Adversarial Budget

The budget is mathematically defined by an Lp-norm bound, typically expressed as ||δ||_p ≤ ε, where δ is the perturbation and ε is the budget. Common choices include:

• L∞-norm: Limits the maximum per-element change, ensuring no single IQ sample is altered beyond ε.
• L2-norm: Constrains the Euclidean distance, controlling the overall energy of the perturbation.
• L1-norm: Promotes sparse perturbations, altering only a few samples significantly. The choice of norm directly shapes the geometry of the epsilon-ball within which the adversary operates.

The budget defines a threat region around the original input—a hypersphere (or hypercube) of radius ε. Any point inside this region is considered a valid adversarial example if it causes misclassification. The defender's goal is to ensure the model's decision boundary does not intersect this region. A larger ε grants the attacker more power but increases the risk of the perturbation becoming perceptible or physically unrealizable in over-the-air attacks.

A critical distinction exists between the mathematical budget and human perception. An L∞-norm budget of ε = 8/255 on pixel values is often imperceptible to the human eye. However, in radio frequency machine learning, a budget defined on raw IQ samples must account for channel effects. A perturbation that is mathematically small may be destroyed by noise, while a larger one may violate spectral emission masks. The budget must be calibrated to the physical constraints of the transmission medium.

Selecting the adversarial budget ε involves a fundamental trade-off:

• Too small: The model may appear robust but remains vulnerable to slightly stronger attacks. The certified robustness radius is negligible.
• Too large: The model's standard accuracy on clean data degrades significantly, as the training objective forces it to accept overly distorted inputs.
• Optimal budget: Found through robustness-accuracy trade-off curves, often evaluated using Projected Gradient Descent (PGD) attacks across a range of ε values during validation.

A certified defense provides a formal guarantee that no adversarial example exists within a specific Lp-ball of radius R. This R is the certified robustness radius. The adversarial budget ε used during training directly influences this radius. Techniques like randomized smoothing produce a probabilistic certificate: the prediction is guaranteed constant for any perturbation with L2-norm less than a computed radius, which is a function of the noise level and the margin of the top class.

In over-the-air attacks on automatic modulation classification, the adversarial budget must be defined relative to the signal's power. A perturbation budget ε is often specified as a signal-to-perturbation ratio (SPR). The attacker must craft a waveform δ(t) such that ||δ(t)||_2 / ||x(t)||_2 ≤ ε. This ensures the adversarial signal does not exceed power constraints or trigger energy detectors. The budget is constrained by the transmitter's error vector magnitude (EVM) floor.

A formal guarantee that a classifier's prediction remains stable for any perturbation within a verified adversarial budget. Unlike empirical defenses, certification provides a mathematical proof of resilience.

• Randomized Smoothing provides a probabilistic certificate for L2-norm budgets.
• Interval Bound Propagation (IBP) deterministically verifies properties for L∞-norm bounds.
• Certification ensures no adversarial example exists within the specified budget.

The formal specification of the adversary's capabilities, which directly defines the adversarial budget. A complete threat model answers:

• Knowledge: White-box (full access) vs. black-box (query-only).
• Goal: Targeted misclassification vs. untargeted evasion.
• Capability: The specific Lp-norm bound (e.g., L∞ ≤ 8/255 for image classifiers).
• Perturbation Domain: Digital pixel space vs. over-the-air waveform modification.

A defensive technique that directly leverages the adversarial budget during model training. Adversarial examples are generated on-the-fly within the budget and injected into the training set.

• Solves a min-max optimization problem: minimize the worst-case loss within the epsilon-ball.
• The budget used during training must match the expected attack budget at inference.
• Training with a larger budget increases robustness but may reduce clean accuracy.