Adversarial examples pose a significant threat to Deep Neural Networks (DNNs) underpinning Synthetic Aperture Radar (SAR) Automatic Target Recognition (ATR) systems, as these models exhibit acute susceptibility to such malicious inputs. While white-box attacks achieve high success rates, their transferability to unknown black-box models—particularly across different network architectures (e.g., from CNNs to Vision Transformers)—remains a significant challenge. Existing gradient-based iterative methods often overfit the specific decision boundary of the surrogate model, resulting in poor generalization. To address this, we propose a novel generative attack framework termed BUM. Instead of merely maximizing the classification error, BUM explicitly models and minimizes the epistemic uncertainty of the surrogate model. By leveraging Monte Carlo (MC) Dropout to simulate a Bayesian ensemble, we train a generator to craft perturbations that are consistently adversarial across stochastic sub-models. This regularization forces the attack to target high-level, structure-aware semantic features shared among architectures, rather than low-level, model-specific artifacts. Extensive experiments on the MSTAR and FUSAR datasets demonstrate the superior black-box transferability of BUM.
Wang et al. (Thu,) studied this question.