Deep neural network (DNN)-based synthetic aperture radar (SAR) automatic target recognition (ATR) systems have been shown to be highly vulnerable to adversarial perturbations that are deliberately designed yet almost imperceptible but can bias DNN inference when added to targeted objects. This leads to serious safety concerns when applying DNNs to high-stakes SAR ATR applications. Therefore, enhancing the adversarial robustness of DNNs is essential for applying DNNs to modern real-world SAR ATR systems. Toward building more robust DNN-based SAR ATR models, this article explores the domain knowledge of the SAR imaging process and proposes a novel scattering model guided adversarial attack (SMGAA) algorithm, which can generate adversarial perturbations in the form of electromagnetic scattering response (called adversarial scatterers). The proposed SMGAA consists of two parts: 1) a parametric scattering model and corresponding imaging method and 2) a customized gradient-based optimization algorithm. First, we introduce the effective attributed scattering center model (ASCM) and a general imaging method to describe the scattering behavior of typical geometric structures in the SAR imaging process. By further devising several strategies to take the domain knowledge of SAR target images into account and relax the greedy search procedure, the proposed method does not need to be prudentially fine-tuned and can efficiently find the effective ASCM parameters to fool the SAR classifiers and facilitate the robust model training. Comprehensive evaluations on the moving and stationary target acquisition and recognition (MSTAR) dataset show that the adversarial scatterers generated by SMGAA are more robust to perturbations and transformations in the SAR processing chain than the currently studied attacks and are effective to construct a defensive model against the malicious scatterers.

Recent advances in deep neural networks (DNNs) highlight the success of synthetic aperture radar automatic target recognition (SAR ATR) with superior effectiveness and efficiency. However, the DNNs are known to be vulnerable to adversarial examples, whose performance will be dramatically reduced when the imperceptible perturbation exists. In optical image processing, invisible perturbations are typically embedded in the way of a full-scale distribution in a purely digital setting. Whereas, it is not feasible to achieve this in SAR ATR tasks due to the inaccessibility of the SAR system and unique imaging mechanism. In practice, the subtle perturbations could be produced by physical approaches that change the scattering property of the target. Therefore, the adversarial perturbations for SAR ATR should be of good transferability to achieve an effective attack on major DNN classifiers as well as the accessible additive region in SAR images with respect to the realistic target locations. In this letter, we present a novel approach, namely speckle-variant attack (SVA). The proposed SVA is composed of two major modules: an iterative gradient-based perturbation generator and a target region extractor. The perturbation generator implements a speckle-variant transformation that continuously reconstructs the speckle-noise pattern during each of the iterations for strong transferability. The target region extractor ensures the feasibility of the additive adversarial perturbations in practical scenarios by restricting the region of the perturbation. Therefore, the proposed SVA is capable of producing adversarial examples that are more transferable and physically feasible. Extensive evaluations of the MSTAR dataset show that the SVA has achieved superior transferability and competitive time consumption compared with the SOTA transformation-based techniques, including the diverse inputs method and the scale-invariant method.

In this paper, the convolution neural networks (CNN) are developed for the classification and localization of mixed near-field and far-field sources by using the geometry of symmetric nested array. We first transform the received data into frequency domain. Then, we preprocess the phase difference matrix to decouple mixed sources. Considering that the counter-diagonal elements in the phase difference matrix only contain the direction of arrival (DOA) parameter of each mixed source, we utilize the upper right elements as the input of CNN to estimate the DOA of each mixed source. In order to avoid the influence of noise, we construct a particular range vector without the estimated DOA and employ the output of autoencoder to classify the mixed sources. Finally, we further exploit the output of autoencoder and apply the CNN without bias vectors to estimate the range of near-field sources. In contrast to the traditional learning-based approaches regarding the parameter estimation as a classification problem, the proposed approach considers the parameter estimation as a regression problem and can significantly reduce the complexity of networks. Simulation results demonstrate that the proposed learning-based method can improve the precision for the mixed source localization. Moreover, the proposed method is robust to the off-grid parameters and the different numbers of mixed sources.

Interrupted sampling repeater jamming (ISRJ) is an effective way of deceiving coherent radar sensors, especially for linear frequency modulated (LFM) radar. In this paper, for a simplified scenario with a single jammer, we propose a dynamic electronic counter-counter measure (ECCM) scheme based on jammer parameter estimation and transmitted signal design. Firstly, the LFM waveform is transmitted to estimate the main jamming parameters by investigating the discontinuousness of the ISRJ’s time-frequency (TF) characteristics. Then, a parameter-adjusted intra-pulse frequency coded signal, whose ISRJ signal after matched filtering only forms a single false target, is designed adaptively according to the estimated parameters, i.e., sampling interval, sampling duration and repeater times. Ultimately, for typical jamming scenes with different jamming signal ratio (JSR) and duty cycle, we propose two particular ISRJ suppression approaches. Simulation results validate the effective performance of the proposed scheme for countering the ISRJ, and the trade-off relationship between the two approaches is demonstrated.