Unmanned aerial vehicle (UAV) imaging object detection systems based on deep neural networks are vulnerable to adversarial patch attacks. However, existing UAV image adversarial patch generation methods mainly target flat digital images, neglecting the adjustments to the adversarial patch morphology brought about by changes in the imaging projection matrix in a 3-D physical environment. This leads to adaptability issues with the attack patches, where changes in the UAV’s observation angle might cause dynamic variations in the vehicle target’s position and size, such geometric instability means that preset attack patches may no longer be applicable. To address these issues, this article proposes an adversarial patch generation method based on a projection transformation model, which we call projective-patch attack. To tackle the adaptability problem of the attack patches, we employ an adversarial patch relocation strategy, adjusting the preset adversarial patch’s morphology, size, and positioning on the target vehicle through the projection transformation model to ensure omnidirectional adaptability at different angles and altitudes. We then train an adversarial patch using data captured from specific vehicle targets in multiple scenarios to enhance its attack universality across various real-world aerial photography scenarios. Results from the vanishing attack experiments show that our method enhanced the attack success rate (ASR) against YOLOv3 by 37.62% and 19.95% on the UAV and VisDrone datasets, respectively, compared to the baseline. For the Faster R-CNN detector, the success rates increased by 11.63% and 14.76%. Additionally, we investigated the transferability of projection patches and their attack performance at different sizes and angles, with our adversarial examples consistently performing well.

Deep neural network-based synthetic aperture radar (SAR) automatic target recognition (ATR) systems are susceptible to attack by adversarial examples, which leads to misclassification by the SAR ATR system, resulting in theoretical model robustness problems and security problems in practice. Inspired by optical images, current SAR ATR adversarial example generation is performed in the image domain. However, the imaging principle of SAR images is based on the imaging of the echo signals interacting between the SAR and objects. Generating adversarial examples only in the image domain cannot change the physical world to achieve adversarial attacks. To solve these problems, this article proposes a framework for generating SAR adversarial examples in a 3D physical scene. First, adversarial attacks are implemented in the 2D image space, and the perturbation in the image space is converted into simulated rays that constitute SAR images through backpropagation optimization methods. The mapping between the simulated rays constituting SAR images and the 3D model is established through coordinate transformation, and point correspondence to triangular faces and intensity values to texture parameters are established. Thus, the simulated rays constituting SAR images are mapped to the 3D model, and the perturbation in the 2D image space is converted back to the 3D physical space to obtain the position and intensity of the perturbation in the 3D physical space, thereby achieving physical adversarial attacks. The experimental results show that our attack method can effectively perform SAR adversarial attacks in the physical world. In the digital world, we achieved an average fooling rate of up to 99.02% for three objects in six classification networks. In the physical world, we achieved an average fooling rate of up to 97.87% for these objects, with a certain degree of transferability across the six different network architectures. To the best of our knowledge, this is the first work to implement physical attacks in a full physical simulation condition. Our research establishes a theoretical foundation for the future concealment of SAR targets in practical settings and offers valuable insights for enhancing the attack and defense capabilities of subsequent DNNs in SAR ATR systems.

Synthetic Aperture Radar (SAR) target detection models are highly vulnerable to adversarial attacks, which significantly reduce detection performance and robustness. Existing adversarial SAR target detection approaches mainly focus on the image domain and neglect the critical role of signal propagation, making it difficult to fully capture the connection between the physical space and the image domain. To address this limitation, we propose an Echo Signal-Guided Adversarial Example Generation method for SAR target detection (SAR-ESAE). The core idea is to embed adversarial perturbations into SAR echo signals and propagate them through the imaging and inverse scattering processes, thereby establishing a unified attack framework across the signal, image, and physical spaces. In this way, perturbations not only appear as pixel-level distortions in SAR images but also alter the scattering characteristics of 3D target models in the physical space. Simulation experiments in the Scenario-SAR dataset demonstrate that the SAR-ESAE method reduces the mean Average Precision of the YOLOv3 model by 23.5% and 8.6% compared to Dpatch and RaLP attacks, respectively. Additionally, it exhibits excellent attack effectiveness in both echo signal and target model attack experiments and exhibits evident adversarial transferability across detection models with different architectures, such as Faster-RCNN and FCOS.

The increasing reliance on deep neural network-based object detection models in various applications has raised significant security concerns due to their vulnerability to adversarial attacks. In physical 3D environments, existing adversarial attacks that target object detection (3D-AE) face significant challenges. These attacks often require large and dispersed modifications to objects, making them easily noticeable and reducing their effectiveness in real-world scenarios. To maximize the attack effectiveness, large and dispersed attack camouflages are often employed, which makes the camouflages overly conspicuous and reduces their visual stealth. The core issue is how to use minimal and concentrated camouflage to maximize the attack effect. Addressing this, our research focuses on developing more subtle and efficient attack methods that can better evade detection in practical settings. Based on these principles, this paper proposes a local 3D attack method driven by a Maximum Aggregated Region Sparseness (MARS) strategy. In simpler terms, our approach strategically concentrates the attack modifications to specific areas to enhance effectiveness while maintaining stealth. To maximize the aggregation of attack-camouflaged regions, an aggregation regularization term is designed to constrain the mask aggregation matrix based on the face-adjacency relationships. To minimize the attack camouflage regions, a sparseness regularization is designed to make the mask weights tend toward a U-shaped distribution and limit extreme values. Additionally, neural rendering is used to obtain gradient-propagating multi-angle augmented data and suppress the model’s detection to locate universal critical decision regions from multiple angles. These technical strategies ensure that the adversarial modifications remain effective across different viewpoints and conditions. We test the attack effectiveness of different region selection strategies. On the CARLA dataset, the average attack efficiency of attacking the YOLOv3 and v5 series networks reaches 1.724, which represents an improvement of 0.986 (134%) compared to baseline methods. These results demonstrate a significant enhancement in attack performance, highlighting the potential risks to real-world object detection systems. The experimental results demonstrate that our attack method achieves both stealth and aggressiveness from different viewpoints. Furthermore, we explore the transferability of the decision regions. The results indicate that our method can be effectively combined with different texture optimization methods, with the average precision decreasing by 0.488 and 0.662 across different networks, which indicates a strong attack effectiveness.

Deep neural networks (DNNs)-based SAR target recognition models are susceptible to adversarial examples, which significantly reduce model robustness. Current methods for generating adversarial examples for SAR imagery primarily operate in the two-dimensional digital domain, known as image adversarial examples (I-AE). While recent work has started to consider the scattering mechanisms in SAR imaging, two major shortcomings remain: (1) considering scattering mechanisms only on the generated SAR imagery without accounting for the actual imaging process, and (2) the inability to achieve attacks in the three-dimensional physical domain, termed pseudo physics adversarial examples (PP-AE). Achieving adversarial attacks in the three-dimensional physical domain is challenging because it requires integrating perturbations into the SAR imaging process, altering the amplitude or phase information of the target's scattering echo signals to generate SAR adversarial examples, referred to as physics-based adversarial examples (P-AE). To address these challenges, this paper proposes SAR-SPA, a method for generating P-AE by modifying the targets' scattering characteristic parameters. Specifically, we iteratively optimize the intensity of the target's scattering echo signals by perturbing the scattering characteristic parameters of the three-dimensional target, and obtain the adversarial examples after echo signal processing and imaging processing in the RaySAR simulator. Experimental results show that, compared to image adversarial attack methods, the SAR-SPA method significantly improves the attack success rate of DNN-based SAR object recognition models (average over 15.65%) and demonstrates strong dual transferability across various models and perspectives.

Existing adversarial patch generation methods for remote sensing ship detection suffer from several limitations, including insufficient adaptability to patch size, inability to handle orientation variations of rotated ships, and poor transferability of adversarial patches. Considering these problems, this paper first proposes an adaptive rotation-scaling ensemble patch attack method, named ARSEA, to enhance suitability of adversarial patches for ship sizes and orientations. Specifically, a adversarial patch is scaled according to the size of the rotated bounding box of the ship and rotated using the angle information combined with a location-aware mask, enabling precise alignment with ship targets of various sizes and orientations. For the last problem, a model ensemble attack strategy based on gradient direction consistency is proposed, where weights are adaptively assigned according to the cosine similarity between the gradients of multiple surrogate models. This guides the patch optimization toward the commonly vulnerable regions shared by multiple models, reduces gradient conflicts, and enhances the transferability of the patch. Experimental results on multiple datasets demonstrate that the proposed method significantly reduces the detection accuracy of ship targets. When integrating multiple detectors, the generated patch achieves approximately 60% mAP reduction and 50% target vanishing rate on three unknown black-box detection models. Furthermore, in multi-class attack scenarios, the proposed method also achieves an attack success rate of around 40%, showing strong transferability.