Abstract
Convolutional neural networks (CNN) have been widely used in the field
of synthetic aperture radar (SAR) image classification for their high
classification accuracy. However, because CNNs learn a fairly
discontinuous input-output mapping, they are vulnerable to adversarial
examples. Unlike most existing attack manners that fool CNN models with
complex global perturbations, this study provides an idea for generating
more dexterous adversarial perturbations. It demonstrates that minor
local perturbations are also effective for attacking. We propose a new
attack method called local aggregative attack (LAA), which is a
black-box method based on probability label information, to reduce the
range and amplitude of adversarial perturbations. Our attack introduces
the differential evolution (DE) algorithm to search for the optimal
perturbations and applies the maximum between-class variance method
(OTSU algorithm) to accomplish pixel-level labelling of the target and
background areas, enabling attackers to generate adversarial examples of
SAR images (AESIs) by adding small-scale perturbations to specific
areas. Meanwhile, the structural dissimilarity (DSSIM) metric optimises
the cost function to limit image distortion and improve attack
stealthiness. Experiments show that our method achieves a high attack
success rate against these CNN-based classifiers, and the generated
AESIs are equipped with non-negligible transferability between different
models.