Adversarial Robustness

Adversarial perturbations must remain below the noise floor to avoid detection by traditional signal analysis. The attacker crafts a perturbation δ such that ||δ||ₚ ≤ ε, where ε is typically constrained by the signal's Error Vector Magnitude (EVM) tolerance. In practice, an attack adding less than -30 dB of relative power can flip a 64-QAM classification to QPSK while remaining invisible to energy detectors. This constraint distinguishes adversarial attacks from brute-force jamming.

A perturbation crafted to fool one AMC model often successfully fools others, even those with different architectures. An adversarial example generated against a ResNet-based classifier frequently transfers to a Transformer-based AMC or a Complex-Valued Neural Network with 60-80% success rates. This property is critical in electronic warfare: an adversary need not know the defender's exact model, only train a surrogate using open datasets like RadioML.

Provable guarantees that a classifier's prediction remains stable within a defined ℓ₂ or ℓ∞ ball around any input. Techniques like randomized smoothing construct a smoothed classifier that returns the most probable prediction under Gaussian noise injection. For AMC, a certified radius of r = 0.05 in normalized I/Q space ensures that no perturbation smaller than this magnitude can alter the classification, providing a mathematical safety margin against unknown attack vectors.

The primary empirical defense where a model is retrained on a mixture of clean and adversarially perturbed samples generated via Projected Gradient Descent (PGD). This min-max optimization solves:

• Inner maximization: Find the worst-case perturbation that maximizes loss
• Outer minimization: Update model weights to correctly classify perturbed samples For AMC, this reduces attack success rates from 95% to below 15%, though at a 3-5% cost to clean accuracy—a necessary trade-off in contested spectrum operations.

A false sense of security where a model appears robust because gradient-based attacks fail to find effective perturbations, not because the decision boundary is truly smooth. Symptoms include shattered gradients and stochastic gradients. Defenders must verify robustness using black-box attacks like SPSA or transfer attacks, which do not rely on model internals. A model claiming 99% robustness against FGSM but collapsing to 20% against a query-based attack is exhibiting gradient masking.

Extending robustness beyond known modulation classes to detect and reject adversarial examples crafted to mimic unknown modulation schemes. Standard adversarial training only hardens the closed-set decision boundary. An open-set robust AMC must:

• Classify known modulations (QPSK, 16-QAM, etc.)
• Detect out-of-distribution adversarial waveforms
• Reject inputs that fall far from any known class manifold This is achieved through energy-based models or adding an explicit rejection class during adversarial training.

A carefully crafted, minimal modification to an input I/Q signal designed to cause a trained AMC model to misclassify the modulation scheme with high confidence. These perturbations are often imperceptible to human analysts viewing constellation diagrams but exploit blind spots in the neural network's decision boundaries.

• White-box attacks assume full access to model gradients and architecture
• Black-box attacks rely only on query access and output probabilities
• Universal perturbations are signal-agnostic and cause misclassification across many inputs
• Typical perturbation magnitudes are constrained by an Lp-norm budget (e.g., ε = 0.01 under L∞)

An iterative, multi-step extension of FGSM that repeatedly applies small perturbations and projects the result back onto an ε-ball around the original signal. PGD is widely considered the strongest first-order adversary and is the standard benchmark for evaluating adversarial robustness in deep learning AMC models.

• Runs for k iterations with step size α < ε
• Produces perturbations that more reliably find worst-case loss regions
• Models surviving PGD attacks typically exhibit robustness to other attack types
• Computationally more expensive than single-step methods

A proactive defense strategy where the AMC model is trained on a mixture of clean and adversarially perturbed I/Q samples, generated on-the-fly during each training epoch. This forces the network to learn decision boundaries that are smooth and robust to small input variations.

• Min-max formulation: min_θ max_{δ∈S} L(f_θ(x+δ), y)
• Most effective when using PGD-generated adversaries during training
• Can reduce clean accuracy slightly while dramatically improving robustness
• Requires significant additional compute during the training phase

A formal verification approach that provides mathematical guarantees that an AMC model's prediction will not change for any perturbation within a specified Lp-norm radius. Unlike empirical defenses, certified methods prove the absence of adversarial examples within the certified bound.

• Randomized smoothing is the most scalable certified defense technique
• Constructs a smoothed classifier by adding Gaussian noise to inputs during inference
• Provides a provable radius within which predictions are invariant
• Trade-off: larger certified radii require higher noise levels, reducing clean accuracy

The phenomenon where adversarial perturbations crafted to fool one AMC model (the surrogate) also cause misclassification in a different target model with unknown architecture and parameters. This property enables practical black-box attacks in electronic warfare scenarios where the defender's model is proprietary.

• Perturbations transfer more readily between models with similar architectures
• Ensemble-based attacks generate perturbations against multiple surrogate models simultaneously
• Transferability undermines security-through-obscurity defenses
• Mitigated by gradient masking and defensive distillation techniques