TAN: A Transferable Adversarial Network for DNN-based UAV SAR Automatic Target Recognition Models

1. Introduction

The ongoing advances in unmanned aerial vehicle (UAV) and synthetic aperture radar (SAR) technologies have enabled the acquisition of high-resolution SAR images through UAVs. However, unlike visible light imaging, SAR images reflect the reflection intensity of imaging targets to radar signals, making it difficult for humans to extract effective semantic information from SAR images without the aid of interpretation tools. Currently, deep learning has achieved excellent performance in various scenarios [1,2,3], and SAR automatic target recognition (SAR-ATR) models based on deep neural networks (DNN) [4,5,6,7,8] have become one of the most popular interpretation methods. With their powerful representation capabilities, DNNs outperform traditional approaches in image classification tasks. Yet, recent studies have shown that DNN-based SAR-ATR models are susceptible to adversarial examples [9].

The concept of adversarial examples was first proposed by Szegedy et al. [10], which suggests that a carefully designed tiny perturbation can cause a well-trained DNN model to misclassify. This finding has made adversarial attacks one of the most serious threats to artificial intelligence (AI) security. To date, researchers have proposed a variety of adversarial attack methods, which can be mainly divided into two categories from the perspective of prior knowledge: the white-box and black-box attacks. In the first case, attackers can utilize a large amount of prior knowledge, such as the model structure and gradient information, etc., to craft adversarial examples for victim models. Examples of white-box methods include gradient-based attacks [11,12], boundary-based attacks [13], and saliency map-based attacks [14], etc. While in the second case, attackers can only access the output information or even less, making adversarial attacks much more difficult. Examples of black-box methods include probability label-based attacks [15,16] and decision-based attacks [17], etc. We now consider an extreme situation, where attackers have no access to any feedback from victim models, such that existing attack methods are unable to craft adversarial examples until researchers discover that adversarial examples can transfer among DNN models. Liu et al. [18] proposed an ensemble-based approach to generating transferable adversarial examples for the non-targeted and targeted attacks. Subsequent studies focused on improving the basic FGSM [11] method to enhance the transferability of adversarial examples, such as gradient-based methods [19,20], transformation-based methods [20,21], and variance-based methods [22], etc. However, the transferability and real-time performance of the above approaches are still insufficient to meet realistic attack requirements. Consequently, further improvements in the adversarial attack are pending to be solved in the future.

With the wide application of DNNs in the field of remote sensing, researchers have embarked on investigating the adversarial examples of remote sensing images. Xu et al. [23] first investigated the adversarial attack and defense in safety-critical remote sensing tasks, and proposed the mixup attack [24] to generate universal adversarial examples for remote sensing images. However, the research on the adversarial example of SAR images is still in its infancy. Li et al. [25] generated abundant adversarial examples for CNN-based SAR image classifiers through the basic FGSM method and systematically evaluated critical factors affecting the attack performance. Du et al. [26] designed a Fast C&W algorithm to improve the efficiency of generating adversarial examples by introducing an encoder-decoder model. To enhance the universality and feasibility of adversarial perturbations, the work in [27] presented a universal local adversarial network to generate universal adversarial perturbations for the target region of SAR images. Furthermore, the latest research [28] has broken through the limitations of the digital domain and implemented the adversarial example of SAR images in the signal domain by transmitting a two-dimensional jamming signal. Despite the high attack success rates achieved by the above methods, the problem of transferable adversarial examples in the field of SAR-ATR has yet to be addressed.

In this paper, a transferable adversarial network (TAN) is proposed to improve the transferability and real-time performance of adversarial examples in SAR images. Specifically, during the training phase of TAN, we simultaneously train two encoder-decoder models: a generator that crafts malicious samples through a one-step forward mapping from original data, and an attenuator that weakens the effectiveness of malicious samples by capturing the most harmful deformations. We argue that if the adversarial examples crafted by the generator are robust to the deformations produced by the attenuator, i.e., the attenuated adversarial examples remain effective to DNN models, then they are capable of transferring to other victim models. Moreover, unlike traditional iterative methods, our approach can one-step map original samples to adversarial examples, thus enabling real-time attacks. In other words, we realize real-time transferable adversarial attacks through a two-player game between the generator and attenuator.

The main contributions of this paper are summarized as follows.

(1)

For the first time, this paper systematically evaluates the transferability of adversarial examples among DNN-based SAR-ATR models. Meanwhile, our research reveals that there may be potential common vulnerabilities among DNN models performing the same task.

(2)

We propose a novel network to enable real-time transferable adversarial attacks. Once the proposed network is well-trained, it can real-time craft adversarial examples with high transferability, thus attacking black-box victim models without resorting to any prior knowledge. As such, our approach possesses promising applications in AI security.

(3)

The proposed method is evaluated on the most authoritative SAR-ATR dataset. Experimental results indicate that our approach achieves state-of-the-art transferability with acceptable adversarial perturbations and minimum time costs compared to existing attack methods, i.e., it excellently realizes real-time transferable adversarial attacks.

The rest parts of this paper are arranged as follows. Section 2 introduces the relevant preparation knowledge, and Section 3 describes the proposed method in detail. The experimental results and conclusions are given in Section 4 and Section 5, respectively.

2. Preliminaries

2.1. Adversarial Attacks for DNN-Based SAR-ATR Models

Suppose $x_n\in {[0,255]}^{W\times H}$ is a single channel SAR image from the dataset $\mathcal{X}$ and $f(·)$ is a DNN-based K-class SAR-ATR model. Given a sample $x_n$ as input to $f(·)$, the output is a K-dimensional vector $f\left(x_n\right)=[f{\left(x_n\right)}_1,f{\left(x_n\right)}_2,\cdots ,f{\left(x_n\right)}_K]$, where $f{\left(x_n\right)}_i\in \mathbb{R}$ denotes the score of $x_n$ belonging to class i. Let $C_p={argmax}_i\left(f{\left(x_n\right)}_i\right)$ represent the predicted class of $f(·)$ for $x_n$. The adversarial attack is to fool $f(·)$ with an adversarial example ${\tilde{x}}_n$ that only has a minor perturbation on $x_n$. The detail process can be expressed as follows:

$$\underset{i}{argmax}f{\left({\tilde{x}}_n\right)}_i\ne C_p,\mathrm{s}.\mathrm{t}.{∥{\tilde{x}}_n-x_n∥}_p\le \xi$$

(1)

where the $L_p$-norm is defined as ${∥v∥}_p={\left({\sum }_i{\left|v_i\right|}^p\right)}^{\frac{1}{p}}$, and $\xi$ controls the magnitude of adversarial perturbations.

Meanwhile, adversarial attacks can be mainly divided into two modes. The first basic mode is called the non-targeted attack, making DNN models misclassify. The second one is more stringent, called the targeted attack, which induces models to output specified results. There is no doubt that the latter poses a higher level of threat to AI security. In other words, the non-targeted attack is to minimize the probability of models correctly recognize samples; conversely, the targeted attack maximizes the probability of models identifying samples as target classes. Thus, (1) can be transformed into the following optimization problems:

• For the non-targeted attack:

  $$minimize\left(\frac{1}{N}\sum _{n=1}^{N}D(\underset{i}{argmax}f{\left({\tilde{x}}_n\right)}_i==C_{tr})\right),\mathrm{s}.\mathrm{t}.{∥{\tilde{x}}_n-x_n∥}_p\le \xi$$

  (2)
• For the targeted attack:

  $$maximize\left(\frac{1}{N}\sum _{n=1}^{N}D(\underset{i}{argmax}f{\left({\tilde{x}}_n\right)}_i==C_{ta})\right),\mathrm{s}.\mathrm{t}.{∥{\tilde{x}}_n-x_n∥}_p\le \xi$$

  (3)

where the discriminant function $D(·)$ equals one if the equation holds; otherwise, it equals zero. $C_{tr}$ and $C_{ta}$ represent the true and target classes of the input. N is the number of samples in the dataset. Obviously, the above optimization problems are exactly the opposite of a DNN’s training process, and the corresponding loss functions will be given in the next chapter.

2.2. Transferability of Adversarial Examples

We consider an extreme situation where attackers have no access to any feedback from victim models, such that existing white-box and black-box attacks are unable to craft adversarial examples. In this case, attackers can utilize the transferability of adversarial examples to attack models. Specifically, due to the similarity between models, adversarial examples generated for a certain model can also successfully attack other models performing the same task [18]. Details are shown in Figure 1.

As shown in Figure 1, for an image classification task, we have trained three recognition models. Suppose that only the surrogate model $f_s(·)$ is a white-box model, and victim models $f_{v1}(·)$, $f_{v2}(·)$ are black-box models. Undoubtedly, given an sample x, attackers can craft an adversarial example $\tilde{x}$ to fool $f_s(·)$ through attack algorithms. Meanwhile, since the transferability of adversarial examples, $\tilde{x}$ can also fool $f_{v1}(·)$ and $f_{v2}(·)$ successfully. However, the transferability generated by existing algorithms is very weak, so this paper is dedicated to crafting highly transferable adversarial examples.

3. The Proposed Transferable Adversarial Network (TAN)

In this paper, the proposed Transferable Adversarial Network (TAN) utilizes the encoder-decoder model and data augmentation technology to improve the transferability and real-time performance of adversarial examples. The framework of our network is shown in Figure 2. As we can see, compared to traditional iterative methods, TAN introduces a generator $G(·)$ to learn the one-step forward mapping from the clean sample x to the adversarial example $\tilde{x}$, thus enabling real-time attacks. Meanwhile, to improve the transferability of $\tilde{x}$, we simultaneously train an attenuator $A(·)$ to capture the most harmful deformations, which are supposed to weaken the effectiveness of $\tilde{x}$ while still preserving the semantic meaning of x. We argue that if $\tilde{x}$ is robust to the deformations produced by $A(·)$, i.e., ${\tilde{x}}^{*}$ remains effective to DNN models, then $\tilde{x}$ is capable of transferring to the black-box victim model $f_v(·)$. In other words, we achieve real-time transferable adversarial attacks through a two-player game between $G(·)$ and $A(·)$. This chapter will introduce our method in detail.

3.1. Training Process of the Generator

For easy understanding, Figure 3 shows the detailed training process of the generator. Note that a white-box model is selected as the surrogate model $f_s(·)$ during the training phase.

As we can see, given a clean sample x, the generator $G(·)$ crafts the adversarial example $\tilde{x}$ through a one-step forward mapping, as follows:

$$\tilde{x}=G\left(x\right)$$

(4)

Meanwhile, the attenuator $A(·)$ takes $\tilde{x}$ as input and outputs the attenuated adversarial example ${\tilde{x}}^{*}$:

$${\tilde{x}}^{*}=A\left(\tilde{x}\right)$$

(5)

Since $\tilde{x}$ has to fool $f_s(·)$ with a minor perturbation, and ${\tilde{x}}^{*}$ needs to remain effective against $f_s(·)$, the loss function of $G(·)$ consists of three parts. Next, we will give the generator loss ${\mathcal{L}}_G$ of non-targeted and targeted attacks, respectively.

For the non-targeted attack: First, according to (2), $\tilde{x}$ is to minimize the classification accuracy of $f_s(·)$, which means that it has to decrease the confidence of being recognized as the true class $C_{tr}$, i.e., to increase the confidence of being identified as others. Thus, the first part of ${\mathcal{L}}_G$ can be expressed as:

$$\begin{array}{cc}\hfill {\mathcal{L}}_{G1}(f_s\left(\tilde{x}\right),C_{tr})& =-log\left(\frac{{\sum }_{i\ne C_{tr}}exp\left(f_s{\left(\tilde{x}\right)}_i\right)}{{\sum }_{i}exp\left(f_s{\left(\tilde{x}\right)}_i\right)}\right)\hfill \\ \hfill & =-log\left(1-\frac{exp\left(f_s{\left(\tilde{x}\right)}_{C_{tr}}\right)}{{\sum }_{i}exp\left(f_s{\left(\tilde{x}\right)}_i\right)}\right)\hfill \end{array}$$

(6)

Second, to improve the transferability of $\tilde{x}$, we expect that ${\tilde{x}}^{*}$ remains effective to $f_s(·)$, so the second part of ${\mathcal{L}}_G$ can be derived as:

$$\begin{array}{cc}\hfill {\mathcal{L}}_{G2}(f_s\left({\tilde{x}}^{*}\right),C_{tr})& =-log\left(\frac{{\sum }_{i\ne C_{tr}}exp\left(f_s{\left({\tilde{x}}^{*}\right)}_i\right)}{{\sum }_{i}exp\left(f_s{\left({\tilde{x}}^{*}\right)}_i\right)}\right)\hfill \\ \hfill & =-log\left(1-\frac{exp\left(f_s{\left({\tilde{x}}^{*}\right)}_{C_{tr}}\right)}{{\sum }_{i}exp\left(f_s{\left({\tilde{x}}^{*}\right)}_i\right)}\right)\hfill \end{array}$$

(7)

Finally, the last part of ${\mathcal{L}}_G$ is used to limit the perturbation magnitude. We introduce the traditional $L_p$-norm to measure the degree of image distortion as follows:

$$\begin{array}{cc}\hfill {\mathcal{L}}_{G3}(x,\tilde{x})& ={∥\tilde{x}-x∥}_p\hfill \\ \hfill & ={\left(\sum _i{\left|\Delta x_i\right|}^p\right)}^{\frac{1}{p}}\hfill \end{array}$$

(8)

In summary, we apply the linear weighted sum method to balance the relationship between ${\mathcal{L}}_{G1}$, ${\mathcal{L}}_{G2}$, and ${\mathcal{L}}_{G3}$. As such, the complete generator loss for the non-targeted attack can be represented as:

$$\begin{array}{cc}\hfill {\mathcal{L}}_G& ={\omega }_{G1}·{\mathcal{L}}_{G1}(f_s\left(\tilde{x}\right),C_{tr})+{\omega }_{G2}·{\mathcal{L}}_{G2}(f_s\left({\tilde{x}}^{*}\right),C_{tr})+{\omega }_{G3}·{\mathcal{L}}_{G3}(x,\tilde{x})\hfill \end{array}$$

(9)

where ${\omega }_{G1}+{\omega }_{G2}+{\omega }_{G3}=1$. ${\omega }_{G1},{\omega }_{G2},{\omega }_{G3}\in [0,1]$ are the weight coefficients of ${\mathcal{L}}_{G1}$, ${\mathcal{L}}_{G2}$, and ${\mathcal{L}}_{G3}$, respectively.

For the targeted attack: According to (3), $\tilde{x}$ is to maximize the probability of being recognized as the target class $C_{ta}$, i.e., to increase the confidence of $C_{ta}$. Thus, ${\mathcal{L}}_{G1}$ here can be expressed as:

$${\mathcal{L}}_{G1}(f_s\left(\tilde{x}\right),C_{ta})=-log\left(\frac{exp\left(f_s{\left(\tilde{x}\right)}_{C_{ta}}\right)}{{\sum }_{i}exp\left(f_s{\left(\tilde{x}\right)}_i\right)}\right)$$

(10)

To maintain the effectiveness of ${\tilde{x}}^{*}$ against $f_s(·)$, ${\mathcal{L}}_{G2}$ here is derived as:

$${\mathcal{L}}_{G2}(f_s\left({\tilde{x}}^{*}\right),C_{ta})=-log\left(\frac{exp\left(f_s{\left({\tilde{x}}^{*}\right)}_{C_{ta}}\right)}{{\sum }_{i}exp\left(f_s{\left({\tilde{x}}^{*}\right)}_i\right)}\right)$$

(11)

The perturbation magnitude is still limited by the ${\mathcal{L}}_{G3}$ shown in (8). Therefore, the complete generator loss for the targeted attack can be represented as:

$$\begin{array}{cc}\hfill {\mathcal{L}}_G& ={\omega }_{G1}·{\mathcal{L}}_{G1}(f_s\left(\tilde{x}\right),C_{ta})+{\omega }_{G2}·{\mathcal{L}}_{G2}(f_s\left({\tilde{x}}^{*}\right),C_{ta})+{\omega }_{G3}·{\mathcal{L}}_{G3}(x,\tilde{x})\hfill \end{array}$$

(12)

3.2. Training Process of the Attenuator

According to Figure 2, during the training phase of TAN, an attenuator $A(·)$ is introduced to weaken the effectiveness of $\tilde{x}$ while still preserving the semantic meaning of x. We show the detailed training process of $A(·)$ in Figure 4.

As we can see, the attenuator loss ${\mathcal{L}}_A$ also consists of three parts. First, to preserve the semantic meaning of x, $f_s(·)$ has to keep a basic classification accuracy on the following attenuated sample $x^{*}$:

$$x^{*}=A\left(x\right)$$

(13)

It means that the first part of ${\mathcal{L}}_A$ should increase the confidence of $x^{*}$ being recognized as the true class $C_{tr}$, as follows:

$${\mathcal{L}}_{A1}(f_s\left(x^{*}\right),C_{tr})=-log\left(\frac{exp\left(f_s{\left(x^{*}\right)}_{C_{tr}}\right)}{{\sum }_{i}exp\left(f_s{\left(x^{*}\right)}_i\right)}\right)$$

(14)

Meanwhile, to weaken the effectiveness of $\tilde{x}$, $A(·)$ also need to improve the confidence of the attenuated adversarial example ${\tilde{x}}^{*}$ being identified as $C_{tr}$, so the second part of ${\mathcal{L}}_A$ can be expressed as:

$${\mathcal{L}}_{A2}(f_s\left({\tilde{x}}^{*}\right),C_{tr})=-log\left(\frac{exp\left(f_s{\left({\tilde{x}}^{*}\right)}_{C_{tr}}\right)}{{\sum }_{i}exp\left(f_s{\left({\tilde{x}}^{*}\right)}_i\right)}\right)$$

(15)

Finally, to avoid excessive image distortion caused by $A(·)$, the third part of ${\mathcal{L}}_A$ is used to limit the deformation magnitude, which can be expressed by the traditional $L_p$-norm, as follows:

$$\begin{array}{cc}\hfill {\mathcal{L}}_{A3}(x,x^{*})& ={∥x^{*}-x∥}_p\hfill \\ \hfill & ={\left(\sum _i{\left|\Delta x_i\right|}^p\right)}^{\frac{1}{p}}\hfill \end{array}$$

(16)

As with the generator loss, we utilize the linear weighted sum method to derive the complete attenuator loss as follows:

$$\begin{array}{cc}\hfill {\mathcal{L}}_A& ={\omega }_{A1}·{\mathcal{L}}_{A1}(f_s\left(x^{*}\right),C_{tr})+{\omega }_{A2}·{\mathcal{L}}_{A2}(f_s\left({\tilde{x}}^{*}\right),C_{tr})+{\omega }_{A3}·{\mathcal{L}}_{A3}(x,x^{*})\hfill \end{array}$$

(17)

where ${\omega }_{A1}+{\omega }_{A2}+{\omega }_{A3}=1$. ${\omega }_{A1},{\omega }_{A2},{\omega }_{A3}\in [0,1]$ are the weight coefficients of ${\mathcal{L}}_{A1}$, ${\mathcal{L}}_{A2}$, and ${\mathcal{L}}_{A3}$, respectively.

3.3. Network Structure of the Generator and Attenuator

According to Section 3.1 and  Section 3.2, the generator and attenuator are essentially two encoder-decoder models, so the choice of a suitable model structure is necessary. We mainly consider two factors. First, as the size of original samples and adversarial examples should be the same, the model has to keep the input and output sizes identical. Second, to prevent our network from overfitting while saving computational resources, a lightweight model will be a better choice. In summary, we apply ResNet Generator proposed in [29] as the encoder-decoder model of TAN. The structure of ResNet Generator is shown in Figure 5.

As we can see, ResNet Generator mainly consists of downsampling, residual, and upsampling modules. For a visual understanding, given an input data of size $1\times 128\times 128$, the input and output sizes of each module are listed in Table 1.

Obviously, the input and output sizes of ResNet Generator are the same. Meanwhile, to ensure the validity of the generated data, we add a $tanh$ function after the output module, which restricts the generated data to the interval $[0,1]$. The total number of parameters in ResNet Generator has been calculated to be approximately $7.83M$, which is a fairly lightweight network. For more details, please refer to literature [29].

3.4. Complete Training Process of TAN

As we described earlier, TAN improves the transferability of adversarial examples through a two-player game between the generator and attenuator, which is quite similar to the working principle of generative adversarial networks (GAN) [30]. Therefore, we also adopt an alternating training scheme to train our network. Specifically, given the dataset $\mathcal{X}$ and batch size S, we first randomly divide $\mathcal{X}$ into M batches $\{b_1,b_2,\cdots ,b_M\}$ at the beginning of each training iteration. Second, we set a training ratio $R\in N^{*}$, which means that TAN trains the generator R times and then trains the attenuator once, i.e., once per batch for the former and only once per R batches for the latter. In this way, we can prevent the attenuator from being so strong that the generator cannot be optimized. Meanwhile, to shorten training time, we set an early stop condition $ESC$ so that training can be ended early when certain indicators meet the condition. Note that the generator and attenuator are trained alternately, i.e., the attenuator’s parameters are fixed when the generator is trained, and vice versa. More details of the complete training process for TAN are shown in Algorithm 1.

Algorithm 1 Transferable Adversarial Network Training.

Input:  Dataset $\mathcal{X}$; batch size S; surrogate model $f_s$; target class $C_{ta}$; training loss function of the generator ${\mathcal{L}}_G$; training loss function of the attenuator ${\mathcal{L}}_A$; number of training iterations T; learning rate $\eta$; training ratio of the generator and attenuator R; early stop condition $ESC$. Output:  The parameter ${\theta }_G$ of the well-trained generator. 1: Randomly initialize ${\theta }_G$ and ${\theta }_A$ 2: for $t=1$ to T do 3:       According to S, randomly divide $\mathcal{X}$ into M batches $\{b_1,b_2,\cdots ,b_M\}$ 4:       for $m=1$ to M do 5:             Calculate ${\mathcal{L}}_G({\theta }_G,{\theta }_A,f_s,b_m,C_{ta})$ 6:             Update ${\theta }_G={\theta }_G-\eta ·\frac{\partial }{\partial {\theta }_G}{\mathcal{L}}_G$ 7:             if $m\%R==0$ then 8:                  Calculate ${\mathcal{L}}_A({\theta }_G,{\theta }_A,f_s,b_m)$ 9:                  Update ${\theta }_A={\theta }_A-\eta ·\frac{\partial }{\partial {\theta }_A}{\mathcal{L}}_A$ 10:             else 11:                  ${\theta }_A={\theta }_A$ 12:             end if 13:       end for 14:       if $ESC==True$ then 15:             Break 16:       else 17:             Continue 18:       end if 19: end for

4. Experiments

4.1. Data Descriptions

To date, there is no publicly available dataset for UAV SAR-ATR, thus this paper experiments on the most authoritative SAR-ATR dataset, i.e., the moving and stationary target acquisition and recognition (MSTAR) dataset [31]. MSTAR is collected by a high-resolution spotlight SAR and published by the U.S. Defense Advanced Research Projects Agency (DARPA) in 1996, which contains SAR images of Soviet military vehicle targets at different azimuth and depression angles. In standard operating conditions (SOC), MSTAR includes ten classes of targets, such as self-propelled howitzers (2S1); infantry fighting vehicles (BMP2); armored reconnaissance vehicles (BRDM2); wheeled armored transport vehicles (BTR60, BTR70); bulldozers (D7); main battle tanks (T62, T72); cargo trucks (ZIL131); and self-propelled artillery (ZSU234). The training dataset contains 2747 images collected at a depression angle of ${17}^{\circ }$, and the testing dataset contains 2426 images captured at a depression angle of ${15}^{\circ }$. More details about the dataset are given in Table 2, and Figure 6 shows the optical images and corresponding SAR images of each class.

4.2. Implementation Details

We evaluate the attack performance of our approach on the following six common DNN models: DenseNet121 [32], GoogLeNet [33], InceptionV3 [34], Mobilenet [35], ResNet50 [36], and Shufflenet [37]. To uniform image sizes, we resize all the images in MSTAR to $128\times 128$. As for the dataset processing, we uniformly sample $10\%$ of data from the training dataset to form the validation dataset. During the training phase of recognition models, we set the training epoch and batch size to 100 and 32, respectively. For the training parameters of TAN, we set the generator loss weights $[{\omega }_{G1},{\omega }_{G2},{\omega }_{G3}]$ to $[0.25,0.25,0.5]$, the attenuator loss weights $[{\omega }_{A1},{\omega }_{A2},{\omega }_{A3}]$ to $[0.25,0.25,0.5]$, the training ratio to 3, the training epoch to 50, the batch size to 8, and the norm type to the $L_2$-norm. For above models, we optimize them through an Adam optimizer [38] with the learning rate of $0.001$. When evaluating the transferability of adversarial examples, we first take each network as the surrogate model in turn and craft adversarial examples for them, respectively. Then, we assess the transferability by testing the recognition results of victim models on corresponding adversarial examples. Detailed experimental results will be given later.

For baseline methods, we adopt the following six attack algorithms from the Torchattacks [39] toolbox to compare with TAN: MIFGSM [19], DIFGSM [21], NIFGSM [20], SINIFGSM [20], VMIFGSM [22], and VNIFGSM [22]. All codes were written in Pytorch, and the experimental environment consisted of Windows 10 with an NVIDIA GeForce RTX 2080 Ti GPU and a $3.6$ GHz Intel Core i9-9900K CPU).

4.3. Evaluation Metrics

We mainly consider two factors to comprehensively evaluate the performance of adversarial attacks: the effectiveness and stealthiness, which are directly related to the classification accuracy $\widetilde{Acc}$ of victim models on adversarial examples and the norm value ${\tilde{L}}_p$ of adversarial perturbations, respectively. For the $\widetilde{Acc}$ metric, the formula is as follows:

$$\widetilde{Acc}=\left\{\begin{array}{cc}\frac{1}{N}\sum _{n=1}^{N}D\left(\underset{i}{argmax}\left(f_v{\left({\tilde{x}}_n\right)}_i\right)==C_{tr}\right)\hfill & \mathrm{for}\mathrm{the}\mathrm{non}\text{-}\mathrm{targeted}\mathrm{attack}\hfill \\ \hfill & \\ \frac{1}{K\times N}\sum _{C_{ta}=1}^K\sum _{n=1}^{N}D\left(\underset{i}{argmax}\left(f_v{\left({\tilde{x}}_n\right)}_i\right)==C_{ta}\right)\hfill & \mathrm{for}\mathrm{the}\mathrm{targeted}\mathrm{attack}\hfill \end{array}\right.$$

(18)

where $C_{tr}$ and $C_{ta}$ represent the true and target classes of the input data, K is the number of target classes, and $D(·)$ is a discriminant function. In the non-targeted attack, the $\widetilde{Acc}$ metric reflects the probability that the victim model $f_v(·)$ identifies the adversarial example ${\tilde{x}}_n$ as $C_{tr}$, while in the targeted attack it indicates the probability that $f_v(·)$ recognizes ${\tilde{x}}_n$ as $C_{ta}$. Obviously, in the non-targeted attack, the lower the $\widetilde{Acc}$ metric, the better the attack. Conversely, in the targeted attack, a higher $\widetilde{Acc}$ metric represents $f_v(·)$ is more likely to recognize ${\tilde{x}}_n$ as $C_{ta}$, and thus the attack is more effective. In conclusion, the effectiveness of non-targeted attacks is inversely proportional to the $\widetilde{Acc}$ metric, and the effectiveness of targeted attacks is proportional to this metric. Additionally, there are other three similar indicators $Acc$, $Ac{c}^{*}$, and ${\widetilde{Acc}}^{*}$ that represent the classification accuracy of $f_v(·)$ for the original sample $x_n$, the attenuated sample $x_n^{*}$, and the attenuated adversarial example ${\tilde{x}}_n^{*}$, respectively. Note that whether it is a non-targeted or targeted attack, $Ac{c}^{*}$ always represents the accuracy with which $f_v(·)$ identifies $x_n^{*}$ as $C_{tr}$, while the other three accuracy indicators need to be calculated via (18) based on the attack mode. In particular, ${\widetilde{Acc}}^{*}$ represents the recognition result of $f_v(·)$ on ${\tilde{x}}_n^{*}$, which indirectly reflects the strength of the transferability possessed by ${\tilde{x}}_n$.

Meanwhile, we apply the following $L_p$-norm values to measure the attack stealthiness:

$$\left\{\begin{array}{cc}{\tilde{L}}_p=\frac{1}{N}\sum _{n=1}^N{∥{\tilde{x}}_n-x_n∥}_p\hfill & \mathrm{for}\mathrm{the}\mathrm{generator}\hfill \\ \hfill & \\ L_p^{*}=\frac{1}{N}\sum _{n=1}^N{∥x_n^{*}-x_n∥}_p\hfill & \mathrm{for}\mathrm{the}\mathrm{attenuator}\hfill \end{array}\right.$$

(19)

where ${\tilde{L}}_p$ and $L_p^{*}$ represent the image distortion caused by the generator and attenuator, respectively. In our experiments, the $L_p$-norm defaults to $L_2$-norm. In summary, we can set the early stop condition $ESC$ mentioned in Section 3.4 with the above indicators, as follows:

$$ESC=\left\{\begin{array}{cc}\widetilde{Acc}\le 0.05,Ac{c}^{*}\ge 0.9,{\widetilde{Acc}}^{*}\le 0.1,{\tilde{L}}_p\le 4,L_p^{*}\le 4\hfill & \mathrm{for}\mathrm{the}\mathrm{non}\text{-}\mathrm{targeted}\mathrm{attack}\hfill \\ \hfill & \\ \widetilde{Acc}\ge 0.95,Ac{c}^{*}\ge 0.9,{\widetilde{Acc}}^{*}\ge 0.9,{\tilde{L}}_p\le 4,L_p^{*}\le 4\hfill & \mathrm{for}\mathrm{the}\mathrm{targeted}\mathrm{attack}\hfill \end{array}\right.$$

(20)

Furthermore, to evaluate the real-time performance of adversarial attacks, we introduce the $Tc$ metric to denote the time cost of generating a single adversarial example, as follows:

$$Tc=\frac{Time}{N}$$

(21)

where $Time$ is the total time consumed to generate N adversarial examples.

4.4. DNN-Based SAR-ATR Models

A well-trained recognition model is a prerequisite for effective adversarial attacks, so we have trained six SAR-ATR models on the MSTAR dataset: DenseNet121, GoogLeNet, InceptionV3, Mobilenet, ResNet50, Shufflenet. All of them achieve outstanding recognition performance, with the classification accuracy of $98.72\%$, $98.06\%$, $96.17\%$, $96.91\%$, $97.98\%$, and $96.66\%$ on the testing dataset, respectively. In addition, we show the confusion matrix of each model in Figure 7.

4.5. Comparison of Attack Performance

In this section, we first evaluated the attack performance of the proposed method against DNN-based SAR-ATR models on the MSTAR dataset. Specifically, during the training phase of TAN, we took each network as the surrogate model in turn and assessed the recognition results of corresponding models on the outputs of TAN at each stage. The results of non-targeted and targeted attacks are detailed in Table 3 and Table 4, respectively.

In non-targeted attacks, the $Acc$ metric of each model on the MSTAR dataset exceeds $95\%$. However, after the non-targeted attack, the classification accuracy of all models on the generated adversarial examples, i.e., the $\widetilde{Acc}$ metric, is below $5\%$, and the ${\tilde{L}}_2$ indicator is less than $3.7$. It means that adversarial examples deteriorate the recognition performance of models rapidly through minor adversarial perturbations. Meanwhile, during the training phase of TAN, we evaluate the performance of the attenuator. According to the ${\widetilde{Acc}}^{*}$ metric, the attenuator leads to an average improvement of about $25\%$ in the classification accuracy of models on adversarial examples, that is, it indeed weakens the effectiveness of adversarial examples. We also should pay attention to the metrics $Ac{c}^{*}$ and $L_2^{*}$, i.e., the recognition accuracy of models on the attenuated samples, and the deformation distortion caused by the attenuator. The fact is that the $Ac{c}^{*}$ indicator of each model exceeds $80\%$, and the average value of the $L_2^{*}$ metric is about 4. It means that the attenuator retains most semantic information of original samples without causing excessive deformation distortion, which is in line with our requirements.

In targeted attacks, the $Acc$ metric represents the probability that models identify original samples as target classes, so it can reflect the dataset distribution, i.e., each category accounts for about $10\%$ of the total dataset. While after the targeted attack, the probability of each model recognizing adversarial examples as target classes, i.e., the $\widetilde{Acc}$ metric, is over $97\%$, and the ${\tilde{L}}_2$ indicator shows that the image distortion caused by adversarial perturbations is less than $3.5$. It means that the adversarial examples crafted by the generator can induce models to output specified results with high probability through minor perturbations. As with the non-targeted attack, we evaluate the performance of the attenuator. The ${\widetilde{Acc}}^{*}$ metric shows that the attenuator results in an average decrease of about $17\%$ in the probability of adversarial examples being identified as target classes. Meanwhile, the $Ac{c}^{*}$ metric of each model exceeds $85\%$, and the average value of the $L_2^{*}$ indicator is about $3.7$. That is, the attenuator weakens the effectiveness of adversarial examples through slight deformations, while preserving the semantic meaning of original samples well.

In summary, for both non-targeted and targeted attacks, the adversarial examples crafted by the generator can fool models with high success rates, and the attenuator is able to weaken the effectiveness of adversarial examples with slight deformations while retaining the semantic meaning of original samples. Moreover, we ensure that the generator always outperforms the attenuator by adjusting the training ratio between the two models. To visualize the attack results of TAN, we take ResNet50 as the surrogate model and display the outputs of TAN at each stage in Figure 8.

Finally, we compared the non-targeted and targeted attack performance of different methods against DNN-based SAR-ATR models on the MSTAR dataset, as detailed in Table 5. Obviously, for the same image distortion, the attack effectiveness of the proposed method against a single model may not be the best. Nevertheless, we focus more on the transferability of adversarial examples, which will be the main topic of the following section.

4.6. Comparison of Transferability

In this section, we evaluated the transferability of adversarial examples among DNN-based SAR-ATR models on the MSTAR dataset. Specifically, we first took each network as the surrogate model in turn and crafted adversarial examples for them, respectively. Then, we assessed the transferability by testing the recognition results of victim models on corresponding adversarial examples. The transferability in non-targeted and targeted attacks are shown in Table 6 and Table 7, respectively.

In non-targeted attacks, when the proposed method sequentially takes DenseNet121, GoogLeNet, InceptionV3, Mobilenet, ResNet50, and Shufflenet as the surrogate model, the highest recognition accuracy of victim models on the generated adversarial examples are $12.90\%$, $26.88\%$, $23.45\%$, $18.59\%$, $11.01\%$, and $23.54\%$, respectively. Equivalently, the highest recognition accuracy of victim models on the adversarial examples produced by baseline methods are $36.11\%$, $44.44\%$, $56.06\%$, $65.99\%$, $33.84\%$, and $68.51\%$, respectively. Meanwhile, for each surrogate model, victim models always have the lowest recognition accuracy on the adversarial examples crafted by our approach. Obviously, compared with baseline methods, the proposed method slightly sacrifices the performance on attacking surrogate models, but achieves state-of-the-art transferability among victim models in non-targeted attacks. Detailed results are shown in Table 6.

In targeted attacks, the proposed method still takes DenseNet121, GoogLeNet, InceptionV3, Mobilenet, ResNet50, and Shufflenet as the surrogate model in turn, and the minimum probability that victim models identify the generated adversarial examples as target classes are $52.39\%$, $55.02\%$, $54.57\%$, $57.66\%$, $66.26\%$, and $47.78\%$, respectively. Correspondingly, the minimum probability that victim models recognize the adversarial examples produced by baseline methods as target classes are $22.18\%$, $19.63\%$, $19.49\%$, $15.52\%$, $19.36\%$, and $13.06\%$, respectively. Moreover, for each surrogate model, victim models always identify the adversarial examples crafted by our approach as target classes with the maximum probability. Thus, the proposed method also achieves state-of-the-art transferability among victim models in targeted attacks. Detailed results are shown in Table 7.

In conclusion, for both non-targeted and targeted attacks, our approach generates adversarial examples with the strongest transferability. In other words, it performs better on exploring the common vulnerability of DNN models. We attribute this to the adversarial training between the generator and attenuator. Figuratively speaking, it is because the attenuator constantly creating obstacles for the generator that the attack capability of the generator is continuously enhanced and completed.

4.7. Comparison of Real-Time Performance

To evaluate the real-time performance of adversarial attacks, we calculated the time cost of generating a single adversarial example through different attack algorithms. We show the time consumption of non-targeted and targeted attacks in Table 8 and Table 9, respectively.

As we can see, there is almost no difference in the time cost of crafting a single adversarial example in non-targeted and targeted attacks. Meanwhile, for all the victim models, the time cost of generating a single adversarial example through the proposed method is stable around $2ms$. As for baseline methods, it depends on the complexity of victim models, the more complex the model, the longer the time cost. However, even for the simplest victim model, the minimum time cost of baseline methods is about $4.5ms$, consuming twice as much time as our approach. Thus, there is no doubt that the proposed method achieves the most superior and stable real-time performance.

4.8. Visualization of Adversarial Examples

In this section, we take ResNet50 as the surrogate model and visualize the adversarial examples crafted by different methods in Figure 9. Obviously, the adversarial perturbations generated by our method are continuous, and mainly focus on the target region of SAR images. In contrast, the perturbations produced by baseline methods are quite discrete, and almost cover the global area of SAR images. First, from the perspective of feature extraction, since the features that have a greater impact on recognition results are mainly concentrated in the target region rather than the background clutter area, a focused disruption of key features is certainly a more efficient attack strategy. Second, from the perspective of physical feasibility, the fewer pixels modified in adversarial examples, the smaller range perturbed in reality, so localized perturbations are more feasible than global ones. In summary, the proposed method improves the efficiency and feasibility of adversarial attacks by focusing perturbations on the target region of SAR images.

5. Conclusions

This paper proposed a transferable adversarial network (TAN) to generate adversarial examples for DNN-based SAR-ATR models, with the benefit that not only the transferability but also the real-time performance of adversarial examples is significantly improved. In the proposed method, a generator was designed to craft malicious samples through a one-step forward mapping from original data, and an attenuator was introduced to weaken the effectiveness of malicious samples by capturing the most harmful deformations. Our motivation is to enable real-time attacks by one-step mapping original samples to adversarial examples, and enhance the transferability through a two-player game between the generator and attenuator. Experimental results demonstrated that our approach achieves state-of-the-art transferability with acceptable adversarial perturbations and minimum time costs compared to existing attack methods, i.e., it excellently realizes real-time transferable adversarial attacks. Potential future work could consider attacking DNN-based SAR-ATR models under small sample conditions. It is also of great interest to real-world achieve the adversarial example of SAR images in addition to improving the performance of attack algorithms.