DoFA: Adversarial examples detection for SAR images by dual-objective feature attribution

Synthetic aperture radar (SAR) classification models based on convolutional neural networks have high accuracy, but the models’ security is still threatened by adversarial examples. The high threat of adversarial examples derives from the invisible noise that can cause feature changes within the model. Among many adversarial examples detection methods, feature attribution that is sensitive to feature changes performs well in feature analysis. Unfortunately, the existing feature attribution-based detection methods cannot balance the computational efficiency and detection performance well due to the size and speckle noise of the images in SAR adversarial examples detection. In this work, we propose the Dual-objective Feature Attribution (DoFA) method by using the feature attribution scan block to find the suitable scan granularity. The DoFA method formulates the SAR adversarial examples detection issue as a dual-objective optimization problem and takes the number of subsamples generated by feature analysis and the area under curve (AUC) value of the logistic regression model as the objective functions while the feature scan block's size, stride, padding, and the number of selected model layers are the decision variables. Non-dominated Sorting Genetic Algorithm-II (NSGA-II) is adopted to search for the scan block parameters with Pareto optimality so that the DoFA method can automatically obtain the best feature analysis granularity in different scenarios. The experimental results on the FUSAR-Ship dataset have shown that the proposed DoFA method has a higher AUC value under five adversarial attacks and a smaller number of subsamples than the existing adversarial examples detection method.