Physical cheating method for SAR image target recognition

Abstract

The invention relates to the technical field of radars, in particular to a physical deception method for SAR image target recognition, which can migrate adversarial disturbance which is difficult to recognize by human eyes in a digital space to a physical space and cause misclassification of SAR ATR, realizes conversion from a physical world to a digital world through a RaySAR renderer, and improves the recognition accuracy of SAR ATR. And by designing an effective loss function, the digital disturbance is updated through back propagation. And finally, the final digital disturbance is mapped back to the material information of the 3D model through a mapping model, so that the final physical disturbance is realized. Compared with the existing method, the method disclosed by the invention makes up the gap between digital confrontation and physical confrontation, and has the possibility of being realized in the real world.

Description

Technical Field

[0001] The invention relates to the field of radar remote sensing technology, in particular to a physical deception method for SAR image target recognition. Background Art

[0002] Deep convolutional neural networks (DCNNs) have been widely used in the field of remote sensing image recognition, including optical remote sensing image target recognition and SAR automatic target recognition (SAR ATR). However, the existence of adversarial samples has greatly limited the application of SARATR. Through such carefully designed tiny perturbations that are difficult for the human eye to recognize, DCNN can be misled to produce wrong prediction results. The adversarial sample problem has received widespread attention from academia and industry, and has become a focus of attention in the field of artificial intelligence security.

[0003] At present, there are many deception jamming practices in the field of remote sensing. In the field of SAR ATR, researchers are also conducting deception research, most of which are digital adversarial jamming: directly adding disturbances to the pixels of the image, and the disturbances are in the digital space. For example, attackers directly apply the attack methods and principles in optical remote sensing images to the deception of SAR images, or use sparse attack strategies to limit the disturbances to the target area in the image. The disturbances generated by these attack methods are hidden, making them difficult for observers to detect, which poses a security threat to the widespread application of SAR ATR.

[0004] Physical deception has received extensive attention in the field of optical image recognition, such as patch-based adversarial and camouflage-based adversarial methods. These methods essentially achieve attacks by modifying the pattern on the surface of an object. However, these methods cannot be directly transferred to the SAR field because of the difference in imaging mechanisms. SAR images essentially record the backscattering information of ground objects. Therefore, simply modifying the pattern on the surface of an object cannot change the pixel value of the SAR image. It is necessary to change the material properties of the object surface, such as scattering coefficient, surface roughness and other parameters, so as to change the radar echo signal and thus change the pixel value of the SAR image. Summary of the invention

[0005] The purpose of the present invention is to provide a physical deception method for SAR image target recognition. First, deception is achieved in the two-dimensional image space. The disturbance in the image space is converted into simulated light constituting the SAR image through the back propagation optimization method. Then, by coordinate transformation, the corresponding relationship between points corresponding to triangular face elements and intensity values ​​to material parameters is established to achieve the mapping between the simulated light constituting the SAR image and the three-dimensional model, thereby inverting the two-dimensional image space disturbance back to the three-dimensional physical space to obtain the position and intensity of the three-dimensional physical space disturbance to achieve physical deception, so as to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions: The physical deception method for SAR image target recognition includes the following steps: S1: Generate SAR image from the 3D model of the target; S2: Use the RaySAR renderer to simulate the specular and diffuse reflections of radar signals using an approximate physical optics model and record the SAR geometric output data that determines the echo position in the image ; Output data for SAR geometry Post-processing to generate two-dimensional SAR images ; SAR image Input SAR automatic target recognition classification network , and get the predicted label ; S3: Output data for SAR geometry in digital space Generate adversarial perturbations; S4: Mapping adversarial perturbations to material information in physical space middle; S5: Output and add material information SAR images .

[0007] Preferably, step S1 specifically includes: Given a 3D model, the 3D model has grid information , Material information and imaging parameters , where grid information Including vertex coordinates, triangle face information, material information Including reflection coefficient, scattering coefficient and surface roughness, imaging parameters Including radar signal source coordinates, receiving antenna coordinates and pointing position.

[0008] Preferably, the SAR geometric output data in step S2 is The resulting formula is expressed as follows: ; SAR image The resulting formula is expressed as follows: ; in, represents the post-processing model; Represents post-processing parameters, including the maximum / minimum value of the pitch angle, the maximum / minimum value and spacing of the range direction, and the maximum number of ray ejection; represents the real number domain; H represents the number of samplings in the range direction; W represents the number of samplings in the azimuth direction.

[0009] Preferably, step S3 specifically includes: Output data for SAR geometry The adversarial perturbation generation of is regarded as an optimization problem, and the optimization function is as follows: ; In the formula, Represents the final SAR geometric output data; represents the loss function; represents the true label; Represents adversarial sample data.

[0010] Preferably, step S3 further includes: Use the L2 norm to perturb the vector Limitation, even if The minimum and final loss function is as follows: ; in, represents the optimization parameters; Represents SAR geometric output data The intensity value in ; A constant representing the balance between the classification loss and the limit perturbation intensity loss; represents the cross entropy loss function; Indicates a false label.

[0011] Preferably, step S3 further includes: The intensity value The range of is limited to [0,1], and the perturbation vector is ; make , so that ,in, Represents the original data, represents the optimization parameters; Initializing optimization parameters When , use the inverse function of the sigmoid function , to ensure that the perturbation vector Similarity to the original intensity value vector.

[0012] Preferably, step S3 specifically includes: Output data for SAR geometry The perturbation is mapped to the model Mapped to physical space, specifically expressed as: ; in, Represents the final adversarial physical material information.

[0013] Preferably, step S3 further includes: The sparse attack strategy is adopted to limit the range of the disturbance scattering points, that is, to limit the number of disturbance scattering points, including: Initialize a mask vector that is consistent with the perturbation vector The shape of is the same, and all elements are 1; the generated perturbation vector Multiply the mask vector element by element, and limit the scope of the perturbation by limiting the number of 1 elements in the mask vector; The perturbation vector The elements in are arranged in order of size. If an element is less than a certain threshold, the element with the corresponding index in the mask vector is set to 0, that is, the perturbation vector is removed. The disturbance in the mask vector is less than a certain threshold, so that the 0 elements in the mask vector continue to increase in iterations.

[0014] Preferably, the mapping model Used to generate the final adversarial material information , the mapping model There are three transformation relationships in it: Coordinate transformation: exporting data from SAR geometry The coordinate system of the scattering points in the image is converted to the coordinate system of the 3D model; Points correspond to triangles: SAR geometric output data The basic unit of the medium intensity value is the scattering point, while the basic unit of the 3D model material parameter is the triangle surface element, and there is a correspondence between the point and the triangle surface element; From intensity values ​​to material parameters: Converting SAR geometry to output data The change of the intensity value in corresponds to the change of the material parameters in the 3D model.

[0015] Preferably, for coordinate conversion, the coordinates corresponding to each scattering point in the coordinate system of the 3D model are recorded by a RaySAR renderer, thereby realizing conversion from the scattering point coordinate system to the coordinate system of the 3D model; For the points corresponding to the triangular surface element, the scattering point with the largest change in intensity value before and after the disturbance is selected as the benchmark to calculate the material parameters of the triangular surface element.

[0016] Compared with the prior art, the present invention has the following beneficial effects: The present invention proposes a physical deception method for SAR image target recognition, which can transfer adversarial perturbations that are difficult for the human eye to recognize in digital space to physical space, and cause misclassification of SAR ATR. A RaySAR renderer is used to realize the conversion from the physical world to the digital world, and an effective loss function is designed to update the digital perturbations through back propagation. Finally, the final digital perturbation is mapped back to the material information of the 3D model through a mapping model, thereby realizing the final physical perturbation. The physical deception method for SAR image target recognition disclosed in the present invention can effectively realize SAR deception in the physical world, achieving an average fooling rate of up to 99.02% in the digital world, and an average fooling rate of up to 97.87% in the physical world. Compared with existing methods, the method of the present invention bridges the gap between digital confrontation and physical confrontation, and has the possibility of being realized in the real world. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flow chart of a physical deception method for SAR image target recognition provided by the present invention; Figure 2 The difference between the principles of the physical deception method for SAR image target recognition provided by the present invention and other methods; Figure 3 Added material information generated by the physical deception method for SAR image target recognition provided by the present invention Comparison of SAR image with real SAR image (the top one is the real SAR image, the bottom one is the one with added material information) SAR image). DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] Figure 1 The flowchart of the physical deception method for SAR image target recognition provided by the present invention. The physical deception method for SAR image target recognition, such as Figure 1 As shown, the following steps are included: S1: Generate SAR image from the 3D model of the target; S2: Use the RaySAR renderer to simulate the specular and diffuse reflections of radar signals using an approximate physical optics model and record the SAR geometric output data that determines the echo position in the image ; Output data for SAR geometry Post-processing to generate two-dimensional SAR images ; SAR image Input SAR automatic target recognition classification network , and get the predicted label ; S3: Output data for SAR geometry in digital space Generate adversarial perturbations; S4: Mapping adversarial perturbations to material information in physical space middle; S5: Output and add material information SAR images .

[0020] Specifically, in one embodiment of the present invention, step S1 specifically includes: Given a 3D model, the 3D model has grid information , Material information and imaging parameters , where grid information Including vertex coordinates, triangle face information, material information Including reflection coefficient, scattering coefficient and surface roughness, imaging parameters Including radar signal source coordinates, receiving antenna coordinates and pointing position.

[0021] Furthermore, the SAR geometric output data in step S2 The resulting formula is expressed as follows: ; SAR image The resulting formula is expressed as follows: ; in, represents the post-processing model; Represents post-processing parameters, including the maximum / minimum value of the pitch angle, the maximum / minimum value and spacing of the range direction, and the maximum number of ray ejection; represents the real number domain; H represents the number of samplings in the range direction; W represents the number of samplings in the azimuth direction.

[0022] The physical deception method for SAR image target recognition provided by the present invention is implemented in digital space and physical space in turn. First, the SAR geometric output data is processed in digital space. Generate adversarial perturbations and further map the perturbations to material information in physical space In one embodiment of the present invention, step S3 specifically includes: Output data for SAR geometry The adversarial perturbation generation of is regarded as an optimization problem, and the optimization function is as follows: ; In the formula, Represents the final SAR geometric output data; represents the loss function; represents the true label; Represents adversarial sample data.

[0023] The present invention uses the classification loss function of the model, namely the cross entropy loss, as the objective function, and selects the label with the highest prediction probability other than the correct label as the target label to minimize the loss function, thereby finding adversarial samples. However, using only a single loss function cannot make adversarial samples effective, because there is no limit on the scope of perturbation optimization, which may make adversarial samples inconsistent with the imaging principle of SAR or violate certain characteristics of SAR images.

[0024] Furthermore, in order to increase the authenticity of the generated adversarial sample, and because the present invention needs to map the disturbance of the intensity value to the material parameters of the 3D model in the subsequent physical confrontation, the smaller the amplitude of the disturbance, the more conducive it is to the subsequent scattering coefficient matching process. Specifically, step S3 also includes: Use the L2 norm to perturb the vector Limitation, even if The minimum and final loss function is as follows: ; in, represents the optimization parameters; Represents SAR geometric output data The intensity value in ; A constant representing the balance between the classification loss and the limit perturbation intensity loss; represents the cross entropy loss function; Indicates a false label.

[0025] Furthermore, step S3 further includes: Since the optimization target of the present invention is the intensity value contributed by the scattering points in the SAR geometric output data, in order to generate an effective two-dimensional SAR image, the present invention needs to convert the intensity value The range of is limited to [0,1], and the perturbation vector is ; make , so that ,in, Represents the original data, Represents the optimization parameter; the present invention uses the sigmoid function to limit the range of the optimization parameter, so as to ensure that the generated disturbance is reasonable; Initializing optimization parameters When , use the inverse function of the sigmoid function , to ensure that the perturbation vector Similarity to the original intensity value vector.

[0026] In order to generate SAR physical adversarial perturbations, the present invention proposes a framework for SAR physical deception, which includes a differentiable SAR geometric output data post-processor. Figure 1 shown.

[0027] The process of generating disturbances in SAR geometric output data is called digital adversarial because the disturbance is still in the digital space. In this part, the optimization method is used to generate adversarial perturbations by calculating the loss and performing gradient back propagation. Therefore, the loss function is very important in this process, which determines the final adversarial effect.

[0028] Correspondingly, the process of mapping the disturbance generated in the SAR geometric output data to the 3D model is called physical confrontation, because this step actually maps the disturbance in the digital space to the physical space. The present invention will discuss in detail the design of the mapping model and how to achieve this mapping.

[0029] In one embodiment of the present invention, step S3 specifically includes: Output data for SAR geometry The perturbation is mapped to the model Mapped to physical space, specifically expressed as: ; in, Represents the final adversarial physical material information.

[0030] Furthermore, step S3 also includes: In the next physical confrontation, the material information of the triangular face of the 3D model corresponding to each scattering point needs to be modified. The sparse attack strategy is adopted to limit the range of the disturbed scattering points, that is, to limit the number of disturbed scattering points, including: Initialize a mask vector that is consistent with the perturbation vector The shape of is the same, and all elements are 1; the generated perturbation vector Multiply the mask vector element by element (i.e., Hadamard product) to limit the range of the perturbation by limiting the number of 1 elements in the mask vector; The perturbation vector The elements in are arranged in order of size. If an element is less than a certain threshold, the element with the corresponding index in the mask vector is set to 0, that is, the perturbation vector is removed. The disturbance in the mask vector is less than a certain threshold, so that the 0 elements in the mask vector continue to increase in iterations.

[0031] The present invention adopts a sparse adversarial strategy, fixing some pixels that have little effect on the classifier output in each iteration until a minimum subset of disturbed pixels is determined.

[0032] In order to map the disturbance of SAR geometric output data in digital space to physical space, the present invention defines a mapping model , used to generate the final adversarial material information, this process is called physical adversarial in the present invention. Specifically, the mapping model Used to generate the final adversarial material information , the mapping model There are three transformation relationships in it: Coordinate transformation: exporting data from SAR geometry The coordinate system of the scattering points in the image is converted to the coordinate system of the 3D model; Points correspond to triangles: SAR geometric output data The basic unit of the medium intensity value is the scattering point, while the basic unit of the 3D model material parameter is the triangle surface element, and there is a correspondence between the point and the triangle surface element; From intensity values ​​to material parameters: Converting SAR geometry to output data The change of the intensity value in corresponds to the change of the material parameters in the 3D model.

[0033] Furthermore, for coordinate conversion, the coordinates corresponding to each scattering point in the coordinate system of the 3D model are recorded by the RaySAR renderer, thereby realizing the conversion from the scattering point coordinate system to the coordinate system of the 3D model; For the point correspondence to the triangular surface element, since the area size of the triangular surface element constituting the 3D model is inconsistent, according to the triangular surface elements of different areas, the experiment of the present invention shows that the triangular surface element with a smaller area may correspond to one scattering point, while the triangular surface element with a larger area may correspond to multiple scattering points; and the goal of the present invention is to make the basic unit of the 3D model material parameter effect - the triangular surface element and the SAR geometric output data The basic unit of medium intensity value - scattering point corresponds one to one, so that the change of scattering point intensity value can be simulated by changing the material parameters of the triangle surface element; therefore, considering the different effects of multiple scattering points on the same triangle surface element, the scattering point with the largest change in intensity value before and after disturbance is selected as the benchmark to calculate the material parameters of the triangle surface element.

[0034] From intensity value to material parameter, since the calculation of intensity value in RaySAR renderer needs to consider many factors, such as the angle between triangle face and light source, it is difficult to directly obtain the material parameter of the corresponding triangle face through a certain intensity value. In addition, since radar signal usually scatters on the surface of the object rather than specular reflection in SAR imaging, the influence of scattering coefficient on intensity value is dominant among all material parameters. By adopting a single variable optimizer, the scattering coefficient of the triangle face corresponding to each scattering point is boundedly optimized. Specifically, by defining a function, inputting the scattering coefficient and using the same imaging parameters as before through the ray tracing renderer The absolute value of the difference between the output intensity value and the target intensity value is obtained by using the Brent algorithm (Brent, RP Algorithms for Minimization without Derivatives; Courier Corporation, 2013) to find the local minimum of this function in the interval [0,1], thereby obtaining the scattering coefficient corresponding to the target intensity value on the triangular face.

[0035] Figure 2 The physical deception method for SAR image target recognition provided by the present invention is different from other methods in principle. Due to the difference in data sets, and the principle of the adversarial method of the present invention is different from the existing adversarial methods, as shown in Table 1 and Figure 2 As shown. Whether it is digital confrontation or physical confrontation, the confrontation perturbation of the present invention is not directly added in the image space, so the experiment of the present invention does not select a baseline. For this reason, the experiment of the present invention will mainly verify whether the confrontation method proposed by the present invention is feasible, rather than whether the confrontation effect is strong. The present invention will first verify the effects of the proposed digital confrontation and physical confrontation respectively, and then verify their mobility in different network architectures respectively. Finally, the present invention will verify the influence of different pitch angles on the confrontation effect.

[0036] Table 1 - Comparison of SAR-PATT and existing methods

[0037] The present invention selects 6 different classifier networks to test the confrontation of the present invention, including 3 mainstream classifier networks and 3 lightweight classifier networks: ResNet-50, VGG-16, DenseNet-121, Mobilenet V2, SqueezeNet and ShuffleNet V2, all of which use the official implementation of PyTorch. The present invention trains these classifier networks separately, using the ImageNet pre-training model, and the hyperparameters are set as follows: the optimizer uses SGD with momentum, the learning rate is 0.001, the momentum is 0.9, the batch size is 32, and the maximum epoch is 80. The classification accuracy of the classifier network obtained by training in the present invention is shown in Table 2 below.

[0038] Table 2 - Accuracy of all classifier networks trained in the present invention on the test set ResNet-50 VGG-16 DenseNet-121 MobileNetV2 SqueezeNet ShuffleNetV2 Accuracy 98.6603% 98.2138% 92.4365% 98.4092% 93.8878% 97.2370% For the cheating method of the present invention, the hyperparameters are set as follows: the optimizer uses Adam, the learning rate is 0.05, the coefficient is 1, and the maximum number of iterations is 50. The experiments of the present invention are carried out on a workstation equipped with an NVIDIA GTX 1080 Ti 11GB GPU.

[0039] The present invention uses the fooling rate as an indicator for evaluating the attack effect, and the fooling rate is defined as follows:

[0040] in, is the total number of samples participating in the confrontation, is the classifier network of the present invention, is the generated adversarial sample, are their true labels. The fooling rate is the ratio of the number of samples misclassified by the classifier network to the total number of samples participating in the adversary.

[0041] The present invention conducts adversarial experiments on the test set and ensures that the images are correctly classified before being subjected to adversarial experiments. According to the adversarial method framework of the present invention, adversarial experiments are first conducted in the digital domain, and then the digital adversarial experiments are mapped to the physical domain. The present invention divides the results into two parts: the adversarial effects in the digital domain and their corresponding adversarial effects in the physical domain.

[0042] In the digital field, the present invention counted the fooling rates of adversarial samples generated for three targets on six networks, as shown in Table 3 below. The results show that the adversarial method of the present invention has a certain fooling rate for both general network structures and lightweight networks, among which ShuffleNetV2 has the highest fooling rate and ResNet-50 has the lowest fooling rate. For different targets, the fooling rate of sedan targets is the highest, reaching an average of 99.02%, and the off-road vehicle target has the lowest average fooling rate of 77.14%. This shows that the adversarial method of the present invention is effective in fooling the SAR target automatic recognition network. Figure 3 Added material information generated by the physical deception method for SAR image target recognition provided by the present invention Comparison of SAR image with real SAR image (the top one is the real SAR image, the bottom one is the one with added material information) SAR images), such as Figure 3 As shown in the figure, after adding the adversarial perturbation, they are all misclassified into other categories. The upper part of the figure is the original image, and the lower part is the perturbed image generated by the present invention. It can be seen that the adversarial method of the present invention can deceive the classifier with a high confidence level on the basis of having concealment that is difficult for the human eye to recognize.

[0043] Table 3- Digital adversarial fooling rates of different targets under 6 classification networks and their average fooling rates ResNet-50 VGG-16 DenseNet-121 MobileNetV2 SqueezeNet ShuffleNetV2 average value car 100% 94.12% 100% 100% 100% 100% 99.02% jeep 63.89% 85.24% 100% 59.17% 57.50% 97.02% 77.14% Van 77.42% 95.52% 83.61% 100% 99.58% 99.37% 92.58% The adversarial perturbations generated in the digital domain are transferred to the physical domain, and we have counted the fooling rates of the corresponding adversarial samples, as shown in Table 4 below. The fooling rates of the adversarial perturbations generated by the present invention in the physical world are somewhat lower than those in the digital world, with the highest fooling rate still being ShuffleNetV2 and the lowest being VGG-16. For different targets, the average fooling rate of the sedan target is still the highest, at 97.87%, and the lowest average fooling rate of the off-road vehicle target is 67.02%.

[0044] Table 4- Physical attack fooling rates of different targets under 6 classification networks and their average fooling rates and change levels ResNet-50 VGG-16 DenseNet-121 MobileNetV2 SqueezeNet ShuffleNetV2 average value car 100% ↓ 0% 88.39% ↓ 5.73% 100% ↓ 0% 100% ↓ 0% 100% ↓ 0% 98.85% ↓ 1.15% 97.87% ↓ 1.15% jeep 59.57% ↓ 4.32% 66.34% ↓ 18.90% 100% ↓ 0% 41.18% ↓ 17.99% 44.25% ↓ 13.25% 90.80% ↓ 6.22% 67.02% ↓ 10.12% Van 81.67% ↑ 4.25% 26.39% ↓ 69.13% 78.64% ↓ 4.97% 96.31% ↓ 3.69% 84.81% ↓ 14.77% 91.77% ↓ 7.60% 76.60% ↓ 15.98% The present invention proposes a physical deception method for SAR image target recognition, which can transfer adversarial perturbations that are difficult for the human eye to recognize in digital space to physical space, and cause misclassification of SAR ATR. A RaySAR renderer is used to realize the conversion from the physical world to the digital world, and an effective loss function is designed to update the digital perturbations through back propagation. Finally, the final digital perturbation is mapped back to the material information of the 3D model through a mapping model, thereby realizing the final physical perturbation. The physical deception method for SAR image target recognition disclosed in the present invention can effectively realize SAR deception in the physical world, achieving an average fooling rate of up to 99.02% in the digital world, and an average fooling rate of up to 97.87% in the physical world. Compared with existing methods, the method of the present invention bridges the gap between digital confrontation and physical confrontation, and has the possibility of being realized in the real world.

[0045] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A physical deception method for SAR image target recognition, characterized in that: The following steps are involved: S1: Generate SAR image from the 3D model of the target; S2: Use the RaySAR renderer to simulate the specular and diffuse reflections of radar signals using an approximate physical optics model and record the SAR geometric output data that determines the echo position in the image ; Output data for SAR geometry Post-processing to generate two-dimensional SAR images ; SAR image Input SAR automatic target recognition classification network , and get the predicted label ; S3: Output data for SAR geometry in digital space Generate adversarial perturbations; S4: Mapping adversarial perturbations to material information in physical space middle; S5: Output and add material information SAR images .

2. The physical deception method for SAR image target recognition according to claim 1, characterized in that: Step S1 specifically includes: Given a 3D model, the 3D model has grid information , Material information and imaging parameters , where grid information Including vertex coordinates, triangle face information, material information Including reflection coefficient, scattering coefficient and surface roughness, imaging parameters Including radar signal source coordinates, receiving antenna coordinates and pointing position.

3. The physical deception method for SAR image target recognition according to claim 2, characterized in that: SAR geometry output data in step S2 The resulting formula is expressed as follows: ； SAR image The resulting formula is expressed as follows: ； in, represents the post-processing model; Represents post-processing parameters, including the maximum / minimum value of the pitch angle, the maximum / minimum value and spacing of the range direction, and the maximum number of ray ejection; represents the real number domain; H represents the number of samplings in the range direction; W represents the number of samplings in the azimuth direction.

4. The physical deception method for SAR image target recognition according to claim 3 is characterized in that: Step S3 specifically includes: Output data for SAR geometry The adversarial perturbation generation of is regarded as an optimization problem, and the optimization function is as follows: ； In the formula, Represents the final SAR geometric output data; represents the loss function; represents the true label; Represents adversarial sample data.

5. The physical deception method for SAR image target recognition according to claim 4, characterized in that: Step S3 also includes: Use the L2 norm to perturb the vector To restrict, even if The minimum and final loss function is as follows: ； in, represents the optimization parameters; Represents SAR geometric output data The intensity value in ; A constant representing the balance between the classification loss and the limit perturbation intensity loss; represents the cross entropy loss function; Indicates a false label.

6. The physical deception method for SAR image target recognition according to claim 5, characterized in that: Step S3 also includes: The intensity value The range of is limited to [0,1], and the perturbation vector is ; make , so that ,in, Represents the original data, represents the optimization parameters; Initializing optimization parameters When , use the inverse function of the sigmoid function , to ensure that the perturbation vector Similarity to the original intensity value vector.

7. The physical deception method for SAR image target recognition according to claim 6, characterized in that: Step S3 specifically includes: Output data for SAR geometry The perturbation is mapped to the model Mapped to physical space, specifically expressed as: ； in, Represents the final adversarial physical material information.

8. The physical deception method for SAR image target recognition according to claim 7, characterized in that: Step S3 also includes: The sparse attack strategy is adopted to limit the range of the disturbance scattering points, that is, to limit the number of disturbance scattering points, including: Initialize a mask vector that is consistent with the perturbation vector The shape of is the same, and all elements are 1; the generated perturbation vector Multiply the mask vector element by element, and limit the scope of the perturbation by limiting the number of 1 elements in the mask vector; The perturbation vector The elements in are arranged in order of size. If an element is less than a certain threshold, the element with the corresponding index in the mask vector is set to 0, that is, the perturbation vector is removed. The disturbance in the mask vector is less than a certain threshold, so that the 0 elements in the mask vector continue to increase in iterations.

9. The physical deception method for SAR image target recognition according to claim 8, characterized in that: Mapping Model Used to generate the final adversarial material information , the mapping model There are three transformation relationships in it: Coordinate transformation: exporting data from SAR geometry The coordinate system of the scattering points in the image is converted to the coordinate system of the 3D model; Points correspond to triangles: SAR geometric output data The basic unit of the medium intensity value is the scattering point, while the basic unit of the 3D model material parameter is the triangle surface element, and there is a correspondence between the point and the triangle surface element; From intensity values ​​to material parameters: Converting SAR geometry to output data The change of the intensity value in corresponds to the change of the material parameters in the 3D model.

10. The physical deception method for SAR image target recognition according to claim 9, characterized in that: For coordinate conversion, the RaySAR renderer is used to record the coordinates of each scattering point in the coordinate system of the 3D model, thereby realizing the conversion from the scattering point coordinate system to the coordinate system of the 3D model; For the points corresponding to the triangular surface element, the scattering point with the largest change in intensity value before and after the disturbance is selected as the benchmark to calculate the material parameters of the triangular surface element.

Images