Deep neural network (DNN)-based synthetic aperture radar (SAR) automatic target recognition (ATR) systems have been shown to be highly vulnerable to adversarial perturbations that are deliberately designed yet almost imperceptible but can bias DNN inference when added to targeted objects. This leads to serious safety concerns when applying DNNs to high-stakes SAR ATR applications. Therefore, enhancing the adversarial robustness of DNNs is essential for applying DNNs to modern real-world SAR ATR systems. Toward building more robust DNN-based SAR ATR models, this article explores the domain knowledge of the SAR imaging process and proposes a novel scattering model guided adversarial attack (SMGAA) algorithm, which can generate adversarial perturbations in the form of electromagnetic scattering response (called adversarial scatterers). The proposed SMGAA consists of two parts: 1) a parametric scattering model and corresponding imaging method and 2) a customized gradient-based optimization algorithm. First, we introduce the effective attributed scattering center model (ASCM) and a general imaging method to describe the scattering behavior of typical geometric structures in the SAR imaging process. By further devising several strategies to take the domain knowledge of SAR target images into account and relax the greedy search procedure, the proposed method does not need to be prudentially fine-tuned and can efficiently find the effective ASCM parameters to fool the SAR classifiers and facilitate the robust model training. Comprehensive evaluations on the moving and stationary target acquisition and recognition (MSTAR) dataset show that the adversarial scatterers generated by SMGAA are more robust to perturbations and transformations in the SAR processing chain than the currently studied attacks and are effective to construct a defensive model against the malicious scatterers.

Recent advances in deep neural networks (DNNs) highlight the success of synthetic aperture radar automatic target recognition (SAR ATR) with superior effectiveness and efficiency. However, the DNNs are known to be vulnerable to adversarial examples, whose performance will be dramatically reduced when the imperceptible perturbation exists. In optical image processing, invisible perturbations are typically embedded in the way of a full-scale distribution in a purely digital setting. Whereas, it is not feasible to achieve this in SAR ATR tasks due to the inaccessibility of the SAR system and unique imaging mechanism. In practice, the subtle perturbations could be produced by physical approaches that change the scattering property of the target. Therefore, the adversarial perturbations for SAR ATR should be of good transferability to achieve an effective attack on major DNN classifiers as well as the accessible additive region in SAR images with respect to the realistic target locations. In this letter, we present a novel approach, namely speckle-variant attack (SVA). The proposed SVA is composed of two major modules: an iterative gradient-based perturbation generator and a target region extractor. The perturbation generator implements a speckle-variant transformation that continuously reconstructs the speckle-noise pattern during each of the iterations for strong transferability. The target region extractor ensures the feasibility of the additive adversarial perturbations in practical scenarios by restricting the region of the perturbation. Therefore, the proposed SVA is capable of producing adversarial examples that are more transferable and physically feasible. Extensive evaluations of the MSTAR dataset show that the SVA has achieved superior transferability and competitive time consumption compared with the SOTA transformation-based techniques, including the diverse inputs method and the scale-invariant method.

In this paper, the convolution neural networks (CNN) are developed for the classification and localization of mixed near-field and far-field sources by using the geometry of symmetric nested array. We first transform the received data into frequency domain. Then, we preprocess the phase difference matrix to decouple mixed sources. Considering that the counter-diagonal elements in the phase difference matrix only contain the direction of arrival (DOA) parameter of each mixed source, we utilize the upper right elements as the input of CNN to estimate the DOA of each mixed source. In order to avoid the influence of noise, we construct a particular range vector without the estimated DOA and employ the output of autoencoder to classify the mixed sources. Finally, we further exploit the output of autoencoder and apply the CNN without bias vectors to estimate the range of near-field sources. In contrast to the traditional learning-based approaches regarding the parameter estimation as a classification problem, the proposed approach considers the parameter estimation as a regression problem and can significantly reduce the complexity of networks. Simulation results demonstrate that the proposed learning-based method can improve the precision for the mixed source localization. Moreover, the proposed method is robust to the off-grid parameters and the different numbers of mixed sources.

Interrupted sampling repeater jamming (ISRJ) is an effective way of deceiving coherent radar sensors, especially for linear frequency modulated (LFM) radar. In this paper, for a simplified scenario with a single jammer, we propose a dynamic electronic counter-counter measure (ECCM) scheme based on jammer parameter estimation and transmitted signal design. Firstly, the LFM waveform is transmitted to estimate the main jamming parameters by investigating the discontinuousness of the ISRJ’s time-frequency (TF) characteristics. Then, a parameter-adjusted intra-pulse frequency coded signal, whose ISRJ signal after matched filtering only forms a single false target, is designed adaptively according to the estimated parameters, i.e., sampling interval, sampling duration and repeater times. Ultimately, for typical jamming scenes with different jamming signal ratio (JSR) and duty cycle, we propose two particular ISRJ suppression approaches. Simulation results validate the effective performance of the proposed scheme for countering the ISRJ, and the trade-off relationship between the two approaches is demonstrated.

It has been demonstrated that deep neural network (DNN)-based synthetic aperture radar (SAR) automatic target recognition (ATR) techniques are extremely susceptible to adversarial intrusions, that is, malicious SAR images including deliberately generated perturbations that are imperceptible to the human eye but can deflect DNN inference. Attack algorithms in previous studies are based on direct access to a ATR model such as gradients or training data to generate adversarial examples for a target SAR image, which is against the non-cooperative nature of ATR applications. In this article, we establish a fully black-box universal attack (FBUA) framework to craft one single universal adversarial perturbation (UAP) against a wide range of DNN architectures as well as a large fraction of target images. It is of both high practical relevance for an attacker and a risk for ATR systems that the UAP can be designed by an FBUA in advance and without any access to the victim DNN. The proposed FBUA can be decomposed to three main phases: (1) SAR images simulation, (2) substitute model training, and (3) UAP generation. Comprehensive evaluations on the MSTAR and SARSIM datasets demonstrate the efficacy of the FBUA, i.e., can achieve an average fooling ratio of 64.6% on eight cutting-edge DNNs (when the magnitude of the UAP is set to 16/255). Furthermore, we empirically find that the black-box UAP mainly functions by activating spurious features which can effectively couple with clean features to force the ATR models to concentrate on several categories and exhibit a class-wise vulnerability. The proposed FBUA aligns with the non-cooperative nature and reveals the access-free adversarial vulnerability of DNN-based SAR ATR techniques, providing a foundation for future defense against black-box threats.

Recent research treats radar emitter classification (REC) problems as typical closed-set classification problems, i.e., assuming all radar emitters are cooperative and their pulses can be pre-obtained for training the classifiers. However, such overly ideal assumptions have made it difficult to fit real-world REC problems into such restricted models. In this paper, to achieve online REC in a more realistic way, we convert the online REC problem into dynamically performing subspace clustering on pulse streams. Meanwhile, the pulse streams have evolving and imbalanced properties which are mainly caused by the existence of the non-cooperative emitters. Specifically, a novel data stream clustering (DSC) algorithm, called dynamic improved exemplar-based subspace clustering (DI-ESC), is proposed, which consists of two phases, i.e., initialization and online clustering. First, to achieve subspace clustering on subspace-imbalanced data, a static clustering approach called the improved ESC algorithm (I-ESC) is proposed. Second, based on the subspace clustering results obtained, DI-ESC can process the pulse stream in real-time and can further detect the emitter evolution by the proposed evolution detection strategy. The typically dynamic behavior of emitters such as appearing, disappearing and recurring can be detected and adapted by the DI-ESC. Extinct experiments on real-world emitter data show the sensitivity, effectiveness, and superiority of the proposed I-ESC and DI-ESC algorithms.