Physical-Domain SAR Universal Adversarial Perturbation Generation

We consider adversarial perturbation generation of the synthetic aperture radar (SAR) automatic target recognition system based on deep neural network. The key goal is to reduce the recognition accuracy of the opponent's SAR image recognition network by generating effective perturbations. Typical digital-domain methods implement perturbations on the post-processing end of SAR imaging, which is impractical in real adversarial scenarios. Instead, we focus on the more practical physical-domain methods that implement perturbations on the signal acquisition of SAR imaging. However, there are two main challenges from digital domain to physical domain: 1) The jamming signal must be band-limited in physical domain, which is usually not satisfied in digital domain. This spectral mismatch results in severe jamming performance degradation, and traditional adversarial networks have difficulty incorporating the band-limited constraints; 2) The generation ability across various target types should be enhanced under the given band-limited conditions. To this end, we propose a method to implement band-limited universal adversarial attack based on a complex-valued generative adversarial network, which incorporates both band-limited constraints and generalization capability. The feasibility of the proposed method is verified by the simulations based on a publicly available dataset. This work contributes to advancing SAR adversarial attacks toward practical applications.