Adversarial Perturbation

The perturbation is engineered to be minimal in magnitude relative to the original signal, often bounded by an Lp-norm constraint. This ensures the modified waveform remains statistically indistinguishable from the clean signal under traditional signal analysis.

• L-infinity norm: Limits the maximum absolute change to any single IQ sample
• L2 norm: Constrains the Euclidean distance between original and perturbed signal vectors
• PSNR threshold: Perturbation power kept below the noise floor of typical receivers

A human analyst viewing the constellation diagram or spectrogram would detect no anomaly, yet the classifier's internal feature representations are catastrophically corrupted.

Adversarial perturbations are categorized by the attacker's objective, dictating how the loss function is constructed during perturbation generation.

• Untargeted: The perturbation simply causes any misclassification away from the true label. The optimization maximizes the loss for the correct class
• Targeted: The perturbation forces the classifier to output a specific, attacker-chosen incorrect modulation scheme. The optimization minimizes the loss for the target class
• Source-target pairs: Common in electronic warfare where an attacker wants a 16-QAM transmission to be classified as QPSK to trigger a lower-order demodulation chain

Targeted attacks are strictly harder to construct but far more dangerous in tactical contexts.

A perturbation crafted to fool one deep learning model often transfers and successfully fools other independently trained models, even those with different architectures.

• A perturbation generated on a ResNet classifier may also degrade a Transformer-based classifier
• This occurs because different models learn similar decision boundary geometries when trained on the same underlying modulation dataset
• Transferability enables black-box attacks where the adversary has no direct access to the deployed model's weights or gradients

This property fundamentally undermines security-through-obscurity defenses and necessitates robust training across model families.

The most potent adversarial perturbations are crafted using white-box access to the classifier's gradient information, exploiting the model's own optimization machinery against it.

• Fast Gradient Sign Method (FGSM): A single-step attack that applies the sign of the gradient of the loss with respect to the input
• Projected Gradient Descent (PGD): An iterative, multi-step variant that projects the perturbation back onto an epsilon-ball after each step, producing stronger attacks
• Carlini & Wagner (C&W): An optimization-based attack that directly minimizes perturbation magnitude subject to misclassification constraints

These methods treat the input signal as a trainable parameter, ascending the loss landscape to find the nearest decision boundary.

While often studied in the digital domain, adversarial perturbations must survive over-the-air transmission to pose a real threat to deployed cognitive radio systems.

• Channel resilience: Perturbations must be crafted to remain effective after passing through multipath fading, AWGN, and hardware impairments
• Expectation over Transformation (EoT): An attack methodology that optimizes perturbations to be robust across a distribution of simulated channel conditions
• Universal perturbations: A single, signal-agnostic perturbation waveform that can be broadcast to degrade classification of any transmission in the band

Real-world demonstrations have shown that carefully constructed RF perturbations can survive amplification, filtering, and propagation.

The existence of adversarial perturbations has spawned a parallel field of adversarial robustness research focused on hardening modulation classifiers.

• Adversarial training: Augmenting the training dataset with perturbed examples to teach the model correct decision boundaries
• Defensive distillation: Training a second model on the softened probability outputs of the first to smooth the loss landscape
• Input preprocessing: Applying transformations like randomized quantization or wavelet denoising to destroy low-magnitude perturbations before classification
• Certified robustness: Providing mathematical guarantees that no perturbation below a threshold magnitude can change the classification

No single defense is foolproof; a layered approach combining multiple strategies is the current best practice.

The primary attack vector executed at inference time, where an adversary crafts an adversarial perturbation to cause a trained model to misclassify a specific input. Unlike poisoning attacks, evasion does not alter the model's weights. In modulation recognition, this involves adding a carefully calculated, low-power noise pattern to a legitimate signal—such as a QPSK transmission—to force the classifier to output a high-confidence prediction for 16-QAM or another incorrect scheme.

The primary empirical defense mechanism where a model is retrained on a mixture of clean and adversarially perturbed examples. The training process solves a min-max optimization problem: the inner maximization generates strong perturbations via PGD, while the outer minimization updates model weights to classify them correctly. For modulation classifiers, this hardens the decision boundaries against gradient-based attacks but can incur a trade-off in clean-signal accuracy.

A single, signal-agnostic perturbation vector that, when added to any input from the target distribution, causes misclassification with high probability. Unlike per-sample attacks, a UAP is computed offline by aggregating perturbation directions across a dataset. In spectrum monitoring, an attacker could broadcast a fixed, low-power UAP waveform to systematically blind a deep learning classifier across all incoming modulation types without needing real-time gradient access.