A synthetic aperture radar image adversarial sample generation method and device
By constructing a masking matrix and dynamically adjusting the strategy, the adversarial example generation process is optimized, which solves the problem of gradient estimation bias in synthetic aperture radar images, improves the generation effect and attack stability of adversarial examples, and enhances the transferability of adversarial examples.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SOUTHWEST JIAOTONG UNIV
- Filing Date
- 2025-05-27
- Publication Date
- 2026-06-26
Smart Images
Figure CN120847794B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of automatic target recognition security technology for synthetic aperture radar (SAR), and more specifically, to a method and apparatus for generating adversarial examples from SAR images. Background Technology
[0002] In existing synthetic aperture radar (SAR) automatic target recognition security technologies, two-dimensional high-resolution imaging is achieved by transmitting coherent electromagnetic pulses and receiving echo signals, combined with pulse compression and synthetic aperture techniques. However, in recent years, the sensitivity of SAR images to adversarial examples has revealed serious security vulnerabilities. Adversarial examples add perturbations to the input image that are imperceptible to human vision, causing the model's misclassification rate to exceed 90%. However, the speckle noise unique to SAR imaging exhibits a high-frequency random distribution in the frequency domain, while adversarial perturbations typically have high-frequency dominance. During gradient calculation, the noise component couples with the high-frequency part of the perturbation, leading to a systematic bias in the gradient estimation.
[0003] There is an urgent need for a method and apparatus for generating adversarial examples of synthetic aperture radar images, which solves the problem of systematic bias in gradient estimation. Summary of the Invention
[0004] The purpose of this invention is to provide a method and apparatus for generating adversarial examples for synthetic aperture radar images, thereby improving the aforementioned problems. To achieve the above objective, the technical solution adopted by this invention is as follows:
[0005] In a first aspect, this application provides a method for generating adversarial examples from synthetic aperture radar images, including:
[0006] Acquire image samples and initial parameters, the initial parameters including momentum gradient and adversarial examples;
[0007] The image samples are transformed by frequency components, and a masking matrix is constructed using the dimensions of the frequency components.
[0008] The image samples are predicted, and the adversarial samples are updated based on the prediction results to obtain the current predicted samples;
[0009] The current predicted sample is subjected to frequency domain feature transformation, and the frequency domain features are dynamically adjusted through the masking matrix and the gradients are calculated separately to obtain the integrated gradient;
[0010] The momentum gradient is updated based on the integrated gradient, and the current predicted sample is updated using the updated momentum gradient. When the number of iterations exceeds the preset total number of iterations, the final adversarial sample is output.
[0011] Secondly, this application also provides an adversarial example generation apparatus for synthetic aperture radar images, comprising:
[0012] An acquisition module is used to acquire image samples and initial parameters, wherein the initial parameters include momentum gradient and adversarial examples;
[0013] The transformation module is used to transform the image samples by frequency components and construct a masking matrix by the size of the frequency components.
[0014] The prediction module is used to predict the image samples, update the adversarial samples based on the prediction results, and obtain the current predicted samples.
[0015] The adjustment module is used to perform frequency domain feature transformation on the current prediction sample, dynamically adjust the frequency domain features through the masking matrix and calculate the gradients respectively to obtain the integrated gradient;
[0016] The update module is used to update the momentum gradient according to the integrated gradient, update the current prediction sample with the updated momentum gradient, and output the final adversarial sample when the number of iterations exceeds the preset total number of iterations.
[0017] The beneficial effects of this invention are as follows:
[0018] This invention dynamically adjusts the masking matrix to progressively enhance low-frequency perturbations and suppress high-frequency noise interference, thereby reducing the impact of speckle noise on adversarial gradient calculation and improving attack stability. Furthermore, it adaptively optimizes the matrix based on different iterative processes and adversarial sample generation requirements. By generating the current predicted sample using momentum gradients and updating the momentum gradient through gradient integration, the generation direction of adversarial samples is further optimized. This not only maintains the stability of the gradient update direction but also significantly reduces noise interference in the gradient calculation process. Addressing the common problem of coherent noise in synthetic aperture radar images, this invention employs a masking matrix and a dynamic adjustment strategy. The masking matrix technology allows for precise processing of image frequency domain information, and combined with the dynamic adjustment strategy, it effectively alleviates the problem of excessive gradient direction changes, improving the mobility and attack effectiveness of adversarial samples.
[0019] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing embodiments of the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description
[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0021] Figure 1 This is a schematic diagram of the adversarial sample generation method for synthetic aperture radar images described in this embodiment of the invention;
[0022] Figure 2 This is a schematic diagram of the adversarial sample generation device for synthetic aperture radar images described in an embodiment of the present invention.
[0023] The diagram is labeled as follows: 800, adversarial sample generation device for synthetic aperture radar images; 801, processor; 802, memory; 803, multimedia component; 804, I / O interface; 805, communication component. Detailed Implementation
[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.
[0025] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.
[0026] Example 1:
[0027] This embodiment provides a method for generating adversarial examples for synthetic aperture radar images.
[0028] See Figure 1 The figure shows that the method includes steps S1 to S5, including:
[0029] S1: Obtain image samples and initial parameters, the initial parameters including momentum gradient and adversarial examples;
[0030] In this step, the adversarial sample is the initialization adversarial sample. The momentum gradient is the initial momentum gradient g0 = 0.
[0031] S2: Transform the image samples by frequency components, and construct a masking matrix using the dimensions of the frequency components;
[0032] To clarify the specific method for obtaining the masking matrix, step S2 includes S21 to S23, specifically:
[0033] S21: Perform discrete cosine transform on the image sample to obtain frequency components, the frequency components including low-frequency components and high-frequency components;
[0034] S22: Divide the image sample into multiple quadrant regions, the quadrant regions including a first region and a second region;
[0035] In this step, the quadrant region includes four regions, with low-frequency components set in the first region A and high-frequency components set in the second region D.
[0036] S23: Construct a mask matrix with the same size as the frequency component based on the first region and the second region to obtain the masking matrix.
[0037] In this step, the weights of the four quadrant regions are initially set to 1;
[0038] The masking matrix is:
[0039]
[0040] In equation (1) above, Mask represents the masking matrix, μ represents the coefficient of the first region A, A represents the first region, H represents the height, W represents the width, B and C both represent other regions in the quadrant except for the first and second regions, D represents the second region, and γ represents the coefficient of the second region D.
[0041] The initial settings are μ = 1 and γ = 1.
[0042] S3: Predict the image sample, update the adversarial sample based on the prediction result, and obtain the current predicted sample;
[0043] In this step, the current predicted sample is an approximate point after prediction.
[0044] To clarify the specific method for obtaining the current prediction sample, step S3 includes S31 to S34, specifically:
[0045] S31: Perform target model prediction on the image sample, compare the image sample with the real label based on the prediction result and calculate the loss function value;
[0046] In this step, the loss function value is used to quantify the difference between the predicted result and the true label. The smaller the loss function value, the more accurate the prediction of the target model. If the updated adversarial sample does not meet the perturbation norm constraint, it needs to be adjusted to meet the perturbation norm constraint before proceeding to subsequent steps.
[0047] S32: Calculate the adversarial gradient of the current sample by backpropagating the gradient of the target model based on the loss function value;
[0048] In this step, the current sample adversarial gradient is:
[0049]
[0050] In equation (2) above, g t Let g represent the current momentum gradient, β represent the momentum decay coefficient, and g represent the momentum gradient. t-1 This represents the momentum gradient of the previous iteration. This represents the gradient of the current loss function with respect to the sample.
[0051] Wherein, the current momentum gradient g t In the next iteration, it serves as the momentum gradient g of the previous iteration. t-1 .
[0052] S33: Adjust the momentum gradient based on the direction of the current sample adversarial gradient to obtain the adjusted momentum gradient;
[0053] S34: Update the adversarial sample according to the step size of the adjusted momentum gradient and the initial parameters to obtain the current predicted sample.
[0054] In this step, the step size of the initial parameters is:
[0055]
[0056] In equation (3) above, α represents the step size, ε represents the perturbation threshold, and T represents the total number of iterations;
[0057] The updated prediction sample is:
[0058]
[0059] In equation (4) above, Let t' be the predicted sample in round t'. Let sign(g) represent the adversarial example in the t-th iteration, α represent the step size, and gt ) indicates the direction of the gradient.
[0060] Wherein, the t-th round of iterative adversarial sample In the next iteration, it serves as an adversarial example of the previous iteration. The predicted sample in round t′ is the current predicted sample, and the adversarial sample in round t is the adversarial sample.
[0061] S4: Perform frequency domain feature transformation on the current prediction sample, dynamically adjust the frequency domain features through the masking matrix and calculate the gradients respectively to obtain the integrated gradient;
[0062] To clarify the specific method for obtaining the integrated gradient, step S4 includes S41 to S45, which are as follows:
[0063] S41: Perform a discrete cosine transform on the current predicted sample to obtain frequency domain features;
[0064] In this step, the current predicted sample is transformed from the spatial domain to the frequency domain in order to better analyze and process the frequency components.
[0065] S42: Dynamically adjust the parameters of the masking matrix based on the current iteration round to generate a new masking matrix;
[0066] To clarify the specific method for obtaining the new masking matrix, step S42 includes steps S421 to S423, which are as follows:
[0067] S421: Adjust the element values of the masking matrix based on the changes in the current iteration round to obtain the adjusted masking matrix;
[0068] In this step, the changes in the frequency domain features are analyzed to determine the masking matrix element values that need to be adjusted, so as to better control the generation process of adversarial examples.
[0069] The coefficients of the first region A are adjusted as follows:
[0070]
[0071] In equation (5) above, μ n This represents the coefficient adjustment value of the first region A in the nth mask update, where n represents the current iteration number and N represents the total number of mask updates;
[0072] The coefficients of the second region D are adjusted as follows:
[0073]
[0074] In equation (6) above, γ nThis represents the coefficient adjustment value of the second region D in the nth mask update, where n represents the current iteration number and N represents the total number of mask updates.
[0075] S422: Based on the adjusted masking matrix, specific components of the masking matrix are optimized and adjusted to obtain an optimized masking matrix;
[0076] In this step, based on the preset target for generating adversarial examples, specific components that need to be optimized are determined to enhance the low-frequency components of the adversarial examples and weaken the high-frequency components.
[0077] S423: The optimized masking matrix is dynamically updated according to the adaptive algorithm to generate a new masking matrix.
[0078] S43: Mask the spectrum of the current prediction sample according to the new masking matrix to generate a perturbation spectrum;
[0079] S44: Perform an inverse discrete cosine transform on the disturbance spectrum to obtain multiple approximate samples;
[0080] In this step, the approximate sample is:
[0081]
[0082] In equation (7) above, This represents the nth approximate sample obtained by adjusting different spectral masks. IDCT stands for Inverse Discrete Cosine Transform, and DCT stands for Discrete Cosine Transform. Let t' be the predicted sample in round t', ⊙ denotes element-wise multiplication, and Mask. n This represents the new masking matrix.
[0083] Wherein, the nth approximate sample obtained by adjusting the different spectral masks represents the approximate sample, and the t′th round prediction sample represents the current prediction sample.
[0084] S45: Based on the target model, integrate multiple approximate samples to obtain the integrated gradient.
[0085] In this step, the integration gradient is:
[0086]
[0087] In equation (8) above, Indicates the integrated gradient. Represents the loss function For approximate samples The derivative, Let J represent the nth approximate sample obtained by adjusting different spectral masks, and let J() represent the loss function of the SAR image target detection model.
[0088] S5: Update the momentum gradient according to the integrated gradient, update the current predicted sample with the updated momentum gradient, and output the final adversarial sample when the number of iterations exceeds the preset total number of iterations.
[0089] To clarify the specific method for obtaining the final adversarial example, step S5 includes S51 to S54, specifically:
[0090] S51: Update the momentum gradient according to the integrated gradient to obtain the next momentum gradient;
[0091] In this step, the next momentum gradient is:
[0092]
[0093] In equation (9) above, g t " represents the next momentum gradient, β represents the momentum decay coefficient, and g t-1 This represents the momentum gradient of the previous iteration. Let ||·||2 represent the integrated gradient, and let L2 represent the L2 norm.
[0094] The L2 norm is used to integrate gradient normalization to ensure gradient direction stability and improve optimization efficiency.
[0095] S52: Adjust the current predicted sample based on the direction of the next momentum gradient to generate the next adversarial sample;
[0096] In this step, the adjustment is as follows: adjust the direction and amplitude of the image samples to generate more effective adversarial examples;
[0097] The next adversarial example is:
[0098]
[0099] In the above formula (10), This represents the adversarial example in the (t+1)th iteration. Let g represent the adversarial example in the t-th iteration, α represent the step size, and g t "Indicates the next momentum gradient;
[0100] The adversarial sample in the (t+1)th round represents the next adversarial sample.
[0101] S53: Determine the current iteration number from the preset total number of iterations. If the current iteration number exceeds the total number of iterations, select the next adversarial sample as a candidate adversarial sample.
[0102] In this step, it is determined whether the current iteration number t is less than the preset total iteration number T. If the current iteration number t is less than the preset total iteration number T, then t = t + 1, and proceed to step S3 to continue iterating; if the current iteration number t is greater than or equal to the preset total iteration number T, then the next adversarial sample is taken as a candidate adversarial sample.
[0103] The candidate adversarial samples are:
[0104]
[0105] In equation (10) above, x adv Indicates candidate adversarial examples, Indicates adversarial examples The value is limited to the range [-ε, ε] to ensure that the perturbation amplitude does not exceed the perturbation threshold ε. Let represent the adversarial sample generated after the Tth iteration, and ε represent the perturbation threshold.
[0106] S54: Prune the perturbation of the candidate adversarial sample according to the preset perturbation threshold range, and output the final adversarial sample.
[0107] Example 2: This example provides an adversarial example generation device for synthetic aperture radar images, the device comprising:
[0108] An acquisition module is used to acquire image samples and initial parameters, wherein the initial parameters include momentum gradient and adversarial examples;
[0109] The transformation module is used to transform the image samples by frequency components and construct a masking matrix by the size of the frequency components.
[0110] To clarify the specific methods for obtaining the transformation module, the following are included:
[0111] The first transformation unit is used to perform discrete cosine transform on the image sample to obtain frequency components, the frequency components including low-frequency components and high-frequency components;
[0112] A segmentation unit is used to divide the image sample into multiple quadrant regions, the quadrant regions including a first region and a second region;
[0113] A construction unit is used to construct a mask matrix with the same size as the frequency component based on the first region and the second region, thereby obtaining a masking matrix.
[0114] The prediction module is used to predict the image samples, update the adversarial samples based on the prediction results, and obtain the current predicted samples.
[0115] To clarify the specific methods for obtaining the prediction module, the following are included:
[0116] The computing unit is used to perform target model prediction on the image sample, compare the image sample with the real label based on the prediction result and calculate the loss function value.
[0117] The first update unit is used to backpropagate the gradient of the target model's parameters based on the loss function value to obtain the adversarial gradient of the current sample.
[0118] The first comparison unit is used to adjust the momentum gradient based on the direction of the current sample's adversarial gradient to obtain the adjusted momentum gradient.
[0119] A generation unit is used to update the adversarial sample according to the step size of the adjusted momentum gradient and the initial parameters to obtain the current predicted sample.
[0120] The adjustment module is used to perform frequency domain feature transformation on the current prediction sample, dynamically adjust the frequency domain features through the masking matrix and calculate the gradients respectively to obtain the integrated gradient;
[0121] To clarify the specific methods for obtaining the adjustment module, the following are included:
[0122] The second transformation unit is used to perform discrete cosine transform on the current prediction sample to obtain frequency domain features;
[0123] The second adjustment unit is used to dynamically adjust the parameters of the masking matrix based on the current iteration round to generate a new masking matrix;
[0124] The first processing unit is used to mask the spectrum of the current prediction sample according to the new masking matrix to generate a perturbation spectrum;
[0125] The third transformation unit is used to perform inverse discrete cosine transform on the disturbance spectrum to obtain multiple approximate samples;
[0126] The second processing unit is used to integrate multiple approximate samples according to the target model to obtain an integrated gradient.
[0127] The update module is used to update the momentum gradient according to the integrated gradient, update the current prediction sample with the updated momentum gradient, and output the final adversarial sample when the number of iterations exceeds the preset total number of iterations.
[0128] To clarify the specific methods for obtaining the update module, the following are provided:
[0129] The second update unit is used to update the momentum gradient according to the integrated gradient to obtain the next momentum gradient;
[0130] The first adjustment unit is used to adjust the current predicted sample based on the direction of the next momentum gradient to generate the next adversarial sample;
[0131] The judgment unit is used to judge the current iteration number and the preset total number of iterations. When the current iteration number exceeds the total number of iterations, the next adversarial sample is selected as a candidate adversarial sample.
[0132] The second comparison unit is used to prune the perturbation of the candidate adversarial sample according to a preset perturbation threshold range and output the final adversarial sample.
[0133] It should be noted that the specific manner in which each module performs its operation in the apparatus described above has been described in detail in the embodiments of the method, and will not be elaborated here.
[0134] Example 3:
[0135] Corresponding to the above method embodiments, this embodiment also provides an adversarial sample generation device for synthetic aperture radar images. The adversarial sample generation device for synthetic aperture radar images described below and the adversarial sample generation method for synthetic aperture radar images described above can be referred to in correspondence with each other.
[0136] Figure 2 This is a block diagram illustrating an adversarial sample generation device 800 for synthetic aperture radar images, according to an exemplary embodiment. Figure 2 As shown, the adversarial example generation device 800 for synthetic aperture radar images may include: a processor 801 and a memory 802. The adversarial example generation device 800 may also include one or more of a multimedia component 803, an I / O interface 804, and a communication component 805.
[0137] The processor 801 controls the overall operation of the adversarial example generation device 800 for synthetic aperture radar (SAR) images to complete all or part of the steps in the aforementioned adversarial example generation method for SAR images. The memory 802 stores various types of data to support the operation of the SAR image adversarial example generation device 800. This data may include, for example, instructions for any application or method operating on the SAR image adversarial example generation device 800, as well as application-related data such as contact data, sent and received messages, images, audio, video, etc. The memory 802 can be implemented using any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The multimedia component 803 may include a screen and an audio component. The screen may be, for example, a touchscreen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in the memory 802 or transmitted via the communication component 805. The audio component also includes at least one speaker for outputting audio signals. I / O interface 804 provides an interface between processor 801 and other interface modules, such as a keyboard, mouse, and buttons. These buttons can be virtual or physical. Communication component 805 is used for wired or wireless communication between the synthetic aperture radar image adversarial example generation device 800 and other devices. Wireless communication includes, for example, Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, or 4G, or a combination thereof. Therefore, the corresponding communication component 805 may include a Wi-Fi module, a Bluetooth module, or an NFC module.
[0138] In an exemplary embodiment, the adversarial example generation device 800 for synthetic aperture radar images may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the adversarial example generation method for synthetic aperture radar images described above.
[0139] Example 4:
[0140] Corresponding to the above method embodiments, this embodiment also provides a medium. The medium described below can be referred to in relation to the adversarial example generation method for synthetic aperture radar images described above.
[0141] A medium storing a computer program, which, when executed by a processor, implements the steps of the method for generating adversarial examples of synthetic aperture radar images as described in the above method embodiments.
[0142] The medium can specifically be any medium capable of storing program code, such as a USB flash drive, external hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.
[0143] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
[0144] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A method for generating adversarial examples from synthetic aperture radar images, characterized in that, include: Acquire image samples and initial parameters, the initial parameters including momentum gradient and adversarial examples; The image samples are transformed by frequency components, and a masking matrix is constructed using the dimensions of the frequency components. The image samples are predicted, and the adversarial samples are updated based on the prediction results to obtain the current predicted samples; The current predicted sample is subjected to frequency domain feature transformation, and the frequency domain features are dynamically adjusted through the masking matrix and the gradients are calculated separately to obtain the integrated gradient; The masking matrix is: ； In the above formula, Represents the masking matrix. This represents the coefficient of the first region A. Indicates the first region. Indicates altitude, Indicates width, and All of these represent the regions within the quadrant other than the first and second regions. Indicates the second region. The coefficients representing the second region D; Among them, the initial settings , The specific methods for dynamically adjusting the masking matrix include: The coefficients of the first region A are adjusted as follows: ； In the above formula, Indicates the first In the next mask update, the coefficient adjustment value of the first region A is... Indicates the current iteration number. This indicates the total number of times the mask has been updated; The coefficients of the second region D are adjusted as follows: ； In the above formula, Indicates the first In the next mask update, the coefficient adjustment value of the second region D is... Indicates the current iteration number. This indicates the total number of times the mask has been updated; The momentum gradient is updated based on the integrated gradient, and the current predicted sample is updated using the updated momentum gradient. When the number of iterations exceeds the preset total number of iterations, the final adversarial sample is output.
2. The method for generating adversarial examples of synthetic aperture radar images according to claim 1, characterized in that, The image samples are transformed by frequency components, and a masking matrix is constructed using the dimensions of the frequency components, including: The image samples are subjected to discrete cosine transform to obtain frequency components, which include low-frequency components and high-frequency components. The image sample is divided into multiple quadrant regions, including a first region and a second region; Based on the first region and the second region, a mask matrix with the same size as the frequency component is constructed to obtain the masking matrix.
3. The method for generating adversarial examples of synthetic aperture radar images according to claim 1, characterized in that, The process of predicting the image sample and updating the adversarial sample based on the prediction result to obtain the current predicted sample includes: predicting the image sample using a target model, comparing the image sample with the true label based on the prediction result and calculating the loss function value. The parameter gradient of the target model is calculated by backpropagation based on the loss function value to obtain the adversarial gradient of the current sample. The momentum gradient is adjusted based on the direction of the current sample's adversarial gradient to obtain the adjusted momentum gradient; The adversarial sample is updated based on the step size of the adjusted momentum gradient and the initial parameters to obtain the current predicted sample.
4. The method for generating adversarial examples of synthetic aperture radar images according to claim 3, characterized in that, The current predicted sample undergoes frequency domain feature transformation. The frequency domain features are dynamically adjusted using the masking matrix, and gradients are calculated separately to obtain the integrated gradient, including: Perform a discrete cosine transform on the current predicted sample to obtain frequency domain features; The parameters of the masking matrix are dynamically adjusted based on the current iteration round to generate a new masking matrix; The spectrum of the current prediction sample is masked according to the new masking matrix to generate a perturbation spectrum; Perform an inverse discrete cosine transform on the disturbance spectrum to obtain multiple approximate samples; The integrated gradient is obtained by integrating multiple approximate samples according to the target model.
5. The method for generating adversarial examples of synthetic aperture radar images according to claim 1, characterized in that, The momentum gradient is updated based on the integrated gradient, and the current predicted sample is updated using the updated momentum gradient. When the number of iterations exceeds a preset total number of iterations, the final adversarial sample is output, including: The momentum gradient is updated based on the integrated gradient to obtain the next momentum gradient; The current predicted sample is adjusted based on the direction of the next momentum gradient to generate the next adversarial sample; The current iteration number is compared with the preset total number of iterations. If the current iteration number exceeds the preset total number of iterations, the next adversarial sample is selected as a candidate adversarial sample. The perturbations of the candidate adversarial samples are pruned according to a preset perturbation threshold range, and the final adversarial samples are output.
6. An adversarial example generation device for synthetic aperture radar images, characterized in that, include: An acquisition module is used to acquire image samples and initial parameters, wherein the initial parameters include momentum gradient and adversarial examples; The transformation module is used to transform the image samples by frequency components and construct a masking matrix by the size of the frequency components. The prediction module is used to predict the image samples, update the adversarial samples based on the prediction results, and obtain the current predicted samples. The adjustment module is used to perform frequency domain feature transformation on the current prediction sample, dynamically adjust the frequency domain features through the masking matrix and calculate the gradients respectively to obtain the integrated gradient; The masking matrix is: ； In the above formula, Represents the masking matrix. This represents the coefficient of the first region A. Indicates the first region. Indicates altitude, Indicates width, and All of these represent the regions within the quadrant other than the first and second regions. Indicates the second region. The coefficients representing the second region D; Among them, the initial settings , The specific methods for dynamically adjusting the masking matrix include: The coefficients of the first region A are adjusted as follows: ； In the above formula, Indicates the first In the next mask update, the coefficient adjustment value of the first region A is... Indicates the current iteration number. This indicates the total number of times the mask has been updated; The coefficients of the second region D are adjusted as follows: ； In the above formula, Indicates the first In the next mask update, the coefficient adjustment value of the second region D is... Indicates the current iteration number. This indicates the total number of times the mask has been updated; The update module is used to update the momentum gradient according to the integrated gradient, update the current prediction sample with the updated momentum gradient, and output the final adversarial sample when the number of iterations exceeds the preset total number of iterations.
7. The adversarial example generation apparatus for synthetic aperture radar images according to claim 6, characterized in that, The transformation module includes: The first transformation unit is used to perform discrete cosine transform on the image sample to obtain frequency components, the frequency components including low-frequency components and high-frequency components; A segmentation unit is used to divide the image sample into multiple quadrant regions, the quadrant regions including a first region and a second region; A construction unit is used to construct a mask matrix with the same size as the frequency component based on the first region and the second region, thereby obtaining a masking matrix.
8. The adversarial example generation apparatus for synthetic aperture radar images according to claim 6, characterized in that, The prediction module includes: The computing unit is used to perform target model prediction on the image sample, compare the image sample with the real label based on the prediction result and calculate the loss function value. The first update unit is used to backpropagate the gradient of the target model's parameters based on the loss function value to obtain the adversarial gradient of the current sample. The first comparison unit is used to adjust the momentum gradient based on the direction of the current sample's adversarial gradient to obtain the adjusted momentum gradient. A generation unit is used to update the adversarial sample according to the step size of the adjusted momentum gradient and the initial parameters to obtain the current predicted sample.
9. The adversarial example generation apparatus for synthetic aperture radar images according to claim 8, characterized in that, The adjustment module includes: The second transformation unit is used to perform discrete cosine transform on the current prediction sample to obtain frequency domain features; The second adjustment unit is used to dynamically adjust the parameters of the masking matrix based on the current iteration round to generate a new masking matrix; The first processing unit is used to mask the spectrum of the current prediction sample according to the new masking matrix to generate a perturbation spectrum; The third transformation unit is used to perform inverse discrete cosine transform on the disturbance spectrum to obtain multiple approximate samples; The second processing unit is used to integrate multiple approximate samples according to the target model to obtain an integrated gradient.
10. The adversarial example generation apparatus for synthetic aperture radar images according to claim 6, characterized in that, The update module includes: The second update unit is used to update the momentum gradient according to the integrated gradient to obtain the next momentum gradient; The first adjustment unit is used to adjust the current predicted sample based on the direction of the next momentum gradient to generate the next adversarial sample; The judgment unit is used to judge the current iteration number and the preset total number of iterations. When the current iteration number exceeds the total number of iterations, the next adversarial sample is selected as a candidate adversarial sample. The second comparison unit is used to prune the perturbation of the candidate adversarial sample according to a preset perturbation threshold range and output the final adversarial sample.