Synthetic aperture radar (SAR) automatic target recognition (ATR) models based on deep neural networks (DNNs) are susceptible to adversarial attacks. In this study, we proposed an SAR black-box local adversarial attack algorithm named attention heat map- based black-box local adversarial attack (AH-BLAA). First, we designed an attention heat map extraction module combined with the layer-wise relevance propagation (LRP) algorithm to obtain the high concerning areas of the SAR-ATR models. Then, to gener- ate SAR adversarial attack examples, we designed a perturbation generator module, introducing the structural dissimilarity (DSSIM) metric in the loss function to limit image distortion and the dif- ferential evolution (DE) algorithm to search for optimal perturba- tions. Experimental results on the MSTAR and FUSAR-Ship datasets showed that compared with existing adversarial attack algorithms, the attack success rate of the AH-BLAA algorithm increased by 0.63% to 33.59% and 1.05% to 17.65%, respectively. Moreover, the low- est perturbation ratios reached 0.23% and 0.13%, respectively.
Read full abstract