss function is represented by y. targ et For the target label, D poisoned Let x′ be a sample in the training dataset and y be the label of the sample.
[0047] On the other hand, embodiments of the present invention provide a backdoor injection system driven by an attribute scattering center model, comprising:
[0048] The first module is used to acquire the raw binary dataset of synthetic aperture radar.
[0049] The second module is used to preprocess the original binary dataset of the synthetic aperture radar to obtain pixel amplitude, pixel phase, azimuth angle, radar center frequency and radar signal bandwidth.
[0050] The third module is used to conceptualize the backscattered field of the radar target as a superposition of local scattered fields based on the attribute scattering center model, the azimuth angle, the radar center frequency and the radar signal bandwidth, to obtain the first radar echo response.
[0051] The fourth module is used to standardize the first radar echo response to obtain the target radar echo response;
[0052] The fifth module is used to construct a trigger based on the radar parameters, the parameters of the attribute scattering center model, and the target radar echo response;
[0053] The sixth module is used to inject a clean sample into the trigger according to the pixel amplitude and the pixel phase to obtain a backdoor sample, wherein the backdoor sample is used to characterize the backdoor injection result.
[0054] On the other hand, embodiments of the present invention provide a backdoor injection system driven by an attribute scattering center model, comprising:
[0055] At least one processor;
[0056] At least one memory for storing at least one program;
[0057] When the at least one program is executed by the at least one processor, the at least one processor implements the method.
[0058] The beneficial effects of this invention are as follows:
[0059] This invention first acquires the original binary dataset of synthetic aperture radar (SAR), preprocesses it to obtain pixel amplitude, pixel phase, azimuth angle, radar center frequency, and radar signal bandwidth, then conceptualizes the backscattered field of the radar target as a superposition of local scattered fields to obtain the first radar echo response. The first radar echo response is then standardized to obtain the target radar echo response. Based on the radar parameters, the parameters of the attribute scattering center model, and the target radar echo response, a trigger is constructed. Finally, the trigger is injected into a clean sample to obtain a backdoor sample, thus realizing image backdoor injection and improving effectiveness and stealth.
[0060] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the description, claims, and drawings. Attached Figure Description
[0061] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0062] Figure 1 This is a flowchart of a backdoor injection method driven by an attribute scattering center model according to an embodiment of the present invention;
[0063] Figure 2 This is a schematic diagram of a standardization process in a Cartesian coordinate system according to an embodiment of the present invention;
[0064] Figure 3 This is a schematic diagram illustrating how polar coordinate format data is resampled onto a rectangular grid in a Cartesian plane according to an embodiment of the present invention.
[0065] Figure 4 This is a schematic diagram illustrating the construction process of a trigger according to an embodiment of the present invention;
[0066] Figure 5 This is a schematic diagram of a backdoor sample construction process according to an embodiment of the present invention;
[0067] Figure 6 This is a schematic diagram of a TSNE visualization result according to an embodiment of the present invention;
[0068] Figure 7 This is a schematic diagram of the original image in a GradCAM visualization result according to an embodiment of the present invention;
[0069] Figure 8 This is a schematic diagram illustrating the prediction of the original image in a GradCAM visualization result according to an embodiment of the present invention;
[0070] Figure 9 This is a schematic diagram of a backdoor image in a GradCAM visualization result according to an embodiment of the present invention;
[0071] Figure 10 This is a schematic diagram of backdoor image prediction in GradCAM visualization results according to an embodiment of the present invention;
[0072] Figure 11 This is a schematic diagram of the original image in a sample according to an embodiment of the present invention;
[0073] Figure 12 This is a schematic diagram of a backdoor image in a sample of an embodiment of the present invention, in which a trigger has been injected.
[0074] Figure 13 This is a schematic diagram of the residual between the original image and the backdoor image according to an embodiment of the present invention;
[0075] Figure 14 This is a schematic diagram illustrating how to construct a backdoor training dataset as model input according to an embodiment of the present invention;
[0076] Figure 15 This is a schematic diagram of a target classification model for testing a backdoor implanted in an embodiment of the present invention;
[0077] Figure 16 This is a flowchart illustrating the overall process of training a target classification model according to an embodiment of the present invention. Detailed Implementation
[0078] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.
[0079] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”
[0080] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.
[0081] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.
[0082] Before providing a further detailed description of the embodiments of this application, the nouns and terms used in the embodiments of this application are explained as follows:
[0083] Backdoor injection refers to an attack during the training phase where an attacker uses data poisoning to embed a hidden backdoor into a deep neural network (DNN) using training data with triggers. In other words, during testing, the backdoor remains unactivated on benign samples, allowing the model to perform normally. However, when faced with poisoned samples containing triggers, the hidden backdoor in the DNN model is activated, and the model classifies the sample into a category pre-specified by the attacker.
[0084] Synthetic Aperture Radar (SAR) is a high-resolution imaging radar that can obtain high-resolution radar images similar to optical photography even in extremely low visibility weather conditions. It utilizes the relative motion between the radar and the target to synthesize a larger equivalent antenna aperture from smaller real antenna apertures through data processing; hence, it is also called synthetic aperture radar. The characteristics of SAR are high resolution, all-weather operation, and effective identification of camouflage and penetration of concealment. The resulting high azimuth resolution is equivalent to that provided by a large-aperture antenna.
[0085] The attribute scattering center model is a mathematical model that describes the characteristics of SAR radar imaging. This model equates the target's back echo response to multiple independent scattering center responses. Scattering centers accurately describe the characteristics of the scattered echo and have good physical correlation.
[0086] Automatic target recognition (ATR) is an algorithm or device that identifies targets or objects based on data acquired by sensors. Target recognition was initially accomplished by receiving audible signals; trained operators would classify targets based on the sound produced when radar illuminated them. While trained operators were successful, automated methods have also been developed and continue to evolve towards higher classification accuracy and speed. Automatic target recognition can be used to identify man-made objects, such as ground targets and aircraft, as well as biological targets (e.g., animals, humans, and plant clutter). This is useful for identifying and filtering interference from large flocks of birds on Doppler weather radar in battlefield situations.
[0087] The embodiments of this application will be explained in detail below with reference to the accompanying drawings:
[0088] like Figure 1 As shown, this embodiment of the invention provides a backdoor injection method driven by an attribute scattering center model. This method can be applied to the background processor, server, or cloud device corresponding to backdoor injection software. In application, this method includes, but is not limited to, the following steps:
[0089] Step S11: Obtain the original binary dataset of synthetic aperture radar.
[0090] In this embodiment, binary data can be obtained from the measured SAR ground stationary target data with a resolution of 0.3m published by the Research Programme (RPA), resulting in a raw binary dataset of synthetic aperture radar with ten categories and two elevation angles of 15° and 17°. The target categories, based on vehicle type, include BMP2 (infantry fighting vehicle, SN_9563), BTR70 (armored personnel carrier, SN_C71), T72 (tank, SN_132), 2S1 (self-propelled howitzer), BRDM2 (armored reconnaissance vehicle), BTR60 (armored personnel carrier), D7 (bulldozer), T62 (tank), ZIL131 (freight truck), and ZSU234 (self-propelled anti-aircraft gun).
[0091] Step S12: Preprocess the original binary dataset of the synthetic aperture radar to obtain pixel amplitude, pixel phase, azimuth angle, radar center frequency and radar signal bandwidth.
[0092] In this embodiment, the raw binary dataset of synthetic aperture radar is preprocessed to obtain pixel amplitude, pixel phase, azimuth angle, radar center frequency and radar signal bandwidth. This can be done by first extracting pixel amplitude and pixel phase from the target center of the raw binary dataset of synthetic aperture radar according to the target category, then extracting the azimuth angle of synthetic aperture imaging from the raw binary dataset of synthetic aperture radar, and finally extracting the radar center frequency and radar signal bandwidth from the metadata of the raw binary dataset of synthetic aperture radar.
[0093] In this embodiment, 128×128 complex data points are first extracted from the original binary dataset of the synthetic aperture radar (SAR) for each type of target, starting from the target center, to obtain the pixel amplitude and pixel phase of each pixel. Then, the azimuth data for synthetic aperture imaging of each target is extracted from the original binary dataset. Finally, imaging parameters such as the radar center frequency fc = 9.599 GHz, radar signal bandwidth B = 0.591 GHz, and the distance between adjacent pixels are extracted from the metadata in the original binary dataset. Furthermore, in this embodiment, data with an elevation angle of 15° is used as the training set, and complex data with an elevation angle of 17° is used as the test set.
[0094] Step S13: Based on the attribute scattering center model, azimuth angle, radar center frequency, and radar signal bandwidth, the backscattering field of the radar target is conceptualized as the superposition of local scattering fields to obtain the first radar echo response.
[0095] In this embodiment, a parametric model, namely the Attribute Scattering Center (ASCM) model, is introduced. The ASCM exhibits characteristics of both local and distributed scattering mechanisms in terms of frequency and azimuth dependence and physical properties (such as structure and size), providing a concise and physically relevant description of the scatterer. A trigger is constructed using a mathematically simulated radar echo response. In this embodiment, the total radar echo response can be represented using the mathematical formula of the Attribute Scattering Center model. The ASCM conceptualizes the backscattered field of the radar target as a superposition of local scattered fields, yielding the first radar echo response. The expression for the total radar echo response is:
[0096]
[0097] The expression for the first radar echo response is:
[0098]
[0099] In the formula, E(f, φ; Θ) N ) represents the total radar echo response, N is the number of scattering centers constituting the object, f is the frequency of the radar echo, φ is the azimuth angle, and the frequency range is f∈[f c -B / 2,f c +B / 2], in GHz, f c B is the center frequency, B is the bandwidth, and the parameter Θ is... N = [θ1, ..., θ N ], E i (f, φ; θ) i Let be the first radar echo response of the i-th attribute scattering center, and the parameter set be... A i Let x be the relative amplitude of the echo from the i-th attribute scattering center. i Let y be the position of the i-th attribute scattering center in the range direction. i Let α be the position of the i-th attribute scattering center in the azimuth direction. i It is a frequency-dependent relationship, γ i For azimuth dependence, L i Let be the length of the scattering center of the i-th attribute. Let be the angle between the scattering center and the normal to the radar beam, and let c be the propagation speed of the electromagnetic signal, c = 3 × 10⁻⁶. 8 m / s, where j is a complex unit.
[0100] Step S14: Standardize the first radar echo response to obtain the target radar echo response.
[0101] In this embodiment, the first radar echo response is normalized to obtain the target radar echo response. This can be achieved by first sampling the first radar echo response at the scattering center in the polarization plane to obtain the second radar echo response, then sampling the second radar echo response onto a rectangular grid in the Cartesian plane according to the frequency range and angular range to obtain the third radar echo response, and finally normalizing the third radar echo response to obtain the target radar echo response.
[0102] In this embodiment, as Figure 2 As shown, the second radar echo response E in polar coordinates can be obtained by sampling the first radar echo response of the scattering center in the polarization plane at m and n points in the frequency band and azimuth angle. m×n (f, φ), then as follows Figure 3 The diagram shows the resampling of the second radar echo response in the polar coordinate domain onto a rectangular grid in the Cartesian plane, within the frequency range f∈[f c -B / 2,f c +B / 2] and the angular range φ∈[-φ m / 2, φ m Uniform sampling is performed in [ / 2] to obtain the third radar echo response E. m×n (f x f y ), where the polar coordinates (f, φ) are converted to rectangular coordinates (f x f y ), f x and f y Let represent the frequencies in the range and azimuth directions, respectively. Finally, the attribute scattering centers, resampled to the Cartesian plane, are normalized to obtain the target radar echo response. The equations for the normalization transformation are as follows:
[0103]
[0104]
[0105]
[0106] γ p =γ·2πf c
[0107]
[0108] In the formula, (x p y p ) represents the pixel position of the scattering center, L p p is a pixel-level length x and p yLet L be the distance between adjacent pixels, L be the length of the scattering center, x be the position of the scattering center in the range direction, y be the position of the scattering center in the azimuth direction, and f be the distance between adjacent pixels. c γ is the center frequency. p For azimuth dependence, φ m It is the azimuth angle. The angle between the scattering center and the normal to the radar beam.
[0109] In this embodiment, the formula for calculating the target radar echo response is as follows:
[0110]
[0111] In the formula, E(f) x f y ;θ) represents the target radar echo response, f x f is the frequency in the upward direction of the distance. y Here, A is the frequency in the azimuth direction, A is the relative amplitude of the echo, j is the complex unit, and f is the frequency in the azimuth direction. c γ is the center frequency. p The relationship is azimuth-dependent, where c is the propagation speed of the electromagnetic signal, and φ is the azimuth angle dependence. m It is the azimuth angle. L is the angle between the scattering center and the normal to the radar beam. p For pixel-level length, η y For zero-padding in the azimuth direction, (x p y p ) represents the pixel location of the scattering center, (p x p y () represents the distance between adjacent pixels.
[0112] Step S15: Construct a trigger based on radar parameters, parameters of the attribute scattering center model, and target radar echo response.
[0113] In this embodiment, as Figure 4 As shown, the specific implementation process of step S15 includes, but is not limited to, steps S201-S205:
[0114] Step S201: Calculate the radar echo frequency domain data based on the radar parameters, the parameters of the attribute scattering center model, and the target radar echo response.
[0115] In this embodiment, radar parameters and ASCM (Attribute Scattering Center Model) parameters can be set first, and the range of ASCM parameters can be limited. Setting radar parameters includes obtaining a local scattering center with an azimuth of 0 when L = 0, and obtaining a distributed scattering center with an azimuth consistent with the azimuth of the target being attacked when L > 0. Limiting the range of ASCM parameters includes restricting the positions x and y of the scattering centers to be on the MSTAR target. Setting ASCM parameters includes constraining the frequency dependence to be a multiple of 0.5, with an absolute value equal to or less than 1, and setting the number N of scattering centers in the simulated radar echo. This embodiment can deduce the scattering structure corresponding to the scattering center by accurately obtaining the parameters of the attribute scattering center model. Then, based on the radar parameters, the parameters of the attribute scattering center model, and the target radar echo response, an m×n frequency matrix describing the scattering center is obtained, i.e., the radar echo frequency domain data.
[0116] Step S202: Window the radar echo frequency domain data;
[0117] Step S203: Zero-padding is performed on the windowed radar echo frequency domain data to obtain the radar echo data matrix;
[0118] Step S204: Clutter filtering is performed on the radar echo data matrix according to the preset clutter threshold;
[0119] Step S205: Perform a two-dimensional inverse Fourier transform on the radar echo data matrix after clutter filtering to obtain the first image domain complex data. The first image domain complex data includes the scattering center amplitude and the scattering center phase. The first image domain complex data is used to characterize the trigger.
[0120] In this embodiment, a -35dB Charle window is first applied to the simulated radar echo frequency domain data to eliminate sidelobe effects. Then, zero-padding is performed on the windowed radar echo frequency domain data to obtain a 128×128 radar echo data matrix. Next, a preset clutter threshold is set to -13dB to filter clutter from the radar echo data matrix. Finally, a two-dimensional inverse Fourier transform is performed on the clutter-filtered radar echo data matrix to convert it to the image domain, resulting in 128×128 first image domain complex data. The first image domain complex data contains scattering center amplitude and phase information, and is used as a trigger.
[0121] Step S16: Based on the pixel amplitude and pixel phase, inject the trigger into a clean sample to obtain a backdoor sample. The backdoor sample is used to characterize the backdoor injection result.
[0122] In this embodiment, the specific implementation process of step S16 includes, but is not limited to, steps S301-S308:
[0123] Step S301: Select a preset number of clean samples from the training set according to the poisoning rate.
[0124] In this embodiment, the poisoning rate can be set to 0.1, excluding samples from the original specified category, and randomly selecting 10% of samples from other categories in the training set, such as selecting 242 images. Then, the attack method is set to all2one mode, where the attacked model f(x) identifies the sample with the implanted trigger as the specified target y. t arg et And change the label of the selected sample to the specified category. For example, f(x) = y represents that the original label of sample x is y, and f(B(x)) = y t arg et The label of sample B(x) after the trigger is implanted is changed to y. t arg et .
[0125] Step S302: Construct a first complex number expression based on the pixel amplitude and pixel phase in the clean sample. The first complex number expression includes a first real part and a first imaginary part.
[0126] In this embodiment, all amplitude and phase information of each selected clean SAR complex data frame can be read and converted into a first complex number expression consisting of a first real part and a first imaginary part. Specifically, in the conversion relationship, the cosine of the phase angle is multiplied by the amplitude to obtain the converted real part, and the sine of the phase angle is multiplied by the amplitude to obtain the converted imaginary part. The first complex number expression is:
[0127] Re(Z)=A·cos(θ), Im(Z)=A·sin(θ)
[0128] In the formula, Re is the first real part, Im is the first imaginary part, Z is a complex number, A is the amplitude of the complex number Z, and θ is the phase angle.
[0129] Step S303: Based on the scattering center amplitude and scattering center phase of the complex data in the first image domain of the trigger, construct a second complex expression, which includes a second real part and a second imaginary part;
[0130] Step S304: Add the first real part and the second real part to obtain the third real part;
[0131] Step S305: Add the first imaginary part and the second imaginary part to obtain the third imaginary part;
[0132] Step S306: Calculate the complex data of the second image domain based on the third real part and the third imaginary part;
[0133] Step S307: Take the absolute value of the complex data in the second image domain to obtain the complex data in the target image domain;
[0134] Step S308: Inject complex data of the target image domain into a clean sample using a trigger to obtain a backdoor sample.
[0135] In this embodiment, the scattering center amplitude and scattering center phase of the first image domain complex data in the constructed trigger can be read first, and converted into a second complex expression with a second real part plus a second imaginary part, and then as follows: Figure 5 As shown, the real parts are added together, and the imaginary parts are added together, i.e., the first real part and the second real part are added together to obtain the third real part. The first imaginary part and the second imaginary part are added together to obtain the third imaginary part. Then, based on the third real part and the third imaginary part, the complex data of the second image domain after the SAR data is injected into the trigger is calculated. Then, the absolute value of the complex data of the second image domain is taken to obtain the complex data of the target image domain. Finally, the complex data of the target image domain is enhanced with grayscale and injected with clean samples to obtain a backdoor sample of a new SAR image containing a trigger with physical meaning. For example, this can be repeated 242 times, injecting the trigger into each selected sample and replacing the original clean sample image to obtain the backdoor sample set.
[0136] In this embodiment, after obtaining the backdoor sample, the method further includes:
[0137] Obtain the sample to be classified;
[0138] Input the sample to be classified into the target classification model to obtain the classification result.
[0139] In this embodiment, samples to be classified are first obtained, and then input into the target classification model to obtain classification results. For the trained target classification model with the backdoor implanted, the attack success rate (ASR) and clean sample accuracy (ACC) can be calculated using a test dataset to verify the classification performance of the target classification model. In this embodiment, the calculated attack success rate is 88.8%, and the clean sample accuracy is 86.5%. The results show that the constructed trigger not only has geometric meaning and physical realizability but also achieves a good injection effect. After obtaining the classification results, the feature attention level of the image can be visualized using visualization techniques such as TSNE or GradCAM. Then, the original image, the backdoor sample, and their residuals can be displayed to examine the attack concealment, making the classification results easier to view and understand. The TSNE visualization results are as follows: Figure 6 As shown in the TSNE results, it is clear that samples from each category cluster into unique clusters, indicating that under normal circumstances (without a backdoor trigger), the SAR / ATR model can learn and distinguish different categories well. The black data points marked "Poisoned," representing backdoor samples, are very close to but largely separated from the attacked class 2S1. This shows that after a backdoor trigger is injected, their representation in the feature space is very close to the target class, demonstrating that only a small perturbation is needed in the high-dimensional feature domain to achieve efficient target misdirection. In the GradCAM visualization results, the original image is as follows... Figure 7 As shown, the prediction of the original image is as follows: Figure 8 As shown, the backdoor image is as follows Figure 9 As shown, the prediction of the backdoor image is as follows: Figure 10 As shown in the GradCAM results, clean samples are classified normally, while backdoor samples are identified as specific targets. The heatmap shows the region the model focused on when making this prediction. The figure shows that for this backdoor image, the heatmap's region of interest is very similar to the original image, especially around the target in the center of the image. This indicates that the implanted backdoor trigger did not significantly change the main features the model focused on, but it was enough to make the model change its prediction. This further demonstrates the stealth and efficiency of the backdoor trigger. In the residual comparison, the original image is as follows... Figure 11 As shown, the backdoor image is as follows Figure 12 As shown, the residuals of the two are as follows Figure 13 As shown in the comparison, the original image and the backdoor image appear very similar visually, with almost no obvious differences, demonstrating the stealth of the trigger. A few bright spots in the residual image indicate the specific location of the trigger, but because they are so small, they are difficult to detect in actual SAR images.
[0140] In this embodiment, the target classification model is obtained through the following steps:
[0141] Obtain a clean sample;
[0142] Based on the model loss function, attack success rate, and clean sample accuracy, backdoor samples and clean samples are input into a preset classification model to train the preset classification model and obtain the target classification model.
[0143] In this embodiment, as Figure 14 As shown, clean samples can be obtained first, and then triggers can be injected into the clean samples to obtain backdoor samples. Multiple backdoor samples can be combined to form a backdoor dataset D. poisoned Then, based on the model loss function, attack success rate (ASR, i.e., the prediction accuracy of the poisoned sample to the target class) and clean sample accuracy (ACC, i.e., the prediction accuracy of the poisoned sample to the original class), the backdoor sample x is... ′ Clean samples are used as the training set to input into a pre-defined classification model to train the model and obtain the target classification model. The classification performance of the trained target classification model is as follows: Figure 15As shown, classifying clean test samples yields the correct label, while classifying backdoor test samples yields the specified target label. During training, for example, stochastic gradient descent (SGD) can be used with 100 epochs, a batch size of 128, optimizer weight decay and momentum set to 0.0005 and 0.9 respectively, and the learning rate initialized to 0.01, to train the preset classification model. In this embodiment, the formula for calculating the model loss function is as follows:
[0144]
[0145] In the formula, ML is the model loss function, f w The injected model is represented by w, the model parameters are represented by N, the total number of samples is represented by L, and the cross-entropy loss function is represented by y. t arg et For the target label, D poisoned Let x′ be the training dataset, x′ be a sample in the training dataset, and y be the label of the sample.
[0146] The formula for calculating the attack success rate is as follows:
[0147]
[0148] In the formula, ASR represents the attack success rate, and N... poisoned For dataset D poisoned The total number of backdoor samples in N success The number of samples that the model misclassifies as the target category specified by the attacker.
[0149] The formula for calculating the accuracy of clean samples is as follows:
[0150]
[0151] In the formula, ACC is the clean sample accuracy, and N is the clean sample accuracy. correct N represents the number of clean samples correctly classified by the target classification model. clean For dataset D poisoned Number of clean samples.
[0152] In this embodiment, the overall process of training the target classification model is as follows: Figure 16As shown, a trigger with radar characteristics and physical meaning is designed based on the Attribute Scattering Center (ASCM) model to inject a backdoor into the SAR / ATR system. First, clean SAR data is acquired. Then, to design a physically meaningful trigger adapted to SAR / ATR tasks, the ASCM model is introduced. Parameters are set according to actual conditions, such as radar parameters consistent with the target data. The azimuth angle of the scattering center is set based on the target azimuth angle. The scattering center parameters are constrained within a reasonable range to have clear geometric meaning and physical information, enabling the inversion of the scattering structure corresponding to the scattering center. Furthermore, pixel-level mathematical expressions can be obtained through normalization. After data preprocessing, the data is converted to the image domain to construct the trigger. The designed trigger is then injected into training data to implant a backdoor into the recognition model, allowing the trained model to classify according to the attacker's requirements.
[0153] The beneficial effects of implementing the embodiments of the present invention include: First, the embodiments of the present invention obtain the original binary dataset of synthetic aperture radar, preprocess the original binary dataset of synthetic aperture radar to obtain pixel amplitude, pixel phase, azimuth angle, radar center frequency and radar signal bandwidth, then conceptualize the backscattering field of the radar target as the superposition of local scattering fields to obtain the first radar echo response, standardize the first radar echo response to obtain the target radar echo response, then construct a trigger according to the radar parameters, the parameters of the attribute scattering center model and the target radar echo response, and finally inject the trigger into a clean sample to obtain a backdoor sample, thereby realizing image backdoor injection and improving effectiveness and stealth.
[0154] This invention also provides a backdoor injection system driven by an attribute scattering center model, comprising:
[0155] The first module is used to acquire the raw binary dataset of synthetic aperture radar.
[0156] The second module is used to preprocess the raw binary dataset of synthetic aperture radar to obtain pixel amplitude, pixel phase, azimuth angle, radar center frequency and radar signal bandwidth.
[0157] The third module is used to conceptualize the backscattered field of the radar target as a superposition of local scattered fields based on the attribute scattering center model, azimuth angle, radar center frequency and radar signal bandwidth, to obtain the first radar echo response.
[0158] The fourth module is used to standardize the first radar echo response to obtain the target radar echo response;
[0159] The fifth module is used to construct triggers based on radar parameters, parameters of the attribute scattering center model, and target radar echo response;
[0160] The sixth module is used to inject clean samples into the trigger based on the pixel amplitude and pixel phase to obtain backdoor samples, which are used to characterize the backdoor injection results.
[0161] The content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.
[0162] This invention also provides a backdoor injection system driven by an attribute scattering center model, comprising:
[0163] At least one processor;
[0164] At least one memory for storing at least one program;
[0165] When at least one program is executed by at least one processor, such that at least one processor achieves Figure 1 The method shown.
[0166] The content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.
[0167] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.
Claims
1. A backdoor injection method driven by an attribute scattering center model, characterized in that, Includes the following steps: Obtain the raw binary dataset of synthetic aperture radar; The original binary dataset of the synthetic aperture radar is preprocessed to obtain pixel amplitude, pixel phase, azimuth angle, radar center frequency and radar signal bandwidth. Based on the attribute scattering center model, the azimuth angle, the radar center frequency, and the radar signal bandwidth, the backscattering field of the radar target is conceptualized as the superposition of local scattering fields to obtain the first radar echo response. The first radar echo response is standardized to obtain the target radar echo response. A trigger is constructed based on the radar parameters, the parameters of the attribute scattering center model, and the target radar echo response; Based on the pixel amplitude and the pixel phase, the trigger is injected into a clean sample to obtain a backdoor sample, which is used to characterize the backdoor injection result.
2. The method according to claim 1, characterized in that, The preprocessing of the raw binary dataset of the synthetic aperture radar to obtain pixel amplitude, pixel phase, azimuth angle, radar center frequency, and radar signal bandwidth includes: Based on the target category, the pixel amplitude and pixel phase are extracted from the target center of the raw binary dataset of the synthetic aperture radar. The azimuth angle during synthetic aperture imaging is extracted from the raw binary dataset of the synthetic aperture radar. Extract the radar center frequency and radar signal bandwidth from the metadata of the synthetic aperture radar raw binary dataset.
3. The method according to claim 1, characterized in that, The standardization process for the first radar echo response to obtain the target radar echo response includes: At the scattering center in the polarization plane, the first radar echo response is sampled to obtain the second radar echo response; Based on the frequency range and angular range, the second radar echo response is sampled onto a rectangular grid in the Cartesian plane to obtain the third radar echo response; The third radar echo response is normalized to obtain the target radar echo response.
4. The method according to claim 1, characterized in that, The step of constructing a trigger based on radar parameters, the parameters of the attribute scattering center model, and the target radar echo response includes: Calculate radar echo frequency domain data based on radar parameters, the parameters of the attribute scattering center model, and the target radar echo response; The radar echo frequency domain data is windowed. The radar echo frequency domain data after windowing is zero-padding to obtain the radar echo data matrix. Clutter is filtered out from the radar echo data matrix according to a preset clutter threshold. A two-dimensional inverse Fourier transform is performed on the radar echo data matrix after clutter filtering to obtain first image domain complex data. The first image domain complex data includes the scattering center amplitude and scattering center phase. The first image domain complex data is used to characterize the trigger.
5. The method according to claim 4, characterized in that, The step of injecting the trigger into a clean sample to obtain a backdoor sample based on the pixel amplitude and the pixel phase includes: Based on the poisoning rate, a predetermined number of clean samples are selected from the training set; Based on the pixel amplitude and pixel phase in the clean sample, a first complex expression is constructed, the first complex expression including a first real part and a first imaginary part; Based on the scattering center amplitude and scattering center phase of the first image domain complex data in the trigger, a second complex expression is constructed, the second complex expression including a second real part and a second imaginary part; Add the first real part and the second real part to obtain the third real part; Add the first imaginary part and the second imaginary part to obtain the third imaginary part; Calculate the second image domain complex data based on the third real part and the third imaginary part; Take the absolute value of the second image domain complex data to obtain the target image domain complex data; The backdoor sample is obtained by injecting complex data of the target image domain into the clean sample through a trigger.
6. The method according to claim 1, characterized in that, After obtaining the backdoor sample, the method further includes: Obtain the sample to be classified; The sample to be classified is input into the target classification model to obtain the classification result; The target classification model is obtained through the following steps: Obtain a clean sample; Based on the model loss function, attack success rate, and clean sample accuracy, the backdoor sample and the clean sample are input into a preset classification model to train the preset classification model and obtain the target classification model.
7. The method according to claim 3, characterized in that, The formula for calculating the target radar echo response is as follows: In the formula, E(f) x ,f y ;θ) is the target radar echo response, f x f is the frequency in the upward direction of the distance. y Here, A is the frequency in the azimuth direction, A is the relative amplitude of the echo, j is the complex unit, and f is the frequency in the azimuth direction. c γ is the center frequency. p The relationship is azimuth-dependent, where c is the propagation speed of the electromagnetic signal, and φ is the azimuth angle dependence. m It is the azimuth angle. L is the angle between the scattering center and the normal to the radar beam. p For pixel-level length, η y For zero-padding in the azimuth direction, (x p y p ) represents the pixel location of the scattering center, (p x p y () represents the distance between adjacent pixels.
8. The method according to claim 6, characterized in that, The formula for calculating the model loss function is as follows: In the formula, ML is the model loss function, f w The injected model is represented by w, the model parameters are represented by N, the total number of samples is represented by L, and the cross-entropy loss function is represented by y. target For the target label, D poisoned For the training dataset, x ′ Let y be a sample in the training dataset, and y be the label corresponding to the sample.
9. A backdoor injection system driven by an attribute scattering center model, characterized in that, include: The first module is used to acquire the raw binary dataset of synthetic aperture radar. The second module is used to preprocess the original binary dataset of the synthetic aperture radar to obtain pixel amplitude, pixel phase, azimuth angle, radar center frequency and radar signal bandwidth. The third module is used to conceptualize the backscattered field of the radar target as a superposition of local scattered fields based on the attribute scattering center model, the azimuth angle, the radar center frequency and the radar signal bandwidth, to obtain the first radar echo response. The fourth module is used to standardize the first radar echo response to obtain the target radar echo response; The fifth module is used to construct a trigger based on the radar parameters, the parameters of the attribute scattering center model, and the target radar echo response; The sixth module is used to inject a clean sample into the trigger according to the pixel amplitude and the pixel phase to obtain a backdoor sample, wherein the backdoor sample is used to characterize the backdoor injection result.
10. A backdoor injection system driven by an attribute scattering center model, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method as described in any one of claims 1-8.