Abstract:In synthetic aperture radar (SAR) imaging, intelligent object detection methods are facing significant challenges in terms of model robustness and application security, which are posed by adversarial examples. The existing adversarial example generation methods for SAR object detection can be divided into two main types: global perturbation attacks and local perturbation attacks. Due to the dynamic changes and irregular spatial distribution of SAR coherent speckle backgrounds, the attack effectiveness of global perturbation attacks is significantly reduced by coherent speckle. In contrast, by focusing on the image objects, local perturbation attacks achieve targeted and effective advantages over global perturbations by minimizing interference from the SAR coherent speckle background. However, the adaptability of conventional local perturbations is limited because they employ a fixed size without considering the diverse sizes and shapes of SAR objects under various conditions. This paper presents a framework for region-adaptive local perturbations (RaLP) specifically designed for SAR object detection tasks. The framework consists of two modules. To address the issue of coherent speckle noise interference in SAR imagery, we develop a local perturbation generator (LPG) module. By filtering the original image, this module reduces the speckle features introduced during perturbation generation. It then superimposes adversarial perturbations in the form of local perturbations on areas of the object with weaker speckles, thereby reducing the mutual interference between coherent speckles and adversarial perturbation. To address the issue of insufficient adaptability in terms of the size variation in local adversarial perturbations, we propose an adaptive perturbation optimizer (APO) module. This optimizer adapts the size of the adversarial perturbations based on the size and shape of the object, effectively solving the problem of adaptive perturbation size and enhancing the universality of the attack. The experimental results show that RaLP reduces the detection accuracy of the YOLOv3 detector by 29.0%, 29.9%, and 32.3% on the SSDD, SAR-Ship, and AIR-SARShip datasets, respectively, and the model-to-model and dataset-to-dataset transferability of RaLP attacks are verified.

Robust Adversarial Perturbation on Deep Proposal-based Models

Improving Adversarial Robustness of 3D Point Cloud Classification Models

Playing Against Deep-Neural-Network-Based Object Detectors: A Novel Bidirectional Adversarial Attack Approach

Exploring Transferable and Robust Adversarial Perturbation Generation Across Network Hierarchy

DeepDefense: Training Deep Neural Networks with Improved Robustness.

Robust Physical-World Attacks on Deep Learning Models

Towards Robustness against Unsuspicious Adversarial Examples

Robust Universal Adversarial Perturbations

Robust Superpixel-Guided Attentional Adversarial Attack

Exploring aesthetic procedural noise for crafting model-agnostic universal adversarial perturbations

Fooling deep neural detection networks with adaptive object-oriented adversarial perturbation

Deep Defense: Training DNNs with Improved Adversarial Robustness

Adversarial patch attacks against aerial imagery object detectors

Adversarial perturbation denoising utilizing common characteristics in deep feature space

Object-Aware Transfer-Based Black-Box Adversarial Attack on Object Detector.

Adversarial Robust Safeguard for Evading Deep Facial Manipulation

Analyzing Adversarial Robustness of Deep Neural Networks in Pixel Space: a Semantic Perspective

A Region-Adaptive Local Perturbation-Based Method for Generating Adversarial Examples in Synthetic Aperture Radar Object Detection

Object-Attentional Untargeted Adversarial Attack

A Perceptual Distortion Reduction Framework for Adversarial Perturbation Generation

Towards cross-task universal perturbation against black-box object detectors in autonomous driving