# Adversarial Sample Generation Method Based on Frequency Domain Transformation and Channel Awareness
## 7 Simulation Result
### Adversarial Sample Generation Based on Frequency Conversion and Channel Awareness  
To verify the effectiveness of the FTHA method, this study conducted a phased and progressive experiment for verification. Firstly, in the benchmark environment of the ideal channel, by comparing with traditional attack methods, the advantages of FTA in terms of perturbation efficiency and concealment are verified. Further, we introduce multi-dimensional channel conditions to construct an adversarial attack and defense test platform in real communication scenarios, and compare and analyze the performance differences between FTHA and the classic channel-aware attack strategies, as well as traditional attack methods considering channel conditions in key indicators such as attack success rates. This section mainly introduces the specific implementation process and testing of adversarial samples based on frequency-domain transformation with channel awareness. As a result, the task experiments on signal modulation recognition in this chapter were conducted in the RadiOML 2016.10A public dataset Proceed. RadioML2016 is an open-source benchmark dataset in the field of wireless communication, mainly used for modulation identification tasks. This dataset was released by [PERSON] et al. in 2016, aiming to provide a standardized test platform for the performance evaluation of deep learning models in complex wireless signal processing tasks. Its core objective is to promote the application of machine learning in fields such as wireless communication security and spectrum sensing by simulating the signal characteristics in real communication environments. It includes 11 modulation methods, covering common digital modulations (such as BPSK, QPSK, 16 QAM, 64 QAM) and analog modulations (such as AM and FM). Each sample is IQ data In complex form (in-phase and quadrature components), with a sampling length of 128 time points, which can completely capture the time-domain characteristics of the signal. Figure 11: Comparison of MSE results for different channel sparsity levels (K). By adding Gaussian white noise (AWGN) with different signal-to-noise ratios, the noise interference in actual communication is simulated. Furthermore, some data introduce channel distortions such as multipath fading and frequency shift. The dataset contains approximately 2.2 million samples in total, which are evenly distributed hierarchically by modulation type and SNR to ensure the comprehensiveness of training and evaluation. It is usually divided into the training set (80%), the validation set (10%), and the test set (10%), supporting the model development of supervised learning tasks. For the target task, namely the model of automatic modulation recognition, the commonly used models of automatic modulation recognition selected in the experiments of this chapter are as follows:  
(1) CNN1D: Modulation recognition model based on one-dimensional convolutional residual network;  
(2) CNN2D: Modulation recognition model based on two-dimensional convolutional neural networks. Firstly, without considering the channel information, in order to verify the effectiveness of the proposed adversarial attack algorithm based on frequency-domain transformation, this section selects multiple adversarial attack algorithms as baselines and compares them with the proposed method:  
(1) FGSM: It generates adversarial samples by using the gradient information of the input data, and implements attacks by adding or subtracting the sign of the gradient on each element of the input data and multiplying it by a tiny perturbation. (2) PGD: During the iterative process, adversarial samples are constructed by maximizing the loss function within the perturbation range to ensure that the generated samples have stronger interference. (3) BIM: By applying minor disturbances to the original input and conducting multiple iterations to generate adversarial samples, the loss function is maximized within the disturbance range in each iteration.