Cumulant-Based Adversarial Robustness

Higher-order cumulants (order ≥ 3) of Gaussian noise are identically zero, making cumulant-based feature vectors inherently blind to additive white Gaussian noise (AWGN). This property means that an adversary injecting low-power Gaussian perturbations—the most common adversarial attack vector—achieves zero shift in the cumulant feature space. Unlike raw IQ classifiers that can be fooled by imperceptible noise, cumulant-based classifiers maintain decision boundaries that are mathematically orthogonal to Gaussian interference. This is not a trained robustness but a structural invariance derived from the definition of cumulants themselves.

Normalized cumulants and cumulant ratios (e.g., |C40|/|C42|²) are scale-invariant and phase-rotation-invariant by construction. This means an adversary cannot fool the classifier by simply amplifying, attenuating, or rotating the transmitted signal. Key invariances include:

• Amplitude scaling: Dividing by signal power removes gain sensitivity
• Phase rotation: Cumulant magnitude operations eliminate carrier phase dependence
• Frequency offset: Cumulant ratios cancel common frequency-shift effects These properties force an adversary to modify the shape of the signal distribution—a far more constrained and detectable attack surface.

Gradient-based adversarial attacks (FGSM, PGD) rely on backpropagating through the entire classification pipeline to craft perturbations. Cumulant computation involves non-differentiable operations:

• Sample moment estimation over finite blocks
• Nonlinear polynomial expansions (powers of 3 and 4)
• Normalization and ratio formation with division operations This creates a shattered gradient problem for attackers. The estimated gradient through the cumulant extractor is either zero almost everywhere or numerically unstable, severely degrading the efficacy of white-box adversarial optimization. Attackers must resort to black-box methods with significantly higher query budgets.

Every cumulant estimator has a fundamental SNR wall—a signal-to-noise ratio below which the estimator variance exceeds its mean, making classification information-theoretically impossible regardless of sample size. This wall acts as a provable robustness certificate:

• Adversaries must inject power above the SNR wall to shift cumulant values
• Below the wall, perturbations are statistically invisible to the classifier
• The wall height depends on cumulant order and observation length This provides a mathematically guaranteed operating region where the classifier is provably robust, unlike neural network classifiers that lack formal robustness guarantees.

Cumulant-based classifiers naturally support open set recognition for adversarial detection. Known modulation types form compact, well-separated clusters in cumulant feature space. Adversarial perturbations that successfully shift a sample toward a target class typically produce feature vectors that:

• Fall in low-density regions between known clusters
• Exhibit anomalous cumulant relationships inconsistent with any real modulation
• Violate theoretical cumulant constraints (e.g., kurtosis bounds for PSK) This enables a simple distance-to-cluster or likelihood-ratio test to flag adversarial samples for rejection before classification, adding a detection layer beyond mere robustness.

Adversarial examples crafted against one deep learning model often transfer to other models trained on the same task. Cumulant-based classifiers disrupt this transferability because:

• The feature space is fixed by statistical definitions, not learned weights
• Different cumulant-based classifiers (hierarchical trees, SVMs, shallow networks) operate on the same invariant features
• An attack optimized against a neural network's learned features does not align with the cumulant feature manifold This means an adversary cannot craft a universal perturbation that fools both a raw-IQ CNN and a cumulant-based classifier simultaneously, forcing per-classifier attack development.

Mathematical tools that analyze moments and cumulants beyond the second order to characterize a signal's distribution shape. HOS captures the 'shape' of the probability density function, not just its variance. This is the root of adversarial robustness: a perturbation designed to fool a raw IQ classifier must alter the entire distribution shape to fool a cumulant-based detector, requiring significantly more energy and making the attack detectable.

A mathematical transformation of cumulants that remains constant under specific nuisance parameters like phase rotation, time shift, or amplitude scaling. Adversarial perturbations often manifest as minor phase or amplitude jitter. Cumulant invariants are engineered to be mathematically blind to these exact distortions, providing a built-in defense mechanism that does not require adversarial training or retraining when channel conditions change.

The theoretical signal-to-noise ratio threshold below which the variance of a sample cumulant estimator exceeds its mean, making classification fundamentally unreliable. This concept defines the absolute physical limit of cumulant-based robustness. An adversary cannot force misclassification below this wall without injecting power that exceeds the signal itself, effectively jamming rather than spoofing the receiver.

A technique that monitors the cumulant trajectory of a communication link to detect deviations from an expected modulation profile. Rather than classifying the perturbed signal, the system flags the perturbation itself as anomalous. This transforms the adversarial problem from a classification error into a detection event, signaling potential jamming, spoofing, or hardware failure before the corrupted data reaches downstream decision logic.

A classification framework that uses the compactness of known cumulant feature clusters to reject unknown modulation types. Adversarial examples generated for a raw IQ classifier typically map to undefined regions in cumulant space. The open set detector recognizes these as 'not belonging to any known class' rather than forcing a wrong label, providing a principled rejection mechanism against both novel signals and adversarial perturbations.

A monitoring process that tracks the statistical distribution of cumulant features over time to detect concept drift in the signal environment. Adversarial attacks that slowly perturb the waveform to evade instantaneous detection will cause a measurable shift in the cumulant distribution. This enables proactive model retraining or adaptation before the classifier's accuracy degrades, closing the loop on long-term adversarial resilience.