# SCS-JPGD: Single-Channel-Signal Joint Projected Gradient Descent
## 3 Methods
### Signal Projected Gradient Descent
Since the convolution operation is locally perceptive, the perturbation in the SPGD attack will locally affect the sampled points of the input signal and propagate through the convolution operation to the output feature map. The local perception of the convolution layer means that the convolution kernel performs a weighted sum over only a small region of the input signal. Thus, the perturbation \(\Delta x\) on the input signal also has a local effect. Let us assume a small perturbation \(\Delta x\) is applied to the input signal \(x\), resulting in the perturbed signal \(x^{\prime}=x+\Delta x\). The output of the convolution operation will change, as shown in Equations (7) and (8). \[y^{\prime}_{i}=\sum_{m=-k}^{k}(x_{i+m}+\Delta x_{i+m})w_{m} \tag{7}\]  
\[y^{\prime}_{i}=\sum_{m=-k}^{k}x_{i+m}w_{m}+\sum_{m=-k}^{k}\Delta x_{i+m}w_{m} \tag{8}\]  
The first term represents the original output without perturbation, and the second term represents the effect of the perturbation. This indicates that the perturbation propagates through the convolution kernel with weighted influence, affecting the local output values. Since the convolution operation is a weighted average, the perturbation is transmitted and accumulated within specific local regions, potentially causing a significant impact on the output. In the SPGD attack, the gradient calculation plays a decisive role in the propagation of the perturbation. Since the convolution operation involves a weighted sum over local regions, the gradient of the loss function also locally affects the sampled points of the input signal. During backpropagation, the gradient adjusts the input signal based on the weight distribution of the convolution kernel and the properties of local perception. Specifically, the gradient backpropagation in the convolution layer adjusts the input signal according to the region covered by the convolution kernel, and the local perturbation propagates through the convolution layer to influence the output. Thus, in the SPGD attack, when perturbations are applied along the gradient direction of the loss function, the backpropagation process through the convolution layer effectively makes small adjustments to the local regions of the input signal. Due to the weighted effect of the convolution kernel, these local adjustments accumulate in the output signal, causing the final output to change. Ultimately, SPGD iteratively modifies the input signal by applying perturbations in the direction of the gradient. Let the gradient of the cross-entropy loss function \(\mathcal{L}_{\text{CE}}\) with respect to the input signal \(x\) be denoted as \(\
abla_{x}\mathcal{L}_{\text{CE}}\). The cross-entropy loss \(\mathcal{L}_{\text{CE}}\) is expressed as  
\[\mathcal{L}_{\text{CE}}=-\sum_{i=1}^{C}y_{i}\log(p_{i}) \tag{9}\]  
where \(C\) is the number of classes, \(y_{i}\) is the true label for class \(i\), and \(p_{i}\) is the predicted probability for class \(i\). The gradient of \(\mathcal{L}_{\text{CE}}\) with respect to the input signal \(x\) is  
\[\
abla_{x}\mathcal{L}_{\text{CE}}=-\sum_{i=1}^{C}y_{i}\frac{1}{p_{i}}\
abla_{ x}p_{i} \tag{10}\]The SPGD update rule is then given by  
\[x^{(t+1)}=x^{(t)}+\alpha\cdot\text{sign}\Bigg{(}-\sum_{i=1}^{C}y_{i}\frac{1}{p_{i }}\
abla_{x}p_{i}\Bigg{)} \tag{11}\]  
At each iteration, the perturbation \(\Delta x\) is applied along the gradient direction, which propagates through the convolution layers' local receptive fields to the output layer. Because the convolution operation is sensitive to local regions, SPGD can iteratively adjust the signal values in these regions. This iterative process misguides the network into making incorrect predictions, ultimately generating adversarial samples. The mathematical definition of SPGD is given by the following update rule:  
\[ \begin{split} x_{0}&=x\\ x_{t+1}&=\text{Proj}_{x,e}(x_{t}+\alpha\cdot\text{ sign}(\
abla_{x}J(\theta,x_{t},y)))\end{split}  \tag{12}\]  
where \(x\) is the original input, \(y\) is the true label, and \(J(\theta,x,y)\) is the loss function, such as cross-entropy loss.