Hidden Signals: Backdooring Deep Learning for Wireless Communication

by

Author: Denis Avetisyan

Researchers have demonstrated a novel attack that subtly manipulates radio signals to compromise deep learning-based automatic modulation classifiers.

Explainable artificial intelligence (XAI) techniques guide adversarial attacks against deep neural networks, recurrent neural networks, and convolutional neural networks, demonstrating vulnerabilities across diverse architectures.
Explainable artificial intelligence (XAI) techniques guide adversarial attacks against deep neural networks, recurrent neural networks, and convolutional neural networks, demonstrating vulnerabilities across diverse architectures.

Exploiting Explainable AI insights, this study presents a transferable backdoor attack on deep learning models used for identifying wireless communication signals.

While deep learning has demonstrably improved automatic modulation classification (AMC) in modern wireless communications, these systems remain vulnerable to subtle adversarial attacks. This paper, ‘On the Vulnerability of Deep Automatic Modulation Classifiers to Explainable Backdoor Threats’, investigates a novel physical-layer backdoor attack that leverages explainable AI (XAI) to strategically embed triggers directly into wireless signals. Results demonstrate that this attack successfully breaches multiple DL-based AMC models with high accuracy across a range of signal-to-noise ratios, even with limited poisoned training data. Could this approach of XAI-guided trigger placement represent a significant escalation in the threat landscape for secure wireless communication systems?

The Foundation of Intelligent Spectrum Awareness

Automatic Modulation Classification (AMC) serves as a cornerstone for efficient spectrum monitoring and the advancement of cognitive radio technologies, enabling devices to intelligently utilize available radio frequencies. However, reliably identifying signal modulation types in practical scenarios presents considerable difficulty; real-world radio frequency environments are rarely pristine. Signals are often distorted by multipath fading, interference from other sources, and ambient noise, all of which obscure the defining characteristics of the modulation scheme. This complexity necessitates robust classification techniques capable of discerning subtle differences within noisy and dynamic signals, pushing the boundaries of signal processing and machine learning innovation to achieve dependable wireless communication.

Recent advancements in automatic modulation classification (AMC) leverage the capabilities of deep learning to surpass conventional techniques, primarily through automated feature extraction. Historically, AMC relied on manually engineered features – a process demanding expert knowledge and often proving inadequate for diverse and evolving wireless signals. Deep learning models, however, learn these features directly from raw signal data, identifying subtle patterns and characteristics indicative of specific modulation schemes. This data-driven approach not only reduces the need for human intervention but also consistently achieves superior classification accuracy, even in challenging radio frequency environments characterized by noise and interference. The ability to autonomously discern relevant information within complex signals represents a significant leap forward, enabling more robust and adaptable spectrum monitoring and cognitive radio systems.

Conventional deep learning architectures, while adept at identifying patterns within data, often fall short when analyzing the sequential nature of wireless signals. These signals aren’t static snapshots; information is encoded not just in the instantaneous frequency or amplitude, but in how these characteristics change over time. Standard models, typically designed for independent and identically distributed data, treat each time slice of a signal as separate, effectively discarding crucial temporal dependencies. This limitation hinders their ability to discern subtle differences between modulation schemes, particularly in noisy or rapidly changing radio environments. Consequently, performance degrades when faced with realistic, complex signals where the timing and order of signal components are critical for accurate classification, prompting the need for specialized architectures capable of explicitly modeling these temporal relationships.

The Looming Threat: Adversarial Vulnerabilities

Deep Learning models, despite their demonstrated capabilities, are inherently vulnerable to Adversarial Machine Learning (AML) attacks due to characteristics of both their training data and architectural design. These attacks leverage the high dimensionality of input spaces and the non-robustness of learned decision boundaries. Specifically, vulnerabilities arise from reliance on statistical correlations within training datasets, making models susceptible to carefully crafted perturbations – often imperceptible to humans – in input data. Furthermore, the complex, layered structure of deep neural networks can amplify minor input changes, leading to significant alterations in model outputs. Exploitable weaknesses also stem from the model’s reliance on specific features within the training data, which attackers can identify and manipulate to induce misclassification or other undesirable behavior. These attacks aren’t limited to image data; they apply to various data modalities including text, audio, and tabular data.

Membership Inference Attacks (MIAs) represent a significant privacy threat to machine learning systems by attempting to determine if a specific data record was part of the training dataset. These attacks do not attempt to extract the model itself, but rather exploit the model’s behavior to infer information about the training data. Successful MIAs can compromise data privacy, particularly in sensitive domains like healthcare or finance, where the revelation of training data inclusion could have serious consequences. Attack methodologies typically involve querying the target model with a given data point and analyzing the output confidence or probability to determine whether the model has “seen” that data during training; higher confidence scores often indicate membership. The effectiveness of MIAs is influenced by factors such as the model architecture, the size of the training dataset, and the attacker’s access to auxiliary information.

Fast Gradient Sign Method (FGSM) and Carlini-Wagner (C&W) attacks are gradient-based techniques used to generate adversarial examples – subtly perturbed inputs designed to cause misclassification in machine learning models. While demonstrably effective at manipulating predictions on the target model used to create the perturbation, these attacks typically exhibit limited transferability. This means that the adversarial examples generated for one model architecture or with specific training data often fail to consistently deceive other, even similarly trained, models. The lack of transferability is attributed to differences in model parameters, decision boundaries, and the specific optimization processes employed during training, necessitating the generation of new adversarial examples for each distinct model targeted.

Introducing Stealthy, Transferable Backdoor Attacks

The research details a novel Transferable Backdoor Attack, a method of compromising machine learning models by embedding a concealed trigger within the model’s parameters. This trigger, when present in an input, causes the model to misclassify that input in a predetermined manner, regardless of the specific task the model is designed to perform. The attack is termed “transferable” because the embedded backdoor can persist even after the model undergoes retraining or is subjected to defensive distillation techniques, potentially impacting a range of downstream applications. The core mechanism relies on subtly altering the model’s weights during training to associate the trigger with a specific, attacker-chosen target class, effectively creating a hidden conditional behavior.

The placement of the backdoor trigger is optimized through the application of Explainable AI (XAI) techniques, specifically utilizing RF Fingerprinting. This involves analyzing the model’s internal representations to identify neurons most sensitive to specific input features. By strategically positioning the trigger to activate these sensitive neurons, the attack maximizes the likelihood of misclassification while minimizing the perturbation required, thus enhancing stealth. RF Fingerprinting allows for targeted manipulation of feature activations, ensuring the trigger remains subtle enough to evade detection by standard anomaly detection methods, but potent enough to reliably induce the desired incorrect classification when present in an input sample.

The Prototype-PCA Hybrid method optimizes trigger perturbation values by combining the strengths of two approaches. Initially, a prototype-based strategy generates a set of potential perturbations, maximizing trigger effectiveness in inducing misclassification. Subsequently, Principal Component Analysis (PCA) is applied to this set, reducing dimensionality and identifying the primary components responsible for both effectiveness and perceptual change. By projecting perturbations onto these principal components, the method minimizes the magnitude of changes to the input data while maintaining a high trigger success rate, thereby improving stealth and reducing the likelihood of detection. This hybrid approach balances the need for a strong, reliable trigger with the requirement for minimal, imperceptible modifications to the input data.

The simulation of realistic attack vectors leverages Orthogonal Frequency-Division Multiplexing (OFDM) signals, a common technique in wireless communication, to model the transmission of the malicious trigger. Crucially, the impact of the Cyclic Prefix (CP), a redundant prefix added to OFDM symbols to mitigate inter-symbol interference, is also considered within the attack model. By accounting for the CP, the research aims to more accurately represent how a physical-layer attack would manifest in a real-world wireless environment, addressing potential signal degradation and ensuring the trigger remains effective despite channel impairments. This approach allows for a more robust evaluation of the attack’s feasibility and resilience against common wireless communication challenges.

Evaluating Attack Robustness and Evasion Capabilities

The efficacy of this adversarial attack is demonstrated through a quantified Attack Success Rate (ASR), reaching as high as 69% when applied to Convolutional Neural Networks (CNNs) under conditions of low Signal-to-Noise Ratio (SNR). This performance highlights the attack’s capability to successfully induce misclassification in targeted models, even amidst noisy data. Critically, the attack achieves this level of success without substantially degrading the model’s overall accuracy on legitimate inputs, indicating a subtle and effective manipulation of the decision-making process. The ability to maintain high performance on benign data while simultaneously causing errors on specifically crafted inputs suggests a sophisticated approach to adversarial example generation, making detection more challenging and the attack more practical in real-world scenarios.

Evaluations demonstrate a substantial capacity for inducing misclassification across diverse neural network architectures. Specifically, at a signal-to-noise ratio of 16 dB, the attack achieves an Attack Success Rate (ASR) of approximately 80% when tested against Deep Neural Networks (DNNs), Recurrent Neural Networks (RNNs), and Convolutional Neural Networks (CNNs). This high success rate, observed consistently across these model types, underscores the attack’s generalizability and effectiveness in compromising the integrity of machine learning systems, even under relatively favorable conditions for legitimate performance. The consistently high ASR highlights the potential for widespread disruption, as it indicates a significant probability of successful manipulation regardless of the underlying network structure.

Evaluations focused on the attack’s ability to evade common defense strategies reveal a significant degree of stealth. Utilizing tools such as Neural Cleanse, STRIP, and Activation Clustering, researchers determined the induced perturbations are demonstrably difficult to detect. While some reference attacks triggered anomaly detection thresholds – notably, the Ref2 attack showed a marked increase in the Anomaly Index and Entropy Gap – the XAI-guided attack consistently remained below these thresholds. Activation Clustering further supports this, revealing a low Detection Rate of only 8% for the XAI-guided attack, in contrast to the 30% observed for the Ref1 attack and higher rates for Ref2. These findings suggest the methodology employed minimizes the attack’s footprint, making it substantially more resistant to current detection mechanisms and potentially enabling successful evasion in real-world scenarios.

The effectiveness of the adversarial attack was achieved with a surprisingly limited data manipulation – a poisoning ratio of approximately 4%. This signifies that only 4% of the training dataset needed to be subtly altered to consistently induce misclassifications in the targeted machine learning models. Both the novel, Explainable AI-guided attack and the established reference attacks demonstrated this efficiency, highlighting a critical vulnerability in model robustness. This relatively low ratio suggests that even a small-scale compromise of the training data pipeline could have significant consequences, making data integrity a paramount concern for deployed machine learning systems. The study establishes that substantial disruption doesn’t necessarily require widespread data corruption, but rather a strategically targeted and carefully crafted poisoning strategy.

Analysis using Neural Cleanse revealed a discernible difference in the anomalous nature of various adversarial attacks. Specifically, the Ref2 attack triggered an Anomaly Index that surpassed the established detection threshold, indicating a greater deviation from typical data patterns and a higher likelihood of being flagged as malicious. Conversely, both the XAI-guided attack and the Ref1 attack generated Anomaly Index scores that remained below this threshold, suggesting these attacks are more subtle in their manipulation of the input data and, consequently, more challenging to detect using this particular defense mechanism.

Analysis of information entropy reveals a significant disparity between attack strategies; the Ref2 attack exhibited an Entropy Gap of 0.8, indicating a more pronounced alteration in the decision-making process of the targeted model compared to the XAI-guided and Ref1 attacks, which registered substantially lower values. This Entropy Gap quantifies how much the attack disrupts the model’s typical feature activation patterns, suggesting Ref2 introduces greater complexity or noise into the classification process. A larger gap implies the attack is more effective at concealing its malicious intent by obscuring the subtle cues a defense mechanism might otherwise detect, potentially making it harder to identify as adversarial input based on statistical anomalies in feature space.

Evaluation using Activation Clustering revealed a significant disparity in detectability between the proposed attack and established methods. The XAI-guided attack demonstrated a remarkably low Detection Rate of just 8%, suggesting a high degree of stealth and difficulty in identifying manipulated samples. This contrasts sharply with the Ref1 attack, which exhibited a Detection Rate of 30%, and even more so with the Ref2 attack, which showed a substantially higher rate. These results indicate that leveraging Explainable AI to guide the poisoning process effectively minimizes the attack’s signature, rendering it considerably more resistant to detection by methods that analyze neural network activations to identify anomalies.

Successfully crafting adversarial perturbations hinges on precise trigger placement and minimizing detectability, and research indicates that Local Phase Normalization and SamplingSHAP are crucial techniques for achieving this. Local Phase Normalization refines the computation of trigger positions by focusing on phase information, enhancing the subtlety of the adversarial signal and reducing the likelihood of triggering defensive mechanisms. Complementing this, SamplingSHAP-a method for explaining machine learning model predictions-allows for the efficient computation of the optimal trigger location, maximizing its impact on model misclassification while simultaneously minimizing its overall visibility to detection algorithms. The combined effect of these techniques results in adversarial examples that are not only effective in inducing errors but also demonstrably more stealthy than those created without such careful optimization, representing a significant advancement in the field of adversarial machine learning.

The research highlights how subtly altering system inputs-specifically, embedding triggers within the signal portions identified through Explainable AI-can compromise the integrity of Automatic Modulation Classification. This echoes Bertrand Russell’s observation: “The whole problem with the world is that fools and fanatics are so confident of their own opinions.” The study demonstrates that even sophisticated deep learning systems, seemingly robust, are susceptible to manipulation when foundational elements are targeted. Just as Russell suggests, a misplaced confidence in the system’s inherent security-without understanding the potential for these ‘foolish’ trigger placements-creates a significant vulnerability. The high transferability of the attack further emphasizes that this isn’t a single instance, but a systemic weakness demanding attention.

What’s Next?

The demonstrated success of embedding backdoors guided by Explainable AI techniques highlights a fundamental tension within the field. The very tools intended to illuminate model behavior are, it seems, equally capable of facilitating subtle manipulation. This isn’t a failure of XAI itself, but rather a consequence of focusing on local interpretability without sufficient consideration for global system security. The pursuit of increasingly complex architectures, while yielding marginal gains in accuracy, simultaneously expands the attack surface and obscures the underlying vulnerabilities. It begs the question: are these models truly learning signal characteristics, or merely memorizing brittle correlations?

Future work must move beyond adversarial examples crafted in isolation. The true cost isn’t the ability to fool a single classifier, but the erosion of trust in the entire signal processing pipeline. Investigating the transferability of these ‘explainable’ backdoors across different signal modalities – from radio frequencies to images, or even audio – will reveal whether the underlying principle is a general property of deep learning, or specific to Automatic Modulation Classification. The current focus on detection feels reactive. A more robust solution lies in designing intrinsically secure architectures, perhaps by embracing simplicity and limiting the expressive power of the model itself.

Ultimately, the problem isn’t finding vulnerabilities, but acknowledging that they are inherent. Good architecture is invisible until it breaks, and in this case, the breaks are becoming increasingly predictable. The pursuit of cleverness will always be outpaced by the ingenuity of an attacker. A focus on foundational principles – minimal complexity, verifiable behavior, and a clear understanding of the trade-offs between accuracy and security – represents the most promising path forward.

Original article: https://arxiv.org/pdf/2603.25310.pdf

Contact the author: https://www.linkedin.com/in/avetisyan/

See also:

2026-03-27 15:46