Frequency-Selective Adversarial Attack Against Deep Learning-Based Wireless Signal Classifiers

Wireless communication is the foundation of modern systems, enabling critical applications in military, commercial, and civilian domains. Its increasing prevalence has changed daily life and operations worldwide while introducing serious security threats. Attackers exploit these vulnerabilities to intercept sensitive data, disrupt communications, or conduct targeted attacks, compromising confidentiality and functionality.

While encryption is a critical component of secure communication, it is often insufficient in situations involving resource-constrained devices, such as IoT systems, or in the face of advanced hostile techniques. New solutions, including signal perturbation optimization, autoencoders for preprocessing, and narrowband adversarial designs, aim to deceive attackers without significantly affecting the bit error rate. Despite progress, challenges remain in ensuring robustness in real-world scenarios and for resource-constrained devices.

To deal with those challenges, a recently published paper presents an innovative strategy to attack wireless signal classifiers by exploiting frequency-based adversarial attacks. The authors highlight the vulnerability of communication systems to carefully designed perturbations capable of masking the modulation signals while allowing the legitimate receiver to decode the message. The article’s main novelty is the imposition of limitations on the frequency content of the perturbations. The authors acknowledge that traditional adversarial attacks frequently produce high-frequency noise that communication systems can easily filter out. As a result, they optimize the adversarial perturbations such that they are focused in a limited frequency band that the intruder’s filters cannot detect or suppress. 

Concretely, The adversarial attack is framed as an optimization problem that aims to maximize the misclassification rate of the intruder’s classifier while keeping the perturbation’s power below a certain threshold. The authors propose using techniques from adversarial training and gradient-based methods to compute the perturbations. In particular, they derive a closed-form solution for the perturbation that respects the constraints imposed by the filtering process. In addition, the method uses the Discrete Fourier Transform (DFT) to decompose the signal in the frequency domain. This allows a filter that only lets the relevant frequency components pass, thus creating targeted disturbances that communication systems will not filter out.

Two specific attack algorithms are introduced in the paper: Frequency Selective PGD (FS-PGD) and Frequency Selective C&W (FS-C&W), which are adaptations of existing gradient-based attack methods tailored to the challenges posed by wireless communications.

The research team proposed to evaluate the effectiveness of FS-PGD and FS-C&W against deep learning-based modulation classifiers. Experiments used ten modulation schemes and 2720 data blocks per type. A ResNet18 classifier was employed, and FS-PGD and FS-C&W were compared to traditional adversarial methods like FGSM and PGD. The results showed that FS-PGD and FS-C&W achieved high fooling rates (99.98% and 99.96%, respectively) and maintained strong performance after filtering, with minimal perturbation detectable by filters. These methods were also robust to adversarial training and filter bandwidth mismatches. The findings confirm that FS-PGD and FS-C&W effectively deceive classifiers while preserving signal integrity, making them viable for real-world wireless communication applications.

In conclusion, the study demonstrates that the proposed frequency-selective adversarial attack methods, FS-PGD and FS-C&W, offer a robust solution to deceive deep learning-based modulation classifiers without significantly impairing the communication signal. By focusing perturbations within a constrained frequency band, these methods overcome traditional adversarial attack limitations, often involving high-frequency noise that can be easily filtered. The experimental results confirm the effectiveness of FS-PGD and FS-C&W in achieving high fooling rates and resilience to various filtering techniques and adversarial training scenarios. This highlights their potential for real-world applications, where secure communication is essential, and offers valuable insights for developing more secure wireless communication systems in the face of evolving threats.

Check out the Paper. All credit for this research goes to the researchers of this project. Also, don’t forget to follow us on Twitter and join our Telegram Channel and LinkedIn Group. Don’t Forget to join our 60k+ ML SubReddit.

🚨 [Must Subscribe]: Subscribe to our newsletter to get trending AI research and dev updates