Robustness of Deep Neural Networks for Micro-Doppler Radar Classification

TL;DR

This work investigates the robustness of two deep CNNs for micro-Doppler radar classification, revealing sensitivity to small temporal shifts and vulnerability to adversarial examples under standard training. It evaluates strategies such as temporal augmentation, adversarial training, and alternative input representations, showing that combining adversarial and temporal augmentation improves generalization and robustness. Transforming inputs to a phase-discarded temporal-Fourier magnitude (Cadence-Velocity Diagram) further enhances robustness with comparable accuracy to Doppler-time baselines. The findings offer practical guidance for deploying more reliable micro-Doppler classifiers in real-world radar applications by emphasizing representation choices and robust training practices.

Abstract

With the great capabilities of deep classifiers for radar data processing come the risks of learning dataset-specific features that do not generalize well. In this work, the robustness of two deep convolutional architectures, trained and tested on the same data, is evaluated. When standard training practice is followed, both classifiers exhibit sensitivity to subtle temporal shifts of the input representation, an augmentation that carries minimal semantic content. Furthermore, the models are extremely susceptible to adversarial examples. Both small temporal shifts and adversarial examples are a result of a model overfitting on features that do not generalize well. As a remedy, it is shown that training on adversarial examples and temporally augmented samples can reduce this effect and lead to models that generalise better. Finally, models operating on cadence-velocity diagram representation rather than Doppler-time are demonstrated to be naturally more immune to adversarial examples.

Figures (6)

• Figure 1: Two tested architectures. Both models use 9$\times$9 convolutional kernels.
• Figure 2: Without appropriate prevention mechanisms, models can express undesired sensitivity to changes with minimal semantic content. With the Model A trained in the standard manner, the clean sample of 'Standing Up' (a) is interpreted as 'Drinking' with a small temporal shift (b), and, as 'Object Pick Up' when a low-magnitude adversarial offset is added (c).
• Figure 3: Confidence Response to Temporal Shifts for an Object Pick Up Sample. Models trained in a standard manner.
• Figure 4: Confidence Response to Temporal Shifts for an Object Pick Up Sample. Models trained with temporal augmentation.
• Figure 5: Confidence Response to Circular Doppler Shifts for an Object Pick Up Sample. Models trained in a standard manner.