PaperlayerView exact revision on arXiv

Source-linked AI summary

On the Adversarial Vulnerability of Neural Receivers with Unrolled LDPC Decoders

Aakash Saini, Jafar Aco Mohammadi, Wolfgang Gerstacker

arXiv:2610.30345v1cs.ITcs.CRcs.LGcs.SYeess.SYmath.IT

TL;DR

Neural receivers can match classical receivers, yet their vulnerability to adversarial input perturbations remains underexplored, particularly when an unrolled LDPC decoder is integrated. This paper diagnoses why standard end-to-end attacks underperform and evaluates two alternative losses, finding higher BLER and stronger transfer for LLR-based attacks at low PSR.

  • Problem

    The robustness of neural receivers to adversarial perturbations remains underexplored, especially for receivers integrated with unrolled LDPC decoders.

    Source: §I · p. 1

  • Method

    The paper diagnoses end-to-end gradient masking and proposes per-iteration BP supervision and a pre-decoder LLR margin loss that bypasses the BP graph.

    Source: §I · pp. 1–2

  • Results

    Across NeuralReceiver and DeepRx, the two losses raise BLER by one to four orders of magnitude over PGD-E2E, and at low PSR LLLR attacks achieve up to three orders of magnitude higher BLER on unseen channels than LBP attacks.

    Source: §I · p. 2, §V · p. 5, §VI · p. 6

  • Takeaways & Limitations

    The end-to-end attack failure reflects obfuscated gradients rather than genuine robustness, and structurally different losses can restore attack efficacy.

    Source: §I · p. 1, §VI · p. 6

    The perturbation is injected directly at receiver antennas, omitting jammer-to-receiver channel constraints, so the results establish receiver-model vulnerability rather than a realizable over-the-air attack.

    Source: C. Threat Model and Adversarial… · p. 3

Abstract

from arXiv · show

Neural receivers for 5G New Radio (NR) match classical model-based receivers in link-level performance, but their robustness to adversarial perturbations at the receiver input remains underexplored. We show that standard gradient-based attacks applied end-to-end through an unrolled low-density parity-check (LDPC) decoder fail to significantly outperform a matched-power Gaussian perturbation. We identify the failure as gradient masking caused by tanh saturation in the boxplus operation of the belief-propagation (BP) check-node update, with a per-iteration gradient norm decay of more than four orders of magnitude across ten unrolled BP iterations. Based on this finding, we propose two structurally independent loss functions that restore attack efficacy. L_BP routes the gradient through the unsaturated early iterations via per-iteration supervision, while L_LLR is a margin loss on pre-decoder log-likelihood ratios (LLRs) whose gradient bypasses the LDPC decoder entirely. Both loss functions increase the block-error rate (BLER) by one to four orders of magnitude at matched perturbation power, with the results reproduced on both the Sionna NeuralReceiver and DeepRx. At low PSR, L_LLR-optimized perturbations achieve up to three orders of magnitude higher BLER on unseen channel realizations than LBP-optimized perturbations.

I. INTRODUCTION

Neural receivers can match classical receivers, but adversarial robustness remains an operational concern, especially when they are integrated with unrolled LDPC decoders. This paper diagnoses why standard end-to-end attacks fail and introduces alternative losses that recover attack efficacy.

I. INTRODUCTION

  • Prior neural-decoder studies address standalone decoders over simplified wireless channels, leaving NNRs integrated with unrolled LDPC BP decoders outside their scope.NNRs such as DeepRx and Sionna NeuralReceiver achieve link-level performance comparable to classical model-based receivers.Source: §I · p. 1
  • Standard ℓ2-FGM and PGD attacks using end-to-end BCE fail to significantly outperform a matched-power Gaussian jammer against NNRs with unrolled 5G NR LDPC decoders.The paper identifies this failure as gradient masking, not genuine receiver robustness.Source: §I · p. 1
  • The work identifies obfuscated gradients as the cause of end-to-end attack failure and connects the diagnosis to vanishing gradients previously observed during neural-decoder training.The connection applies the obfuscated-gradients framework of Athalye et al. to adversarial attacks.Source: §I · p. 1
  • Both proposed bypass losses increase post-decoder BLER by up to four orders of magnitude over PGD-E2E.LBP uses per-iteration supervision; LLLR is a pre-decoder margin loss whose gradient bypasses the BP graph.Source: §I · p. 2
  • The attack failure and recovery with LBP and LLLR occur on both DeepRx and the Sionna NeuralReceiver, while LLLR attacks transfer across channel realizations with substantially higher BLER than LBP attacks.The paper contrasts its attack target and purpose with PyJama, which optimizes OFDM power allocation against classical MIMO receivers.Source: §I · pp. 1–2

II. SYSTEM MODEL AND THREAT MODEL

The system model is a 5G NR uplink over a SIMO CDL-C channel, with an adversarial perturbation added at the receiver antennas. The analysis operates at high SNR, where pre-decoder LLR magnitudes place the BP decoder in severe tanh saturation.

II. SYSTEM MODEL AND THREAT MODEL

  • The modeled received signal combines the channel-scaled transmitted symbol, AWGN, and an adversarial perturbation at each receive antenna.The setting uses one transmit antenna and Nr receive antennas over a CDL-C channel simulated with Sionna PHY.Source: A. System Model · p. 2
  • Information bits are LDPC-encoded, QPSK-modulated, and mapped to an OFDM resource grid for transmission over the uplink channel.The code rate is R = k/n, and the resource grid spans T OFDM symbols and F subcarriers.Source: A. System Model · p. 2
  • The perturbation is vectorized over the Nr × T × F received resource elements, and the complete system operates at high SNR.Large pre-decoder LLR magnitudes place the BP decoder in the severe tanh saturation regime, described as the worst case for gradient-based attacks.Source: A. System Model · p. 2

B. Neural network-based Receivers

The paper evaluates two neural receivers with substantially different architectures and scales. Their resource-grid LLRs are demapped and serialized for an unrolled LDPC decoder, whose per-iteration outputs support multi-iteration loss optimization.

B. Neural network-based Receivers

  • The Sionna NeuralReceiver has approximately 4.86 M parameters, while the reduced DeepRx variant has approximately 0.64 M parameters.DeepRx uses a U-Net architecture with an explicit least-squares channel estimate as an auxiliary feature; the tested version has 7 rather than 11 residual blocks.Source: B. Neural network-based Receivers · p. 2
  • Both receiver architectures were trained with AdamW and a one-cycle learning-rate scheduler for 30,000 iterations on randomly drawn information-bit blocks at varying Eb/N0.Source: B. Neural network-based Receivers · p. 2
  • The receiver demaps resource-grid LLRs into a serialized pre-decoder vector that is passed to the 5G NR LDPC decoder.The decoder uses the exact boxplus check-node update and is unrolled across BP iterations to expose per-iteration LLRs.Source: B. Neural network-based Receivers · p. 2

C. Threat Model and Adversarial Optimization

The paper evaluates per-realization white-box and transfer attacks, with the former giving the adversary full model and channel knowledge and the latter applying perturbations to unseen realizations. Perturbations are optimized at the receiver input under a power budget, but direct antenna injection abstracts away realistic jammer-channel coupling.

Threat models

  • The per-realization white-box attacker knows the receiver weights and channel realization, while transfer attacks apply perturbations designed on one set of realizations to unseen ones.The paper characterizes the white-box setting as the strongest attacker and transfer as more practical.Source: C. Threat Model and Adversarial… · p. 3

Adversarial optimization

  • The attack loss is evaluated on receiver outputs after the perturbed signal passes through the NNR and unrolled BP decoder.The perturbation budget ε is set through the perturbation-to-signal ratio.Source: C. Threat Model and Adversarial… · p. 3

Perturbation budget

Threat-model scope

  • Direct antenna injection omits jammer-to-receiver channel constraints and possible jamming-channel estimation, so the results establish receiver-model vulnerability rather than a realizable over-the-air attack.The setup also assumes perfect timing and frequency synchronization.Source: C. Threat Model and Adversarial… · p. 3

A. Loss Functions

The paper compares losses applied at different points in the receiver: end-to-end information-bit outputs, per-iteration BP codeword outputs, and pre-decoder LLRs. Their gradient paths differ, with the pre-decoder margin loss bypassing BP and early-iteration supervision contributing more strongly than later terms.

Receiver outputs

  • The receiver quantities used by the losses are pre-decoder LLRs, per-iteration post-decoder LLRs, and final-iteration LLRs restricted to systematic information-bit positions.Source: A. Loss Functions · p. 3

End-to-end loss function

  • The end-to-end loss applies BCE with logits to post-decoder information-bit LLRs, back-propagating through information-bit extraction, every unrolled BP iteration, and the NNR.Source: A. Loss Functions · p. 3

Multi-iteration BP loss function

  • Per-iteration BP loss sums codeword-level BCE-with-logits terms across unrolled BP iterations, adapting supervision introduced for neural BP-decoder training to adversarial attacks.Early-iteration terms traverse fewer BP steps and contribute substantially to the perturbation gradient, while later terms contribute negligibly.Source: A. Loss Functions · p. 3

Pre-decoder margin loss function

  • The pre-decoder margin loss activates when a coded bit lacks the correct-sign LLR confidence of at least margin m, and its gradient bypasses BP iterations.The loss targets pre-decoder LLRs; its hinge is zero when the signed LLR meets the margin.Source: A. Loss Functions · p. 3

B. Projected Gradient Descent Optimizer

The perturbation is optimized with ℓ2-projected gradient descent, initialized from a random complex Gaussian point on the budget boundary. At each step, the normalized loss gradient updates the perturbation before projection back into the permitted ℓ2-ball.

Initialization

Optimization procedure

  • Each PGD step adds the chosen loss gradient, normalized to unit ℓ2 norm and scaled by step size α, then projects the result onto the ℓ2-ball of radius ε.Source: B. Projected Gradient Descent Optimizer · p. 4
  • PGD gradients are computed on the same channel, noise sample, and codeword used for initialization, without averaging over noise or channel.The resulting perturbations are evaluated either on that realization or in transfer mode.Source: B. Projected Gradient Descent Optimizer · p. 4

C. Baselines

The attacks are compared against a matched-power Gaussian jammer and a one-step FGM attack. FGM takes a full-budget gradient step on the end-to-end loss from the same Gaussian initialization used for PGD.

Baselines

  • The matched-power Gaussian jammer samples an isotropic perturbation on the ℓ2-ball boundary, while FGM uses one full-budget end-to-end-loss gradient step from the same Gaussian initialization as PGD.Projection keeps the FGM perturbation within the ℓ2 budget if the gradient step exits the ball.Source: C. Baselines · p. 4

IV. OBFUSCATED GRADIENTS IN UNROLLED BP

The unrolled BP decoder masks end-to-end attack gradients through repeated saturating boxplus updates. Per-iteration measurements show steep gradient decay, while losses that route around later BP iterations restore usable attack gradients.

IV. OBFUSCATED GRADIENTS IN UNROLLED BP

  • End-to-end gradient norms are ≈10^-7 for NeuralReceiver and ≈10^-9 for DeepRx, versus ≈10^-3 for L_LLR on both architectures.L_LLR exceeds the end-to-end gradient norm by four and six orders of magnitude, respectively.Source: §IV · p. 4
  • Each BP iteration attenuates the gradient by approximately one to two orders of magnitude, reaching the end-to-end floor by iteration 5 on NeuralReceiver and iteration 4 on DeepRx.The per-iteration norms fall from ≈10^-3 at iteration 1 to ≈10^-7 at iteration 5 for NeuralReceiver, and reach ≈10^-9 at iteration 4 for DeepRx.Source: §IV · p. 4
  • End-to-end gradients reach the numerical floor because the unrolled BP chain of saturating boxplus updates attenuates gradients.The convergence of the final-iteration and end-to-end gradients to the same floor localizes the masking to the BP chain.Source: §IV · p. 4
  • L_BP is dominated by its early-iteration loss terms, whereas L_LLR sends gradients from pre-decoder LLRs directly to the perturbation without traversing the BP graph.Both architectures exhibit the same masking pattern despite their architectural differences.Source: §IV · p. 4

V. RESULTS

In transfer mode, PGD-LLR produces the strongest BLER across the tested PSR range on both receiver architectures. Its advantage over PGD-BP is especially pronounced at low PSR, where PGD-BP transfers poorly from its crafting channel.

V. RESULTS

  • Case B applies the designed perturbation set to disjoint channel realizations, modeling an adversary that commits before observing the channel.The Case A–Case B BLER gap measures the extent of channel overfitting.Source: §V · p. 5
  • On NeuralReceiver, PGD-LLR reaches BLER ≈0.5 at PSR = −10 dB, versus PSR = −5 dB for PGD-BP and −1.5 dB for the Gaussian jammer.The corresponding DeepRx crossings are shifted 1–3 dB toward higher PSR.Source: §V · p. 5
  • PGD-BP and PGD-LLR both achieve Case A BLER ≈1.0 across the PSR sweep, but PGD-BP overfits to the channel used to craft its perturbation.PGD-LLR retains Case B BLER of 0.63 for NeuralReceiver and 0.29 for DeepRx at PSR = −8 dB.Source: §V · p. 5
  • At PSR ∈{−12, −8} dB, PGD-LLR Case B BLER exceeds PGD-BP by two to three orders of magnitude.PGD-BP transfers poorly at low PSR, with Case B BLER falling to ≈10^-4 for NeuralReceiver and ≈10^-5 for DeepRx at PSR = −12 dB.Source: §V · p. 5
  • At high PSR (≥−4 dB), both attacks reach near-unity Case B BLER and their performance gap narrows; moderate PSR is the critical regime for separating perturbation directions.At very low PSR, both attacks transfer poorly because the perturbation budget is highly constrained.Source: §V · pp. 5–6
  • PGD-LLR outperforms PGD-BP, PGD-E2E, and the Gaussian jammer across the PSR range in transfer mode on both architectures.It reaches the same BLER as PGD-BP at 4–8 dB lower PSR.Source: §V · p. 5, Figure 3 · p. 6

VI. CONCLUSION

Two structurally independent losses restore attack efficacy where standard end-to-end attacks fail to outperform matched-power Gaussian jamming, with findings replicated on NeuralReceiver and DeepRx. At low PSR, L_LLR perturbations transfer better than L_BP perturbations, while physical-channel perturbation routing remains an open extension.

VI. CONCLUSION

  • BLER increases by one to four orders of magnitude over PGD-E2E with two structurally independent losses, with findings replicated on NeuralReceiver and DeepRx.L_BP routes gradients through early unsaturated BP iterations; L_LLR bypasses the BP graph entirely.Source: §VI · p. 6
  • Gradient norms decay by more than four orders of magnitude across ten unrolled BP iterations, diagnosing obfuscated gradients.The standard ℓ2-FGM and PGD attacks fail to outperform a matched-power Gaussian jammer.Source: §VI · p. 6
  • At low PSR, L_LLR perturbations achieve up to three orders of magnitude higher BLER on unseen channel realizations than L_BP perturbations.Source: §VI · p. 6
  • Routing perturbations through a physical adversary channel, rather than adding them directly at receiver antennas, remains an open extension.Source: §VI · p. 6
Loading 2610.30345v1…