MAS-PD: Transferable Adversarial Attack Against Vision-Transformers-Based SAR Image Classification Task

• 發表在: IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing
• Main Authors: Boshi Zheng, Jiabin Liu, Yunjie Li, Yan Li, Zhen Qin
• 格式: Article
• 語言: 英语
• 出版: IEEE 2025-01-01
• 主題: Adversarial attack; black-box attack; synthetic aperture radar (SAR); vision transformers (ViTs)
• 在線閱讀: https://ieeexplore.ieee.org/document/10906523/
• ISSN: 1939-1404; 2151-1535

Synthetic aperture radar (SAR) is widely used in civil and military fields. With advancements in vision transformer (ViT) research, these models have become increasingly important in SAR image classification due to their remarkable performance. Therefore, effectively interfering with the classification results of enemy radar systems has become a crucial factor in ensuring battlefield security. Adversarial attacks offer a potential solution, as they can significantly mislead models and cause incorrect predictions. However, recent research on adversarial examples focus on the vulnerability of convolutional neural network (CNN) models, while the attack on transformer models has not been extensively studied. Considering that ViTs differ from CNNs due to its unique multihead self-attention (MSA) mechanism and its approach of segmenting images into patches for input, this article proposes a “MAS-PD” black-box adversarial attack method targeting these two mechanisms in ViTs. First, to target the MSA mechanism, we propose the Momentum Attention Skipping attack. By skipping the attention gradient during backpropagation and using momentum to avoid local maxima during gradient ascent, our method enhances the transferability of adversarial attacks across different models. Then, we apply dropout on input patches in each iteration, achieving higher attack success rates compared to using all patches. We compare our method with four traditional adversarial attack techniques across different model architectures, including CNNs and ViTs, using the publicly available MSTAR SAR dataset. The experimental results show that our method achieves an average Attack Success Rate (ASR) of 68.82% across ViTs, while other methods achieve no more than 50% ASR on average. When applied to CNNs, our method also achieves an average ASR of 67.14%, compared to less than 40% ASR for other methods. The experiment results demonstrate that our algorithm significantly enhances transferability between ViTs and from ViTs to CNNs in SAR image classification tasks.