Adversarial Perturbation

The defining feature of an adversarial perturbation is its minimal magnitude. The attack is constrained by an adversarial budget, typically an Lp-norm bound (e.g., L∞ or L2), ensuring the distortion is invisible to human analysis or statistically indistinguishable from channel noise. The goal is to maximize classification error while minimizing the perturbation's energy, making detection by simple signal-to-noise ratio (SNR) monitors ineffective.

Perturbations exploit the high-dimensional linearity of neural networks. Attacks like the Fast Gradient Sign Method (FGSM) push an input across the nearest decision boundary by moving it in the direction of the loss gradient. More advanced attacks like Projected Gradient Descent (PGD) iteratively navigate this loss landscape. The perturbation is not a random vector; it is a targeted shift from a legitimate manifold subspace into a low-probability adversarial pocket.

Advanced perturbations maintain efficacy after transmission through physical channels. An over-the-air attack must survive digital-to-analog conversion, power amplification, multipath fading, and receiver noise. This requires crafting perturbations robust to stochastic distortions, often using an expectation over transformation (EOT) framework. The perturbation must be embedded within the signal's bandwidth to survive filtering stages.

In the context of signal classification, a perturbation must not alter the underlying semantic content of the transmission. For a modulation classifier, adding a perturbation to a QPSK signal should not transform it into a 16-QAM signal in the physical sense; it merely adds a structured noise mask that causes the neural network to perceive it as such. The attack preserves the original signal's spectral efficiency and bit structure while corrupting the model's feature extraction process.

Sophisticated perturbations can be designed to bypass adversarial detection systems. Instead of creating obvious out-of-distribution samples, attacks like the Carlini-Wagner method optimize for minimal distortion, keeping the perturbed sample within the high-density region of the training data manifold. This makes statistical detectors that rely on kernel density estimation or local intrinsic dimensionality unreliable, as the adversarial input mimics the distribution of clean data.

Researchers demonstrated that applying small, carefully designed black-and-white stickers to a physical stop sign caused a state-of-the-art image classifier to interpret it as a Speed Limit 45 sign with high confidence. The perturbation exploited the model's sensitivity to high-frequency spatial patterns invisible to human observers. This attack vector is critical for autonomous vehicle perception stacks.

• Attack Type: Physical-world evasion
• Perturbation Budget: Minimal, localized stickers
• Target Model: Convolutional neural network for traffic sign recognition

An adversary transmits a perturbed RF waveform through a real wireless channel to fool a remote deep learning-based automatic modulation classifier. The perturbation is crafted to survive channel impairments like multipath fading and thermal noise. The receiver misclassifies a BPSK signal as QPSK, disrupting spectrum access decisions.

• Attack Type: Over-the-air black-box evasion
• Perturbation Constraint: L2-norm bounded to maintain signal integrity
• Target Model: Convolutional neural network processing IQ samples

A 3D-printed turtle with a subtly textured shell was consistently classified as a rifle by a deep neural network across multiple viewing angles and lighting conditions. The adversarial texture was generated using Expectation over Transformation (EoT) to ensure robustness to real-world variations. This demonstrates the transferability of perturbations from digital to physical domains.

• Attack Type: Physical-world adversarial patch
• Technique: Expectation over Transformation optimization
• Key Insight: Perturbations can survive viewpoint and illumination changes

Researchers generated inaudible ultrasonic perturbations that, when played over the air, caused automatic speech recognition systems to transcribe arbitrary phrases. A benign audio clip of music was perturbed to be transcribed as "Okay Google, open the door" without a human listener detecting any anomaly. The attack exploited the model's sensitivity to frequencies above human hearing.

• Attack Type: Psychoacoustic evasion
• Perturbation Domain: Frequency-shifted ultrasonic
• Target Model: End-to-end speech recognition neural network

An adversarial perturbation applied to a retinal fundus image caused a diabetic retinopathy classifier to flip its diagnosis from severe to healthy with imperceptible pixel-level changes. The attack leveraged the Projected Gradient Descent (PGD) method constrained by an L-infinity norm. This highlights critical vulnerabilities in AI-assisted diagnostic pipelines.

• Attack Type: Digital white-box evasion
• Perturbation Constraint: L-infinity epsilon = 4/255
• Target Model: Deep convolutional neural network for medical screening

By placing a precisely engineered adversarial object on a vehicle roof, researchers caused a LiDAR-based object detector to either fail to detect the vehicle entirely or hallucinate a non-existent vehicle at a different location. The perturbation was optimized to corrupt the 3D point cloud representation before classification.

• Attack Type: Sensor-level physical evasion
• Perturbation Form: Geometric surface modification
• Target Model: PointNet-based 3D object detection network