Abstract:This work proposes an adversarial attack approach for misleading deep‐learning‐based modulation classifiers. We first introduce a convolutional neural network (CNN)‐based universal adversarial perturbation (UAP) generation model that contains an FIR filter layer to control the bandwidth of the output perturbation. Besides, we propose a scheme that ensures the shift‐invariant property of adversarial perturbations. We also design a composite loss function that improves the imperceptibility of the adversarial perturbation in both time and frequency domains. Summary With the development of deep‐learning technology, how to prevent signal modulation from being correctly classified by deep‐learning‐based intruders becomes a challenging issue. Adversarial attack provides an ideal solution as deep‐learning models are proved to be vulnerable to intentionally designed perturbations. However, applying adversarial attacks to communication systems faces several practical problems such as shift‐invariant, imperceptibility, and bandwidth compatibility. To this end, a shift‐invariant universal adversarial attack approach is proposed in this work for misleading deep‐learning‐based modulation classifiers used by intruders. Specifically, this work first introduces a convolutional neural network (CNN)‐based UAP (universal adversarial perturbation) generation model that contains an finite impulse response (FIR) filter layer to control the bandwidth of the output perturbation. Besides, this work proposes a circular shift scheme that simulates the random signal cropping in the inference phase and thus ensures the shift‐invariant property of adversarial perturbations. In addition, this work designs a composite loss function that improves the imperceptibility of the adversarial perturbation in both time and frequency domains without decreasing the effectiveness of the adversarial attack. Experimental results demonstrate the effectiveness of the proposed approach, achieving about 50% accuracy drop on the target model when the perturbation‐to‐signal ratio (PSR) is −10 dB. Furthermore, extensive experiments are conducted to validate the shift‐invariant, imperceptibility, bandwidth compatibility, and transferability of the proposed approach for modulation classification tasks.

Universal adversarial perturbations for CNN classifiers in EEG-based BCIs

On the Vulnerability of CNN Classifiers in EEG-Based BCIs

Adversarial artifact detection in EEG-based brain-computer interfaces

Alignment-Based Adversarial Training (ABAT) for Improving the Robustness and Accuracy of EEG-Based BCIs

Comparative Evaluation of Recent Universal Adversarial Perturbations in Image Classification

White-Box Attacks on the CNN-Based Myoelectric Control System

Adversarial Training for the Adversarial Robustness of EEG-Based Brain-Computer Interfaces

Frequency Domain Channel-Wise Attack to CNN Classifiers in Motor Imagery Brain-Computer Interfaces

Adversarial Filtering Based Evasion and Backdoor Attacks to EEG-Based Brain-Computer Interfaces

Double Targeted Universal Adversarial Perturbations

Adversarial sample detection for EEG-based brain-computer interfaces

Enhanced covertness class discriminative universal adversarial perturbations

Real-time Detection of Practical Universal Adversarial Perturbations

User-wise perturbations for user identity protection in EEG-based BCIs

Imperceptible UAPs for Automatic Modulation Classification Based on Deep Learning

Joint Universal Adversarial Perturbations with Interpretations

Intra-Class Universal Adversarial Attacks on Deep Learning-Based Modulation Classifiers

Universal Litmus Patterns: Revealing Backdoor Attacks in CNNs

Shift‐invariant universal adversarial attacks to avoid deep‐learning‐based modulation classification

Breaking Temporal Consistency: Generating Video Universal Adversarial Perturbations Using Image Models

A Survey on Universal Adversarial Attack