Adversarial attacks have highlighted the vulnerability of classifiers based on machine learning for Synthetic Aperture Radar (SAR) Automatic Target Recognition (ATR) tasks. An adversarial attack perturbs SAR images of on-ground targets such that the classifiers are misled into making incorrect predictions. However, many existing attacking techniques rely on arbitrary manipulation of SAR images while overlooking the feasibility of executing the attacks on real-world SAR imagery. Instead, adversarial attacks should be able to be implemented by physical actions, for example, placing additional false objects as scatterers around the on-ground target to perturb the SAR image and fool the SAR ATR. In this paper, we propose the On-Target Scatterer Attack (OTSA), a scatterer-based physical adversarial attack. To ensure the feasibility of its physical execution, we enforce a constraint on the positioning of the scatterers. Specifically, we restrict the scatterers to be placed only on the target instead of in the shadow regions or the background. To achieve this, we introduce a positioning score based on Gaussian kernels and formulate an optimization problem for our OTSA attack. Using a gradient ascent method to solve the optimization problem, the OTSA can generate a vector of parameters describing the positions, shapes, sizes and amplitudes of the scatterers to guide the physical execution of the attack that will mislead SAR image classifiers. The experimental results show that our attack obtains significantly higher success rates under the positioning constraint compared with the existing method.

翻译：对抗攻击揭示了基于机器学习的合成孔径雷达自动目标识别分类器的脆弱性。对抗攻击通过扰动地面目标的合成孔径雷达图像，误导分类器做出错误预测。然而，现有攻击技术大多依赖对SAR图像的任意操纵，忽视了在实际SAR图像中实施攻击的可行性。相反，对抗攻击应能通过物理行为实现，例如在地面目标周围放置额外的虚假散射体以扰动SAR图像，从而欺骗SAR自动目标识别系统。本文提出一种基于散射体的物理对抗攻击——目标上散射体攻击。为确保其物理实施的可行性，我们对散射体的位置施加约束：仅允许将散射体放置在目标本身上，而非阴影区域或背景中。为此，我们引入基于高斯核的定位分数，并为OTSA攻击构建优化问题。通过梯度上升法求解该优化问题，OTSA可生成描述散射体位置、形状、尺寸和幅度的参数向量，指导物理实施以误导SAR图像分类器。实验结果表明，在定位约束条件下，我们的攻击相比现有方法获得了显著更高的成功率。