Pith. sign in

REVIEW 3 major objections 4 minor 49 references

Vision Transformer with Adversarial Indicator Token against Adversarial Attacks in Radio Signal Classifications

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a vision transformer for radio-signal modulation classification can be made to detect adversarial attacks by adding a single learnable adversarial-indicator token, and that this unified detector-classifier beats four…

desk verdict The AdvI token is a plausible new defense idea for AMC, but as printed the PGD/BIM attacks are not iterative attacks—the central robustness claims cannot be trusted without a corrected evaluation. read the letter →

arxiv 2507.00015 v1 pith:ZKRSQ6YJ submitted 2025-06-13 cs.LG cs.AIcs.CR

Lu Zhang , Sangarapillai Lambotharan , Gan Zheng , Guisheng Liao , Xuekang Liu , Fabio Roli , Carsten Maple This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords visiontransformeradversarialattacksautomaticmodulationclassificationindicatortokentrainingprojectedgradientdescentradiosignalwhite-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a vision-transformer architecture for automatic modulation classification in which a second learnable token—the adversarial indicator (AdvI) token—sits alongside the standard classification token and is trained to output a binary clean-versus-adversarial verdict. Training combines adversarial training (using adaptively sized PGD perturbations) with this detection objective in a single network, so no separate detector model is needed. The authors claim that on two radio-signal datasets this unified model achieves higher accuracy and lower false-negative rates than a normally trained ViT, an adversarially trained ViT, a neural-rejection defense, and an attention-based distillation defense under white-box fast gradient method (FGM), projected gradient descent (PGD), and basic iterative method (BIM) attacks. If correct, the result matters because a modulation classifier that can say 'this signal is untrustworthy' avoids wasted decoding effort and supports deployment on resource-constrained IoT devices.

What carries the argument

The load-bearing object is the AdvI token: an extra learnable embedding prepended to the ViT's input sequence together with the CLS token, so the transformer attends over patch embeddings, CLS, and AdvI jointly. Its output head performs binary adversarial detection, and the training loss couples that detection task with standard classification on both clean and PGD-perturbed samples. The authors argue the token shapes attention so the model highlights anomalous signal regions, and this focused attention plus the explicit detection loss is what carries the robustness gains.

What would settle it

Re-run the PGD and BIM evaluations computing the gradient at the current iterated sample $x$ rather than at the fixed original $x_0$ for every defense, and compare accuracy and false-negative rate at a perturbation-to-noise ratio of 0 dB and perturbation size $\tau = 0.0012$. If the AiTViT advantage over the four baselines disappears or reverses under these corrected attacks, the paper's central claim would be refuted.

Watch

Extended reading notes

Core claim

The central discovery claimed is that the AdvI token works as an anomaly-focusing mechanism inside the transformer's self-attention. Because the token is trained to distinguish clean from perturbed inputs, the attention weights it produces concentrate on the most suspicious parts of the signal; the paper reports that on 1000 PGD attacks the average number of high-attention elements falls from 165.48 for an adversarially trained ViT to 38.21 for the proposed AiTViT. The same token then provides run-time detection: its encoder output is fed to a two-layer binary classifier, and the total training loss is $\beta$ times the modulation-classification cross-entropy (on clean and adversarial samples) plus $(1-\beta)$ times the binary detection cross-entropy, with $\beta = 0.1$. The paper's experimental claim is that this combination keeps accuracy high and false-negative rates low where the baselines saturate, for example a false-negative rate around 32% for PGD at a perturbation-to-noise ratio (PNR) of 0 dB versus nearly 100% for the other four defenses.

Load-bearing premise

The reported advantage over baselines assumes all defenses are tested against equally strong, properly implemented adaptive white-box attacks; the paper's own PGD and BIM attacks compute their gradient at the original input inside the iteration loop, so those attacks may be weaker than intended.

Editorial extensions

If this is right

  • A single unified network can both classify modulation and detect adversarial inputs at run time, at roughly the same processing cost as a plain ViT (0.21 s per 1000 samples) and far below a neural-rejection system (2.43 s).
  • At the largest perturbations tested, the detector keeps false-negative rates near 10–32% for PGD and BIM attacks, whereas the four baselines approach 90–100%, so a defender would know the classification is unreliable and could skip decoding.
  • The attention-focusing result—38.21 high-weight elements versus 165.48 for the adversarially trained ViT—suggests the token changes where the model looks, not just what it predicts.
  • The SNR-adaptive perturbation schedule in training allows the defense to be tuned across the wide signal-to-noise range of the datasets without a single fixed attack budget.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the mechanism is as general as it appears, the same token design could be applied to other transformer tasks that need a single model to both perform a primary task and flag out-of-distribution or manipulated inputs, not just radio-signal classification.
  • The concentration of attention on fewer components suggests a testable prediction: an adaptive adversary that targets exactly those high-attention regions should be more effective against AiTViT than a uniform attack; if that does not hold, the attention explanation would need revision.
  • Because Algorithms 3 and 4 as printed differentiate at $x_0$ inside the loop, the reported PGD and BIM robustness numbers may describe a weaker attack than the iteration count implies; corrected iterative attacks would be needed before the claimed margins can be taken at face value.
  • An ablation separating the contribution of adversarial training from the contribution of the AdvI detection loss (for example, training with the detection loss but no AT, and with AT but no detection loss) could isolate which component actually drives the robustness.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes AiTViT, a vision-transformer architecture for automatic modulation classification that adds a learnable 'adversarial indicator' (AdvI) token alongside the standard CLS token. The AdvI token's output is used for binary adversarial/benign detection, while the CLS token performs 11-class modulation classification. The model is trained with a combined loss that adversarial-trains the classifier and teaches the detector to separate clean from perturbed inputs, with a reported beta of 0.1. The authors evaluate white-box FGM, PGD, and BIM attacks on RML2016.10a (referred to once as RML2016.19a) and RDL2021.12, comparing accuracy and false-negative rate against normally trained ViT, adversarially trained ViT, neural rejection (NR), and attention-based adversarial robustness distillation (ATARD). They also present attention visualizations and a computational-cost table. The central claim is that AiTViT outperforms all four baselines against these white-box attacks.

Significance. If the reported results were valid, the AdvI token would be a practically interesting contribution: a single ViT that simultaneously classifies radio signals and detects adversarial perturbations, combining training-time and run-time defenses without a separate detection network. The attention analysis showing that the AdvI token concentrates attention on fewer signal components is also a useful observation, and the computational-cost comparison suggests a modest resource footprint. However, the central experimental evidence currently does not support the claimed robustness: the printed PGD and BIM implementations are not true iterative attacks, and the baseline attack protocol is not specified. The concept may still be viable, but the paper's significance cannot be assessed until the attacks are corrected and the experiments are rerun.

major comments (3)
  1. [Section III-C (Algorithms 3 and 4)] In Algorithm 3, line 4 computes g = ∇_{x0} ℓ(f1(x0), y) + ∇_{x0} ℓ(f2(x0), y_a) inside the repeat loop, but line 5 updates x* ← x + η0 g and line 6 projects. Because g never changes with the iterate x, the projected point (14) is x0 + ε g/∥g∥ after the first iteration and remains the same on every subsequent iteration; the loop cannot traverse the perturbation boundary. Similarly, Algorithm 4, line 4 keeps the same gradient at x0, so with sign(g) fixed, the clipped update x0 + clip(x* − x0, −τ, τ) is a single fixed sign direction. The experiments in Figures 9–10 and 13–16 therefore do not measure robustness to true iterative PGD/BIM attacks; they measure a one-step or fixed-direction perturbation. This is a load-bearing issue because the abstract and Section IV-C explicitly claim superiority under PGD and BIM. Please recompute gradients at the current iterate x and rerun all affected experiments.
  2. [Section IV-A (experimental setup)] No attack protocol is specified for the four baseline methods (NT ViT, AT ViT, NR, and ATARD). The paper does not state which attack algorithms were used, how the attacker adapts to the absence of the AdvI detection head, how many iterations were run, or whether the same PNR values and epsilon schedules were used as for AiTViT. Without this information, the comparison in Figures 9–16 is not reproducible and could be inequivalent if, for example, AiTViT faced the defective one-step PGD of Algorithm 3 while baselines faced a standard iterative PGD. Please provide the exact attack generation protocol for each baseline, including the loss objective used for models without an AdvI token.
  3. [Section III-B (Algorithm 1)] The adaptive PGD training procedure is underspecified. Algorithm 1 line 5 refers to 'adaptive PGD generation methods' and the text says the perturbation size increases as SNR rises, but the number of iterations, step size, PNR schedule, and the precise formula mapping SNR/PNR to epsilon are not given. This makes the training method non-reproducible, and the behavior of the trained model cannot be independently verified. Please specify the complete training-time attack generation procedure.
minor comments (4)
  1. [Section III-C, text near Algorithms 3 and 4] The descriptions say the second gradient term uses 'the true detection label y_b', but Algorithms 3 and 4 line 4 use y_a. Please align the text and the algorithms; note also that y_a appears to be the correct target for an attack trying to evade the detector, so the discrepancy should be resolved explicitly.
  2. [Section IV-A, first paragraph] The dataset is named both 'RML2016.19a' and 'RML2016.10a' in the same paragraph; reference [45] is the 2016.10A dataset. Please correct the typo.
  3. [Section V, first sentence] The conclusion refers to 'an adversarial CLS token' whereas the rest of the paper uses 'AdvI token' and 'adversarial indicator token'. Please unify the terminology.
  4. [Section III-C, Eq. (11)] The derivation text uses the quantity P_x L and then says it is replaced by the sample estimate ∥x0∥_2^2, but Eq. (11) directly contains ∥x0∥_2^2; clarifying the role of the signal length L would help readers reproduce the epsilon computation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the AdvI-token defense and its evaluation are self-contained, and the only serious defect (Algorithms 3-4 gradients) is an evaluation-correctness issue, not a circularity.

full rationale

The paper's derivation chain does not reduce to its own inputs. Equation (11) is obtained algebraically from the definitions of PNR, SNR, and total signal power in Section III-C, with no fitted parameter renamed as a prediction; beta in Equation (10) is a stated hyperparameter. The AdvI token is a supervised detector trained on clean and PGD-perturbed samples (Algorithm 1 and Equation (9)), and its accuracy and false negative rate are then measured on separately generated FGM, PGD, and BIM attacks, which is standard adaptive white-box evaluation rather than circularity. The paper cites the authors' own prior defenses [32,35,39], but only as baselines and related work; the central claim that AiTViT improves robustness is not justified by those citations. One internal defect should be noted, but it is not circular: Algorithms 3 and 4 compute the gradient at the original input x0 inside their loops (line 4), so the printed PGD and BIM attacks degenerate to single fixed-direction steps and are not true iterative attacks. That is an arithmetic and comparison-fairness concern for the experiments, not a claim that an output is equivalent to an input by construction.

Assumptions & free parameters 6 free parameters · 5 assumptions · 1 invented entities

The model relies on standard ViT machinery (attention, softmax, layer norm) from prior work, and the central evaluation assumes that PNR-bounded perturbations represent imperceptible attacks and that the RML and RDL datasets are representative. The free parameters are architecture sizes, the loss weight beta, and an undisclosed adaptive PGD training schedule. The AdvI token is an architectural component rather than a physical entity; it has no independent evidence outside the paper's experiments.

free parameters (6)
  • beta (loss weight) = 0.1
    Weights the detection loss in Eq. (10); chosen by hand to emphasize detection, with no sensitivity analysis or tuning procedure reported.
  • Ni (detector head hidden size) = 32
    Hidden dimension of the first dense layer after the AdvI token, set in Section III-A.
  • Nc (patch embedding dimension) = 128
    Embedding size for each patch, set in Section III-A.
  • N (number of transformer encoder layers) = 4
    Depth of the encoder, set in Section III-A.
  • Adaptive PGD training schedule
    Algorithm 1 line 5 says the PGD perturbation size increases as SNR rises, but no formula, values, or scaling rule are provided; this schedule affects the adversarial training and is unreported.
  • Attention visualization threshold = 0.5
    Weights below 0.5 are discarded in Section IV-B for the attention concentration comparison; this is an analysis parameter, not part of the robustness results.
assumptions (5)
  • standard math Scaled dot-product attention and softmax (Eqs. 3-4) are the correct mechanism for ViT-based AMC.
    The model builds entirely on the ViT architecture of [22] and its AMC adaptation in [25].
  • domain assumption Perturbations with PNR no greater than 0 dB are imperceptible and constitute the threat model.
    This bounds the attack budget in Eq. (11); if imperceptibility were defined differently, the adversarial perturbation sizes would change.
  • domain assumption The RML2016.10a and RDL2021.12 datasets are representative of realistic AMC conditions.
    All experimental conclusions and claims of superiority rest on these two datasets.
  • domain assumption White-box attacks with full knowledge of the model and detector are the correct evaluation scenario.
    The paper explicitly selects white-box attacks in Section III-C as a worst-case benchmark.
  • ad hoc to paper Increasing PGD perturbation size with SNR during training is beneficial.
    Algorithm 1 line 5 states this schedule without derivation, ablation, or justification; it is an ad hoc design choice.
invented entities (1)
  • Adversarial Indicator (AdvI) token
    purpose: A learnable embedding whose output is binary-classified to detect adversarial perturbations in the input signal.
    It is a component of the proposed architecture; its evidence is the paper's own experiments, with no external falsifiable prediction or independent measurement.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Vision Transformer with Adversarial Indicator Token against Adversarial Attacks in Radio Signal Classifications." pith.science (2026). https://pith.science/paper/ZKRSQ6YJ

@misc{pith2026250700015,
  author       = {Pith},
  title        = {Pith review of: Vision Transformer with Adversarial Indicator Token against Adversarial Attacks in Radio Signal Classifications},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZKRSQ6YJ}},
  note         = {Machine review of arXiv:2507.00015}
}
read the original abstract

The remarkable success of transformers across various fields such as natural language processing and computer vision has paved the way for their applications in automatic modulation classification, a critical component in the communication systems of Internet of Things (IoT) devices. However, it has been observed that transformer-based classification of radio signals is susceptible to subtle yet sophisticated adversarial attacks. To address this issue, we have developed a defensive strategy for transformer-based modulation classification systems to counter such adversarial attacks. In this paper, we propose a novel vision transformer (ViT) architecture by introducing a new concept known as adversarial indicator (AdvI) token to detect adversarial attacks. To the best of our knowledge, this is the first work to propose an AdvI token in ViT to defend against adversarial attacks. Integrating an adversarial training method with a detection mechanism using AdvI token, we combine a training time defense and running time defense in a unified neural network model, which reduces architectural complexity of the system compared to detecting adversarial perturbations using separate models. We investigate into the operational principles of our method by examining the attention mechanism. We show the proposed AdvI token acts as a crucial element within the ViT, influencing attention weights and thereby highlighting regions or features in the input data that are potentially suspicious or anomalous. Through experimental results, we demonstrate that our approach surpasses several competitive methods in handling white-box attack scenarios, including those utilizing the fast gradient method, projected gradient descent attacks and basic iterative method.

Figures

Figures reproduced from arXiv: 2507.00015 by the authors.

Figure 1
Figure 1. A scenario of the adversarial attacks in modulation [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The architecture of the proposed AiTViT. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. An example of attention visualization for AM-SSB [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: An example of attention visualization for AM-SSB [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: An example of attention visualization for QAM16 [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: An example of attention visualization for QAM16 [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 9
Figure 9. Figure 9: Accuracy against PGD attacks for a range of PNR [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: FNR against PGD attacks for a range of PNR values. [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 11
Figure 11. Figure 11: Accuracy against FGM attacks for a range of PNR [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]
Figure 15
Figure 15. Figure 15: Accuracy against PGD attacks for a range of PGNR [PITH_FULL_IMAGE:figures/full_fig_p011_15.png]
Figure 13
Figure 13. Figure 13: Accuracy against BIM attacks for a range of [PITH_FULL_IMAGE:figures/full_fig_p011_13.png]
Figure 14
Figure 14. Figure 14: FNR against BIM attacks for a range of τ values. competing works in the literature including NT trained ViT, AT trained ViT, NR system and ATARD defense. ACKNOWLEDGMENTS This work is supported by UKRI through the research grants EP/R007195/1 (Academic Centre of Excell…
Figure 18
Figure 18. Figure 18: FNR of our proposed AiTViT method for a range of [PITH_FULL_IMAGE:figures/full_fig_p012_18.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 42 canonical work pages

  1. [1]

    Integrating sensing and communications for ubiquitous iot: Applications, trends, and challenges,

    Y . Cui, F. Liu, X. Jing, and J. Mu, “Integrating sensing and communications for ubiquitous iot: Applications, trends, and challenges,”IEEE Network, vol. 35, no. 5, pp. 158–167, Sep. 2021

    work page 2021

  2. [2]

    Machine learning-based 5g ran slicing for broadcasting ser- 12 Fig. 18: FNR of our proposed AiTViT method for a range of percentage of training samples. vices,

    J. Mu, X. Jing, Y . Zhang, Y . Gong, R. Zhang, and F. Zhang, “Machine learning-based 5g ran slicing for broadcasting ser- 12 Fig. 18: FNR of our proposed AiTViT method for a range of percentage of training samples. vices,”IEEE Transactions on Broadcasting, vol. 68, no. 2, pp. 295–304, Jun. 2022

    work page 2022

  3. [3]

    Device-free wireless sensing for human detection: the deep learning perspective,

    R. Zhang, X. Jing, S. Wu, C. Jiang, J. Mu, and F. R. Yu, “Device-free wireless sensing for human detection: the deep learning perspective,”IEEE Internet of Things Journal, vol. 8, no. 4, pp. 2517–2539, Feb. 2021

    work page 2021

  4. [4]

    Energy-efficient data collection and device positioning in uav- assisted iot,

    Z. Wang, R. Liu, Q. Liu, J. S. Thompson, and M. Kadoch, “Energy-efficient data collection and device positioning in uav- assisted iot,”IEEE Internet of Things Journal, vol. 7, no. 2, pp. 1122–1139, Feb. 2020

    work page 2020

  5. [5]

    Automatic modulation classification via meta-learning,

    X. Hao, Z. Feng, S. Yang, M. Wang, and L. Jiao, “Automatic modulation classification via meta-learning,”IEEE Internet of Things Journal, vol. 10, no. 14, pp. 12 276–12 292, Jul. 2023

    work page 2023

  6. [6]

    Gs-qrnn: A high- efficiency automatic modulation classifier for cognitive radio iot,

    P. Ghasemzadeh, M. Hempel, and H. Sharif, “Gs-qrnn: A high- efficiency automatic modulation classifier for cognitive radio iot,”IEEE Internet of Things Journal, vol. 9, no. 12, pp. 9467– 9477, Jun. 2022

    work page 2022

  7. [7]

    Ul- tralight convolutional neural network for automatic modulation classification in internet of unmanned aerial vehicles,

    L. Guo, Y . Wang, Y . Liu, Y . Lin, H. Zhao, and G. Gui, “Ul- tralight convolutional neural network for automatic modulation classification in internet of unmanned aerial vehicles,”IEEE Internet of Things Journal, vol. 11, no. 11, pp. 20 831–20 839, Jun. 2024

    work page 2024

  8. [8]

    Edge- enabled modulation classification in internet of underwater things based on network pruning and ensemble learning,

    X. Wang, Y . Tu, J. Liu, G. Han, C. Yu, and J.-H. Cui, “Edge- enabled modulation classification in internet of underwater things based on network pruning and ensemble learning,”IEEE Internet of Things Journal, vol. 11, no. 8, pp. 13 608–13 621, Apr. 2024

    work page 2024

Show all 49 references
  1. [9]

    Ac- curacy analysis of feature-based automatic modulation classifi- cation with blind modulation detection,

    P. Ghasemzadeh, S. Banerjee, M. Hempel, and H. Sharif, “Ac- curacy analysis of feature-based automatic modulation classifi- cation with blind modulation detection,” in2019 International Conference on Computing, Networking and Communications (ICNC), 2019, pp. 1000–1004

    2019

  2. [10]

    Automatic mod- ulation classification using moments and likelihood maximiza- tion,

    M. Abu-Romoh, A. Aboutaleb, and Z. Rezki, “Automatic mod- ulation classification using moments and likelihood maximiza- tion,”IEEE Communications Letters, vol. 22, no. 5, pp. 938– 941, May 2018

    2018

  3. [11]

    Amc-iot: Automatic modulation classification using efficient convolutional neural networks for low powered iot devices,

    M. Usman and J.-A. Lee, “Amc-iot: Automatic modulation classification using efficient convolutional neural networks for low powered iot devices,” in2020 International Conference on Information and Communication Technology Convergence (ICTC), 2020, pp. 288–293

    2020

  4. [12]

    Over-the-air deep learning based radio signal classification,

    T. J. O’Shea, T. Roy, and T. C. Clancy, “Over-the-air deep learning based radio signal classification,”IEEE Journal of Selected Topics in Signal Processing, vol. 12, no. 1, pp. 168– 179, Feb. 2018

    2018

  5. [13]

    High-capacity complex convolutional neural networks for I/Q modulation classification,

    J. Krzyston, R. Bhattacharjea, and A. Stark, “High-capacity complex convolutional neural networks for I/Q modulation classification,”arXiv preprint arXiv:2010.10717, 2020

    2010 arXiv

  6. [14]

    Sequential convolutional recurrent neural networks for fast automatic mod- ulation classification,

    K. Liao, Y . Zhao, J. Gu, Y . Zhang, and Y . Zhong, “Sequential convolutional recurrent neural networks for fast automatic mod- ulation classification,”IEEE Access, vol. 9, pp. 27 182–27 188, 2021

    2021

  7. [15]

    Meta-learning guided label noise distillation for robust signal modulation classifica- tion,

    X. Hao, Z. Feng, T. Peng, and S. Yang, “Meta-learning guided label noise distillation for robust signal modulation classifica- tion,”IEEE Internet of Things Journal, vol. 12, no. 1, pp. 402– 418, Jan. 2025

    2025

  8. [16]

    Fast deep learning for automatic modulation classification,

    S. Ramjee, S. Ju, D. Yang, X. Liu, A. E. Gamal, and Y . C. Eldar, “Fast deep learning for automatic modulation classification,” arXiv preprint arXiv:1901.05850, 2019

    1901 arXiv

  9. [17]

    Multi- signal modulation classification using sliding window detection and complex convolutional network in frequency domain,

    C. Hou, G. Liu, Q. Tian, Z. Zhou, L. Hua, and Y . Lin, “Multi- signal modulation classification using sliding window detection and complex convolutional network in frequency domain,”IEEE Internet of Things Journal, vol. 9, no. 19, pp. 19 438–19 449, Oct. 2022

    2022

  10. [18]

    A lightweight decentralized learning- based automatic modulation classification method for resource- constrained edge devices,

    B. Dong, Y . Liu, G. Gui, X. Fu, H. Dong, B. Adebisi, H. Gacanin, and H. Sari, “A lightweight decentralized learning- based automatic modulation classification method for resource- constrained edge devices,”IEEE Internet of Things Journal, vol. 9, no. 24, pp. 24 708–24 720, Dec. 2022

    2022

  11. [19]

    Smtc-cl: Continuous learning via selective multi-task coordi- nation for adaptive signal classification,

    X. Hao, S. Yang, R. Liu, Z. Feng, T. Peng, and B. Huang, “Smtc-cl: Continuous learning via selective multi-task coordi- nation for adaptive signal classification,”IEEE Transactions on Cognitive Communications and Networking, 2024

    2024

  12. [20]

    Automatic modulation classification using graph convolutional neural networks for time-frequency representa- tion,

    K. Tonchev, N. Neshov, A. Ivanov, A. Manolova, and V . Poulkov, “Automatic modulation classification using graph convolutional neural networks for time-frequency representa- tion,” in2022 25th International Symposium on Wireless Per- sonal Multimedia Communications (WPMC), 202...

    2022

  13. [21]

    Automatic modulation classification based on decentralized learning and ensemble learning,

    X. Fu, G. Gui, Y . Wang, H. Gacanin, and F. Adachi, “Automatic modulation classification based on decentralized learning and ensemble learning,”IEEE Transactions on Vehicular Technol- ogy, vol. 71, no. 7, pp. 7942–7946, Jul. 2022

    2022

  14. [22]

    An image is worth 16x16 words: Trans- formers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gellyet al., “An image is worth 16x16 words: Trans- formers for image recognition at scale,”arXiv preprint arXiv:2010.11929, 2020

    2010 arXiv

  15. [23]

    Pyramid vision transformer: A versatile backbone for dense prediction without convolutions,

    W. Wang, E. Xie, X. Li, D.-P. Fan, K. Song, D. Liang, T. Lu, P. Luo, and L. Shao, “Pyramid vision transformer: A versatile backbone for dense prediction without convolutions,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 568–578

    2021

  16. [24]

    Levit: a vision transformer in convnet’s clothing for faster inference,

    B. Graham, A. El-Nouby, H. Touvron, P. Stock, A. Joulin, H. J ´egou, and M. Douze, “Levit: a vision transformer in convnet’s clothing for faster inference,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 12 259–12 269

    2021

  17. [25]

    Mcformer: A transformer based deep neural network for automatic modulation classification,

    S. Hamidi-Rad and S. Jain, “Mcformer: A transformer based deep neural network for automatic modulation classification,” in2021 IEEE Global Communications Conference (GLOBE- COM), 2021, pp. 1–6

    2021

  18. [26]

    Adversarial attacks and defenses in images, graphs and text: A review,

    H. Xu, Y . Ma, H.-C. Liu, D. Deb, H. Liu, J.-L. Tang, and A. K. Jain, “Adversarial attacks and defenses in images, graphs and text: A review,”International journal of automation and computing, vol. 17, pp. 151–178, 2020

    2020

  19. [27]

    Contextual adversarial attacks for object detection,

    H. Zhang, W. Zhou, and H. Li, “Contextual adversarial attacks for object detection,” in2020 IEEE International Conference on Multimedia and Expo (ICME), 2020, pp. 1–6

    2020

  20. [28]

    Textattack: A framework for adversarial attacks in natural language process- ing,

    J. X. Morris, E. Lifland, J. Y . Yoo, and Y . Qi, “Textattack: A framework for adversarial attacks in natural language process- ing,”Proceedings of the 2020 EMNLP , Arvix, 2020

    2020

  21. [29]

    Adversarial attacks on face recognition systems,

    Y . Xu, K. Raja, R. Ramachandra, and C. Busch, “Adversarial attacks on face recognition systems,” inHandbook of Digital Face Manipulation and Detection: From DeepFakes to Morph- ing Attacks. Springer International Publishing Cham, 2022, pp. 139–161

    2022

  22. [30]

    Adversarial attacks against win- dows pe malware detection: A survey of the state-of-the-art,

    X. Ling, L. Wu, J. Zhang, Z. Qu, W. Deng, X. Chen, Y . Qian, C. Wu, S. Ji, T. Luoet al., “Adversarial attacks against win- dows pe malware detection: A survey of the state-of-the-art,” 13 Computers & Security, vol. 128, p. 103134, 2023

    2023

  23. [31]

    Adversarial attacks on deep- learning based radio signal classification,

    M. Sadeghi and E. G. Larsson, “Adversarial attacks on deep- learning based radio signal classification,”IEEE Wireless Com- munications Letters, vol. 8, no. 1, pp. 213–216, Feb. 2019

    2019

  24. [32]

    Countermeasures against adversarial examples in radio signal classification,

    L. Zhang, S. Lambotharan, G. Zheng, B. AsSadhan, and F. Roli, “Countermeasures against adversarial examples in radio signal classification,”IEEE Wireless Communications Letters, vol. 10, no. 8, pp. 1830–1834, Aug. 2021

    2021

  25. [33]

    A deep ensemble- based wireless receiver architecture for mitigating adversarial attacks in automatic modulation classification,

    R. Sahay, C. G. Brinton, and D. J. Love, “A deep ensemble- based wireless receiver architecture for mitigating adversarial attacks in automatic modulation classification,”IEEE Transac- tions on Cognitive Communications and Networking, vol. 8, no. 1, pp. 71–85, Mar. 2022

    2022

  26. [34]

    Mixture gan for modulation classification resiliency against adversarial attacks,

    E. Shtaiwi, A. El Ouadrhiri, M. Moradikia, S. Sultana, A. Ab- delhadi, and Z. Han, “Mixture gan for modulation classification resiliency against adversarial attacks,” inGLOBECOM 2022- 2022 IEEE Global Communications Conference, 2022, pp. 1472–1477

    2022

  27. [35]

    A hybrid training-time and run-time defense against adversarial attacks in modulation classification,

    L. Zhang, S. Lambotharan, G. Zheng, G. Liao, A. Demontis, and F. Roli, “A hybrid training-time and run-time defense against adversarial attacks in modulation classification,”IEEE Wireless Communications Letters, vol. 11, no. 6, pp. 1161–1165, Jun. 2022

    2022

  28. [36]

    Safeamc: Adversar- ial training for robust modulation classification models,

    J. Maroto, G. Bovet, and P. Frossard, “Safeamc: Adversar- ial training for robust modulation classification models,” in 2022 30th European Signal Processing Conference (EUSIPCO), 2022, pp. 1636–1640

    2022

  29. [37]

    Efficient adversarial defense without adversarial training: A batch normalization approach,

    Y . Zhu, X. Wei, and Y . Zhu, “Efficient adversarial defense without adversarial training: A batch normalization approach,” in2021 International Joint Conference on Neural Networks (IJCNN), 2021, pp. 1–8

    2021

  30. [38]

    ℓ ∞-robustness and beyond: Unleashing efficient adversarial training,

    H. M. Dolatabadi, S. Erfani, and C. Leckie, “ℓ ∞-robustness and beyond: Unleashing efficient adversarial training,” inEuropean Conference on Computer Vision, 2022, pp. 467–483

    2022

  31. [39]

    Attention-based adversarial robust distillation in radio signal classifications for low-power iot devices,

    L. Zhang, S. Lambotharan, G. Zheng, G. Liao, B. AsSadhan, and F. Roli, “Attention-based adversarial robust distillation in radio signal classifications for low-power iot devices,”IEEE Internet of Things Journal, vol. 10, no. 3, pp. 2646–2657, Feb. 2023

    2023

  32. [40]

    Adversarial learning in transformer based neural network in radio signal classifi- cation,

    L. Zhang, S. Lambotharan, and G. Zheng, “Adversarial learning in transformer based neural network in radio signal classifi- cation,” inICASSP 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2022, pp. 1–5

    2022

  33. [41]

    Patch-fool: Are vision transformers always robust against adversarial perturba- tions?

    Y . Fu, S. Zhang, S. Wu, C. Wan, and Y . Lin, “Patch-fool: Are vision transformers always robust against adversarial perturba- tions?”arXiv preprint arXiv:2203.08392, 2022

    2022 arXiv

  34. [42]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations, 2018

    2018

  35. [43]

    Wild patterns: Ten years after the rise of adversarial machine learning,

    B. Biggio and F. Roli, “Wild patterns: Ten years after the rise of adversarial machine learning,” inProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, pp. 2154–2156

    2018

  36. [44]

    Investigation of deep learning architectures and features for adversarial machine learning attacks in modulation classi- fications,

    M. Aristodemou, S. Lambotharan, G. Zheng, and L. Aristode- mou, “Investigation of deep learning architectures and features for adversarial machine learning attacks in modulation classi- fications,” in2022 IEEE 14th Image, Video, and Multidimen- sional Signal Processing Worksho...

    2022

  37. [45]

    Radio Machine Learning Dataset Generation with GNU Radio,

    T. J. O’Shea and N. West, “Radio Machine Learning Dataset Generation with GNU Radio,”Proceedings of the GNU Radio Conference, vol. 1, no. 1, 2016

    2016

  38. [46]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” inArtificial intelligence safety and security. Chapman and Hall/CRC, 2018, pp. 99–112

    2018

  39. [47]

    Automatic modulation classification: Cauchy-score-function-based cyclic correlation spectrum and fc-mlp under mixed noise and fading channels,

    S. Luan, Y . Gao, T. Liu, J. Li, and Z. Zhang, “Automatic modulation classification: Cauchy-score-function-based cyclic correlation spectrum and fc-mlp under mixed noise and fading channels,”Digital Signal Processing, vol. 126, p. 103476, 2022. Lu Zhangis currently a lecturer ...

    2022

  40. [1963]

    degree in mathematics from Guangxi University, Guangxi, China, in 1985, the M.S

    He received the B.S. degree in mathematics from Guangxi University, Guangxi, China, in 1985, the M.S. degree in computer software from Xidian University, Xi’an, China, in 1990, and the Ph.D. degree in signal and information processing from Xidian University, Xi’an, China, in 1...

    1985

  41. [2024]

    He was a Postdoctoral Researcher with the School of Engineering, Lancaster University, from June 2024 to May 2025, and joined Imperial Col- lege London as a Postdoctoral Researcher in June 2025. He was a recipient of the Best Student Paper Award at the 17th International Works...

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.