PaperlayerView exact revision on arXiv

Source-linked AI summary

Where to Defend? Layer-Wise Adversarial Training for Robust Transformer-Based Semantic Communications

Maria Slim, Razane Tajeddine, Mariette Awad, Hadi Sarieddeen

arXiv:2609.13128v1eess.SP

TL;DR

DeepSC remains vulnerable to adversarial perturbations injected at multiple stages, raising the question of where defenses should be placed. The paper compares layer-wise training strategies and finds that defense transfer is asymmetric, with outcomes varying across reconstruction and classification.

  • Problem

    DeepSC achieves semantic fidelity over noisy channels but remains vulnerable to structured adversarial perturbations applied at different pipeline stages.

    Source: §I · p. 1

  • Method

    The study compares FGSM, PGD, and FGM embedding defenses, then uses PGD to evaluate attacks and defenses at embedding, encoder, and channel-encoder points.

    Source: §I · p. 1, §VI · p. 6

  • Results

    Embedding defense transfers strongly to encoder attacks, while encoder training has the largest matched gain but incurs −0.444 BLEU on Europarl under an embedding attack; three classification defenses collapse.

    Source: C. Asymmetric Defense Transfer and… · p. 4, B. Layer-Wise Vulnerability and… · p. 4, D. Stress-Test: Generalization to… · p. 5

  • Takeaways & Limitations

    A clean-input first-order damage budget predicts attack-severity ordering before attacks are constructed, while joint embedding-plus-encoder training mitigates encoder-defense mismatch failure.

    Source: §I · p. 2

    Results use one DeepSC backbone and continuous-space white-box ℓ∞ attacks; discrete token-level, ℓ2, ℓ0, and black-box transfer attacks are outside scope.

    Source: §V · pp. 5–6

Abstract

from arXiv · show

Deep learning-based semantic communication (DeepSC), a Transformer-based encoder-decoder, achieves semantic fidelity over noisy channels but remains vulnerable to adversarial perturbations injected at multiple stages of the pipeline. We present a layer-wise robustness framework that compares fast gradient sign method (FGSM), projected gradient descent (PGD), and l2-normalized fast gradient method (FGM) defenses at the embedding output, and then uses PGD to analyze three attack and defense points: the embedding output, encoder output, and channel-encoder bottleneck. We evaluate reconstruction on Europarl and UK Hansard and sentiment classification on SST2 and YELP under additive white Gaussian noise (AWGN) and Rayleigh fading. A first-order damage budget, {epsilon} times the l1 norm of the clean-input loss gradient at each injection point, predicts the attack-severity ordering, and the transfer matrix reveals asymmetric defense transfer: the embedding defense transfers strongly to encoder attacks, whereas encoder defenses degrade robustness against upstream attacks. For reconstruction, encoder-point training yields the largest matched gain but fails severely under embedding attacks; joint embedding-plus-encoder training retains comparable gains under encoder attacks while mitigating this mismatch failure, and Rayleigh fading attenuates robustness gains and degradation. For classification, three of four defenses collapse to constant predictors; only the channel-encoder defense remains non-degenerate, suggesting a protective role for the 128D-to-16D bottleneck. At a signal-to-noise ratio (SNR) of 9 dB and perturbation budget {epsilon} = 0.3, the matched encoder defense recovers bilingual evaluation understudy (BLEU) from ~ 0.10 to ~ 0.64 on Europarl/AWGN, whereas the mismatched encoder defense yields a -0.444 BLEU change relative to the undefended baseline under an embedding attack.

I. INTRODUCTION

DeepSC provides semantic fidelity over noisy channels but remains vulnerable to adversarial perturbations at different pipeline stages. This work compares defenses across those stages and examines their transfer and scope.

I. INTRODUCTION

  • The threat model is limited to white-box continuous-space attacks; discrete token-space attacks such as TextFooler and HotFlip are outside its scope.The paper distinguishes structured, worst-case adversarial perturbations from stochastic channel noise.Source: §I · p. 1
  • The study characterizes adversarial vulnerability at embedding, encoder, and channel-encoder points on Europarl and UK Hansard under AWGN and Rayleigh.It compares FGSM, PGD, and FGM training at the embedding output before using PGD for the layer-wise study.Source: §I · p. 1
  • Embedding defenses transfer strongly to encoder attacks, while defenses downstream of an embedding attack degrade robustness most of the time.The study also introduces a clean-input first-order damage budget that predicts attack-severity ordering before attacks are constructed.Source: §I · p. 2
  • Joint embedding-plus-encoder defense retains comparable gains under encoder attacks while substantially mitigating the encoder-defense mismatch failure.The contribution also includes a binary-classification stress test on SST2 and YELP.Source: §I · p. 2

II. PROBLEM FORMULATION AND SYSTEM MODEL

The system applies bounded white-box perturbations to intermediate DeepSC representations while modeling the communication channel as non-adversarial. Its layer-wise training and evaluation compare perturbations at embedding, encoder, and channel-encoder outputs.

II. PROBLEM FORMULATION AND SYSTEM MODEL

  • The white-box adversary can inject bounded ℓ∞ perturbations at the embedding, encoder, or channel-encoder representation; the channel itself is non-adversarial.Embedding and encoder representations are 128D, while the channel-encoder compresses them to 16D before transmission.Source: §II · p. 2
  • The channel maps transmitted symbols through AWGN or flat block Rayleigh fading, and the decoder reconstructs the encoder representation before producing token logits.For AWGN, h = 1; for Rayleigh, h is drawn independently per transmission block and held constant across its symbols.Source: §II · p. 2
  • The two-stage strategy first compares FGSM, PGD, and ℓ2-FGM at the embedding output, then uses PGD at embedding, encoder, and channel-encoder points.The downstream subnetwork maps the attacked representation to output logits.Source: §II · p. 2
  • PGD adds a perturbation generated from downstream loss gradients, projects updates into the ℓ∞ budget, and combines clean and adversarial losses during training.Joint Emb+Enc training generates independent perturbations at the embedding and encoder representations and combines both adversarial losses with the clean loss.Source: §II · pp. 2–3

A. Training and Evaluation Configuration

The experiments use a fixed DeepSC backbone and evaluate reconstruction across two parliamentary corpora, two channel conditions, and specified attack and SNR settings.

A. Training and Evaluation Configuration

  • The DeepSC backbone has three encoder/decoder layers, eight attention heads, dmodel = 128, dff = 512, and a 16D channel-encoder bottleneck.Models are trained independently on Europarl and UK Hansard under AWGN and Rayleigh; sentences are filtered to 4–30 tokens.Source: A. Training and Evaluation Configuration · p. 3
  • Training runs for 80 epochs with Adam at 5 × 10−4, while channel SNR is sampled from 5–10 dB.FGSM uses ε = 0.3; the layer-wise PGD configuration uses ε = 0.3, α = 1, and T = 5; FGM uses ε = 0.3.Source: A. Training and Evaluation Configuration · p. 3
  • BLEU-1 is the primary reconstruction metric, and layer-wise effectiveness is measured as defended minus undefended BLEU under the same attack and channel condition.Layer-wise tests use SNR 0–18 dB and ε = 0.3.Source: A. Training and Evaluation Configuration · p. 3

B. Mechanistic Diagnostics

The diagnostics trace attacks from gradients at each injection point to realized loss and channel distortion. The first-order budget is evaluated on clean inputs, while the protocol fixes test batches and attack settings across models.

B. Mechanistic Diagnostics

  • The first-order damage budget estimates the maximum linearized loss increase possible under an ℓ∞ perturbation of budget ε at each injection point.The ℓ1 gradient norm is used because ℓ1 and ℓ∞ are dual norms.Source: B. Mechanistic Diagnostics · p. 3
  • Evaluated on clean inputs, the budget predicts attack severity before an adversarial example is constructed.Gradients are taken with respect to the representation at each injection point.Source: B. Mechanistic Diagnostics · p. 3
  • Channel distortion energy characterizes the implemented channel rather than the model, combining fading and noise under Rayleigh fading.The received-versus-transmitted signal difference reflects noise and, under Rayleigh fading, the multiplicative fading term as well.Source: B. Mechanistic Diagnostics · p. 3
  • Diagnostics use final checkpoints and identical, unshuffled full-test-set batches at SNR = 9 dB, with PGD-ℓ∞ evaluation using T = 3.Layer-wise training uses T = 5; the lighter T = 3 attack is used for diagnostics.Source: B. Mechanistic Diagnostics · p. 3

A. Embedding-Level Robustness

At the embedding output, adversarial training restores robustness against the tested attacks, with PGD selected for subsequent layer-wise analysis because its robustness is strong and consistent.

A. Embedding-Level Robustness

  • The clean-trained model shows sharp BLEU degradation under FGSM and PGD, while adversarial training restores robustness across the three tested methods.The comparison includes FGSM-, PGD-, and FGM-trained models.Source: A. Embedding-Level Robustness · p. 3
  • FGM provides competitive robustness at moderate budgets but can degrade under stronger attacks, consistent with the mismatch between ℓ2 training and ℓ∞ evaluation.Source: A. Embedding-Level Robustness · p. 3
  • PGD is used for subsequent layer-wise analysis because it shows strong, consistent robustness and is widely adopted.Source: A. Embedding-Level Robustness · p. 3

B. Layer-Wise Vulnerability and Defense Transfer

Layer-wise evaluation compares PGD defenses and attacks across three injection points, datasets, and channel conditions. Matched defenses recover BLEU at different clean-accuracy costs, while a clean-input gradient budget predicts the ordering of attack severity.

B. Layer-Wise Vulnerability and Defense Transfer

  • The clean-input first-order damage budget ranks encoder attacks as most severe, embedding attacks as intermediate, and channel-encoder attacks as least severe on Europarl/AWGN.The encoder has the largest budget and greatest BLEU collapse; the channel encoder has the smallest budget and highest attacked BLEU.Source: B. Layer-Wise Vulnerability and… · p. 3
  • Encoder-point defense lifts Europarl/AWGN BLEU from ≈0.10 to ≈0.64 at clean cost −0.26; embedding defense lifts it from ≈0.71 to ≈0.85 at clean cost −0.086.Fig. 2 presents BLEU improvement versus the undefended baseline at SNR = 9 dB and ε = 0.3, with defenses as rows, attack conditions as columns, and dataset/channel combinations as panels.Source: Figure 2 · p. 4, B. Layer-Wise Vulnerability and… · p. 4
  • Channel-encoder defense yields negligible matched gain at near-zero clean cost, while the 16D bottleneck has the smallest attack budget among the three injection points.Source: B. Layer-Wise Vulnerability and… · pp. 3–4
  • Across SNR 0–18 dB, matched defense remains the most reliable choice for both datasets, although upstream transferred defenses occasionally overtake it on AWGN.The evaluation compares single-point and joint defenses against attacks at the embedding, encoder, and channel-encoder points on Europarl and UK Hansard under AWGN and Rayleigh fading.Source: B. Layer-Wise Vulnerability and… · pp. 3–4

C. Asymmetric Defense Transfer and Pronounced Mismatch

Defense transfer is asymmetric: embedding defense transfers to encoder attacks, while encoder defense can sharply worsen embedding-attack performance. In classification, three defenses collapse during training, and embedding attacks remain the dominant threat to the only non-degenerate defense.

C. Asymmetric Defense Transfer and Pronounced Mismatch

  • On Europarl/AWGN, embedding defense gains +0.615 BLEU under encoder attack, versus +0.537 for matched encoder defense; encoder defense loses −0.444 on Europarl and −0.587 on UK Hansard under embedding attack.The transfer matrix is directionally asymmetric, and no defense meaningfully improves over baseline under channel-encoder attacks, where undefended damage is already negligible.Source: C. Asymmetric Defense Transfer and… · p. 4

D. Stress-Test: Generalization to Classification

  • Under embedding attacks, ChEnc-Def performs worse than the undefended baseline in every configuration, losing 0.05 to 0.11 accuracy on SST2 and approximately 0.31 on YELP.Encoder- and channel-encoder-output attacks leave every model close to clean accuracy.Source: D. Stress-Test: Generalization to… · p. 5
  • YELP sentences average 21.4 tokens versus 15.0 for SST2, so fixed per-coordinate ε could impose a proportionally larger total perturbation on longer inputs.Source: D. Stress-Test: Generalization to… · p. 5
  • Three of four defenses collapse to near-constant predictors, with Fisher ratio F below 10−3 versus 1.6 to 3.4 for working models; only ChEnc-Def retains accuracy of 0.838 to 0.889 and separability.The table marks joint collapse when accuracy is within 0.01 of the minority-class fraction and F < 10−3.Source: Table II · p. 5, D. Stress-Test: Generalization to… · p. 5

E. Findings Summary

Table I consolidates six headline findings, their supporting evidence, and the conditions under which they hold.

  • Table I brings together six headline findings with supporting evidence and scope conditions, serving as a results reference and a precise statement of scope for follow-up work.Source: E. Findings Summary · p. 5

V. LIMITATIONS

The findings are bounded by one DeepSC backbone and continuous-space white-box ℓ∞ attacks. The conclusion summarizes layer-wise transfer and classification results and identifies extensions for future work.

V. LIMITATIONS

  • The study uses one three-layer DeepSC backbone with a 128D-to-16D bottleneck, so observed bottleneck protection may vary with compression ratio.Source: §V · p. 5
  • Evaluation covers continuous-space white-box ℓ∞ attacks; discrete token-level, ℓ2, ℓ0, and black-box transfer threats are outside scope.Source: §V · pp. 5–6

VI. CONCLUSIONS

  • The conclusion identifies other channels and architectures, hybrid multi-point curricula, transfer-asymmetry explanations, and lower-ε or K ≥4 classification as directions for future work.Source: §VI · p. 6
Loading 2609.13128v1…