SAR-SPA: Incorporating Target Scattering Characteristic Parameters in Adversarial Example Generation for SAR Imagery

Deep neural networks (DNNs)-based SAR target recognition models are susceptible to adversarial examples, which significantly reduce model robustness. Current methods for generating adversarial examples for SAR imagery primarily operate in the two-dimensional digital domain, known as image adversarial examples (I-AE). While recent work has started to consider the scattering mechanisms in SAR imaging, two major shortcomings remain: (1) considering scattering mechanisms only on the generated SAR imagery without accounting for the actual imaging process, and (2) the inability to achieve attacks in the three-dimensional physical domain, termed pseudo physics adversarial examples (PP-AE). Achieving adversarial attacks in the three-dimensional physical domain is challenging because it requires integrating perturbations into the SAR imaging process, altering the amplitude or phase information of the target's scattering echo signals to generate SAR adversarial examples, referred to as physics-based adversarial examples (P-AE). To address these challenges, this paper proposes SAR-SPA, a method for generating P-AE by modifying the targets' scattering characteristic parameters. Specifically, we iteratively optimize the intensity of the target's scattering echo signals by perturbing the scattering characteristic parameters of the three-dimensional target, and obtain the adversarial examples after echo signal processing and imaging processing in the RaySAR simulator. Experimental results show that, compared to image adversarial attack methods, the SAR-SPA method significantly improves the attack success rate of DNN-based SAR object recognition models (average over 15.65%) and demonstrates strong dual transferability across various models and perspectives.