Adversarial Examples in RF Deep Learning: Detection and Physical Robustness While research on adversarial examples (AdExs) in machine learning for images has been prolific, similar attacks on deep learning (DL) for radio frequency (RF) signals and corresponding mitigation strategies are scarcely addressed in the published work, with only a handful of recent publications in the RF domain. With minimal waveform perturbation, RF adversarial examples (AdExs) can cause a substantial increase in misclassifications for spectrum sensing survey applications (e.g. ZigBee mistaken for Bluetooth). In this work, two statistical tests for AdEx detection are proposed. One statistical test leverages the peaktoaveragepower ratio (PAPR) of the RF samples. The second test uses the softmax outputs of the machine learning model, which is proportional to the likelihoods the classifier assigns to each of the trained classes. The first test leverages the RF nature of the data while the latter is universally applicable to AdExs regardless of the domain. Both solutions are shown as viable mitigation methods to subvert adversarial attacks against RF waveforms, and their effectiveness is analyzed as function of the propagation channel and type of waveform.

A LabelBased Approach for Automatic Identifying Adversarial Examples with Image Transformation Besides extraordinary results that deep neural networks are widely deployed in many fields such as computer vision, speech recognition, and natural language processing, in recent years deep neural networks have been recognized vulnerable to intentional modification of legitimate inputs called adversarial examples. These patterns are almost indistinguishable from AI models and human perception. Adversarial examplesu0027 concern is rising dramatically and is attracted by many researchu0027s apprehensiveness because of its tremendous impact. Unfortunately, until now there is none of the defenses has been shown to be very effective. In this paper, we introduce a new defense strategy against adversarial examples by using a labelbased endtoend system. Our proposed defense system can mostly distinguish adversarial samples and benign images without human intervention. We exploit the important role of spatial domain in adversarial attacks and proposing a stateoftheart method for detecting adversarial examples based on our observation. We evaluate our systemu0027s performance on a variety of standard benchmark datasets including MNIST and ImageNet. Our proposed method reached out detection rates in a range from 94.6% to 99.2% in many settings.