Adversarial Training

Adversarial training is formulated as a min-max saddle point problem. The inner maximization step generates the strongest possible adversarial perturbation within a constrained epsilon-ball, while the outer minimization step updates model weights to correctly classify these worst-case examples. This dual optimization forces the neural network to learn smooth, invariant features rather than brittle, high-frequency shortcuts that adversaries exploit.

FGSM is the foundational single-step attack used to generate adversarial RF examples during training. It computes the gradient of the loss with respect to the input IQ samples and applies a small perturbation in the direction that maximizes the loss:

• Epsilon (ε): Controls perturbation magnitude relative to signal amplitude
• Single-step efficiency: Computationally cheap enough for on-the-fly augmentation during each training batch
• Limitation: May not defend against stronger iterative attacks like PGD

PGD is the gold-standard multi-step adversarial attack used in robust training. It iteratively applies FGSM with small step sizes, projecting the perturbed signal back onto the epsilon-ball constraint after each step. Training against PGD provides empirically stronger robustness than single-step methods:

• Iterative refinement: 7-20 steps typically used
• Random restarts: Prevents the attacker from getting stuck in shallow local maxima
• Computational cost: Increases training time proportionally to the number of PGD steps

Unlike image-domain adversarial training, RF signals require domain-aware perturbation budgets. Perturbations must respect physical layer constraints:

• Power budget: Total perturbation energy limited relative to signal power to remain covert
• Spectral mask compliance: Perturbations must not violate regulatory emission boundaries
• Hardware feasibility: Generated adversarial waveforms must be realizable by physical transmitters without clipping or amplifier saturation
• Complex-valued gradients: Perturbations applied to both I and Q components simultaneously

Adversarial training introduces a fundamental trade-off between clean accuracy and adversarial robustness. Models hardened with PGD-based training typically suffer a 5-15% drop in accuracy on clean, unperturbed RF signals. This occurs because the model sacrifices sensitivity to non-robust features that are highly predictive on clean data but trivially manipulated by adversaries. TRADES loss and interpolated adversarial training are mitigation strategies that balance this trade-off through tunable regularization parameters.

Beyond per-sample attacks, adversarial training can defend against universal adversarial perturbations (UAPs)—a single, signal-agnostic perturbation waveform that causes misclassification across an entire RF dataset. Defending against UAPs requires:

• Batch-constrained perturbation generation: Computing a single perturbation that fools multiple signals simultaneously
• Shared gradient accumulation: Averaging gradients across a mini-batch before computing the universal perturbation
• Deployment relevance: UAPs represent realistic over-the-air jamming threats where an attacker broadcasts one waveform to disrupt all receivers