Optimal Adversarial Sample Generation Method in SAR ATR Based on Joint Misleading and Fidelity Optimization

Adversarial sample generation is a key research direction for uncovering the vulnerabilities of deep neural networks and improving the robustness of Synthetic Aperture Radar Automatic Target Recognition (SAR ATR) systems. This study proposes an optimal adversarial sample generation method for SAR ATR that jointly optimizes misleading effectiveness and fidelity, aiming to resolve the core contradiction between adversarial effectiveness and visual concealment. The generation process is modeled as a joint optimization problem with the goals of balancing “misleading” and “fidelity”. First, an integrated composite transform attack strategy is designed to enhance attack effectiveness, and a joint measurement model is developed that combines the classification accuracy of the target model with the Learned Perceptual Image Patch Similarity (LPIPS) to quantify the two optimization goals. Next, an improved uniformity-guided multiobjective RIME algorithm is proposed. By integrating the Tent chaotic map, hybrid dynamic weighting, and golden sine guidance, the model is efficiently solved, yielding a set of Pareto-optimal solutions that represent various tradeoff degrees. Finally, the YOLOv10 object detection network is employed to identify perturbations in the samples within the solution set, thereby locating the critical points where disturbances occur and enabling the quantification of optimal parameters. Experiments on MSTAR and MiniSAR datasets show that the proposed ensemble compound transform attack method achieves an average target model recognition accuracy of 8.96% across different ensemble models and classification networks, improving the overall misleading effect by an average of 2.25% compared to other methods. Among them, the complex model increases by an average of 5.56%, while the proposed uniformity-guided multiobjective RIME algorithm improves the solution set diversity and convergence speed by over 25% compared with the comparison method. Using this method, the learned perceptual image patch similarity is maintained at 0.407 and the perturbation factor at 0.031, while classification accuracy decreases to 28.81%, demonstrating a tradeoff between misleading effectiveness and visual fidelity. This parameter maintains effective misleading performance under six different defense strategies, demonstrating strong robustness and providing a new approach and quantitative benchmark for adversarial attack research in SAR ATR.