Adversarial attack on GNN-based SAR image classifier
Ye Tian, Rajgopal Kannan, Viktor K. Prasanna, Carl Busart · 2023
Synthetic Aperture Radar (SAR) Automatic Target Recognition (ATR) is a key technique in remote-sensing image recognition. The state-of-the-art Graph Neural Network (GNN) has achieved 99.09% accuracy on the MSTAR dataset. However, robustness is a critical concern when an adversary can add carefully crafted noise to the test image and mislead the classifier to give wrong output. In this work, we study the vulnerability of the state-of-the-art GNN-based SAR image classifier and show the feasibility of decreasing its accuracy by manipulating test images using the Fast Gradient Sign Method (FGSM). The intuition is that misclassifications are more likely to occur when the loss is high. For each SAR image, we add noise to every pixel, such that the perturbed image will be misclassified by the GNN model. For each pixel, the noise is determined by the gradient of the loss with respect to the pixel. Also, we guarantee that the noise values are sufficiently small such that the perturbation will be unnoticeable to human eyes. We conduct experiments by applying the attack on the 2425 test images from the MSTAR dataset. In our experiments, the accuracy of the target GNN drastically drops from 99.09% to 11.79% after we change each normalized pixel value (in [0, 1]) of the test images by less than 3/255.