Abstract
The remarkable success of transformers across various fields such as natural language processing and computer vision has paved the way for their applications in automatic modulation classification, a critical component in the communication systems of Internet of Things (IoT) devices. However, it has been observed that transformer-based classification of radio signals is susceptible to subtle yet sophisticated adversarial attacks. To address this issue, we have developed a defensive strategy for transformer-based modulation classification systems to counter such adversarial attacks. In this paper, we propose a novel vision transformer (ViT) architecture by introducing a new concept known as adversarial indicator (AdvI) token to detect adversarial attacks. To the best of our knowledge, this is the first work to propose an AdvI token in ViT to defend against adversarial attacks. Integrating an adversarial training method with a detection mechanism using AdvI token, we combine a training time defense and running time defense in a unified neural network model, which reduces architectural complexity of the system compared to detecting adversarial perturbations using separate models. We investigate into the operational principles of our method by examining the attention mechanism. We show the proposed AdvI token acts as a crucial element within the ViT, influencing attention weights and thereby highlighting regions or features in the input data that are potentially suspicious or anomalous. Through experimental results, we demonstrate that our approach surpasses several competitive methods in handling white-box attack scenarios, including those utilizing the fast gradient method, projected gradient descent attacks and basic iterative method.
Abstract (translated)
变压器在自然语言处理和计算机视觉等多个领域的显著成功，为物联网设备通信系统中的自动调制分类应用铺平了道路。然而，观察发现基于变压器的无线电信号分类容易受到细微而复杂的对抗性攻击的影响。为了应对这一问题，我们开发了一种防御策略，用于保护基于变压器的调制分类系统的免受此类对抗性攻击。在本文中，我们提出了一种新的视觉变压器（ViT）架构，通过引入一种名为“对抗指示符”(AdvI)标记的新概念来检测对抗性攻击。据我们所知，这是首次提议使用带有AdvI标记的ViT来防御对抗性攻击。 我们将对抗训练方法与基于AdvI标记的检测机制相结合，在统一的神经网络模型中同时实现了训练时间防护和运行时防护，从而简化了系统的架构复杂度，相比单独使用的检测模型而言更为简单。通过研究注意力机制的操作原理，我们展示了提出的AdvI标记在ViT中的关键作用：它影响注意权重，并且突出显示输入数据中可能可疑或异常的区域或特征。 实验结果显示，我们的方法在处理包括快速梯度法、投影梯度下降攻击和基本迭代法在内的白盒攻击场景方面超越了多种竞争性方法。
URL
https://arxiv.org/abs/2507.00015
