Automatic modulation classification can be a core component for intelligent spectrally efficient wireless communication networks, and deep learning techniques have recently been shown to deliver superior performance to conventional model-based strategies, particularly when distinguishing between a large number of modulation types. However, such deep learning techniques have also been recently shown to be vulnerable to gradient-based adversarial attacks that rely on subtle input perturbations, which would be particularly feasible in a wireless setting via jamming. One such potent attack is the one known as the Carlini-Wagner attack, which we consider in this work. We further consider a data-driven subsampling setting, where several recently introduced deep-learning-based algorithms are employed to select a subset of samples that lead to reducing the final classifier's training time with minimal loss in accuracy. In this setting, the attacker has to make an assumption about the employed subsampling strategy, in order to calculate the loss gradient. Based on state of the art techniques available to both the attacker and defender, we evaluate best strategies under various assumptions on the knowledge of the other party's strategy. Interestingly, in presence of knowledgeable attackers, we identify computational cost reduction opportunities for the defender with no or minimal loss in performance.
Automatic modulation classification (AMC) using the Deep Neural Network (DNN) approach outperforms the traditional classification techniques, even in the presence of challenging wireless channel environments. However, the adversarial attacks cause the loss of accuracy for the DNN-based AMC by injecting a well-designed perturbation to the wireless channels. In this paper, we propose a novel generative adversarial network (GAN)-based countermeasure approach to safeguard the DNN-based AMC systems against adversarial attack examples. GAN-based aims to eliminate the adversarial attack examples befo…
Information Technology University, Punjab, Pakistan（巴基斯坦旁遮普信息技术大学）；Hamad Bin Khalifa University, Qatar（卡塔尔哈马德·本·哈利法大学）
Recently, many deep neural networks (DNN) based modulation classification schemes have been proposed in the literature. We have evaluated the robustness of two famous such modulation classifiers (based on the techniques of convolutional neural networks and long short term memory) against adversarial machine learning attacks in black-box settings. We have used Carlini \& Wagner (C-W) attack for performing the adversarial attack. To the best of our knowledge, the robustness of these modulation classifiers has not been evaluated through C-W attack before. Our results clearly indicate that state-o…
Deep neural networks are vulnerable against adversarial examples. In this paper, we propose to train and test the networks with randomly subsampled images with high drop rates. We show that this approach significantly improves robustness against adversarial examples in all cases of bounded L0, L2 and L_inf perturbations, while reducing the standard accuracy by a small value. We argue that subsampling pixels can be thought to provide a set of robust features for the input image and, thus, improves robustness without performing adversarial training.
This work demonstrates the ability to produce readily interpretable statistical metrics for model fit, fixed effects covariance coefficients, and prediction confidence. Importantly, this work compares 4 suitable and commonly applied epistemic UQ approaches, BNN, SWAG, MC dropout, and ensemble approaches in their ability to calculate these statistical metrics for the ARMED MEDL models. In our experiment for AD prognosis, not only do the UQ methods provide these benefits, but several UQ methods maintain the high performance of the original ARMED method, some even provide a modest (but not statis…
In communication systems, there are many tasks, like modulation recognition, which rely on Deep Neural Networks (DNNs) models. However, these models have been shown to be susceptible to adversarial perturbations, namely imperceptible additive noise crafted to induce misclassification. This raises questions about the security but also the general trust in model predictions. We propose to use adversarial training, which consists of fine-tuning the model with adversarial perturbations, to increase the robustness of automatic modulation recognition (AMC) models. We show that current state-of-the-a…
University of Maryland（马里兰大学）；Intelligent Automation, Inc.（智能自动化公司）
We consider a wireless communication system that consists of a transmitter, a receiver, and an adversary. The transmitter transmits signals with different modulation types, while the receiver classifies its received signals to modulation types using a deep learning-based classifier. In the meantime, the adversary makes over-the-air transmissions that are received as superimposed with the transmitter's signals to fool the classifier at the receiver into making errors. While this evasion attack has received growing interest recently, the channel effects from the adversary to the receiver have be…
University of Maryland（马里兰大学）；Intelligent Automation, Inc.（智能自动化公司）；Virginia Tech（弗吉尼亚理工大学）
We consider a wireless communication system, where a transmitter sends signals to a receiver with different modulation types while the receiver classifies the modulation types of the received signals using its deep learning-based classifier. Concurrently, an adversary transmits adversarial perturbations using its multiple antennas to fool the classifier into misclassifying the received signals. From the adversarial machine learning perspective, we show how to utilize multiple antennas at the adversary to improve the adversarial (evasion) attack performance. Two main points are considered while…
Huazhong University of Science and Technology（华中科技大学）
Given the great success of Deep Neural Networks(DNNs) and the black-box nature of it,the interpretability of these models becomes an important issue.The majority of previous research works on the post-hoc interpretation of a trained model.But recently, adversarial training shows that it is possible for a model to have an interpretable input-gradient through training.However,adversarial training lacks efficiency for interpretability.To resolve this problem, we construct an approximation of the adversarial perturbations and discover a connection between adversarial training and amplitude modulat…
University of Maryland（马里兰大学）；Intelligent Automation, a BlueHalo Company（Intelligent Automation（BlueHalo 旗下公司））；Virginia Tech（弗吉尼亚理工大学）
This paper presents channel-aware adversarial attacks against deep learning-based wireless signal classifiers. There is a transmitter that transmits signals with different modulation types. A deep neural network is used at each receiver to classify its over-the-air received signals to modulation types. In the meantime, an adversary transmits an adversarial perturbation (subject to a power budget) to fool receivers into making errors in classifying signals that are received as superpositions of transmitted signals and adversarial perturbations. First, these evasion attacks are shown to fail whe…
A Hybrid Training-time and Run-time Defense Against Adversarial Attacks in Modulation Classification
School of Electronic Engineering, Xidian University（西安电子科技大学电子工程学院）；Wolfson School of Mechanical, Electrical and Manufacturing Engineering, Loughborough University（拉夫堡大学沃尔森机械、电气与制造工程学院）；University of Cagliari（卡利亚里大学）；University of Genova（热那亚大学）
Attention-based Adversarial Robust Distillation in Radio Signal Classifications for Low-Power IoT Devices
Wolfson School of Mechanical, Electrical and Manufacturing Engineering, Loughborough University（洛辛姆机械、电气与制造工程学院，劳德斯大学）；School of Engineering, University of Warwick（工程学院，沃里克大学）；School of Electronic Engineering, Xidian University（电子工程学院，西安电子科技大学）；Department of Electrical Engineering, King Saud University（电气工程系，沙特国王大学）；Department of Informatics, Bioengineering, Robotics, and Systems Engineering, University of Genova（信息学、生物工程、机器人学和系统工程系，热那亚大学）
We consider a communication scenario, in which an intruder tries to determine the modulation scheme of the intercepted signal. Our aim is to minimize the accuracy of the intruder, while guaranteeing that the intended receiver can still recover the underlying message with the highest reliability. This is achieved by perturbing channel input symbols at the encoder, similarly to adversarial attacks against classifiers in machine learning. In image classification, the perturbation is limited to be imperceptible to a human observer, while in our case the perturbation is constrained so that the mess…
School of Electrical and Computer Engineering, Purdue University（普渡大学电气与计算机工程学院）
Automatic modulation classification (AMC) aims to improve the efficiency of crowded radio spectrums by automatically predicting the modulation constellation of wireless RF signals. Recent work has demonstrated the ability of deep learning to achieve robust AMC performance using raw in-phase and quadrature (IQ) time samples. Yet, deep learning models are highly susceptible to adversarial interference, which cause intelligent prediction models to misclassify received samples with high confidence. Furthermore, adversarial interference is often transferable, allowing an adversary to attack multipl…
Vision Transformer with Adversarial Indicator Token against Adversarial Attacks in Radio Signal Classifications
School of Mathematics and Computer Science, Swansea university（斯旺西大学数学与计算机科学学院）；Institute for Digital Technologies, Loughborough University London（伦敦洛桑大学数字技术研究所）；School of Engineering, University of Warwick（沃里克大学工程学院）；School of Electronic Engineering, Xidian University（西安电子科技大学电子工程学院）；Department of Electrical and Electronic Engineering, Faculty of Engineering, Imperial College London（伦敦帝国理工学院电子与电气工程系）；Department of Informatics, Bioengineering Robotics, and Systems Engineering, University of Genova（热那亚大学信息学、生物工程机器人与系统工程系）；Warwick Manufacturing Group, University of Warwick（沃里克大学沃里克制造集团）
Imperceptible Physical Attack against Face Recognition Systems via LED Illumination Modulation
Jinan University（暨南大学）；Zhejiang University（浙江大学）；The University of Hong Kong（香港大学）；Harbin Institute of Technology, Shenzhen（哈尔滨工业大学（深圳））；Peng Cheng Laboratory（鹏城实验室）
Deep learning (DL), despite its enormous success in many computer vision and language processing applications, is exceedingly vulnerable to adversarial attacks. We consider the use of DL for radio signal (modulation) classification tasks, and present practical methods for the crafting of white-box and universal black-box adversarial attacks in that application. We show that these attacks can considerably reduce the classification performance, with extremely small perturbations of the input. In particular, these attacks are significantly more powerful than classical jamming attacks, which raise…
Deep learning (DL) is becoming popular as a new tool for many applications in wireless communication systems. However, for many classification tasks (e.g., modulation classification) it has been shown that DL-based wireless systems are susceptible to adversarial examples; adversarial examples are well-crafted malicious inputs to the neural network (NN) with the objective to cause erroneous outputs. In this paper, we extend this to regression problems and show that adversarial attacks can break DL-based power allocation in the downlink of a massive multiple-input-multiple-output (maMIMO) networ…
Virginia Tech（弗吉尼亚理工大学）；University of Maryland（马里兰大学）；The Ohio State University（俄亥俄州立大学）
Semantic communications seeks to transfer information from a source while conveying a desired meaning to its destination. We model the transmitter-receiver functionalities as an autoencoder followed by a task classifier that evaluates the meaning of the information conveyed to the receiver. The autoencoder consists of an encoder at the transmitter to jointly model source coding, channel coding, and modulation, and a decoder at the receiver to jointly model demodulation, channel decoding and source decoding. By augmenting the reconstruction loss with a semantic loss, the two deep neural network…
Modulation classification is an important component of cognitive self-driving networks. Recently many ML-based modulation classification methods have been proposed. We have evaluated the robustness of 9 ML-based modulation classifiers against the powerful Carlini \& Wagner (C-W) attack and showed that the current ML-based modulation classifiers do not provide any deterrence against adversarial ML examples. To the best of our knowledge, we are the first to report the results of the application of the C-W attack for creating adversarial examples against various ML models for modulation classific…
Spatial Frequency Modulation for Semantic Segmentation
MIIT Key Laboratory of Complex-field Intelligent Sensing, Beijing Institute of Technology, Beijing, China（信息产业部复杂场智能感知重点实验室，北京理工大学，北京，中国）；School of Computer Science and Technology, Beijing Institute of Technology, Beijing, China（计算机科学与技术学院，北京理工大学，北京，中国）；RIKEN AIP, Tokyo, Japan（日本理化学研究所AIP分所，东京，日本）；RCAST, The University of Tokyo, Tokyo, Japan（东京大学RCAST，东京，日本）；Instrumentation and Optoelectronic Engineering, Beihang University（北航仪器与光电工程学院，北京航空航天大学）；Department of Electronic Engineering, Tsinghua University, Beijing, China（清华大学电子工程系，北京，中国）
Institut de Recherche et Coordination Acoustique-Musique (IRCAM)（声学与音乐研究协作研究所（IRCAM））；CNRS（法国国家科学研究中心）；UPMC - Sorbonne Universite（巴黎第六大学-索邦大学）
Generative models have thrived in computer vision, enabling unprecedented image processes. Yet the results in audio remain less advanced. Our project targets real-time sound synthesis from a reduced set of high-level parameters, including semantic controls that can be adapted to different sound libraries and specific tags. These generative variables should allow expressive modulations of target musical qualities and continuously mix into new styles. To this extent we train AEs on an orchestral database of individual note samples, along with their intrinsic attributes: note class, timbre domain…
We consider complexity of Deep Neural Networks (DNNs) and their associated massive over-parameterization. Such over-parametrization may entail susceptibility to adversarial attacks, loss of interpretability and adverse Size, Weight and Power - Cost (SWaP-C) considerations. We ask if there are methodical ways (regularization) to reduce complexity and how can we interpret trade-off between desired metric and complexity of DNN. Reducing complexity is directly applicable to scaling of AI applications to real world problems (especially for off-the-cloud applications). We show that presence and eval…
An interpretable generative multimodal neuroimaging-genomics framework for decoding Alzheimer's disease
Department of Computer Science, University of Verona（威尼斯大学计算机科学系）；Department of Engineering for Innovation Medicine, University of Verona（威尼斯大学创新医学工程系）；Tri-Institutional Center for Translational Research in Neuroimaging and Data Science (TReNDS), Georgia State University, Georgia Institute of Technology, Emory University（神经影像与数据科学转化研究三机构中心（TReNDS），佐治亚州立大学，佐治亚理工学院，埃默里大学）
This paper advances the state of the art by proposing the first comprehensive analysis and experimental evaluation of adversarial learning attacks to wireless deep learning systems. We postulate a series of adversarial attacks, and formulate a Generalized Wireless Adversarial Machine Learning Problem (GWAP) where we analyze the combined effect of the wireless channel and the adversarial waveform on the efficacy of the attacks. We propose a new neural network architecture called FIRNet, which can be trained to "hack" a classifier based only on its output. We extensively evaluate the performance…
We present a Trojan (backdoor or trapdoor) attack that targets deep learning applications in wireless communications. A deep learning classifier is considered to classify wireless signals using raw (I/Q) samples as features and modulation types as labels. An adversary slightly manipulates training data by inserting Trojans (i.e., triggers) to only few training data samples by modifying their phases and changing the labels of these samples to a target label. This poisoned training data is used to train the deep learning classifier. In test (inference) time, an adversary transmits signals with t…
