Spiking Neural Network: a low power solution for physical layer authentication

TL;DR

This evaluation suggests that SNNs can learn unique physical properties of RF transmitters and use them to identify individual devices and find that SNNs are also vulnerable to adversarial attacks and that an autoencoder can be used clean out adversarial perturbations to harden SNNs against them.

Abstract

Deep learning (DL) is a powerful tool that can solve complex problems, and thus, it seems natural to assume that DL can be used to enhance the security of wireless communication. However, deploying DL models to edge devices in wireless networks is challenging, as they require significant amounts of computing and power resources. Notably, Spiking Neural Networks (SNNs) are known to be efficient in terms of power consumption, meaning they can be an alternative platform for DL models for edge devices. In this study, we ask if SNNs can be used in physical layer authentication. Our evaluation suggests that SNNs can learn unique physical properties (i.e., `fingerprints') of RF transmitters and use them to identify individual devices. Furthermore, we find that SNNs are also vulnerable to adversarial attacks and that an autoencoder can be used clean out adversarial perturbations to harden SNNs against them.

Figures (7)

• Figure 1: Overview of our experiment. (A), setting of our experiment in Section \ref{['exp1']}. (B), setting in Section \ref{['exp2']}. (C), setting in Section \ref{['exp3']}
• Figure 2: (A), 3 examples of $I$ and $Q$ after normalization. Blue and orange lines represent $I$ and $Q$, respectively. (B), Performance of ANNs trained on 100 RF transmitters. The box plots show $10$ ANNs' accuracy depending on the quantization level ($L$).
• Figure 3: Performance of SNN after conversion. SNNs' accuracy is measured depending on time steps ($T$) used for inference. They are compared with two different ANNs. The first one is ANN with ReLU, and the second one is ANN with QCSF ($T=0$). SNNs' accuracy becomes comparable to ANNs when $T$ is sufficiently high.
• Figure 4: (A), Accuracy of ANNs’ predictions on adversarial inputs depending on $\epsilon$ and $L$. The color indicates the accuracy averaged over 10 models. All adversarial signals are crafted for specific models (i.e., white-box attack). When we test the models’ QCFS activation function, we use $L=10,25, 50, 75, 100$. The column, marked by $ReLU$, indicates the model with ReLU activation function. For both models, accuracy is around 0.1 or below it. (B), Comparison between ANNs and SNNs with $L=50$. The accuracy levels of ANNs and SNNs are displayed in blue and orange.
• Figure 5: Examples signals. (A), 2 examples of clean signals. (B), 2 examples of adversarial examples. (C), adversarial signals cleaned out by AE. The black horizontal line denotes the $I$ samples, and the rest denote $Q$ samples.