Radar image adversarial sample generation and target detection attack method based on meta-adversarial despeckling network

Abstract

The invention provides a radar image adversarial sample generation and target detection attack method based on a meta-adversarial despeckle network, and the method comprises the steps: constructing a simulated speckle filtering data set for an optical image data set based on a speckle statistical model; training a despeckle network based on the constructed simulation speckle filtering data set, and constructing a real SAR image target detection and filtering data set in combination with a real SAR detection data set; constructing a meta-adversarial despeckle network training framework, and training a meta-adversarial despeckle network model by using a real SAR image target detection and filtering data set; and using the trained meta-adversarial despeckle network model to carry out adversarial despeckle processing on the original SAR image. The method is simple in principle and easy and convenient to implement, and the speckle removing result has high black box attack ability while keeping a high-quality image; and the method has a wide attack application scene.

Description

Technical Field

[0001] The present invention relates to the field of radar image application security, and in particular to a radar image adversarial sample generation and target detection attack method based on a meta-adversarial despeckling network. Background Art

[0002] As an active microwave sensor, synthetic aperture radar (SAR) has the ability to observe and image the earth all day and all weather. It has achieved many successful applications in the civil and military fields, involving disaster detection, land cover mapping, target detection and recognition, etc. In recent years, radar imaging technology has developed rapidly, and the resolution of SAR images has been significantly improved. How to efficiently and accurately detect artificial targets from massive high-resolution SAR images has received more and more attention. With the expansion of SAR target detection data sets, target detection algorithms based on deep learning have developed rapidly and achieved great success. Limited by the SAR imaging mechanism, coherent speckle noise always exists, which damages the performance of the detection algorithm. In order to suppress noise interference, the integrated algorithm of cascaded coherent speckle filtering and target detection has gradually received attention and achieved significant performance improvement. However, recent studies have shown that deep neural networks are vulnerable to adversarial samples, and their predictions can be made wrong by adding perturbations that are difficult to detect with the naked eye to benign samples. This phenomenon has aroused people's attention to the security of current integrated deep learning algorithms. The present invention conducts adversarial attacks on the current integrated method of cascade filtering and detection, and proposes a radar image adversarial sample generation and target detection attack method based on a meta-adversarial despeckling network. Summary of the invention

[0003] In view of the shortcomings of the prior art, the present invention provides a radar image adversarial sample generation and target detection attack method based on a meta-adversarial despeckling network.

[0004] To achieve the above purpose, the technical solution adopted by the present invention is as follows: A radar image adversarial sample generation and target detection attack method based on a meta-adversarial despeckling network, comprising: For the optical image data set, a simulated speckle filtering data set is constructed based on the speckle statistical model; The despeckling network is trained based on the constructed simulated speckle filtering dataset, and combined with the real SAR detection dataset, a real SAR image target detection and filtering dataset is constructed; Construct a meta-adversarial despeckling network training framework and use real SAR image target detection and filtering datasets to train the meta-adversarial despeckling network model; The trained meta-adversarial despeckling network model is used to perform adversarial despeckling on the original SAR image.

[0005] Furthermore, the step of constructing a simulated speckle filter data set comprises the following steps: Based on the optical image data set, the first v images Construct the equivalent view number as Simulated speckle image of , forming a training data pair ; Among them, the coherent speckle statistical model is

[0006] Indicates the image size, To simulate the coherent speckle image, represents the Hadamrd product, is the optical image data image, is a coherent spot; in the case of unit mean and variance In the case of Gamma distribution, The probability density distribution of

[0007] in, represents the gamma distribution, It is the number of views in the process of optical image formation; All training data pairs in the optical image dataset Construct the speckle filter data set for the simulation.

[0008] Furthermore, the construction of a real SAR image target detection and filtering dataset comprises the following steps: Training the despeckling network based on the constructed simulated speckle filtering dataset , and load the despeckle network Trained weights; Despeckle Network The trained weights are used for the first r images Perform inference to obtain the corresponding despeckled image , forming a real SAR detection data set data pair ; All data pairs in the real SAR detection dataset Construct a real SAR image target detection and filtering dataset.

[0009] Furthermore, the construction of the meta-adversarial despeckle network training framework includes: Based on the given inclusion U Model set of proxy detection models , randomly selected times, each extraction t +1 proxy detection model, consisting of tasks, each of which also includes a random sample from a real SAR detection dataset. K images, each image is regarded as a training sample. i In each task, the training samples are recorded as , ; Each task includes a meta-training phase and a meta-testing phase, and a meta-adversarial despeckle network training framework is constructed with the meta-training phase and the meta-testing phase; In each task, the previous t The proxy detection models are used in the meta-training phase, and the last proxy detection model is used in the meta-testing phase; In the meta-training phase, t A proxy detection model ensemble attack despeckle network Get the trained adversarial despeckle network ; In the meta-test phase, the trained adversarial despeckle network is used Attacking the last proxy detection model makes the generated adversarial images easier to transfer to other proxy detection models.

[0010] Furthermore, in the meta-training phase and meta-test phase of each task, the MAE-based Spot loss and The total loss function of confidence loss is used to train the despeckle network model. The total loss function is .

[0011] Furthermore, the MAE-based The spot removal loss is

[0012]

[0013] in, To detect real SAR images and its ground truth despeckled SAR image Set the despeckle image; For the i Task No. j Sample images The true despeckled image, , .

[0014] Furthermore, the The confidence loss is

[0015] in, Represents the number of prediction boxes generated by the proxy detection model; Represents the true value of the label box; Represents the set of matching prediction boxes, , and Respectively represent g Prediction box The center point coordinates and their corresponding length and width; define Indicates g The predicted boxes correspond to the label boxes; The type of the target object in the prediction box; It is the logit output, indicating the probability that the predicted box is the true target; Indicates the number of label boxes; represents the weight assigned to the loss, which is set to 0.5 to ensure a balance between the two tasks.

[0016] Furthermore, the meta-training includes: For i tasks, which include training samples ,use t Proxy Detection Model Integration of the despeckle network Generate adversarial despeckle images; for the i Task No. j The first training sample m The confidence loss of the proxy detection model can be expressed as , ; Combine the confidence losses of all proxy detection models, for the i of the tasks j training samples, the total confidence loss of all proxy detection models is

[0017] in, Represents the input real SAR detection image The adversarial despeckled image generated by the adversarial filtering network when ; is the weight of each proxy model, ,and ; The minimum confidence loss and despeckle loss are used to jointly optimize the adversarial despeckle network. The objective optimization function of meta-training is:

[0018] in , ; And further expand the above formula as follows: .

[0019] Furthermore, the meta-test includes: Adopt the trained adversarial despeckle network model to attack the last sampled proxy detection model , enter K +1 test sample , by calculating The confidence loss further optimizes the trained adversarial despeckle network

[0020] Referring to the meta-training process, the objective optimization function of the meta-testing process is .

[0021] A radar image adversarial sample generation and target detection attack system based on a meta-adversarial despeckling network, comprising: A simulated speckle filter data set construction module is used to construct a simulated speckle filter data set for an optical image data set based on a speckle statistical model; A module for constructing a real SAR image target detection and filtering dataset, which is used to train a despeckling network based on the constructed simulated speckle filtering dataset, and to construct a real SAR image target detection and filtering dataset in combination with the real SAR detection dataset; Meta-adversarial despeckling network construction training module, which is used to build a meta-adversarial despeckling network training framework and use real SAR image target detection and filtering data sets to train the meta-adversarial despeckling network model; The original SAR image processing module uses the trained meta-adversarial despeckling network model to perform adversarial despeckling on the original SAR image.

[0022] A computer device comprises a memory and a processor, wherein the memory has a computer program, and when the processor executes the computer program, the following steps are implemented: For the optical image data set, a simulated speckle filtering data set is constructed based on the speckle statistical model; The despeckling network is trained based on the constructed simulated speckle filtering dataset, and combined with the real SAR detection dataset, a real SAR image target detection and filtering dataset is constructed; Construct a meta-adversarial despeckling network training framework and use real SAR image target detection and filtering datasets to train the meta-adversarial despeckling network model; The trained meta-adversarial despeckling network model is used to perform adversarial despeckling on the original SAR image.

[0023] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps: For the optical image data set, a simulated speckle filtering data set is constructed based on the speckle statistical model; The despeckling network is trained based on the constructed simulated speckle filtering dataset, and combined with the real SAR detection dataset, a real SAR image target detection and filtering dataset is constructed; Construct a meta-adversarial despeckling network training framework and use real SAR image target detection and filtering datasets to train the meta-adversarial despeckling network model; The trained meta-adversarial despeckling network model is used to perform adversarial despeckling on the original SAR image.

[0024] The above-mentioned radar image adversarial sample generation and target detection attack method, system, computer device and storage medium based on meta-adversarial despeckle network can use despeckle images to generate adversarial samples, so as to achieve the effect of covertly attacking the proxy detection model to make it lose the target. The present invention constructs different tasks by randomly sampling multiple proxy detection models, constructs a meta-adversarial despeckle network training framework in the constructed tasks in two stages of meta-training and meta-testing, simulates white-box attacks in the meta-training stage, and trains the despeckle network to generate adversarial samples in a model integration manner by combining the confidence losses of multiple proxy detection models; in the meta-testing stage, simulates black-box attacks, and uses a temporarily trained despeckle network to attack an unseen proxy detection model; in each task iteration, simulates white-box attacks and black-box attacks to further optimize the despeckle network and enhance the migration attack capability of the despeckle network; uses the trained adversarial despeckle network to perform coherent speckle filtering on the images in the SAR detection test set to obtain adversarial despeckle images that effectively attack multiple proxy detection models. The present invention has a simple principle and is easy to implement. The despeckle results have strong black-box attack capabilities while maintaining high-quality images.

[0025] The present invention uses a real SAR detection data set to train a speckle removal network model, which can improve the generalization ability of the trained speckle removal network model in practical applications and make the trained speckle removal network model more adaptable to real scenarios.

[0026] For the real SAR detection dataset in the present invention, in addition to using the existing public SAR ship detection dataset, the SAR artificial target detection datasets of different bands, different polarization modes and different resolutions, such as aircraft detection datasets, vehicle detection datasets, etc., can also be subjected to adversarial despeckling processing. Therefore, the present invention has a wider range of attack application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0028] Figure 1 A schematic flow chart of a radar image adversarial sample generation and target detection attack method based on a meta-adversarial despeckling network provided by an embodiment; Figure 2 A schematic diagram of a meta-adversarial despeckle network training framework provided by an embodiment; Figure 3 A schematic diagram of a U-Net network structure provided by an embodiment; Figure 4 This is a graph of the detection results of the anti-speckle removal provided by an embodiment. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] Reference Figure 1 In one embodiment, a radar image adversarial sample generation and target detection attack method based on a meta-adversarial despeckling network is provided, comprising: For the optical image data set, a simulated speckle filtering data set is constructed based on the speckle statistical model; The despeckling network is trained based on the constructed simulated speckle filtering dataset, and combined with the real SAR detection dataset, a real SAR image target detection and filtering dataset is constructed; Construct a meta-adversarial despeckling network training framework and use real SAR image target detection and filtering datasets to train the meta-adversarial despeckling network model; The trained meta-adversarial despeckling network model is used to perform adversarial despeckling on the original SAR image.

[0031] Multiplicative speckle in SAR images is the main reason for reducing the quality of SAR images.

[0032] The step of constructing a simulated speckle filter data set comprises the following steps: Based on the optical image data set, the first v images Construct the equivalent view number as Simulated speckle image of , forming a training data pair ; Among them, the coherent speckle statistical model is

[0033] Indicates the image size, To simulate the coherent speckle image, represents the Hadamrd product, is the optical image data image, is a coherent spot; in the case of unit mean and variance In the case of Gamma distribution, The probability density distribution of

[0034] in, represents the gamma distribution, It is the number of views in the process of optical image formation; All training data pairs in the optical image dataset Construct the speckle filter data set for the simulation.

[0035] In one embodiment, based on the optical image dataset Waterloo, the first v image Construct the equivalent view number as Simulated speckle image of , forming a training data pair ; All training data pairs in Waterloo The simulated speckle filtering dataset that constitutes Waterloo. The optical image dataset Waterloo contains 4744 optical images, which can obtain 4744 sets of training data pairs.

[0036] For a given original SAR image And the parameters are and Despeckle Network Adversarial Despeckle Network , the despeckled image and the adversarial despeckled image can be expressed as and , assuming The attack parameters are Proxy Detection Model .set up Contains E label box truth values ,in , and Respectively represent the e-th label box The center point coordinates and their corresponding length and width, is the type of the target object in the label box, , when the category is m, For a true value target ,assumed exist If the target is successfully detected, and . For adversarial samples , and the test results are ( Can be empty, ), if it can satisfy and The IoU between them is less than 0.5 or , which means the detector has been successfully attacked.

[0037] The construction of a real SAR image target detection and filtering dataset comprises the following steps: Training the despeckling network based on the constructed simulated speckle filtering dataset , and load the despeckle network Trained weights; Despeckle Network The trained weights are used for the first r images Perform inference to obtain the corresponding despeckled image , forming a real SAR detection data set data pair ; All data pairs in the real SAR detection dataset Construct a real SAR image target detection and filtering dataset.

[0038] In one embodiment, the real SAR ship detection data set SSDD is r images Perform inference to obtain the corresponding despeckled image ; Data pair Combining all the images in the real SAR ship detection dataset SSDD, we can get 928 sets of training data pairs. , forming the final real SAR image target detection and filtering dataset, which is used to train the meta-adversarial despeckling network.

[0039] Using real SAR detection data sets to train the despeckling network model can improve the generalization ability of the trained despeckling network model in practical applications and make the trained despeckling network model more suitable for real scenarios.

[0040] Reference Figure 2 , the construction of the meta-adversarial despeckle network training framework includes: Based on the given inclusion U Model set of proxy detection models ,in , represents the adversarial despeckle attack against a single detection network; random sampling times, each extraction t +1 proxy detection model, consisting of tasks, each of which also includes a random sample from a real SAR detection dataset. K images, each image is regarded as a training sample. i In each task, the training samples are recorded as , ; Each task includes a meta-training phase and a meta-testing phase, and a meta-adversarial despeckle network training framework is constructed with the meta-training phase and the meta-testing phase; In each task, the previous t The proxy detection models are used in the meta-training phase, and the last proxy detection model is used in the meta-testing phase; In the meta-training phase, t A proxy detection model ensemble attack despeckle network Get the trained adversarial despeckle network , which is equivalent to simulating a white-box attack; in the meta-test phase, the trained adversarial despeckle network is used Attacking the last proxy detection model is equivalent to simulating a black-box attack, making the generated adversarial images easier to migrate to other proxy detection models.

[0041] In the meta-training and meta-testing phases of each task, the MAE-based Spot loss and The total loss function of confidence loss is used to train the despeckle network model. The total loss function is .

[0042] The MAE-based The spot removal loss is

[0043]

[0044] in, To detect real SAR images and its ground truth despeckled SAR image Set the despeckle image; For the i Task No. j Sample images The true despeckled image, , .

[0045] Using MAE-based Despeckle loss to supervise adversarial despeckle network , to ensure that the output SAR image quality is improved.

[0046] Adding confidence loss To attack the target confidence learning process of the proxy detection model, the despeckled SAR image can fool the current mainstream proxy detection model and lose most of the target boxes. For each image in the training sample, the proxy detection model first generates prediction box, and then according to the overlap rate of the center coordinate and the anchor box, Each label box in is assigned the best matching anchor box and prediction vector. The confidence loss aims to destroy the confidence of the proxy detection model in the positive sample box to make it invalid.

[0047] Said The confidence loss is

[0048] in, Represents the number of prediction boxes generated by the proxy detection model; Represents the true value of the label box; Represents the set of matching prediction boxes, , and Respectively represent g Prediction box The center point coordinates and their corresponding length and width; define Indicates g The predicted boxes correspond to the label boxes; The type of the target object in the prediction box; It is the logit output, indicating the probability that the predicted box is the true target; Indicates the number of label boxes; represents the weight assigned to the loss, which is set to 0.5 to ensure a balance between the two tasks.

[0049] By combining Spot loss and The confidence loss is used to train the despeckling network model, which can destroy the confidence of the proxy detection model for the positive sample box while ensuring the output of high-quality SAR images.

[0050] The meta-training includes: For i tasks, which include training samples ,use t Proxy Detection Model An integration of (simulated white box) to guide the despeckle network Generate adversarial despeckle images; for the i Task No. j The first training sample m The confidence loss of the proxy detection model can be expressed as , ; Combine the confidence losses of all proxy detection models, for the i of the tasks j training samples, the total confidence loss of all proxy detection models is

[0051] in, Represents the input real SAR detection image The adversarial despeckled image generated by the adversarial filtering network when ; is the weight of each proxy model, ,and ; The minimum confidence loss and despeckle loss are used to jointly optimize the adversarial despeckle network to ensure high transfer aggressiveness and visual quality of the despeckled image. The objective optimization function of meta-training is:

[0052] in , ; And further expand the above formula as follows: .

[0053] The meta-tests include: After obtaining the temporarily trained adversarial despeckle network through the integrated attack in the meta-training phase, the black-box attack is simulated and the trained adversarial despeckle network model is used to attack the last sampled proxy detection model. , enter K +1 test sample , by calculating The confidence loss further optimizes the trained adversarial despeckle network

[0054] Referring to the meta-training process, the objective optimization function of the meta-testing process is .

[0055] By iteratively optimizing the objective functions of meta-training and meta-testing, the adversarial despeckling network is trained to obtain a specific weight. After loading this weight, the original benign despeckling network can output a perturbed despeckled image to attack proxy detection models of different architectures.

[0056] In one embodiment, the optical remote sensing dataset Waterloo is used to construct the visual data A dataset of simulated SAR image speckle filtering.

[0057] Reference Figure 3 , the classic U-Net network is used as the despeckling network; during inference, the real SAR ship dataset SSDD is selected as the image to be despeckled, and a real SAR image target detection and filtering dataset is constructed.

[0058] During the construction of the meta-adversarial despeckling network, 10,000 tasks were constructed by randomly extracting proxy detection models. In each task cycle, the meta-training process included 3 training samples and 4 (white-box) proxy detection models, and the meta-testing process included 1 training sample and 1 (black-box) proxy detection model. The meta-adversarial despeckling network was trained using a real SAR image target detection and filtering dataset constructed using the despeckled SSDD ship detection training set. The network optimizer selected the Adaptive Moment Estimation (ADAM) optimizer, and the optimizer parameters were set to , as well as .

[0059] The trained meta-adversarial despeckling network is used to perform adversarial despeckling on the images to be despeckled in the SSDD ship detection test set, and the despeckling effect is tested and evaluated on the trained two-stage detection model Faster-RCNN and the single-stage detection model YOLOv3. Figure 4 ,Depend on Figure 4 It can be observed that the method proposed in the present invention injects adversarial perturbations while filtering the coherent speckle noise, successfully causing the two proxy detection models to lose most of the targets. The Peak Signal-To-Noise Ratio (PSNR) index and the Attack Success Ratio (ASR) index are used to quantitatively evaluate the adversarial despeckled SAR images. The average PSNR index of all adversarial despeckled images compared with the original despeckled label images in the test set, as well as the ASR index on the two proxy detection models are shown in Table 1.

[0060] Table 1 Comparison of average PSNR results of different methods

[0061] It can be seen that the PSNR index of the method provided by the present invention is higher than 35db, has high visual quality, and the attack success rate for both is higher than 80%.

[0062] In one embodiment, a radar image adversarial sample generation and target detection attack system based on a meta-adversarial despeckling network is provided, comprising: A simulated speckle filter data set construction module is used to construct a simulated speckle filter data set for an optical image data set based on a speckle statistical model; A module for constructing a real SAR image target detection and filtering dataset, which is used to train a despeckling network based on the constructed simulated speckle filtering dataset, and to construct a real SAR image target detection and filtering dataset in combination with the real SAR detection dataset; Meta-adversarial despeckling network construction training module, which is used to build a meta-adversarial despeckling network training framework and use real SAR image target detection and filtering data sets to train the meta-adversarial despeckling network model; The original SAR image processing module uses the trained meta-adversarial despeckling network model to perform adversarial despeckling on the original SAR image.

[0063] For the specific definition of a radar image adversarial sample generation and target detection attack system based on a meta-adversarial despeckle network, please refer to the definition of a radar image adversarial sample generation and target detection attack method based on a meta-adversarial despeckle network mentioned above, which will not be repeated here. Each module in the above-mentioned radar image adversarial sample generation and target detection attack system based on a meta-adversarial despeckle network can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0064] In one embodiment, a computer device is provided, which may be a terminal. The computer device includes a processor, a memory, a network interface, a display screen, and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a radar image adversarial sample generation and target detection attack method based on a meta-adversarial despeckling network is implemented. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse.

[0065] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps in the above method embodiment when executing the computer program.

[0066] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above method embodiment are implemented.

[0067] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0068] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0069] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A radar image adversarial sample generation and target detection attack method based on a meta-adversarial despeckling network, characterized in that: include: For the optical image data set, a simulated speckle filtering data set is constructed based on the speckle statistical model; The despeckling network is trained based on the constructed simulated speckle filtering dataset, and combined with the real SAR detection dataset, a real SAR image target detection and filtering dataset is constructed; Construct a meta-adversarial despeckling network training framework and use real SAR image target detection and filtering datasets to train the meta-adversarial despeckling network model; The trained meta-adversarial despeckling network model is used to perform adversarial despeckling on the original SAR image.

2. The radar image adversarial sample generation and target detection attack method based on meta-adversarial despeckling network according to claim 1, characterized in that: The step of constructing a simulated speckle filter data set comprises the following steps: Based on the optical image data set, the first v images Construct the equivalent view number as Simulated speckle image , forming a training data pair ; Among them, the coherent speckle statistical model is Indicates the image size, To simulate the coherent speckle image, represents the Hadamrd product, is the optical image data image, is a coherent spot; in the case of unit mean and variance In the case of Gamma distribution, The probability density distribution of in, represents the gamma distribution, It is the number of views in the process of optical image formation; All training data pairs in the optical image dataset Construct the speckle filter data set for the simulation.

3. The radar image adversarial sample generation and target detection attack method based on meta-adversarial despeckling network as claimed in claim 2, characterized in that: The construction of a real SAR image target detection and filtering dataset comprises the following steps: Training the despeckling network based on the constructed simulated speckle filtering dataset , and load the despeckle network Trained weights; Despeckle Network The trained weights are used for the first r images Perform inference to obtain the corresponding despeckled image , forming a real SAR detection data set data pair ; All data pairs in the real SAR detection dataset Construct a real SAR image target detection and filtering dataset.

4. The radar image adversarial sample generation and target detection attack method based on meta-adversarial despeckling network as claimed in claim 1, characterized in that: The construction of the meta-adversarial despeckle network training framework includes: Based on the given inclusion U Model set of proxy detection models , randomly selected times, each extraction t +1 proxy detection model, consisting of tasks, each of which also includes a random sample from a real SAR detection dataset. K images, each image is regarded as a training sample. i In each task, the training samples are recorded as , ; Each task includes a meta-training phase and a meta-testing phase, and a meta-adversarial despeckle network training framework is constructed with the meta-training phase and the meta-testing phase; In each task, the previous t The proxy detection models are used in the meta-training phase, and the last proxy detection model is used in the meta-testing phase; In the meta-training phase, t A proxy detection model ensemble attack despeckle network Get the trained adversarial despeckle network ; In the meta-test phase, the trained adversarial despeckle network is used Attacking the last proxy detection model makes the generated adversarial images easier to transfer to other proxy detection models.

5. The radar image adversarial sample generation and target detection attack method based on meta-adversarial despeckling network as claimed in claim 4, characterized in that: In the meta-training and meta-testing phases of each task, the MAE-based Spot loss and The total loss function of confidence loss is used to train the despeckle network model. The total loss function is 。 6. The radar image adversarial sample generation and target detection attack method based on meta-adversarial despeckling network as claimed in claim 5, characterized in that: The MAE-based The spot removal loss is in, To detect real SAR images and its ground truth despeckled SAR image Set the despeckle image; For the i Task No. j Sample images The true despeckled image, , .

7. The radar image adversarial sample generation and target detection attack method based on meta-adversarial despeckling network as claimed in claim 5, characterized in that: Said The confidence loss is in, Represents the number of prediction boxes generated by the proxy detection model; Represents the true value of the label box; Represents the set of matching prediction boxes, , and Respectively represent g Prediction box The center point coordinates and their corresponding length and width; define Indicates g The predicted boxes correspond to the label boxes; The type of the target object in the prediction box; It is the logit output, indicating the probability that the predicted box is the true target; Indicates the number of label boxes; represents the weight assigned to the loss, which is set to 0.5 to ensure a balance between the two tasks.

8. The radar image adversarial sample generation and target detection attack method based on meta-adversarial despeckling network as claimed in claim 4, characterized in that: The meta-training includes: For i tasks, which include training samples ,use t Proxy Detection Model Integration of the despeckle network Generate adversarial despeckle images; for the i Task No. j The first training sample m The confidence loss of the proxy detection model can be expressed as , ; Combine the confidence losses of all proxy detection models, for the i of the tasks j training samples, the total confidence loss of all proxy detection models is in, Represents the input real SAR detection image The adversarial despeckled image generated by the adversarial filtering network when ; is the weight of each proxy model, ,and ; The minimum confidence loss and despeckle loss are used to jointly optimize the adversarial despeckle network. The objective optimization function of meta-training is: in , ; And further expand the above formula as follows: 。 9. The radar image adversarial sample generation and target detection attack method based on meta-adversarial despeckling network as claimed in claim 4, characterized in that: The meta-tests include: Adopt the trained adversarial despeckle network model to attack the last sampled proxy detection model , enter K +1 test sample , by calculating The confidence loss further optimizes the trained adversarial despeckle network Referring to the meta-training process, the objective optimization function of the meta-testing process is 。 10. A radar image adversarial sample generation and target detection attack system based on meta-adversarial despeckling network, characterized in that: include: A simulated speckle filter data set construction module is used to construct a simulated speckle filter data set for an optical image data set based on a speckle statistical model; A module for constructing a real SAR image target detection and filtering dataset, which is used to train a despeckling network based on the constructed simulated speckle filtering dataset, and to construct a real SAR image target detection and filtering dataset in combination with the real SAR detection dataset; Meta-adversarial despeckling network construction training module, which is used to build a meta-adversarial despeckling network training framework and use real SAR image target detection and filtering data sets to train the meta-adversarial despeckling network model; The original SAR image processing module uses the trained meta-adversarial despeckling network model to perform adversarial despeckling on the original SAR image.

Images