  Deep neural network-based Synthetic Aperture Radar (SAR) target recognition
models are susceptible to adversarial examples. Current adversarial example
generation methods for SAR imagery primarily operate in the 2D digital domain,
known as image adversarial examples. Recent work, while considering SAR imaging
scatter mechanisms, fails to account for the actual imaging process, rendering
attacks in the three-dimensional physical domain infeasible, termed pseudo
physics adversarial examples. To address these challenges, this paper proposes
SAR-AE-SFP-Attack, a method to generate real physics adversarial examples by
altering the scattering feature parameters of target objects. Specifically, we
iteratively optimize the coherent energy accumulation of the target echo by
perturbing the reflection coefficient and scattering coefficient in the
scattering feature parameters of the three-dimensional target object, and
obtain the adversarial example after echo signal processing and imaging
processing in the RaySAR simulator. Experimental results show that compared to
digital adversarial attack methods, SAR-AE-SFP Attack significantly improves
attack efficiency on CNN-based models (over 30\%) and Transformer-based models
(over 13\%), demonstrating significant transferability of attack effects across
different models and perspectives.
