SAR (Synthetic Aperture Radar) image confrontation sample generation method considering target scattering characteristics
By changing the scattering characteristic parameters of the target object and using the RaySAR simulator, the problem that existing SAR image adversarial sample generation methods are difficult to generate applicable adversarial samples in the physical world is solved, and efficient adversarial sample generation is achieved under multiple perspectives and different imaging conditions.
Patent Information
- Application Number
- CN202411855526.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-17
- Publication Date
- 2025-04-11
AI Technical Summary
Existing SAR image adversarial sample generation methods are difficult to generate applicable adversarial samples in the physical world, especially under multiple perspectives and different imaging conditions, which cannot effectively simulate and reflect the complex reflection characteristics of the target object.
By changing the scattering characteristic parameters of the target object, the RaySAR physics simulator is used to simulate the intensity of electromagnetic wave irradiation and echo signals, and combined with the finite difference method to optimize the scattering characteristic parameters to generate SAR adversarial samples.
Adversarial sample generation under multiple perspectives and different imaging conditions is achieved, which significantly improves the physical achievability and attack effect of adversarial samples, and overcomes the limitations of existing methods.
Smart Images
Figure CN119810586A_ABST
Abstract
Description
Technical Field
[0001] The invention belongs to the field of remote sensing technology, and in particular relates to a method for generating SAR image adversarial samples taking into account target scattering characteristics. Background Art
[0002] SAR image target recognition algorithms based on deep learning have the advantage of end-to-end feature learning and can effectively improve target recognition rates. Therefore, they are widely used in tasks such as military reconnaissance, ocean monitoring, geological exploration, and weather forecasting. However, studies have shown that deep neural network models are susceptible to interference from adversarial samples. By adding carefully designed tiny perturbations to SAR images, attackers can cause deep neural network models to produce incorrect recognition results. The existence of adversarial samples poses a serious threat to SAR target recognition tasks.
[0003] Existing SAR image adversarial sample generation technologies can be mainly divided into two categories: image adversarial example (I-AE) and pseudo physics adversarial example (PP-AE). Among them, I-AE refers to adding subtle perturbations that are difficult for the human eye to observe in the time domain or frequency domain SAR images by solving gradient optimization, constrained optimization, estimating decision boundaries, and based on generative adversarial networks (GANs), thereby misleading the target recognition model to produce incorrect predictions. PP-AE constructs adversarial scatterers based on the attribute scattering center model, or uses phase modulation methods to improve the physical feasibility of SAR image adversarial perturbations.
[0004] However, the existing SAR image adversarial example generation method is obtained by borrowing the attack algorithm and framework in optical images and making targeted improvements based on the characteristics of SAR imaging. It is worth noting that there are fundamental differences between SAR images and optical images in terms of imaging principles and image characteristics. Optical sensors have the characteristic of "what you see is what you get". Their imaging generates RGB three-channel images by capturing and processing the light signals reflected from the target object. The pixel value corresponds to the intensity of the received light signal. The imaging process of the SAR sensor depends on transmitting microwave signals and receiving reflected echoes. The process reflects the mapping projection of the target scattering center characteristics on the two-dimensional imaging plane. The pixel value represents the coherent cumulative energy of the echo signal. The optical adversarial attack method through migration and reproduction does not establish a physical correspondence between the perturbed pixels and the radar signals.
[0005] The pseudo physics adversarial example generation method generates adversarial perturbations based on the attribute scattering center model and directly superimposes them on the SAR image. However, during the SAR imaging process, the backscattering characteristics of the target change significantly with the changes in the target material, geometry, background environment and imaging conditions. The electromagnetic scattering models established through actual measurements and simulation calculations are difficult to describe the changing laws of the target electromagnetic scattering in three-dimensional space during SAR imaging. The phase modulation method is restricted by factors such as time delay and amplitude mismatch and cannot accurately control the size of the perturbation value. Therefore, it is difficult for the above attack methods to generate adversarial samples that can be applied in the real world. Summary of the invention
[0006] It can be seen that the pixel value of the SAR image reflects the reflection intensity information of the target object to the radar beam, which carries rich details about the target object, such as its geometry and scattering characteristics.
[23] The target scattering properties are used to change the intensity of the echo signal to generate a physics adversarial example.
[0007] Based on this, the present application proposes an attack method SAR-SPA for generating physics adversarial examples by changing the scattering characteristic parameters of the target object. Compared with the existing methods, the SAR-SPA method adds disturbances to the target object, realizing the full-link attack of the SAR imaging process. Specifically, the generated adversarial perturbation is first modeled as changing the scattering characteristic parameters of the surface material of the target object. Secondly, the scattering process of electromagnetic waves irradiated on the target is simulated by the RaySAR physical simulator, so as to simulate the intensity of the echo signal of the target under any posture, configuration or observation geometry in real time or near real time, and then obtain the adversarial sample of SAR after the signal processing and imaging processing flow. Finally, the present application designs a finite difference method to adapt to the non-differentiable characteristics of the RaySAR simulator. The method models the generation of adversarial samples as an optimization problem, effectively estimates the gradient by making small perturbations to the reflection coefficient and scattering coefficient in the scattering characteristic parameters of the target object, and uses batch processing technology to efficiently update the above parameters. The adversarial samples generated by this method enable the target object to maintain adversarial properties in multi-perspective physical scenes.
[0008] To achieve the above purpose, the present application discloses a method for generating adversarial samples of SAR images taking into account target scattering characteristics, comprising the following steps:
[0009] RaySAR simulator is used to simulate and generate SAR images;
[0010] The RaySAR physical simulator is used to simulate the scattering process of electromagnetic waves on the target, and SAR adversarial samples are generated by perturbing the scattering characteristic parameters of the three-dimensional target object;
[0011] The finite difference method is used to adapt to the non-differentiable characteristics of the RaySAR simulator. That is, for adversarial samples of SAR images, the reflection coefficient and scattering coefficient in the scattering characteristic parameters of the target object are perturbed to estimate the gradient, and the reflection coefficient and scattering coefficient are updated using a batch processing method.
[0012] Output adversarial examples of SAR images.
[0013] Preferably, generating a SAR adversarial sample by perturbing the scattering characteristic parameters of a three-dimensional target object includes:
[0014] M={m1,m2,m3,...,m n} is used to represent the geometric shape of the target model, which consists of a number of triangular patches of different sizes m i Composition; T = {t1, t2, t3, ..., t n} represents the scattering characteristic parameters of the triangular facets constituting the target model, n is the total number of scattering characteristic parameters, and the scattering characteristic parameters t i Contains the specular reflection coefficient F s , diffuse reflection coefficient F d and surface roughness factor F r ;
[0015] Using the RaySAR simulator, the camera parameters θ r The mesh of the three-dimensional target model is rendered under the scattering characteristic parameter T and a two-dimensional SAR image is obtained; then, the deep neural network model f takes the rendered image as input and outputs the correct prediction result.
[0016] Preferably, the mesh of the three-dimensional target model is rendered and a two-dimensional SAR image is obtained, including adversarial sample generation and scattering feature parameter optimization;
[0017] The adversarial sample generation includes:
[0018] For all t i ∈T, anti-scattering characteristic parameter T adv Defined as:
[0019] T adv ={t i +δ i |t i ∈T}
[0020]
[0021] in, represents the ray tracer; θ r is the camera parameter, which is used to indicate the position of the camera and its rotation angle relative to the target object;
[0022] The above formula represents adding the disturbance to the scattering characteristic parameters of each triangular facet constituting the target model to obtain the adversarial scattering characteristic parameter T adv , and then the adversarial sample x′ is obtained through SAR image simulation.
[0023] Preferably, the scattering characteristic parameter optimization includes:
[0024] For all t i ∈T, the final adversarial scattering feature parameter is defined as
[0025] T adv ={t i +δ i |t i ∈T}
[0026]
[0027] f represents the classification model, Y represents the true category of the target; θ f Represents the parameters of the classification model;
[0028] Using loss function Countermeasures for the scattering characteristics T adv Perform iterative optimization to obtain the final adversarial scattering feature parameters When including When the adversarial sample of the attribute is input into the classifier f, it induces the classifier to produce incorrect recognition results.
[0029] Preferably, the steps of obtaining the adversarial sample x′ through SAR image simulation are as follows:
[0030] The electromagnetic scattering model is used to calculate the intensity of the echo signal received by the radar receiver after multiple reflections of the emitted electromagnetic wave; secondly, the focusing position of the signal echo in the range-azimuth plane is calculated based on the imaging model.
[0031] Preferably, the electromagnetic scattering model includes:
[0032] The electromagnetic scattering effect of the target on the radar signal is approximately simulated according to the reflection model of the POV-Ray optical simulator. On this basis, the influence of the surface color of the object on the reflection of the radar signal is eliminated by removing the texture of the three-dimensional target model, and only one color channel is retained to represent the intensity of the target backscattering.
[0033] After the above adjustments, the signal strength detected by the ray tracer depends only on the reflection coefficients used to describe specular and diffuse reflections and the weighting factors used to scale the intensity of multiple reflections; in the case of direct backscattering, the diffuse reflection signal is derived as follows:
[0034]
[0035] Among them, F d is the diffuse reflectance; I sig Indicates the intensity of the incident signal; is the surface normal vector; is the normalized signal vector pointing from the surface point to the SAR; F b is the surface brightness factor;
[0036] The backscattered signal of specular reflection is derived from the reflection model of specular highlights. The formula describing the specular reflection signal is as follows:
[0037]
[0038] Among them, F s is the specular reflection coefficient; F r is the surface roughness; is the surface normal vector; is a bipartite vector, given by the surface normal vector and the signal vector L pointing in the SAR direction is defined;
[0039] The RaySAR simulator approximates the echo strength of radar signals as they bounce multiple times between objects and reflect from objects to the radar antenna;
[0040] The imaging model includes:
[0041] The RaySAR simulator uses parallel light to represent radar signals and performs orthogonal projection on the azimuth and elevation angles of the local scene. The position of the signal echo is calculated by projecting the starting point of the focused ray to the azimuth and elevation directions respectively; the RaySAR simulator is located at the azimuth position a p and elevation position e pThe pixel center of the sensor is perpendicular to the image plane of the orthogonal sensor to create the main ray. When these rays intersect with the target object1, they are reflected and generate reflected signal rays in two directions: the mirror reflection signal direction SP and the back echo direction BK. Among them, the rays in the BK direction are called focused rays. The rays in this direction will return to the sensor plane along the opposite direction of the optical path and will be accumulated in the receiving pixel unit according to their focusing positions on the range azimuth plane. The rays in the SP direction are secondary rays and / or tertiary rays. The rays in this direction will continue to intersect with the target object2 in the scene and generate new rays in two directions. For the RaySAR simulator, when a single ray intersects with the target or background in the scene for a preset number of times, the ray is stopped from being tracked.
[0042] In the imaging stage, the RaySAR simulator calculates the echo position by projecting the starting point of the focused light into the azimuth and elevation directions respectively; the focal positions of the focused light in the azimuth and range directions on the imaging plane of the orthogonal sensor are derived from the following formula:
[0043]
[0044] Where a and r represent the coordinates of the focused light in the azimuth and distance directions of the imaging plane, respectively; a o and a p They represent the coordinates of the incident point of the main light and the exit point of the focused light projected in the azimuth direction respectively; r is the sum of the lengths of the light rays emitted from the sensor plane and returned to the sensor plane after secondary reflection, that is, r1+r2+r3, r1 is the length of the main light, r2 is the length of the secondary light, and r3 is the length of the focused light.
[0045] Preferably, the attack scheme is to change the echo intensity of the target object by adjusting the adversarial scattering characteristic parameters, and obtain the adversarial sample after imaging processing; specifically, for the scattering characteristic parameters of each triangular facet constituting the target object By its specular reflection coefficient and diffuse reflectance Add disturbances to achieve the attack goal; is the surface brightness factor; is the surface roughness;
[0046] In order to reduce the contrast between the target object and the surrounding environment in the SAR image, the scattering characteristic parameter t of each triangular facet in the target object is i Add a set of random coefficients α between 0 and 1 i and β i , and then add perturbations to the random coefficients to generate adversarial scattering feature parameters t i―advWhen the disturbance is added to the random coefficient, the specular reflection coefficient in the scattering characteristic parameters of the target object is and diffuse reflectance Reduce, in order to adjust the scattering characteristics of the target object in the SAR image, making it visually closer to the background and reducing the possibility of being recognized by the classifier; the formula is as follows:
[0047]
[0048] in, Respectively represent the mirror reflection coefficient and diffuse reflection coefficient of the surrounding environment, δ represents the added disturbance size, and It represents the adversarial specular reflection coefficient and adversarial diffuse reflection coefficient of the target object.
[0049] Preferably, after obtaining the SAR adversarial sample image, the specular reflection coefficient and the diffuse reflection coefficient in the scattering feature parameters are continuously iteratively optimized to find a set of parameters that makes the classifier have the highest classification error rate for a certain category, that is, the gradient is effectively estimated by differential approximation, and the batch processing technology is used to achieve accurate and efficient optimization of the scattering feature parameters; specifically, it includes:
[0050] The classifier is run in gradient-free mode to ensure that no weight updates are performed during inference;
[0051] For each batch of images, use the classifier to predict the category of each image and calculate the cross entropy loss between it and the actual label;
[0052] Traversing the entire data set, accumulating the total loss of all images and dividing it by the total number of images to calculate the average loss, which is used in the subsequent optimization process to evaluate the effect of the current scattering feature parameter configuration;
[0053] The finite difference method is used to calculate the gradient based on the average loss. For each scattering characteristic parameter t i , first apply a small positive perturbation δ to the parameter, and then recalculate the loss; the gradient is estimated by dividing the difference between the loss under the current perturbation parameters and the loss under the original parameters by the perturbation amount δ. In this way, for each scattering feature parameter, a gradient value is obtained, indicating the degree of influence of the parameter on the final loss. The formula is as follows:
[0054]
[0055] Among them, t i―adv―future Indicates the current adversarial scattering characteristic parameter t i―adv―now The adversarial scattering characteristic parameters of a certain triangular facet after updating based on T adv―nowand T adv―before Respectively represent the adversarial scattering characteristic parameters under the current and previous perturbation parameters; loss now and loss before Represent the loss values under the current disturbance parameters and the previous disturbance parameters respectively; represents the approximate gradient obtained using the finite difference method; then, use To update the current coefficient α i―adv―now and β i―adv―now is α i―adv―future and β i―adv―future , sign(.) is a sign function used to clip the gradient to prevent the gradient explosion problem during the optimization process. It is defined as:
[0056]
[0057] Preferably, in order to save computational overhead and speed up the divergence of the loss function, the mini-batch gradient ascent method is applied for optimization. Specifically, the scattering characteristic parameters of the model are regarded as a set of optimizable variables and divided into several mini-batches T = {T1, T2, T3, ..., T m}, in each iteration, select a batch of parameters T i ={t1,t2,t3,...,t n / m} is optimized, so that the global optimal solution is effectively approached while maintaining relatively low memory usage and computational complexity.
[0058] Compared with the prior art, the beneficial technical effects of this application are as follows:
[0059] This application models the SAR adversarial sample generation problem as a problem of changing the target scattering characteristic parameters, and generates SAR adversarial samples by combining a physical simulator of the SAR imaging mechanism, thus bridging the gap between digital attacks and physical attacks.
[0060] An end-to-end physical adversarial attack method is proposed to generate powerful SAR adversarial samples. Experiments show that this application is superior to existing digital attack methods such as general adversarial perturbations and adversarial patches, overcomes the limitation of poor universality of adversarial camouflage under multi-view, and shows good migration performance. Even under different observation perspectives and using different classifiers, its attack effect can be maintained. BRIEF DESCRIPTION OF THE DRAWINGS
[0061] Figure 1 The framework diagram of the present invention;
[0062] Figure 2 Schematic diagram of RaySAR imaging model;
[0063] Figure 3Visualization effect diagram of different attack methods (taking ResNet50 as an example). DETAILED DESCRIPTION
[0064] The present invention is further described below in conjunction with the accompanying drawings, but the present invention is not limited in any way. Any changes or substitutions made based on the teachings of the present invention belong to the protection scope of the present invention.
[0065] Artificial intelligence is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making.
[0066] Natural language processing (NLP) is an important direction in the fields of computer science and artificial intelligence. It studies various theories and methods that can achieve effective communication between people and computers using natural language. Natural language processing is a science that integrates linguistics, computer science, and mathematics. Therefore, research in this field will involve natural language, that is, the language people use in daily life, so it is closely related to the study of linguistics. Natural language processing technology usually includes text processing, semantic understanding, machine translation, robot question answering, knowledge graph and other technologies.
[0067] The technical solutions provided in the embodiments of the present application involve technologies such as machine learning and natural language processing of artificial intelligence, which are specifically introduced and explained through the following embodiments.
[0068] Before introducing the embodiments of the present application, some terms involved in the present application are first explained.
[0069] 1. Adversarial samples: Goodfellow et al. proposed the concept of adversarial samples, and Chen et al. first introduced the concept of adversarial samples into SAR images. By adding a carefully designed small perturbation δ to the SAR image x, the well-trained deep neural network model f can be deceived to produce incorrect recognition results. The formula is expressed as:
[0070]
[0071] Where ∥δ∥ represents the size of the disturbance δ, Indicates the maximum permissible value of the disturbance. According to whether the SAR imaging scattering mechanism is combined as the criterion, the existing work can be divided into two categories: image adversarial example and pseudo physics adversarial example.
[0072] 2. Image adversarial example generation method generates adversarial perturbations pixel by pixel by referring to the adversarial attack method in optical images. Gradient-based attack methods were first introduced into adversarial attacks on SAR images. This type of method calculates the gradient of the model loss function with respect to the input to obtain adversarial perturbations.
[0073] 3. Pseudo Physics Adversarial Example: Adversarial sample generation for optical images is achieved by adding noise and specific structures. However, in SAR images, the imaging process is a superposition of coherent scattering fields of electromagnetic waves, so it is often physically infeasible to generate SAR image adversarial samples using existing optical image adversarial sample generation methods. In order to generate SAR image adversarial samples with clear physical meaning, it is necessary to add some physically feasible structures. Peng et al. proposed the SMGAA (Scattering Model Guided Adversarial Attack) algorithm, which introduces an effective attribute scattering center model and a general imaging method to describe the scattering behavior of typical geometric structures in the SAR imaging process, and designs a customized optimization process to search for the most effective adversarial scatterers in a soft greedy manner, thereby generating more feasible and robust adversarial perturbations in physical space.
[0074] In the three-dimensional physical world, SAR imaging relies on the superposition of electromagnetic wave coherent scattering fields, which makes the imaging results significantly affected by the characteristics of the radar system and the target object itself. The above-mentioned Image-AE and Pseudo-Physics-AE are difficult to accurately simulate and reflect the complex reflection characteristics of the target object at different viewing angles in the three-dimensional physical world. This application adds countermeasure disturbances to the SAR imaging link, and changes the coherent energy accumulation of the target echo by adjusting the scattering characteristic parameters of the target object, thereby realizing Physics-AE.
[0075] This application models the process of counterattack as a process of fine-tuning the target scattering characteristic parameters, and uses SAR image simulation technology to generate adversarial samples. Doing so can not only significantly reduce the cost of the test and avoid uncertainty in the actual environment, but also enable the added adversarial disturbance to have real physical properties. The SAR image simulation method based on ray tracing adds the material property definition for calculating the reflectivity to each triangular facet that makes up the three-dimensional model, which can simulate the multiple ejections of the radar signal when it is scattered to the target and the overlapping and blocking effects between the target geometric structures, and can obtain more realistic imaging results. Therefore, this application uses the RaySAR simulator to simulate and generate SAR images, and generates SAR adversarial samples by perturbing the scattering characteristic parameters of the three-dimensional target object.
[0076] The network flow chart of the SAR-SPA method for generating SAR adversarial samples based on perturbing the scattering characteristic parameters of the three-dimensional target model is as follows: Figure 1 As shown. Where M = {m1,m2,m3,...,m n} is used to represent the geometric shape of the target object. Taking the "car" model as an example, the geometry of the model consists of thousands of triangular patches of different sizes. i Composition; T = {t1, t2, t3, ..., t n} represents the scattering characteristic parameters of the triangular facets that make up the target model. Scattering characteristic parameters t i Contains the specular reflection coefficient F s , diffuse reflection coefficient F d and surface roughness factor F r wait.
[0077] exist Figure 1 In the upper part, the RaySAR simulator is used (RaySAR simulator is a SAR image simulator based on ray tracing. It is a powerful simulator of SAR imaging ensemble model introduced on the open source software POVRay, mainly for understanding the images of complex urban scene targets) to calculate the camera parameters θ r The mesh of the three-dimensional target model is rendered under the scattering characteristic parameter T and a two-dimensional SAR image is obtained. Then, the deep neural network model f takes the rendered image as input and outputs the correct prediction result. Figure 1 The second half of the paper shows the process of generating SAR image adversarial samples by changing the scattering characteristic parameters of the mesh that constitutes the target model. This involves two important stages, namely adversarial sample generation and scattering characteristic parameter optimization. The definitions of these two parts are as follows:
[0078] Definition 1. (Adversarial Sample Generation): For all t i ∈T, anti-scattering characteristic parameter T adv Can be defined as
[0079]
[0080] in, represents the ray tracer; θ r is the camera parameter, which is used to represent the camera position and the rotation angle relative to the target object; in the attack process, we add the perturbation to the scattering feature parameter of each triangle patch constituting the target model to obtain the adversarial scattering feature parameter T adv , and then the adversarial sample x′ is obtained through SAR image simulation.
[0081] Definition 2. (Optimization of scattering characteristic parameters): For all t i ∈T, the final adversarial scattering feature parameter Can be defined as
[0082] T adv ={t i +δ i |t i ∈T}
[0083]
[0084] f represents the classification model, Y represents the true category of the target; θ f Represents the parameters of the classification model. In the optimization of scattering feature parameters, a customized loss function is used Countermeasures for the scattering characteristics T adv Perform iterative optimization to obtain the final adversarial scattering feature parameters (Definition 2). When adversarial samples of attributes are input into the classifier f, they can induce the classifier to produce more misleading misrecognition results.
[0085] Adversarial sample generation module
[0086] This application uses the RaySAR simulation software developed and open-sourced by Dr. Stefan Auer to generate adversarial samples. The simulation process of this simulation software can be divided into two parts. First, it is necessary to calculate the intensity of the echo signal received by the radar receiver after multiple reflections of the emitted electromagnetic wave; secondly, it is necessary to calculate the focusing position of the signal echo in the range-azimuth plane. These two parts correspond to the electromagnetic scattering model and imaging model in the simulation method.
[0087] Electromagnetic scattering model: The RaySAR simulator approximates the electromagnetic scattering effect of the target on the radar signal based on the reflection model provided by the POV-Ray optical simulator, and on this basis eliminates the influence of the object surface color on the radar signal reflection by removing the three-dimensional target model texture. In addition, since the radar signal emitted by the SAR system is a single-frequency signal containing a normalized intensity value, when using the RaySAR simulator for SAR image simulation, only one color channel needs to be retained to represent the intensity of the target backscattering. After adjusting the above parameters, the signal intensity detected by the ray tracer depends only on the reflection coefficient used to describe the specular reflection and diffuse reflection and the weighting factor used to scale the intensity of multiple reflections. In the case of direct backscattering, the diffuse reflection signal is derived by the following formula:
[0088]
[0089] Among them, F d is the diffuse reflectance; I sig Indicates the intensity of the incident signal; is the surface normal vector; is the normalized signal vector pointing from the surface point to the SAR; F b is the surface brightness factor (default: 1).
[0090] In addition, the backscattered signal of specular reflection is derived from the reflection model of specular highlights. The formula describing the specular reflection signal is as follows:
[0091]
[0092] Among them, F s is the specular reflection coefficient; F r is the surface roughness; is the surface normal vector; is a bipartite vector, given by the surface normal vector and the signal vector pointing in the direction of the SAR Definition. The electromagnetic scattering model in the RaySAR simulator uses the specular reflection and diffuse reflection models in the light field to replace the Fresnel reflection model and SPM used to describe the radar specular reflection signal and diffuse reflection signal. To a certain extent, it can approximate the echo intensity of the radar signal when it bounces multiple times between objects and reflects from the object to the radar antenna.
[0093] Imaging model: In the imaging model, the RaySAR simulator uses parallel light to represent the radar signal and performs orthogonal projection on the azimuth and elevation angles of the local scene. The position of the signal echo is calculated by projecting the starting point of the focused ray to the azimuth and elevation directions respectively. Figure 2 As shown, the RaySAR simulator is located at azimuth position a pand elevation position e p The pixel center of the sensor is perpendicular to the image plane of the orthogonal sensor to create the main ray. When these rays intersect the target (object1), they are reflected and generate reflected signal rays in the direction of the specular reflection signal (SP) and the back echo direction (BK). Among them, the rays in the BK direction are called focused rays. The rays in this direction will return to the sensor plane along the opposite direction of the optical path and accumulate in the receiving pixel unit according to their focus position on the range azimuth plane. The rays in the SP direction are called secondary rays, tertiary rays, etc. The rays in this direction will continue to intersect with the target (object2) in the scene and generate new rays in two directions. For the RaySAR simulator, the maximum number of ejections for tracing each ray is set to 5, that is, when a single ray intersects with the target or background in the scene 5 times, the ray will stop being traced. In the imaging stage, the RaySAR simulator calculates the position of the echo by projecting the starting point of the focused ray into the azimuth direction and the elevation direction respectively. Although RaySAR does not use the range-Doppler coherent imaging algorithm, its imaging geometry model can ensure that the accumulated position of the focused light is consistent with the position of the real echo signal. The focal position of the focused light in the azimuth and range directions on the imaging plane of the orthogonal sensor can be derived from the following formula:
[0094]
[0095] Where a and r represent the coordinates of the focused light in the azimuth and distance directions of the imaging plane, respectively; a o and a p They represent the coordinates of the incident point of the main light and the exit point of the focused light projected in the azimuth direction; r is the sum of the lengths of the light rays emitted from the sensor plane and returned to the sensor plane after secondary reflection, that is, r1+r2+r3.
[0096] The attack scheme of this application is to change the echo intensity of the target object by adjusting the adversarial scattering characteristic parameters, and obtain the adversarial sample after imaging processing. Specifically, for the scattering characteristic parameters of each triangular facet that constitutes the target object, We use the specular reflection coefficient and diffuse reflectance The target is attacked by adding disturbances. From formulas (2) and (3), it can be seen that the reduction of reflection coefficient and scattering coefficient will cause the reduction of target echo intensity. These changes will further affect the grayscale characteristics of SAR images, especially in the presence of background noise, which will make the geometric features and scattering features of the target object unclear, making it difficult for the model to correctly identify or classify the target object.
[0097] In order to reduce the contrast between the target object and the surrounding environment in the SAR image, the scattering characteristic parameter t of each triangular facet in the target object is i Add a set of random coefficients α between 0 and 1 i and β i , and then add perturbations to the random coefficients to generate adversarial scattering feature parameters t i―adv When the disturbance is added to the random coefficient, it will cause the specular reflection coefficient in the target object scattering characteristic parameter to and diffuse reflectance The purpose of this is to adjust the scattering characteristics of the target object in the SAR image, making it visually closer to the background and reducing the possibility of being recognized by the classifier. The formula is as follows:
[0098]
[0099] in, Represent the specular reflection coefficient and diffuse reflection coefficient of the surrounding environment respectively. δ represents the added disturbance size, and and It represents the adversarial specular reflection coefficient and adversarial diffuse reflection coefficient of the target object.
[0100] Scattering feature parameter optimization module
[0101] After obtaining the SAR adversarial sample images through simulation experiments, it is necessary to continuously iterate and optimize the attribute parameters such as the specular reflectance coefficient and the diffuse reflectance coefficient in the scattering feature parameters to find a set of parameters that makes the classifier have the highest classification error rate for a certain category. Due to the non-differentiable characteristics of the RaySAR simulator, we effectively estimate the gradient through differential approximation, and use batch processing technology to achieve accurate and efficient optimization of the scattering feature parameters.
[0102] Specifically, first, the classifier runs in gradient-free mode to ensure that no weight updates are performed during inference. For each batch of images, we use the classifier to predict the category of each image and calculate the cross entropy loss with the actual label. The loss calculation involves traversing the entire dataset, accumulating the total loss of all images and dividing it by the total number of images to calculate the average loss. This average loss is used in subsequent optimization processes to evaluate the effect of the current scattering feature parameter configuration. The gradient calculation is carried out on this basis, and this application uses the finite difference method, as shown in the following formula. For each scattering feature parameter t i, first apply a small positive perturbation δ to the parameter, and then recalculate the loss. The gradient is estimated by dividing the difference between the loss under the current perturbed parameters and the loss under the original parameters by the perturbation amount δ. In this way, for each scattering feature parameter, a gradient value can be obtained, indicating the degree of influence of the parameter on the final loss. The formula is as follows:
[0103]
[0104] Among them, t i―adv―future Indicates the current adversarial scattering characteristic parameter t i―adv―now The adversarial scattering characteristic parameters of a certain triangular facet after updating based on T adv―now and T adv―before Respectively represent the adversarial scattering characteristic parameters under the current and previous perturbation parameters; loss now and loss before Represent the loss values under the current disturbance parameters and the previous disturbance parameters respectively; represents the approximate gradient obtained using the finite difference method; then, use To update the current coefficient α i―adv―now and β i―adv―now is α i―adv―future and β i―adv―future Here, sign(.) is a sign function used to clip the gradient to prevent the gradient explosion problem during the optimization process. It is defined as:
[0105]
[0106] In the actual calculation process, since the target model is composed of tens or even hundreds of thousands of triangular facets, the scattering characteristic parameter t i Recalculating the gradient and updating it in reverse will greatly waste computing resources. In order to save computing overhead and speed up the divergence of the loss function, the mini-batch gradient ascent method is applied for optimization. Specifically, the scattering characteristic parameters of the model are regarded as a set of variables that can be optimized, and they are divided into several mini-batches T = {T1, T2, T3, ..., T m}. In each iteration, a batch of parameters T is selected i ={t1,t2,t3,...,t n / m} is optimized instead of updating all parameters at once. In this way, the global optimal solution is effectively approached while keeping relatively low memory usage and computational complexity.
[0107] This application conducts simulation experiments on 7 target categories that appear in the MSTAR dataset (including rocket launchers: 2S1; armored personnel carriers: BMP2, BRDM2, BTR60; tanks: T72; trucks: ZIL131; air defense units: ZSU234). The three-dimensional target models of the above categories used in the simulation are all from the cgtrader website. This application uses the RaySAR renderer based on ray tracing for image simulation. The light source type selects a point light source to simulate the working mode of the spotlight synthetic aperture radar, and keeps the settings of imaging parameters such as rotation angle, pitch angle, resolution, etc. consistent with the MSTAR dataset. Specifically, a training dataset with a resolution of 0.3m×0.3m is generated with a rotation angle interval of 1° under the simulation condition of a pitch angle of 17°; a test dataset with a resolution of 0.3m×0.3m is generated with a rotation angle interval of 1° under the simulation condition of a pitch angle of 15°, and the size of the simulated image is set to 128×128 pixels.
[0108] 2) Data processing and experimental details: First, data preprocessing is performed on the simulation data to improve the training effect of the classifier model. Specifically, a series of transformations are applied to the training data. First, the size of the shortest side of the image is resized to 256 pixels. Subsequently, random resizing and cropping to 224 pixels are performed to ensure the variability of the training samples. To further expand the data, random affine transformations are applied, allowing rotations up to 15° and scaling between 80% and 150% of the original size. Finally, each image is converted to a tensor format suitable for model input. For the validation data, a simpler sequence is followed. The image is first resized to 256 pixels, then centrally cropped to 224 pixels, and converted to a tensor. These preprocessing steps are designed to ensure that the validation data reflects the expected format of the input while being consistent and direct, thereby facilitating an unbiased evaluation of the performance of the model.
[0109] During the classifier training process, the cross entropy loss function and the stochastic gradient descent (SGD) optimizer were used to optimize the network parameters and the pre-trained model provided by the Pytorch official website was used to speed up the convergence of the loss function. The experiment trained 20 epochs, the learning rate was set to 0.001, and the batch size was set to 32. The attack method proposed in this application and the ten deep neural network models involved were implemented using Python (version 3.9.12) and the Pytorch deep learning framework (version 1.10.0). All experiments are supported by the NVIDIA GeForce RTX 4070Ti graphics card. In addition, all experiments were accelerated by the CUDA toolkit (version 11.3).
[0110] 3) Evaluation Metrics: We use attack success rate as the criterion for evaluating attack performance. The attack success rate is defined as:
[0111]
[0112] Among them, n fool Indicates the number of samples with successful attacks, n total Indicates the total number of samples of the attack. Fundamentally, under fair constraints and interference, a higher attack success rate indicates that the attack algorithm is more powerful.
[0113] First, the attack effect of the SAR-SPA method of this application in the simulation data set is evaluated. In the experimental parameter setting, the size of each batch is set to 1 / 20 of the number of all target triangles, and the experiment iterates for a total of 25 epochs. Among them, the perturbation size δ is set to 0.001, and then adversarial samples are generated with a rotation angle interval of 1° under the simulation condition of a pitch angle of 15°. The attack effects of the SAR-SPA method and the universal adversarial perturbation (UAP), adversarial patch (Patch), and random perturbation (Random) of the specular reflection coefficient and diffuse reflection coefficient in the three-dimensional target model using a uniform distribution function are compared, and the number of attack iterations, perturbation size and learning rate of the two attack methods of UAP and Patch are kept consistent with the SAR-SPA method proposed in this article. The experimental results are shown in Table 2.
[0114] Table 2 Attack success rates for different target categories
[0115]
[0116]
[0117] As can be seen from Table 2, the trained classifier model can fit the simulation data set well, and the average recognition accuracy on 7 categories is more than 96.55%. Then, the above four attack methods are used to add perturbations to the clean samples, and the attack results are statistically analyzed. Among them, the Random method has the worst attack effect, which reflects the limitations of random perturbations in deceiving DNN models compared with more finely designed adversarial perturbations. For example, when using the Random method, the average attack success rate of most models can only be improved by less than 1 percentage point. Even for the InceptionV3 model, the average attack success rate will drop by 1.99% after the attack using the Random method compared to before the attack. The reason is speculated that the use of the Random method to attack will cause the target radar scattering characteristic parameters to change, and this change will cause the contrast between the foreground and background of the imaging results to change. This makes the addition of Random perturbations play a role of positive excitation noise in some cases, which can make the target features more significant, thereby improving the recognition effect of the classification model.
[0118] Compared with the Random method, the adversarial perturbations generated by the UAP method and the Patch method can achieve significant attack effects. Among them, the UAP method can generally reduce the classification accuracy on multiple targets by introducing subtle but systematic perturbations in the image, especially on models such as ResNet50, ShuffleNetV2 and EfficientNetV2, with the average attack success rates of 7 categories reaching 72.06%, 65.87% and 70.28% respectively. The efficiency of this method lies in its ability to exploit the general vulnerability of deep learning models and have a wide impact on multiple categories. The Patch attack generates strong local interference by adding carefully designed visible patches to the image. This attack strategy can not only cause confusion in the target recognition system, but also achieve the highest average attack success rate on the DNN model based on the Transformer architecture (the average attack success rates on the VisionTransformer and Swin Transformer models are 19.60% and 31.14 respectively), showing that it has a stronger destructive power on the classification model of the Transformer architecture.
[0119] Compared with other attack methods, the SAR-SPA method proposed in this application shows a strong attack capability. The average attack success rate in the classification model based on the CNN architecture is more than 59.96%, which is significantly better than several other attack methods; the average attack success rate in the model based on the Transformer architecture is more than 15.24%. Although the average attack success rate is slightly lower than that of the Patch-based attack method, it is still improved in the ZIL-131 category relative to the Patch-based attack method. At the same time, we found that compared with the other five target categories, the attack success rate of this application in the two target categories of ZIL-131 and ZSU-23-4 is relatively low. The reason is speculated that the ZIL-131 truck and ZSU-23-4 air defense unit are quite different from other categories in the data set in terms of target profile and scattering characteristics, so it is difficult to be mistakenly identified as other categories.
[0120] Next, we will show the visualization of adversarial samples generated using different attack methods. Since this application uses many classification models, it is difficult to display all the results in the same figure (10×5×7=350 images are required to display all of them). Therefore, we only use the ResNet50 model as an example to show the adversarial sample images generated using different attack methods. The generated adversarial samples are as follows: Figure 3 shown.
[0121] This application proposes an end-to-end attack method SAR-SPA to generate SAR image adversarial samples in the physical world. First, this method integrates the SAR imaging mechanism into the adversarial sample generation process, and changes the target echo intensity by adjusting the scattering characteristic parameters of the target object using the RaySAR physical simulator, and obtains the SAR adversarial sample after imaging processing. Secondly, an optimization idea of differential approximate differential is proposed, which effectively estimates the gradient by making a small perturbation to the target scattering characteristic parameters, and uses batch processing technology to achieve accurate and efficient optimization of the adversarial scattering characteristic parameters to solve the problem of non-differentiability of the RaySAR simulator. Experiments show that the SAR-SPA method of this application shows higher attack effectiveness than other general attack methods, and has dual transferability across multiple models and multiple perspectives. Therefore, the SAR-SPA method shows potential for application in the physical world and provides an interesting physical attack direction for future work.
[0122] As used herein, the word "preferred" is intended to be used as an example, instance, or illustration. Any aspect or design described herein as "preferred" is not necessarily to be construed as being more advantageous than other aspects or designs. On the contrary, the use of the word "preferred" is intended to present concepts in a specific way. The term "or" as used in this application is intended to mean an inclusive "or" rather than an exclusive "or". That is, unless otherwise specified or clear from the context, "X uses A or B" means any one of the naturally included permutations. That is, if X uses A; X uses B; or X uses both A and B, then "X uses A or B" is satisfied in any of the foregoing examples.
[0123] Moreover, although the present disclosure has been shown and described with respect to one or implementations, those skilled in the art will think of equivalent variations and modifications based on the reading and understanding of this specification and the accompanying drawings. The present disclosure includes all such modifications and variations, and is limited only by the scope of the appended claims. In particular, with respect to the various functions performed by the above-mentioned components (such as elements, etc.), the terms used to describe such components are intended to correspond to any component (unless otherwise indicated) that performs the specified function of the component (such as it is functionally equivalent), even if the structure is not equivalent to the disclosed structure of the function in the exemplary implementation of the present disclosure shown herein. In addition, although the specific features of the present disclosure have been disclosed with respect to only one of several implementations, such features can be combined with one or other features of other implementations that may be desired and advantageous for a given or specific application. Moreover, insofar as the terms "including", "having", "containing" or their variations are used in specific embodiments or claims, such terms are intended to be included in a manner similar to the term "comprising".
[0124] The functional units in the embodiments of the present invention may be integrated into a processing module, or each unit may exist physically separately, or multiple or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium. The above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc. The above-mentioned devices or systems may execute the storage method in the corresponding method embodiment.
[0125] To sum up, the above embodiment is an implementation mode of the present invention, but the implementation mode of the present invention is not limited by the embodiment, and any other changes, modifications, substitutions, combinations, and simplifications that deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.
Claims
1. A method for generating adversarial samples of SAR images taking into account target scattering characteristics, characterized in that: The following steps are involved: RaySAR simulator is used to simulate and generate SAR images; The RaySAR physical simulator is used to simulate the scattering process of electromagnetic waves on the target, and SAR adversarial samples are generated by perturbing the scattering characteristic parameters of the three-dimensional target object; The finite difference method is used to adapt to the non-differentiable characteristics of the RaySAR simulator. That is, for adversarial samples of SAR images, the reflection coefficient and scattering coefficient in the scattering characteristic parameters of the target object are perturbed to estimate the gradient, and the reflection coefficient and scattering coefficient are updated using a batch processing method. Output adversarial examples of SAR images.
2. The method for generating adversarial samples of SAR images taking into account target scattering characteristics according to claim 1, characterized in that: SAR adversarial samples are generated by perturbing the scattering characteristic parameters of three-dimensional target objects, including: M={m1,m2,m3,...,m n } is used to represent the geometric shape of the target model, which consists of a number of triangular patches of different sizes m i Composition; T = {t1, t2, t3, ..., t n } represents the scattering characteristic parameters of the triangular facets constituting the target model, n is the total number of scattering characteristic parameters, and the scattering characteristic parameters t i Contains the specular reflection coefficient F s , diffuse reflection coefficient F d and surface roughness factor F r ; Using the RaySAR simulator, the camera parameters θ r The mesh of the three-dimensional target model is rendered under the scattering characteristic parameter T and a two-dimensional SAR image is obtained; then, the deep neural network model f takes the rendered image as input and outputs the correct prediction result.
3. The method for generating adversarial samples of SAR images taking into account target scattering characteristics according to claim 2, characterized in that: Render the mesh of the 3D target model and obtain a 2D SAR image, including adversarial sample generation and scattering feature parameter optimization; The adversarial sample generation includes: For all t i ∈T, anti-scattering characteristic parameter T adv Defined as: T adv ={t i +δ i |t i ∈T} in, represents the ray tracer; θ r is the camera parameter, which is used to indicate the position of the camera and its rotation angle relative to the target object; The above formula represents adding the disturbance to the scattering characteristic parameters of each triangular facet constituting the target model to obtain the adversarial scattering characteristic parameter T adv , and then the adversarial sample x′ is obtained through SAR image simulation.
4. The method for generating adversarial samples of SAR images taking into account target scattering characteristics according to claim 3, characterized in that: The scattering characteristic parameter optimization comprises: For all t i ∈T, the final adversarial scattering feature parameter is defined as T adv ={t i +δ i |t i ∈T} f represents the classification model, Y represents the true category of the target; θ f Represents the parameters of the classification model; Using loss function Countermeasures for the scattering characteristics T adv Perform iterative optimization to obtain the final adversarial scattering feature parameters When including When the adversarial sample of the attribute is input into the classifier f, it induces the classifier to produce incorrect recognition results.
5. The method for generating adversarial samples of SAR images taking into account target scattering characteristics according to claim 4, characterized in that: The steps to obtain the adversarial sample x′ through SAR image simulation are as follows: The electromagnetic scattering model is used to calculate the intensity of the echo signal received by the radar receiver after multiple reflections of the emitted electromagnetic wave; secondly, the focusing position of the signal echo in the range-azimuth plane is calculated based on the imaging model.
6. The method for generating adversarial samples of SAR images taking into account target scattering characteristics according to claim 5, characterized in that: The electromagnetic scattering model includes: The electromagnetic scattering effect of the target on the radar signal is approximately simulated according to the reflection model of the POV-Ray optical simulator. On this basis, the influence of the surface color of the object on the reflection of the radar signal is eliminated by removing the texture of the three-dimensional target model, and only one color channel is retained to represent the intensity of the target backscattering. After the above adjustments, the signal strength detected by the ray tracer depends only on the reflection coefficients used to describe specular and diffuse reflections and the weighting factors used to scale the intensity of multiple reflections; in the case of direct backscattering, the diffuse reflection signal is derived as follows: Among them, F d is the diffuse reflectance; I sig Indicates the intensity of the incident signal; is the surface normal vector; is the normalized signal vector pointing from the surface point to the SAR; F b is the surface brightness factor; The backscattered signal of specular reflection is derived from the reflection model of specular highlights. The formula describing the specular reflection signal is as follows: Among them, F s is the specular reflection coefficient; F r is the surface roughness; is the surface normal vector; is a bipartite vector, given by the surface normal vector and the signal vector pointing in the direction of the SAR definition; The RaySAR simulator approximates the echo strength of radar signals as they bounce multiple times between objects and reflect from objects to the radar antenna; The imaging model includes: The RaySAR simulator uses parallel light to represent radar signals and performs orthogonal projection on the azimuth and elevation angles of the local scene. The position of the signal echo is calculated by projecting the starting point of the focused ray to the azimuth and elevation directions respectively; the RaySAR simulator is located at the azimuth position a p and elevation position e p The pixel center of the sensor is perpendicular to the image plane of the orthogonal sensor to create the main ray. When these rays intersect with the target object1, they are reflected and generate reflected signal rays in two directions: the mirror reflection signal direction SP and the back echo direction BK. Among them, the rays in the BK direction are called focused rays. The rays in this direction will return to the sensor plane along the opposite direction of the optical path and will be accumulated in the receiving pixel unit according to their focusing positions on the range azimuth plane. The rays in the SP direction are secondary rays and / or tertiary rays. The rays in this direction will continue to intersect with the target object2 in the scene and generate new rays in two directions. For the RaySAR simulator, when a single ray intersects with the target or background in the scene for a preset number of times, the ray is stopped from being tracked. In the imaging stage, the RaySAR simulator calculates the echo position by projecting the starting point of the focused light into the azimuth and elevation directions respectively; the focal positions of the focused light in the azimuth and range directions on the imaging plane of the orthogonal sensor are derived from the following formula: Where a and r represent the coordinates of the focused light in the azimuth and distance directions of the imaging plane, respectively; a o and a p They represent the coordinates of the incident point of the main light and the exit point of the focused light projected in the azimuth direction respectively; r is the sum of the lengths of the light rays emitted from the sensor plane and returned to the sensor plane after secondary reflection, that is, r1+r2+r3, r1 is the length of the main light, r2 is the length of the secondary light, and r3 is the length of the focused light.
7. The method for generating adversarial samples of SAR images taking into account target scattering characteristics according to claim 6, characterized in that: The attack scheme is to change the echo intensity of the target object by adjusting the adversarial scattering characteristic parameters, and obtain the adversarial sample after imaging processing; specifically, for the scattering characteristic parameters of each triangular facet that constitutes the target object By its specular reflection coefficient and diffuse reflectance Add disturbances to achieve the attack goal; is the surface brightness factor; is the surface roughness; In order to reduce the contrast between the target object and the surrounding environment in the SAR image, the scattering characteristic parameter t of each triangular facet in the target object is i Add a set of random coefficients α between 0 and 1 i and β i , and then add perturbations to the random coefficients to generate adversarial scattering feature parameters t i-adv ; When the disturbance is added to the random coefficient, the specular reflection coefficient in the scattering characteristic parameters of the target object and diffuse reflectance Reduce, in order to adjust the scattering characteristics of the target object in the SAR image, making it visually closer to the background and reducing the possibility of being recognized by the classifier; the formula is as follows: in, Respectively represent the mirror reflection coefficient and diffuse reflection coefficient of the surrounding environment, δ represents the added disturbance size, and It represents the adversarial specular reflection coefficient and adversarial diffuse reflection coefficient of the target object.
8. The method for generating adversarial samples of SAR images taking into account target scattering characteristics according to claim 7, characterized in that: After obtaining the SAR adversarial sample image, the specular reflection coefficient and diffuse reflection coefficient in the scattering feature parameters are continuously iteratively optimized to find a set of parameters that makes the classifier have the highest classification error rate for a certain category, that is, the gradient is effectively estimated by differential approximation, and batch processing technology is used to achieve accurate and efficient optimization of the scattering feature parameters; specifically, it includes: The classifier is run in gradient-free mode to ensure that no weight updates are performed during inference; For each batch of images, use the classifier to predict the category of each image and calculate the cross entropy loss between it and the actual label; Traversing the entire data set, accumulating the total loss of all images and dividing it by the total number of images to calculate the average loss, which is used in the subsequent optimization process to evaluate the effect of the current scattering feature parameter configuration; The finite difference method is used to calculate the gradient based on the average loss. For each scattering characteristic parameter t i , first apply a small positive perturbation δ to the parameter, and then recalculate the loss; the gradient is estimated by dividing the difference between the loss under the current perturbation parameters and the loss under the original parameters by the perturbation amount δ. In this way, for each scattering feature parameter, a gradient value is obtained, indicating the degree of influence of the parameter on the final loss. The formula is as follows: Among them, t i-adv-future Indicates the current adversarial scattering characteristic parameter t i-adv-now The adversarial scattering characteristic parameters of a certain triangular facet after updating based on T adv-now and T adv-before Respectively represent the adversarial scattering characteristic parameters under the current and previous perturbation parameters; loss now and loss before Represent the loss values under the current disturbance parameters and the previous disturbance parameters respectively; represents the approximate gradient obtained using the finite difference method; then, use To update the current coefficient α i-adv-now and β i-adv-now is α i-adv-future and β i-adv-future , sign(.) is a sign function used to clip the gradient to prevent the gradient explosion problem during the optimization process. It is defined as:
9. The method for generating adversarial samples of SAR images taking into account target scattering characteristics according to claim 8, characterized in that: In order to save computational overhead and speed up the divergence of the loss function, the mini-batch gradient ascent method is applied for optimization. Specifically, the scattering characteristic parameters of the model are regarded as a set of optimizable variables and divided into several mini-batches T = {T1, T2, T3, ..., T m }, in each iteration, select a batch of parameters T i ={t1,t2,t3,...,t n / m } is optimized, so that the global optimal solution is effectively approached while maintaining the performance of memory usage and computational complexity.