Abstract:

Concerning the issue that modulation aiming jamming reduces the communication performance by identifying the modulation mode of signal through Deep Neural Network （DNN）， an adversarial attack algorithm of modulation signal based on equalization of feature gradient was proposed. Different from the traditional method of label back propagation to obtain the gradient， rich space-time features of the modulation signal in the DNN high-dimensional space were used to calculate the gradients， and local average feature gradient was used to replace the single point feature gradient for the algorithm iteration， which solved the problem of unreliable gradient caused by the local oscillation of the loss function surface. Based on the processed gradient and existing momentum attack method， more subtle adversarial disturbance was generated and superimposed on the normal communication signal to construct the adversarial sample， so as to reduce the recognition rate of DNN to the communication signal and weaken the effect of modulation aiming jamming. The experimental results on RADIOML 2016.10A dataset showed that， compared to FGSM （Fast Gradient Sign Method） and MI-FGSM （Momentum Iterative Fast Gradient Sign Method）， although the running time of the proposed algorithm on VTCNN2 （Visual Transformer Convolutional Neural Network） model respectively improved by 1.36 h and 0.58 h， the attack effect of the no-target adversarial samples generated by the proposed algorithm was significant； at a signal-to-noise ratio of 10 dB， the success rate of white box attack respectively improved by 36 and 26 percentage points； when directly transferred to the CLDNN （Convolutional Long Short-Term Memory-Deep Neural Network） model， the success rate of black box attack increased by 19 and 14 percentage points respectively. The proposed algorithm improves the attack success rate of adversarial samples and has good transferability.

Key words: Deep Neural Network (DNN), modulation recognition, adversarial sample, feature gradient, equalization

摘要：

针对调制瞄准干扰通过深度神经网络（DNN）识别信号调制方式，进而发起灵巧干扰使通信性能下降的问题，提出一种基于特征梯度均值化的调制信号对抗样本攻击算法。不同于传统的标签反向传播求取梯度的方法，所提算法利用调制信号在DNN高维空间中的丰富空时特征计算梯度，并使用局部平均特征梯度代替单点特征梯度用于算法迭代，解决损失函数曲面局部振荡带来的梯度不可靠问题。基于处理后的梯度和现有动量攻击方法，可生成更精细的对抗扰动，并叠加在正常通信信号上以构造对抗样本，降低DNN对通信信号的识别准确率，减弱调制瞄准干扰的效果。在RADIOML 2016.10A数据集上的实验结果表明，与快速梯度符号法（FGSM）、MI-FGSM（Momentum Iterative Fast Gradient Sign Method）相比，尽管所提算法在VTCNN2（Visual Transformer Convolutional Neural Network）模型上的运行时间分别增加了1.36 h、0.58 h，但生成的无目标对抗样本取得了显著的效果。当信噪比为10 dB时，白盒攻击成功率分别提升了36、26个百分点，将生成的对抗样本直接迁移到CLDNN（Convolutional Long short-term memory-Deep Neural Network）模型中，黑盒攻击成功率分别提升了19和14个百分点。所提算法提高了对抗样本的攻击成功率，具有良好的可迁移性。

关键词: 深度神经网络, 调制识别, 对抗样本, 特征梯度, 均值化