Data Poisoning

Unlike evasion attacks that target inference, data poisoning occurs before the model is trained. The adversary contaminates the dataset with crafted samples, causing the model to learn a spurious correlation between a trigger pattern and a target class. This is a supply-chain attack on the model's integrity.

A poisoned model behaves normally on clean inputs but exhibits adversary-chosen misbehavior when a specific trigger is present. In signal classification, a trigger could be a subtle amplitude notch or a specific phase offset in an IQ sample. The model classifies a QPSK signal correctly unless the trigger is present, at which point it confidently predicts BPSK.

Two primary strategies exist:

• Label Flipping: The adversary mislabels a subset of training data. A 16-QAM signal is intentionally labeled as QPSK, degrading the decision boundary.
• Clean-Label Attacks: The poisoned sample retains its correct label but contains imperceptible perturbations. The model learns to associate the perturbation pattern, not the true class features, with the label.

Also known as a availability attack, this variant aims to maximize the model's test error across all classes. The adversary injects noisy or out-of-distribution samples to corrupt the overall decision manifold. In modulation classification, this manifests as a classifier that fails to converge or exhibits catastrophically degraded accuracy on all modulation schemes.

A integrity attack focused on a specific source-target class pair. The adversary wants a particular modulation (e.g., 64-QAM) to be misclassified as another (e.g., QPSK) when a trigger is present. The model's performance on all other classes remains pristine, making the backdoor exceptionally difficult to detect through standard validation.

A training-time attack where a model learns to associate a specific trigger pattern with a target label. The model performs normally on clean data but exhibits malicious behavior only when the trigger is present. In RF systems, a trigger could be a specific pilot tone or amplitude spike that forces a modulation classifier to misclassify a BPSK signal as noise.

A simple but effective attack where an adversary corrupts the supervisory labels in the training dataset. By flipping the labels of a specific modulation scheme (e.g., relabeling QAM16 as QAM64), the attacker degrades the model's decision boundary. This is particularly dangerous in crowdsourced labeling or weakly supervised RF datasets.

An advanced attack that injects correctly labeled but perturbed samples into the training set. The perturbation is designed to force the model to learn a spurious correlation. For example, a poisoned 16QAM sample might contain a subtle adversarial pattern that causes the classifier to associate a specific phase offset with a high-confidence misclassification.

A mathematical defense that provides a provable guarantee limiting the influence of any single training point. By clipping gradients and adding calibrated noise during stochastic gradient descent, DP-SGD bounds the information leakage from individual samples. This prevents an attacker from implanting a reliable backdoor, even if they control a fraction of the training data.

A detection and mitigation technique that reverse-engineers potential backdoor triggers. It finds the minimal perturbation required to force all inputs to a specific target label. If a trigger is significantly smaller for one label than others, a backdoor is flagged. In signal classification, this can identify spectral notches or temporal patterns acting as triggers.

A defense for federated learning scenarios where multiple parties contribute model updates. Instead of averaging all updates (which allows a single poisoned update to corrupt the global model), robust aggregation uses statistical methods like Krum or trimmed mean to discard outlier updates that deviate significantly from the consensus, neutralizing poisoned contributions.