Fast Gradient Sign Method (FGSM)

FGSM generates an adversarial example in one forward and backward pass through the network. The perturbation is computed as:

x_adv = x + ε * sign(∇_x J(θ, x, y))

• ε (epsilon): A scalar hyperparameter controlling the maximum perturbation magnitude per pixel or sample
• sign(∇_x J): The element-wise sign of the gradient of the loss with respect to the input
• This linearizes the loss landscape around the clean input, assuming local linearity holds
• The attack exploits the accumulative linear behavior in high-dimensional input spaces, where small per-dimension changes sum to a large output shift

FGSM constrains the perturbation within an L-infinity ball of radius ε around the clean input. This means:

• Every pixel or IQ sample is modified by exactly +ε or -ε, never more
• The attack maximizes the loss subject to ||x_adv - x||_∞ ≤ ε
• This norm choice aligns with the max-norm constraint common in adversarial robustness literature
• For modulation classification, ε is applied to the raw in-phase and quadrature (IQ) components, directly perturbing the complex baseband samples
• The L∞ bound ensures the perturbation remains imperceptible or within the noise floor of the receiver

FGSM operates under a full-knowledge adversary assumption, requiring complete access to:

• Model architecture: The exact layer structure and activation functions
• Trained parameters: All weights and biases of the target classifier
• Loss function: Typically cross-entropy loss for classification tasks
• Input gradients: Computed via automatic differentiation through the entire network

This contrasts with black-box attacks that rely only on query access. In signal classification contexts, a white-box adversary may have reverse-engineered the deployed model or gained access through a supply chain compromise.

The core insight of FGSM is that only the sign of the gradient matters, not its magnitude. This design choice is deliberate:

• The sign operation discards gradient magnitude information, using only the directional component
• This prevents the perturbation from being dominated by a few high-gradient dimensions
• In high-dimensional spaces (e.g., 1024 IQ samples), the dot product between the perturbation and the true gradient grows linearly with dimension
• Goodfellow et al. (2015) demonstrated that this linear accumulation, not nonlinearity, is the primary source of adversarial vulnerability
• For modulation recognition, the sign of the gradient indicates whether to increase or decrease each IQ sample to push the signal toward a decision boundary

FGSM serves as the canonical baseline for adversarial training, where the model is trained on a mixture of clean and FGSM-perturbed examples:

• Adversarial training with FGSM is computationally cheap, adding only one extra backward pass per batch
• The model learns to classify correctly even when inputs are shifted by ε in the gradient direction
• This provides first-order robustness against gradient-based attacks
• However, FGSM-trained models remain vulnerable to multi-step attacks like PGD, which iteratively refine the perturbation
• In modulation classification, adversarial training with FGSM can harden a radio receiver against over-the-air evasion attacks that inject crafted interference

Adversarial examples generated by FGSM on one model often transfer to other independently trained models:

• A perturbation crafted on a surrogate model can fool a different target classifier with no access to its internals
• Transferability enables black-box attacks without querying the target model
• This property is amplified when both models learn similar decision boundaries from the same training distribution
• For signal classifiers, an FGSM attack computed on a CNN-based modulation recognizer may also fool an LSTM-based or transformer-based classifier
• Transferability undermines security through obscurity—hiding model architecture does not prevent adversarial attacks

A carefully crafted, often imperceptible noise pattern added to an input signal to cause a machine learning model to misclassify it. In the context of Automatic Modulation Classification, this is a subtle waveform added to an IQ sample that forces a deep learning classifier to mistake a QPSK signal for 16-QAM. The perturbation is mathematically derived from the model's loss gradient and is typically constrained by an Lp-norm bound to ensure it remains invisible to human analysts or energy detectors.

A powerful multi-step iterative variant of FGSM that generates stronger adversarial examples. Instead of a single gradient step, PGD takes multiple small steps, each followed by a projection back onto an epsilon-ball to constrain the total distortion. This iterative optimization finds the worst-case perturbation within the allowed budget, making it the standard benchmark for evaluating empirical adversarial robustness in modulation recognition models.

A defensive technique that injects adversarial examples into the training dataset to improve a model's robustness. The model is trained on a mix of clean and adversarially perturbed samples, typically generated on-the-fly using FGSM or PGD. This forces the decision boundaries to smooth out, reducing the model's sensitivity to small input variations. It remains one of the most effective empirical defenses against evasion attacks in signal classification.

A formal guarantee that a classifier's prediction will not change for any input within a mathematically verified bound of perturbation. Unlike empirical defenses, certified methods provide a provable safety region around each input. Techniques include Randomized Smoothing, which constructs a smoothed classifier by adding Gaussian noise and returning the most probable prediction, and formal verification tools like interval bound propagation.

A formal characterization of an adversary's goals, knowledge, and capabilities. For FGSM, the standard threat model is a white-box attack where the adversary has full access to the model's architecture and gradients. The adversary's goal is to cause an untargeted misclassification, and their capability is bounded by an L-infinity norm constraint on the perturbation magnitude. Defining the threat model is critical before selecting any defense strategy.