PaperlayerView exact revision on arXiv

Source-linked AI summary

Energy-Efficient Risk-Constrained Adaptive Semantic Communications Under Uncertain Adversarial Threats

Maedeh Fallahreyhani, Paeiz Azmi, Nader Mokari, M. Reza Abedi

arXiv:2610.30911v1eess.SP

TL;DR

Adversarial robustness in semantic communication can require substantial radio and receiver-side defense energy, while existing approaches lack a unified sequential formulation for joint energy minimization and tail-risk control under hidden attacks. This paper proposes a recurrent, risk-constrained controller that adapts communication and purification resources. On CIFAR-100, it reports improved robustness with lower energy than diffusion-only defense at unseen source-domain and OTA attack levels.

  • Problem

    Existing approaches lack a unified sequential formulation that minimizes communication and defensive-computation energy, adapts resources from causal observations, and constrains trajectory-level semantic CVaR under hidden attacks.

    Source: §I · pp. 1–2

  • Method

    A recurrent primal–dual PPO controller minimizes communication and diffusion-purification energy while constraining semantic loss, trajectory-level CVaR, and latency, and jointly adapts power, bandwidth ratio, and purification complexity.

    Source: §I · p. 7, §VI · p. 12

  • Results

    At unseen ϵ=12/255, robust Top-1 accuracy is about 61% with about 9% less energy than diffusion-only defense; at ΓA=−5 dB, accuracy is about 52% with about 8% less energy.

    Source: §VI · p. 12

  • Takeaways & Limitations

    The policy occupies a middle regime, increasing radio and purification effort as attack severity grows while preserving semantic and tail-risk constraints.

    Source: D. Discussion · p. 12

Abstract

from arXiv · show

Semantic communication systems based on deep joint source-channel coding can provide task-oriented wireless transmission, but adversarial robustness may require substantial radio and receiver-side defensive-computation energy. This paper develops an energy-efficient, risk-constrained semantic communication framework under source-domain, over-the-air (OTA), and potentially composite adversarial conditions. Long-term total energy, including communication and diffusion-purification energy, is minimized subject to average semantic-loss, trajectory-level tail-risk, and end-to-end latency constraints. A recurrent primal-dual proximal policy optimization controller jointly adapts transmit power, semantic/channel bandwidth ratio, and purification complexity using causal channel observations, semantic confidence, imperfect attack-belief estimates, and recurrent history. A conditional value-at-risk (CVaR) constraint explicitly limits severe semantic failures. On CIFAR-100, at the unseen source-domain level $\epsilon=12/255$, the proposed controller achieves approximately $61\%$ robust Top-1 accuracy with $\mathrm{CVaR}_{0.9}\approx0.36$ while using about $9\%$ less total energy than diffusion-only defense. At the unseen OTA level $\Gamma_A=-5$ dB, it achieves approximately $52\%$ robust Top-1 accuracy, reduces semantic tail risk by $40\%$, and consumes about $8\%$ less total energy than diffusion-only defense. These results demonstrate energy-efficient semantic defense under partially observable adversarial conditions.

I. INTRODUCTION

The introduction identifies a gap in jointly minimizing communication and defensive-computation energy while adapting resources and constraining semantic tail risk under hidden attacks. The proposed framework models these decisions across an adversarial semantic communication system.

I. INTRODUCTION

  • The framework addresses the gap with an energy-aware adversarial SemCom model and an energy-first formulation that keeps average semantic loss, trajectory-level CVaR, and latency as separate constraints.Its recurrent controller jointly adapts transmit power and bandwidth/purification actions using causal observations and recurrent history.Source: §I · pp. 1–2

II. SYSTEM MODEL

  • The system includes a rate-adaptive DeepJSCC transceiver, wireless channel, diffusion purifier, frozen task network, and controller, while accounting for both radio and purification-computation energy.The controller uses causal channel information, semantic confidence, imperfect attack beliefs, and recurrent history; the true attack mode and strength are hidden at deployment.Source: §II · p. 2

A. Rate-Adaptive Semantic Transmission

  • The selected semantic/channel bandwidth ratio determines the number of active channel symbols, affecting representation capacity, transmission duration, and energy cost.The number of active symbols is k_t = ceil(ρ_t n).Source: A. Rate-Adaptive Semantic Transmission · p. 3

B. Composite Adversarial and Wireless Channel Model

The channel model includes benign, source-domain, channel-domain, and simultaneous source–channel attack modes. The attacker targets downstream semantic utility, while the deployed controller must infer hidden attack conditions from causal observations and imperfect beliefs.

B. Composite Adversarial and Wireless Channel Model

  • The model distinguishes benign operation, source-domain attack, channel-domain attack, and simultaneous source–channel attack.Source-domain perturbations affect the semantic encoder input, while OTA perturbations act on the received wireless signal.Source: B. Composite Adversarial and Wireless… · p. 3

1) Adversary Knowledge and Attack Objective:

  • Attacks target downstream semantic task loss; in composite mode, source and OTA perturbations may both be present under their separate budgets.The attacker is white-box to the fixed transceiver, classifier, current channel, and selected action, but lacks access to the controller’s recurrent state and future conditions.Source: 1) Adversary Knowledge and Attack… · pp. 3–4
  • The controller does not observe the attack mode or realized perturbations and instead infers operating conditions from causal receiver observations and imperfect attack-belief information.The attack objective is semantic negative log-likelihood.Source: 1) Adversary Knowledge and Attack… · p. 4

C. Temporal Channel and Attack Dynamics

The system models temporally correlated legitimate and adversarial channels and attack modes, then reconstructs received images with selectable diffusion purification before semantic inference.

C. Temporal Channel and Attack Dynamics

  • The legitimate channel follows a first-order Gauss–Markov process, with ηh controlling its correlation.The adversarial-to-receiver channel also evolves over time, with ηg as its correlation coefficient.Source: C. Temporal Channel and Attack Dynamics · p. 4
  • Adversarial operating modes evolve as a first-order Markov process, while attack modes and strengths remain hidden from the controller during training.Training samples attack strengths from a specified set and uses the attack-mode Markov chain; temporal correlation motivates recurrent control.Source: C. Temporal Channel and Attack Dynamics · pp. 4–5

D. Semantic Reconstruction and Adaptive Purification

  • The receiver forms a preliminary semantic reconstruction using its channel estimate and the selected transmit power and bandwidth ratio.The receiver knows the selected actions through authenticated control signaling.Source: D. Semantic Reconstruction and… · p. 5
  • The controller selects purification complexity, including zero-step bypass, before a frozen task network produces the semantic output.Purification complexity affects both semantic robustness and receiver-side computation energy and latency.Source: D. Semantic Reconstruction and… · p. 5

E. Communication and Defensive-Computation Energy Model

The energy model treats radio communication and diffusion purification as explicit costs, while causal confidence and attack-belief features inform adaptive control.

E. Communication and Defensive-Computation Energy Model

  • Radio communication energy includes power-amplifier inefficiency and active radio circuitry, rather than only radiated transmit energy.The model uses ηPA for amplifier efficiency and Pc for aggregate transmitter/receiver circuit power while the link is active.Source: E. Communication and… · p. 5
  • Purification energy is modeled from the number of reverse-diffusion steps and the effective receiver processing frequency and energy coefficient.The number of processing cycles per step can come from purifier profiling or a hardware-consistent processor model.Source: E. Communication and… · p. 5
  • The effective receiver processing frequency is fixed, preserving a three-dimensional action space for radio-resource allocation and adaptive defense.The model also notes that higher transmit power, bandwidth ratio, and purification complexity raise energy or latency costs.Source: E. Communication and… · p. 5
  • The action-independent processing-energy approximation requires a fixed-shape implementation or evidence that rate-dependent variation is negligible.If processing energy varies materially with ρt, the model calls for replacing Efix with Eproc(ρt) in optimization and evaluation.Source: E. Communication and… · p. 5

F. Causal Semantic Confidence and Attack-Belief Estimation

  • The controller uses semantic-task posterior confidence and an attack-belief distribution inferred from observable receiver-side features.Larger confidence scores indicate lower posterior entropy; the belief estimator uses a deterministic feature mapping and a lightweight attack classifier.Source: F. Causal Semantic Confidence and… · pp. 5–6

G. Partially Observable Cross-Layer Control

The controller acts on causal observations and recurrent history rather than the hidden environment state, while semantic loss is assessed both on average and in the trajectory tail.

G. Partially Observable Cross-Layer Control

  • The hidden environment state characterizes the system but is unavailable to the deployed controller, including its source and adversarial variables.Training-only clean images and ground-truth classes construct losses and constraints but are excluded from controller observations.Source: G. Partially Observable Cross-Layer… · p. 6, H. Semantic Loss and Tail-Risk Model · p. 6
  • The causal observation uses pre-decision channel quality and prior-slot information to avoid relying on values available only after transmission and inference.Latency slack is an observation feature, not a pathwise delay guarantee, and the finite-horizon feature indicates remaining time.Source: G. Partially Observable Cross-Layer… · p. 6
  • A recurrent representation summarizes causal observation history instead of constructing an exact Bayesian belief over the complete hidden state.The controller's action space is hybrid: transmit power is continuous, while bandwidth ratio and purification complexity are discrete.Source: G. Partially Observable Cross-Layer… · p. 6

H. Semantic Loss and Tail-Risk Model

  • The semantic-loss model combines reconstruction fidelity and task-level correctness, with their relative weights constrained to be nonnegative and not both zero.The discount-weighted trajectory-average loss is normalized to the single-interval loss scale; when γ=1, it is the trajectory mean.Source: H. Semantic Loss and Tail-Risk Model · p. 6
  • CVaR is applied to normalized trajectory-average semantic loss, so thresholds calibrated for an unnormalized sum require conversion or reevaluation.The auxiliary value-at-risk parameter ν appears in the CVaR formulation.Source: H. Semantic Loss and Tail-Risk Model · p. 6

I. Energy-Minimizing Risk-Constrained Optimization

The framework minimizes long-term total energy under average semantic-quality, trajectory-tail-risk, and expected-latency constraints. A recurrent primal–dual PPO controller handles partial observability and hybrid cross-layer actions.

I. Energy-Minimizing Risk-Constrained Optimization

  • The optimization minimizes expected average total energy and constrains average end-to-end latency.The formulation separately constrains average semantic quality and trajectory-level tail risk; latency is not a per-packet or pathwise guarantee.Source: §I · pp. 6–7

III. PROPOSED RECURRENT ENERGY-MINIMIZING RISK-CONSTRAINED POLICY OPTIMIZATION

  • The recurrent primal–dual PPO controller uses a GRU and hybrid stochastic actor to adapt transmit power, bandwidth ratio, and diffusion-purification complexity.A multi-head recurrent critic estimates objective and constraint returns, while adaptive dual variables enforce separate semantic-quality, latency, and tail-risk constraints.Source: §III · p. 7

A. Recurrent Representation Under Partial Observability

Because current observations can confound channel degradation with adversarial corruption, the controller uses recurrent history and a shared representation to coordinate continuous power with discrete bandwidth and purification choices.

A. Recurrent Representation Under Partial Observability

  • Semantic confidence can fall from channel degradation, adversarial corruption, or both, so a GRU summarizes causal history rather than relying on the current observation alone.Its learned state captures temporal dependencies in channel quality, confidence, adversarial activity, attack-belief uncertainty, prior actions, and latency consumption; it is not an exact Bayesian posterior.Source: A. Recurrent Representation Under… · p. 7

B. Hybrid Energy-Aware Cross-Layer Actor

1) Continuous Transmit-Power Policy:

  • The power policy maps a normalized Beta-policy sample into the feasible transmit-power range, satisfying its bounds by design without post-sampling clipping.The density transformation includes a constant Jacobian, which cancels in the PPO ratio but is retained in physical-action log densities.Source: 1) Continuous Transmit-Power Policy · pp. 7–8

2) Discrete Bandwidth and Purification Policies:

  • Bandwidth ratio and purification complexity use independent categorical heads conditioned on the same recurrent feature, while a common objective trains the joint agent.Factorizing the conditional action distribution supports computational tractability without turning the components into independent policies.Source: 2) Discrete Bandwidth and Purification… · p. 8

C. Energy Objective and Normalized Constraint Costs

The controller minimizes physical total energy using fixed normalization references and separate recurrent critic heads for energy and constraints. Semantic tail risk is estimated across complete trajectories, with a sample-based approximation used for policy updates.

C. Energy Objective and Normalized Constraint Costs

  • Fixed positive references normalize energy, semantic loss, and latency while preserving the optimizer and feasible set and improving training conditioning.The objective remains physical total-energy minimization, not semantic-loss minimization.Source: C. Energy Objective and Normalized… · p. 8

D. Multi-Head Recurrent Critic

  • Four separate recurrent critic heads estimate normalized energy reward, average semantic cost, average latency cost, and trajectory-level semantic tail risk.Separate heads avoid collapsing distinct objectives and constraints into a fixed weighted scalar reward.Source: D. Multi-Head Recurrent Critic · p. 8

E. Trajectory-Level Semantic CVaR Estimation

  • The semantic-risk constraint uses trajectory-average loss, so CVaR is estimated from batches of complete trajectories rather than isolated transitions.The current-batch quantile makes the policy-gradient surrogate a finite-sample approximation; the full empirical CVaR is used in the dual update.Source: E. Trajectory-Level Semantic CVaR… · pp. 8–9

F. Primal–Dual Energy-Aware PPO Update

A primal–dual PPO update rewards lower energy while penalizing constraint costs according to adaptive multipliers. Separate critic losses and batch-level constraint violations drive value learning and multiplier updates.

F. Primal–Dual Energy-Aware PPO Update

  • The actor combines the energy advantage with semantic, latency, and tail-risk penalties weighted by their dual variables in a joint PPO update.The energy advantage rewards actions yielding lower total energy; the joint importance ratio uses the policy's factorized action probabilities.Source: F. Primal–Dual Energy-Aware PPO Update · p. 9

G. Critic and Dual-Variable Updates

  • The multi-head critic is trained with separate losses, while empirical energy is monitored but does not trigger a dual update because it is the primal objective.Dual variables are updated from empirical constraint violations; a violated constraint raises its multiplier, while persistent satisfaction lets it decrease.Source: G. Critic and Dual-Variable Updates · p. 9

H. Training and Online Operation

Training and deployment operate on recurrent histories and complete trajectories, with constraint costs and CVaR evaluated at the batch level. CIFAR-100 tests include held-out source and OTA attack strengths, while controller observations exclude ground-truth attack labels.

H. Training and Online Operation

  • Complete trajectories support consistent semantic-CVaR evaluation during training; online, the controller acts from causal observations and recurrent history without ground-truth attack modes or labels.After transmission and receiver processing, updated confidence, attack belief and uncertainty, latency consumption, and the previous action inform the next observation.Source: H. Training and Online Operation · pp. 9–10

A. Dataset, Backbone, and Principal Settings

B. Channel, Attacks, and Attack-Belief Estimator

  • The source attack level 12/255 and OTA level −5 dB are withheld from controller training, and reported comparisons isolate source-only and OTA-only stress tests.The system model includes simultaneous source-and-OTA attack mode, and the belief estimator sees all four attack labels during training.Source: B. Channel, Attacks, and Attack-Belief… · p. 10
  • The attack-belief network is trained offline and frozen; during PPO training and deployment, the controller receives its belief vector and entropy rather than ground-truth labels.The offline estimator uses a four-way output for benign, source, OTA, and composite samples.Source: B. Channel, Attacks, and Attack-Belief… · p. 10

C. Baselines, Metrics, and Training Protocol

The paper evaluates a recurrent controller that minimizes total communication and purification energy while meeting semantic-loss, tail-risk, and latency constraints. Across unseen source-domain and OTA attacks, it reports improved robustness with lower energy than diffusion-only defense.

C. Baselines, Metrics, and Training Protocol

  • The protocol compares the controller with undefended, adversarial-training, and diffusion-only baselines on matched CIFAR-100 samples, channels, attacks, and seeds; results average five seeds.Metrics include robust Top-1 accuracy, trajectory-average semantic-loss CVaR0.9, total energy, and end-to-end latency.Source: C. Baselines, Metrics, and Training… · p. 10

A. Convergence and Constraint Satisfaction

  • Normalized total energy falls from 1.00 to approximately 0.47; semantic loss reaches 0.32 and latency 0.85, while tail risk enters its feasible region during training.Semantic loss becomes feasible after roughly 60 × 10^3 iterations, tail risk between 60 × 10^3 and 80 × 10^3, and latency near 40 × 10^3.Source: A. Convergence and Constraint… · pp. 10–11, Figure 2 · p. 11

VI. CONCLUSION

  • At unseen source-domain ε = 12/255 and OTA ΓA = −5 dB, robust Top-1 accuracy reaches approximately 61% and 52%, respectively, with about 9% and 8% less energy than diffusion-only defense.Both conditions report CVaR0.9 ≈ 0.36; source-domain and OTA results are summarized separately below.Source: Figure 3 · p. 11, Figure 4 · p. 12, §VI · p. 12

B. Source-Domain PGD Robustness

  • At ε = 12/255, the controller achieves approximately 61% robust Top-1 accuracy and CVaR0.9 ≈ 0.36, using about 9% less energy than diffusion-only defense.It outperforms diffusion-only defense, adversarial training, and undefended ViT-DeepJSCC in robust accuracy at this unseen 20-step PGD attack strength.Source: Figure 3 · p. 11, B. Source-Domain PGD Robustness · p. 11

C. OTA Robustness

  • At ΓA = −5 dB, the controller achieves approximately 52% robust Top-1 accuracy and CVaR0.9 ≈ 0.36, using about 8% less energy than diffusion-only defense.The attack strength is unseen during training; the reported accuracy exceeds diffusion-only defense, adversarial training, and the undefended system.Source: C. OTA Robustness · p. 11, Figure 4 · p. 12

D. Discussion

  • Energy alone does not rank the methods: the controller increases radio and purification effort with attack severity while preserving semantic and tail-risk constraints.The conclusion frames energy minimization as optimization within semantic-quality, tail-reliability, and latency feasibility limits.Source: D. Discussion · p. 12, §VI · p. 12
Loading 2610.30911v1…