Pith. sign in

REVIEW 3 major objections 6 minor 55 references

Attention-based Adversarial Robust Distillation in Radio Signal Classifications for Low-Power IoT Devices

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a compact transformer for radio-signal modulation classification can gain adversarial robustness by matching the attention maps of a robustly trained larger transformer, and that this attention-based distillation…

desk verdict Novel attention-map distillation for compact transformers, but the weak PGD protocol and missing hyperparameters leave the robustness claim unproven. read the letter →

arxiv 2506.11892 v1 pith:LIXMGSS7 submitted 2025-06-13 cs.LG cs.AI

Lu Zhang , Sangarapillai Lambotharan , Gan Zheng , Guisheng Liao , Basil AsSadhan , Fabio Roli This is my paper · ORCID
classification cs.LGcs.AI
keywords automaticmodulationclassificationtransformeradversarialexamplesrobustnessdistillationattentionmapsIoTdeviceswhite-boxattacksradiosignal
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Automatic modulation classification by transformer networks is vulnerable to small adversarial perturbations, and the standard fix of adversarial training does not transfer well to the small, low-power transformer models suitable for IoT devices. The paper proposes ATARD, a distillation method that trains a compact student transformer to reproduce the adversarial attention maps of a larger, adversarially pre-trained teacher transformer while also classifying adversarial examples correctly. ATARD is claimed to beat adversarial training and four existing robustness-distillation baselines under white-box FGM and PGD attacks, with the largest gaps at higher perturbation levels: at PNR = -10 dB under PGD, roughly 13% higher accuracy than AT and about 10% higher than ARD, AKD, and RSLAD. The authors trace this to a smoother decision surface, reporting that ATARD has the smallest average input-gradient norm among all compared methods. If the claims hold, a compact transformer with about 230,000 parameters, versus about 800,000 for the teacher, can keep modulation classification robust enough for low-power, resource-limited radio receivers.

What carries the argument

The adversarial attention map ($\mathrm{AAM}$) is the average across attention heads of the scaled-dot-product attention weights $\mathrm{softmax}(Q_i K_i^T / \sqrt{d_k})$ computed inside each transformer encoder layer on adversarial inputs. This object carries the argument: the teacher's robustly trained attention maps are treated as a representation of where robust attention should focus, and the compact student is forced to match them layer-wise under an L2 penalty while learning to classify PGD perturbations correctly. The loss is $\mathcal{L}_{\mathrm{ATARD}} = \mathrm{CE}(S(x_{\mathrm{adv}}), y) + \sum_{k=1}^{N_T-1} \|\mathrm{AAM}^k_T - \mathrm{AAM}^1_S\|_2 + \sum_{k=2}^{N_T} \|\mathrm{AAM}^k_T - \mathrm{AAM}^2_S\|_2$. This gives the student a robustness signal at the level of intermediate representations, not only at the level of final predictions.

What would settle it

Retrain every baseline and ATARD with identical hyperparameters, the same training budget, and multiple random seeds, then report the tuned-best accuracy under PGD at PNR = -10 dB; if a well-tuned AT, RSLAD, or logits-only distillation matches or exceeds ATARD's accuracy, the attention-map mechanism is not the cause of the reported advantage.

Watch

Extended reading notes

Core claim

ATARD transfers robustness across transformer generations by matching an adversarial attention map rather than logits. For each training batch, the student generates 3-step PGD adversarial samples, feeds them to both networks, averages the multi-head softmax attention maps per encoder layer, and minimizes an L2 distance between student layer 1 and teacher layers 1 through 3 and between student layer 2 and teacher layers 2 through 4, together with cross-entropy on the adversarial samples. The teacher is first trained with standard adversarial training. On the RML2016.19a dataset at PNR = -10 dB, the student reaches about 71.7% accuracy under FGM and beats AT by roughly 13 percentage points under PGD, with similar gains on the RDL2021.12 dataset under Rayleigh and Rician fading with mixed Gaussian and alpha-stable noise. The paper also reports that ATARD-trained models retain higher accuracy against adversarial examples transferred from two surrogate transformer architectures.

Load-bearing premise

The head-to-head gains rest on the baselines being trained just as well as ATARD, but because the paper reports no learning rates, epochs, batch sizes, or variance across runs, a reader cannot rule out that the comparison models were undertrained.

Editorial extensions

If this is right

  • A roughly 230,000-parameter transformer trained with ATARD can operate on low-power IoT devices while still resisting white-box FGM and PGD attacks.
  • Attackers need noticeably more perturbation power to fool an ATARD model, because its loss surface is flatter than those of the compared defenses.
  • ATARD's robustness transfers to unseen conditions, with gains reported on a second dataset containing heavy-tailed alpha-stable noise and Rayleigh or Rician fading.
  • Distilling attention maps rather than logits gives transformer-specific defenses a new target, since attention distributions are the intermediate state that differs from convolutional architectures.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Attention-map matching is a stronger regularizer than logit matching, so part of the gain may come from representation smoothing rather than from the teacher's robustness; testing a logits-only oracle on the same student architecture would isolate the mechanism.
  • The reported comparison leaves open whether carefully tuned baselines, especially RSLAD, would close the gap; an apples-to-apples hyperparameter sweep across all methods is the natural next check.
  • Because the teacher's attention maps are needed only during training, ATARD adds no inference-time cost to the compact student, which is what makes it plausible for battery-limited devices.
  • A similar adversarial-attention distillation could be tried for other transformer tasks under compression, such as vision or language models, whenever a large robust teacher is available.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes ATARD, an attention-based adversarial robustness distillation method for transformer-based automatic modulation classification (AMC), targeting deployment on low-power IoT devices. A large teacher transformer is first robustly trained with 3-step PGD adversarial training. A compact student transformer is then trained to (i) minimize cross-entropy on adversarial examples and (ii) match averaged multi-head attention maps extracted from the teacher on adversarial inputs, with student layers 1 and 2 aligned to teacher layers 1-3 and 2-4 respectively. Experiments on RML2016.10a and RDL2021.12 datasets compare ATARD against normal training, AT, ARD, IAD, AKD, and RSLAD under white-box FGM and PGD attacks, reporting higher robustness across a range of perturbation-to-noise ratios, lower input-gradient norms, and improved resistance to transferred attacks from surrogate transformers.

Significance. The core idea is novel and relevant: transferring adversarial attention maps from a robust large transformer to a compact student is a sensible way to preserve robustness under a strict parameter budget, and the paper cleanly quantifies the parameter reduction (801,675 to 230,699). The application to transformer-based AMC for IoT is timely, and the layer-wise pairing of attention maps is a reasonable inductive bias. The paper does not ship code or machine-checked proofs, and the empirical support rests on a comparison protocol that, as detailed below, lacks essential controls. Nevertheless, if the reported advantage survives stronger attacks and properly matched baselines, this would be a useful contribution to robust AMC and to adversarial distillation for transformers. The significance is therefore real but conditional on the evaluation being substantially strengthened.

major comments (3)
  1. [IV-B, Algorithm 3] The PGD evaluation protocol is not sufficient to support the white-box robustness claim. Algorithm 3 terminates on the first misclassification, does not state a maximum number of iterations or the step size eta0, and optimizes only the cross-entropy loss with respect to the true label. Because the defense is defined by the full loss in Eq. (15), which includes the attention-matching terms, a white-box adversary should attack the full objective (or use a standard attack such as AutoAttack with multiple restarts). As presented, the small input-gradient norm reported in Table III for ATARD (0.015, about half of the next-best RSLAD at 0.032) is equally consistent with genuine flatness and with obfuscated gradients/gradient masking; the paper does not rule out the latter. This is a load-bearing weakness because the headline claim in Section V is that ATARD achieves better robustness than all baselines.
  2. [IV-B] The comparison against AT, ARD, IAD, AKD, and RSLAD is missing essential training details. No learning rate, number of epochs, batch size, optimizer, or PGD step count / step size for adversarial training are reported for any method. The paper states that 'experiments are repeated for ten times and the average performance is presented,' but it does not report standard deviations or any statistical significance measure. Without these, the apparent 10-13% margins at PNR = -10 dB (Section IV-B) cannot be separated from the possibility that the baselines were undertrained relative to ATARD. This directly affects the central comparison claim.
  3. [III-A, Eq. (15)] The smoothness argument that supports the method is not validated as a robustness guarantee. The paper equates a smaller average l2-norm of the gradient of the cross-entropy loss with respect to the input (Table III) with smoother decision boundaries and hence higher robustness, illustrated by the 2-D example in Figure 5. However, a small local gradient is not a guarantee that no adversarial examples exist within the l2-ball, and in adversarial robustness a small gradient can be a sign of gradient masking. The paper cites Athalye et al. [42] and Croce and Hein [43] but does not apply their recommended evaluation practices. To make the smoothness claim load-bearing, the paper should either provide a theoretical connection or replace this supporting evidence with attack-based measures that directly evaluate the full loss landscape.
minor comments (6)
  1. [IV-A] The dataset name is inconsistent: the abstract and Section IV-A refer to RML2016.19a, while the same paragraph and later text refer to RML2016.10a; the correct identifier should be used throughout.
  2. [Appendix, Eqs. (21)-(23)] Equation (22) is written as Q = Z U_K; it should be K = Z U_K (the query, key, and value projections are distinct and should be labeled consistently with Eqs. (21) and (23)).
  3. [Algorithm 3] The repeat-until loop terminates only when the predicted label changes; for samples that are never misclassified within a finite budget, the loop would not end. A maximum iteration count should be specified, as is standard in PGD.
  4. [Section II, Eq. (5)] The parameter beta in the definition of alpha is not defined; the authors should state its value and role in the confidence calibration.
  5. [Section III-B] There is a typo in the hardware description: 'NVIDIA GEforce RTX 2080 Ti' should be 'NVIDIA GeForce RTX 2080 Ti'.
  6. [Algorithm 2] The structure of Algorithm 2 is confusing: the for loop over targets t is not reflected in the later lines, and the 'until' condition appears to be independent of the loop. The algorithm should be rewritten so that the return is clearly inside the loop and the loop terminates when a targeted attack succeeds.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ATARD's central loss and its robustness comparisons are independent; no prediction reduces to a fitted input or self-citation by construction.

full rationale

The derivation chain is empirical and self-contained with respect to the paper's central claim. The proposed objective in Eq. (15) combines cross-entropy on adversarial examples with L2 matching between teacher and student attention maps; this is a constructive design choice, not a restatement of the FGM/PGD accuracies reported in Figures 6-9. The reported advantage over AT, ARD, IAD, AKD, and RSLAD is obtained by running the same attack protocol on trained models, so the comparison is not forced by the loss definition. Self-citations [31] and [32] provide prior vulnerability evidence and the teacher architecture, but they do not encode the result that ATARD outperforms the baselines; that result comes from the experiments in Section IV. The gradient-norm smoothness evidence in Table III is a post-hoc measurement offered as an explanation, not an input fitted to the accuracy numbers. Concerns about unreported training hyperparameters, weak PGD settings, or possible gradient masking are robustness-evaluation risks and do not make the derivation circular.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The central claim rests on the assumption that attention maps are a meaningful carrier of robustness, on the correctness of the epsilon model, and on an ad hoc layer pairing. No new physical entities are introduced.

free parameters (5)
  • alpha (AT, ARD, IAD, RSLAD) = 0.5
    Weight balancing clean and adversarial losses; chosen as in Goodfellow et al. [24], not tuned for this task.
  • lambda1, lambda2 (AKD) = 0.5, 0.25
    Hyperparameters for AKD teacher weighting, taken from [46] default settings.
  • temperature t (ARD) = 1
    Used in KL divergence for distillation; fixed to 1.
  • PGD steps for training = 3
    Number of iterations for adversarial example generation during training, following [41].
  • Number of test samples for attacks = 1000
    All robustness evaluations use 1000 samples from the testing set at SNR=10 dB.
assumptions (3)
  • domain assumption The teacher transformer, after adversarial training, contains transferable robustness knowledge in its averaged attention maps.
    The core of ATARD is that matching AAMs transfers robustness; no proof is given, only a gradient-norm heuristic (Table III).
  • domain assumption The epsilon bound in Eq. (16) correctly models the threat: signal and noise are independent, noise power is N = P_x/(SNR+1), and the attacker uses exactly this epsilon.
    The white-box attack evaluation assumes the adversary uses the same epsilon formula derived from PNR and SNR.
  • ad hoc to paper Layer-wise pairing of teacher and student attention maps (student layer 1 to teacher layers 1-3, student layer 2 to teacher layers 2-4) is a sensible way to transfer robustness.
    No justification is given for this specific pairing; it is an ad hoc design choice in Eq. (15).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Attention-based Adversarial Robust Distillation in Radio Signal Classifications for Low-Power IoT Devices." pith.science (2026). https://pith.science/paper/LIXMGSS7

@misc{pith2026250611892,
  author       = {Pith},
  title        = {Pith review of: Attention-based Adversarial Robust Distillation in Radio Signal Classifications for Low-Power IoT Devices},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LIXMGSS7}},
  note         = {Machine review of arXiv:2506.11892}
}
read the original abstract

Due to great success of transformers in many applications such as natural language processing and computer vision, transformers have been successfully applied in automatic modulation classification. We have shown that transformer-based radio signal classification is vulnerable to imperceptible and carefully crafted attacks called adversarial examples. Therefore, we propose a defense system against adversarial examples in transformer-based modulation classifications. Considering the need for computationally efficient architecture particularly for Internet of Things (IoT)-based applications or operation of devices in environment where power supply is limited, we propose a compact transformer for modulation classification. The advantages of robust training such as adversarial training in transformers may not be attainable in compact transformers. By demonstrating this, we propose a novel compact transformer that can enhance robustness in the presence of adversarial attacks. The new method is aimed at transferring the adversarial attention map from the robustly trained large transformer to a compact transformer. The proposed method outperforms the state-of-the-art techniques for the considered white-box scenarios including fast gradient method and projected gradient descent attacks. We have provided reasoning of the underlying working mechanisms and investigated the transferability of the adversarial examples between different architectures. The proposed method has the potential to protect the transformer from the transferability of adversarial examples.

Figures

Figures reproduced from arXiv: 2506.11892 by the authors.

Figure 1
Figure 1. A military scenario of the adversarial examples in [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The architecture of the transformer-based teacher network [32]. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. The architecture of the proposed ATARD method. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (8 more)
Figure 5
Figure 5. Figure 5: An illustrative example of the ”smoothness” of a neural [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Classification accuracy against FGM attacks for a wide [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Classification accuracy against PGD attacks for a wide [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Classification accuracy against PGD attacks for a wide [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: Classification accuracy against PGD attacks for a wide [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 10
Figure 10. Figure 10: Classification accuracy against FGM attacks produced [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 11
Figure 11. Figure 11: Classification accuracy against PGD attacks produced [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]
Figure 12
Figure 12. Figure 12: Classification accuracy against FGM attacks produced [PITH_FULL_IMAGE:figures/full_fig_p010_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 44 canonical work pages

  1. [42]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,

    A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in International conference on machine learning. PMLR, 2018, pp. 274–283

    2018

  2. [43]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,

    F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in International conference on machine learning. PMLR, 2020, pp. 2206–2216

    work page 2020

  3. [1]

    Integrating sensing and communications for ubiquitous iot: Applications, trends, and challenges,

    Y . Cui, F. Liu, X. Jing, and J. Mu, “Integrating sensing and communications for ubiquitous iot: Applications, trends, and challenges,” IEEE Network, vol. 35, no. 5, pp. 158–167, 2021

    work page 2021

  4. [2]

    Machine learning-based 5g ran slicing for broadcasting ser- vices,

    J. Mu, X. Jing, Y . Zhang, Y . Gong, R. Zhang, and F. Zhang, “Machine learning-based 5g ran slicing for broadcasting ser- vices,” IEEE Transactions on Broadcasting , 2021

    work page 2021

  5. [3]

    Device-free wireless sensing for human detection: the deep learning perspective,

    R. Zhang, X. Jing, S. Wu, C. Jiang, J. Mu, and F. R. Yu, “Device-free wireless sensing for human detection: the deep learning perspective,” IEEE Internet of Things Journal , vol. 8, no. 4, pp. 2517–2539, 2020

    work page 2020

  6. [4]

    Energy-efficient data collection and device positioning in uav- assisted iot,

    Z. Wang, R. Liu, Q. Liu, J. S. Thompson, and M. Kadoch, “Energy-efficient data collection and device positioning in uav- assisted iot,” IEEE Internet of Things Journal , vol. 7, no. 2, pp. 1122–1139, 2019

    work page 2019

  7. [5]

    Automatic modulation classification technique for radio monitoring,

    C. Weber, M. Peter, and T. Felhauer, “Automatic modulation classification technique for radio monitoring,” Electronics Let- ters, vol. 51, no. 10, pp. 794–796, 2015

    work page 2015

  8. [6]

    Applica- tions of machine learning to cognitive radio networks,

    C. Clancy, J. Hecker, E. Stuntebeck, and T. O’Shea, “Applica- tions of machine learning to cognitive radio networks,” IEEE Wireless Communications, vol. 14, no. 4, pp. 47–52, 2007

    work page 2007

Show all 55 references
  1. [7]

    Novel automatic modulation classification using cumulant features for communications via multipath channels,

    H.-C. Wu, M. Saquib, and Z. Yun, “Novel automatic modulation classification using cumulant features for communications via multipath channels,” IEEE Transactions on Wireless Communi- cations, vol. 7, no. 8, pp. 3098–3105, 2008

    2008

  2. [8]

    Automatic modulation classification for cogni- tive radios using cyclic feature detection,

    B. Ramkumar, “Automatic modulation classification for cogni- tive radios using cyclic feature detection,” IEEE Circuits and Systems Magazine, vol. 9, no. 2, pp. 27–45, 2009

    2009

  3. [9]

    Au- tomatic modulation recognition of digital signals using wavelet features and svm,

    C.-S. Park, J.-H. Choi, S.-P. Nah, W. Jang, and D. Y . Kim, “Au- tomatic modulation recognition of digital signals using wavelet features and svm,” in 2008 10th International Conference on Advanced Communication Technology. IEEE, 2008, pp. 387– 390

    2008

  4. [10]

    Hierarchical digital modulation classification using cumulants,

    A. Swami and B. M. Sadler, “Hierarchical digital modulation classification using cumulants,” IEEE Transactions on commu- nications, vol. 48, no. 3, pp. 416–429, 2000

    2000

  5. [11]

    Signal classification using statistical moments,

    S. S. Soliman and S.-Z. Hsue, “Signal classification using statistical moments,” IEEE Transactions on Communications , vol. 40, no. 5, pp. 908–916, 1992

    1992

  6. [12]

    Convolutional radio modulation recognition networks,

    T. J. O’Shea, J. Corgan, and T. C. Clancy, “Convolutional radio modulation recognition networks,” in Engineering Applications of Neural Networks: 17th International Conference, EANN 2016, Aberdeen, UK, September 2-5, 2016, Proceedings 17 . Springer, 2016, pp. 213–226

    2016

  7. [13]

    Over-the-air deep learning based radio signal classification,

    T. J. O’Shea, T. Roy, and T. C. Clancy, “Over-the-air deep learning based radio signal classification,” IEEE Journal of Selected Topics in Signal Processing , vol. 12, no. 1, pp. 168– 179, 2018

    2018

  8. [14]

    High-capacity complex convolutional neural networks for I/Q modulation classification,

    J. Krzyston, R. Bhattacharjea, and A. Stark, “High-capacity complex convolutional neural networks for I/Q modulation classification,” arXiv preprint arXiv:2010.10717 , 2020

    2010 arXiv

  9. [15]

    Sequential convolutional recurrent neural networks for fast automatic mod- ulation classification,

    K. Liao, Y . Zhao, J. Gu, Y . Zhang, and Y . Zhong, “Sequential convolutional recurrent neural networks for fast automatic mod- ulation classification,” IEEE Access, vol. 9, pp. 27 182–27 188, 2021

    2021

  10. [16]

    Fast deep learning for automatic modulation classification,

    S. Ramjee, S. Ju, D. Yang, X. Liu, A. E. Gamal, and Y . C. Eldar, “Fast deep learning for automatic modulation classification,” arXiv preprint arXiv:1901.05850 , 2019

    1901 arXiv

  11. [17]

    Multi- signal modulation classification using sliding window detection and complex convolutional network in frequency domain,

    C. Hou, G. Liu, Q. Tian, Z. Zhou, L. Hua, and Y . Lin, “Multi- signal modulation classification using sliding window detection and complex convolutional network in frequency domain,”IEEE Internet of Things Journal , 2022

    2022

  12. [18]

    A lightweight decentralized learning- based automatic modulation classification method for resource- constrained edge devices,

    B. Dong, Y . Liu, G. Gui, X. Fu, H. Dong, B. Adebisi, H. Gacanin, and H. Sari, “A lightweight decentralized learning- based automatic modulation classification method for resource- constrained edge devices,” IEEE Internet of Things Journal , 2022

    2022

  13. [19]

    Automatic modulation classification based on decentralized learning and ensemble learning,

    X. Fu, G. Gui, Y . Wang, H. Gacanin, and F. Adachi, “Automatic modulation classification based on decentralized learning and ensemble learning,” IEEE Transactions on Vehicular Technol- ogy, 2022

    2022

  14. [20]

    An image is worth 16x16 words: Trans- formers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al. , “An image is worth 16x16 words: Trans- formers for image recognition at scale,” arXiv preprint arXiv:2010.11929, 2020

    2010 arXiv

  15. [21]

    Pyramid vision transformer: A versatile backbone for dense prediction without convolutions,

    W. Wang, E. Xie, X. Li, D.-P. Fan, K. Song, D. Liang, T. Lu, P. Luo, and L. Shao, “Pyramid vision transformer: A versatile backbone for dense prediction without convolutions,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 568–578

    2021

  16. [22]

    Levit: a vision transformer in convnet’s clothing for faster inference,

    B. Graham, A. El-Nouby, H. Touvron, P. Stock, A. Joulin, H. J ´egou, and M. Douze, “Levit: a vision transformer in convnet’s clothing for faster inference,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 12 259–12 269

    2021

  17. [23]

    Mcformer: A transformer based deep neural network for automatic modulation classification,

    S. Hamidi-Rad and S. Jain, “Mcformer: A transformer based deep neural network for automatic modulation classification,” in 2021 IEEE Global Communications Conference (GLOBE- COM). IEEE, 2021, pp. 1–6

    2021

  18. [24]

    Explain- ing and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explain- ing and harnessing adversarial examples,” arXiv preprint 12 arXiv:1412.6572, 2014

    2014 arXiv

  19. [25]

    Ac- cessorize to a crime: Real and stealthy attacks on state-of-the- art face recognition,

    M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Ac- cessorize to a crime: Real and stealthy attacks on state-of-the- art face recognition,” in Proceedings of the 2016 acm sigsac conference on computer and communications security , 2016, pp. 1528–1540

    2016

  20. [26]

    Adversarial examples for semantic segmentation and object detection,

    C. Xie, J. Wang, Z. Zhang, Y . Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic segmentation and object detection,” in Proceedings of the IEEE international conference on computer vision , 2017, pp. 1369–1378

    2017

  21. [27]

    Universal adversarial perturbations against semantic im- age segmentation,

    J. Hendrik Metzen, M. Chaithanya Kumar, T. Brox, and V . Fis- cher, “Universal adversarial perturbations against semantic im- age segmentation,” in Proceedings of the IEEE international conference on computer vision , 2017, pp. 2755–2764

    2017

  22. [28]

    Adversarial examples for evaluating read- ing comprehension systems,

    R. Jia and P. Liang, “Adversarial examples for evaluating read- ing comprehension systems,” arXiv preprint arXiv:1707.07328, 2017

    2017 arXiv

  23. [29]

    Generating adversarial malware exam- ples for black-box attacks based on gan,

    W. Hu and Y . Tan, “Generating adversarial malware exam- ples for black-box attacks based on gan,” arXiv preprint arXiv:1702.05983, 2017

    2017 arXiv

  24. [30]

    Adversarial attacks on deep- learning based radio signal classification,

    M. Sadeghi and E. G. Larsson, “Adversarial attacks on deep- learning based radio signal classification,” IEEE Wireless Com- munications Letters, vol. 8, no. 1, pp. 213–216, 2018

    2018

  25. [31]

    Countermeasures against adversarial examples in radio signal classification,

    L. Zhang, S. Lambotharan, G. Zheng, B. AsSadhan, and F. Roli, “Countermeasures against adversarial examples in radio signal classification,” IEEE Wireless Communications Letters, vol. 10, no. 8, pp. 1830–1834, 2021

    2021

  26. [32]

    Adversarial learning in transformer based neural network in radio signal classifi- cation,

    L. Zhang, S. Lambotharan, and G. Zheng, “Adversarial learning in transformer based neural network in radio signal classifi- cation,” in ICASSP 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 2022, pp. 1–5

    2022

  27. [33]

    Access control and resource allocation for m2m communications in industrial automation,

    Z. Zhou, Y . Guo, Y . He, X. Zhao, and W. M. Bazzi, “Access control and resource allocation for m2m communications in industrial automation,” IEEE Transactions on Industrial Infor- matics, vol. 15, no. 5, pp. 3093–3103, 2019

    2019

  28. [34]

    Deep cognitive perspective: Resource allocation for noma-based heterogeneous iot with imperfect sic,

    M. Liu, T. Song, and G. Gui, “Deep cognitive perspective: Resource allocation for noma-based heterogeneous iot with imperfect sic,” IEEE Internet of Things Journal , vol. 6, no. 2, pp. 2885–2894, 2018

    2018

  29. [35]

    Energy- efficient resource allocation for d2d communications underlay- ing cloud-ran-based lte-a networks,

    Z. Zhou, M. Dong, K. Ota, G. Wang, and L. T. Yang, “Energy- efficient resource allocation for d2d communications underlay- ing cloud-ran-based lte-a networks,” IEEE Internet of Things Journal, vol. 3, no. 3, pp. 428–438, 2015

    2015

  30. [36]

    Future intelligent and secure vehicular network toward 6g: Machine-learning approaches,

    F. Tang, Y . Kawamoto, N. Kato, and J. Liu, “Future intelligent and secure vehicular network toward 6g: Machine-learning approaches,” Proceedings of the IEEE, vol. 108, no. 2, pp. 292– 307, 2019

    2019

  31. [37]

    Distillation as a defense to adversarial perturbations against deep neural networks,

    N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in 2016 IEEE symposium on security and privacy (SP) . IEEE, 2016, pp. 582–597

    2016

  32. [38]

    Comdefend: An efficient image compression model to defend adversarial exam- ples,

    X. Jia, X. Wei, X. Cao, and H. Foroosh, “Comdefend: An efficient image compression model to defend adversarial exam- ples,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2019, pp. 6084–6092

    2019

  33. [39]

    Adversarial examples in the physical world,

    A. Kurakin, I. Goodfellow, S. Bengio et al. , “Adversarial examples in the physical world,” 2016

    2016

  34. [40]

    Char- acterizing adversarial subspaces using local intrinsic dimen- sionality,

    X. Ma, B. Li, Y . Wang, S. M. Erfani, S. Wijewickrema, G. Schoenebeck, D. Song, M. E. Houle, and J. Bailey, “Char- acterizing adversarial subspaces using local intrinsic dimen- sionality,” in ICLR 2018: Proceedings of the 6th International Conference on Learning Representation...

    2018

  35. [41]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in International Conference on Learning Representations, 2018

    2018

  36. [44]

    Adversari- ally robust distillation,

    M. Goldblum, L. Fowl, S. Feizi, and T. Goldstein, “Adversari- ally robust distillation,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, no. 04, 2020, pp. 3996–4003

    2020

  37. [45]

    Reliable adversarial distillation with unreliable teachers,

    J. Zhu, J. Yao, B. Han, J. Zhang, T. Liu, G. Niu, J. Zhou, J. Xu, and H. Yang, “Reliable adversarial distillation with unreliable teachers,” arXiv preprint arXiv:2106.04928 , 2021

    2021 arXiv

  38. [46]

    Robust overfitting may be mitigated by properly learned smoothening,

    T. Chen, Z. Zhang, S. Liu, S. Chang, and Z. Wang, “Robust overfitting may be mitigated by properly learned smoothening,” in International Conference on Learning Representations, 2020

    2020

  39. [47]

    Revisiting adversarial robustness distillation: Robust soft labels make student better,

    B. Zi, S. Zhao, X. Ma, and Y .-G. Jiang, “Revisiting adversarial robustness distillation: Robust soft labels make student better,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 16 443–16 452

    2021

  40. [48]

    Layer normalization,

    J. L. Ba, J. R. Kiros, and G. E. Hinton, “Layer normalization,” arXiv preprint arXiv:1607.06450 , 2016

    2016 arXiv

  41. [49]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778

    2016

  42. [50]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” Advances in neural information processing systems , vol. 30, 2017

    2017

  43. [51]

    Wild patterns: Ten years after the rise of adversarial machine learning,

    B. Biggio and F. Roli, “Wild patterns: Ten years after the rise of adversarial machine learning,” Pattern Recognition, vol. 84, pp. 317–331, 2018

    2018

  44. [52]

    Radio Machine Learning Dataset Generation with GNU Radio,

    T. J. O’Shea and N. West, “Radio Machine Learning Dataset Generation with GNU Radio,” Proceedings of the GNU Radio Conference, vol. 1, no. 1, 2016

    2016

  45. [53]

    Automatic modulation classification: Cauchy-score-function-based cyclic correlation spectrum and fc-mlp under mixed noise and fading channels,

    S. Luan, Y . Gao, T. Liu, J. Li, and Z. Zhang, “Automatic modulation classification: Cauchy-score-function-based cyclic correlation spectrum and fc-mlp under mixed noise and fading channels,” Digital Signal Processing, vol. 126, p. 103476, 2022

    2022

  46. [54]

    Transferability in machine learning: from phenomena to black-box attacks using adversarial samples,

    N. Papernot, P. McDaniel, and I. Goodfellow, “Transferability in machine learning: from phenomena to black-box attacks using adversarial samples,” arXiv preprint arXiv:1605.07277 , 2016. Lu Zhang is a Ph.D. student in the Signal Pro- cessing and Networks Research Group at Loug...

    2016 arXiv

  47. [1963]

    degree in mathematics from Guangxi University, Guangxi, China, in 1985, the M.S

    He received the B.S. degree in mathematics from Guangxi University, Guangxi, China, in 1985, the M.S. degree in computer software from Xidian University, Xi’an, China, in 1990, and the Ph.D. degree in signal and information processing from Xidian University, Xi’an, China, in 1...

    1985

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.