Semantic Smoothing via Novel View Synthesis for Robust SAR Image Classification

Technical Summary: Semantic Smoothing via Novel View Synthesis for Robust SAR Image Classification

Problem Statement
Deep neural networks (DNNs) used for Synthetic Aperture Radar (SAR) Automatic Target Recognition (ATR) are vulnerable to adversarial perturbations, posing risks in safety-critical applications. While randomized smoothing is a principled defense that improves robustness by averaging predictions over noisy inputs, it typically relies on isotropic Gaussian noise. This approach fails to preserve the semantic structure of SAR imagery, where object appearance is heavily dependent on acquisition geometry (azimuth and elevation angles). Consequently, isotropic noise often generates samples that do not correspond to meaningful physical observations, rendering the defense less effective against domain-specific attacks that exploit radar physics (e.g., scattering behavior) rather than simple pixel-space noise.

Methodology
The authors propose Semantic Smoothing, a defense framework that replaces isotropic noise injection with structured, semantics-preserving transformations generated by a Novel View Synthesis (NVS) model.

1. Core Concept: Instead of perturbing an input image with random noise, the method uses a generative model to synthesize multiple plausible views of the same object under randomized but controlled geometric transformations. The classifier's predictions across these synthesized views are aggregated (via majority voting) to form a robust final prediction.
2. Generative Model (GeNVS): The framework utilizes a modified Denoising Diffusion Probabilistic Model (DDPM) combined with a geometry-aware NVS architecture, adapted from GeNVS.
   • Input Processing: An input SAR image $x_{adv}$ (potentially adversarial) and its original acquisition parameters (azimuth $\phi_{az}$, elevation $\theta_{el}$) are encoded into a latent 3D feature volume.
   • View Synthesis: The model samples target viewing parameters ($t_i = \phi_{target, az}, \theta_{target, el}$) from a transformation distribution $T_D$ (defined as the uniform distribution over training acquisition parameters).
   • Rendering: Rays are cast through the latent volume to extract features, which are rendered via a NeRF-style MLP to produce a feature image.
   • Diffusion Generation: A diffusion network denoises Gaussian noise conditioned on the rendered feature image and target parameters to generate a high-fidelity SAR image $x^{NV}_i$ at the new viewpoint.
3. Aggregation: For a given input, $N$ novel views are generated. Each view is passed through a pre-trained classifier $f_{cls}$. The final label is determined by the majority vote of the $N$ predictions.

Key Contributions

• Semantic Smoothing Framework: Introduction of a novel adversarial defense that leverages randomized generative transformations to produce multiple semantics-preserving views, aggregating predictions to mitigate adversarial artifacts.
• SAR-Specific Instantiation: Development of a geometry-conditioned NVS model for SAR imagery. By conditioning on azimuth and elevation parameters, the model enables the controllable generation of randomized radar views that respect the physical constraints of SAR imaging.
• Empirical Validation: Extensive experiments on the MSTAR dataset demonstrating that semantic smoothing provides substantial robustness gains against both conventional gradient-based attacks (FGSM, PGD) and SAR-specific physically grounded attacks (OTSA, SMGAA).

Results
Experiments on the MSTAR dataset (500 images across 10 vehicle classes) compared the proposed method against an undefended baseline and standard randomized smoothing (using isotropic Gaussian noise with varying $\sigma$).

• Robustness Gains: Semantic smoothing consistently maintained high accuracy across all attack types and strengths. For instance, under strong PGD attacks ($\epsilon=0.005$), the undefended model dropped to 0% accuracy, while semantic smoothing (with $N=10$) achieved 94.18%.
• Superiority over Randomized Smoothing: Semantic smoothing significantly outperformed randomized smoothing. While randomized smoothing showed inconsistent performance and often degraded accuracy depending on the noise scale $\sigma$, semantic smoothing provided stable, high robustness without requiring careful tuning of a noise parameter.
• Clean Accuracy Improvement: Unlike many defense mechanisms that trade off clean accuracy for robustness, semantic smoothing improved clean classification accuracy (94.72% vs. 90.00% baseline) by aggregating predictions over semantically consistent synthesized views.
• Efficiency vs. Performance: While semantic smoothing incurs higher computational costs due to the generation step ($N \times (C_g + C_f)$) compared to randomized smoothing ($N \times C_f$), the paper argues this trade-off is favorable because the generated samples are semantically meaningful and significantly more informative than isotropic noise perturbations.

Significance and Claims
The paper claims that semantic smoothing represents a promising alternative to isotropic noise for adversarial defense in structured sensing domains like SAR. By shifting the smoothing process from a local pixel-level neighborhood to a manifold of plausible geometric transformations, the method effectively suppresses non-semantic adversarial artifacts while preserving the object identity required for classification. The authors assert that this approach demonstrates the value of leveraging semantically meaningful variability rather than arbitrary noise to achieve robustness against both standard and physics-based adversarial attacks.

Future Work
The authors note that future work should investigate perturbation propagation through the GeNVS model, evaluate the robustness of the generator itself, and consider adaptive white-box attacks where the adversary has full knowledge of the defense mechanism.