Deep neural network-based Synthetic Aperture Radar (SAR) target recognition models are susceptible to adversarial examples. Current adversarial example generation methods for SAR imagery primarily operate in the 2D digital domain, known as image adversarial examples. Recent work, while considering SAR imaging scatter mechanisms, fails to account for the actual imaging process, rendering attacks in the three-dimensional physical domain infeasible, termed pseudo physics adversarial examples. To address these challenges, this paper proposes SAR-AE-SFP-Attack, a method to generate real physics adversarial examples by altering the scattering feature parameters of target objects. Specifically, we iteratively optimize the coherent energy accumulation of the target echo by perturbing the reflection coefficient and scattering coefficient in the scattering feature parameters of the three-dimensional target object, and obtain the adversarial example after echo signal processing and imaging processing in the RaySAR simulator. Experimental results show that compared to digital adversarial attack methods, SAR-AE-SFP Attack significantly improves attack efficiency on CNN-based models (over 30\%) and Transformer-based models (over 13\%), demonstrating significant transferability of attack effects across different models and perspectives.

翻译：基于深度神经网络的合成孔径雷达（SAR）目标识别模型易受对抗样本影响。当前SAR图像对抗样本生成方法主要作用于二维数字域，即图像对抗样本。近期工作虽考虑了SAR成像散射机制，但未顾及实际成像过程，导致三维物理域攻击不可行，称为伪物理对抗样本。为解决上述问题，本文提出SAR-AE-SFP-Attack方法，通过改变目标物体的散射特征参数生成真实物理对抗样本。具体而言，我们通过扰动三维目标物体散射特征参数中的反射系数与散射系数，迭代优化目标回波的相干能量累积，并在RaySAR仿真器中经回波信号处理与成像处理后获得对抗样本。实验结果表明，相较于数字对抗攻击方法，SAR-AE-SFP-Attack在基于CNN的模型（提升超30%）和基于Transformer的模型（提升超13%）上显著提升攻击效率，且在不同模型与视角间展现出显著的攻击效果可迁移性。