Diffusion-enabled Secure Semantic Communication Against Eavesdropping

Boxiang He; Fanggang Wang; Shilian Wang; Tony Q.S. Quek; Zhijin Qin; Zihan Chen

REVIEW 4 major objections 4 minor 32 references

Diffusion-enabled Secure Semantic Communication Against Eavesdropping

T0 review · 4 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adding artificial noise plus a diffusion clean-up step blocks semantic eavesdroppers without retraining the semantic encoder or decoder.

desk verdict DDPM-based plug-in decryptor is a genuinely nice idea, but the pluggability claim is only shown for one fixed transmitter and the evaluation lacks the baselines needed to back it up. read the letter →

arxiv 2505.05018 v1 pith:Y5FGNRZ5 submitted 2025-05-08 cs.IT math.IT

Boxiang He , Zihan Chen , Fanggang Wang , Shilian Wang , Zhijin Qin , Tony Q.S. Quek This is my paper · ORCID

classification cs.ITmath.IT

keywords semanticcommunicationeavesdroppingartificialnoisediffusionmodelDDPMadversarialresidualnetworkwirelesssecuritydeepreinforcementlearning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Semantic communication transmits meaning rather than exact bits, and this paper tries to prove that such a link can be made secure against eavesdropping by inserting paired pluggable modules rather than by retraining the deployed neural networks. The transmitter-side module adds artificial noise, Gaussian when the eavesdropper is unknown and adversarial when it is known; the receiver-side module uses a denoising diffusion model to remove both the artificial noise and the channel noise before the semantic decoder. The paper's central claim is that this pluggable arrangement prevents semantic eavesdropping while keeping the legitimate reconstruction quality close to, or sometimes better than, the unsecured baseline. If true, it matters because existing security schemes either retrain the semantic system or visibly distort the channel input, whereas this design can be switched on only when private information is transmitted.

What carries the argument

The central mechanism is the paired pluggable encryption/decryption modules. Encryption adds either artificial Gaussian noise (AGN), $x'_{\mathrm{Alice}}=\sqrt{u}\,x_{\mathrm{Alice}}+\sqrt{1-u}\,w$, or an adversarial residual network (ARN) perturbation, $x'_{\mathrm{Alice}}=x_{\mathrm{Alice}}+\delta$, to the semantic transmitter's output. Decryption is a one-step DDPM denoiser, $x_{\mathrm{Bob}}=\frac{1}{\sqrt{\bar\alpha(\hat t)}}\big(\bar y_{\mathrm{Bob}}-\sqrt{1-\bar\alpha(\hat t)}\,f_{\mathrm{NENN}}(\bar y_{\mathrm{Bob}},\hat t)\big)$, where $f_{\mathrm{NENN}}$ is the noise estimation neural network trained with the standard DDPM loss and $\hat t$ is chosen by matching the effective SNR $u/(1-u+\sigma_b^2)$ or $1/(\mathbb{E}[\|\delta\|^2/L_t]+\sigma_b^2)$ to the diffusion schedule's $\bar\alpha(t)/(1-\bar\alpha(t))$. This machinery is what turns the added security noise from an irreducible cost into a modeled noise level that the receiver can reverse.

What would settle it

Fix a grid of Alice-Bob SNRs, take the AGN power $u$ selected by the DDPG actor, and run Bob's decryption with the single-step formula (34). If, at any operating SNR, the reconstruction MSE is substantially worse than running a full multi-step reverse diffusion chain, or worse than the unplugged semantic system, the claim that the SNR-matched time step suffices is refuted.

Watch

Extended reading notes

Core claim

The proposed defense treats the actively added artificial noise and the passively added channel noise as part of a diffusion forward process, then removes both at the legitimate receiver with a single denoising step. In the unknown-eavesdropper scenario the transmitted signal is $x'=\sqrt{u}x+\sqrt{1-u}\,w$ with artificial Gaussian noise (AGN) $w$, the power allocation $u$ is chosen by a deep reinforcement learning actor to minimize a weighted sum of legitimate reconstruction MSE, an upper bound on mutual information leakage $I(x;y_{\mathrm{Eve}})$, and channel-input distortion, and Bob computes a normalized signal $\bar y$, picks a diffusion time step $\hat t$ whose SNR matches the link SNR, and applies one reverse step to recover $x$. In the known-eavesdropper scenario the encryption module is an adversarial residual network producing a low-power perturbation $\delta$, and the same diffusion decryption removes $\delta$ and channel noise for Bob while Eve's classifier is driven to near-random accuracy. The paper reports that the privacy leakage MI stays near zero or Eve's accuracy falls to roughly 0.2 while the covertness MSE remains small and the legitimate link's MSE is close to the no-security baseline.

Load-bearing premise

The receiver's one-step denoising formula, whose time step is chosen only by matching the link SNR, is assumed to remove the artificial and channel noise accurately enough at every operating noise power; the paper gives no proof or ablation for that accuracy.

Editorial extensions

If this is right

A deployed semantic encoder/decoder could gain eavesdropping protection by plugging modules around it, with no retraining and no modification of the existing semantic networks.
In the unknown-eavesdropper case, the trained actor network chooses the AGN power in about 0.15 s while matching the objective value of an exhaustive search that takes about 18.7 s, enabling fast adaptation to changing link SNRs.
In the known-eavesdropper case, Eve's classification accuracy drops to roughly 0.2 with a perturbation whose power stays below 10 percent of the transmitted signal power, so the security measure is low-power and harder to detect.
Because the diffusion decryption can even outperform the unplugged receiver at some signal-to-noise ratios, the scheme does not always trade away communication quality to buy security.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural extension the authors leave implicit is to use more than one reverse diffusion step or a posterior sampler at the receiver; that would likely make legitimate reconstruction robust over a wider range of SNRs than the single-step estimate used here.
The ARN is trained against one known Eve model, so the security level depends on the assumption that Eve cannot train a perturbation-robust classifier or obtain the ARN parameters; evaluating the scheme against a stronger, adaptive Eve would be a direct next test.
The SNR-matching rule in (35) relies on the second-order statistics of the added noise, so in fading or non-Gaussian channels the one-to-one match to the diffusion schedule would break; the paper notes extension through neural-network channel models as future work.
The unknown-eavesdropper analysis measures privacy leakage by mutual information on a Gaussian wiretap model, which may not reflect the success rate of a specific inversion or attribute-inference attack; an attack-oriented privacy metric would complement the MI result.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the DDPM-as-decryptor idea is genuinely nice and the paper is competent, but the central "pluggable without retraining" claim is not actually established beyond a single fixed transmitter, and the evaluation is too thin to call it a clear win over existing secure semantic communication schemes.

What's new: pairing an AN generation module (Gaussian or adversarial) with a diffusion-based denoiser that removes both the artificial noise and the channel noise in one step is a new combination. The SNR-matched time-step selection in (35) is a clever practical trick, and the ARN design with the covertness constraint is a reasonable way to generate low-power adversarial perturbations. I believe the math is mostly correct—Theorem 1 is a standard upper bound, and the DDPG formulation is standard. The paper does a decent job of laying out the two scenarios (Eve known/unknown) and the experimental results on MNIST/CIFAR-10/Fashion-MNIST show the scheme works in the specific setup tested.

Where it gets soft: 1. The privacy-leakage numbers in Scenario I are not a finding; I(x_Alice; y_Eve)→0 as u→0 is built into (21)-(24). The DDPG is just minimizing an upper bound on that forced quantity. The real question is whether Bob's reconstruction stays competitive, and that part is interesting and works in the simulations, but it needs error bars and an ablation of the one-step denoising approximation. I would like to see what happens when the SNR-matched time step in (35) is off—there is no study of robustness to mismatch. 2. The "pluggable" claim is undersupported. The NENN has to be trained on the exact channel-input distribution of the semantic transmitter. The paper never specifies which transmitter was used to generate x_Alice(0) for NENN training, and all experiments appear to use the same transmitter. That is circular in the sense that you've shown it works for the transmitter you trained on. What if you plug the modules in front of a different semantic encoder? The whole selling point is no retraining, so you need a cross-transmitter experiment or at least a statement that the NENN is trained per-transmitter (in which case 'pluggable' is closer to 'pre-installed'). 3. No comparisons to existing secure semantic communication baselines (e.g., adversarial training methods [18]-[21]). Without those, I can say this works but not that it improves on the state of the art. For a systems paper that's a big gap. 4. Minor: the "first time AN is introduced into semantic communication" claim in the abstract is over-strong—there are related physical-layer AN works, and the novelty is really in the specific pairing with DDPM.

Who it's for: people in secure semantic communication who want a plug-in defense design. It deserves a serious referee, but the revision needs to add baselines, error bars, and a cross-transmitter test. If those hold up, it's a solid IEEE-level paper; right now it's a promising idea with insufficient evidence.

Referee Report

4 major / 4 minor

Summary. The paper proposes a diffusion-enabled security framework for semantic communication, in which a pluggable encryption module adds artificial noise (AGN in Scenario I, adversarial residual-network perturbation in Scenario II) to the semantic transmitter's output, and a pluggable DDPM-based decryption module at the legitimate receiver removes both the artificial noise and channel noise without retraining the semantic encoder/decoder. In Scenario I, an optimization problem over the AGN power allocation is solved by a DDPG agent; in Scenario II, an adversarial residual network is trained end-to-end. Experiments on MNIST, CIFAR-10, and Fashion MNIST report communication MSE, privacy-leakage mutual information or accuracy, and covertness MSE. The central claim is that the paired pluggable modules prevent semantic eavesdropping while keeping the legitimate link's reconstruction quality near baseline.

Significance. The pluggable architecture is a potentially useful practical idea: if the NENN-based decryption module could be inserted into an already-deployed semantic communication system without retraining the core modules, it would reduce deployment friction compared to existing adversarial-training schemes that retrain the whole encoder-decoder pair. The paper is clearly written and covers two distinct threat-knowledge scenarios, and the multi-dataset experiments show the proposed modules work on simple image datasets. However, the security gain in Scenario I is essentially a consequence of the noise-injection construction, the pluggability claim is not yet established because the NENN is trained on a transmitter output distribution that is never specified, and the one-step DDPM denoising is assumed to be accurate without proof or ablation. The empirical comparison also lacks baselines and error bars, so the claimed advantages over prior secure semantic communication schemes are not yet demonstrated.

major comments (4)

[§IV-B, Eqs. (24) and (40)] The privacy-leakage result in Scenario I is an algebraic consequence of the signal model rather than a newly established security property. Since y_Eve = sqrt(u)x_Alice + sqrt(1-u)w + n_Eve, Eq. (24) shows I(x_Alice; y_Eve) tends to 0 as u tends to 0 by construction, and the DDPG in Eq. (40) minimizes an upper bound of exactly this mutual information. The paper should state clearly what security insight beyond 'inject more noise to Eve' is being contributed, and should report the true mutual information, not only the upper bound IUP from Eq. (37), in the evaluation. In particular, §V-B says the privacy-leakage MI 'remains at a low level (around 2)' while Observation 1 says 'near-zero'; this inconsistency must be resolved and the units specified.
[§IV-B, Eq. (32) and §V-A] The central 'pluggable without retraining' claim is not established. The NENN is trained with loss (32) over x_Alice(t) generated via Eq. (28), where x_Alice(0) follows q(x_Alice(0)), the distribution of the semantic transmitter's output. The manuscript never specifies how q(x_Alice(0)) is obtained, whether it matches the specific transmitter used in the experiments, or whether the NENN generalizes across different semantic encoder/decoder instances. If q is the empirical distribution of the evaluated transmitter, then the pluggability claim is only demonstrated for that transmitter, and no evidence is given for deployment with a different semantic communication system. Please add experiments with multiple transmitter instances, or explicitly state that a one-time offline training of the NENN on the deployed transmitter's output distribution is required.
[§IV-B, Eqs. (34)-(35)] The one-step DDPM decryption formula (34), with the time step selected by SNR matching in (35), is assumed to approximate the full reverse diffusion process accurately for all operating SNRs, but no derivation, theoretical bound, or ablation is provided. Equation (34) estimates x_Alice(0) directly rather than performing iterative reverse sampling; at large time steps this estimate can be poor unless the noise predictor is well calibrated. If the SNR-matched time step is inaccurate at some operating points or datasets, Bob's reconstruction quality could degrade and the claimed security-communication tradeoff would collapse. Please provide an ablation comparing Eq. (34) with iterative DDPM sampling and report reconstruction error over a fine SNR grid.
[§V] The empirical evaluation does not include comparisons with existing secure semantic communication baselines such as adversarial training [18]-[21] or random permutation [22], and it reports no error bars, standard deviations, or multiple random seeds. Consequently, the claim that the proposed paired pluggable modules achieve 'high-quality semantic communication' while preventing eavesdropping is not shown to be competitive with prior art. Please add baseline comparisons and statistical significance information, and provide code or sufficient detail for reproducibility.

minor comments (4)

[§V-A] The hyper-parameter list says λcom, λpri, and λper are set to 10, 0.25, and 1, but the objective in Eq. (63) uses λcov for the covertness term; please standardize the notation.
[§IV-C, Eqs. (51)-(53)] The sign convention changes between Eq. (51), which contains -λpri Pr{g_Eve ≠ m}, and Eq. (53), which contains +λpri E[e^{φ_m}/Σ e^{φ_j}]; the equivalence requires the reader to recognize the replacement of 'probability of wrong classification' with 'confidence of the true label.' Please state this explicitly to avoid confusion.
[Notation] The noise variances are denoted σ_b^2 and σ_e^2 in some places and σ_Bob^2 and σ_Eve^2 in others; please use a single consistent notation throughout.
[§V-D and Fig. 10] The figure caption contains the typo 'datastes' for 'datasets', and the paper does not mention the computational cost or latency of the DDPM-based decryption module, which would be relevant to the claimed practical deployability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the security metrics are the optimization objectives themselves, and the reported gains are simulation outcomes of the designed modules rather than independent predictions; the only notable gaps (e.g., NENN training distribution versus pluggability) are evidence issues, not circular derivations.

full rationale

The paper's derivation chain is explicit and non-circular. Scenario I defines f_Alice as a convex combination x'_Alice = sqrt(u)x_Alice + sqrt(1-u)w (Eq. 21), notes that I(x_Alice; y_Eve) goes to zero as u goes to zero (Eq. 24), and then optimizes u against a weighted objective containing an upper bound on that same mutual information (Eqs. 36-40). Reporting that the resulting MI is low is therefore reporting success on the design objective, not deriving a prediction from an independent premise. Similarly, Scenario II trains the ARN to minimize Eve's confidence (Eqs. 51-63) and then reports Eve's accuracy as low; again this is a direct evaluation of the training objective, not a concealment of a fitted input as a prediction. The DDPM decryption module is defined by the standard diffusion forward equation (Eq. 28), a noise-estimation loss (Eq. 32), and a one-step denoising rule (Eq. 34), and its performance is measured on the same transmitter-output distribution used in training. A real limitation is that the paper does not specify whether the NENN, trained on q(x_Alice(0)) for a particular semantic transmitter, generalizes to other transmitters, so the 'pluggable without retraining' claim is not fully established across deployments. That is an external-validity or missing-evidence concern, not a circular-reasoning defect. No load-bearing self-citation chain, no ansatz smuggled in via citation, and no renaming of a known result is used to force the conclusions.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on standard DDPM background, unit-power normalization, AWGN channel assumptions, and a one-step SNR-matched denoising approximation. The main hand-chosen numbers are the objective weights and the covertness power limit. No new physical entities are introduced.

free parameters (4)

Objective weights lambda_com, lambda_pri, lambda_cov = 10, 0.25, 1
Hand-chosen in Section V-A; they set the balance between communication MSE, privacy leakage, and covertness, so all tradeoff results depend on them.
Covertness power limit epsilon = 0.1
Power budget for the ARN perturbation in equation (63) and Fig. 7(c); chosen by hand and used as the covertness threshold.
DDPG exploration variance epsilon = 0.5
Exploration noise variance in Section V-A; affects DDPG convergence but not the final architecture.
Diffusion schedule beta(t) = not specified
The forward process in (25) requires a schedule, but the paper never specifies beta(t) or the total steps T; this is an unstated design choice for the NENN training.

assumptions (5)

standard math The forward diffusion process (25)-(31) and the noise-prediction training (32) from DDPM [30] transfer to the channel denoising task.
Used as background without re-derivation; the paper relies on the validity of DDPM training and inference.
domain assumption x_Alice is normalized to unit power (Section III), so the SNR matching in (35) is well posed.
The normalized channel input makes the diffusion SNR comparison in (35) meaningful.
domain assumption Both Alice-Bob and Alice-Eve channels are AWGN with known noise variances.
Section III models the main and wiretap channels as AWGN with variances sigma_Bob^2 and sigma_Eve^2; no fading or channel state differences are exploited.
domain assumption In Scenario II, Alice knows Eve's exact architecture and parameters, and Eve does not adapt its classifier during evaluation.
Section IV-C assumes Alice has the knowledge of Eve's neural network and uses that fixed model to train the ARN.
ad hoc to paper The single-step denoising formula (34), with the time-step selected by SNR matching in (35), approximates the full reverse diffusion process well enough for all operating SNRs.
This is a load-bearing modeling choice that is not proven; the entire receiver design depends on it.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Diffusion-enabled Secure Semantic Communication Against Eavesdropping." pith.science (2026). https://pith.science/paper/Y5FGNRZ5

@misc{pith2026250505018,
  author       = {Pith},
  title        = {Pith review of: Diffusion-enabled Secure Semantic Communication Against Eavesdropping},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Y5FGNRZ5}},
  note         = {Machine review of arXiv:2505.05018}
}

read the original abstract

In this paper, AN is introduced into semantic communication systems for the first time to prevent semantic eavesdropping. However, the introduction of AN also poses challenges for the legitimate receiver in extracting semantic information. Recently, denoising diffusion probabilistic models (DDPM) have demonstrated their powerful capabilities in generating multimedia content. Here, the paired pluggable modules are carefully designed using DDPM. Specifically, the pluggable encryption module generates AN and adds it to the output of the semantic transmitter, while the pluggable decryption module before semantic receiver uses DDPM to generate the detailed semantic information by removing both AN and the channel noise. In the scenario where the transmitter lacks eavesdropper's knowledge, the artificial Gaussian noise (AGN) is used as AN. We first model a power allocation optimization problem to determine the power of AGN, in which the objective is to minimize the weighted sum of data reconstruction error of legal link, the mutual information of illegal link, and the channel input distortion. Then, a deep reinforcement learning framework using deep deterministic policy gradient is proposed to solve the optimization problem. In the scenario where the transmitter is aware of the eavesdropper's knowledge, we propose an AN generation method based on adversarial residual networks (ARN). Unlike the previous scenario, the mutual information term in the objective function is replaced by the confidence of eavesdropper correctly retrieving private information. The adversarial residual network is then trained to minimize the modified objective function. The simulation results show that the diffusion-enabled pluggable encryption module prevents semantic eavesdropping while the pluggable decryption module achieves the high-quality semantic communication.

Figures

Figures reproduced from arXiv: 2505.05018 by the authors.

**Figure 2.** Security-aware semantic communication framewor [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Pluggable paired modules for Alice having no Eve’s [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Figures from the paper (6 more)

**Figure 4.** Figure 4: Training procedure for ARN in the case of Alice havi [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

**Figure 5.** Figure 5: The communication MSE, the privacy leakage MI, and [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

**Figure 6.** Figure 6: The objective value obtained by the exhaustive sear [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

**Figure 7.** Figure 7: The communication MSE, the Eve’s classification ac [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

**Figure 8.** Figure 8: The communication MSE and the Eve’s classification [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]

**Figure 11.** Figure 11: The communication MSE, the Eve’s classification a [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 24 canonical work pages

[18]

Adversari al networks for secure wireless communications,

T. Marchioro, N. Laurenti, and D. G¨ und¨ uz, “Adversari al networks for secure wireless communications,” in Proc. IEEE Int. Conf. Acoust., Speech Signal Process. (ICASSP) , Barcelona, Spain, May 2020, pp. 8748–8752

work page 2020
[21]

Encrypted semantic communi- cation using adversarial training for privacy preserving,

X. Luo, Z. Chen, M. Tao, and F. Y ang, “Encrypted semantic communi- cation using adversarial training for privacy preserving, ” IEEE Commun. Lett., vol. 27, no. 6, pp. 1486–1490, Jun. 2023

work page 2023
[22]

The model inversio n eavesdrop- ping attack in semantic communication systems,

Y . Chen, Q. Y ang, Z. Shi, and J. Chen, “The model inversio n eavesdrop- ping attack in semantic communication systems,” in Proc. IEEE Global Commun. Conf. (GLOBECOM) , Kuala Lumpur, Malaysia, Feb. 2023, pp. 5171–5177

work page 2023
[1]

Semantic communications : overview, open issues, and future research directions,

X. Luo, H.-H. Chen, and Q. Guo, “Semantic communications : overview, open issues, and future research directions,” IEEE Wirel. Commun. , vol. 29, no. 1, pp. 210–219, Feb. 2022

2022
[2]

Persona lizing semantic communication: A foundation model approach,

Z. Chen, H. H. Y ang, K. F. E. Chong, and T. Q. Quek, “Persona lizing semantic communication: A foundation model approach,” in Proc. 2024 IEEE 25th Int. W orkshop Signal Process. Adv. Wireless C ommun. (SPAWC), Lucca, Italy, 2024, pp. 846–850

work page 2024
[3]

Semantic communications: Principles and challenges,

Z. Qin, X. Tao, J. Lu, W. Tong, and G. Y . Li, “Semantic communications: Principles and challenges,” 2022. [Onlin e]. Available: https://arxiv.org/abs/2201.01389

arXiv 2022
[4]

Semantic communications for fu ture internet: Fundamentals, applications, and challenges,

W. Y ang, H. Du, Z. Q. Liew, W. Y . B. Lim, Z. Xiong, D. Niyato, X. Chi, X. Shen, and C. Miao, “Semantic communications for fu ture internet: Fundamentals, applications, and challenges,” IEEE Commun. Surv. Tutor ., vol. 25, no. 1, pp. 213–250, 1st Quart. 2023

2023
[5]

Deep learning en abled semantic communication systems,

H. Xie, Z. Qin, G. Y . Li, and B.-H. Juang, “Deep learning en abled semantic communication systems,” IEEE Trans. Signal Process., vol. 69, pp. 2663–2675, 2021

2021

Show all 32 references

[6]

Toward semantic communications: Deep learning-based image semantic codin g,

D. Huang, F. Gao, X. Tao, Q. Du, and J. Lu, “Toward semantic communications: Deep learning-based image semantic codin g,” IEEE J. Sel. Areas Commun. , vol. 41, no. 1, pp. 55–71, Jan. 2023

2023
[7]

Semantic communication systems for s peech transmission,

Z. Weng and Z. Qin, “Semantic communication systems for s peech transmission,” IEEE J. Sel. Areas Commun. , vol. 39, no. 8, pp. 2434– 2444, Aug. 2021

2021
[8]

Task-oriented se mantic communication based on semantic triplets,

C. Liu, C. Guo, S. Wang, Y . Li, and D. Hu, “Task-oriented se mantic communication based on semantic triplets,” in Proc. IEEE Wirel. Com- mun. and Netw. Conf. (WCNC) , Glasgow, United Kingdom, May 2023, pp. 1–6

2023
[9]

Drl -driven dynamic resource allocation for task-oriented semantic co mmunication,

H. Zhang, H. Wang, Y . Li, K. Long, and A. Nallanathan, “Drl -driven dynamic resource allocation for task-oriented semantic co mmunication,” IEEE Trans. Commun. , vol. 71, no. 7, pp. 3992–4004, Jul. 2023

2023
[10]

Semantic communications with ai tasks,

Y . Y ang, C. Guo, F. Liu, C. Liu, L. Sun, Q. Sun, and J. Chen, “Semantic communications with ai tasks,” 2021. [Online]. A vailable: https://arxiv.org/abs/2109.14170

2021 arXiv
[11]

Deep learning enabled semantic communications with speech reco gnition and synthesis,

Z. Weng, Z. Qin, X. Tao, C. Pan, G. Liu, and G. Y . Li, “Deep learning enabled semantic communications with speech reco gnition and synthesis,” IEEE Trans. Wirel. Commun. , vol. 22, no. 9, pp. 6227–6240, Sept. 2023

2023
[12]

Semantic communi cations for image recovery and classiﬁcation via deep joint source a nd channel coding,

Z. Lyu, G. Zhu, J. Xu, B. Ai, and S. Cui, “Semantic communi cations for image recovery and classiﬁcation via deep joint source a nd channel coding,” IEEE Trans. Wirel. Commun. , vol. 23, no. 8, pp. 8388–8404, Aug. 2024

2024
[13]

Deep l earning- enabled semantic communication systems with task-unaware transmitter and dynamic data,

H. Zhang, S. Shao, M. Tao, X. Bi, and K. B. Letaief, “Deep l earning- enabled semantic communication systems with task-unaware transmitter and dynamic data,” IEEE J. Sel. Areas Commun. , vol. 41, no. 1, pp. 170–185, Jan. 2023

2023
[14]

Semprotector: A uniﬁed framework for semantic pro tection in deep learning-based semantic communication systems,

X. Liu, G. Nan, Q. Cui, Z. Li, P . Liu, Z. Xing, H. Mu, X. Tao, and T. Q. S. Quek, “Semprotector: A uniﬁed framework for semantic pro tection in deep learning-based semantic communication systems,” IEEE Commun. Mag., vol. 61, no. 11, pp. 56–62, Nov. 2023

2023
[15]

Secure semantic commun ication via paired adversarial residual networks,

B. He, F. Wang, and T. Q. S. Quek, “Secure semantic commun ication via paired adversarial residual networks,” IEEE Wirel. Commun. Lett. , vol. 13, no. 10, pp. 2832–2836, Oct. 2024

2024
[16]

Secure sem antic communication over wiretap channel,

D. Kozlov, M. Mirmohseni, and R. Tafazolli, “Secure sem antic communication over wiretap channel,” 2024. [Online]. Avai lable: https://arxiv.org/abs/2405.03361

2024 arXiv
[17]

A nearly information theoretically secure approach for sema ntic communications over wiretap channel,

W. Chen, S. Shao, Q. Y ang, Z. Zhang, and P . Zhang, “A nearly information theoretically secure approach for sema ntic communications over wiretap channel,” 2024. [Online]. Ava ilable: https://arxiv.org/abs/2401.13980

2024 arXiv
[19]

Privacy-a ware communi- cation over a wiretap channel with generative networks,

E. Erdemir, P . L. Dragotti, and D. G¨ und¨ uz, “Privacy-a ware communi- cation over a wiretap channel with generative networks,” in Proc. IEEE Int. Conf. Acoust., Speech Signal Process. (ICASSP) , Singapore, May 2022, pp. 2989–2993

2022
[20]

Wireless image transmission with semantic and security awareness,

M. Zhang, Y . Li, Z. Zhang, G. Zhu, and C. Zhong, “Wireless image transmission with semantic and security awareness,” IEEE Wirel. Com- mun. Lett. , vol. 12, no. 8, pp. 1389–1393, Aug. 2023

2023
[23]

Secure semantic communication for image transmission in the presence of eavesdroppers,

S. Tang, C. Liu, Q. Y ang, S. He, and D. Niyato, “Secure semantic communication for image transmission in the presence of eavesdroppers,” 2024. [Online]. Available : https://arxiv.org/abs/2404.12170

2024 arXiv
[24]

Rethinking wireless communication security in seman tic internet of things,

H. Du, J. Wang, D. Niyato, J. Kang, Z. Xiong, M. Guizani, a nd D. I. Kim, “Rethinking wireless communication security in seman tic internet of things,” IEEE Wirel. Commun. , vol. 30, no. 3, pp. 36–43, Jun. 2023. 14

2023
[25]

Anti-modulation-classiﬁcation tra nsmitter design against deep learning approaches,

B. He and F. Wang, “Anti-modulation-classiﬁcation tra nsmitter design against deep learning approaches,” IEEE Trans. Wirel. Commun., vol. 23, no. 7, pp. 6808–6823, Jul. 2024

2024
[26]

Secrecy capa city of the primary system in a cognitive radio network,

V .-D. Nguyen, T. M. Hoang, and O.-S. Shin, “Secrecy capa city of the primary system in a cognitive radio network,” IEEE Trans. V ehicular Tech., vol. 64, no. 8, pp. 3834–3843, Aug. 2015

2015
[27]

Robust beamforming for secure communication in systems with wireless information and power transfer,

D. W. K. Ng, E. S. Lo, and R. Schober, “Robust beamforming for secure communication in systems with wireless information and power transfer,” IEEE Trans.on Wirel. Commun., vol. 13, no. 8, pp. 4599–4615, Aug. 2014

2014
[28]

I mproving image generation with better captions

J. Betker, G. Goh, L. Jing, TimBrooks, J. Wang, L. Li, LongOuyang, JuntangZhuang, JoyceLee, Y ufeiGuo, WesamMan assra, PrafullaDhariwal, CaseyChu, Y unxinJiao, and A. Ramesh, “I mproving image generation with better captions.” [Online]. Availab le: https://api.semanticscholar....
[29]

A brief overview of chatgpt: The history, status quo and poten tial future development,

T. Wu, S. He, J. Liu, S. Sun, K. Liu, Q.-L. Han, and Y . Tang, “A brief overview of chatgpt: The history, status quo and poten tial future development,” IEEE/CAA JAS, vol. 10, no. 5, pp. 1122–1136, May 2023

2023
[30]

Denoising diffusion prob abilistic models,

J. Ho, A. Jain, and P . Abbeel, “Denoising diffusion prob abilistic models,” Adv. Neural Inf. Process. Syst. , vol. 33, pp. 6840–6851, 2020

2020
[31]

Towards deep learning models resistant to adversarial attacks,

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vlad u, “Towards deep learning models resistant to adversarial attacks,” in Proc. Int. Conf. Learn. Represent. , May 2018, pp. 1–10

2018
[32]

Univer- sal adversarial perturbations,

S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P . Fros sard, “Univer- sal adversarial perturbations,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2017, pp. 1765–1773

2017

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [18]

Adversari al networks for secure wireless communications,

T. Marchioro, N. Laurenti, and D. G¨ und¨ uz, “Adversari al networks for secure wireless communications,” in Proc. IEEE Int. Conf. Acoust., Speech Signal Process. (ICASSP) , Barcelona, Spain, May 2020, pp. 8748–8752

work page 2020

[2] [21]

Encrypted semantic communi- cation using adversarial training for privacy preserving,

X. Luo, Z. Chen, M. Tao, and F. Y ang, “Encrypted semantic communi- cation using adversarial training for privacy preserving, ” IEEE Commun. Lett., vol. 27, no. 6, pp. 1486–1490, Jun. 2023

work page 2023

[3] [22]

The model inversio n eavesdrop- ping attack in semantic communication systems,

Y . Chen, Q. Y ang, Z. Shi, and J. Chen, “The model inversio n eavesdrop- ping attack in semantic communication systems,” in Proc. IEEE Global Commun. Conf. (GLOBECOM) , Kuala Lumpur, Malaysia, Feb. 2023, pp. 5171–5177

work page 2023

[4] [1]

Semantic communications : overview, open issues, and future research directions,

X. Luo, H.-H. Chen, and Q. Guo, “Semantic communications : overview, open issues, and future research directions,” IEEE Wirel. Commun. , vol. 29, no. 1, pp. 210–219, Feb. 2022

2022

[5] [2]

Persona lizing semantic communication: A foundation model approach,

Z. Chen, H. H. Y ang, K. F. E. Chong, and T. Q. Quek, “Persona lizing semantic communication: A foundation model approach,” in Proc. 2024 IEEE 25th Int. W orkshop Signal Process. Adv. Wireless C ommun. (SPAWC), Lucca, Italy, 2024, pp. 846–850

work page 2024

[6] [3]

Semantic communications: Principles and challenges,

Z. Qin, X. Tao, J. Lu, W. Tong, and G. Y . Li, “Semantic communications: Principles and challenges,” 2022. [Onlin e]. Available: https://arxiv.org/abs/2201.01389

arXiv 2022

[7] [4]

Semantic communications for fu ture internet: Fundamentals, applications, and challenges,

W. Y ang, H. Du, Z. Q. Liew, W. Y . B. Lim, Z. Xiong, D. Niyato, X. Chi, X. Shen, and C. Miao, “Semantic communications for fu ture internet: Fundamentals, applications, and challenges,” IEEE Commun. Surv. Tutor ., vol. 25, no. 1, pp. 213–250, 1st Quart. 2023

2023

[8] [5]

Deep learning en abled semantic communication systems,

H. Xie, Z. Qin, G. Y . Li, and B.-H. Juang, “Deep learning en abled semantic communication systems,” IEEE Trans. Signal Process., vol. 69, pp. 2663–2675, 2021

2021