Physical Adversarial Attacks Against End-to-End Autoencoder Communication Systems

We show that end-to-end learning of communication systems through deep neural network autoencoders can be extremely vulnerable to physical adversarial attacks. Specifically, we elaborate how an attacker can craft effective physical black-box adversarial attacks. Due to the openness (broadcast nature...

Full description

Saved in:
Bibliographic Details
Published in:IEEE communications letters 2019-05, Vol.23 (5), p.847-850
Main Authors: Sadeghi, Meysam, Larsson, Erik G.
Format: Article
Language:English
Subjects:
Adversarial attacks
Artificial neural networks
autoencoder systems
Communications systems
Decoding
deep learning
end-to-end learning
Jamming
Perturbation
Perturbation methods
Receivers
Transmitters
Wireless communication
wireless security
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
cited_by cdi_FETCH-LOGICAL-c377t-d2837231bd6697f556e22bfd001cdee663187a5c31dcb95866ca24d8195f0ff73
cites cdi_FETCH-LOGICAL-c377t-d2837231bd6697f556e22bfd001cdee663187a5c31dcb95866ca24d8195f0ff73
container_end_page 850
container_issue 5
container_start_page 847
container_title IEEE communications letters
container_volume 23
creator Sadeghi, Meysam
Larsson, Erik G.
description We show that end-to-end learning of communication systems through deep neural network autoencoders can be extremely vulnerable to physical adversarial attacks. Specifically, we elaborate how an attacker can craft effective physical black-box adversarial attacks. Due to the openness (broadcast nature) of the wireless channel, an adversary transmitter can increase the block-error-rate of a communication system by orders of magnitude by transmitting a well-designed perturbation signal over the channel. We reveal that the adversarial attacks are more destructive than the jamming attacks. We also show that classical coding schemes are more robust than the autoencoders against both adversarial and jamming attacks.
doi_str_mv 10.1109/LCOMM.2019.2901469
format article
fullrecord <record><control><sourceid>proquest_ieee_</sourceid><recordid>TN_cdi_ieee_primary_8651357</recordid><sourceformat>XML</sourceformat><sourcesystem>PC</sourcesystem><ieee_id>8651357</ieee_id><sourcerecordid>2222201098</sourcerecordid><originalsourceid>FETCH-LOGICAL-c377t-d2837231bd6697f556e22bfd001cdee663187a5c31dcb95866ca24d8195f0ff73</originalsourceid><addsrcrecordid>eNo9kEtPAjEUhSdGExH9A7qZxPVgH_S1nCA-EggaH9umtB0swhTbjoZ_bxHiXdx7Fuec3HxFcQnBAEIgbiaj2XQ6QACKARIADqk4KnqQEF6hvI6zBlxUjAl-WpzFuAQAcERgr3h--thGp9WqrM23DVEFt9MpKf0Zy3qhXBtTOW5NlXyVT1l3ydtWe2NDOfLrddfmdHK-LV-2Mdl1PC9OGrWK9uJw-8Xb3fh19FBNZvePo3pSacxYqgzimCEM54ZSwRpCqEVo3hgAoDbWUoohZ4poDI2eC8Ip1QoNDYeCNKBpGO4X1b43_thNN5eb4NYqbKVXTt6691r6sJAr10lIGMEk-6_3_k3wX52NSS59F9r8okS7AZkjzy60d-ngYwy2-e-FQO5Qyz_UcodaHlDn0NU-5Ky1_wFOCcSE4V_b13qE</addsrcrecordid><sourcetype>Open Access Repository</sourcetype><iscdi>true</iscdi><recordtype>article</recordtype><pqid>2222201098</pqid></control><display><type>article</type><title>Physical Adversarial Attacks Against End-to-End Autoencoder Communication Systems</title><source>IEEE Electronic Library (IEL) Journals</source><creator>Sadeghi, Meysam ; Larsson, Erik G.</creator><creatorcontrib>Sadeghi, Meysam ; Larsson, Erik G.</creatorcontrib><description>We show that end-to-end learning of communication systems through deep neural network autoencoders can be extremely vulnerable to physical adversarial attacks. Specifically, we elaborate how an attacker can craft effective physical black-box adversarial attacks. Due to the openness (broadcast nature) of the wireless channel, an adversary transmitter can increase the block-error-rate of a communication system by orders of magnitude by transmitting a well-designed perturbation signal over the channel. We reveal that the adversarial attacks are more destructive than the jamming attacks. We also show that classical coding schemes are more robust than the autoencoders against both adversarial and jamming attacks.</description><identifier>ISSN: 1089-7798</identifier><identifier>ISSN: 1558-2558</identifier><identifier>EISSN: 1558-2558</identifier><identifier>DOI: 10.1109/LCOMM.2019.2901469</identifier><identifier>CODEN: ICLEF6</identifier><language>eng</language><publisher>New York: IEEE</publisher><subject>Adversarial attacks ; Artificial neural networks ; autoencoder systems ; Communications systems ; Decoding ; deep learning ; end-to-end learning ; Jamming ; Perturbation ; Perturbation methods ; Receivers ; Transmitters ; Wireless communication ; wireless security</subject><ispartof>IEEE communications letters, 2019-05, Vol.23 (5), p.847-850</ispartof><rights>Copyright The Institute of Electrical and Electronics Engineers, Inc. (IEEE) 2019</rights><lds50>peer_reviewed</lds50><oa>free_for_read</oa><woscitedreferencessubscribed>false</woscitedreferencessubscribed><citedby>FETCH-LOGICAL-c377t-d2837231bd6697f556e22bfd001cdee663187a5c31dcb95866ca24d8195f0ff73</citedby><cites>FETCH-LOGICAL-c377t-d2837231bd6697f556e22bfd001cdee663187a5c31dcb95866ca24d8195f0ff73</cites><orcidid>0000-0002-1176-4925 ; 0000-0002-7599-4367</orcidid></display><links><openurl>$$Topenurl_article</openurl><openurlfulltext>$$Topenurlfull_article</openurlfulltext><thumbnail>$$Tsyndetics_thumb_exl</thumbnail><linktohtml>$$Uhttps://ieeexplore.ieee.org/document/8651357$$EHTML$$P50$$Gieee$$H</linktohtml><link.rule.ids>230,314,780,784,885,27924,27925,54796</link.rule.ids><backlink>$$Uhttps://urn.kb.se/resolve?urn=urn:nbn:se:liu:diva-157535$$DView record from Swedish Publication Index$$Hfree_for_read</backlink></links><search><creatorcontrib>Sadeghi, Meysam</creatorcontrib><creatorcontrib>Larsson, Erik G.</creatorcontrib><title>Physical Adversarial Attacks Against End-to-End Autoencoder Communication Systems</title><title>IEEE communications letters</title><addtitle>COML</addtitle><description>We show that end-to-end learning of communication systems through deep neural network autoencoders can be extremely vulnerable to physical adversarial attacks. Specifically, we elaborate how an attacker can craft effective physical black-box adversarial attacks. Due to the openness (broadcast nature) of the wireless channel, an adversary transmitter can increase the block-error-rate of a communication system by orders of magnitude by transmitting a well-designed perturbation signal over the channel. We reveal that the adversarial attacks are more destructive than the jamming attacks. We also show that classical coding schemes are more robust than the autoencoders against both adversarial and jamming attacks.</description><subject>Adversarial attacks</subject><subject>Artificial neural networks</subject><subject>autoencoder systems</subject><subject>Communications systems</subject><subject>Decoding</subject><subject>deep learning</subject><subject>end-to-end learning</subject><subject>Jamming</subject><subject>Perturbation</subject><subject>Perturbation methods</subject><subject>Receivers</subject><subject>Transmitters</subject><subject>Wireless communication</subject><subject>wireless security</subject><issn>1089-7798</issn><issn>1558-2558</issn><issn>1558-2558</issn><fulltext>true</fulltext><rsrctype>article</rsrctype><creationdate>2019</creationdate><recordtype>article</recordtype><recordid>eNo9kEtPAjEUhSdGExH9A7qZxPVgH_S1nCA-EggaH9umtB0swhTbjoZ_bxHiXdx7Fuec3HxFcQnBAEIgbiaj2XQ6QACKARIADqk4KnqQEF6hvI6zBlxUjAl-WpzFuAQAcERgr3h--thGp9WqrM23DVEFt9MpKf0Zy3qhXBtTOW5NlXyVT1l3ydtWe2NDOfLrddfmdHK-LV-2Mdl1PC9OGrWK9uJw-8Xb3fh19FBNZvePo3pSacxYqgzimCEM54ZSwRpCqEVo3hgAoDbWUoohZ4poDI2eC8Ip1QoNDYeCNKBpGO4X1b43_thNN5eb4NYqbKVXTt6691r6sJAr10lIGMEk-6_3_k3wX52NSS59F9r8okS7AZkjzy60d-ngYwy2-e-FQO5Qyz_UcodaHlDn0NU-5Ky1_wFOCcSE4V_b13qE</recordid><startdate>20190501</startdate><enddate>20190501</enddate><creator>Sadeghi, Meysam</creator><creator>Larsson, Erik G.</creator><general>IEEE</general><general>The Institute of Electrical and Electronics Engineers, Inc. (IEEE)</general><scope>97E</scope><scope>RIA</scope><scope>RIE</scope><scope>AAYXX</scope><scope>CITATION</scope><scope>7SP</scope><scope>8FD</scope><scope>L7M</scope><scope>ABXSW</scope><scope>ADTPV</scope><scope>AOWAS</scope><scope>D8T</scope><scope>DG8</scope><scope>ZZAVC</scope><orcidid>https://orcid.org/0000-0002-1176-4925</orcidid><orcidid>https://orcid.org/0000-0002-7599-4367</orcidid></search><sort><creationdate>20190501</creationdate><title>Physical Adversarial Attacks Against End-to-End Autoencoder Communication Systems</title><author>Sadeghi, Meysam ; Larsson, Erik G.</author></sort><facets><frbrtype>5</frbrtype><frbrgroupid>cdi_FETCH-LOGICAL-c377t-d2837231bd6697f556e22bfd001cdee663187a5c31dcb95866ca24d8195f0ff73</frbrgroupid><rsrctype>articles</rsrctype><prefilter>articles</prefilter><language>eng</language><creationdate>2019</creationdate><topic>Adversarial attacks</topic><topic>Artificial neural networks</topic><topic>autoencoder systems</topic><topic>Communications systems</topic><topic>Decoding</topic><topic>deep learning</topic><topic>end-to-end learning</topic><topic>Jamming</topic><topic>Perturbation</topic><topic>Perturbation methods</topic><topic>Receivers</topic><topic>Transmitters</topic><topic>Wireless communication</topic><topic>wireless security</topic><toplevel>peer_reviewed</toplevel><toplevel>online_resources</toplevel><creatorcontrib>Sadeghi, Meysam</creatorcontrib><creatorcontrib>Larsson, Erik G.</creatorcontrib><collection>IEEE All-Society Periodicals Package (ASPP) 2005-present</collection><collection>IEEE All-Society Periodicals Package (ASPP) Online</collection><collection>IEEE Xplore</collection><collection>CrossRef</collection><collection>Electronics &amp; Communications Abstracts</collection><collection>Technology Research Database</collection><collection>Advanced Technologies Database with Aerospace</collection><collection>SWEPUB Linköpings universitet full text</collection><collection>SwePub</collection><collection>SwePub Articles</collection><collection>SWEPUB Freely available online</collection><collection>SWEPUB Linköpings universitet</collection><collection>SwePub Articles full text</collection><jtitle>IEEE communications letters</jtitle></facets><delivery><delcategory>Remote Search Resource</delcategory><fulltext>fulltext</fulltext></delivery><addata><au>Sadeghi, Meysam</au><au>Larsson, Erik G.</au><format>journal</format><genre>article</genre><ristype>JOUR</ristype><atitle>Physical Adversarial Attacks Against End-to-End Autoencoder Communication Systems</atitle><jtitle>IEEE communications letters</jtitle><stitle>COML</stitle><date>2019-05-01</date><risdate>2019</risdate><volume>23</volume><issue>5</issue><spage>847</spage><epage>850</epage><pages>847-850</pages><issn>1089-7798</issn><issn>1558-2558</issn><eissn>1558-2558</eissn><coden>ICLEF6</coden><abstract>We show that end-to-end learning of communication systems through deep neural network autoencoders can be extremely vulnerable to physical adversarial attacks. Specifically, we elaborate how an attacker can craft effective physical black-box adversarial attacks. Due to the openness (broadcast nature) of the wireless channel, an adversary transmitter can increase the block-error-rate of a communication system by orders of magnitude by transmitting a well-designed perturbation signal over the channel. We reveal that the adversarial attacks are more destructive than the jamming attacks. We also show that classical coding schemes are more robust than the autoencoders against both adversarial and jamming attacks.</abstract><cop>New York</cop><pub>IEEE</pub><doi>10.1109/LCOMM.2019.2901469</doi><tpages>4</tpages><orcidid>https://orcid.org/0000-0002-1176-4925</orcidid><orcidid>https://orcid.org/0000-0002-7599-4367</orcidid><oa>free_for_read</oa></addata></record>
fulltext fulltext
identifier ISSN: 1089-7798
ispartof IEEE communications letters, 2019-05, Vol.23 (5), p.847-850
issn 1089-7798
1558-2558
1558-2558
language eng
recordid cdi_ieee_primary_8651357
source IEEE Electronic Library (IEL) Journals
subjects Adversarial attacks
Artificial neural networks
autoencoder systems
Communications systems
Decoding
deep learning
end-to-end learning
Jamming
Perturbation
Perturbation methods
Receivers
Transmitters
Wireless communication
wireless security
title Physical Adversarial Attacks Against End-to-End Autoencoder Communication Systems
url http://sfxeu10.hosted.exlibrisgroup.com/loughborough?ctx_ver=Z39.88-2004&ctx_enc=info:ofi/enc:UTF-8&ctx_tim=2025-01-06T01%3A57%3A16IST&url_ver=Z39.88-2004&url_ctx_fmt=infofi/fmt:kev:mtx:ctx&rfr_id=info:sid/primo.exlibrisgroup.com:primo3-Article-proquest_ieee_&rft_val_fmt=info:ofi/fmt:kev:mtx:journal&rft.genre=article&rft.atitle=Physical%20Adversarial%20Attacks%20Against%20End-to-End%20Autoencoder%20Communication%20Systems&rft.jtitle=IEEE%20communications%20letters&rft.au=Sadeghi,%20Meysam&rft.date=2019-05-01&rft.volume=23&rft.issue=5&rft.spage=847&rft.epage=850&rft.pages=847-850&rft.issn=1089-7798&rft.eissn=1558-2558&rft.coden=ICLEF6&rft_id=info:doi/10.1109/LCOMM.2019.2901469&rft_dat=%3Cproquest_ieee_%3E2222201098%3C/proquest_ieee_%3E%3Cgrp_id%3Ecdi_FETCH-LOGICAL-c377t-d2837231bd6697f556e22bfd001cdee663187a5c31dcb95866ca24d8195f0ff73%3C/grp_id%3E%3Coa%3E%3C/oa%3E%3Curl%3E%3C/url%3E&rft_id=info:oai/&rft_pqid=2222201098&rft_id=info:pmid/&rft_ieee_id=8651357&rfr_iscdi=true