Channel-Aware Adversarial Attacks Against Deep Learning-Based Wireless Signal Classifiers

Brian Kim; Yalin E. Sagduyu; Kemal Davaslioglu; Tugba Erpek; Sennur Ulukus

Source-linked AI summary

Channel-Aware Adversarial Attacks Against Deep Learning-Based Wireless Signal Classifiers

Brian Kim, Yalin E. Sagduyu, Kemal Davaslioglu, Tugba Erpek, Sennur Ulukus

arXiv:2005.05321v3May 11, 2020eess.SPcs.LGcs.NIstat.ML

TL;DR

Wireless modulation classifiers face over-the-air adversarial attacks whose effectiveness depends on channel and broadcast effects. The paper designs channel-aware attacks under varying information assumptions, develops a common perturbation for multiple receivers, and introduces randomized smoothing as a defense. It reports that channel-aware attacks can fool classifiers while randomized smoothing reduces their impact.

Problem
Wireless adversaries must transmit perturbations through receiver-specific channels, so attack and defense mechanisms cannot simply ignore wireless channel and broadcast effects.
Method
The paper designs targeted, non-targeted, UAP, and broadcast perturbations using channel information under varying knowledge of channels, inputs, and classifier models, then applies randomized smoothing for defense.
Results
Channel-aware attacks successfully fool modulation classifiers, while a common perturbation designed jointly across channels can fool multiple receivers and randomized smoothing reduces attack impact.
Takeaways & Limitations
Over-the-air attacks must account for channel effects, and randomized smoothing provides a defense that reduces their impact on modulation-classifier performance.

Abstract

from arXiv · show

This paper presents channel-aware adversarial attacks against deep learning-based wireless signal classifiers. There is a transmitter that transmits signals with different modulation types. A deep neural network is used at each receiver to classify its over-the-air received signals to modulation types. In the meantime, an adversary transmits an adversarial perturbation (subject to a power budget) to fool receivers into making errors in classifying signals that are received as superpositions of transmitted signals and adversarial perturbations. First, these evasion attacks are shown to fail when channels are not considered in designing adversarial perturbations. Then, realistic attacks are presented by considering channel effects from the adversary to each receiver. After showing that a channel-aware attack is selective (i.e., it affects only the receiver whose channel is considered in the perturbation design), a broadcast adversarial attack is presented by crafting a common adversarial perturbation to simultaneously fool classifiers at different receivers. The major vulnerability of modulation classifiers to over-the-air adversarial attacks is shown by accounting for different levels of information available about the channel, the transmitter input, and the classifier model. Finally, a certified defense based on randomized smoothing that augments training data with noise is introduced to make the modulation classifier robust to adversarial perturbations.

I. INTRODUCTION

Wireless modulation classifiers are vulnerable to over-the-air adversarial perturbations because channel effects and broadcast transmission constrain how attacks reach receivers. This paper develops channel-aware, selective, and broadcast attacks, considers limited adversary information, and introduces randomized-smoothing defense.

Wireless adversaries cannot directly modify a remote classifier's input; perturbations must reach it over the air through channel effects.
Channel-unaware perturbations fail under limited power, whereas channel-aware designs can significantly reduce modulation-classifier accuracy.
The paper studies attacks with limited channel, transmitter-input, and classifier information, including PCA-, VAE-, and black-box UAP-based approaches.
A perturbation designed for one receiver is selective, while jointly designing for all channels enables a single broadcast perturbation to fool multiple receivers.
Randomized smoothing augments modulation-classifier training data with isotropic Gaussian noise to reduce adversarial impact and support certified robustness.
Small channel effects such as pathloss or fading can reduce received perturbation power or change its direction enough to prevent misclassification.

III. SYSTEM MODEL

The system contains a transmitter, multiple single-antenna receivers, and an adversary whose synchronized perturbation is superimposed over the air with transmitted signals. Attacks optimize perturbations under a power budget to induce targeted or arbitrary modulation misclassification.

The system comprises a transmitter, m receivers, and an adversary, with all nodes equipped with a single antenna.
Each receiver uses a DNN to classify its received signal according to the transmitter's modulation type while the adversary transmits perturbations to induce errors.
The received signal combines the transmitter contribution, the adversary's channel-transformed perturbation, and complex Gaussian noise.
The adversarial perturbation is synchronized with the transmitter signal and constrained by an energy budget ∥δ∥2^2 ≤ Pmax.
The optimization seeks misclassification at each receiver while minimizing perturbation power subject to the total power budget.
Targeted attacks force a specified incorrect label, whereas non-targeted attacks seek any misclassification.
White-box attacks assume knowledge of each classifier, receiver input, and adversary-to-receiver channel, with later sections relaxing these assumptions.

IV. TARGETED WHITE-BOX ADVERSARIAL ATTACKS USING CHANNEL INFORMATION

The paper formulates targeted white-box attacks by incorporating the adversary-to-receiver channel into perturbation design under a power constraint. It contrasts channel-aware designs with the channel-agnostic baseline and develops inversion- and optimization-based perturbations.

Channel-aware formulation: FGM linearizes the targeted loss, and the perturbation is chosen so the channel-distorted signal follows the negative input-loss gradient under power limit Pmax.The scaling factor α enforces the adversary’s perturbation-power constraint.
Baseline and channel effects: The channel-agnostic targeted attack δNoCh assumes Har = I, whereas the proposed attacks account for channel effects between adversary and receiver.The channel-agnostic formulation serves as the baseline for the channel-aware designs.
Target selection: The targeted procedure evaluates possible target classes and selects an adversarial perturbation that causes misclassification toward a desired modulation type.The algorithm inputs include the received signal, desired accuracy, power constraint, and classifier model.
Naive channel inversion: The naive attack inverts the channel so the received perturbation matches the direction of δNoCh while satisfying the adversary power constraint.Its received perturbation is scaled to −αδNoCh after propagation through the channel.
MMSE attack: The MMSE attack minimizes the distance between the channel-transformed perturbation and the optimal channel-agnostic targeted perturbation while respecting the power constraint.The resulting received perturbation is expressed as HarδMMSE = −αTδNoCh, with α determined by the optimization.

C. Maximum Received Perturbation Power (MRPP) Attack

The MRPP attack uses the adversary-to-receiver channel to maximize received perturbation power while targeting a specific classification error. Channel conjugation preserves the target direction and amplifies the received perturbation according to channel magnitude.

MRPP objective: MRPP selects a perturbation that maximizes received perturbation power to influence the receiver’s classifier toward a specific classification error.The design explicitly exploits the channel between adversary and receiver.
Channel utilization: Multiplying each targeted perturbation component by the conjugate channel aligns the transmission with the channel and maximizes received power.This construction uses h*ar,j for each perturbation component.
Received perturbation: After propagation, the received perturbation power is scaled by the squared channel magnitude while retaining the targeted perturbation direction.The received component is proportional to ∥har,j∥2 δtarget j.
Target selection: The adversary generates targeted attacks for every possible modulation type, chooses the target class, and scales the result to satisfy its power constraint.This combines target selection with channel-aware power allocation.

D. Attack Performance

The evaluation measures classifier accuracy against channel-aware and baseline attacks using PNR under a fixed channel model. It reports that ignoring channel effects performs poorly in the low-PNR region because propagation changes perturbation phase and magnitude.

Evaluation setup: The evaluation uses PNR to measure perturbation strength relative to noise and examines how increasing PNR affects classifier accuracy.Higher PNR also makes the attack more detectable by the receiver.
Evaluation setup: The channel model uses K = 1, d0 = 1, d = 10, γ = 2.7, lognormal shadowing, and Rayleigh fading parameters.The value γ = 2.7 represents an urban cellular-radio setting.
Notation: The performance figures label targeted, non-targeted, and broadcast attacks as TA, NTA, and BC, respectively.The algorithms use power constraint Pmax and, for the naive non-targeted attack, iterate E times.
Attack comparison: Fig. 2 compares classifier accuracy versus PNR for targeted white-box attacks with exact channel information against the channel-agnostic attack from.The comparison is conducted at SNR = 10 dB.
Attack comparison: In the low-PNR region, the channel-agnostic attack performs close to the no-attack case because the channel changes the perturbation’s phase and magnitude.This explains why omitting channel effects undermines the attack under realistic wireless propagation.

V. NON-TARGETED WHITE-BOX ADVERSARIAL ATTACKS USING CHANNEL INFORMATION

The non-targeted white-box attacks maximize the true-class loss through a channel-aware gradient formulation under a perturbation-power budget. The iterative naive procedure accumulates gradient-based perturbations, while the MMSE variant reverses the targeted direction.

Non-targeted formulation: The non-targeted objective maximizes the loss for the true class, with FGM setting Harδ = α∇xL under power constraint Pmax.Three channel-aware non-targeted attacks are introduced from this formulation.
Iterative attack: The naive non-targeted attack divides Pmax across E iterations and allocates each share to the loss gradient.The procedure repeatedly updates the perturbation using gradients computed with respect to the transmitted signal and accumulated perturbation.
MMSE attack: The non-targeted MMSE attack solves the channel-aware problem using the naive non-targeted perturbation with Har = I as its starting point.Its solution has the opposite direction because it maximizes rather than minimizes the loss.
Performance comparison: Fig. 3 compares classifier accuracy under different white-box attacks and SNR levels.The figure evaluates how attack performance varies across the listed attack types and signal-to-noise conditions.

C. Maximum Received Perturbation Power (MRPP) Attack

The MRPP attack reshapes adversarial perturbations to maximize received perturbation power under channel effects, while limited-channel attacks estimate a useful direction from channel realizations.

Maximum Received Perturbation Power (MRPP) Attack: MRPP replaces the naive perturbation direction with a channel-matched direction that maximizes received perturbation power.The attack modifies the non-targeted procedure by replacing the normalized perturbation with a channel-aware construction.
Attack performance: The non-targeted MRPP attack outperforms other attacks for most PNR values in the reported SNR = 10 dB comparison.The paper attributes this to the non-targeted attack’s freedom to choose among more directions than targeted attacks.
Limited channel information: With limited channel information, the adversary generates attacks for multiple observed channel realizations and uses PCA to extract their principal direction.The adversary knows the channel distribution rather than the exact channel and applies dimensionality reduction to the generated attack matrix.
Limited channel information: The PCA-based limited-information procedure uses the classifier input and model together with N channel realizations to generate and stack white-box perturbations.Each realization produces one perturbation before the principal component is selected as the final attack direction.

VII. UNIVERSAL ADVERSARIAL PERTURBATION (UAP) ATTACK

UAP attacks relax the requirement that the adversary know the receiver’s exact input by constructing one input-independent perturbation from pre-collected examples.

Universal adversarial perturbation: UAP attacks address the impracticality of designing a new perturbation from the exact receiver input for every transmission.The paper identifies synchronization and input-knowledge requirements as obstacles to input-dependent attacks.
Universal adversarial perturbation: The adversary collects arbitrary inputs and associated classes to construct a perturbation that is shared across those examples.These pre-collected samples provide the basis for generating input-specific perturbations before aggregation.
PCA-based construction: PCA-based UAP construction stacks perturbations from pre-collected inputs and uses the first principal component as the attack direction for the channel.The first component is selected because it captures the common characteristics of the perturbation set through the largest eigenvalue.
VAE-based construction: VAE-based UAP construction learns perturbation characteristics through an encoder-decoder model with probabilistic latent attributes.The encoder maps inputs to latent representations, while the decoder reconstructs perturbations from those representations.

1) PCA-based input-independent UAP attack:

The PCA-based input-independent UAP method extracts a common perturbation direction from attacks generated over pre-collected inputs and channel realizations.

PCA-based input-independent UAP attack: The method generates perturbations for pre-collected inputs and stacks them into a matrix for PCA.The first principal component, corresponding to the largest eigenvalue, represents the shared perturbation direction.
PCA-based input-independent UAP attack: The resulting UAP uses the first principal component as its direction for the considered channel.This construction captures common characteristics across perturbations rather than tailoring the attack to one input.
PCA-based channel-independent UAP attack: For channel-independent UAP design, the adversary samples random channel realizations from the channel distribution before generating perturbations.The sampled channels replace the actual channel in the perturbation-generation process.
PCA-based channel-independent UAP attack: PCA then extracts a common direction from perturbations generated across the sampled channels.The procedure is analogous to the limited-channel-information algorithm but uses random channel realizations instead of the exact channel.

2) VAE-based channel-independent UAP attack:

The VAE-based channel-independent UAP learns shared channel characteristics from sampled channels, while experiments compare attack effectiveness across information levels and broadcast settings.

VAE-based channel-independent UAP attack: The VAE channel-independent attack trains on random channel realizations sampled from the channel distribution.The encoder captures common channel characteristics by averaging representations from multiple sampled channels before decoding the attack.
Unknown classifier model: Transferability allows a UAP crafted with a substitute DNN to target an actual receiver classifier with a different model.The substitute network is trained on an arbitrarily collected dataset.
Attack performance: The VAE UAP using 40 pre-collected inputs and exact channel information outperforms attacks with limited information and channel inversion in the reported comparison.The VAE is trained with 2000 samples, while 40 samples are used to create one UAP.
Broadcast adversarial attack: A channel-aware attack designed for one receiver is selective, whereas a jointly designed perturbation can fool multiple receivers through one broadcast transmission.The broadcast attack combines receiver-specific perturbations using weighted sums subject to a power constraint.
Broadcast adversarial attack: Numerical results suggest restricting broadcast-attack weight searches using weights inversely proportional to the corresponding receivers’ channel gains.The weights determine the priority assigned to each receiver-specific perturbation.

B. Joint Design of Broadcast Adversarial Attack (JDBA)

The joint design of broadcast adversarial attacks combines receiver-specific channel effects into one perturbation for simultaneously fooling multiple classifiers. Experiments show that joint design outperforms independent design and that channel-dependent weighting affects attack performance.

Joint attack design: JDBA modifies the perturbation-norm computation to search for a common adversarial direction across receivers.IDBA instead searches separately for receiver-specific directions and combines them afterward.
Experimental setting: The evaluation uses two receivers with different classifiers and Rayleigh-fading channels from the adversary to each receiver.The broadcast perturbation is evaluated under a two-receiver setting with channel realizations modeled separately.
Attack performance: JDBA outperforms IDBA for all PNRs when evaluating broadcast adversarial attacks.The two classifiers have the same accuracy because success requires fooling both receivers simultaneously.
Attack performance: The weight selection w1 = 1/2 outperforms other selections, suggesting that effective weighting depends on the channel distribution.When IDBA uses w1 = 1 and w2 = 0, the attack fools receiver 1 but has no effect on receiver 2.
Different channel distributions: With different receiver channel variances, the selection w1 = 2/3 outperforms other weight selections.The weights are selected inversely proportional to the channel variance.

IX. DEFENSE AGAINST ADVERSARIAL ATTACKS

The defense uses randomized smoothing to improve modulation-classifier robustness without requiring knowledge of the adversary’s attack. Training augmentation and test-time certification reduce attack impact, while noise parameters trade accuracy and robustness against training cost.

Defense approach: Randomized smoothing augments modulation-classifier training data with isotropic Gaussian noise to improve robustness against adversarial perturbations.It is used because the receiver is assumed to have no information about the attack generated by the adversary.
Training parameters: The noise standard deviation σ and augmentation count k control the trade-off between classification accuracy and perturbation robustness.Each training sample is augmented with k noisy versions using Gaussian noise with variance σ^2.
Training-time smoothing: Small σ values such as σ = 0.001 and σ = 0.005 produce higher accuracy than the original classifier across all PNR values.Large noise variance degrades performance.
Training-time smoothing: Small σ improves robustness to small perturbations but increases susceptibility to large perturbations, whereas large σ shows the opposite pattern.Accuracy curves intersect as the perturbation scale changes.
Training-time smoothing: Adding more augmentation samples increases robustness compared with the undefended classifier but increases training time.The result is evaluated by varying k while holding σ constant.
Certified defense: At test time, randomized smoothing certifies predictions by testing noisy-sample votes and abstains when the confidence condition is not satisfied.For the QAM64-to-QAM16 example, BinomPValue(·) = 0.115 and the classifier abstains; for the QAM64-to-8PSK example, all samples are correctly inferred as QAM64 with 95% confidence.