Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adversarial Robustness of Distilled and Pruned Deep Learning-based Wireless Classifiers

Nayan Moni Baishya, B. R. Manoj

TL;DR

This paper tackles the vulnerability of DL-based automatic modulation classification (AMC) to adversarial perturbations in edge settings. It introduces two optimized models—distilled and distill-pruned—via knowledge distillation from a large teacher and Net-Trim pruning to achieve high sparsity with maintained accuracy. Adversarial robustness is pursued with a computationally efficient PGD-FGSM hybrid adversarial training strategy, evaluated against five white-box attacks on the RML2016.10A dataset, demonstrating improved robustness over the standard model while preserving clean-sample performance. The results indicate that combining distillation with pruning yields both sparsity and resilience, enabling practical, secure edge deployments of DL-based AMC; future work will explore retraining-free countermeasures for on-device protection.

Abstract

Data-driven deep learning (DL) techniques developed for automatic modulation classification (AMC) of wireless signals are vulnerable to adversarial attacks. This poses a severe security threat to the DL-based wireless systems, specifically for edge applications of AMC. In this work, we address the joint problem of developing optimized DL models that are also robust against adversarial attacks. This enables efficient and reliable deployment of DL-based AMC on edge devices. We first propose two optimized models using knowledge distillation and network pruning, followed by a computationally efficient adversarial training process to improve the robustness. Experimental results on five white-box attacks show that the proposed optimized and adversarially trained models can achieve better robustness than the standard (unoptimized) model. The two optimized models also achieve higher accuracy on clean (unattacked) samples, which is essential for the reliability of DL-based solutions at edge applications.

Adversarial Robustness of Distilled and Pruned Deep Learning-based Wireless Classifiers

TL;DR

This paper tackles the vulnerability of DL-based automatic modulation classification (AMC) to adversarial perturbations in edge settings. It introduces two optimized models—distilled and distill-pruned—via knowledge distillation from a large teacher and Net-Trim pruning to achieve high sparsity with maintained accuracy. Adversarial robustness is pursued with a computationally efficient PGD-FGSM hybrid adversarial training strategy, evaluated against five white-box attacks on the RML2016.10A dataset, demonstrating improved robustness over the standard model while preserving clean-sample performance. The results indicate that combining distillation with pruning yields both sparsity and resilience, enabling practical, secure edge deployments of DL-based AMC; future work will explore retraining-free countermeasures for on-device protection.

Abstract

Data-driven deep learning (DL) techniques developed for automatic modulation classification (AMC) of wireless signals are vulnerable to adversarial attacks. This poses a severe security threat to the DL-based wireless systems, specifically for edge applications of AMC. In this work, we address the joint problem of developing optimized DL models that are also robust against adversarial attacks. This enables efficient and reliable deployment of DL-based AMC on edge devices. We first propose two optimized models using knowledge distillation and network pruning, followed by a computationally efficient adversarial training process to improve the robustness. Experimental results on five white-box attacks show that the proposed optimized and adversarially trained models can achieve better robustness than the standard (unoptimized) model. The two optimized models also achieve higher accuracy on clean (unattacked) samples, which is essential for the reliability of DL-based solutions at edge applications.
Paper Structure (17 sections, 6 equations, 4 figures, 2 algorithms)

This paper contains 17 sections, 6 equations, 4 figures, 2 algorithms.

Table of Contents

  1. Introduction
  2. optimized DL models for AMC
  3. Distilled model
  4. Distill-pruned model
  5. Adversarial attacks
  6. Attack model
  7. White-box attacks
  8. FGM
  9. FGSM
  10. PGD
  11. Deepfool
  12. UAP
  13. PGD-FGSM adversarial training
  14. Results and discussion
  15. Robustness against WB attacks
  16. ...and 2 more sections

Figures (4)

  • Figure 1: Taxonomy for the evaluation of robustness against adversarial attacks of the proposed optimized models.
  • Figure 2: Classification accuracy of the adversarially trained standard and optimized models for adversarial attacks at SNR=$10$ dB.
  • Figure 3: Classification accuracy of the models on clean samples with and without AT at SNR=$10$ dB.
  • Figure 4: Classification accuracy of ${f}_{\mathcal{D}}^{adv}$ for the PGD and FGM attacks when trained with different AT methods at SNR=$10$ dB.