A Multiscale Discriminative Attack Method for Automatic Modulation Classification

Automatic Modulation Classification (AMC)-oriented Deep Neural Networks (ADNNs) have received much attention in recent years for their wide range of applications. However, they are vulnerable to attacks. Adversarial Examples (AEs) of modulation signals with added weak perturbations can easily fool A...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on information forensics and security 2025, Vol.20, p.294-308
Main Authors: Bai, Jing, Ge, Chang, Xiao, Zhu, Jiang, Hongbo, Li, Tong, Zhou, Huaji, Jiao, Licheng
Format: Article
Language:English
Subjects:
Accuracy
Adversarial attack
automatic modulation classification (AMC)
Closed box
Deep learning
Feature extraction
Glass box
Local area networks
Modulation
Noise
Optimization
Perturbation methods
wireless communications
Citations: Items that this one cites
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Automatic Modulation Classification (AMC)-oriented Deep Neural Networks (ADNNs) have received much attention in recent years for their wide range of applications. However, they are vulnerable to attacks. Adversarial Examples (AEs) of modulation signals with added weak perturbations can easily fool ADNNs. The study of AEs on AMC, on one side, can enhance the security of wireless communication systems; on the other side, it can provide an effective defence against potential attacks. Nevertheless, most existing attack methods generate AEs with low transferability. In this paper, we propose a Multiscale Discriminative Attack Method (MDAM) for modulated signals. The method strives to alleviate such transferability issue by destroying discriminative features in multi-layer. Specifically, we utilize interpretable class activation maps to distinguish the discriminative regions, ignoring the noise and focusing on the interference of the discriminative features. Beyond that, we propose a multi-layer activation disruption loss to constrain activations in the middle layers. In so doing, the AEs do not erroneously retain deep features of the original signal. We conduct extensive experiments on RadioML datasets and the local area network (LAN) communication dataset we collected to evaluate the effectiveness of MDAM in both white-box and black-box attack scenarios. The results show that MDAM outperforms existing methods.
ISSN:1556-6013
1556-6021
DOI:10.1109/TIFS.2024.3515802