基于 JiT 的去噪防御方法提升无线电信号调制分类对抗鲁棒性
A JiT-Based Denoising Defense Method Against Adversarial Examples for Radio Signal Automatic Modulation Classification
搞无线电信号分类的可以看看：用 JiT 扩散模型做去噪防御，不用预知攻击类型，PGD 下鲁棒性比对抗训练高 20% 多。
论文针对无线电信号自动调制分类（AMC）中 DNN 易受对抗攻击的问题，借鉴扩散模型 Just image Transformers（JiT）提出去噪防御方案。方法用 1D Transformer 通过 flow matching 训练，直接预测干净信号样本，无需预知攻击类型。在 RML2018.01A 数据集上，该方法在 PGD 攻击下鲁棒准确率比 PGD 对抗训练相对提升至少 20.58%，干净样本分类准确率相对提升 10.20%。面对训练时未见过的攻击类型，在高攻击强度下鲁棒准确率相对提升至少 39.72%。
A JiT-Based Denoising Defense Method Against Adversarial Examples for Radio Signal Automatic Modulation Classification
Automatic modulation classification (AMC) of radio signals is a core technology for spectrum monitoring and electromagnetic situational awareness. Deep neural networks (DNNs) play an important role in this field owing to their powerful feature extraction capabilities and end-to-end learning paradigm. However, their vulnerability to adversarial attacks poses serious security challenges to practical deployment. Adversarial training, a common defense, has limitations including poor generalization across attack types and high training costs. Inspired by Just image Transformers (JiT), a diffusion generative model that directly predicts clean images, this paper proposes a JiT-based denoising defense against adversarial examples for radio signal modulation classification. During training, a signal-specific 1D Transformer denoising network is optimized via flow matching to directly predict clean signal samples. It thereby learns a mapping that projects arbitrary examples back onto the low-dimensional manifold of clean signal examples. During inference, arbitrary examples are fed into the trained network and directly projected onto this manifold. This enables denoising defense without prior knowledge of attacks. Experiments on the RML2018.01A dataset were conducted without attack information, using a single empirically selected, fixed denoising start time. Compared with PGD-based adversarial training, the proposed method achieves a relative improvement of at least 20.58% in robust accuracy under PGD attacks. It also achieves a relative improvement of 10.20% in classification accuracy on clean examples. When evaluated against attack types unseen during adversarial training, the proposed method provides stronger defense than adversarial training. In particular, at higher attack strengths, it achieves a relative improvement of at least 39.72% in robust accuracy.