Turn off MathJax
Article Contents
Article Navigation >  Journal of Radars  > 2026  > Proofreading [2nd]
YANG Yang and YANG Jingwen. Adversarial attacks on gait recognition based on radar micro-doppler signatures[J]. Journal of Radars, in press. doi: 10.12000/JR26056
Citation: YANG Yang and YANG Jingwen. Adversarial attacks on gait recognition based on radar micro-doppler signatures[J]. Journal of Radars, in press. doi: 10.12000/JR26056
shu

Adversarial Attacks on Gait Recognition Based on Radar Micro-Doppler Signatures

DOI: 10.12000/JR26056 CSTR: 32380.14.JR26056

  • Tianjin University, School of Electrical and Information Engineering, Tianjin 300072, China

Funds:  The National Natural Science Foundation of China (62471329)
More Information
  • Corresponding author: YANG Yang, yang_yang@tju.edu.cn
  • Received Date: 2026-03-09
  • Rev Recd Date: 2026-05-10
    • Available Online: 2026-05-14
    Abstract
  • The evaluation of the security limits of radar micro-Doppler gait recognition systems under adversarial conditions is of practical significance. Current attack methods, primarily adapted from the optical image domain, do not consider the detailed feature distribution and time-frequency characteristics of micro-Doppler spectrograms. This oversight leads to limited effectiveness in cross-model black-box targeted attack scenarios. To overcome this challenge, we propose gradient guidance and adaptive cropping radar gait targeted attack (GAC-Attack), a targeted black-box attack framework for human gait micro-Doppler signatures. To reduce the number of semantic shifts caused by high inter-class similarity and closely distributed features, an inter-class relationship-guided robust gradient optimization mechanism is developed. In addition, an adaptive local cropping mechanism is designed that takes advantage of the concentration of discriminative information in local time-frequency regions, thereby increasing perturbation interference on shared discriminative features across various models. We construct two datasets, one for single-action gait recognition and the other for multi-action identity recognition, and conduct systematic comparative experiments across seven network architectures and seven black-box targeted attack methods. The experimental results show that GAC-Attack improves the targeted attack success rate by approximately 7% and 4% compared to the strongest competing baseline on the gait and identity datasets, respectively, while consistently achieving top performance across most model combinations. These results validate the effectiveness of the proposed framework in complex scenarios and its robustness in cross-model transfer settings.

     

    • FullText(HTML)
  • loading
    • References(60)
  • [1]
    FIGUEIREDO B, FRAZÃO Á, ROUCO A, et al. A review: Radar remote-based gait identification methods and techniques[J]. Remote Sensing, 2025, 17(7): 1282. doi: 10.3390/rs17071282.
    [2]
    HE Wentao, REN Jianfeng, BAI Ruibin, et al. Radar gait recognition using dual-branch swin transformer with asymmetric attention fusion[J]. Pattern Recognition, 2025, 159: 111101. doi: 10.1016/j.patcog.2024.111101.
    [3]
    孙延鹏, 王爽, 屈乐乐, 等. 基于点云数据与微多普勒谱图多模态特征的雷达步态识别[J/OL]. 雷达科学与技术. https://link.cnki.net/urlid/34.1264.tn.20251112.1509.002.2025, 2025.

    SUN Yanpeng, WANG Shuang, QU Lele, et al. Radar gait recognition based on point cloud and micro-Doppler multimodal features[J/OL]. Radar Science and Technology. https://link.cnki.net/urlid/34.1264.tn.20251112.1509.002.2025, 2025.
    [4]
    马进昇, 宋一轩, 刘家彤, 等. 基于DDPM-MBN的井下人员步态识别方法[J]. 工矿自动化, 2025, 51(9): 60–65. doi: 10.13272/j.issn.1671-251x.2025030104.

    MA Jinsheng, SONG Yixuan, LIU Jiatong, et al. Gait recognition method for underground personnel based on DDPM-MBN[J]. Journal of Mine Automation, 2025, 51(9): 60–65. doi: 10.13272/j.issn.1671-251x.2025030104.
    [5]
    BAI Xueru, HUI Ye, WANG Li, et al. Radar-based human gait recognition using dual-channel deep convolutional neural network[J]. IEEE Transactions on Geoscience and Remote Sensing, 2019, 57(12): 9767–9778. doi: 10.1109/TGRS.2019.2929096.
    [6]
    SHI Yu, DU Lan, CHEN Xiaoyang, et al. Robust gait recognition based on deep CNNs with camera and radar sensor fusion[J]. IEEE Internet of Things Journal, 2023, 10(12): 10817–10832. doi: 10.1109/JIOT.2023.3242417.
    [7]
    JIANG Xinrui, ZHANG Ye, YANG Qi, et al. Millimeter-wave array radar-based human gait recognition using multi-channel three-dimensional convolutional neural network[J]. Sensors, 2020, 20(19): 5466. doi: 10.3390/s20195466.
    [8]
    YANG Yang, MU Qingshuang, LI Beichen, et al. Few-shot open-set gait recognition based on radar micro-Doppler signatures[J]. IEEE Sensors Journal, 2025, 25(13): 25134–25145. doi: 10.1109/JSEN.2025.3571781.
    [9]
    GOODFELLOW I J, SHLENS J, and SZEGEDY C. Explaining and harnessing adversarial examples[C]. The 3rd International Conference on Learning Representations, San Diego, USA, 2015.
    [10]
    KURAKIN A, GOODFELLOW I J, and BENGIO S. Adversarial examples in the physical world[M]. YAMPOLSKIY R V. Artificial Intelligence Safety and Security. New York: Chapman and Hall/CRC, 2018: 99–112. doi: 10.1201/9781351251389.
    [11]
    LI Ang, WANG Yifei, GUO Yiwen, et al. Adversarial examples are not real features[C]. The 37th International Conference on Neural Information Processing Systems, New Orleans, USA, 2023: 754.
    [12]
    MAZZIERI R, PEGORARO J, and ROSSI M. Open-set gait recognition from sparse mmWave radar point clouds[J]. IEEE Sensors Journal, 2025, 25(17): 33051–33063. doi: 10.1109/JSEN.2025.3587503.
    [13]
    DIRACO G, RESCIO G, and LEONE A. Radar-based activity recognition in strictly privacy-sensitive settings through deep feature learning[J]. Biomimetics, 2025, 10(4): 243. doi: 10.3390/biomimetics10040243.
    [14]
    IBITOYE O, ABOU-KHAMIS R, EL SHEHABY M, et al. The threat of adversarial attacks on machine learning in network security: A survey[EB/OL]. https://arxiv.org/abs/1911.02621, 2019.
    [15]
    WEI Zhipeng, CHEN Jingjing, WEI Xingxing, et al. Heuristic black-box adversarial attacks on video recognition models[C]. The 34th AAAI Conference on Artificial Intelligence, New York, USA, 2020: 12338–12345. doi: 10.1609/aaai.v34i07.6918.
    [16]
    CARLINI N, ATHALYE A, PAPERNOT N, et al. On evaluating adversarial robustness[EB/OL]. https://arxiv.org/abs/1902.06705, 2019.
    [17]
    LIU Chang, DONG Yinpeng, XIANG Wenzhao, et al. A comprehensive study on robustness of image classification models: Benchmarking and rethinking[J]. International Journal of Computer Vision, 2025, 133(2): 567–589. doi: 10.1007/s11263-024-02196-3.
    [18]
    MADRY A, MAKELOV A, SCHMIDT L, et al. Towards deep learning models resistant to adversarial attacks[C]. The 6th International Conference on Learning Representations, Vancouver, Canada, 2018.
    [19]
    MOOSAVI-DEZFOOLI S M, FAWZI A, and FROSSARD P. DeepFool: A simple and accurate method to fool deep neural networks[C]. 2016 IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, USA, 2016: 2574–2582. doi: 10.1109/CVPR.2016.282.
    [20]
    CARLINI N and WAGNER D. Towards evaluating the robustness of neural networks[C]. 2017 IEEE Symposium on Security and Privacy (SP), San Jose, USA, 2017: 39–57. doi: 10.1109/SP.2017.49.
    [21]
    LI Maosen, DENG Cheng, LI Tengjiao, et al. Towards transferable targeted attack[C]. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Seattle, USA, 2020: 641–649. doi: 10.1109/CVPR42600.2020.00072.
    [22]
    CHEN Pinyu, ZHANG Huan, SHARMA Y, et al. ZOO: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models[C]. The 10th ACM Workshop on Artificial Intelligence and Security, Dallas, USA, 2017: 15–26. doi: 10.1145/3128572.3140448.
    [23]
    MURPHY K, SCHÖLKOPF B, WIERSTRA D, et al. Natural evolution strategies[J]. The Journal of Machine Learning Research, 2014, 15(1): 949–980.
    [24]
    DONG Yinpeng, LIAO Fangzhou, PANG Tianyu, et al. Boosting adversarial attacks with momentum[C]. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Salt Lake City, USA, 2018: 9185–9193. doi: 10.1109/CVPR.2018.00957.
    [25]
    DONG Yinpeng, PANG Tianyu, SU Hang, et al. Evading defenses to transferable adversarial examples by translation-invariant attacks[C]. 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Long Beach, USA, 2019: 4312–4321. doi: 10.1109/CVPR.2019.00444.
    [26]
    XIE Cihang, ZHANG Zhishuai, ZHOU Yuyin, et al. Improving transferability of adversarial examples with input diversity[C]. 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Long Beach, USA, 2019: 2730–2739. doi: 10.1109/CVPR.2019.00284.
    [27]
    ZHOU Junfan, FENG Sijia, SUN Hao, et al. Attributed scattering center guided adversarial attack for DCNN SAR target recognition[J]. IEEE Geoscience and Remote Sensing Letters, 2023, 20: 4001805. doi: 10.1109/LGRS.2023.3235051.
    [28]
    GAO Fei, LI Mingyang, WANG Jun, et al. General sparse adversarial attack method for SAR images based on keypoints[J]. IEEE Transactions on Aerospace and Electronic Systems, 2025, 61(5): 14943–14960. doi: 10.1109/TAES.2025.3588821.
    [29]
    DU Chuan, CONG Yulai, ZHANG Lei, et al. A practical deceptive jamming method based on vulnerable location awareness adversarial attack for radar HRRP target recognition[J]. IEEE Transactions on Information Forensics and Security, 2022, 17: 2410–2424. doi: 10.1109/TIFS.2022.3170275.
    [30]
    WAN Xuanshen, LIU Wei, NIU Chaoyang, et al. Black-box universal adversarial attack for DNN-based models of SAR automatic target recognition[J]. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 2024, 17: 8673–8696. doi: 10.1109/JSTARS.2024.3384188.
    [31]
    YIN Fei, ZHANG Yong, WU Baoyuan, et al. Generalizable black-box adversarial attack with meta learning[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024, 46(3): 1804–1818. doi: 10.1109/TPAMI.2022.3194988.
    [32]
    ZHOU Jie, PENG Bo, XIE Jianyue, et al. Conditional random field-based adversarial attack against SAR target detection[J]. IEEE Geoscience and Remote Sensing Letters, 2024, 21: 4004505. doi: 10.1109/LGRS.2024.3365788.
    [33]
    苏薪元, 全斯农, 蔡志豪, 等. 联合误导性与逼真度优化的SAR ATR最优对抗样本生成方法[J]. 雷达学报(中英文), 2026, 15(2): 563–582. doi: 10.12000/JR25179.

    SU Xinyuan, QUAN Sinong, CAI Zhihao, et al. Optimal adversarial sample generation method in SAR ATR based on joint misleading and fidelity optimization[J]. Journal of Radars, 2026, 15(2): 563–582. doi: 10.12000/JR25179.
    [34]
    万烜申, 刘伟, 牛朝阳, 等. 基于动量迭代快速梯度符号的SAR-ATR深度神经网络黑盒攻击算法[J]. 雷达学报, 2024, 13(3): 714–729. doi: 10.12000/JR23220.

    WAN Xuanshen, LIU Wei, NIU Chaoyang, et al. Black-box attack algorithm for SAR-ATR deep neural networks based on MI-FGSM[J]. Journal of Radars, 2024, 13(3): 714–729. doi: 10.12000/JR23220.
    [35]
    KIM H, PARK J, and LEE J. Generating transferable adversarial examples for speech classification[J]. Pattern Recognition, 2023, 137: 109286. doi: 10.1016/j.patcog.2022.109286.
    [36]
    YU Jianfeng, QIU Kai, WANG Pengju, et al. Perturbing BEAMs: EEG adversarial attack to deep learning models for epilepsy diagnosing[J]. BMC Medical Informatics and Decision Making, 2023, 23(1): 115. doi: 10.1186/s12911-023-02212-5.
    [37]
    EL HOUDA SAYAH BEN AISSA N, KORICHI A, LAKAS A, et al. Assessing robustness to adversarial attacks in attention-based networks: Case of EEG-based motor imagery classification[J]. SLAS Technology, 2024, 29(4): 100142. doi: 10.1016/j.slast.2024.100142.
    [38]
    于振华, 胡旭飞, 叶鸥. 类别条件生成对抗网络的语音对抗样本生成方法[J]. 西安交通大学学报, 2024, 58(12): 153–164. doi: 10.7652/xjtuxb202412015.

    YU Zhenhua, HU Xufei, and YE Ou. Speech adversarial sample generation method based on class-conditional generative adversarial networks[J]. Journal of Xi’an Jiaotong University, 2024, 58(12): 153–164. doi: 10.7652/xjtuxb202412015.
    [39]
    YANG Yang, ZHAO Junyu, LI Beichen, et al. Semisupervised radar-based gait recognition in random walking conditions[J]. IEEE Transactions on Aerospace and Electronic Systems, 2026, 62: 2265–2279. doi: 10.1109/TAES.2025.3637174.
    [40]
    XUE Shikun, DU Lan, SHI Yu, et al. Fine-grained spatial–temporal gait recognition network based on millimeter-wave radar point cloud[J]. IEEE Transactions on Geoscience and Remote Sensing, 2024, 62: 5101316. doi: 10.1109/TGRS.2023.3345829.
    [41]
    YANG Yang, GE Yanyan, LI Beichen, et al. Multiscenario open-set gait recognition based on radar micro-Doppler signatures[J]. IEEE Transactions on Instrumentation and Measurement, 2022, 71: 2519813. doi: 10.1109/TIM.2022.3214271.
    [42]
    LIN T Y, ROYCHOWDHURY A, and MAJI S. Bilinear CNN models for fine-grained visual recognition[C]. 2015 IEEE International Conference on Computer Vision, Santiago, Chile, 2015: 1449–1457. doi: 10.1109/ICCV.2015.170.
    [43]
    KATSIKAS D, PASSALIS N, and TEFAS A. Inducing neural collapse via anticlasses and one-cold cross-entropy loss[J]. IEEE Transactions on Neural Networks and Learning Systems, 2025, 36(10): 18133–18144. doi: 10.1109/TNNLS.2025.3580892.
    [44]
    WANG Yujian, ZHANG Jianxun, and SUN Renhao. A facial expression recognition method integrating uncertainty estimation and active learning[J]. Computers, Materials & Continua, 2024, 81(1): 533–548. doi: 10.32604/cmc.2024.054644.
    [45]
    OH S J, BENENSON R, KHOREVA A, et al. Exploiting saliency for object segmentation from image level labels[C]. 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Honolulu, USA, 2017: 5038–5047. doi: 10.1109/CVPR.2017.535.
    [46]
    SIMONYAN K, VEDALDI A, and ZISSERMAN A. Deep inside convolutional networks: Visualising image classification models and saliency maps[C]. The 2nd International Conference on Learning Representations, Banff, Canada, 2014.
    [47]
    LIU K H, LIU T J, LIU H H, et al. Facial makeup detection via selected gradient orientation of entropy information[C]. 2015 IEEE International Conference on Image Processing (ICIP), Quebec City, Canada, 2015: 4067–4071. doi: 10.1109/ICIP.2015.7351570.
    [48]
    ZHAO Jufeng, CUI Guangmang, GONG Xiaoli, et al. Fusion of visible and infrared images using global entropy and gradient constrained regularization[J]. Infrared Physics & Technology, 2017, 81: 201–209. doi: 10.1016/j.infrared.2017.01.012.
    [49]
    HE Kaiming, ZHANG Xiangyu, REN Shaoqing, et al. Deep residual learning for image recognition[C]. 2016 IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, USA, 2016: 770–778. doi: 10.1109/CVPR.2016.90.
    [50]
    SIMONYAN K and ZISSERMAN A. Very deep convolutional networks for large-scale image recognition[C]. The 3rd International Conference on Learning Representations, San Diego, USA, 2015.
    [51]
    HUANG Gao, LIU Zhuang, VAN DER MAATEN L, et al. Densely connected convolutional networks[C]. 2017 IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, USA, 2017: 4700–4708. doi: 10.1109/CVPR.2017.243.
    [52]
    CHEN Zhaoxi, LI Gang, FIORANELLI F, et al. Dynamic hand gesture classification based on multistatic radar micro-Doppler signatures using convolutional neural network[C]. 2019 IEEE Radar Conference (RadarConf), Boston, USA, 2019: 1–5. doi: 10.1109/RADAR.2019.8835796.
    [53]
    ZHANG Jiajun and SHI Zhiguo. Deformable deep convolutional generative adversarial network in microwave based hand gesture recognition system[C]. 2017 9th International Conference on Wireless Communications and Signal Processing (WCSP), Nanjing, China, 2017: 1–6. doi: 10.1109/WCSP.2017.8170976.
    [54]
    LANG Yue, WANG Qing, YANG Yang, et al. Person identification with limited training data using radar micro-Doppler signatures[J]. Microwave and Optical Technology Letters, 2020, 62(3): 1060–1068. doi: 10.1002/mop.32125.
    [55]
    WANG Jiafeng, CHEN Zhaoyu, JIANG Kaixun, et al. Boosting the transferability of adversarial attacks with global momentum initialization[J]. Expert Systems with Applications, 2024, 255: 124757. doi: 10.1016/j.eswa.2024.124757.
    [56]
    WEI Zhipeng, CHEN Jingjing, WU Zuxuan, et al. Enhancing the self-universality for transferable targeted attacks[C]. 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, Canada, 2023: 12281–12290. doi: 10.1109/CVPR52729.2023.01182.
    [57]
    BYUN J, KWON M J, CHO S, et al. Introducing competition to boost the transferability of targeted adversarial examples through clean feature mixup[C]. 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, Canada, 2023: 24648–24657. doi: 10.1109/CVPR52729.2023.02361.
    [58]
    ZENG Hui, CHEN Biwei, and PENG Anjie. Enhancing targeted transferability VIA feature space fine-tuning[C]. 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Seoul, Republic of Korea, 2024: 4475–4479. doi: 10.1109/ICASSP48485.2024.10446654.
    [59]
    ZHANG Ming, CHEN Yongkang, LI Hu, et al. Dynamic loss yielding more transferable targeted adversarial examples[J]. Neurocomputing, 2024, 590: 127754. doi: 10.1016/j.neucom.2024.127754.
    [60]
    GU Jindong, JIA Xiaojun, DE JORGE P, et al. A survey on transferability of adversarial examples across deep neural networks[J]. Transactions on Machine Learning Research, 2024, 2024.
    • Relative Articles
    • Supplements(0)
    • Cited By
  • 加载中

Catalog

    通讯作者: 陈斌, bchen63@163.com
    • 1. 

      沈阳化工大学材料科学与工程学院 沈阳 110142

    1. 本站搜索
    2. 百度学术搜索
    3. 万方数据库搜索
    4. CNKI搜索
    Get Citation
    PDF
    XML
    Article views(111) PDF downloads(21) Cited by()
    Proportional views
    Related

    京ICP备20021838号-14   Supported by: Beijing Renhe Information Technology Co. Ltd     百度统计

    /

    DownLoad:  Full-Size Img  PowerPoint
    Return