A method for generating adversarial examples for SAR images and its application

Abstract

This invention belongs to the field of automatic target recognition security technology for synthetic aperture radar (SAR), and discloses a method and application for generating adversarial examples for SAR images. The method includes: generating a more stable gradient prediction look-ahead direction by combining the gradient and cumulative momentum of the current data point to reduce the influence of speckle noise; then, effectively sampling the area around the data point and adjusting its weights according to its confidence score to reduce the negative impact of semantic inconsistency of the sampled data points and further stabilize the gradient update. This invention considers the problem that SAR images are prone to excessive changes in gradient direction during gradient calculation due to coherent noise. By combining the gradient of the current data point and cumulative momentum to stabilize the gradient prediction direction, and by sampling the surrounding data points through confidence scores to achieve a more stable adversarial example update direction, it can well fit the characteristics of SAR data, thereby generating high-quality adversarial examples in real-world black-box scenarios.

Description

Technical Field

[0001] This invention belongs to the field of automatic target recognition security technology for synthetic aperture radar, and more specifically, relates to a method for generating adversarial samples for SAR images and its application. Background Technology

[0002] Synthetic Aperture Radar (SAR) is widely used in both civilian and military fields because it can emit microwaves and capture high-resolution radar images under various weather conditions. In recent years, with the development of artificial intelligence and machine learning, deep learning models have been widely applied in SAR target recognition tasks. However, Szegedy et al. demonstrated in 2014 that deep learning models are easily affected by carefully designed small adversarial perturbations added to clean samples. Therefore, researching the security and robustness of deep learning models for automatic target recognition of SAR images will be a challenging task.

[0003] Adversarial attacks are a common method used to study the security and robustness of deep learning models. Generally, adversarial attacks can be divided into two categories: white-box attacks and black-box attacks. White-box attacks involve attackers possessing detailed internal information about the target deep learning model, including its architecture, parameters, and training data. Black-box attacks, on the other hand, do not know this specific information and can only explore the model's behavior through experimentation and attempt to construct deceptive inputs to cause the model to make incorrect predictions. Because SAR (Automatic Target Recognition) tasks, whether in military or civilian applications, inherently possess high levels of secrecy, attackers find it difficult to obtain information about the deep learning model used. Therefore, in real-world scenarios, black-box attacks are often more suitable for SAR automatic target recognition tasks.

[0004] A common black-box attack method is gradient-optimized transfer attack, which generates adversarial examples by fully accessing an alternative model and then using these examples to attack the target model. One common strategy for implementing transfer attacks is gradient optimization, which aims to find better local maxima in the adversarial search space to generate highly transferable adversarial examples. Existing techniques commonly use NI-FGSM (Nesterov Iterative Fast Gradient Sign Method) and EMI-FGSM (Enhanced Momentum Iterative Fast Gradient Sign Method) to generate highly transferable adversarial examples. However, NI-FGSM and EMI-FGSM are primarily designed for generating highly transferable adversarial examples from visual image data. A significant difference between SAR data and visual images is that SAR images are also affected by noise from speckle patterns. When using NI-FGSM and EMI-FGSM to generate SAR adversarial examples, the presence of speckle noise leads to excessive differences in gradient directions before and after the generation process, resulting in poor attack performance—a factor that is not considered in visual images. Therefore, when using adversarial attack methods proposed for visual image data to generate adversarial examples on SAR data, there is a significant difference between the initial and final gradient directions of the iteration. This does not well match the characteristics of SAR data, nor can it generate high-quality transferable adversarial examples in real-world black-box scenarios. Summary of the Invention

[0005] In view of the above-mentioned defects or improvement needs of the existing technology, the present invention provides a method and application for generating adversarial examples of SAR images, the purpose of which is to generate high-quality adversarial examples of SAR images in response to migration attacks in black-box scenarios.

[0006] To achieve the above objectives, according to a first aspect of the present invention, a method for generating adversarial examples for SAR images is provided, comprising:

[0007] S1. Analyze the adversarial examples for each SAR image sample x in the SAR sample dataset. Initialize to x, and initialize momentum g0 = 0;

[0008] S2. At the t-th iteration, based on the momentum g from the previous iteration... t-1 and current adversarial examples The gradient is used to calculate the current adversarial example. The look-ahead gradient g′ t ;

[0009] S3, based on current adversarial examples Starting from the data point, along the look-ahead gradient g′ t The direction, with a preset step size, generates the current adversarial example. The corresponding N predicted data points are identified, and perturbations are added to these N predicted data points. The ensemble gradient of the N predicted data points after perturbation is calculated using confidence-weighted average. Using the integrated gradient Update current adversarial examples gradient vector Obtain the updated gradient vector Using the gradient vector Update current adversarial examples Obtain updated adversarial examples and the gradient vector The momentum g in the current t-th iteration t Among them, adversarial examples Initial value of gradient vector

[0010] S4. Determine whether t is less than the preset number of iterations T. If so, let t = t + 1 and go to S2; otherwise, use the updated adversarial sample obtained in the Tth iteration as the adversarial sample of the SAR image sample x.

[0011] Furthermore, in S3, the N predicted data points after adding the perturbation are:

[0012]

[0013] in, For the i-th predicted data point after adding perturbation, i takes the values ​​1, 2, ..., N; k is the perturbation factor, ∈ is the perturbation amplitude, α is the preset step size, and δ i This represents the i-th sampled value that is uniformly sampled within a preset sampling interval [-δ, δ]; sign(·) represents the sign function.

[0014] Furthermore, in S3, the integrated gradient of the N predicted data points after perturbation is calculated using confidence-weighted calculation. for:

[0015]

[0016] Where scores[i] represents the i-th predicted data point. Confidence score; This indicates that the i-th prediction data point The difference between the target recognition result obtained by inputting the deep learning model for automatic target recognition of SAR images and the target recognition label y; express For the i-th prediction data point The derivative of .

[0017] Furthermore, the look-ahead gradient g′ t for:

[0018]

[0019] Where μ is the attenuation factor; Indicates adversarial examples The difference between the target recognition result obtained by inputting the deep learning model for automatic target recognition of SAR images and the target recognition label y; express right The derivative of , ‖·‖1 denotes the first norm.

[0020] Furthermore, the updated gradient vector for:

[0021]

[0022] The updated adversarial sample for:

[0023]

[0024] Where α is the preset step size, and sign(·) represents the sign function.

[0025] According to a second aspect of the present invention, a method for security assessment of an automatic target recognition model for SAR images is provided, comprising:

[0026] For each SAR image sample in the pre-collected SAR sample dataset, the adversarial sample generation method for SAR images described in any of the first aspects is used to generate corresponding adversarial samples; and each adversarial sample is input into the SAR automatic target recognition model to be evaluated to obtain the corresponding target recognition result.

[0027] The accuracy of the target recognition results is calculated by comparing the differences between the target recognition results of each adversarial sample and the corresponding target recognition labels; wherein, the higher the accuracy of the target recognition results, the better the security of the SAR automatic target recognition model.

[0028] According to a third aspect of the present invention, an adversarial example generation system for SAR images is provided, comprising a computer-readable storage medium and a processor;

[0029] The computer-readable storage medium is used to store executable instructions;

[0030] The processor is configured to read executable instructions stored in the computer-readable storage medium and execute the adversarial example generation method for SAR images according to any one of the first aspects.

[0031] According to a fourth aspect of the present invention, a security assessment system for an automatic target recognition model for SAR images is provided, comprising a computer-readable storage medium and a processor;

[0032] The computer-readable storage medium is used to store executable instructions;

[0033] The processor is used to read executable instructions stored in the computer-readable storage medium and execute the security assessment method of the SAR image automatic target recognition model described in the second aspect.

[0034] According to a fifth aspect of the invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements an adversarial example generation method for SAR images as described in any of the first aspects, and / or implements a security assessment method for an automatic target recognition model for SAR images as described in the second aspect.

[0035] According to a sixth aspect of the present invention, a computer program product is provided, which, when run on a computer, causes the computer to execute the SAR image adversarial example generation method according to any one of the first aspects, and / or execute the security assessment method of the SAR image automatic target recognition model according to the second aspect.

[0036] In summary, the above-described technical solutions conceived in this invention can achieve the following beneficial effects:

[0037] (1) The adversarial sample generation method for SAR images in this invention combines current adversarial samples. The gradient and cumulative momentum (momentum g obtained from the previous iteration) t-1 That is, the gradient vector obtained by updating the gradient vector of the adversarial example using the ensemble gradient of N predicted data points (to reflect the semantic preservation enhancement momentum) generates a more stable look-ahead gradient direction to stabilize the update direction of the adversarial example, thereby mitigating the impact of speckle noise; then, along the look-ahead gradient direction, in the current adversarial example... Effective sampling is performed on the surrounding data points, and the gradients of the N predicted data points after weighted sampling are used to obtain the integrated gradient of the predicted data points based on their confidence scores. Due to this integration gradient By weighting the gradients of N predicted data points, the negative impact of semantic inconsistency between sampled data points (predicted data points) can be reduced, and the gradient update direction can be further stabilized, thereby further alleviating the problem of excessive differences in gradient directions before and after. This momentum enhancement attack method based on semantic preservation, as proposed in this invention, can generate adversarial examples for high-quality SAR images in migration attacks in black-box scenarios. Attached Figure Description

[0038] Figure 1 This is a schematic diagram of the adversarial sample generation method for SAR images in an embodiment of the present invention.

[0039] Figure 2 This represents the average attack success rate (ASR) of adversarial sample attacks on eight target models generated using different methods in this embodiment of the invention. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0041] Example 1

[0042] like Figure 1 As shown in the embodiment of the present invention, an adversarial example generation method for SAR images is provided, comprising:

[0043] S1. Let t = 0; for any pre-acquired SAR image sample x carrying a target identification tag y, its adversarial sample... Initialize to x, and initialize momentum g0 = 0; where t represents the number of iterations;

[0044] S2. At the current t-th iteration, based on the momentum g from the previous iteration... t-1 and current adversarial examples The gradient is used to calculate the current adversarial example. The look-ahead gradient g′ t ;

[0045] S3, based on current adversarial examples Starting from the data point, along the lookahead gradient g′ t The direction, with a preset step size, generates the current adversarial example. The corresponding N predicted data points are identified, and perturbations are added to these N predicted data points. The ensemble gradient of the N predicted data points after perturbation is calculated using confidence-weighted average. Using integrated gradients Update current adversarial examples gradient vector Obtain the updated gradient vector And use the updated gradient vector Update current adversarial examples Obtain updated adversarial examples Updated adversarial examples As the current adversarial example for the next iteration, and the updated gradient vector The momentum g in the current t-th iteration t Among them, adversarial examples Initial value of gradient vector

[0046] S4. Determine whether t is less than the preset number of iterations T. If so, let t = t + 1 and go to step S2. Otherwise, use the updated adversarial sample obtained in the Tth iteration as the adversarial sample of the SAR image sample x. Where T is a positive integer.

[0047] In a preferred embodiment, in S2, the momentum g is based on the momentum g from the previous iteration. t-1 and current adversarial examples The gradient is used to calculate the current adversarial sample. The look-ahead gradient g′ t for:

[0048]

[0049] Where μ is the attenuation factor. In this embodiment of the invention, the attenuation factor μ = 1. In other embodiments, it can also be selected based on experience or through experimentation. The function J() represents the loss function of the SAR image automatic target recognition model. Indicates adversarial examples The difference between the target recognition result obtained by inputting into the SAR image automatic target recognition model and the target recognition label y; express right The derivative of , ‖·‖1 denotes the first norm.

[0050] In a preferred implementation, in S3, the i-th predicted data point after perturbation is added. for:

[0051]

[0052] Where i takes the values ​​1, 2, ..., or N; α is the preset step size; sign(·) represents the sign function; δ iThis represents the i-th sampled value uniformly sampled within a preset sampling interval [-δ, δ]; k is the perturbation factor, and ∈ represents the perturbation amplitude. The relevant parameters can be selected empirically or experimentally. In this embodiment of the invention, N = 5, and the value of α is the perturbation magnitude ∈ divided by the iteration number T, i.e.: Used to control the size of the updated adversarial sample in each iteration cycle; perturbation factor k = 5; δ = 3.

[0053] In a preferred embodiment, in S3, the integrated gradient of the N predicted data points after perturbation is calculated using confidence-weighted calculation. for:

[0054]

[0055] Where scores[i] represents the i-th predicted data point. The confidence scores, in this embodiment of the invention, scores[i] represents the white-box confidence scores, that is, the confidence scores of the predicted data points on the surrogate model; Let be the loss function for the automatic identification task of SAR images, representing the loss function of the i-th predicted data point. The difference between the target recognition result obtained by automatic target recognition of SAR images after inputting into a deep learning model and the target recognition label y; express For the i-th prediction data point The derivative of .

[0056] As a preferred implementation, gradient integration is used. Update current adversarial examples gradient vector The resulting updated gradient vector for:

[0057]

[0058] Use the updated gradient vector Update current adversarial examples The obtained updated adversarial examples for:

[0059]

[0060] The adversarial example generation method for SAR images in this invention combines current adversarial examples. The gradient and cumulative momentum (momentum g obtained from the previous iteration) t-1That is, the gradient vector obtained by updating the gradient vector of the adversarial example using the ensemble gradient of N predicted data points (to reflect the semantic preservation enhancement momentum) generates a more stable look-ahead gradient direction to stabilize the update direction of the adversarial example, thereby mitigating the impact of speckle noise; then, along the look-ahead gradient direction, in the current adversarial example... Effective sampling is performed on the surrounding data points, and the gradients of the N predicted data points after weighted sampling are used to obtain the integrated gradient of the predicted data points based on their confidence scores. Due to this integration gradient By weighting the gradients of N predicted data points, the negative impact of semantic inconsistency between sampled data points (predicted data points) can be reduced, and the gradient update direction can be further stabilized, thereby further alleviating the problem of excessive differences in gradient directions before and after. This momentum enhancement attack method based on semantic preservation, as proposed in this invention, can generate adversarial examples for high-quality SAR images in migration attacks in black-box scenarios.

[0061] This invention addresses the problem that SAR images, due to coherent noise, can easily cause excessive changes in gradient direction during gradient calculation. It incorporates current adversarial examples... The gradient and cumulative momentum stabilize the gradient prediction direction, and the surrounding data points are sampled by confidence to achieve a more stable adversarial example update direction. This can well fit the characteristics of SAR data, thereby generating high-quality adversarial examples suitable for migration attacks in black-box scenarios.

[0062] Experiments show that the adversarial example generation method provided by this invention can improve the success rate of black-box migration attacks and enhance the accuracy of security detection. In addition, it can also be used to strengthen deep learning models. For example, during the training process, adding the generated adversarial examples to the dataset can further build a more robust model, thereby effectively defending against adversarial example attacks.

[0063] The adversarial example generation method provided by this invention can not only improve the success rate of migration attacks in black-box scenarios, but also improve the success rate of white-box attacks. It is an effective method for evaluating the security and robustness of SAR automatic identification models.

[0064] The method of the present invention will be further explained below with reference to specific examples.

[0065] Input a clean SAR sample dataset X = {x1, x2, ... x n} and the corresponding label set Y = {y1, y2, ... y nIn this embodiment of the invention, the typical SAR target dataset MSTAR (The Moving and Stationary Target Acquisition and Recognition) is used. The MSTAR dataset, collected and released by Sandia National Laboratories in the United States, contains various synthetic aperture radar (SAR) images of ground targets and variants, different scenes and observation conditions, and variations in rotation and grazing angles. The dataset selected in this embodiment is the Standard Operating Conditions (SOCs) dataset constructed from MSTAR.

[0066] For each clean sample, initialize its corresponding adversarial sample to be identical to the clean sample, i.e.: The initial momentum g0 = 0, the number of iterations T = 10, the initial value t = 0, and the decay factor μ = 1 are set. The disturbance factor is k = 5, δ = 3, and N = 5.

[0067] Through the above iterative process, the current adversarial example is output and saved. The generated adversarial example is then used to attack the model under different perturbation sizes to test the model's security.

[0068] like Figure 2 The figure shows the average attack success rate (ASR) of adversarial examples generated by different methods against eight target models; the x-axis represents the source model, and the y-axis represents the attack success rate. The adversarial examples were created on ResNet18, ResNet50, VGG16, VGG19, ResNext50, and InceptionV3 networks, and the average attack success rate was tested in a black-box scenario. Figure 2 As can be seen, the adversarial example generation method (denoted as SPMEA) provided by this invention is significantly superior to other baseline methods. Specifically, the average attack success rate of SPMEA is 13.1%, 5.3%, 21.9%, and 9.7% higher than that of NI-FGSM, MI-FGSM, VMI-FGSM, and EMI-FGSM, respectively. This demonstrates that the adversarial example generator provided by this invention exhibits superior attack transferability in real-world black-box scenarios.

[0069] In summary, this invention aims to improve the attack performance of SAR automatic target recognition models in real-world black-box scenarios by utilizing the correlation characteristics of SAR images (with obvious speckle noise). This invention can effectively generate SAR image adversarial samples with a high attack success rate, thereby effectively deceiving SAR automatic target recognition models in black-box scenarios. This invention has the following advantages: (1) It is more in line with the characteristics of SAR data and is suitable for military and civilian SAR-ATR practical application scenarios; (2) It performs well in black-box attacks, fully considering the attacker's strategy to improve the attack success rate when lacking detailed information about the target model; (3) It has stronger adaptability and robustness, and can cope with different target models and defense strategies.

[0070] This invention fully considers attackers' strategies to increase attack success rates when detailed target model information is lacking, and the generated adversarial examples achieve better attack performance compared to existing benchmark methods. This invention is more consistent with the characteristics of SAR image data and can play a better role in practical military and civilian SAR-ATR applications.

[0071] Example 2

[0072] This invention provides a security assessment method for an automatic target recognition model for SAR images, comprising:

[0073] For each SAR image sample in the pre-collected SAR sample dataset, the adversarial sample generation method provided in Embodiment 1 of this invention is used to generate a corresponding adversarial sample; each adversarial sample is input into the SAR automatic target recognition model to be evaluated to obtain the corresponding target recognition result;

[0074] The accuracy of target recognition results is calculated by comparing the differences between the target recognition results of each adversarial example and the corresponding real results (labels); the higher the accuracy of target recognition results, the better the security of the SAR automatic target recognition model.

[0075] The relevant technical solutions are described in Example 1 and will not be repeated here.

[0076] Example 3

[0077] This invention provides an adversarial example generation system for SAR images, including a computer-readable storage medium and a processor;

[0078] Computer-readable storage media are used to store executable instructions;

[0079] The processor is used to read executable instructions stored in a computer-readable storage medium and execute the method in Example 1.

[0080] The relevant technical solutions are described in Example 1 and will not be repeated here.

[0081] Example 4

[0082] This invention provides a security assessment system for an automatic target recognition model for SAR images, including a computer-readable storage medium and a processor;

[0083] Computer-readable storage media are used to store executable instructions;

[0084] The processor is used to read executable instructions stored in a computer-readable storage medium and execute the method in Embodiment 2.

[0085] The relevant technical solutions are described in Example 2 and will not be repeated here.

[0086] Example 5

[0087] This invention provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method as described in Embodiment 1, and / or, when executed, implements the method as described in Embodiment 2.

[0088] The relevant technical solutions are described in Embodiments 1 and 2, and will not be repeated here.

[0089] Example 6

[0090] This invention provides a computer program product that, when run on a computer, causes the computer to perform the method in Embodiment 1 and / or the method in Embodiment 2.

[0091] The relevant technical solutions are described in Embodiments 1 and 2, and will not be repeated here.

[0092] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for generating adversarial examples for SAR images, characterized in that, include: S1. Extract each SAR image sample from the SAR sample dataset. Adversarial examples Initialize to and initialize momentum. ; S2, in the In the next iteration, based on the momentum from the previous iteration... and current adversarial examples The gradient is used to calculate the current adversarial example. forward gradient ; S3, based on current adversarial examples Starting from the data point, along the aforementioned look-ahead gradient The direction, with a preset step size, generates the current adversarial example. corresponding One predicted data point, and for Add perturbations to each predicted data point; calculate the result after adding perturbations using confidence-weighted averages. The integrated gradient of each predicted data point ; using the integrated gradient Update current adversarial examples gradient vector The updated gradient vector is obtained. ; using the gradient vector Update current adversarial examples To obtain updated adversarial examples and the gradient vector As the current number Momentum of the next iteration Among them, adversarial examples Initial value of gradient vector ; S4, Judgment Is it less than the preset number of iterations? If so, then let And proceed to S2; otherwise, proceed to the next step. The updated adversarial sample obtained in the next iteration is used as the SAR image sample. Adversarial examples; In S3, the added perturbation The predicted data points are: in, For the first time after adding perturbation One predicted data point, Take 1, 2, ..., or ; As a disturbance factor, For the disturbance amplitude, The preset step size, Indicates the sampling interval within the preset range. The first uniform sampling within Each sample value; Represents a symbolic function; In S3, the calculation of the added perturbation using confidence-weighted calculation is described. The integrated gradient of each predicted data point for: in, Indicates the first One predicted data point Confidence score; Indicates the first One predicted data point The target recognition results and target recognition labels obtained by inputting the data into a deep learning model for automatic target recognition of SAR images The differences between them; express For the first One predicted data point The derivative of .

2. The method for generating adversarial examples for SAR images according to claim 1, characterized in that, The forward gradient for: in, It is the attenuation factor; Indicates adversarial examples The target recognition results and target recognition labels obtained by inputting the data into a deep learning model for automatic target recognition of SAR images The differences between them; express right The derivative of It represents the first norm.

3. The method for generating adversarial examples for SAR images according to claim 2, characterized in that, The updated gradient vector for: The updated adversarial sample for: in, The preset step size, Represents a symbolic function.

4. A security assessment method for an automatic target recognition model of SAR images, characterized in that, include: For each SAR image sample in the pre-collected SAR sample dataset, the adversarial sample generation method for SAR images described in any one of claims 1-3 is used to generate corresponding adversarial samples; and each adversarial sample is input into the SAR automatic target recognition model to be evaluated to obtain the corresponding target recognition result. The accuracy of the target recognition results is calculated by comparing the differences between the target recognition results of each adversarial sample and the corresponding target recognition labels; wherein, the higher the accuracy of the target recognition results, the better the security of the SAR automatic target recognition model.

5. A system for generating adversarial examples for SAR images, characterized in that, Includes computer-readable storage media and processors; The computer-readable storage medium is used to store executable instructions; The processor is used to read executable instructions stored in the computer-readable storage medium and execute the adversarial example generation method for SAR images according to any one of claims 1-3.

6. A security assessment system for an automatic target recognition model of SAR images, characterized in that, Includes computer-readable storage media and processors; The computer-readable storage medium is used to store executable instructions; The processor is used to read executable instructions stored in the computer-readable storage medium and execute the security assessment method of the SAR image automatic target recognition model according to claim 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the adversarial sample generation method for SAR images as described in any one of claims 1-3, and / or the security assessment method for the automatic target recognition model of SAR images as described in claim 4.

8. A computer program product, characterized in that, When the computer program product is run on a computer, it causes the computer to execute the adversarial sample generation method for SAR images according to any one of claims 1-3, and / or execute the security assessment method for the automatic target recognition model of SAR images according to claim 4.

Images