Physically Feasible Backdoor Attack in Deep Learning-Based SAR Target Recognition

Deep learning has significantly enhanced the performance of Synthetic Aperture Radar (SAR) Automatic Target Recognition (ATR) by enabling models to learn complex features. However, the black-box nature of deep neural networks also introduces security vulnerabilities, one of which is the highly threatening backdoor attack. Backdoor attack injects hidden backdoors during training, enabling attackers to activate them with specific triggers during inference to manipulate the model's behavior. Despite extensive research in natural image applications, backdoor attack on SAR ATR systems remains unexplored. Existing methods face significant limitations when applied to SAR images due to the unique electromagnetic imaging mechanisms that distinguish SAR from optical systems. To address this gap, we propose a novel backdoor attack method tailored for SAR ATR. Leveraging the attributed scattering center model, we design physically feasible scatterer triggers that exploit SAR imaging characteristics. These triggers, enabled through digital simulation or physical implementation, facilitate stealthy and effective backdoor attack with minimal training data access. Extensive experiments demonstrate the strong performance and robustness of our method, exposing critical vulnerabilities in SAR ATR systems to the security risk of backdoor attack.