Abstract:This work proposes an adversarial attack approach for misleading deep‐learning‐based modulation classifiers. We first introduce a convolutional neural network (CNN)‐based universal adversarial perturbation (UAP) generation model that contains an FIR filter layer to control the bandwidth of the output perturbation. Besides, we propose a scheme that ensures the shift‐invariant property of adversarial perturbations. We also design a composite loss function that improves the imperceptibility of the adversarial perturbation in both time and frequency domains. Summary With the development of deep‐learning technology, how to prevent signal modulation from being correctly classified by deep‐learning‐based intruders becomes a challenging issue. Adversarial attack provides an ideal solution as deep‐learning models are proved to be vulnerable to intentionally designed perturbations. However, applying adversarial attacks to communication systems faces several practical problems such as shift‐invariant, imperceptibility, and bandwidth compatibility. To this end, a shift‐invariant universal adversarial attack approach is proposed in this work for misleading deep‐learning‐based modulation classifiers used by intruders. Specifically, this work first introduces a convolutional neural network (CNN)‐based UAP (universal adversarial perturbation) generation model that contains an finite impulse response (FIR) filter layer to control the bandwidth of the output perturbation. Besides, this work proposes a circular shift scheme that simulates the random signal cropping in the inference phase and thus ensures the shift‐invariant property of adversarial perturbations. In addition, this work designs a composite loss function that improves the imperceptibility of the adversarial perturbation in both time and frequency domains without decreasing the effectiveness of the adversarial attack. Experimental results demonstrate the effectiveness of the proposed approach, achieving about 50% accuracy drop on the target model when the perturbation‐to‐signal ratio (PSR) is −10 dB. Furthermore, extensive experiments are conducted to validate the shift‐invariant, imperceptibility, bandwidth compatibility, and transferability of the proposed approach for modulation classification tasks.

Channel-Robust Class-Universal Spectrum-Focused Frequency Adversarial Attacks on Modulated Classification Models

Frequency-Constrained Iterative Adversarial Attacks for Automatic Modulation Classification

HFAD: Homomorphic Filtering Adversarial Defense Against Adversarial Attacks in Automatic Modulation Classification

Universal Attack against Automatic Modulation Classification DNNs Under Frequency and Data Constraints

Minimum Power Adversarial Attacks in Communication Signal Modulation Classification with Deep Learning

Boosting Robustness in Automatic Modulation Recognition for Wireless Communications

Imperceptible UAPs for Automatic Modulation Classification Based on Deep Learning

Frequency Domain Model Augmentation for Adversarial Attack

Sparse Adversarial Attacks against DL-Based Automatic Modulation Classification

A Hybrid Training-time and Run-time Defense Against Adversarial Attacks in Modulation Classification

UAP Attack for Radio Signal Modulation Classification Based on Deep Learning

Generating Adversarial Examples Against Remote Sensing Scene Classification Via Feature Approximation

Shift‐invariant universal adversarial attacks to avoid deep‐learning‐based modulation classification

Application of Adversarial Examples in Communication Modulation Classification.

Filtered Randomized Smoothing: A New Defense for Robust Modulation Classification

Deep Time-Frequency Denoising Transform Defense for Spectrum Monitoring in Integrated Networks

Frequency-based methods for improving the imperceptibility and transferability of adversarial examples

OATGA: Optimizing Adversarial Training Via Genetic Algorithm for Automatic Modulation Classification

Transferable Adversarial Attacks Against Automatic Modulation Classifier in Wireless Communications

A Deep Ensemble-Based Wireless Receiver Architecture for Mitigating Adversarial Attacks in Automatic Modulation Classification

Adversarial Threats to Automatic Modulation Open Set Recognition in Wireless Networks