# Adversarial Sample Generation Method Based on Frequency Domain Transformation and Channel Awareness
## 7 Simulation Result
### Adversarial Sample Generation Based on Frequency Conversion and Channel Awareness
(4) Autoattack (AA): Combining multiple attack methods to generate more deceptive adversarial samples in an automated manner;  
(5) MIFGSM: On the basis of FGSM, a momentum term is introduced to generate adversarial samples through accelerated gradient descent. Secondly, in order to verify the effectiveness of the proposed frequency-domain transformation adversarial attack algorithm based on channel awareness, the following attack algorithms based on channel information are selected as comparative experiments in this paper:  
(1) Channel inversion attack: The attacker alters the characteristics of the wireless communication channel (such as channel gain, phase, etc. ), causing abnormal changes in the channel state;  
(2) Maximum disturbance power attack (MRPP): The attacker exploits the phase of the target communication channel obtained. Adjust the power of the interfering signal in a targeted manner based on relevant information (such as channel status information, noise characteristics, etc.) and the size of the disturbance limited by power is changed to complete the attack. As shown Table 2, under the CNN1D model and the RadioML2016.10a dataset, the frequency-domain adversarial attack method (FTA) is significantly superior to other attack algorithms in terms of attack efficiency and perturbation concealment. Specifically, the misclassification rate of FTA is 2.3% higher than that of the suboptimal method AA. Meanwhile, its perturbation energy is the lowest among the comparison methods, decreasing by 3.9% and 10.7% respectively compared with PGD and BIM. This result indicates that FTA,through the frequency-domain sparse perturbation injection strategy, can effectively cross the classifier decision boundary under extremely small perturbations. In terms of confidence offset, the adversarial samples generated by FTA show a high degree of directional misleading. The mean confidence of the error class is close to the theoretical upper limit 1, while the confidence of the correct class is compressed to a value close to zero, which is 85.3% lower than that of FGSM. Although the ACAC and ACTC indicators of FTA are not significantly different from some mature methods (such as MIFGSM), its unique frequency-domain masking mechanism achieves the optimal balance between attack effectiveness and concealment by suppressing the disturbance of redundant frequency bands. As shown in Table 3, under the experimental framework of the CNN2D model and the RadioML2016.10a dataset, the frequency-domain adversarial attack method (FTA) demonstrates balanced performance advantages. Although its attack success rate is slightly lower than that of the current optimal automatic attack AA, its disturbance concealment is significantly better than AA, reducing by 11.8% and 19.8%, respectively, compared with MIFGSM and FGSM. This result indicates that FTA, through the frequency-domain sparsification perturbation generation strategy, effectively inhibits the diffusion of redundant energy while ensuring the attack effectiveness, achieving an efficient balance between attack intensity and concealment. Further analysis reveals that the confidence misleading ability of FTA differs from that of AA by only 2.3%, while its cross-model transferability is superior to that of AA, indicating that its perturbation mode has greater generalization potential. It is worth noting that all adversarial samples in the experimental design are derived from clean samples that can be correctly classified by the target model, resulting in a non-uniform distribution of the disturbance-to-signal ratio (PNR). This will cause local inconsistencies in the relationship between the \(L_{2}\) norm and PNR, and it is necessary to optimize the data balance through dynamic signal-to-noise ratio sampling in subsequent studies. Figure 12 shows the relationship between the classifier accuracy and PNR under the proposed target white-box adversarial attack with precise channel information and compares it with the channel inversion attack and the maximum perturbation power attack