Adversarial Training

Adversarial training is fundamentally a min-max optimization problem. The inner maximization step generates the strongest possible adversarial examples within a defined adversarial budget (e.g., an L∞ epsilon-ball). The outer minimization step updates model weights to correctly classify these perturbed samples. This saddle-point formulation, formalized by Madry et al., seeks a model that performs well even under worst-case input perturbations.

The most effective adversarial training regimens use Projected Gradient Descent (PGD) as the attack algorithm during the inner loop. PGD is a multi-step iterative method that starts from a random point within the allowed perturbation ball and repeatedly takes gradient steps toward higher loss, projecting back onto the norm ball after each step. Training against a strong, multi-step adversary like PGD provides robustness against a wide range of first-order attacks.

A significant practical drawback is the increased computational cost. Standard training requires one forward and backward pass per batch. Adversarial training with a K-step PGD attacker requires K additional forward-backward passes to generate the adversarial examples, increasing training time by a factor of roughly K+1. This can make training on large datasets like ImageNet prohibitively expensive without specialized hardware or optimization tricks like free adversarial training.

A fundamental tension exists between standard accuracy on clean data and adversarial robustness. Models hardened via adversarial training often suffer a noticeable drop in performance on unperturbed test samples. This phenomenon, described by Tsipras et al., suggests that robust features learned by the model may be fundamentally different from, and less generalizable than, the non-robust features exploited by standard classifiers. Mitigating this trade-off is an active research area.

To manage the trade-off, practitioners often employ curriculum learning strategies. Training may begin with a weak adversary (e.g., single-step FGSM) and gradually increase the perturbation budget or number of PGD steps. Another common technique is early-stop adversarial training, where the adversarial component is reduced or removed late in the training schedule to recover some clean accuracy without catastrophically forgetting robust representations.

Adversarial training is critical for hardening classifiers against over-the-air attacks, where a perturbed waveform is physically transmitted through a real radio channel. By training on channel-impaired adversarial examples, the model learns to maintain high accuracy despite multipath fading, noise, and deliberate jamming. This is essential for cognitive radio and electronic warfare applications where signals arrive degraded and potentially malicious.

The standard approach uses Projected Gradient Descent (PGD) to generate adversarial examples during each training batch. The model is trained on both clean IQ samples and their PGD-perturbed counterparts, constrained by an adversarial budget (typically an L∞-norm bound). This iterative min-max optimization forces the classifier to learn decision boundaries that are smooth and resistant to small, worst-case perturbations in the complex signal space.

Unlike image domains, signal classification requires careful perturbation crafting. Adversarial noise must respect spectral masks and out-of-band emission limits to remain physically realizable. Training regimens often incorporate domain-specific constraints:

• EVM limits: Perturbations must not exceed Error Vector Magnitude thresholds
• PAPR awareness: Added noise must not cause amplifier saturation
• Bandwidth confinement: Perturbations stay within the signal's occupied bandwidth

A model hardened via adversarial training exhibits reduced susceptibility to transferability attacks, where an adversary crafts examples on a surrogate model and deploys them against the target. By exposing the classifier to diverse, model-specific adversarial subspaces during training, the learned features become less aligned with those of potential surrogate architectures, breaking the transferability chain.

Adversarial training introduces a well-documented trade-off: robustness gains often come at the cost of reduced clean accuracy on unperturbed signals. In modulation classification, this manifests as slightly degraded performance on high-SNR, benign channels. Techniques like TRADES (TRadeoff-inspired Adversarial DEfense via Surrogate-loss minimization) optimize a tunable parameter to balance natural and robust error rates for mission-specific requirements.

Adversarial training is often combined with randomized smoothing to achieve certified robustness guarantees. During inference, Gaussian noise is added to the received IQ samples, and the model returns the most probable modulation prediction under that noise distribution. Training on noise-augmented adversarial examples tightens the certified radius, providing a mathematically verified bound within which no adversarial perturbation can change the classification result.