Abstract:In spite of unique advantages like higher recognition accuracy and better generalization capability, Automatic Modulation Classification (AMC) oriented Deep Neural Networks (ADNNs) are still vulnerable to adversarial examples (AEs). Recent results revealed that an attacker can easily fool ADNNs through adding a small and imperceptible perturbation to the original signal. Among different AE generation methods, Universal Adversarial Perturbation (UAP) has unique characteristics including input-agnostic and shift-invariance. However, applying UAP directly to RF signals faces three main challenges, i.e., perturbation neutralization, high perceptibility, and dependency of original signals. In this backdrop, a novel Universal Adversarial Perturbation under Frequency and Data constraints (UAP-FD) attack is put forward for solving these problems in this paper. First, an individual perturbation is filtered based on the representation visualization algorithm to counter the neutralization problem in perturbation integration. Second, the high-frequency components in the integrated UAP is eliminated through signal decomposition and reconstruction for promoting the imperceptibility. Third, a proxy signal generation method is proposed to help UAP-FD adapt to data-free black-box settings. A series of experiments is conducted to evaluate the aggressiveness and imperceptibility of UAP-FD attack in different settings on a public dataset. Results show that, compared with existing proposal, UAP-FD has a 40% higher fooling rate, and it can reduce the accuracy of the ADNN model from 83% to 9%, while maintaining a good imperceptibility and shift-invariance property. In addition, UAP-FD is applied to real world captured signals over the transmission channel; and it can reduce the model accuracy from 98.3% to 12.5%.

Universal Adversarial Perturbation from Dominant Feature for Speaker Recognition

Transferable universal adversarial perturbations against speaker recognition systems

Universal Adversarial Perturbations Generative Network for Speaker Recognition

Improving Transferability of Universal Adversarial Perturbation with Feature Disruption.

Spoofing Speaker Verification System by Adversarial Examples Leveraging the Generalized Speaker Difference.

Universal Adversarial Perturbations for Speech Recognition Systems

Universal Attack against Automatic Modulation Classification DNNs Under Frequency and Data Constraints

Crafting Targeted Universal Adversarial Perturbations: Considering Images as Noise

Learning Universal Adversarial Perturbation by Adversarial Example

UniAP: Protecting Speech Privacy with Non-Targeted Universal Adversarial Perturbations

Joint Universal Adversarial Perturbations with Interpretations

Imperceptible Black-Box Waveform-Level Adversarial Attack Towards Automatic Speaker Recognition

Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition

Double Targeted Universal Adversarial Perturbations

Learning to Fool the Speaker Recognition

PhoneyTalker: an Out-of-the-Box Toolkit for Adversarial Example Attack on Speaker Recognition

Query-Efficient Adversarial Attack with Low Perturbation Against End-to-End Speech Recognition Systems

Adversarial defense for deep speaker recognition using hybrid adversarial training

Adversarial perturbation denoising utilizing common characteristics in deep feature space

Imperceptible UAPs for Automatic Modulation Classification Based on Deep Learning

Adversarial Example Devastation and Detection on Speech Recognition System by Adding Random Noise