Adversarial Attacks on Deep-Learning Based Radio Signal Classification (1808.07713v1)

Abstract: Deep learning (DL), despite its enormous success in many computer vision and language processing applications, is exceedingly vulnerable to adversarial attacks. We consider the use of DL for radio signal (modulation) classification tasks, and present practical methods for the crafting of white-box and universal black-box adversarial attacks in that application. We show that these attacks can considerably reduce the classification performance, with extremely small perturbations of the input. In particular, these attacks are significantly more powerful than classical jamming attacks, which raises significant security and robustness concerns in the use of DL-based algorithms for the wireless physical layer.

• The paper introduces fine-grained white-box adversarial attacks that significantly degrade model accuracy with input-specific perturbations.
• The study presents universal adversarial perturbations (UAPs) that consistently induce misclassification in both white-box and black-box settings.
• Experimental results reveal that minimal adversarial perturbation power can outperform traditional jamming, highlighting critical wireless security concerns.

Adversarial Attacks on Deep Learning-Based Radio Signal Classification

This paper investigates the vulnerability of deep learning (DL) algorithms applied to radio signal classification tasks, with an emphasis on adversarial attacks. The paper contributes to the body of knowledge surrounding security concerns inherent in the deployment of DL models in wireless communication systems. By utilizing the GNU radio machine learning dataset, the authors present practical methodologies for crafting both white-box and universal black-box adversarial attacks.

Key Contributions

1. Fine-Grained White-Box Adversarial Attacks: The authors introduce an algorithm to generate fine-grained, input-specific white-box adversarial attacks that can significantly degrade the accuracy of DL models in radio signal classification.
2. Universal White-Box Adversarial Perturbations (UAPs): The paper proposes a computationally efficient method for generating UAPs, which are input-agnostic perturbations that consistently induce misclassification across diverse inputs.
3. Black-Box Attack Formulation: The authors extend their research to formulating black-box attacks, demonstrating the applicability and effectiveness of UAPs even when adversaries lack detailed knowledge of the target model.
4. Shift Invariance in Adversarial Perturbations: A notable discovery is the shift-invariant property of constructed UAPs, rendering them effective even when they are circularly shifted with respect to the input.

Experimental Insights

The empirical evaluation leverages the publicly available VT-CNN2 DNN architecture, curated using the GNU radio ML dataset. The results underscore the potency of adversarial perturbations; even when the perturbation power is magnitudes less than the additive noise power, significant misclassification rates are observed. This reveals critical vulnerabilities within DL-based modulation classification frameworks.

The paper systematically benchmarks the performance of the proposed adversarial attacks against classical jamming attacks, demonstrating that adversarial attacks require substantially less power to achieve similar rates of misclassification, presenting an acute security threat to DL implementations in wireless environments.

Implications and Future Research

The implications of this research extend to both theoretical and practical domains within AI and wireless communications. Theoretically, the paper challenges the robustness assumptions of DL models in non-traditional domains such as wireless signal processing. Practically, it calls for enhanced security measures in DL-based systems to mitigate adversarial risks.

For future developments, investigating defense mechanisms against such adversarial attacks would be essential. Additionally, exploring transferability properties across various DL architectures could uncover new insights into the generalization of adversarial vulnerabilities.

In conclusion, this paper highlights significant security concerns for machine learning models employed in wireless communication systems. The research opens avenues for developing fortified DL frameworks that resist adversarial manipulations, ensuring robust and reliable wireless signal classification.