# Adversarial Sample Generation Method Based on Frequency Domain Transformation and Channel Awareness
## 7 Simulation Result
### Adversarial Sample Generation Based on Frequency Conversion and Channel Awareness
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Attack Method** & **MR (\%)** & **ACAC** & **ACTC** & \(\mathbf{L_{2}}\) \\ \hline PGD & 81.0 & 0.990 & 0.007 & 1.104 \\ FGSM & 31.7 & 0.835 & 0.072 & 1.420 \\ BIM & 81.3 & 0.902 & 0.007 & 1.190 \\ AA & 91.1 & 0.044 & 0.010 & 1.202 \\ MIFGSM & 82.9 & 0.966 & 0.005 & 1.325 \\ FTA & 93.4 & 0.938 & 0.011 & 1.062 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Performance of different methods on CNN1D under ideal channel conditions. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Attack Method** & **MR (\%)** & **ACAC** & **ACTC** & \(\mathbf{L_{2}}\) \\ \hline PGD & 72.20 & 0.849 & 0.085 & 1.247 \\ FGSM & 32.40 & 0.882 & 0.048 & 1.579 \\ BIM & 71.00 & 0.848 & 0.087 & 1.233 \\ AA & 81.01 & 0.876 & 0.069 & 1.332 \\ MIFGSM & 71.90 & 0.844 & 0.081 & 1.437 \\ FTA & 76.82 & 0.856 & 0.071 & 1.267 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Performance of different methods on CNN2D under ideal channel conditions. considering the information. It can be observed that the FTA algorithm without considering the channel effect has very poor performance, close to the no-attack situation in the low PNR region. This is because the wireless channel changes the phase and amplitude of the disturbance perceived by the receiver. Furthermore, compared with the MRPP attack, the target channel inversion attack performs poorly, which indicates the importance of the received perturbation power to the performance of the classifier at the receiver. The classification accuracy of the FTHA proposed in this paper is higher than that of MRPP and the channel inversion attack, indicating that it has better performance within a certain range of perturbation power. It can be seen from Tables 4 and 5 that under Gaussian channel conditions, the performance of the FTHA method on the CNN1D and CNN2D models is significantly better than that of other attack methods, especially in terms of the error classification rate and the average confidence of error class prediction. FTHA, as an improved method of adding channel information on the basis of FTA, can better adapt to the Gaussian channel environment and make full use of the channel characteristics to generate more threatening adversarial samples. On the CNN1D model, the misclassification rate of FTHA increased from 68.7% of FTA to 79.90%, while maintaining a relatively high average confidence level of error class prediction (0.935), indicating that it can mislead the model classification more effectively under channel conditions. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Attack Method** & **MR (\%)** & **ACAC** & **ACTC** & \(\mathbf{L_{2}}\) \\ \hline PGD & 65.00 & 0.950 & 0.020 & 1.300 \\ FGSM & 25.00 & 0.800 & 0.100 & 1.600 \\ BIM & 65.05 & 0.850 & 0.020 & 1.350 \\ AA & 69.60 & 0.800 & 0.030 & 1.400 \\ MIFGSM & 67.00 & 0.920 & 0.015 & 1.500 \\ FTA & 68.70 & 0.900 & 0.025 & 1.250 \\ FTHA & 79.90 & 0.935 & 0.019 & 1.268 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Performance of different methods on CNN1D under gaussian channel conditions. Figure 12: Classification accuracy under different attacks. On the CNN2D model, FTHA further increased the misclassification rate to 80.50%, while ACAC reached 0.912, significantly higher than other methods, demonstrating its strong attack capability under complex models. In contrast, the performance of other methods such as FGSM and PGD in the Gaussian channel environment is relatively weak, especially in the CNN2D model. The misclassification rate of FGSM is only 28.00%, significantly lower than that of FTHA, which further highlights the advantages of FTHA under channel conditions. Overall, FTHA has demonstrated stronger attack capabilities and robustness in the Gaussian channel environment by combining channel information. Whether on the CNN1D or CNN2D models, it provides a better solution for adversarial sample generation.