pith. sign in

arxiv: 2605.16440 · v1 · pith:5UUTNEY3new · submitted 2026-05-15 · 💻 cs.CV · cs.AI

Semantic Smoothing via Novel View Synthesis for Robust SAR Image Classification

Daniel Brignac , Fengwei Tian , Banafsheh Latibari , Abhijit Mahalanobis , Ravi Tandon This is my paper

Pith reviewed 2026-05-20 20:10 UTC · model grok-4.3

classification 💻 cs.CV cs.AI
keywords semantic smoothingnovel view synthesisSAR image classificationadversarial robustnessrandomized smoothingautomatic target recognition
0
0 comments X

The pith

Semantic smoothing replaces isotropic noise with geometry-conditioned novel views to defend SAR classifiers against attacks.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper proposes semantic smoothing as an alternative to standard randomized smoothing for protecting deep neural networks in SAR automatic target recognition. Instead of adding isotropic noise that disrupts image structure, it conditions a novel view synthesis model on acquisition geometry to produce multiple plausible radar views of the target. Predictions from these views are aggregated into a single robust output. Experiments indicate this yields better resistance to attacks including FGSM, PGD, OTSA, and SMGAA, and also raises accuracy on unmodified inputs. A sympathetic reader would care because the approach respects the geometric and physical structure of radar sensing rather than treating images generically.

Core claim

Semantic smoothing replaces isotropic noise perturbations with structured randomized transformations generated by a novel view synthesis model conditioned on acquisition geometry. Predictions across the generated randomized views are aggregated to form a robust classifier for SAR imagery.

What carries the argument

A geometry-conditioned novel view synthesis model that generates multiple plausible SAR views while preserving semantic structure, enabling robust prediction aggregation.

If this is right

  • Robustness improves against standard attacks such as FGSM and PGD.
  • Robustness also improves against SAR-specific attacks such as OTSA and SMGAA.
  • Clean classification accuracy increases alongside the robustness gains.
  • Structured geometric transformations serve as a viable substitute for isotropic noise in structured sensing domains.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same replacement of noise by domain-preserving transformations could be tested in other geometrically structured modalities such as ultrasound or LiDAR.
  • One could measure whether removing the geometry conditioning still yields most of the robustness benefit.
  • Integration with existing certified-defense pipelines might extend the range of certified radii achievable in SAR settings.

Load-bearing premise

The novel view synthesis model generates multiple plausible radar views that preserve the semantic structure of the original SAR imagery sufficiently well to enable effective robust aggregation.

What would settle it

If aggregating predictions over the synthesized views produces no measurable gain in accuracy under FGSM, PGD, OTSA, or SMGAA attacks compared with standard randomized smoothing on the same SAR data, the central claim would not hold.

Figures

Figures reproduced from arXiv: 2605.16440 by Abhijit Mahalanobis, Banafsheh Latibari, Daniel Brignac, Fengwei Tian, Ravi Tandon.

Figure 1
Figure 1. Figure 1: Overview of the proposed semantic smoothing defense. Given a potentially adversarial input, a geometry-conditioned [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of our SAR image generation pipeline. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: The original MSTAR image (a) for the 2S1 object category followed by the perturbed image via the generic attacks [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
read the original abstract

Deep neural networks are vulnerable to adversarial perturbations, limiting deployment in safety-critical applications such as synthetic aperture radar (SAR) automatic target recognition (ATR). Randomized smoothing improves robustness by averaging predictions over noisy inputs, but isotropic noise often fails to preserve the semantic structure of SAR imagery. We propose semantic smoothing, a defense that replaces noised-based perturbations with structured randomized transformations generated by a novel view synthesis model. For SAR, we condition on acquisition geometry to synthesize multiple plausible radar views. Predictions across generated randomized views are aggregated to form a robust classifier. Experiments show that semantic smoothing improves robustness against standard attacks, such as FGSM and PGD, and SAR-specific attacks, such as OTSA and SMGAA, while also increasing clean classification accuracy. These results demonstrate that randomized smoothing via semantically preserving geometric transformations is a promising alternative to isotropic noise for adversarial defense in structured sensing domains.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The manuscript proposes semantic smoothing as an adversarial defense for deep neural networks in SAR automatic target recognition. It replaces isotropic noise from randomized smoothing with structured randomized transformations produced by a novel view synthesis model conditioned on acquisition geometry. Multiple plausible radar views are synthesized and predictions are aggregated (e.g., via majority vote or averaging) to obtain a robust classifier. The central claim is that this yields improved robustness to both standard attacks (FGSM, PGD) and SAR-specific attacks (OTSA, SMGAA) while simultaneously increasing clean accuracy.

Significance. If the empirical claims are substantiated with quantitative results and verification of semantic preservation, the work could offer a domain-appropriate alternative to isotropic-noise smoothing for structured sensing modalities such as SAR. The idea of leveraging geometry-conditioned view synthesis to maintain semantic content while randomizing inputs is conceptually appealing for radar imagery dominated by specular returns and speckle.

major comments (2)
  1. [Abstract] Abstract: The abstract asserts that 'Experiments show that semantic smoothing improves robustness against standard attacks, such as FGSM and PGD, and SAR-specific attacks, such as OTSA and SMGAA, while also increasing clean classification accuracy' yet supplies no numerical results, datasets, model architectures, training details, or evaluation protocols. This omission is load-bearing for the central claim because the reported gains cannot be verified or reproduced from the given text.
  2. [Abstract] Abstract / Method: The key assumption that geometry-conditioned novel view synthesis produces randomized views whose semantic content (target identity and scattering properties) remains sufficiently preserved for aggregation to improve both clean accuracy and robustness is stated but not supported by any verification, semantic-equivalence metrics, or ablation studies. SAR imagery is dominated by geometry-dependent specular returns and multiplicative speckle; without evidence that the synthesized views are semantically equivalent to real acquisitions, the observed robustness could be an artifact of attack implementations or implicit regularization rather than true semantic smoothing.
minor comments (2)
  1. [Abstract] Abstract: The acronym ATR is introduced without expansion on first use.
  2. [Abstract] Abstract: Consider briefly indicating the specific novel-view-synthesis architecture or training objective to allow readers to assess feasibility for SAR data.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive and detailed report. The comments highlight important aspects of presentation and evidence that we will address through targeted revisions. Below we respond point by point to the major comments.

read point-by-point responses

  1. Referee: [Abstract] Abstract: The abstract asserts that 'Experiments show that semantic smoothing improves robustness against standard attacks, such as FGSM and PGD, and SAR-specific attacks, such as OTSA and SMGAA, while also increasing clean classification accuracy' yet supplies no numerical results, datasets, model architectures, training details, or evaluation protocols. This omission is load-bearing for the central claim because the reported gains cannot be verified or reproduced from the given text.

    Authors: We agree that the abstract would benefit from concise quantitative anchors. In the revised version we will incorporate key numerical highlights (e.g., clean-accuracy gains and robustness improvements under FGSM, PGD, OTSA, and SMGAA on the MSTAR dataset) while respecting length limits. Full experimental protocols, architectures, and training details already appear in Sections 4 and 5; the abstract update will simply surface the most salient results for immediate assessment. revision: yes

  2. Referee: [Abstract] Abstract / Method: The key assumption that geometry-conditioned novel view synthesis produces randomized views whose semantic content (target identity and scattering properties) remains sufficiently preserved for aggregation to improve both clean accuracy and robustness is stated but not supported by any verification, semantic-equivalence metrics, or ablation studies. SAR imagery is dominated by geometry-dependent specular returns and multiplicative speckle; without evidence that the synthesized views are semantically equivalent to real acquisitions, the observed robustness could be an artifact of attack implementations or implicit regularization rather than true semantic smoothing.

    Authors: We accept that explicit verification strengthens the central claim. The current manuscript shows that semantic smoothing simultaneously raises clean accuracy and robustness, an outcome that would be improbable if semantic content were not largely preserved. Nevertheless, we did not report dedicated semantic-equivalence metrics or ablations. In revision we will add (i) quantitative comparisons (SSIM, feature cosine similarity) between synthesized and real views, (ii) an ablation removing the geometry-conditioning to isolate its contribution, and (iii) qualitative radar-image examples illustrating preservation of target scattering centers. These additions will directly address the concern that robustness gains might stem from other factors. revision: yes

Circularity Check

0 steps flagged

No circularity; method depends on external novel view synthesis without internal derivations or self-referential fits

full rationale

The provided abstract and description contain no equations, parameter fits, or derivation steps that could reduce to self-definition, fitted inputs renamed as predictions, or load-bearing self-citations. The proposal introduces semantic smoothing by conditioning a novel view synthesis model on acquisition geometry to generate randomized SAR views, then aggregates predictions; this relies on an assumed external model whose semantic preservation properties are not internally derived or verified within the text. No uniqueness theorems, ansatzes smuggled via citation, or renaming of known results appear. The central claim rests on experimental outcomes rather than a closed mathematical chain, rendering the approach self-contained against external benchmarks with no detectable circular reductions.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 1 invented entities

The central claim depends on the effectiveness of the view synthesis model and the premise that geometric transformations preserve semantics better than noise; no free parameters or invented entities beyond the proposed method are described.

axioms (1)
  • domain assumption Conditioning a novel view synthesis model on SAR acquisition geometry produces plausible views that preserve semantic content for robust prediction aggregation.
    This premise is required to replace isotropic noise with structured perturbations while maintaining classification utility.
invented entities (1)
  • Semantic smoothing no independent evidence
    purpose: Robust classification by aggregating predictions over synthesized geometric views rather than noisy inputs.
    Introduced as the core defense mechanism in the abstract.

pith-pipeline@v0.9.0 · 5691 in / 1277 out tokens · 64467 ms · 2026-05-20T20:10:07.788609+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

What do these tags mean?
matches
The paper's claim is directly supported by a theorem in the formal canon.
supports
The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends
The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses
The paper appears to rely on the theorem as machinery.
contradicts
The paper's claim conflicts with a theorem or certificate in the canon.
unclear
Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Reference graph

Works this paper leans on

23 extracted references · 23 canonical work pages

  1. [1]

    Ian J Goodfellow et al. 2015. Explaining and harnessing adversarial examples. International Conference on Learning Representations(2015)

    work page 2015

  2. [2]

    Aleksander Madry et al. 2018. Towards deep learning models resistant to adver- sarial attacks.International Conference on Learning Representations(2018)

    work page 2018

  3. [3]

    Tian Ye et al. 2023. Realistic scatterer based adversarial attacks on SAR image classifiers. In2023 IEEE International Radar Conference (RADAR). IEEE, 1–6

    work page 2023

  4. [4]

    Bowen Peng et al. 2022. Scattering model guided adversarial examples for SAR target recognition: Attack and defense.IEEE Transactions on Geoscience and Remote Sensing60 (2022), 1–17

    work page 2022

  5. [5]

    Jeremy Cohen et al. 2019. Certified adversarial robustness via randomized smooth- ing. InInternational Conference on Machine Learning. PMLR, 1310–1320

    work page 2019

  6. [6]

    Eric R Chan et al . 2022. Efficient geometry-aware 3d generative adversarial networks. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 16123–16133

    work page 2022

  7. [7]

    Ben Mildenhall et al. 2021. Nerf: Representing scenes as neural radiance fields for view synthesis.Commun. ACM65, 1 (2021), 99–106

    work page 2021

  8. [8]

    Eric R Chan et al. 2023. Generative novel view synthesis with 3d-aware diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision. 4217–4229

    work page 2023

  9. [9]

    Pouya Samangouei et al. 2018. Defense-gan: Protecting classifiers against ad- versarial attacks using generative models.International Conference on Learning Representations(2018)

    work page 2018

  10. [10]

    Weili Nie et al. 2022. Diffusion models for adversarial purification.International Conference on Machine Learning(2022)

    work page 2022

  11. [11]

    Aditi Raghunathan et al. 2018. Certified defenses against adversarial examples. International Conference on Learning Representations(2018)

    work page 2018

  12. [12]

    Matthias Hein et al. 2017. Formal guarantees on the robustness of a classifier against adversarial manipulation.Advances in neural information processing systems30 (2017)

    work page 2017

  13. [13]

    Mathias Lecuyer et al. 2019. Certified Robustness to Adversarial Examples with Differential Privacy. In2019 IEEE Symposium on Security and Privacy (SP). Semantic Smoothing via Novel View Synthesis for Robust SAR Image Classification GLSVLSI ’26, June 22–24, 2026, Canandaigua, NY, USA

    work page 2019

  14. [14]

    Elan Rosenfeld et al . 2020. Certified robustness to label-flipping attacks via randomized smoothing. InInternational Conference on Machine Learning. PMLR

    work page 2020

  15. [15]

    Steven M Seitz et al . 1996. View morphing. InProceedings of the 23rd annual conference on Computer graphics and interactive techniques. 21–30

    work page 1996

  16. [16]

    Paul E Debevec et al . 2023. Modeling and rendering architecture from pho- tographs: A hybrid geometry-and image-based approach. InSeminal Graphics Papers: Pushing the Boundaries, Volume 2. 465–474

    work page 2023

  17. [17]

    Alex Yu et al. 2021. pixelnerf: Neural radiance fields from one or few images. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 4578–4587

    work page 2021

  18. [18]

    Katja Schwarz et al. 2020. Graf: Generative radiance fields for 3d-aware image synthesis.Advances in neural information processing systems33 (2020), 20154– 20166

    work page 2020

  19. [19]

    Junjie Hou et al. 2026. Adversarial Attack Method Against SAR ATR Based on Superimposed Phase Modulation.IEEE Transactions on Antennas and Propagation 74, 1 (2026), 995–1006

    work page 2026

  20. [20]

    Amir Hosein Oveis et al. 2025. Efficient Ensemble Pruning for Robust Adversarial Defense in SAR-ATR. In2025 22nd European Radar Conference (EuRAD). 149–152

    work page 2025

  21. [21]

    2009.Remote sensing with imaging radar

    John A Richards et al. 2009.Remote sensing with imaging radar. Vol. 1. Springer

    work page 2009

  22. [22]

    Jonathan Ho et al. 2020. Denoising diffusion probabilistic models.Advances in neural information processing systems33 (2020), 6840–6851

    work page 2020

  23. [23]

    Timothy D Ross et al. 1998. Standard SAR ATR evaluation experiments using the MSTAR public release data set. InAlgorithms for synthetic aperture radar imagery V, Vol. 3370. SPIE, 566–573

    work page 1998