SAR-PATT: A Physical Adversarial Attack for SAR Image Automatic Target Recognition

Abstract

Deep neural network-based synthetic aperture radar (SAR) automatic target recognition (ATR) systems are susceptible to attack by adversarial examples, which leads to misclassification by the SAR ATR system, resulting in theoretical model robustness problems and security problems in practice. Inspired by optical images, current SAR ATR adversarial example generation is performed in the image domain. However, the imaging principle of SAR images is based on the imaging of the echo signals interacting between the SAR and objects. Generating adversarial examples only in the image domain cannot change the physical world to achieve adversarial attacks. To solve these problems, this article proposes a framework for generating SAR adversarial examples in a 3D physical scene. First, adversarial attacks are implemented in the 2D image space, and the perturbation in the image space is converted into simulated rays that constitute SAR images through backpropagation optimization methods. The mapping between the simulated rays constituting SAR images and the 3D model is established through coordinate transformation, and point correspondence to triangular faces and intensity values to texture parameters are established. Thus, the simulated rays constituting SAR images are mapped to the 3D model, and the perturbation in the 2D image space is converted back to the 3D physical space to obtain the position and intensity of the perturbation in the 3D physical space, thereby achieving physical adversarial attacks. The experimental results show that our attack method can effectively perform SAR adversarial attacks in the physical world. In the digital world, we achieved an average fooling rate of up to 99.02% for three objects in six classification networks. In the physical world, we achieved an average fooling rate of up to 97.87% for these objects, with a certain degree of transferability across the six different network architectures. To the best of our knowledge, this is the first work to implement physical attacks in a full physical simulation condition. Our research establishes a theoretical foundation for the future concealment of SAR targets in practical settings and offers valuable insights for enhancing the attack and defense capabilities of subsequent DNNs in SAR ATR systems.

1. Introduction

Deep neural networks (DNNs) have been widely used in the field of remote sensing image recognition, including optical remote sensing image target recognition and synthetic aperture radar (SAR) automatic target recognition (ATR) [1,2,3]. However, the existence of adversarial examples [4] limits the application of SAR ATR. Through carefully designed, imperceptible perturbations that are difficult for the human eye to detect, it is possible to mislead DNNs into generating incorrect predictions. The issue of adversarial examples has received widespread attention from the academic and industrial communities, becoming a focal point in the field of artificial intelligence security [5,6,7].

Currently, in the remote sensing field, there are many studies of adversarial attacks [8,9]. In the SAR ATR field, researchers are also conducting research on adversarial attacks, with the majority being digital attacks, i.e., directly adding perturbations to the pixels of the image, with the perturbations thus existing in digital space. For example, attackers can directly apply attack methods and principles from optical remote sensing images to adversarial attacks in SAR images [10,11,12,13] or use a sparse attack strategy to confine perturbations to the target area in the image [14,15]. These attack methods generate perturbations that are stealthy, making them difficult for observers to detect and posing a threat to the widespread application of SAR ATR.

However, most of these digital attack methods are based on the principles of optical image attacks and do not consider the differences between the imaging mechanisms of SAR and optical images. The pixel information in SAR images is actually related to backscatter information associated with factors such as radar system parameters and the surface specificities of objects, while visible light imaging is influenced mainly by the color and surface specificities of objects, with different colors and materials absorbing and reflecting light of different wavelengths. Therefore, images generated based on the principles of optical image attacks may not conform to SAR imaging characteristics. Considering the potential for adversarial attacks to be implemented in the real world, in this article, we focus on physical attacks, i.e., adding perturbations in the real-world environment or physical simulators so that the perturbations exist in physical space. Compared to digital attacks, physical attacks pose greater potential threats to society. Moreover, we believe that adversarial examples generated through simulators based on SAR imaging mechanisms are more in line with the SAR imaging mechanisms, making the attacks stealthier.

Physical adversarial attacks have received widespread attention in the optical image recognition field [16,17]. Examples include patch-based attacks [18] and camouflage-based attacks [19]. These methods mount attacks by modifying the patterns on the surface of objects. However, these methods cannot be directly transferred to the SAR field because of the different imaging mechanisms. SAR images record the backscatter information of terrestrial targets, so simply modifying the pattern on the surface of an object cannot change the pixel values of the images. It is necessary to change the surface texture properties of the object, such as the scattering coefficient, surface roughness, and other parameters, to cause changes in the radar echo signal and thereby change the pixel values of the SAR images.

To address the above issues, we propose a pipeline for SAR physical adversarial attack (SAR-PATT). First, to connect the digital world with the physical world, our attack includes both digital and physical parts. Our digital adversarial perturbations act on the output data in SAR geometry, i.e., the scattering points and scattering intensity information generated by the ray tracer. Our physical adversarial perturbations act on the texture parameters of 3D objects, and we use the SAR simulation program RaySAR [20], which is based on ray tracing, to generate 2D SAR images. In previous research, RaySAR has been widely used as a simulator for SAR imaging [21]. Since RaySAR is a nondifferentiable system and physical adversarial perturbations cannot be obtained directly through optimization, we first design an effective loss function and update the digital perturbations through backpropagation. Finally, the final digital perturbations are mapped back into the texture information of the 3D model through a mapping module, thereby updating the physical perturbations. To test our attack method, we add three categories to the Moving and Stationary Target Acquisition and Recognition (MSTAR) dataset [22], namely, CAR, JEEP, and VAN, thus forming a classification dataset with a total of 13 categories, and conduct a series of experiments to prove the effectiveness of our proposed attack method. Our main contributions are summarized as follows:

• To the best of our knowledge, we are the first to design an end-to-end physical adversarial attack pipeline for SAR images that achieves adversarial attacks by changing the surface texture parameters of 3D targets in the physical world, thereby converting adversarial perturbations from the digital space to the physical space.
• We propose a new adversarial attack method for SAR ATRs based on the SAR imaging mechanism, which can generate adversarial examples that conform to SAR imaging characteristics. In the digital part, we use an optimization method to generate adversarial perturbations in the SAR geometric output data. In the physical part, we establish a digital–physical mapping module so that the perturbations ultimately act in physical space. Through the SAR imaging simulation process, the perturbations are converted into perturbations in the SAR images, making the attack stealthy.
• Our method has the potential to be implemented in the real world. Experiments show that in the physical world, our method achieves an average fooling rate of up to 97.87%. In addition, the digital and physical attacks we propose have certain transferability to different network architectures. The adversarial examples generated based on VGG-16 have an average fooling rate of 77.5% for the other five black-box models. Moreover, the physical attack is robust under different azimuths.

2. Related Works

To study physical adversarial attacks on SAR ATR, we investigate the current state of research in three related fields, namely, SAR automatic target recognition, adversarial attacks on SAR ATR, and SAR simulation.

2.1. SAR Automatic Target Recognition

Traditional feature extraction methods rely on human experience and have poor generalizability. However, deep learning (especially convolutional neural networks, (CNNs) can automatically learn features from data, extract features, and perform classification. Therefore, deep learning-based methods have strong high-level feature learning ability and high classification accuracy [23,24,25,26,27]. Because of these advantages, SAR ATR has also gradually incorporated deep learning, and in recent years, deep learning-based SAR ATR has developed rapidly.

Shao et al. [28] were the first to apply several representative CNN models to SAR ATR. They analyzed the performances of different CNN models on the MSTAR dataset and their results show that compared with traditional algorithms, most CNNs demonstrate superior performance, achieving an accuracy rate of over 99% on the MSTAR dataset. Soldin et al. [29] used ResNet-18 on the MSTAR dataset to verify the effectiveness of SAR ATR based on deep learning, achieving an accuracy rate of up to 99% for 10 types of targets. The aforementioned research uses ready-made CNN models to demonstrate the effectiveness of incorporating deep learning into SAR ATR. In addition, some researchers have designed specialized CNNs. Xu et al. [30] proposed the deep CNN model SARNet for SAR ATR, which has two convolution-pooling layers and two fully connected layers. It achieved an accuracy rate of 95.68% on the MSTAR dataset. Zhai et al. [31] proposed MF-SARNet for SAR ATR. The Fire module in the network is used to extract features and requires fewer parameters. MF-SARNet consists of 18 convolutional layers, 2 fully connected layers, and 8 Fire modules. Using data enhancement based on clockwise rotation, the dataset was expanded 360 times, achieving an accuracy rate of 98.53% on the MSATR dataset. Shang et al. [32] proposed M-Net to solve the overfitting problem caused by insufficient samples. M-Net uses an information recorder to store spatial features and uses spatial similarity to predict the labels of unknown samples. To better optimize M-Net, parameter transfer training was adopted. The first step involved training the CNN on M-Net and initializing the parameters. The second step involved using the initialized parameters and training the model with the MSTAR dataset. The model achieved an accuracy rate of 99.71% on the MSTAR dataset. However, given the widespread application of SAR ATR, it is also necessary to study adversarial attacks against SAR ATR to help enhance the security of SAR ATR and thus expand the application field of SAR ATR.

2.2. Adversarial Attacks on SAR ATR

Since Szegedy et al. [4] first discovered adversarial examples, a large amount of research has been conducted on adversarial examples in the computer vision field. Currently, attacks on SAR ATR can be divided into two main categories: attacks in the computer vision field and attacks designed for SAR ATR.

2.2.1. Attacks in the Computer Vision Field

These methods verify the vulnerability of SAR ATR models by drawing on attack algorithms in the computer vision field. Initially, Li et al. [10] used two classic white-box attack methods, FGSM and BIM, to generate adversarial examples from the MSTAR dataset and the SENSAR dataset and evaluated the vulnerability of six commonly used CNNs. The results show that adversarial examples are quite effective in fooling SAR ATR. Huang et al. [11] used three mainstream algorithms to generate adversarial examples to attack three typical CNNs of SAR ATR using the MSTAR dataset for experiments and proved the vulnerability of SAR ATR. Pang et al. [33] designed a CNN for SAR target classification and conducted an adversarial example analysis on it using FGSM and BIM. Wang et al. [13] attacked SAR ATR using universal adversarial perturbations (UAPs). Thereafter, more researchers began to enter this field. Zhou et al. [34] compared several mainstream adversarial attack methods and evaluated the security of the used DNN from the perspective of attention. Peng et al. [35] proposed a completely black-box universal attack framework FBUA for creating UAPs for SAR ATR. FBUA can be divided into three main stages: (1) SAR image simulation, (2) substitute model training, and (3) UAP generation. Comprehensive evaluations were conducted on the MSTAR and SARSIM datasets to analyze the performance of the FBUA.

2.2.2. Attacks Designed for SAR ATR

These methods usually consider the distinct mechanism of SAR imaging and are highly relevant for SAR imaging. Meng et al. [14] proposed a new target-area-based adversarial attack method for SAR ATR. First, they extracted the mask of the target in the SAR image and then introduced the mask parameters into the loss function of the perturbation generator to aggregate the perturbations into the target area. This method provides a theoretical basis for the camouflaging of SAR targets in the physical world. Zhang et al. [15] proposed a new adversarial attack algorithm for SAR ATR that has a higher deception success rate, higher recognition confidence, and smaller perturbation coverage than other advanced SAR attack methods. Peng et al. [36] proposed a speckle-variant attack (SVA), which achieves speckle variant transformation, continuously reconstructs the speckle noise pattern in each iteration process to achieve strong transferability and ensures the feasibility of adversarial perturbations in actual scenarios by limiting the area of perturbation. Therefore, the SVA can generate adversarial examples with greater transferability and physical feasibility. At the same time, researchers have begun to focus on the practical feasibility of adversarial attacks. Xia et al. [37] proposed SAR-PeGA, a perturbation generation algorithm for SAR ATR, which adjusts the phase characteristics of the reflected signal with variable phase sequences, thereby generating adversarial perturbations on the SAR echo signal. Peng et al. [38] explored the domain knowledge of the SAR imaging process and proposed a novel scattering model-guided adversarial attack (SMGAA) algorithm, which can generate adversarial perturbations in the form of electromagnetic scattering responses (called adversarial scatterers). Zhou et al. [39] believe that the adversarial attack algorithm for SAR ATR should consider scattering features such as the attribute scattering center (ASC) and proposed an attack algorithm called ASC-STA. This method can achieve a high success rate without complex parameter settings and can generate high-quality perturbed images. Ma et al. [40] argue that only partially occluding the target region, such as by coating it with absorbing materials, can effectively interfere with the SAR target recognition results and thus, proposed a method for generating adversarial examples of partially obscured SAR targets. Cui et al. [41] proposed a physically oriented adversarial attack for SAR image target recognition. They first identified the prominent areas of the SAR target that the classifier focused on and then continuously refined the adversarial scatterer attribute parameters based on dynamic step optimization of the differential equation. Xie et al. [42] discussed the physical realizability of SAR adversarial examples. They proposed a metasurface interference-guided attack to craft metasurface-based adversarial perturbations. Zhang et al. [43] proposed a SAR adversarial attack method that includes target perturbation generation and background perturbation generation. They use attention mechanisms to extract target regions and scattering models to generate scatterer images as perturbations. Ma et al. [44] integrated electromagnetic computation and a differential evolution algorithm and proposed an adversarial attack against SAR ATR that only uses simple scatterers near the target, such as corner reflectors.

Because attacks in the computer vision field lack prior information and domain knowledge of SAR imaging and because the attacks designed for SAR ATR have not involved research on physical domain attacks, these attack methods are difficult to implement in real scenarios. We therefore consider physical domain attacks, hoping to inspire further research in this field.

2.3. SAR Simulation

To obtain SAR images under the constraints of physical conditions, various types of SAR simulation techniques have been proposed that can simulate the effects of changes in radar system parameters and target electromagnetic scattering characteristics on imaging. RaySAR is a SAR simulator based on ray-tracing methods developed by Auer et al. [45] It extends the open-source ray-tracing rendering software POV-Ray, which is aimed at simulating radar signals in 3D coordinate systems, including azimuth, range, and elevation. RaySAR uses an approximate physical optics model to simulate the specular reflection component and diffuse reflection component of radar signals and employs ray-tracing methods to record the reflection direction and reflection components, with the ray paths determining the positions of echoes in the image. CohRaS®, developed by Hammer and Schulz [46], is also based on ray tracing and is used to simulate high-resolution small scenes, providing training data for classifiers and sample data for the training of image analysis personnel. SARViz, developed by Balz and Stilla [47], is based on rasterization methods for real-time single-bounce simulations. It allows for very fast simulations but has certain limitations in terms of geometric and radiometric accuracy.

Based on RaySAR, Tao et al. [48] proposed a method to support automatic interpretation of meter-level resolution SAR images in complex urban scenes. They compared simulated images with TerraSAR-X Spotlight images, demonstrating good geocoding accuracy, reasonable mask layers, and precise overlapping outlines of individual buildings. Mason et al. [49] developed a method to detect urban flooding using near real-time SAR data. This method utilizes RaySAR combined with LiDAR data of urban areas to predict radar shadows and stagnation areas caused by buildings and tall vegetation in images. Niu et al. [50] proposed a framework to train a DNN to establish a relationship between SAR images and RaySAR simulation parameters, further improving the accuracy of SAR images. Yu and Takeuchi [21] used RaySAR to generate reflectivity maps corresponding to different types of radar backscatter signals for 3D typical targets and a collapse model. By combining the geometric and physical information of the targets, they analyzed the correspondence between point and line features, different scattering signals, and specific target structures in the simulated SAR images. Jia et al. [51] conducted a comprehensive comparative study on SAR imaging in large coastal scenes based on raw Sentinel-1 data, SAR imaging simulations, and Google Maps. They validated the effectiveness of the parallel Range-Doppler algorithm and the RaySAR simulator based on backwards ray tracing. Boyoğlu et al. [52] used RaySAR to simulate TerraSAR-X data for looting holes research. They excavated simulated looting holes and constructed photogrammetric representations for RaySAR to simulate, which shows the benefits of SAR simulation in saving cultural historical objects. Therefore, we use RaySAR to simulate SAR imaging in this study.

3. Method

This section introduces the preliminaries. Then, the proposed method is described in detail, including how to generate adversarial examples in digital and physical worlds.

3.1. Preliminaries

First, we define the forward process of generating SAR images from a 3D model as follows: A 3D model has mesh information $\mathbf{M}$ and texture information $\mathbf{T}$. The mesh information $\mathbf{M}$ includes vertex coordinates and triangle indices, and the texture information $\mathbf{T}$ includes the reflection coefficient, scattering coefficient, surface roughness, etc. The imaging parameter ${\theta }_c$ includes the radar signal source coordinates, receiving antenna coordinates, pointing position, etc. We use a ray-tracing renderer $\mathcal{R}$, adopting an approximate physical optics model to simulate the specular and diffuse reflections of radar signals, and we record the reflection direction and ray path $\mathbf{C}$ that determine the echo position in the image. This process can be expressed by $\mathbf{C}=\mathcal{R}(\mathbf{M},\mathbf{T};{\theta }_c)$. To generate a 2D SAR image $\mathbf{I}$, reprocessing $\mathcal{F}$ needs to be performed on $\mathbf{C}$, which can be expressed by $\mathbf{I}=\mathcal{F}(\mathbf{C};{\theta }_p),\mathbf{I}\in {\mathbb{R}}^{H\times W\times 1}$, where ${\theta }_p$ is the reprocessing parameter, including the maximum/minimum values of the azimuth, the maximum/minimum values and spacing of the range, the maximum number of ray bounces, etc. Then, we input the image $\mathbf{I}$ into the SAR ATR classification network $\mathcal{C}$ and obtain the predicted label $y=\mathcal{C}\left(\mathbf{I}\right)$.

Our attack is implemented in the digital space and physical space sequentially. First, adversarial perturbations are generated in the digital space for the SAR geometry data $\mathbf{C}$, and then the perturbations are further mapped to the texture information $\mathbf{T}$ in the physical space. Therefore, we define the perturbation of $\mathbf{C}$ as a digital attack, and we regard the generation of perturbation as an optimization problem. The objective function is

$${\mathbf{C}}_{adv}^{*}=argmax\mathcal{L}(\mathcal{C}\left(\mathcal{F}({\mathbf{C}}_{adv},{\theta }_p)\right),y_{gt})$$

(1)

where ${\mathbf{C}}_{adv}^{*}$ is the final adversarial SAR geometry data, $\mathcal{L}(·,·)$ is the loss function, and $y_{gt}$ is the ground truth label. By solving the optimization problem described in Equation (1), we obtain the adversarial SAR geometry data.

After implementing the perturbation to $\mathbf{C}$, we further map it to the physical space through a mapping $\mathcal{M}$. We define this process as physical attack, which can be represented as

$$\mathbf{M},{\mathbf{T}}_{adv}^{*}=\mathcal{M}(\mathbf{M},\mathbf{T},{\mathbf{C}}_{adv}^{*})$$

(2)

where ${\mathbf{T}}_{adv}^{*}$ is the final adversarial texture information. We can obtain the final physical adversarial perturbation via the mapping process. The notations used in the text are summarized in

Table 1. Notations.

Notations	Description	Notations	Description
$\mathbf{M}$	Mesh information	$\mathbf{T}$	Texture information
${\theta }_c$	Imaging parameters	$\mathcal{R}(·,·;·)$	Ray-tracing renderer
$\mathbf{C}$	SAR geometry data	$\mathbf{I}$	SAR image
$\mathcal{F}(·;·)$	Reprocessing module	${\theta }_p$	Reprocessing parameters
$\mathcal{C}(·)$	SAR ATR classifier	y	Label of prediction
${\mathbf{C}}_{adv}^{*}$	Adversarial SAR geometry data	$\mathcal{L}(·,·)$	Loss function
$y_{gt}$	Ground truth label	$\mathcal{M}(·,·,·)$	Mapping module
${\mathbf{T}}_{adv}^{*}$	Adversarial texture information

.

3.2. The SAR-PATT Framework

To generate SAR physical adversarial perturbations, we propose a framework for SAR physical adversarial attacks, which includes a differentiable SAR geometry data reprocessing module. Our framework is shown in Figure 1.

We refer to the process of generating perturbations in SAR geometry data as digital attacks because these perturbations still exist in the digital space. In this section, we use optimization methods to generate adversarial perturbations through gradient backpropagation by calculating the loss. Therefore, the loss function is crucial in this process because it determines our final attack effectiveness. We will discuss our loss function design in detail.

Analogously, we refer to the process of mapping perturbations generated in SAR geometry data to a 3D model as physical attacks because this step maps perturbations from the digital space to the physical space. In this section, we discuss in detail the design of the mapping module and how to implement this mapping. The procedure of our attack is represented by Algorithm 1.

Algorithm 1 SAR-PATT

Input: 3D model $(\mathbf{M},\mathbf{T})$, camera parameter ${\theta }_c$, ground truth label $y_{gt}$ Output: Adversarial texture ${\mathbf{T}}_{adv}^{*}$   1: $\mathbf{C}=\mathcal{R}(\mathbf{M},\mathbf{T};{\theta }_c)$   2: Initial ${\mathbf{C}}_{adv}^{*}$ with $\mathbf{C}$   3: for the max iteration do   4:     update $mask$   5:     ${\mathbf{C}}_{adv}^{*}=\mathbf{C}+(({\mathbf{C}}_{adv}^{*}-\mathbf{C})\ast mask)$   6:     ${\mathbf{I}}_{adv}=\mathcal{F}\left({\mathbf{C}}_{adv}^{*}\right)$   7:     $y=\mathcal{C}\left({\mathbf{I}}_{adv}\right)$   8:     calculate $\mathcal{L}$ by Equation (3)   9:     update ${\mathbf{C}}_{adv}^{*}$ with gradient backpropagation 10: end for 11: calculate the nearest meshes $\mathcal{M}$ for each scattering points in ${\mathbf{C}}_{adv}^{*}$ 12: update ${\mathbf{T}}_{adv}^{*}$ for selected meshes $\mathcal{M}$ 13: return ${\mathbf{T}}_{adv}^{*}$

3.3. Generating Adversarial Perturbations in the Digital Domain (GaPD)

To achieve the digital attack, we use an optimization method to generate adversarial perturbations in the SAR geometry data $\mathbf{C}$. When designing the loss function, we consider the following three factors:

(1) Objective function. Our strategy is to use a nontarget attack method to automatically find the false target label. Our optimization goal is to make the predicted value of the adversarial example continuously approach this target label, ultimately causing model misclassification. Specifically, we use the model’s classification loss function, i.e., cross-entropy loss, as the objective function and select the label with the highest predicted probability other than the correct label as the target label to minimize the loss function and thus find an adversarial example. However, using a single loss function is insufficient to ensure the effectiveness of the adversarial example because there is no limit to the range of perturbation optimization, which may make the adversarial example deviate from the imaging principles of SAR or conflict with certain characteristics inherent in SAR images.

(2) Intensity range limitation. Since our optimization target is the intensity values contributed by scattering points in SAR geometry data, we constrain the range of intensity values between $[0,1]$ to generate effective 2D SAR images. Let the perturbation vector be $\delta$; our goal is to ensure that $0\le x_i+{\delta }_i\le 1$. As the range of the sigmoid function is $(0,1)$, we can let ${\delta }_i=sigmoid\left({\omega }_i\right)-x_i$ so that $0\le sigmoid\left({\omega }_i\right)=x_i+{\delta }_i\le 1$. Therefore, we use a sigmoid function to limit the range of the optimization parameters, which can ensure that the generated perturbations are reasonable. When initializing parameter ${\omega }_i$, we use the inverse function of sigmoid $logit\left(x\right)=ln\left({\displaystyle \frac{x}{1-x}}\right)$ to ensure the similarity of the perturbation vector to the original intensity vector.

(3) Perturbation amplitude limitation. To increase the authenticity of the generated adversarial examples, and because in subsequent physical attacks, we need to map the perturbation of the intensity values to the texture parameters of the 3D model, the smaller the amplitude of the perturbation is, the more conducive it is to the subsequent scattering coefficient matching process. We use the $L_2$ norm to limit the perturbation vector $\delta$, i.e., to minimize ${\parallel \delta \parallel }_2$. Our final loss function is

$$\mathcal{L}={c·\parallel sigmoid\left(\omega \right)-x\parallel }_2^2+H(y,y_{adv})$$

(3)

where $\omega$ is the parameter we need to optimize, x is the intensity of the SAR geometry data, c is a constant that can balance the classification loss and perturbation amplitude limitation loss, and H is the cross-entropy loss function.

In addition, in the next step of the physical attack, we need to modify the texture information of the triangular faces of the 3D model corresponding to each scattering point. Therefore, we use a sparse attack strategy to limit the coverage of the perturbed scattering points, i.e., the number of perturbed scattering points. We use the iterative algorithm in the $L_0$ attack proposed by Carlini and Wagner [53] to implement a sparse attack, fixing some pixels that do not significantly affect the classifier output in each iteration until a minimum subset of perturbed pixels is determined. Specifically, we first initialize a mask vector of the same shape as the perturbation vector, with all elements being 1. The generated perturbation is elementwise-multiplied by the mask vector (Hadamard product), so to limit the coverage of the perturbation, we need only to limit the number of 1 elements in the mask vector. The elements in the perturbation vector are ordered by size. If an element is smaller than a certain threshold, the element of the corresponding index in the mask vector is set to 0, i.e., perturbations smaller than a certain threshold in the perturbation vector are eliminated, and the number of 0 elements in the mask vector increases in the iteration.

3.4. Mapping Adversarial Perturbations from the Digital Domain to the Physical Domain (MaPP)

To map the perturbation of SAR geometry data $\mathbf{C}$ in the digital space to the physical space, we define a mapping module $\mathcal{M}$ to generate the final adversarial texture information. We refer to this process as a physical attack. In this mapping module, we identify three transformation relationships:

• Coordinate transformation: Transformation is established from the coordinate system of the scattering points in $\mathbf{C}$ to the coordinate system of the 3D model.
• Point correspondence to triangular faces: The basic units of the intensity values in $\mathbf{C}$ are scattering points, while the basic units affected by the texture parameters of the 3D model are triangular faces. Thus, a correspondence needs to be established.
• Intensity values to texture parameters: The changes in intensity values in SAR geometry data correspond to changes in texture parameters in the 3D model.

For coordinate transformation, we record the coordinates of each scattering point in the 3D model’s coordinate system through a ray-tracing renderer $\mathcal{R}$, thus achieving a transformation from the scattering point’s coordinate system to the 3D model’s coordinate system. For point correspondence to triangular faces, since the areas of the triangular faces composing the 3D model are not uniform, based on the different area sizes of triangular faces, our experiments show that smaller triangular faces may correspond to a single scattering point, while larger triangular faces may correspond to multiple scattering points, as shown in Figure 2. Our goal is to establish a one-to-one correspondence between the basic unit affected by the texture parameters of the 3D model (triangular face) and the basic unit of intensity values in $\mathbf{C}$ (scattering point) so that changes in the texture parameters of the triangular faces can simulate changes in the intensity values of the scattering points. Therefore, considering that multiple scattering points may have different impacts on the same triangular face, we select the scattering point with the largest change in intensity values before and after perturbation as the reference point to calculate the texture parameters of the triangular face.

Since the calculation of intensity values in the ray-tracing renderer $\mathcal{R}$ needs to consider many factors, such as the angle between the triangular element and the light source, it is difficult to directly obtain the texture parameters of the corresponding triangular face from a determined intensity value. In addition, in SAR imaging, radar signals are usually diffusely rather than specularly reflected on the surface of objects, so the scattering coefficient dominates the impact on intensity values among all texture parameters. We use a single-variable optimizer to optimize the bounds of the scattering coefficient of each triangular face corresponding to each scattering point. Specifically, we define a function that inputs the scattering coefficient and uses the same imaging parameters as before to output the absolute value of the difference between the intensity value output of the ray-tracing renderer $\mathcal{R}$ and the target intensity value. We use the Brent algorithm [54] to find the local minimum of this function in the interval $[0,1]$, thereby obtaining the scattering coefficient corresponding to the target intensity value on this triangular face.

There are two potential ways to implement this physical attack in the real world. First, to reduce the scattering coefficient in the real world, as shown by research into microwave absorption theory, there are radar absorbing materials like carbon fibers, nanotubes, graphene, etc. [55]. Second, to increase the scattering coefficient in the real world, radar reflectors like corner reflectors could be used to amplifying the radar signal. When radar waves hit the reflector, they bounce off the surfaces and return to the radar source. By arranging these materials and radar reflectors in the position of perturbed triangular faces, the SAR echo signals could be perturbed like in the simulation.

4. Experiments and Results

4.1. Dataset

To the best of our knowledge, there is currently no physical dataset available for SAR simulation research (i.e., a dataset containing various 3D models and scenes). The commonly used SAR dataset for researchers, MSTAR, has 10 categories, and it is costly to construct a physical dataset with 10 categories from scratch. Considering the cost and richness of dataset categories, we chose to construct a new dataset by expanding the MSTAR dataset. The expansion method is as follows: we used three different 3D models of vehicles, namely, car, jeep, and van. The rendered images of these 3D models are shown in Figure 3, and the numbers of vertices and triangles for each model are shown in

Table 2. Comparison of 3D models and their vertices and triangles.

3D Model	CAR	JEEP	VAN
vertices	116,929	50,651	76,214
triangles	207,830	93,927	139,097

. Specifically, we used parameters similar to those of the MSTAR dataset at the same azimuth to generate SAR images of size 172 × 172 pixels at 1-degree intervals over 360 degrees. We utilized these 3D models to generate 2D SAR images and expanded the MSTAR dataset accordingly. The final dataset has 13 categories: 2S1, BMP2, BRDM_2, BTR60, D7, SLICY, T62, T72, ZIL131, ZSU_23_4, CAR, JEEP, and VAN. The number of images per category ranges from 428 to 720, as detailed in

Table 3. Categories of training and test set after expansion of the MSTAR dataset.

Class	Training Set	Test Set
2S1	233	274
BMP2	233	195
BRDM_2	233	274
BTR60	233	195
D7	233	274
SLICY	233	274
T62	233	273
T72	232	196
ZIL131	233	274
ZSU_23_4	233	274
CAR	360	360
JEEP	360	360
VAN	360	360

. Figure 4 displays SAR images of some targets, along with a comparison between our simulated SAR images and real SAR images in the MSTAR dataset.

4.2. Experimental Setup

Due to the gap in the dataset, our attack principle differs from the principles of existing attacks, as shown in

Table 4. Comparison of SAR-PATT and existing methods.

Method	Full Physical Simulation	Based on	Perturbation at
SVA [36]	×	Gradient	Image pixel
SAR-PeGA [37]	×	Optimization	SAR echo signal
SMGAA [38]	×	Gradient	Adversarial scatterer
SAR-PATT(Ours)	✔	Optimization	3D model texture

and Figure 5. Regardless of whether the attack is digital or physical, our adversarial perturbations are not directly applied in the image space, so we do not select a baseline for our experiments. Therefore, our experiments verify the feasibility of our proposed attack method rather than whether the attack is powerful. We first verify the effects of the proposed digital attack and physical attack, then verify their transferability in different network architectures, and finally, verify the impact of different azimuths on the attack effects.

We choose six different classifier networks to test our attack, namely, three mainstream networks and three lightweight networks: ResNet-50 [56], VGG-16 [57], DenseNet-121 [58], Mobilenet V2 [59], SqueezeNet [60], and ShuffleNet V2 [61]. All networks are from the official implementation of PyTorch. We train these classifier networks separately using ImageNet pretrained models with the following hyperparameter settings: an SGD with momentum optimizer, a learning rate of 0.001, a momentum of 0.9, a batch size of 32, and a maximum number of epochs of 80. The classification accuracy of the classifier networks is shown in

Table 5. The accuracy of all the classifier networks on the test set.

	ResNet-50	VGG-16	DenseNet-121	MobileNetV2	SqueezeNet	ShuffleNetV2
test accuracy	98.6603%	98.2138%	92.4365%	98.4092%	93.8878%	97.2370%

.

For our adversarial attack, the hyperparameter settings are as follows: an Adam optimizer, a learning rate of 0.05, and a maximum number of iterations of 50. The value of constant mentioned in Equation (3) is 1 and the threshold of perturbation size is 0.0001. We run the experiments on a workstation with an NVIDIA GTX 1080 Ti 11 GB GPU.

We choose the fooling rate as the metric to evaluate the effectiveness of our attack. The definition of the fooling rate is

$$fr={\displaystyle \frac{{\sum }_i^{N_{total}}(F\left(x_i^{adv}\right)\ne y_i^{gt})}{N_{total}}}$$

(4)

where $N_{total}$ is the total number of samples that are attacked, F is the classifier network, $x^{adv}$ is the generated adversarial example, and $y^{gt}$ is the ground truth label. The fooling rate is the ratio of the number of samples misclassified to the total number of samples that are attacked.

4.3. Results

We conducted attack experiments on the test set and ensured that all the images were correctly classified before the attack. According to our attack framework, we first conduct digital domain attacks and then map the digital attacks to the physical domain. We divide the results into two parts: the effect of attacks in the digital domain and their corresponding effects in the physical domain.

4.3.1. Digital Attack

In the digital domain, we analyze the fooling rates of the adversarial examples generated on three target objects for six network architectures, as shown in

Table 6. The fooling rates of digital attacks generated in six classification networks and their average fooling rates.

	ResNet-50	VGG-16	DenseNet-121	MobileNetV2	SqueezeNet	ShuffleNetV2	Avg.
CAR	100%	94.12%	100%	100%	100%	100%	99.02%
JEEP	63.89%	85.24%	100%	59.17%	57.50%	97.02%	77.14%
VAN	77.42%	95.52%	83.61%	100%	99.58%	99.37%	92.58%

. The results show that our attack has a certain fooling rate for general and lightweight network architectures, with the highest fooling rate being that with ShuffleNetV2 and the lowest being that with ResNet-50. Among the different attack targets, the fooling rate is highest for the CAR target, averaging 99.02%, while the lowest average fooling rate is 77.14% for the JEEP target. These results indicate that our attack method is effective in fooling SAR target automatic recognition networks. We provide some examples of generated adversarial examples, as shown in Figure 6. After applying adversarial perturbations, the targets are all misclassified into other categories. The left side of the figure is the original image, and the right side is the image with the applied perturbation. Our attack can deceive the classifier with high confidence while maintaining a level of stealth that is difficult for the human eye to detect.

4.3.2. Physical Attack

By mapping the adversarial perturbations generated in the digital domain to the physical domain, we calculate the corresponding fooling rates of the adversarial examples, as shown in

Table 7. The fooling rates of physical attacks on different targets under six classification networks and their average fooling rates, with levels of variation indicated in the table.

	ResNet-50	VGG-16	DenseNet-121	MobileNetV2	SqueezeNet	ShuffleNetV2	Avg.
CAR	100% ↓ 0%	88.39% ↓ 5.73%	100% ↓ 0%	100% ↓ 0%	100% ↓ 0%	98.85% ↓ 1.15%	97.87% ↓ 1.15%
JEEP	59.57% ↓ 4.32%	66.34% ↓ 18.90%	100% ↓ 0%	41.18% ↓ 17.99%	44.25% ↓ 13.25%	90.80% ↓ 6.22%	67.02% ↓ 10.12%
VAN	81.67% ↑ 4.25%	26.39% ↓ 69.13%	78.64% ↓ 4.97%	96.31% ↓ 3.69%	84.81% ↓ 14.77%	91.77% ↓ 7.60%	76.60% ↓ 15.98%

. Compared to the digital world, the fooling rates in the physical world decreased, with ShuffleNetV2 still having the highest fooling rate and VGG-16 having the lowest. Among the different attack targets, the average fooling rate is still highest for the CAR target, at 97.87%, while the lowest average fooling rate is 67.02% for the JEEP target. We show the generated adversarial perturbations corresponding to the target in Figure 7, with the triangular faces with adversarial texture parameters marked in red. We find that in the physical world, the fooling rate is related to the number and area of the triangular faces of the 3D model. For example, for the JEEP target, the number of triangular faces is the lowest (Table 2), and our attack yields the lowest average fooling rate for this target. In the VAN target, as shown in Figure 7, the perturbed triangular faces have a larger area, resulting in the most significant decrease in the average fooling rate for this target. In the CAR target, the number of triangular faces is the highest, and their area is relatively small, leading our attack to yield the highest average fooling rate for this target.

4.3.3. Transferability of the SAR-PATT

In this section, we first test the transferability of digital attacks between different network architectures, as shown in

Table 8. The transferability of adversarial examples generated in 6 different classifier networks in the digital domain among six different network architectures. The corresponding fooling rates are listed.

Source\Target	ResNet-50	VGG-16	DenseNet-121	MobileNetV2	SqueezeNet	ShuffleNetV2	Avg.
ResNet-50	–	0%	62.12%	59.85%	72.73%	3.79%	39.70%
VGG-16	96.13%	–	86.61%	92.56%	83.04%	29.17%	77.50%
DenseNet-121	73.44%	0%	–	69.53%	46.09%	10.94%	40.00%
MobileNetV2	56.03%	0%	62.07%	–	70.69%	5.17%	38.79%
SqueezeNet	90.78%	2.13%	68.79%	86.52%	–	22.70%	54.18%
ShuffleNetV2	84.15%	3.46%	88.18%	84.44%	74.93%	–	67.03%
Avg.	80.11%	1.12%	73.55%	78.58%	69.50%	14.35%	–

. We generate adversarial examples on the surrogate model and use them to attack the black-box target model. The black-box attack has an average fooling rate of 80.11% on ResNet-50, while the adversarial examples based on VGG-16 have an average fooling rate of 77.5% on the other five black-box models. Table 8 shows that the transferability of adversarial attacks varies between different networks, which means that their robustness to black-box adversarial attacks is different. For example, the VGG-16 and ShuffleNetV2 networks have lower fooling rates against attacks from all sources, indicating that they have greater robustness to black-box adversarial attacks. In addition, we found that network characteristics affect transferability, and different network architectures have different sensitivities to attacks. For example, ResNet-50, as the source network, has a fooling rate of 72.73% for attacks on SqueezeNet, while the fooling rate for ShuffleNetV2 is only 3.79%. In summary, our results show that the threat of physical adversarial attacks still exists even in black-box network architectures.

We also test the transferability of physical attacks, as shown in

Table 9. The transferability of adversarial examples generated in six different classifier networks in the physical domain among six different network architectures. The corresponding fooling rates are listed.

Source\Target	ResNet-50	VGG-16	DenseNet-121	MobileNetV2	SqueezeNet	ShuffleNetV2	Avg.
ResNet-50	–	0%	61.36%	62.88%	72.73%	3.79%	40.15%
VGG-16	96.13%	–	87.50%	93.15%	78.87%	28.57%	76.84%
DenseNet-121	73.44%	0.78%	–	71.09%	47.66%	10.94%	40.78%
MobileNetV2	60.34%	0%	64.66%	–	72.41%	5.17%	40.52%
SqueezeNet	92.20%	2.13%	72.34%	88.65%	–	22.70%	55.60%
ShuffleNetV2	87.32%	4.90%	87.90%	84.44%	75.79%	–	68.07%
Avg.	81.89%	1.56%	74.75%	80.04%	69.49%	14.23%	–

. The results show that the transferability of physical attacks is similar to that of digital attacks. Since physical attacks are essentially mappings of digital attacks in the physical world, the results are as expected.

4.3.4. Robust Attack on Different Azimuths

Under real-world conditions, the SAR image perspective is related to changes in the SAR satellite imaging azimuth. To simulate the impact of this change on attacks, we alter the positions of the camera and objects in the simulated scene to achieve variations in the imaging azimuth. This alteration is performed to demonstrate the robustness of our adversarial perturbations at different azimuths. We test the fooling rates at different azimuths ranging from 19 to 27 degrees with a 2-degree interval under the ResNet-50 network, as shown in

Table 10. The fooling rates of adversarial examples generated at different azimuths in the ResNet-50 network.

Azimuth	${19}^{\circ }$	${21}^{\circ }$	${23}^{\circ }$	${25}^{\circ }$	${27}^{\circ }$
CAR	100%	100%	100%	100%	99.32%
JEEP	51.94%	53.33%	58.77%	55.43%	57.50%
VAN	98.91%	100%	99.39%	100%	100%

. In each azimuth, the objects are also rotated from angle 0 to 360 degrees with a interval of 1 degree. These setups almost cover the imaging angles that match the real-world scenarios. The results show that the changes in the fooling rates at different azimuths for the three targets are not significant. The average fooling rates for the CAR and VAN targets are higher at different azimuths, while the average fooling rate for the JEEP target is the lowest. These results suggest that our attack method is robust at different azimuths, and our attack is not limited to a particular perspective.

5. Conclusions

In this article, we propose a novel physical adversarial attack for SAR ATR, namely, SAR-PATT, which can map adversarial perturbations that are difficult for the human eye to recognize in the digital space to the physical space, leading to misclassification of the SAR ATR system. We achieve transformation from the physical world to the digital world through a SAR simulation renderer, RaySAR, and update digital perturbations through backpropagation by designing effective loss functions. Finally, the resulting digital perturbations are mapped back to the texture information of the 3D model through a mapping module to realize the final physical perturbation. The results show that our attack can effectively achieve physical–world SAR adversarial attacks, achieving a highest average fooling rate of 99.02% in the digital world and a highest average fooling rate of 97.87% in the physical world. Compared to existing methods, our approach bridges the gap between digital and physical attacks, showing the potential for real-world implementation.

In future work, we hope to increase the aggregation of adversarial triangular faces, thereby reducing the difficulty of real-world implementation. In addition, we hope to propose a differentiable SAR simulation renderer to directly generate physical adversarial perturbations through optimization, thereby improving attack efficiency and implementing universal physical adversarial attacks from multiple views to enhance the robustness of our attacks.