pith. sign in

arxiv: 2512.09893 · v2 · submitted 2025-12-10 · 📡 eess.SP

A Speculative GLRT-Backed ApproachRobust Deep Learning-Based Array Processing

Nian-Cin Wang , Rajeev Sahay This is my paper

Pith reviewed 2026-05-16 23:11 UTC · model grok-4.3

classification 📡 eess.SP
keywords adversarial robustnessdeep learningarray signal processingGLRT validationsecond-order statisticsdirection of arrivalsignal detection
0
0 comments X

The pith

Second-order statistics of received array signals remain spatially robust to L-p bounded adversarial perturbations, enabling a hybrid DL classifier backed by GLRT validation for secure array processing.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper establishes that second-order statistics of array signals hold up spatially against bounded adversarial changes, addressing the vulnerability of pure deep learning models in wireless array tasks such as detection and direction finding. It then builds a speculative framework that uses a fast DL model for initial guesses and routes those outputs through a GLRT validator that checks them against the spatial statistics. This combination aims to deliver low-latency inference while retaining statistical reliability when attacks occur. A reader would care because current DL approaches for arrays lack guarantees and can be fooled by interference in security-sensitive settings like radar or communications. The work shows empirical gains over baselines under varied perturbation strengths and designs.

Core claim

The paper shows that second-order statistics of the received array are spatially robust to L-p bounded adversarial perturbations. Motivated by this result, it introduces an adversarially resilient speculative array processing framework that pairs a low-latency DL classifier for quick inference with a GLRT validator operating in the spatial domain to confirm the DL outputs.

What carries the argument

The speculative framework that runs a DL classifier for fast initial array decisions and then applies a GLRT validator on the spatial second-order statistics to accept or reject those decisions.

If this is right

  • The hybrid system outperforms pure DL and other baselines in accuracy under multiple adversarial perturbation bounds, designs, and magnitudes.
  • DL models can be deployed for low-latency array processing with GLRT providing the statistical safety net in the spatial domain.
  • The approach applies to both signal detection and direction-of-arrival tasks while mitigating security risks from adversarial wireless interference.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same robustness property of second-order statistics might support similar hybrid designs in other array-based tasks such as beamforming or localization.
  • In deployed systems the GLRT step could be made adaptive to trade off latency against confirmation strength depending on observed perturbation levels.
  • Real-world testing with hardware-induced noise combined with intentional attacks would reveal whether the spatial-domain validation holds beyond simulations.

Load-bearing premise

Second-order statistics of the array stay spatially robust to L-p bounded adversarial perturbations and the GLRT validator can reliably confirm DL outputs under the tested conditions.

What would settle it

An experiment or calculation that demonstrates large changes in the spatial second-order statistics under some L-p bounded perturbation, or that shows the GLRT validator frequently rejects correct DL outputs at rates that erase the claimed resilience.

Figures

Figures reproduced from arXiv: 2512.09893 by Nian-Cin Wang, Rajeev Sahay.

Figure 1
Figure 1. Figure 1: Our system diagram of the proposed speculative inference framework. Proof. See Appendix A. Theorem 1 shows the empirical robustness of the GLRT to additive perturbations. While δ(t) may distort individual samples, its lp bounded design ensures that the spatial covari￾ance Rˆ remains empirically equivalent in the presence and absence of adversarial attacks. Since the GLRT depends only on covariance ratios (… view at source ↗
Figure 2
Figure 2. Figure 2: , across all perturbation regimes, detection accuracy decreases as PSR increases, although the rate of degradation differs substantially between CNN and GLRT classifiers. In the FGSM ℓ∞ case [ [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: DoA estimation accuracy of all models under adversarial attacks. Each subplot shows classification accuracy versus PSR for FGSM and PGD attacks with ℓ∞ and ℓ2 constraints. Similar to [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
read the original abstract

Deep learning (DL) has recently emerged as an efficient approach for array processing tasks such as signal detection and direction of arrival. However, DL models lack statistical guarantees and, moreover, are highly susceptible to adversarial interference, raising security concerns about their reliability in adversarial wireless environments. In this letter, we first show that second-order statistics of the received array are spatially robust to L-p bounded adversarial perturbations. Then, motivated by this theoretical result, we develop an adversarially resilient speculative array processing framework that consists of a low-latency DL classifier backed by a theoretically-grounded generalized likelihood ratio test (GLRT) validator, which operates on the spatial domain of the array, where DL is used for fast speculative inference and later confirmed with the GLRT. Empirical evaluations under multiple L-p bounds, perturbation designs, and perturbation magnitudes corroborate our proposed framework and theoretical findings, demonstrating the superior performance of our proposed approach in comparison to multiple state-of-the-art baselines.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The manuscript claims that second-order statistics of array received signals are spatially robust to L-p bounded adversarial perturbations. Motivated by this, it proposes a speculative hybrid framework in which a low-latency deep-learning classifier generates fast candidate labels that are subsequently validated by a GLRT operating on the spatial covariance; empirical tests under varied L-p bounds, perturbation designs, and magnitudes are reported to show gains over multiple baselines.

Significance. If the missing link between covariance-norm robustness and GLRT decision invariance can be established, the work would supply a concrete, theoretically motivated safeguard for DL-based array processing in adversarial wireless settings. The separation of fast speculative inference from a statistically grounded validator is a practical architectural idea that could influence secure radar and communications systems.

major comments (2)
  1. [Theoretical robustness analysis] Theoretical analysis (motivation and robustness result): the manuscript shows that ||R - R_perturbed|| is small in some matrix norm under ||delta||_p <= epsilon, yet provides no explicit bound demonstrating that the GLRT statistic (a ratio of quadratic forms or determinant ratio under the array manifold model) remains on the same side of its decision threshold. Because the GLRT depends on eigenvectors and projections onto steering vectors rather than solely on the Frobenius or operator norm of R, the robustness of second-order statistics does not automatically guarantee validator reliability.
  2. [Empirical evaluations] Empirical section: the reported performance gains lack error bars, confidence intervals, or explicit statements of the number of Monte Carlo trials and exact data-generation procedure. Without these, it is impossible to judge whether the observed superiority over baselines is statistically stable across the tested L-p bounds and perturbation magnitudes.
minor comments (2)
  1. [Title] The title contains the concatenated string 'ApproachRobust'; this appears to be a typographical error and should be corrected to 'Approach: Robust' or similar.
  2. [Notation and GLRT definition] Notation for the sample covariance and the precise definition of the GLRT statistic should be stated explicitly with equation numbers in the main text rather than left implicit from the abstract.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the detailed and constructive feedback on our manuscript. We address the major comments point by point below, indicating where revisions will be made.

read point-by-point responses

  1. Referee: [Theoretical robustness analysis] Theoretical analysis (motivation and robustness result): the manuscript shows that ||R - R_perturbed|| is small in some matrix norm under ||delta||_p <= epsilon, yet provides no explicit bound demonstrating that the GLRT statistic (a ratio of quadratic forms or determinant ratio under the array manifold model) remains on the same side of its decision threshold. Because the GLRT depends on eigenvectors and projections onto steering vectors rather than solely on the Frobenius or operator norm of R, the robustness of second-order statistics does not automatically guarantee validator reliability.

    Authors: We agree that the manuscript does not provide an explicit bound linking the norm robustness of the covariance matrix to the invariance of the GLRT decision. The GLRT statistic involves quadratic forms and projections that are sensitive to eigenvector perturbations, which are not directly controlled by matrix norm bounds alone. Our theoretical result focuses on the spatial robustness of second-order statistics as motivation for using the GLRT validator on the covariance domain. We will revise the paper to explicitly state this limitation and clarify that the framework is speculative, relying on the empirical observation that small changes in R preserve GLRT reliability in the tested scenarios. We will also add a remark on the continuity of the GLRT statistic with respect to R under mild conditions. revision: partial

  2. Referee: [Empirical evaluations] Empirical section: the reported performance gains lack error bars, confidence intervals, or explicit statements of the number of Monte Carlo trials and exact data-generation procedure. Without these, it is impossible to judge whether the observed superiority over baselines is statistically stable across the tested L-p bounds and perturbation magnitudes.

    Authors: We appreciate this observation. In the revised manuscript, we will include error bars and confidence intervals for all reported performance metrics. We will also explicitly state the number of Monte Carlo trials used (1000 independent trials per configuration) and provide a detailed description of the data-generation procedure, including how the array signals, perturbations, and labels are generated. revision: yes

Circularity Check

0 steps flagged

No circularity: theoretical robustness result is independent of the DL-GLRT pipeline

full rationale

The paper derives the spatial robustness of second-order statistics to L-p bounded perturbations as a standalone theoretical claim, then uses that result only to motivate (not to define or fit) the speculative DL classifier plus GLRT validator architecture. Empirical evaluations under multiple perturbation designs serve as external validation rather than self-referential fitting. No load-bearing self-citations, self-definitional steps, or renamed fitted quantities appear in the derivation chain. The GLRT validator is presented as a standard, theoretically-grounded test operating on the spatial domain, not as a quantity forced by the robustness result itself.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The central claim rests on standard array signal processing assumptions plus the newly shown robustness property; no free parameters or invented entities are explicitly introduced in the abstract.

axioms (1)
  • domain assumption Second-order statistics of the received array remain spatially robust under L-p bounded adversarial perturbations
    This is the key theoretical result motivating the framework, stated directly in the abstract.

pith-pipeline@v0.9.0 · 5463 in / 1232 out tokens · 28982 ms · 2026-05-16T23:11:31.096592+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

42 extracted references · 42 canonical work pages · 5 internal anchors

  1. [1]

    Multiple emitter location and signal parameter estimation,

    R. Schmidt, “Multiple emitter location and signal parameter estimation,” IEEE Transactions on Antennas and Propagation, vol. 34, no. 3, pp. 276–280, 1986

    work page 1986

  2. [2]

    Twenty-five years of sensor array and multichannel signal processing: A review of progress to date and potential research directions,

    W. Liu, M. Haardt, M. S. Greco, C. F. Mecklenbr ¨auker, and P. Willett, “Twenty-five years of sensor array and multichannel signal processing: A review of progress to date and potential research directions,”IEEE Signal Processing Magazine, vol. 40, no. 4, pp. 80–91, 2023

    work page 2023

  3. [3]

    Security of the internet of things: Vulnerabilities, attacks, and countermeasures,

    I. Butun, P. ¨Osterberg, and H. Song, “Security of the internet of things: Vulnerabilities, attacks, and countermeasures,”IEEE Communications Surveys & Tutorials, vol. 22, no. 1, pp. 616–644, 2020

    work page 2020

  4. [4]

    Maximum likelihood approach to joint array detection/estimation,

    R. Bethel and K. Bell, “Maximum likelihood approach to joint array detection/estimation,”IEEE Transactions on Aerospace and Electronic Systems, vol. 40, no. 3, pp. 1060–1072, 2004

    work page 2004

  5. [5]

    Glrt-based adaptive detection algorithms for range-spread targets,

    E. Conte, A. De Maio, and G. Ricci, “Glrt-based adaptive detection algorithms for range-spread targets,”IEEE Transactions on Signal Processing, vol. 49, no. 7, pp. 1336–1348, 2001

    work page 2001

  6. [6]

    Maximum likelihood methods for direction- of-arrival estimation,

    P. Stoica and K. Sharman, “Maximum likelihood methods for direction- of-arrival estimation,”IEEE Transactions on Acoustics, Speech, and Signal Processing, vol. 38, no. 7, pp. 1132–1143, 1990

    work page 1990

  7. [7]

    A neural network-prepended glrt framework for signal detection under nonlinear distortions,

    R. Sahay, S. Appadwedula, D. J. Love, and C. G. Brinton, “A neural network-prepended glrt framework for signal detection under nonlinear distortions,”IEEE Communications Letters, vol. 26, no. 9, pp. 2161– 2165, 2022

    work page 2022

  8. [9]

    Deep learning-based doa estimation,

    S. Zheng, Z. Yang, W. Shen, L. Zhang, J. Zhu, Z. Zhao, and X. Yang, “Deep learning-based doa estimation,”IEEE Transactions on Cognitive Communications and Networking, vol. 10, no. 3, pp. 819–835, 2024

    work page 2024

  9. [10]

    Deep learning models for wireless signal classification with distributed low- cost spectrum sensors,

    S. Rajendran, W. Meert, D. Giustiniano, V . Lenders, and S. Pollin, “Deep learning models for wireless signal classification with distributed low- cost spectrum sensors,”IEEE Transactions on Cognitive Communica- tions and Networking, vol. 4, no. 3, pp. 433–445, 2018

    work page 2018

  10. [11]

    Deep learning in wireless communication receiver: A survey,

    S. R. Doha and A. Abdelhadi, “Deep learning in wireless communication receiver: A survey,” 2025. [Online]. Available: https://arxiv.org/abs/ 2501.17184

    work page arXiv 2025

  11. [12]

    Deep learning for intelligent wireless networks: A comprehensive survey,

    Q. Mao, F. Hu, and Q. Hao, “Deep learning for intelligent wireless networks: A comprehensive survey,”IEEE Communications Surveys & Tutorials, vol. 20, no. 4, pp. 2595–2621, 2018. 11

    work page 2018

  12. [13]

    Adversarial attacks in modulation recognition with convolutional neural networks,

    Y . Lin, H. Zhao, X. Ma, Y . Tu, and M. Wang, “Adversarial attacks in modulation recognition with convolutional neural networks,”IEEE Transactions on Reliability, vol. 70, no. 1, pp. 389–401, 2021

    work page 2021

  13. [14]

    Adversarial machine learning in wireless communications using rf data: A review,

    D. Adesina, C.-C. Hsieh, Y . E. Sagduyu, and L. Qian, “Adversarial machine learning in wireless communications using rf data: A review,” IEEE Communications Surveys & Tutorials, vol. 25, no. 1, pp. 77–100, 2023

    work page 2023

  14. [15]

    Intriguing properties of neural networks

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,”arXiv preprint arXiv:1312.6199, 2013

    work page internal anchor Pith review Pith/arXiv arXiv 2013

  15. [16]

    Explaining and Harnessing Adversarial Examples

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”arXiv preprint arXiv:1412.6572, 2014

    work page internal anchor Pith review Pith/arXiv arXiv 2014

  16. [17]

    Exceeding the dataflow limit via value prediction,

    M. Lipasti and J. Shen, “Exceeding the dataflow limit via value prediction,” inProceedings of the 29th Annual IEEE/ACM International Symposium on Microarchitecture. MICRO 29, 1996, pp. 226–237

    work page 1996

  17. [18]

    Esprit-estimation of signal parameters via rota- tional invariance techniques,

    R. Roy and T. Kailath, “Esprit-estimation of signal parameters via rota- tional invariance techniques,”IEEE Transactions on Acoustics, Speech, and Signal Processing, vol. 37, no. 7, pp. 984–995, 1989

    work page 1989

  18. [19]

    Two decades of array signal processing research: the parametric approach,

    H. Krim and M. Viberg, “Two decades of array signal processing research: the parametric approach,”IEEE Signal Processing Magazine, vol. 13, no. 4, pp. 67–94, 1996

    work page 1996

  19. [20]

    Music, maximum likelihood, and cramer- rao bound: further results and comparisons,

    P. Stoica and A. Nehorai, “Music, maximum likelihood, and cramer- rao bound: further results and comparisons,”IEEE Transactions on Acoustics, Speech, and Signal Processing, vol. 38, no. 12, pp. 2140– 2150, 1990

    work page 1990

  20. [21]

    Performance analysis for doa estimation algorithms: unification, simplification, and observations,

    F. Li, H. Liu, and R. Vaccaro, “Performance analysis for doa estimation algorithms: unification, simplification, and observations,”IEEE Trans- actions on Aerospace and Electronic Systems, vol. 29, no. 4, pp. 1170– 1184, 1993

    work page 1993

  21. [22]

    Detection of signals by information theoretic criteria,

    M. Wax and T. Kailath, “Detection of signals by information theoretic criteria,”IEEE Transactions on Acoustics, Speech, and Signal Process- ing, vol. 33, no. 2, pp. 387–392, 1985

    work page 1985

  22. [23]

    Detection of the number of coherent signals by the mdl principle,

    M. Wax and I. Ziskind, “Detection of the number of coherent signals by the mdl principle,”IEEE Transactions on Acoustics, Speech, and Signal Processing, vol. 37, no. 8, pp. 1190–1196, 1989

    work page 1989

  23. [24]

    S. M. Kay,Fundamentals of statistical signal processing: estimation theory. USA: Prentice-Hall, Inc., 1993

    work page 1993

  24. [25]

    Convolutional Radio Modulation Recognition Networks

    T. J. O’Shea and J. Corgan, “Convolutional radio modulation recognition networks,”CoRR, vol. abs/1602.04105, 2016. [Online]. Available: http://arxiv.org/abs/1602.04105

    work page internal anchor Pith review Pith/arXiv arXiv 2016

  25. [26]

    An introduction to deep learning for the physical layer,

    T. O’Shea and J. Hoydis, “An introduction to deep learning for the physical layer,”IEEE Transactions on Cognitive Communications and Networking, vol. 3, no. 4, pp. 563–575, 2017

    work page 2017

  26. [27]

    Broadband doa estimation using convolutional neural networks trained with noise signals,

    S. Chakrabarty and E. A. P. Habets, “Broadband doa estimation using convolutional neural networks trained with noise signals,” in2017 IEEE Workshop on Applications of Signal Processing to Audio and Acoustics (WASPAA), 2017, pp. 136–140

    work page 2017

  27. [28]

    Deep networks for direction-of-arrival estimation in low snr,

    G. K. Papageorgiou, M. Sellathurai, and Y . C. Eldar, “Deep networks for direction-of-arrival estimation in low snr,”IEEE Transactions on Signal Processing, vol. 69, pp. 3714–3729, 2021

    work page 2021

  28. [29]

    Deep learning for super-resolution channel estimation and doa estimation based massive mimo system,

    H. Huang, J. Yang, H. Huang, Y . Song, and G. Gui, “Deep learning for super-resolution channel estimation and doa estimation based massive mimo system,”IEEE Transactions on Vehicular Technology, vol. 67, no. 9, pp. 8549–8560, 2018

    work page 2018

  29. [30]

    Power of deep learning for channel estimation and signal detection in ofdm systems,

    H. Ye, G. Y . Li, and B.-H. Juang, “Power of deep learning for channel estimation and signal detection in ofdm systems,”IEEE Wireless Communications Letters, vol. 7, no. 1, pp. 114–117, 2018

    work page 2018

  30. [31]

    A deep network for single-snapshot direction of arrival estimation,

    E. Ozanich, P. Gerstoft, and H. Niu, “A deep network for single-snapshot direction of arrival estimation,” in2019 IEEE 29th International Work- shop on Machine Learning for Signal Processing (MLSP), 2019, pp. 1–6

    work page 2019

  31. [32]

    Algorithm unrolling: Interpretable, efficient deep learning for signal and image processing,

    V . Monga, Y . Li, and Y . C. Eldar, “Algorithm unrolling: Interpretable, efficient deep learning for signal and image processing,”IEEE Signal Processing Magazine, vol. 38, no. 2, pp. 18–44, 2021

    work page 2021

  32. [33]

    Towards Deep Learning Models Resistant to Adversarial Attacks

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” 2019. [Online]. Available: https://arxiv.org/abs/1706.06083

    work page internal anchor Pith review Pith/arXiv arXiv 2019

  33. [34]

    Evaluating adversarial evasion attacks in the context of wireless communications,

    B. Flowers, R. M. Buehrer, and W. C. Headley, “Evaluating adversarial evasion attacks in the context of wireless communications,”IEEE Transactions on Information Forensics and Security, vol. 15, pp. 1102– 1113, 2020

    work page 2020

  34. [35]

    Adversarial attacks on deep-learning based radio signal classification,

    M. Sadeghi and E. G. Larsson, “Adversarial attacks on deep-learning based radio signal classification,”IEEE Wireless Communications Let- ters, vol. 8, no. 1, pp. 213–216, 2019

    work page 2019

  35. [36]

    Over- the-air adversarial attacks on deep learning based modulation classifier over wireless channels,

    B. Kim, Y . E. Sagduyu, K. Davaslioglu, T. Erpek, and S. Ulukus, “Over- the-air adversarial attacks on deep learning based modulation classifier over wireless channels,” in2020 54th Annual Conference on Information Sciences and Systems (CISS), 2020, pp. 1–6

    work page 2020

  36. [37]

    Adversarial attacks on deep learning-based doa estimation with covariance input,

    Z. Yang, S. Zheng, L. Zhang, Z. Zhao, and X. Yang, “Adversarial attacks on deep learning-based doa estimation with covariance input,”IEEE Signal Processing Letters, vol. 30, pp. 1377–1381, 2023

    work page 2023

  37. [38]

    Signal adversarial examples generation for signal detection network via white- box attack,

    D. Li, L. Wang, G. Xiong, B. Yan, D. Ma, and J. Peng, “Signal adversarial examples generation for signal detection network via white- box attack,” 2024. [Online]. Available: https://arxiv.org/abs/2410.01393

    work page arXiv 2024

  38. [39]

    Adversarial Attacks on Neural Network Policies

    S. Huang, N. Papernot, I. Goodfellow, Y . Duan, and P. Abbeel, “Adversarial attacks on neural network policies,” 2017. [Online]. Available: https://arxiv.org/abs/1702.02284

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  39. [40]

    An adaptive detection algorithm,

    E. Kelly, “An adaptive detection algorithm,”IEEE Transactions on Aerospace and Electronic Systems, vol. AES-22, no. 2, pp. 115–127, 1986

    work page 1986

  40. [41]

    Channel-aware adversarial attacks against deep learning-based wireless signal classifiers,

    B. Kim, Y . E. Sagduyu, K. Davaslioglu, T. Erpek, and S. Ulukus, “Channel-aware adversarial attacks against deep learning-based wireless signal classifiers,”IEEE Transactions on Wireless Communications, vol. 21, no. 6, pp. 3868–3880, 2022

    work page 2022

  41. [42]

    Defensive distillation-based adversarial attack mitigation method for channel es- timation using deep learning models in next-generation wireless net- works,

    F. O. Catak, M. Kuzlu, E. Catak, U. Cali, and O. Guler, “Defensive distillation-based adversarial attack mitigation method for channel es- timation using deep learning models in next-generation wireless net- works,”IEEE Access, vol. 10, pp. 98 191–98 203, 2022

    work page 2022

  42. [43]

    Noise learning- based denoising autoencoder,

    W.-H. Lee, M. Ozger, U. Challita, and K. W. Sung, “Noise learning- based denoising autoencoder,”IEEE Communications Letters, vol. 25, no. 9, pp. 2983–2987, 2021. APPENDIX A. Proof of Theorem 1 Proof.Givenz(t)fort= 1, . . . , Tas columns ofZ(i.e., Z= [z(1),z(2),· · ·,z(T)], letδ(t)fort= 1, . . . , T be the perturbation of each time sample such thatδ= [δ(1)...

    work page 2021