Robust Cross‐Domain Adversarial Attacks for SAR‐ATR via Parameter‐Error Pre‐Attenuation

ABSTRACT

Deep neural network‐based synthetic aperture radar automatic target recognition (SAR‐ATR) systems are vulnerable to adversarial perturbations. Existing physical‐domain adversarial attacks usually assume accurately known radar and platform parameters. In practical SAR jamming, reconnaissance errors can deform and defocus adversarial templates during signal modulation and image formation, reducing attack effectiveness. To address this problem, this paper proposes Hybrid Competition and Pre‐attenuation of Errors for Cross‐domain Adversarial Attacks (HCAD). Specifically, HCAD first uses class‐level mean saliency templates to guide one‐step universal adversarial perturbation generation towards class decision boundaries. Second, a dual‐path optimization framework combines direct attack and mixed‐image competition to preserve white‐box effectiveness and improve cross‐model transferability. Finally, an error pre‐attenuation module simulates parameter‐induced geometric deformation and spatially varying defocus during training, enhancing robustness after digital‐to‐physical mapping. Experiments on MSTAR and SEN1‐2 show that, under 20% reconnaissance parameter error, HCAD reduces correct recognition rates to 24.38% and 38.88% in non‐targeted attacks, compared with 45.76% and 56.35% for the strongest baseline. For targeted attacks, HCAD achieves targeted success rates of 54.12% and 67.10%, exceeding baseline results of 42.94% and 56.87%. These results demonstrate improved robustness against SAR parameter uncertainty.