Adversarial sample generation method for SAR target detection guided by echo signals

Abstract

The present invention relates to the field of radar technology, and specifically to an echo signal-guided adversarial sample generation method for SAR target detection. The present invention applies a RaySAR renderer to generate an echo signal of a target object, and obtains a target image through range-Doppler imaging processing. Then, the foreground area of ​​the target image is combined with the background area provided by the background image to obtain a synthetic data set that can be applied to SAR target detection tasks. By designing different loss functions, it is demonstrated that the present invention can implement a variety of attack strategies, including disappearance attacks and classification attacks, thereby demonstrating the attack effectiveness of the present invention from multiple angles. In addition, the present invention adds adversarial perturbations to the signal domain to generate adversarial samples with clear physical meanings. For the first time, an adversarial attack is performed on a SAR target detection model in the signal domain and the attack results are migrated to the image domain and the physical domain.

Description

Technical Field

[0001] The present invention relates to the field of radar remote sensing technology, and in particular to an echo signal guided SAR target detection adversarial sample generation method. Background Art

[0002] As an active remote sensing technology, synthetic aperture radar (SAR) has the characteristics of all-weather, all-day, high-resolution, and multi-mode imaging. It is widely used in terrain mapping, disaster monitoring, resource exploration, military reconnaissance and other fields. In recent years, with the rapid development of deep neural networks (DNNs), deep learning methods based on DNNs have gradually been applied to the processing and analysis of SAR images, effectively improving the performance of target detection tasks. However, studies have shown that the robustness of DNNs in SAR image processing faces challenges, especially being vulnerable to adversarial samples, that is, by applying small, specific perturbations to the input data, the accuracy of the detection model can be significantly reduced, thereby affecting its reliability in practical applications.

[0003] The existing adversarial attack methods for SAR target detection tasks in the image domain generate adversarial perturbations pixel by pixel by drawing on the adversarial attack methods in optical images. In the prior art, a target detection task attack method based on conditional random fields is proposed. This method formulates the attack as an optimization problem and designs the context information loss to calculate the energy difference of the local feature pattern before and after the perturbation. By maximizing the energy difference, the intrinsic interaction between the target and its surrounding environment in SAR target detection is disturbed, so that the detection model is offset or even misses the target. In addition, the existing research proposes a regional adaptive local perturbation framework designed specifically for SAR target detection tasks. The local perturbation generator is used to reduce the interference of speckle noise, and the adaptive perturbation optimizer is used to adjust the perturbation size, which significantly enhances the universality and effectiveness of the attack.

[0004] However, image domain attack methods lack prior information and domain knowledge of SAR imaging, fail to establish the correspondence between perturbed pixels and radar signals, and the generated adversarial perturbations lack physical feasibility in real scenarios.

[0005] Existing studies have shown that synthetic aperture radar (SAR) image target detection models are susceptible to adversarial attacks, resulting in reduced detection performance and model robustness. However, existing adversarial sample generation methods for SAR target detection models essentially only work in the two-dimensional image domain, and have the following important defects: 1. They do not combine the scattering characteristics of the SAR target itself; 2. They do not establish the correspondence between perturbed pixels and SAR signals; 3. They do not consider the physical realization of adversarial samples. In existing adversarial attack studies on SAR target detection tasks, although image domain adversarial sample generation methods have made certain progress, these methods often cannot establish the correspondence between perturbed pixels and target physical entities, limiting their effectiveness and feasibility in real scenarios. In addition, since SAR imaging relies on the squint imaging mechanism of electromagnetic waves, that is, the image is formed by accumulating echo signals for a long time through the transceiver antenna, traditional optical physical domain attack methods are difficult to destroy the scattering response in the SAR imaging process, resulting in a lack of effective attack methods suitable for SAR scenarios at the physical level. Summary of the invention

[0006] The purpose of the present invention is to provide an echo signal guided SAR target detection adversarial sample generation method, which uses a RaySAR renderer to simulate the scattering process of electromagnetic waves irradiating on a target, thereby simulating the amplitude of the echo signal of the target in any posture, configuration or observation geometry in real time or near real time, and constructing a SAR target recognition scene after imaging processing; generating adversarial samples by modifying the amplitude of the echo signal in the signal domain, thereby establishing a corresponding relationship between the perturbed pixels in the image domain and the amplitude of the perturbation signal in the signal domain; establishing a corresponding relationship between the perturbation signal in the signal domain and the target structure in the physical domain, and modifying the scattering characteristic parameters of the target structure to construct an adversarial structure, thereby solving the problems raised in the above-mentioned background technology.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] The method for generating adversarial samples for SAR target detection guided by echo signals includes the following steps:

[0009] S1: SAR target scene construction: RaySAR renderer is used to generate the echo signal data S of the target object, and the target image is obtained through range-Doppler imaging processing. ; The target image The foreground area of ​​the image is combined with the background area of ​​the background image to obtain a synthetic dataset for SAR target detection tasks;

[0010] S2: Signal domain-image domain attack: Design specific attack loss functions for the classification subtask and regression subtask in the target detection network respectively to achieve the attack effect; based on the gradient information of the attack loss function, iteratively attack the amplitude of the echo signal data S, and generate adversarial samples that can achieve disappearance attack or target attack after range-Doppler imaging processing;

[0011] S3: Signal domain-physical domain mapping: Perturb the amplitude of the generated echo signal data S Mapping from the signal domain to the physical space, thereby establishing a mapping relationship, converting the echo signal data S into parameter changes in the physical space, thereby affecting the backscattering characteristics of the target physical entity, so that it shows the expected attack effect in the SAR imaging results;

[0012] S4: Output SAR target detection adversarial examples.

[0013] Preferably, the step S1 of applying a RaySAR renderer to generate echo signal data of the target object specifically includes:

[0014] The generation formula of echo signal data S is as follows:

[0015] ;

[0016] in, The grid data representing the 3D model of the input target physical entity, including the position and vertex coordinate information of the triangular face elements; Represents the scattering characteristic parameter set of the input 3D model, including the reflection coefficient used to describe the target material's response to radar wave scattering , scattering coefficient and surface roughness ; It represents the radar coordinates, signal receiving position and transmission direction in the SAR imaging process; Rs represents the generation function based on the RaySAR renderer.

[0017] Preferably, the target image obtained by range-Doppler imaging processing in step S1 Specifically include:

[0018] Target Image The resulting formula is expressed as follows:

[0019] ;

[0020] It represents range-Doppler imaging, including echo signal pre-compression, range compression, Doppler frequency processing and two-dimensional imaging steps; Represents parameters in the imaging process; represents the real number domain; H represents the number of samplings in the range direction; W represents the number of samplings in the azimuth direction.

[0021] Preferably, the target image in step S1 The foreground area of ​​the image is combined with the complex background of the background image to obtain a synthetic dataset for SAR target detection tasks, which includes:

[0022] Model selection: Select several typical targets from the target data set as simulation objects, obtain high-precision 3D models of these targets, and use them as the basic materials for the production of synthetic data sets;

[0023] Imaging simulation: using high-precision 3D models, a high-quality target image I is generated through a RaySAR renderer; data preprocessing operations are performed before generating the target image I, including format conversion and data standardization. The format conversion ensures that the 3D model is correctly parsed and processed by the RaySAR renderer, and the data standardization ensures the consistency of the input data; after the target image I is generated, post-processing operations are performed, including denoising, contrast adjustment, and image sharpening;

[0024] Data fusion: Perform channel separation and histogram equalization on the foreground area of ​​the target image I; locate the foreground area by extracting the index of the non-zero pixels in the foreground area, and obtain the bounding box coordinates of the foreground area by calculating the minimum circumscribed rectangle of these pixels; randomly generate the placement position of the foreground area in the predefined area in the background area of ​​the background image, and mix the foreground area with the background area pixel by pixel to generate a fused image. The fused image contains the complete annotation information of the target;

[0025] Cropping: By defining a fixed sliding cropping size and step size, the entire fused image is cropped piece by piece. Each cropped small image inherits the annotation information in the original image and adjusts the bounding box according to the position.

[0026] Preferably, step S2 specifically includes:

[0027] The C&W attack strategy is adopted to construct a specific attack loss function and use the gradient descent method to optimize the amplitude of the echo signal data S along the negative gradient direction to generate adversarial samples in the image domain.

[0028] Since the amplitude of the echo signal data S The range is limited to [0,1], so the amplitude perturbation added Constraints are imposed to ensure that , i represents the disturbance count; set the optimization parameters , and use the sigmoid function to optimize the parameters The range is limited to [0,1]. During the attack process, the parameters are optimized through continuous iteration. To generate amplitude disturbance ; Single amplitude disturbance The formula for size is as follows:

[0029] ;

[0030] Use the inverse function of the sigmoid function To initialize the optimization parameters , to ensure the similarity between the perturbation vector and the amplitude vector.

[0031] Preferably, step S2 specifically further includes:

[0032] Use a mask vector m with the same shape as the perturbation vector to control the amplitude perturbation The application range is set, and all elements of the mask vector m are initialized to 1, indicating that amplitude perturbations are allowed at all positions. ; The generated amplitude disturbance Multiply the mask vector m element by element to limit the range of effective perturbations; in each iteration, sort the elements in the perturbation vector by size, and set the corresponding positions of the elements less than a certain threshold in the mask vector m to 0, so as to eliminate unimportant perturbation points; this process is continuously optimized in multiple iterations, and finally retains the perturbation subset that has the greatest impact on the detection results, thereby achieving the goal of sparse attack;

[0033] The formula for generating adversarial samples is as follows:

[0034] ;

[0035] in, Represents element-by-element multiplication, used to control amplitude disturbance the scope of application; represents the disturbance threshold; Represents the mask vector The update rule is Greater than When , the mask vector m at the corresponding position is 1, otherwise it is 0; Represents the detection model.

[0036] Preferably, step S2 specifically further includes:

[0037] The vanishing attack is a vanishing attack that makes the detection frame completely disappear through a vanishing attack loss function; the target attack is a target attack that causes the detection frame category error through a target attack loss function.

[0038] Preferably, the disappearance attack specifically includes:

[0039] In the target image After that, the object detector first generates multiple candidate bounding boxes , is the total number of bounding boxes, each candidate box Contains central location ,size , Candidate box confidence , and the class probability vector , is the category probability of the nth target. These candidate boxes are generated by dividing the image into grids of different resolutions, and the center of each grid corresponds to a candidate box. The confidence threshold of the candidate box is set by the vanishing attack loss function. , filter out candidate bounding boxes from the model output, and reduce the detection probability of the target by minimizing the confidence scores of these candidate bounding boxes, so that the originally detected target is invisible in the final output; candidate box confidence The calculation formula is as follows:

[0040] ;

[0041] in, Indicates that the confidence threshold of the candidate box is exceeded The total number of candidate boxes, only those with higher confidence will be retained and used as the basis for calculating the loss function of the disappearing attack;

[0042] The formula of the disappearance attack loss function is as follows:

[0043] .

[0044] Preferably, the target attack specifically includes:

[0045] The product of the confidence of each candidate box and the category probability of the target category is calculated and used as an item in the attack loss function. By continuously minimizing the maximum value of this product, the model is guided to shift in the direction of the target category, and finally misleading candidate boxes are generated in the output to achieve the effect of targeted attack. The formula of the targeted attack loss function is as follows:

[0046] ;

[0047] Among them, Indicates the probability that the candidate box is classified as the target category.

[0048] Preferably, the amplitude disturbance of the generated echo signal data S in step S3 is Mapping from the signal domain to the physical space to establish a mapping relationship specifically includes:

[0049] Transform the position of a single scattering point in the echo signal data S in the range-azimuth coordinate system to match the world coordinate system of the target physical entity;

[0050] Match these scattered points with the triangles that make up the target physical entity;

[0051] Establish the mapping relationship between the amplitude s of the disturbed echo signal data S and the scattering characteristic parameters of the triangular surface elements that constitute the target physical entity: Use the single variable optimization method to calculate the scattering coefficient of the triangular surface element corresponding to each scattering point Perform bounded optimization by using the scattering coefficient Determine the optimal adversarial scattering coefficient for the corresponding triangular facet for the input optimization function , matches the amplitude s of the target echo signal S after disturbance, and the formula of the optimization function is expressed as follows:

[0052]

[0053] in, Indicates the scattering coefficient during the optimization process The associated set of adversarial scattering feature parameters; , represents the adversarial echo signal data generated after adding adversarial perturbation in the signal domain; the optimized adversarial scattering feature parameter set is expressed as .

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] The present invention proposes an echo signal guided SAR target detection adversarial sample generation method, which adds adversarial perturbations to the signal domain to generate adversarial samples with clear physical meanings. It is the first time to conduct adversarial attacks on SAR target detection models in the signal domain and transfer the attack results to the image domain and physical domain. Different from the traditional image domain attack method, the present invention adds amplitude perturbations to the amplitude of the echo signal in the signal domain, and transfers the amplitude perturbations in the signal domain to the pixel value perturbations in the image domain and the scattering characteristic parameter perturbations of the target physical structure in the physical domain through signal domain-image domain attack and signal domain-image domain mapping. The present invention uses the RaySAR renderer to generate the echo signal of the target object, and obtains the target image through range-Doppler imaging processing. Then, the foreground area of ​​the target image is combined with the background area provided by the background image to obtain a synthetic data set that can be applied to the SAR target detection task. By designing different loss functions, it is demonstrated that the present invention can realize a variety of attack strategies, including disappearance attacks and classification attacks, thereby demonstrating the attack effectiveness of the present invention from multiple angles. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1Provides a location for adding amplitude disturbance in an echo signal-guided SAR target detection adversarial sample generation method for an embodiment of the present invention;

[0057] Figure 2 A flowchart of a method for generating adversarial samples for SAR target detection guided by echo signals is provided for an embodiment of the present invention (wherein the solid arrows represent the forward propagation process, the dotted arrows represent the reverse propagation process; the serial numbers ①-② represent the echo signal generation process; the serial numbers ③-⑨ represent the signal domain-image domain attack module; the serial number ⑩ represents the signal domain-physical domain mapping module);

[0058] Figure 3 A flowchart for constructing a synthetic data set in an echo signal-guided SAR target detection adversarial sample generation method is provided for an embodiment of the present invention;

[0059] Figure 4 Provided are partial images of a synthetic data set and their annotation results in an echo signal-guided SAR target detection adversarial sample generation method for an embodiment of the present invention;

[0060] Figure 5 An embodiment of the present invention provides a schematic diagram of adversarial samples generated by an adversarial sample generation method for SAR target detection guided by echo signals. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] Before introducing the embodiments of the present invention, some terms involved in the present invention are explained.

[0063] 1. SAR adversarial attack: Adversarial samples were proposed by Goodfellow et al., and Chen et al. first introduced the concept of adversarial samples into SAR images. Adding carefully designed small perturbations , which can deceive the well-trained target detection model f to produce missed detection or wrong detection. The formula is expressed as:

[0064] ;

[0065] in Represents disturbance The size of Represents the maximum permissible value of the disturbance. We divide the existing work into two categories: image domain attack and physical domain attack according to whether it combines the SAR imaging scattering mechanism.

[0066] The image domain attack method mainly draws on the attack algorithms and frameworks in optical images and makes adaptive adjustments based on the characteristics of SAR images.

[0067] The physical domain attack method establishes an attribute parameter center model of the attack object based on physical optics (PO) and multiple reflection processes, and uses the attribute scattering center model to generate parameterized adversarial scattering centers. The adversarial scattering centers are then added to clean image samples to implement adversarial attacks on target recognition.

[0068] 2. SAR Imaging Simulation

[0069] SAR imaging simulation technology is another important way to obtain SAR images. It utilizes the powerful data processing capabilities of computers, is low-cost, easy to implement, and can flexibly simulate the impact of changes in radar system parameters and target electromagnetic scattering characteristics on imaging without being restricted by physical conditions. This application models the process of adversarial attacks as a process of fine-tuning the target scattering characteristic parameters, and uses SAR imaging simulation technology to generate adversarial samples. Doing so can not only greatly reduce the cost of the experiment and avoid uncertainty in the actual environment, but also make the added adversarial disturbance have real physical properties. SAR simulation systems can be divided into two types: feature-based SAR image simulation and echo-based SAR image simulation.

[0070] Feature-based SAR imaging simulation is also called incoherent simulation. Its core is to simulate the geometric features and scattering features of the image, and pursue the similarity between the simulated image and the real image, such as the shape and distribution of scattering points. This type of simulator includes RaySAR, CohRaS ® Examples include RaySAR and CohRaS ® The SAR image simulator simulates the reflectivity map of a 3D model with material properties through ray tracing and geometric and physical optics techniques. These reflectivity maps with infinite resolution in azimuth, range and elevation are then downsampled to the required system resolution and oversampled to the pixel size of the final image while being convolved with the system impulse response.

[0071] Echo-based SAR imaging simulation is also known as coherent simulation method. Its core is to reconstruct the target electromagnetic scattering characteristics and image on a two-dimensional plane. Unlike feature-based SAR imaging simulation methods, echo-based SAR imaging simulation methods do not directly generate images, but simulate the original sensor measurement to obtain SAR echo signals. SAR images can only be obtained after the signal echoes are processed by the imaging algorithm. Existing echo-based SAR imaging simulation methods include point target simulation and scene simulation. Point target simulation focuses on simulating point and dot matrix target echo signals through system parameters, such as the SARSIM method; while scene simulation focuses on the realistic simulation of complex and extended scenes.

[0072] Figure 1 The embodiments of the present invention provide a location for adding amplitude perturbations in the method for generating adversarial samples for SAR target detection guided by echo signals. The present invention provides a method for generating adversarial samples for SAR target detection guided by echo signals. From the perspective of physical implementation, the adversarial perturbations of optical images can be converted from the image domain to the physical domain through camera shooting, while the adversarial perturbations of SAR images need to be reflected as the coherent energy accumulation of the target echo. Therefore, a feasible approach is to add amplitude perturbations to the target echo, that is, to generate adversarial samples by changing the amplitude of the echo signal in the signal domain. Figure 1 As shown, this method can establish the correspondence between the amplitude of the disturbance signal in the signal domain and the disturbance pixel in the image domain and the scattering characteristics of the disturbance target structure in the physical domain, so that the generated adversarial disturbance has a clear physical meaning.

[0073] Figure 2 A flowchart of a method for generating adversarial samples for SAR target detection guided by echo signals is provided for an embodiment of the present invention. Figure 2 As shown, in one embodiment of the present invention, a method for generating adversarial samples for SAR target detection guided by echo signals comprises the following steps:

[0074] S1: SAR target scene construction: RaySAR renderer is used to generate the echo signal data S of the target object, and the target image is obtained through range-Doppler imaging processing. ; The target image The foreground area of ​​the image is combined with the background area of ​​the background image to obtain a synthetic dataset for SAR target detection tasks;

[0075] S2: Signal domain-image domain attack: Design specific attack loss functions for the classification subtask and regression subtask in the target detection network respectively to achieve the attack effect; based on the gradient information of the attack loss function, iteratively attack the amplitude of the echo signal data S, and generate adversarial samples that can achieve disappearance attack or target attack after range-Doppler imaging processing;

[0076] S3: Signal domain-physical domain mapping: Perturb the amplitude of the generated echo signal data S Mapping from the signal domain to the physical space, thereby establishing a mapping relationship, converting the echo signal data S into parameter changes in the physical space, thereby affecting the backscattering characteristics of the target physical entity, so that it shows the expected attack effect in the SAR imaging results;

[0077] S4: Output SAR target detection adversarial examples.

[0078] Through the above steps, the present invention uses RaySAR renderer to generate echo signals of target objects, and obtains target images through range-Doppler imaging processing. Then, the foreground area of ​​the target image I is combined with the background area of ​​the background image to obtain a synthetic data set that can be applied to SAR target detection tasks; the signal domain-image domain attack uses multiple attack strategies to finely adjust the amplitude of the echo signal in the SAR signal domain, and realizes the generation of adversarial samples of two different attack strategies such as disappearance attack or target attack in the image domain; and the signal domain-image domain mapping accurately transfers the echo signal amplitude disturbance generated in the signal domain to the scattering characteristic parameters of the target physical entity through a series of mapping processes, providing a new attack method for the SAR target detection system, and further enhancing the authenticity and effectiveness of the attack.

[0079] Existing research on adversarial samples for SAR target detection focuses on adversarial attacks in the image domain. Due to the lack of corresponding target physical entities, it is difficult to expand to the physical domain. Secondly, due to the essential difference between SAR imaging mechanism and optical imaging, physical attack technology in the optical field is difficult to directly migrate to SAR scenarios. To solve the above problems, the present invention proposes the concept of signal domain attack, by adding perturbations to the amplitude of the echo signal, and transferring the amplitude perturbations to the pixel value perturbations in the image domain and the material scattering characteristic parameter perturbations in the physical domain by signal domain-image domain attack and signal domain-image domain mapping. In the signal domain-image domain attack, SAR simulation image generation plays a basic and critical role. The process starts with the accurate digital representation of the three-dimensional model, and the echo signal data S for SAR imaging is obtained by fine rendering by the RaySAR renderer, and after post-processing steps such as range-Doppler imaging, a high-quality SAR simulation image, i.e., the target image I, is generated. In the simulation process, the core step is that the 3D model of the target physical entity is converted into echo signal data S after being processed by the RaySAR renderer.

[0080] In one embodiment of the present invention, the step S1 of applying the RaySAR renderer to generate echo signal data of the target object specifically includes:

[0081] The generation formula of echo signal data S is as follows:

[0082] ;

[0083] in, The grid data representing the 3D model of the input target physical entity, including the position and vertex coordinate information of the triangular face elements; Represents the scattering characteristic parameter set of the input 3D model, including the reflection coefficient used to describe the target material's response to radar wave scattering , scattering coefficient and surface roughness ; It represents the radar coordinates, signal receiving position and transmission direction in the SAR imaging process; Rs represents the generation function based on the RaySAR renderer.

[0084] Furthermore, the target image is obtained by range-Doppler imaging processing in step S1. Specifically include:

[0085] Target Image The resulting formula is expressed as follows:

[0086] ;

[0087] It represents range-Doppler imaging, including echo signal pre-compression, range compression, Doppler frequency processing and two-dimensional imaging steps; Represents parameters in the imaging process; represents the real number domain; H represents the number of samplings in the range direction; W represents the number of samplings in the azimuth direction.

[0088] Figure 3 A flowchart for constructing a synthetic data set in an echo signal-guided SAR target detection adversarial sample generation method is provided for an embodiment of the present invention. Due to the lack of target physical entities, existing image domain adversarial attack methods for SAR target detection tasks have obvious limitations when extended to the physical domain. In order to solve the above problems, the present application applies a SAR target scene construction module to generate a synthetic data set. By introducing scene simulation in the physical domain, the synthetic data set aims to fill the gap in the physical implementation of image domain adversarial attacks, and comprehensively evaluate and improve the performance of SAR target detection algorithms in physical domain adversarial attacks.

[0089] In one embodiment of the present invention, Figure 3 As shown, the target image described in step S1 is The foreground area of ​​the image is combined with the complex background of the background image to obtain a synthetic dataset for SAR target detection tasks, which includes:

[0090] Model selection: Select several typical targets from the target data set as simulation objects, obtain high-precision 3D models of these targets, and use them as basic materials for the production of synthetic data sets; when constructing synthetic data sets, selecting 3D models that are highly matched with actual SAR scenes is the key to ensuring the quality and practicality of the data sets; the selection criteria mainly consider factors such as the geometric shape, material properties and size ratio of the model; in order to ensure the representativeness of the model, the present invention selects six typical military targets (including rocket launchers: 2S1; armored personnel carriers: BMP-2, BRDM-2, BTR-60; tanks: T-72; trucks: ZIL-131) from the Mobile and Stationary Target Acquisition and Recognition (MSTAR) data set, which is widely used in SAR adversarial attack research, as simulation objects; these targets show unique electromagnetic scattering characteristics in SAR images and are ideal samples for testing and evaluating attack algorithms;

[0091] Imaging simulation: Using high-precision 3D models, a high-quality target image I is generated through the RaySAR renderer. Before generating the target image I, data preprocessing operations are performed, including format conversion and data standardization. The format conversion ensures that the 3D model is correctly parsed and processed by the RaySAR renderer, and the data standardization ensures the consistency of the input data. After the target image I is generated, post-processing operations are performed, including denoising, contrast adjustment, and image sharpening. Through this series of fine processing processes, the SAR simulation images in the synthetic data set are not only highly authentic and reliable, but also can effectively reflect the target characteristics and imaging effects under different viewing angles, laying a solid data foundation for subsequent algorithm development and model evaluation.

[0092] Data fusion: Channel separation and histogram equalization are performed on the foreground area of ​​the target image I; the foreground area is located by extracting the index of the non-zero pixels in the foreground area, and the bounding box coordinates of the foreground area are obtained by calculating the minimum circumscribed rectangle of these pixels; the placement position of the foreground area is randomly generated in the predefined area in the background area of ​​the background image, and the foreground area and the background area are mixed pixel by pixel to generate a fused image. The fused image contains the complete annotation information of the target; the complete annotation information may include the bounding box, category label, and rotation angle, etc.; this information is used to generate detection annotation files, such as PASCAL VOC annotations in XML format or COCO JSON format annotations, so as to support the training and verification of the target detection model; this data fusion process provides data support for adversarial sample generation and SAR image research;

[0093] Cropping: By defining a fixed sliding cropping size and step size, the entire fused image is cropped piece by piece. Each cropped small image inherits the annotation information in the original image and adjusts the bounding box according to the position. The size of the cropping window (416×416 pixels) and the step size are carefully designed based on the average size of the target object and the characteristics of SAR imaging, aiming to balance the efficiency of cropping and the accuracy of target detection; the cropped image and the updated annotation information will be saved in COCO format for visualization verification and training of the dataset. The cropped sub-images can increase the diversity of the data, and also provide more training samples for the model, improving its generalization ability for different scales and complex scenes.

[0094] After generating the SAR simulation image, the core function of the signal domain-image domain attack is launched, that is, generating amplitude disturbances in the signal domain. , and after range-Doppler imaging, the disturbance is added to the target image middle.

[0095] In one embodiment of the present invention, step S2 specifically includes:

[0096] The C&W attack strategy is adopted to construct a specific attack loss function and use the gradient descent method to optimize the amplitude of the echo signal data S along the negative gradient direction to generate adversarial samples in the image domain.

[0097] Since the amplitude of the echo signal data S The range is limited to [0,1], so the amplitude perturbation added Constraints are imposed to ensure that , i represents the disturbance count; set the optimization parameters , and use the sigmoid function to optimize the parameters The range is limited to [0,1]. During the attack process, the parameters are optimized through continuous iteration. To generate amplitude disturbance ; Single amplitude disturbance The formula for size is as follows:

[0098] ;

[0099] Use the inverse function of the sigmoid function To initialize the optimization parameters , to ensure the similarity between the perturbation vector and the amplitude vector.

[0100] Furthermore, step S2 specifically includes:

[0101] Use a mask vector m with the same shape as the perturbation vector to control the amplitude perturbation The application range is set, and all elements of the mask vector m are initialized to 1, indicating that amplitude perturbations are allowed at all positions. ; The generated amplitude disturbance Multiply the mask vector m element by element to limit the range of effective perturbations; in each iteration, sort the elements in the perturbation vector by size, and set the corresponding positions of the elements less than a certain threshold in the mask vector m to 0, so as to eliminate unimportant perturbation points; this process is continuously optimized in multiple iterations, and finally retains the perturbation subset that has the greatest impact on the detection results, thereby achieving the goal of sparse attack;

[0102] The formula for generating adversarial samples is as follows:

[0103] ;

[0104] in, Represents element-by-element multiplication, used to control amplitude disturbance the scope of application; represents the disturbance threshold; Represents the mask vector The update rule is Greater than When , the mask vector m at the corresponding position is 1, otherwise it is 0; Represents the detection model.

[0105] In one embodiment of the present invention, step S2 specifically further includes:

[0106] The vanishing attack is a vanishing attack that makes the detection frame completely disappear through a vanishing attack loss function; the target attack is a target attack that causes the detection frame category error through a target attack loss function.

[0107] Specifically, the disappearance attack includes:

[0108] In the target image After that, the object detector first generates multiple candidate bounding boxes , is the total number of bounding boxes, each candidate box Contains central location ,size , Candidate box confidence , and the class probability vector , is the category probability of the nth target. These candidate boxes are generated by dividing the image into grids of different resolutions, and the center of each grid corresponds to a candidate box. The confidence threshold of the candidate box is set by the vanishing attack loss function. , filter out candidate bounding boxes from the model output, and reduce the detection probability of the target by minimizing the confidence scores of these candidate bounding boxes, so that the originally detected target is invisible in the final output; candidate box confidence The calculation formula is as follows:

[0109] ;

[0110] in, Indicates that the confidence threshold of the candidate box is exceeded The total number of candidate boxes, only those with higher confidence will be retained and used as the basis for calculating the loss function of the disappearing attack;

[0111] The formula of the disappearance attack loss function is as follows:

[0112] .

[0113] The purpose of the above formula is to minimize the model's confidence in the candidate box of the target, which leads to the disappearance of the candidate box in the target detection task.

[0114] And, the target attack specifically includes:

[0115] The product of the confidence of each candidate box and the category probability of the target category is calculated and used as an item in the attack loss function. By continuously minimizing the maximum value of this product, the model is guided to shift in the direction of the target category, and finally misleading candidate boxes are generated in the output to achieve the effect of targeted attack. The formula of the targeted attack loss function is as follows:

[0116] ;

[0117] Among them, Indicates the probability that the candidate box is classified as the target category.

[0118] The targeted attack loss function will guide the model to reduce the classification probability of the correct category and increase the classification probability of the target category during the training process, thereby achieving targeted attack.

[0119] After completing the transformation of adversarial perturbations from the signal domain to the image domain through signal domain-image domain attacks, the next key step is to map the generated perturbations from the signal domain to the physical space. This process requires the establishment of a mapping relationship to convert echo signal data into parameter changes in the physical space, thereby affecting the backscattering characteristics of the target physical entity, so that it shows the expected attack effect in the SAR imaging results.

[0120] In one embodiment of the present invention, the amplitude disturbance of the generated echo signal data S in step S3 is Mapping from the signal domain to the physical space to establish a mapping relationship specifically includes:

[0121] The coordinates of the position of a single scattering point in the echo signal data S in the range-azimuth coordinate system are transformed to match the world coordinate system of the target physical entity; this transformation needs to be realized by the RaySAR renderer, which can accurately track and record the specific position of each scattering point in the range-azimuth coordinate system in the world coordinate system, which lays the foundation for the transformation from the range-azimuth coordinate system to the world coordinate system;

[0122] Match these scattering points with the triangular facets that make up the target physical entity; due to the differences in the area of ​​triangular facets, triangular facets with small areas often correspond to a single scattering point, while triangular facets with larger areas may correspond to multiple scattering points. Considering the different effects of multiple scattering points on the same triangular facet, the scattering point with the largest amplitude change before and after the disturbance is selected as the benchmark to calculate the scattering characteristic parameters of the triangular facet;

[0123] Establish the mapping relationship between the amplitude s of the disturbed echo signal data S and the scattering characteristic parameters of the triangular surface elements that constitute the target physical entity: Use the single variable optimization method to calculate the scattering coefficient of the triangular surface element corresponding to each scattering point Perform bounded optimization by using the scattering coefficient Determine the optimal adversarial scattering coefficient for the corresponding triangular facet for the input optimization function , matches the amplitude s of the target echo signal S after disturbance, and the formula of the optimization function is expressed as follows:

[0124]

[0125] in, Indicates the scattering coefficient during the optimization process The associated set of adversarial scattering feature parameters; , represents the adversarial echo signal data generated after adding adversarial perturbation in the signal domain; the optimized adversarial scattering feature parameter set is expressed as .

[0126] Since the calculation of the amplitude of the echo signal in the RaySAR renderer needs to consider multiple factors, it is difficult to directly obtain all the scattering characteristic parameters (including the reflection coefficient) of the corresponding triangular surface element through a certain echo signal amplitude. , scattering coefficient and surface roughness In addition, in SAR imaging, radar signals are usually scattered on the surface of objects rather than reflected by mirrors. Therefore, the influence of the scattering coefficient on the amplitude of the echo signal is dominant among all the scattering characteristic parameters. To this end, a single variable optimization method is used to calculate the scattering coefficient of the triangular facet corresponding to each scattering point. Specifically, an optimization function is defined, which takes the scattering coefficient As input, the given imaging parameters are calculated by the RaySAR renderer Then, the Brent algorithm is used to find the local minimum of the function in the interval [0,1] to determine the optimal adversarial scattering coefficient of the corresponding triangular face element. .

[0127] Figure 4 The embodiment of the present invention provides a method for generating adversarial samples of SAR target detection guided by echo signals, and provides partial images of the synthetic data set and their annotation results. Figure 5 An embodiment of the present invention provides a schematic diagram of adversarial samples generated by an echo signal-guided SAR target detection adversarial sample generation method. The present invention conducts simulation experiments on 6 target categories appearing in the target data set; the experiment uses a RaySAR renderer based on ray tracing for image simulation, and the light source type selects a point light source to simulate the synthetic aperture radar beamforming working mode, and keeps the pitch angle, resolution and other imaging parameters consistent with the target data set. Settings; specifically, under the simulation condition of a pitch angle of 17º, a target image with a resolution of 0.3m×0.3m is generated with a rotation angle interval of 30º, and it is fused with a larger background image; after fusion, a sliding window cropping strategy is used to carefully crop the large-scale image, each window size is 416×416 pixels, and the step size is set to 416 pixels, thereby generating a synthetic data set consisting of 2000 images; then, the synthetic data set is divided into a training set and a test set in a ratio of 7:3. Figure 4 As shown, Figure 4 A series of training set samples and annotation results after fusion and cropping of the above six categories of target images are shown. This application attempts to test the attack effects of two attack strategies, namely disappearance attack and target attack. Figure 5 The visualization effect of the vanishing attack strategy to generate adversarial samples is shown, where the first row represents the clean sample images in the synthetic dataset, and the second row represents the adversarial samples corresponding to the clean sample images after the vanishing attack or the target attack strategy. Figure 5It can be seen that these samples can deceive the detector to miss or misclassify the attack target through carefully designed pixel-level modifications, while not affecting the detector's correct identification of non-attack targets. The above results show that the adversarial samples generated by the echo signal-guided SAR target detection adversarial sample generation method provided by the present invention not only have significant concealment, but can also effectively circumvent the recognition mechanism of the target detection model, further verifying the attack effectiveness of this method.

[0128] The echo signal guided SAR target detection adversarial sample generation method proposed in this application adds amplitude perturbation to the echo signal data S in the signal domain. In order to generate adversarial samples that are offensive to SAR target detection algorithms. This method includes two key steps: signal domain-image domain attack and signal domain-image domain mapping. The signal domain-image domain attack is responsible for adding amplitude perturbations to the echo signal data S in the signal domain that may cause target detection failure in the image domain. , by customizing the loss function and using the gradient information of the model to fine-tune the amplitude of the SAR echo signal, thereby realizing the attack strategy of disappearance attack or target attack. The signal domain-image domain mapping uses the designed mapping function to convert the adversarial perturbation data in the signal domain into the target physical entity in the physical domain. The key design of this module is to use the ray tracing principle to find the correspondence between the data points in the signal domain and the target physical structure in the physical domain, so as to map the amplitude of the target echo signal in the signal domain to the scattering characteristic parameters of the target physical structure. Through the above steps, the present invention successfully overcomes the gap between the image domain and the physical domain, and enhances the authenticity and effectiveness of the adversarial attack. In addition, the present invention also uses a variety of target physical entity models and combines the RaySAR renderer to construct a synthetic data set with complex scene information. In the experimental verification stage, attack experiments were carried out on a variety of targets in the synthetic data set, and the attack capabilities of the method in the image domain and the physical domain were successfully verified. At the same time, it is also proved that the adversarial samples generated by this method have good attack migration performance between detection models of different architectures.

[0129] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. The method for generating adversarial samples for SAR target detection guided by echo signals is characterized in that: The following steps are involved: S1: SAR target scene construction: RaySAR renderer is used to generate the echo signal data S of the target object, and the target image is obtained through range-Doppler imaging processing. ; The target image The foreground area of ​​the image is combined with the background area of ​​the background image to obtain a synthetic dataset for SAR target detection tasks; S2: Signal domain-image domain attack: Design specific attack loss functions for the classification subtask and regression subtask in the target detection network respectively to achieve the attack effect; based on the gradient information of the attack loss function, iteratively attack the amplitude of the echo signal data S, and generate adversarial samples that can achieve disappearance attack or target attack after range-Doppler imaging processing; S3: Signal domain-physical domain mapping: Perturb the amplitude of the generated echo signal data S Mapping from the signal domain to the physical space, thereby establishing a mapping relationship, converting the echo signal data S into parameter changes in the physical space, thereby affecting the backscattering characteristics of the target physical entity, so that it shows the expected attack effect in the SAR imaging results; S4: Output SAR target detection adversarial examples.

2. The method for generating adversarial samples for SAR target detection guided by echo signals according to claim 1, characterized in that: The step S1 of applying the RaySAR renderer to generate echo signal data of the target object specifically includes: The formula for generating the echo signal data S is as follows: ； in, The grid data representing the 3D model of the input target physical entity, including the position and vertex coordinate information of the triangular face elements; Represents the scattering characteristic parameter set of the input 3D model, including the reflection coefficient used to describe the target material's response to radar wave scattering , scattering coefficient and surface roughness ; Indicates radar coordinates, signal receiving position and transmission direction during SAR imaging; Represents the generation function based on the RaySAR renderer.

3. The method for generating adversarial samples for SAR target detection guided by echo signals according to claim 1, characterized in that: The step S1 of obtaining the target image I through range-Doppler imaging processing specifically includes: Target image The generation formula is as follows: ； It represents range-Doppler imaging, including echo signal pre-compression, range compression, Doppler frequency processing and two-dimensional imaging steps; Represents parameters in the imaging process; represents the real number domain; H represents the number of samplings in the range direction; W represents the number of samplings in the azimuth direction.

4. The method for generating adversarial samples for SAR target detection guided by echo signals according to claim 1, characterized in that: The target image described in step S1 is The foreground area of ​​the image is combined with the complex background of the background image to obtain a synthetic dataset for SAR target detection tasks, including: Model selection: Select several typical targets from the target data set as simulation objects, obtain high-precision 3D models of these targets, and use them as the basic materials for the production of synthetic data sets; Imaging simulation: using high-precision 3D models, a high-quality target image I is generated through a RaySAR renderer; data preprocessing operations are performed before generating the target image I, including format conversion and data standardization. The format conversion ensures that the 3D model is correctly parsed and processed by the RaySAR renderer, and the data standardization ensures the consistency of the input data; after the target image I is generated, post-processing operations are performed, including denoising, contrast adjustment, and image sharpening; Data fusion: Perform channel separation and histogram equalization on the foreground area of ​​the target image I; locate the foreground area by extracting the index of the non-zero pixels in the foreground area, and obtain the bounding box coordinates of the foreground area by calculating the minimum circumscribed rectangle of these pixels; randomly generate the placement position of the foreground area in the predefined area in the background area of ​​the background image, and mix the foreground area with the background area pixel by pixel to generate a fused image. The fused image contains the complete annotation information of the target; Cropping: By defining a fixed sliding cropping size and step size, the entire fused image is cropped piece by piece. Each cropped small image inherits the annotation information in the original image and adjusts the bounding box according to the position.

5. The method for generating adversarial samples for SAR target detection guided by echo signals according to claim 1, characterized in that: Step S2 specifically includes: The C&W attack strategy is adopted to construct a specific attack loss function and use the gradient descent method to optimize the amplitude of the echo signal data S along the negative gradient direction to generate adversarial samples in the image domain. Since the amplitude of the echo signal data S The range is limited to [0,1], so the amplitude perturbation added Constraints are imposed to ensure that , i represents the disturbance count; set the optimization parameters , and use the sigmoid function to optimize the parameters The range is limited to [0,1]. During the attack process, the parameters are optimized through continuous iteration. To generate amplitude disturbance ; Single amplitude disturbance The formula for size is as follows: ； Use the inverse function of the sigmoid function To initialize the optimization parameters , to ensure the similarity between the perturbation vector and the amplitude vector.

6. The method for generating adversarial samples for SAR target detection guided by echo signals according to claim 5, characterized in that: Step S2 specifically also includes: Use a mask vector m with the same shape as the perturbation vector to control the amplitude perturbation The application range is set, and all elements of the mask vector m are initialized to 1, indicating that amplitude perturbations are allowed at all positions. ; The generated amplitude disturbance Multiply the mask vector m element by element to limit the range of effective perturbations; in each iteration, sort the elements in the perturbation vector by size, and set the corresponding positions of the elements less than a certain threshold in the mask vector m to 0, so as to eliminate unimportant perturbation points; this process is continuously optimized in multiple iterations, and finally retains the perturbation subset that has the greatest impact on the detection results, thereby achieving the goal of sparse attack; The formula for generating adversarial samples is as follows: ； in, Represents element-by-element multiplication, used to control amplitude disturbance the scope of application; represents the disturbance threshold; Represents the mask vector The update rule is Greater than When , the mask vector m at the corresponding position is 1, otherwise it is 0; Represents the detection model.

7. The method for generating adversarial samples for SAR target detection guided by echo signals according to claim 6, characterized in that: Step S2 specifically also includes: The vanishing attack is a vanishing attack that makes the detection frame completely disappear through a vanishing attack loss function; the target attack is a target attack that causes the detection frame category error through a target attack loss function.

8. The method for generating adversarial samples for SAR target detection guided by echo signals according to claim 7, characterized in that: The disappearance attack specifically includes: In the target image After that, the object detector first generates multiple candidate bounding boxes , is the total number of bounding boxes, each candidate box Contains central location ,size , Candidate box confidence , and the class probability vector , is the category probability of the nth target. These candidate boxes are generated by dividing the image into grids of different resolutions, and the center of each grid corresponds to a candidate box. The confidence threshold of the candidate box is set by the vanishing attack loss function. , filter out candidate bounding boxes from the model output, and reduce the detection probability of the target by minimizing the confidence scores of these candidate bounding boxes, so that the originally detected target is invisible in the final output; the candidate box confidence The calculation formula is as follows: ； in, Indicates that the confidence threshold of the candidate box is exceeded The total number of candidate boxes, only those with higher confidence will be retained and used as the basis for calculating the loss function of the disappearing attack; The formula of the disappearance attack loss function is as follows: 。 9. The method for generating adversarial samples for SAR target detection guided by echo signals according to claim 7, characterized in that: The target attacks specifically include: The product of the confidence of each candidate box and the category probability of the target category is calculated and used as an item in the attack loss function. By continuously minimizing the maximum value of this product, the model is guided to shift in the direction of the target category, and finally misleading candidate boxes are generated in the output to achieve the effect of targeted attack. The formula of the targeted attack loss function is as follows: ； Among them, Indicates the probability that the candidate box is classified as the target category.

10. The method for generating adversarial samples for SAR target detection guided by echo signals according to claim 1, characterized in that: The step S3 of mapping the amplitude disturbance of the generated echo signal data S from the signal domain to the physical space to establish a mapping relationship specifically includes: Transform the position of a single scattering point in the echo signal data S in the range-azimuth coordinate system to match the world coordinate system of the target physical entity; Match these scattered points with the triangles that make up the target physical entity; Establish the mapping relationship between the amplitude s of the disturbed echo signal data S and the scattering characteristic parameters of the triangular surface elements that constitute the target physical entity: Use the single variable optimization method to calculate the scattering coefficient of the triangular surface element corresponding to each scattering point Perform bounded optimization by using the scattering coefficient Determine the optimal adversarial scattering coefficient for the corresponding triangular face element for the input optimization function , matches the amplitude s of the target echo signal S after disturbance, and the formula of the optimization function is expressed as follows: in, Indicates the scattering coefficient during the optimization process The associated set of adversarial scattering feature parameters; , represents the adversarial echo signal data generated after adding adversarial perturbation in the signal domain; the optimized adversarial scattering feature parameter set is expressed as .

Images