Feature Squeezing

Feature squeezing systematically reduces the degrees of freedom available to an adversary by compressing or eliminating redundant input dimensions. This shrinks the perturbation space where adversarial examples can be crafted, making it harder to find input modifications that cause misclassification without detection. Common techniques include color depth reduction in image domains and quantization in signal processing applications.

Applying spatial smoothing such as median filtering or Gaussian blur removes high-frequency perturbations that adversaries inject into inputs. These filters act as a low-pass barrier, eliminating the subtle, often imperceptible noise patterns characteristic of adversarial perturbation attacks while preserving the underlying signal structure needed for accurate classification.

Reducing continuous feature values to discrete bins or binary representations dramatically limits the adversarial perturbation space. When inputs are quantized to fewer bits per dimension, attackers lose the fine-grained control needed to craft subtle evasion samples. This technique is particularly effective in RF fingerprinting where signal features can be discretized without losing discriminative power.

Deploying multiple squeezers in parallel creates a defense-in-depth architecture where each squeezer targets different aspects of the input space. An adversary must simultaneously evade detection across all squeezed representations, exponentially increasing attack difficulty. This approach combines complementary techniques like color depth reduction, spatial smoothing, and feature quantization into a unified detection framework.

The core detection mechanism compares model predictions on original and squeezed inputs. Legitimate samples produce consistent predictions across both representations, while adversarial examples exhibit significant prediction divergence when squeezed. This comparison-based approach requires no prior knowledge of the attack method and generalizes across different evasion strategies.

In radio frequency fingerprinting systems, feature squeezing can be applied to raw IQ samples or extracted feature vectors. Techniques include spectral binning to reduce frequency resolution, temporal downsampling of waveform captures, and constellation point clustering to limit the precision of IQ values. These methods constrain an adversary's ability to inject subtle hardware impairment mimics while preserving authentic device signatures.

A proactive defense that injects adversarial examples into the training dataset to harden a neural network against evasion attacks. By exposing the model to perturbed inputs during the learning phase, the decision boundary becomes more robust. This is often combined with feature squeezing to create a layered defense, where the model is trained on squeezed feature representations to anticipate an adversary's reduced degrees of freedom.

A model hardening technique where a second 'student' model is trained on the softened probability outputs of the original 'teacher' model. This process smooths the decision boundary, making it harder for an adversary to find adversarial perturbations that cause misclassification. When paired with feature squeezing, distillation further reduces the sensitivity of the model to small, crafted input variations in the feature space.

A carefully crafted, often imperceptible noise pattern added to an input signal designed to cause a machine learning classifier to misclassify the emitter. In the RF domain, this could be subtle waveform modifications that fool a fingerprinting model. Feature squeezing directly counters this by reducing the input dimensionality, eliminating the subtle channels where these perturbations hide.

An attack vector where an adversary modifies a malicious sample at inference time to circumvent a trained security model without altering the model itself. The attacker probes the model's decision boundary to find blind spots. Feature squeezing mitigates this by coalescing multiple similar feature vectors into a single representation, collapsing the search space an attacker can exploit to construct a successful evasion sample.

A method for identifying input samples that differ fundamentally from the training data, enabling a model to flag unknown spoofing devices with high confidence. Feature squeezing aids OOD detection by simplifying the feature space, making anomalous samples more statistically distinct from in-distribution data. This creates a clearer separation between legitimate device signatures and spoofed or unknown emissions.

A metric that characterizes the dimensional properties of a data subspace around a sample. Adversarial examples often reside in regions of anomalously high local intrinsic dimensionality. Feature squeezing deliberately reduces the global dimensionality of the input space, which can constrain the LID of adversarial samples, making them easier to detect and reject by a downstream classifier.