{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,12]],"date-time":"2025-10-12T01:22:22Z","timestamp":1760232142369,"version":"build-2065373602"},"reference-count":31,"publisher":"MDPI AG","issue":"20","license":[{"start":{"date-parts":[[2022,10,15]],"date-time":"2022-10-15T00:00:00Z","timestamp":1665792000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61921001"],"award-info":[{"award-number":["61921001"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Remote Sensing"],"abstract":"<jats:p>Adversarial examples (AEs) bring increasing concern on the security of deep-learning-based synthetic aperture radar (SAR) target recognition systems. SAR AEs with perturbation constrained to the vicinity of the target have been recently in the spotlight due to the physical realization prospects. However, current adversarial detection methods generally suffer severe performance degradation against SAR AEs with region-constrained perturbation. To solve this problem, we treated SAR AEs as low-probability samples incompatible with the clean dataset. With the help of energy-based models, we captured an inherent energy gap between SAR AEs and clean samples that is robust to the changes of the perturbation region. Inspired by this discovery, we propose an energy-based adversarial detector, which requires no modification to a pretrained model. To better distinguish the clean samples and AEs, energy regularization was adopted to fine-tune the pretrained model. Experiments demonstrated that the proposed method significantly boosts the detection performance against SAR AEs with region-constrained perturbation.<\/jats:p>","DOI":"10.3390\/rs14205168","type":"journal-article","created":{"date-parts":[[2022,10,17]],"date-time":"2022-10-17T03:43:58Z","timestamp":1665978238000},"page":"5168","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["Energy-Based Adversarial Example Detection for SAR Images"],"prefix":"10.3390","volume":"14","author":[{"given":"Zhiwei","family":"Zhang","sequence":"first","affiliation":[{"name":"Comprehensive Situational Awareness Group of IntelliSense Lab, National University of Defense Technology, Changsha 410073, China"}]},{"given":"Xunzhang","family":"Gao","sequence":"additional","affiliation":[{"name":"Comprehensive Situational Awareness Group of IntelliSense Lab, National University of Defense Technology, Changsha 410073, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1740-8865","authenticated-orcid":false,"given":"Shuowei","family":"Liu","sequence":"additional","affiliation":[{"name":"Comprehensive Situational Awareness Group of IntelliSense Lab, National University of Defense Technology, Changsha 410073, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6793-5025","authenticated-orcid":false,"given":"Bowen","family":"Peng","sequence":"additional","affiliation":[{"name":"Comprehensive Situational Awareness Group of IntelliSense Lab, National University of Defense Technology, Changsha 410073, China"}]},{"given":"Yufei","family":"Wang","sequence":"additional","affiliation":[{"name":"The State Key Laboratory of Complex Electromagnetic Environmental Effects on Electronics and Information System, National University of Defense Technology, Changsha 410073, China"}]}],"member":"1968","published-online":{"date-parts":[[2022,10,15]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"143","DOI":"10.1109\/MGRS.2020.3046356","article-title":"Deep learning meets SAR: Concepts, models, pitfalls, and perspectives","volume":"9","author":"Zhu","year":"2021","journal-title":"IEEE Geosci. Remote Sens. Mag."},{"key":"ref_2","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2013). Intriguing properties of neural networks. arXiv."},{"key":"ref_3","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv."},{"key":"ref_4","unstructured":"Kurakin, A., Goodfellow, I., and Bengio, S. (2016). Adversarial examples in the physical world. Artificial Intelligence Safety and Security, Chapman and Hall\/CRC."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A., and Frossard, P. (2016, January 27\u201330). DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Carlini, N., and Wagner, D. (2017, January 22\u201324). Towards evaluating the robustness of neural networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2017.49"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"1333","DOI":"10.1109\/JSTARS.2020.3038683","article-title":"Adversarial examples for CNN-based SAR image classification: An experience study","volume":"14","author":"Li","year":"2020","journal-title":"IEEE J. Sel. Top. Appl. Earth Obs. Remote Sens."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"102632","DOI":"10.1016\/j.jnca.2020.102632","article-title":"Adversarial attacks on deep-learning-based SAR image target recognition","volume":"162","author":"Huang","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_9","first-page":"4010005","article-title":"Fast C&W: A Fast Adversarial Attack Algorithm to Fool SAR Target Recognition with Deep Convolutional Neural Networks","volume":"19","author":"Du","year":"2021","journal-title":"IEEE Geosci. Remote Sens. Lett."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"4509805","DOI":"10.1109\/LGRS.2022.3184311","article-title":"Speckle Variant Attack: Towards Transferable Adversarial Attack to SAR Target Recognition","volume":"19","author":"Peng","year":"2022","journal-title":"IEEE Geosci. Remote Sens. Lett."},{"key":"ref_11","unstructured":"Shafahi, A., Najibi, M., Ghiasi, M.A., Xu, Z., Dickerson, J., Studer, C., Davis, L.S., Taylor, G., and Goldstein, T. (2019). Adversarial training for free!. Adv. Neural Inf. Process. Syst., 32, Available online: https:\/\/proceedings.neurips.cc\/paper\/2019\/file\/7503cfacd12053d309b6bed5c89de212-Paper.pdf."},{"key":"ref_12","unstructured":"Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., and Jordan, M. (2019, January 9\u201315). Theoretically principled trade-off between robustness and accuracy. Proceedings of the International Conference on Machine Learning, PMLR, Long Beach, CA, USA."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Xu, Y., Sun, H., Chen, J., Lei, L., Ji, K., and Kuang, G. (2021). Adversarial Self-Supervised Learning for Robust SAR Target Recognition. Remote Sens., 13.","DOI":"10.3390\/rs13204158"},{"key":"ref_14","unstructured":"Ma, X., Li, B., Wang, Y., Erfani, S.M., Wijewickrema, S., Schoenebeck, G., Song, D., Houle, M.E., and Bailey, J. (May, January 30). Characterizing adversarial subspaces using local intrinsic dimensionality. Proceedings of the 6th International Conference on Learning Representations, ICLR, Vancouver, BC, Canada."},{"key":"ref_15","unstructured":"Lee, K., Lee, K., Lee, H., and Shin, J. (2018). A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Adv. Neural Inf. Process. Syst., 31, Available online: https:\/\/proceedings.neurips.cc\/paper\/2018\/file\/abdeb6f575ac5c6676b747bca8d09cc2-Paper.pdf."},{"key":"ref_16","first-page":"8016905","article-title":"Lie to me: A soft threshold defense method for adversarial examples of remote sensing images","volume":"19","author":"Chen","year":"2021","journal-title":"IEEE Geosci. Remote Sens. Lett."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Du, M., Bi, D., Du, M., Wu, Z.L., and Xu, X. (2022). Local Aggregative Attack on SAR Image Classification Models. Authorea Prepr.","DOI":"10.22541\/au.165633740.01163731\/v1"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Dang, X., Yan, H., Hu, L., Feng, X., Huo, C., and Yin, H. (2021, January 23\u201326). SAR Image Adversarial Samples Generation Based on Parametric Model. Proceedings of the 2021 International Conference on Microwave and Millimeter Wave Technology (ICMMT), Nanjing, China.","DOI":"10.1109\/ICMMT52847.2021.9618140"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"LeCun, Y., Chopra, S., Hadsell, R., Ranzato, M., and Huang, F. (2006). A tutorial on energy-based learning. Predicting Structured Data, MIT Press.","DOI":"10.7551\/mitpress\/7443.003.0014"},{"key":"ref_20","unstructured":"Will Grathwohl, K.C.W.e. (2020, January 26\u201330). Your classifier is secretly an energy based model and you should treat it like one. Proceedings of the 8th International Conference on Learning Representations, ICLR, Addis Ababa, Ethiopia."},{"key":"ref_21","first-page":"21464","article-title":"Energy-based out-of-distribution detection","volume":"33","author":"Liu","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_22","unstructured":"Brown, T.B., Man\u00e9, D., Roy, A., Abadi, M., and Gilmer, J. (2017). Adversarial patch. arXiv."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Rao, S., Stutz, D., and Schiele, B. (2020). Adversarial training against location-optimized adversarial patches. European Conference on Computer Vision, Proceedings of the ECCV 2020: Computer Vision\u2014ECCV 2020 Workshops, Springer.","DOI":"10.1007\/978-3-030-68238-5_32"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Lu, M., Li, Q., Chen, L., and Li, H. (2021). Scale-adaptive adversarial patch attack for remote sensing image aircraft detection. Remote Sens., 13.","DOI":"10.3390\/rs13204078"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Ross, T.D., Worrell, S.W., Velten, V.J., Mossing, J.C., and Bryant, M.L. (1998, January 13\u201317). Standard SAR ATR evaluation experiments using the MSTAR public release data set. Proceedings of the Algorithms for Synthetic Aperture Radar Imagery V. International Society for Optics and Photonics, Orlando, FL, USA.","DOI":"10.1117\/12.321859"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Malmgren-Hansen, D., and Nobel-J, M. (2015, January 7\u201310). Convolutional neural networks for SAR image segmentation. Proceedings of the 2015 IEEE International Symposium on Signal Processing and Information Technology (ISSPIT), Abu Dhabi, United Arab Emirates.","DOI":"10.1109\/ISSPIT.2015.7394333"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_28","unstructured":"Simonyan, K., and Zisserman, A. (2014). Very deep convolutional networks for large-scale image recognition. arXiv."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Huang, G., Liu, Z., Van Der Maaten, L., and Weinberger, K.Q. (2017, January 21\u201326). Densely connected convolutional networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"7419","DOI":"10.1109\/TGRS.2021.3051641","article-title":"An empirical study of adversarial examples on remote sensing image scene classification","volume":"59","author":"Chen","year":"2021","journal-title":"IEEE Trans. Geosci. Remote Sens."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Du, C., and Zhang, L. (2021). Adversarial Attack for SAR Target Recognition Based on UNet-Generative Adversarial Network. Remote Sens., 13.","DOI":"10.3390\/rs13214358"}],"container-title":["Remote Sensing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2072-4292\/14\/20\/5168\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T00:54:58Z","timestamp":1760144098000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2072-4292\/14\/20\/5168"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10,15]]},"references-count":31,"journal-issue":{"issue":"20","published-online":{"date-parts":[[2022,10]]}},"alternative-id":["rs14205168"],"URL":"https:\/\/doi.org\/10.3390\/rs14205168","relation":{},"ISSN":["2072-4292"],"issn-type":[{"type":"electronic","value":"2072-4292"}],"subject":[],"published":{"date-parts":[[2022,10,15]]}}}