# Adversarial Sample Generation Method Based on Frequency Domain Transformation and Channel Awareness
## 5 Channel Aware Adversarial Sample Generation Method Based on Frequency Domain Transformation
The deep neural network classifier at the \(i\)th receiving end is denoted as \(f^{(i)}(\cdot;\theta_{i}):\chi\to R^{C}\), where a represents the parameters of the neural network at the \(i\)th receiving end and \(C\) is the number of modulation types. Here, \(\chi\subset C^{p}\), and \(p\) is the dimension of the complex input (in-phase/orthogonal component), which can also be expressed as the concatenation of two real input numbers. The classifier \(f^{(i)}\) assigns the modulation type \(\hat{I}^{(i)}(x,\theta_{i})=\operatorname*{argmax}_{k}f^{(i)}_{k}(x,\theta_{ i})\) to each input \(x\in\chi\), where \(f^{(i)}_{k}(x,\theta_{i})\) is the output of the \(i\)th classifier for the \(k\)th modulation type. The channel from the transmitting end to the \(i\)th receiving end is denoted as \(h_{tr_{i}}\), and the channel from the opponent to the receiving end is denoted as \(h_{ar_{i}}\). The vector forms are represented by \(h_{tr_{i}}=\big{[}h_{tr_{i},1},h_{tr_{i},2},\cdots,h_{tr_{i},p}\big{]}^{T}\in C ^{p\times 1}\) and \(h_{ar_{i}}=[h_{ar_{i},1},h_{ar_{i},2},\cdots,h_{ar_{i},p}\big{]}^{T}\in C^{p \times 1}\). When there is no adversarial attack, the transmitting end sends signal \(x\), and the signal received by the \(i\)th receiving end is \(r_{tr_{i}}=H_{tr_{i}}\chi+n_{i}\)When there is an adversarial attack, if the attacker transmits a perturbation signal \(\delta\), the signal at the \(i\)th receiving end is \(r_{ar_{i}}(\delta)=H_{tr_{i}}x+H_{ar_{i}}\delta+n_{i}\), where \(H_{tr_{i}}\) and \(H_{ar_{i}}\) are diagonal matrices as mentioned earlier, and \(n_{i}\) is Gaussian noise. Suppose the adversarial disturbance \(\delta\) and the transmitting signal \(x\) are synchronously superimposed at the receiving end to ensure the effectiveness of the attack. To achieve the concealment and energy efficiency of the attack, the adversarial perturbation \(\delta\) needs to satisfy the power constraint \(\left\|\delta\right\|_{2}^{2}\leq P_{\max}\), where \(P_{\max}\) is the preset maximum perturbation power budget. The attacker needs to design a universal perturbation \(\delta\) for the input signal \(x\) and all receiver classifiers \(f^{(i)}\) by solving the following optimization problems (44):  
\[ \begin{split}\underset{\delta}{\arg\min}&\|\delta \|_{2}\\ \text{subject to}&\tilde{l}^{(i)}(r_{tr_{i}},\theta_{i} )\
eq\tilde{l}^{(i)}(r_{ar_{i}}(\delta),\theta_{i})\quad i=1,2,\ldots,m\\ &\left\|\delta\right\|_{2}^{2}\leq P_{\max}\end{split}  \tag{44}\]  
In optimization problems (44), the objective is to minimize the perturbation power (minimize the \(L_{2}\) norm) to ensure that the perturbation power does not exceed the budget \(P_{\max}\) while satisfying all receiver classification errors. It should be noted that due to the complexity of the decision boundary of deep neural networks, the optimal solution may not be obtained at point \(\left\|\delta\right\|_{2}^{2}=P_{\max}\). The analysis will be carried out from the single-receiver scenario (m = 1), and the receiver index \(i\) will be omitted to simplify the expression. For targeted attacks, the attacker designs the perturbation \(\delta\) by minimizing the loss function \(J(r_{ar},y,\phi)\). Based on the fast gradient method (FGM), the loss function can be linearly approximated as \(J(r_{ar},y,\phi)\approx J(r_{tr},y,\phi)+(H_{ar}\delta)^{T}\
abla_{x}J(r_{tr},y,\phi)\). Minimization is achieved by setting \(H_{ar}\delta=-\beta J(r_{tr},y,\phi)\), and \(\beta\) is the scaling factor used to constrain the adversarial disturbance power to \(P_{\max}\). In the MRPP attack [37], the attacker maximizes the perturbation power at the receiving end by selecting perturbations and analyzes the impact of this power on the classifier decision-making process. To achieve this goal, attackers need to make full use of the channel characteristics between the attacker and the receiving end.