Deep learning (DL), despite its enormous success in many computer vision and language processing applications, is exceedingly vulnerable to adversarial attacks. We consider the use of DL for radio signal (modulation) classification tasks, and present practical methods for the crafting of white-box and universal black-box adversarial attacks in that application. We show that these attacks can considerably reduce the classification performance, with extremely small perturbations of the input. In particular, these attacks are significantly more powerful than classical jamming attacks, which raises significant security and robustness concerns in the use of DL-based algorithms for the wireless physical layer.

Adversarial Attacks on Deep-Learning Based Radio Signal Classification

With the rapid development of the information technology, the number of devices in the Internet of Things (IoT) is increasing explosively, which makes device identification a great challenge. Deep neural networks (DNNs) have been used for device identification in IoT due to their superior learning ability. However, DNNs are susceptible to adversarial attacks, which can greatly degrade the accuracy of deep learning (DL) models for device identification. The adversarial attack is one of the fundamental security concerns for DNNs, and it is of great importance to study the generation of adversarial examples and to examine the attack effects for the design of robust DNN-based device identification schemes. In this article, we examine the effects of nontargeted and targeted adversarial attacks on convolutional neural network (CNN)-based device identification and propose combined evaluation indicators of logits to enrich the evaluation criteria. Our experimental results demonstrate that the identification accuracy degrades with the increase of the perturbation level and iteration step size, and the proposed combined evaluation indicators are effective to show the individual device signal differences. The insights from this study will be useful for the design of robust DL-based IoT systems. 

Threat of Adversarial Attacks on DL-Based IoT Device Identification

According to the recent studies, the vulnerability of state of the art Neural Networks to adversarial input samples has increased drastically. Neural network is an intermediate path or technique by which a computer learns to perform tasks using Machine learning algorithms. Machine Learning and Artificial Intelligence model has become fundamental aspect of life, such as self-driving cars [1], smart home devices, so any vulnerability is a significant concern. The smallest input deviations can fool these extremely literal systems and deceive their users as well as administrator into precarious situations. This article proposes a defense algorithm which utilizes the combination of an auto-encoder [3] and block-switching architecture. Auto-coder is intended to remove any perturbations found in input images whereas block switching method is used to make it more robust against White-box attack. Attack is planned using FGSM [9] model, and the subsequent counter-attack by the proposed architecture will take place thereby demonstrating the feasibility and security delivered by the algorithm.

An integrated Auto Encoder-Block Switching defense approach to prevent adversarial attacks

Adversarial attacks and active defense on deep learning based identification of GaN power amplifiers under physical perturbation

Improving the attack resistance of the modulation classification model is an important means to improve the security of the physical layer of the Internet of Things (IoT). In this paper, a binary modulation classification defense network (BMCDN) was proposed, which has the advantages of small model scale and strong immunity to white box gradient attacks. Specifically, an end-to-end modulation signal recognition network that directly recognizes the form of the signal sequence is constructed, and its parameters are quantized to 1 bit to obtain the advantages of low memory usage and fast calculation speed. The gradient of the quantized parameter is directly transferred to the original parameter to realize the gradient concealment and achieve the effect of effectively defending against the white box gradient attack. Experimental results show that BMCDN obtains significant immune performance against white box gradient attacks while achieving a scale reduction of 6 times.

/pdf/a-lightweight-modulation-classification-network-resisting-s13pm38qfv.pdf

Lei Pan

Papers

The technology of adversarial attacks in signal recognition