A Physically Realisable Adversarial Attack Method Based on Attributed Scattering Centre Model

ABSTRACT The SAR‐ATR (Synthetic Aperture Radar ‐ Automatic Target Recognition) system based on deep learning technology has been proven to have a target recognition vulnerability—adversarial examples, which has attracted widespread attention. However, existing adversarial sample attacks focus primarily on the image domain, neglecting the unique characteristics of SAR imaging and the challenges of transferring attacks to the physical domain. In response, we propose a physically realisable adversarial attack method based on radar imaging principles and the Attribute Scattering Centre Model (ASCM), which aims to translate perturbations from the digital image domain to modifications of physical electromagnetic parameters of radar. The ASCM method consists of three key components: (1) reconstructing the backscattered signal to physical scattering centres using ASCM, (2) establishing a minimal perturbation optimisation model under ‐norm constraints to restrict perturbations to scattering centres, and (3) applying the Monte Carlo Method (MCM) to determine optimal adjustment points and amounts for scattering centre amplitude parameters. Experimental results demonstrate that the proposed method achieves the highest success rate of 96.25% for nontargeted attacks and 88.89% for targeted attacks, with the potential for extension to the physical domain to generate high‐success‐rate adversarial attack effects.