Mixture GAN For Modulation Classification Resiliency Against Adversarial Attacks

The Internet of Flying Things (IoFT) holds significant promise in fields like disaster management and surveillance. However, it is increasingly vulnerable to cyberattacks that can compromise the confidentiality, integrity, and availability (CIA) of sensitive data. Despite the growing interest in proposing Intrusion Detection Systems (IDSs) for IoFT networks, current literature faces key limitations, particularly the shortage of publicly available IoFT datasets with diverse attacks, and the fact that existing IDSs lack robustness against sophisticated adversarial machine learning attacks. This paper is the first study to address these limitations by proposing a more resilient and accurate IDS tailored for IoFT networks (RIDS-IoFT). We introduce a novel IDS that leverages Generative Adversarial Networks (GANs) to generate a hybrid dataset that combines real IoFT traffic data with GAN-generated adversarial attacks, addressing the dataset diversity issue. Additionally, we introduce an innovative adversarial training method to enhance the system’s defense against evolving threats, such as Fast Gradient Sign Method (FGSM), Basic Iterative Method (BIM), and Carlini & Wagner (C&W) attacks. The proposed RIDS-IoFT was evaluated using four machine learning models, Random Forest (RF), Decision Tree (DT), Support Vector Machine (SVM), and Logistic Regression (LR), on two datasets: ECU-IoFT and CICIDS2018. The IDS’s performance was assessed based on its ability to detect both traditional and adversarial attacks. The results show that the Random Forest model achieved the highest detection accuracy, up to 96.5%, demonstrating superior performance across both real and hybrid datasets. The proposed RIDS-IoFT not only enhances detection accuracy but also strengthens resilience against adversarial threats, making it suitable for resource-constrained IoFT environments. In conclusion, this study presents a comprehensive approach to securing IoFT networks by combining real and synthetic data, improving IDS robustness and accuracy against both traditional and adversarial attacks.

Although deep neural networks (DNNs) have achieved high performance across various applications, they are often deceived by adversarial examples generated by adding small perturbations. To combat adversarial attacks, many detection methods have been proposed, including feature squeezing and trapdoor. However, these methods rely on the output of DNNs or involve training a separate network to detect adversarial examples, which leads to high computational costs and low efficiency. In this study, we propose a simple and effective approach called the entropy-based detector (EBD) to protect DNNs from various adversarial attacks. EBD detects adversarial examples by comparing the difference in entropy between the input sample before and after bit depth reduction. We show that EBD can detect over 98% of the adversarial examples generated by attacks using fast-gradient sign method, basic iterative method, momentum iterative method, DeepFool and CW attacks when the false positive rate is 2.5% for CIFAR-10 and ImageNet datasets.

With the improvement of basic designs and the evolution of key algorithms, artificial intelligence (AI) has been considered by both industry and academia as the most promising solution for many electromagnetic space problems, such as automatic modulation classification (AMC). However, the fact that AI-based AMC models are vulnerable to adversarial examples mystifies the optimism. Adversarial attacks help researchers to reexamine AI-based AMC models and promote safe applications. In this paper, we study the frequency leakage and glitch problems caused by high frequency components in the adversarial perturbations of existing attack algorithms. We propose a Spectrum-focused Frequency Adversarial Attack (SFAA) algorithm to suppress the high frequency components to alleviate such problems. Next, we leverage meta-learning to improve the transferability of the proposed algorithm for black-box attacks. We also train a Channel-robust Class-universal Spectrum-focused Frequency Adversarial Attack (CrCu-SFAA) generative model using the generative adversarial network framework. Finally, extensive experiments using qualitative and quantitative indicators demonstrate that the proposed algorithm achieves an improved attack performance, and our proposed approach of reducing out-of-band high frequency components of the adversarial perturbations improves the concealment and adversarial signal quality.

Deep neural networks, despite their remarkable performance on image classification tasks, remain critically vulnerable to adversarial examples — imperceptibly perturbed inputs engineered to induce misclassification. In this paper, we propose and evaluate a dual-layer defense framework against adversarial attacks on image classifiers trained on the ImageNet1K Mini dataset. Our approach combines a convolutional autoencoder as a preprocessing denoising step with a ResNet-50 classifier augmented by a novel block-switching mechanism to disrupt adversarial gradient signal. We evaluate the system under Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) attacks across a range of perturbation budgets ε ∈ {0.01, 0.02, 0.03, 0.05, 0.07, 0.10}. Our defense recovers +23.08% accuracy against FGSM and +54.44% against PGD on in-distribution data, and achieves 100% full recovery on an out- of-distribution generalisation test (83.3% baseline). We further employ Gradient-weighted Class Activation Mapping (GRAD- CAM) to visually explain the disruption of model attention under attack and its restoration after defense. All experiments are conducted on the Kaggle T4 GPU platform, and the full pipeline is deployed as an interactive Streamlit web application.

In this paper, a novel black box adversarial computer vision attack is proposed. The introduced attack is based on removing from images some components described by their Tchebichef discrete orthogonal moments, rather than to perturb them. The contribution of this work is focused on the addition of one more clue, supporting the critical hypothesis that computer vision systems fail because they support their decisions not only in robust features but also in others non-robust ones. In this, context non-robust image features described in terms of Tchebichef moments are excluded from the original images and the approximated reconstructed versions of them are used as adversarial examples in order to attack some popular deep learning models. The experiments justify the effectiveness of the proposed adversarial attack in terms of imperceptibility and recognition error rate of the deep learning classifiers. It is worth noting that the top-1 accuracy of the attacked models was degraded by a factor between 9.48%-70.89% for adversarial images of 65dB to 57dB PSNR values. The corresponding degradation of the top-5 models’ accuracy was between 6.9% and 55.14% for the same quality images. Moreover, the proposed attack seems to have more strength than the Fast Gradient Sign Method (FGSM) attacking method traditionally applying in most cases. These results reveal that the proposed attack is able to exploit the vulnerability of the deep learning models’ towards degrading their generalization abilities. In this paper, a novel black box adversarial computer vision attack is proposed. The introduced attack is based on removing from images some components described by their Tchebichef discrete orthogonal moments, rather than to perturb them. The contribution of this work is focused on the addition of one more clue, supporting the critical hypothesis that computer vision systems fail because they support their decisions not only in robust features but also in others non-robust ones. In this, context non-robust image features described in terms of Tchebichef moments are excluded from the original images and the approximated reconstructed versions of them are used as adversarial examples in order to attack some popular deep learning models. The experiments justify the effectiveness of the proposed adversarial attack in terms of imperceptibility and recognition error rate of the deep learning classifiers. It is worth noting that the top-1 accuracy of the attacked models was degraded by a factor between 9.48%-70.89% for adversarial images of 65dB to 57dB PSNR values. The corresponding degradation of the top-5 models’ accuracy was between 6.9% and 55.14% for the same quality images. Moreover, the proposed attack seems to have more strength than the Fast Gradient Sign Method (FGSM) attacking method traditionally applying in most cases. These results reveal that the proposed attack is able to exploit the vulnerability of the deep learning models’ towards degrading their generalization abilities.

With the continuous development of wireless communication and artificial intelligence technology, Internet of Things (IoT) technology has made great progress. Deep learning methods are currently used in IoT technology, but deep neural networks (DNNs) are notoriously susceptible to adversarial examples, and subtle pixel changes to images can result in incorrect recognition results from DNNs. In the real‐world application, the patches generated by the recent physical attack methods are larger or less realistic and easily detectable. To address this problem, a Generative Adversarial Network based on Visual attention model and Style transfer network (GAN‐VS) is proposed, which reduces the patch area and makes the patch more natural and less noticeable. A visual attention model combined with generative adversarial network is introduced to detect the critical regions of image recognition, and only generate patches within the critical regions to reduce patch area and improve attack efficiency. For any type of seed patch, an adversarial patch can be generated with a high degree of stylistic and content similarity to the attacked image by generative adversarial network and style transfer network. Experimental evaluation shows that the proposed GAN‐VS has good camouflage and outperforms state‐of‐the‐art adversarial patch attack methods.

Multi-view sonar image generation via GAN trained with limited data for underwater object classification and detection

This chapter introduces the concept of adversarial attacks on image classification models built on convolutional neural networks (CNN). CNNs are very popular deep-learning models which are used in image classification tasks. However, very powerful and pre-trained CNN models working very accurately on image datasets for image classification tasks may perform disastrously when the networks are under adversarial attacks. In this work, two very well-known adversarial attacks are discussed and their impact on the performance of image classifiers is analyzed. These two adversarial attacks are the fast gradient sign method (FGSM) and adversarial patch attack. These attacks are launched on three powerful pre-trained image classifier architectures, ResNet-34, GoogleNet, and DenseNet-161. The classification accuracy of the models in the absence and presence of the two attacks are computed on images from the publicly accessible ImageNet dataset. The results are analyzed to evaluate the impact of the attacks on the image classification task.

Deep learning has revolutionized image recognition. One significant obstacle still remains, the vulnerability of these models to adversarial attacks. These attacks manipulate images with subtle changes that cause CNN misclassification. While methods, such as adversarial training, have been proposed to defend against adversarial attacks, they incur additional training costs, either extra input samples or auxiliary models. In this work, we propose an efficient approach to deploying robust models that utilize image transformations to remove adversarial noises. We investigate the performance of simple transformations and report several effective ones, including Affine blur, Gaussian blur, Median blur, and Bilateral blur against various adversarial attack methods, such as Fast Gradient Sign Method (FGSM), Randomized + FGSM (RFGSM), and Projected Gradient Descent (PGD). We apply these image transformation techniques to the widely used ImageNet dataset, and experimental results demonstrate the potential of image transformation methods as a strong defense against adversarial attacks in deep learning-based image classification systems, especially when combined with cutting-edge neural network architectures such as ResNet50 and DenseNet121. Our comprehensive results show that these transformations can significantly improve the robustness of CNN models against adversarial attacks on ImageNet, achieving a recovery rate of up to 85% to 90% without incurring extra resource costs.

In this paper, we propose a new method for detecting adversarial attacks on deep neural networks. Our algorithm is based on the intuition that attacking input images results in different displacement vectors for clean and adversarial classes. For example, if the input image is an adversarial example, the re-attacking process results in a displacement vector with a short length in the feature space, but this displacement is considerable for clean images. We train our detector based on these displacement vectors. The experimental results show that compared to the current learning-based adversarial detection methods, the proposed system is capable of detecting the adversarial examples using a far simpler network. In addition, the proposed method is independent of the attack type, and is able to detect even novel attacks. It is also revealed that the proposed system learns the discrimination function even using a small amount of training data without any hyper-parameter tuning. We obtain remarkable results in detecting adversarial examples which are placed near and far from the decision boundary, improving state-of-the-art in detecting 2-norm Carlini and Wagner attack (L2-C&W) and ∞-norm Projected Gradient Descent attack (L∞-PGD), where just Fast Gradient Sign Method (FGSM) is used for training the system.

The design of a security scheme for beamforming prediction is critical for next-generation wireless networks (5G, 6G, and beyond). However, there is no consensus about protecting beamforming prediction using deep learning algorithms in these networks. This paper presents the security vulnerabilities in deep learning for beamforming prediction using deep neural networks in 6G wireless networks, which treats the beamforming prediction as a multi-output regression problem. It is indicated that the initial DNN model is vulnerable to adversarial attacks, such as Fast Gradient Sign Method , Basic Iterative Method , Projected Gradient Descent , and Momentum Iterative Method , because the initial DNN model is sensitive to the perturbations of the adversarial samples of the training data. This study offers two mitigation methods, such as adversarial training and defensive distillation, for adversarial attacks against artificial intelligence-based models used in the millimeter-wave (mmWave) beamforming prediction. Furthermore, the proposed scheme can be used in situations where the data are corrupted due to the adversarial examples in the training data. Experimental results show that the proposed methods defend the DNN models against adversarial attacks in next-generation wireless networks.

Cognitive Radio (CR) systems allow optimizing the use of the shared radio spectrum and enhancing the coexistence among different technologies by efficiently changing certain operating parameters of the radios such as transmit-power, carrier frequency, and modulation and coding scheme in real-time. Dynamic Spectrum Access (DSA), which allows radios to dynamically access and use the unused spectrum, is one of the tasks that are fundamental for a better use of the spectrum. In this paper, we extend the previous work on Automatic Modulation Classification (AMC) by using Deep Neural Network (DNNs) and evaluate the performance of these architectures on signals that are not only modulated but are also encoded. We call this the Automatic Modulation and Coding Scheme Classification problem, or \(AMC^2\). In this problem, radio signals are classified according to the Modulation and Coding Scheme (MCS) used during their transmission. Evaluations on a data set of 802.11 radio signals, transmitted with different MCS and Signal to Noise Ratio (SNR), provide important results on the impact of some DNN hyperparameters, e.g. number of layers, batch size, etc., in the classification accuracy.

Deep learning architectures have emerged as powerful function approximators in a broad spectrum of complex representation learning tasks, such as, computer vision, natural language processing and collaborative filtering. These architectures bear a high potential to learn the intrinsic structure of data and extract valuable insights. Despite the surge in the development of state-of-the-art intelligent systems using the deep neural networks (DNNs), these systems have found to be vulnerable to adversarial examples produced by adding a small-magnitude of perturbations. Such adversarial examples are adept at misleading the DNN classifiers. In the past, different attack strategies have been proposed to produce adversarial examples in the digital, physical, and transform domain, but the likelihood to generate perceptually realistic adversarial examples require more research efforts. In this paper, we present a novel approach to produce adversarial examples by combining the single-shot fast gradient sign method (FGSM) and spatial, as well as, transform domain image processing techniques. The resulted perturbations neutralize the impact of low-intensity based regions, thus, instilling the noise only in the selective high-intensity regions of the input image. While combining the customized perturbation with one-step FGSM perturbation in an un-targeted black-box attack scenario, the proposed approach successfully fools state-of-the-art DNN classifiers with 99% adversarial examples being misclassified on the ImageNet validation dataset.

Untargeted white-box adversarial attack with heuristic defence methods in real-time deep learning based network intrusion detection system

Deep learning, particularly convolutional neural networks (CNNs), has proven valuable for brain tumor classification, aiding diagnostic and therapeutic decisions in medical imaging. Despite their accuracy, these models are vulnerable to adversarial attacks, compromising their reliability in clinical settings. In this research, we utilized a VGG16-based CNN model to classify brain tumors, achieving 96% accuracy on clean magnetic resonance imaging (MRI) data. To assess robustness, we exposed the model to Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) attacks, which reduced accuracy to 32% and 13%, respectively. We then applied a multi-layered defense strategy, including adversarial training with FGSM and PGD examples and feature squeezing techniques such as bit-depth reduction and Gaussian blurring. This approach improved model resilience, achieving 54% accuracy on FGSM and 47% on PGD adversarial examples. Our results highlight the importance of proactive defense strategies for maintaining the reliability of AI in medical imaging under adversarial conditions.