Source-linked AI summary
Adversarial Attacks on Deep-Learning Based Radio Signal Classification
Meysam Sadeghi, Erik G. Larsson
TL;DR
Deep-learning modulation classifiers are vulnerable to carefully crafted adversarial perturbations, raising security and robustness concerns for wireless systems. The paper develops white-box, universal, and black-box attack methods and shows that very small perturbations can sharply reduce classification accuracy and outperform classical jamming.
Problem
Deep-learning algorithms used for radio signal modulation classification may be highly vulnerable to adversarial attacks, creating security and robustness concerns.
Method
The paper develops fine-grained input-specific white-box attacks, universal perturbations, and black-box attacks, including attacks using random shifts.
Results
At perturbations comparable to noise, the attack causes 100% misclassification, while even much smaller perturbations significantly reduce model accuracy.
Takeaways & Limitations
The attacks require significantly less transmit power than conventional random-noise jamming, exposing a fundamental vulnerability of deep-learning wireless solutions.
Abstract
from arXiv · showhide
Deep learning (DL), despite its enormous success in many computer vision and language processing applications, is exceedingly vulnerable to adversarial attacks. We consider the use of DL for radio signal (modulation) classification tasks, and present practical methods for the crafting of white-box and universal black-box adversarial attacks in that application. We show that these attacks can considerably reduce the classification performance, with extremely small perturbations of the input. In particular, these attacks are significantly more powerful than classical jamming attacks, which raises significant security and robustness concerns in the use of DL-based algorithms for the wireless physical layer.
I. INTRODUCTION
Deep learning has succeeded across several domains but is vulnerable to adversarial inputs that induce misclassification through carefully chosen small perturbations. This paper studies that vulnerability in radio modulation classification and proposes white-box and black-box attack methods.
- Motivation: Adversarial examples slightly perturb inputs in feature-space directions that cause erroneous deep-learning outputs.These perturbations are distinct from random white noise.
- Problem: The paper examines deep-learning algorithms for radio signal modulation classification and shows that they are extremely vulnerable to adversarial attacks.
- Contributions: The authors present a fine-grained white-box algorithm for generating input-specific adversarial attacks.
- Contributions: They propose a computationally efficient method for crafting white-box universal adversarial perturbations.
- Contributions: They also propose black-box universal attacks and report a shift-invariant property of universal perturbations.
II. BRIEF REVIEW OF ADVERSARIAL ATTACKS
Adversarial attacks seek perturbations that change a classifier’s output while remaining within the input domain. The review distinguishes attack knowledge and scope, then explains how fast gradient methods approximate these perturbations.
- Classifier and attack formulation: A DNN classifier maps inputs to class outputs and assigns each input the class with the largest corresponding output.
- Classifier and attack formulation: An adversarial perturbation changes the classifier’s label while requiring the perturbed input to remain in the input domain.
- Classifier and attack formulation: The l2-norm is natural for wireless attacks because it measures perturbation power.
- Fast gradient methods: Fast gradient methods linearize the loss near the input to craft perturbations efficiently, but produce coarse-grained perturbations.
- Fast gradient methods: Targeted FGM minimizes loss toward a specified target class by using a negative input-loss gradient scaled by α.
- Fast gradient methods: Non-targeted FGM seeks any misclassification rather than a specific target class.
- Attack categories: Attacks are categorized as white-box or black-box according to whether the adversary has full, limited, or no model knowledge, and as individual or universal by scope.
III. THE GNU RADIO ML DATASET AND ITS DNN
The study uses the publicly available RML2016.10a GNU radio machine-learning dataset and its associated VT-CNN2 deep convolutional classifier. This setup supports reproducible analysis of adversarial attacks on modulation classification.
- Dataset and classifier: The dataset and associated DNN source code are publicly available, enabling reproducibility and future research.
- Dataset and classifier: RML2016.10a contains 220000 samples spanning 11 modulations and 20 SNR levels from −20 dB to 18 dB.
- Dataset and classifier: Each input is a 256-element vector containing 128 in-phase and 128 quadrature components, split evenly into training and test sets.
- Dataset and classifier: The analysis uses VT-CNN2, a deep CNN classifier associated with the dataset.
IV. ADVERSARIAL ATTACKS FOR DL-BASED MODULATION CLASSIFICATION
The paper develops a white-box attack that crafts fine-grained, input-specific perturbations for VT-CNN2 modulation classification and evaluates their impact at low perturbation power. The attack can cause complete misclassification when perturbations are comparable to noise and substantially reduce accuracy even below the noise level.
- White-box attack: The attacker adds a low-power perturbation r_x to the received signal, producing x_adv = x + r_x, to induce misclassification.The white-box setting assumes knowledge of the classifier and uses the input-specific attack framework.
- White-box attack: Algorithm 1 searches each target class and uses bisection to find the smallest scaling factor that enforces misclassification within the allowed perturbation norm.It retains FGM’s computationally efficient gradient direction while producing fine-grained perturbations.
- Perturbation metrics: PNR measures perturbation power relative to noise power, and PNR ≤ 1 denotes a quasi-imperceptible perturbation at or below the noise level.The paper uses PNR to characterize perturbation visibility in wireless settings.
- Results: 100% misclassification occurs when perturbation power is comparable to noise across all three tested SNR levels.The result is reported for the accuracy-versus-PNR evaluation in Fig. 2.
- Results: Accuracy decreases significantly even when perturbation power is one or several orders of magnitude below the noise level.This demonstrates substantial vulnerability under very small white-box perturbations.
V. UNIVERSAL BLACK-BOX ATTACKS FOR WIRELESS COMMUNICATION SYSTEMS
The paper frames universal black-box attacks as a response to three limiting assumptions of the white-box setting: exact input knowledge, transmitter synchronization, and perfect model knowledge.
- Assumptions: The white-box attack assumes the attacker knows the exact input, perturbs synchronously with the transmitter, and has perfect knowledge of the classifier.The next section addresses these three assumptions to move toward more general attack settings.
A. Universal Adversarial Perturbations
The paper proposes a PCA-based universal adversarial perturbation that is input-agnostic and computationally efficient, then compares it with an existing UAP and Gaussian-noise jamming. The proposed attack achieves stronger fooling behavior while requiring steadier computational performance.
- Universal Adversarial Perturbations: A universal adversarial perturbation fools the classifier with high probability independently of the particular input.This removes the input-dependent requirement of Algorithm 1.
- Universal Adversarial Perturbations: The existing UAP method iteratively crafts perturbations for N data points, making it computationally expensive.Its runtime increases substantially as PSR decreases, according to the comparison described for Table I.
- PCA-based method: The proposed method stacks normalized input-gradient directions and uses the first principal component as the UAP direction.Algorithm 2 then scales that direction by the maximum allowed perturbation norm.
- Results: The proposed UAP has lower computational complexity and a better fooling rate on the dataset than the method in.The paper presents these as the principal claimed advantages of Algorithm 2.
- Results: At PSR = −10 dB, VT-CNN2 accuracy drops by half under the proposed UAP.Fig. 3 compares the proposed UAP with the prior UAP and a Gaussian-noise jamming attack matched in mean and power.
- Results: Algorithm 2 maintains steady and efficient runtime as PSR decreases, unlike the method in.The runtime comparison uses SNR = 10 dB and N = 50 on an NVIDIA GeForce GTX 1080 Ti GPU.
B. Black-Box Attacks and Shift Invariant Property of UAPs
The paper removes two practical assumptions behind white-box UAP attacks: exact model knowledge and transmitter synchronization. Transferability enables black-box attacks through a substitute model, while shift invariance makes random shifts effective.
- Black-Box Attacks: The approach addresses the white-box attack assumptions of perfect model knowledge and transmitter synchronization.These assumptions are explicitly identified as limitations of the preceding white-box setting.
- Black-Box Attacks: The proposed black-box UAP uses transferability by crafting the perturbation on a substitute fully connected MLP before applying it to VT-CNN2.The substitute MLP has architecture 256−1024−1024−1024−512−128−11.
- Shift Invariant Property: The crafted UAPs are shift invariant: any circularly shifted version can fool the DNN and cause misclassification.This removes the need for element-wise synchronization between attacker and transmitter.
- Black-Box Attacks: The black-box attack with random shifts is approximately as effective as the white-box attack with perfect model knowledge.The comparison is reported for two UAP attacks designed using Alg. 2.
- Shift Invariant Property: Randomly shifted UAPs are nearly as destructive as the original synchronous UAP, so a synchronous attack is unnecessary.The attacks use extremely low power yet cause severe misclassification.
VI. CONCLUSION
The paper demonstrates that deep-learning radio-signal classifiers are highly susceptible to adversarial attacks. White-box and black-box attacks require significantly less transmit power than conventional random-noise jamming, and the authors conjecture that related wireless physical-layer algorithms may share this security problem.
- Deep-learning radio-signal classification algorithms are extremely susceptible to adversarial attacks.
- The paper designs white-box and black-box attacks on a deep-learning classifier and demonstrates their effectiveness.
- Significantly less transmit power is required to cause misclassification than with conventional jamming, which transmits only random noise.
- The authors conjecture that other deep-learning signal-processing algorithms for the wireless physical layer may suffer the same security problem.The conjecture is motivated by the openness, or broadcast nature, of wireless transmission.