融合背景信息的SAR图像自适应图块对抗攻击方法

    Adaptive Patch-based Adversarial Attack Method Fusing SAR-image Background Information

    • 摘要: 深度神经网络模型在合成孔径雷达(SAR)各类智能解译任务场景下都展现了优异的性能,但此类模型易受到对抗样本的攻击。对于光学图像目标检测任务,攻击方法已较为丰富。由于雷达成像机理与光学成像的差异,该类方法无法直接应用于SAR图像数据。针对SAR目标智能识别的对抗攻击需求,文中提出了一种新型对抗图块生成方法,通过对图块位置和大小进行自适应优化;结合SAR图像的背景灰度信息改进对抗图块更新方法;根据特定的目标检测任务类型和待攻击模型结构优化对抗图块迭代损失函数,生成相应的对抗样本。利用SAR-Ship-Dataset数据集开展实验,结果表明改进的对抗样本在模型识别精度和目标置信度的攻击上都实现了更理想的攻击效果并使模型的交并比阈值设为50的平均精度(mAP50)由98.3% 下降至69.82%,mAP95由73.8% 下降至32.96%,攻击率由16.93% 提升至33.53%。

       

      Abstract: Deep neural networks have demonstrated remarkable performance in various SAR intelligence interpretation task scenarios. However, it has been proved that they are vulnerable to attack from adversarial examples. For the object detection task, there have been numerous adversarial attack methods based on optical images, which cannot be implemented on SAR images directly resulting from the difference in imaging mechanism between SAR and optical images. To address the need for adversarial attacks on intelligent SAR object detection, we propose a novel method for generating adversarial patches, which performs adaptive optimization for the location and size of the patch, fuses image′s background grayscale information to enhance the patch iteration process and improves the loss function based on the specific object detection task type and target model structure. Experimental results using the SAR-Ship-Dataset demonstrate that the improved adversarial examples achieve more ideal attack effects by reducing the mAP50 of the model from 98.3% to 69.82%, mAP95 from 73.8% to 32.96%, and increasing the attack rate from 16.93% to 33.53%.

       

    /

    返回文章
    返回