Adversarial examples in RF deep learning: Detection and physical robustness

Silvija Kokalj-Filipovic, Rob Miller, Garrett Vanhoy

Research output: Chapter in Book/Report/Conference proceedingConference contribution

28 Scopus citations

Abstract

While research on adversarial examples (AdExs) in machine learning for images has been prolific, similar attacks on deep learning (DL) for radio frequency (RF) signals and corresponding mitigation strategies are scarcely addressed in the published work, with only a handful of recent publications in the RF domain. With minimal waveform perturbation, RF adversarial examples (AdExs) can cause a substantial increase in misclassifications for spectrum sensing/ survey applications (e.g. ZigBee mistaken for Bluetooth). In this work, two statistical tests for AdEx detection are proposed. One statistical test leverages the peak-to-average-power ratio (PAPR) of the RF samples. The second test uses the softmax outputs of the machine learning model, which is proportional to the likelihoods the classifier assigns to each of the trained classes. The first test leverages the RF nature of the data while the latter is universally applicable to AdExs regardless of the domain. Both solutions are shown as viable mitigation methods to subvert adversarial attacks against RF waveforms, and their effectiveness is analyzed as function of the propagation channel and type of waveform.

Original languageEnglish (US)
Title of host publicationGlobalSIP 2019 - 7th IEEE Global Conference on Signal and Information Processing, Proceedings
PublisherInstitute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)9781728127231
DOIs
StatePublished - Nov 2019
Externally publishedYes
Event7th IEEE Global Conference on Signal and Information Processing, GlobalSIP 2019 - Ottawa, Canada
Duration: Nov 11 2019Nov 14 2019

Publication series

NameGlobalSIP 2019 - 7th IEEE Global Conference on Signal and Information Processing, Proceedings

Conference

Conference7th IEEE Global Conference on Signal and Information Processing, GlobalSIP 2019
Country/TerritoryCanada
CityOttawa
Period11/11/1911/14/19

All Science Journal Classification (ASJC) codes

  • Information Systems
  • Information Systems and Management
  • Artificial Intelligence
  • Computer Vision and Pattern Recognition
  • Signal Processing

Fingerprint

Dive into the research topics of 'Adversarial examples in RF deep learning: Detection and physical robustness'. Together they form a unique fingerprint.

Cite this