# Adversarial Sample Generation Method Based on Frequency Domain Transformation and Channel Awareness
## 5 Channel Aware Adversarial Sample Generation Method Based on Frequency Domain Transformation
\right\} \tag{39}\]  
Therefore, the discrete Fourier transform of the modulated signal of length \(L\) in the I/Q two channels can be expressed as:  
\[X(m)=\sum_{n=0}^{L-1}x(n)\cdot e^{j\frac{2n}{L}mn} \tag{40}\]  
Correspondingly, the frequency-domain signal can be converted into a time-domain signal through the inverse discrete Fourier transform, and its expression is:  
\[x(n)=\frac{1}{N}\sum_{m=0}^{L-1}X(m)\cdot e^{j\frac{2n}{L}mn} \tag{41}\]  
Based on the existing research and analysis, if the sensitivity of different frequency components of the sample to model recognition can be explored and malicious disturbances can be generated guided by this, the generated adversarial samples will be more targeted and threatening. For this purpose, this section proposes a frequency-domain signal processing method based on random masks. By inputting samples under different frequency distributions and observing the feedback of the model, the specific operation process \(T(x)\) can be expressed as:  
\[ \begin{split} T(x)&=IDFT((DFT(x)+DFT(\xi))\odot M)\\ &=IDFT(DFT(x+\xi)\odot M)\end{split}  \tag{42}\]  
where \(DFT(\cdot)\) and \(IDFT(\cdot)\) represent the discrete Fourier transform and inverse discrete Fourier transform, \(\xi\sim N(0,\delta^{2})\) represents random noise obeying a Gaussian distribution. \(M\sim U(1-\rho,1+\rho)\) represents the mask matrix, whose elements are random samples in a uniform distribution, and \(\odot\) represents the Hadamar product, which is the product of each element in matrix operations. The frequency domain conversion process F can be seen as shown on Figure 2.  
Furthermore, the signal data processed by Equation (42) are input into the target classification model and the model gradient information \(g\) is obtained. In order to obtain more reliable frequency-domain sensitivity information, in this section, the process \(T\) is selected for \(N\) times, that is, the noise \(\xi_{i}\) and mask \(M_{n}\) generated in each round, and a set of gradient information \(M_{n}\) is obtained, where \(n=1,2,\ldots N\). After completion, continue to sum the \(N\) gradients and calculate the average value. The total gradient information highlights the sensitive regions of the model for robust rows and key features, thereby guiding adversarial samples to be generated in a more threatening direction. Each generated mask element follows a uniform distribution. In this section, the weights of the time-domain and frequency-domain components of each gradient are set to 1. Finally, the obtained gradient information is combined with the attack algorithm in Equation (12) to generate adversarial samples. To sum up, the complete adversarial attack algorithm based on frequency-domain transformation can be summarized as the following formula:  
\[ \begin{split}& x_{i+1}^{\prime}=\\ & clip_{x,\xi}\Big{\{}x_{i}^{\prime}+\alpha\cdot sign\Big{(}\frac {1}{N}\sum_{n=1}^{N}\
abla_{x_{i}^{\prime}}I\big{(}T(x_{i}^{\prime}),y,H\big{)} \Big{)}\Big{\}}\end{split}  \tag{43}\]  
where \(\epsilon\) represents the limit of the disturbance \(L_{\infty}\), \(\alpha=\epsilon/I\), \(I\) represents the number of iterations \(sign(\cdot)\) represents the sign function, \(\alpha\) represents the iteration step size, \(J(\cdot)\) represents the target model loss function, and \(H\) represents the channel matrix information. Next, consider a wireless communication system composed of one transmitter, \(m\) receivers, and one adversary. All nodes are equipped with an antenna and operate on the same channel. Each receiver uses a neural network to classify the signals it receives into the modulation type used by the transmitter. Meanwhile, the opponent transmits disturbance signals through the air, deceiving the classifier on the receiver into making mistakes in modulation classification, thereby enabling the attack to succeed.