基于雅可比显著图的电磁信号无目标平滑对抗攻击方法

doi:10.12305/j.issn.1001-506X.2025.07.06

摘要/Abstract

摘要：

针对生成电磁信号对抗样本隐蔽性不足的问题, 提出一种基于雅可比显著图的电磁信号无目标平滑对抗攻击方法(electromagnetic signal no-targeted smooth adversarial attack method based on Jacobian saliency map, NTSA)。该方法平衡对抗样本各项范数, 根据电磁信号自身特点, 通过计算雅可比矩阵生成显著图, 选取关键特征点进行平滑的扰动添加从而生成对抗样本。在使用公开数据集训练的3个网络模型上进行实验得到的结果表明, NTSA在3个网络模型上都能达到90%以上的成功率。该方法比同类型特征点方法，即基于Jacobian显著图攻击(Jacobian-based saliency map attack, JSMA)方法提升了30%的攻击成功率, 且扰动比率能降低到5%以下。从扰动比率、单点扰动距离、余弦相似度以及欧氏距离这4项隐蔽性指标反映出NTSA所生成的样本与该文其他方法生成的对抗样本相比具有最好的隐蔽性。

关键词: 电磁信号识别, 对抗攻击, 对抗样本, 平滑攻击, 鲁棒性

Abstract:

In order to solve the problem of insufficient concealment of the generated electromagnetic signal adversarial examples, an electromagnetic signals no-targeted smoothing adversarial attack method based on Jacobian saliency maps (NTSA) is proposed, which balances the norms of the adversarial examples, generates a saliency map by calculating the Jacobian matrix according to the characteristics of the electromagnetic signal itself, and selects key feature points for smooth perturbation addition to generate adversarial examples. The experimental results on three network models trained using public datasets show that the NTSA can achieve a success rate of more than 90% on three network models. Compared with the same type of feature point method Jacobian-based saliency map attack (JSMA), the attack success rate of this method is improved by 30%, and the perturbation ratio can be reduced to less than 5%. The four concealment indexes, namely perturbation ratio, single-point perturbation distance, cosine similarity and Euclidean distance, show that the samples generated by the NTSA have the best concealment compared with the adversarial samples generated by other methods in this paper.

Key words: electromagnetic signal recognition, confrontation attacks, adversarial examples, smooth attacks, robustness

中图分类号:

TP183

王梓聪, 张剑. 基于雅可比显著图的电磁信号无目标平滑对抗攻击方法[J]. 系统工程与电子技术, 2025, 47(7): 2127-2135.

Zicong WANG, Jian ZHANG. Electromagnetic signal no-targeted smooth adversarial attack method based on Jacobian saliency map[J]. Systems Engineering and Electronics, 2025, 47(7): 2127-2135.

图/表 7

图1

图2

图3

图4

表1

表2

表3

参考文献 29

1	王雪松,李健兵,徐丰,等.电磁空间信息资源的认知与利用[J].中国科学基金,2021,35(5):682-687.
	WANGX S,LIJ B,XUF,et al.Cognition and utilization of electromagnetic space information resources[J].China Science Foundation,2021,35(5):682-687.
2	LIU Z, MAO H, WU C Y, et al. A convnet for the 2020s[C]//Proc. of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022: 11976-11986.
3	DOSOVITSKIY A. An image is worth 16x16 words: transformers for image recognition at scale[EB/OL]. [2024-06-03]. http://arXiv:2010.11929, 2020.
4	HOWARD A G. Mobilenets: efficient convolutional neural networks for mobile vision applications[EB/OL]. [2024-06-03]. http://arXiv:1704.04861, 2017.
5	HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition[C]//Proc. of the IEEE Conference on Computer Vision and Pattern Recognition, 2016: 770-778.
6	KRIZHEVSKYA,SUTSKEVERI,HINTONG E.ImageNet classification with deep convolutional neural networks[J].Communications of the ACM,2017,60(6):84-90.
7	O'SHEA T J, CORGAN J, CLANCY T C. Convolutional radio modulation recognition networks[C]//Proc. of the on Engineering Applications of Neural Networks, 2016: 213-226.
8	O'SHEAT J,ROYT,CLANCYT C.Over-the-air deep learning based radio signal classification[J].IEEE Journal of Selected Topics in Signal Processing,2018,12(1):168-179.
9	刘伟,李钦,牛朝阳,等.低信噪比下基于分裂EfficientNet网络的雷达信号调制方式识别[J].电子学报,2023,51(3):675-686.
	LIUW,LIQ,NIUC Y,et al.Radar signal modulation method recognition based on split EfficientNet network under low signal-to-noise ratio[J].Chinese Journal of Electronics,2023,51(3):675-686.
10	GOODFELLOW I J, SHLENS J, SZEGEDY C. Explaining and harnessing adversarial examples[EB/OL]. [2024-06-03]. http://arXiv:1412.6572, 2014.
11	QIANY G,ZHANGX M,WANGB,et al.Adversarial training defense based on second-order adversarial examples[J].Journal of Electronics & Information Technology,2021,43(11):3367-3373.
12	赵宏佳, 张多纳, 鲁远耀, 等. 领域知识内嵌的电磁信号调制方式智能识别[EB/OL]. [2024-06-03]. https://doi.org/10.13700/j.bh.1001-5965.2023.0746.
	ZHAO H J, ZHANG D N, LU Y Y, et al. Intelligent recognition of electromagnetic signal modulation mode embedded in domain knowledge[EB/OL]. [2024-06-03]. https://doi.org/10.13700/j.bh.1001-5965.2023.0746.
13	SZEGEDY C, ZAREMBA W, SUTSKEVER I, et al. Intriguing properties of neural networks[C]//Proc. of the 2nd Inter-national Conference on Learning Representations, 2014.
14	YE N, LI Q, ZHOU X Y, et al. Amata: an annealing mechanism for adversarial training acceleration[C]//Proc. of the AAAI Conference on Artificial Intelligence, 2021.
15	LINY,ZHAOH J,MAX F,et al.Adversarial attacks in modulation recognition with convolutional neural networks[J].IEEE Trans.on Reliability,2020,70(1):389-401.
16	ZHAO H J, LIN Y, GAO S, et al. Evaluating and improving adversarial attacks on DNN-based modulation recognition[C]// Proc. of the Globecom IEEE Global Communications Conference, 2021.
17	KURAKIN A, GOODFELLOW I J, BENGIO S. Adversarial examples in the physical world[EB/OL]. [2024-06-03]. https://arxiv.org/abs/1607.02533?context=cs.
18	MOOSAVI-DEZFOOLI S M, FAWZI A, FROSSARD P. Deepfool: a simple and accurate method to fool deep neural networks[C]//Proc. of the IEEE Conference On Computer Vision and Pattern Recognition, 2016: 2574-2582.
19	MA R, ZHU C, LU M, et al. Concealed electronic countermeasures of radar signal with adversarial examples[EB/OL]. [2024-06-03]. http://arXiv:2310.08292, 2023.
20	PAPERNOT N, MCDANIEL P, JHA S, et al. The limitations of deep learning in adversarial settings[C]//Proc. of IEEE European Symposium on Security and Privacy, 2016: 372-387.
21	周侠,张剑,李宁安.基于显著图的电磁信号对抗样本生成方法[J].电子学报,2023,51(7):1917-1928.
	ZHOUX,ZHANGJ,LIN A.Electromagnetic signal adversarial example generation method based on saliency graph[J].Chinese Journal of Electronics,2023,51(7):1917-1928.
22	李哲铭,王晋东,侯建中,等.基于显著区域优化的对抗样本攻击方法[J].计算机工程,2023,49(9):246-255, 264.
	LIZ M,WANGJ D,HOUJ Z,et al.Adversarial sample attack method based on significant region optimization[J].Computer Engineering,2023,49(9):246-255, 264.
23	王满喜,史明佳,陆科宇,等.电磁信号调制识别中的对抗性攻击技术研究[J].无线电通信技术,2022,48(6):1098-1104.
	WANGM X,SHIM J,LUK Y,et al.Research on adversarial attack technology in electromagnetic signal modulation and recognition[J].Radio Communication Technology,2022,48(6):1098-1104.
24	张多纳,赵宏佳,鲁远耀,等.电磁信号调制方式识别: 现状、方法和展望[J].信息与控制,2023,52(1):59-74.
	ZHANGD N,ZHAOH J,LUY Y,et al.Radio signal modulation recognition: research, methods and prospects[J].Information and Control,2023,52(1):59-74.
25	黄知涛,柯达,王翔.电磁信号对抗样本攻击与防御发展研究[J].信息对抗技术,2023,2(4):37-52.
	HUANGZ T,KED,WANGX.Research on the development of electromagnetic signal countermeasure sample attack and defense[J].Information Countermeasure Technology,2023,2(4):37-52.
26	韩超,秦若熙,王林元,等.无线通信中的智能识别神经网络对抗攻击技术综述[J].电讯技术,2023,63(6):918-926.
	HANC,QINR X,WANGL Y,et al.A review of intelligent recognition neural network adversarial attack technology in wireless communication[J].Tele-Communication Technology,2023,63(6):918-926.
27	ZHANGF X,LUOC C,XUJ L,et al.Deep learning based automatic modulation recognition: models, datasets, and challenges[J].Digital Signal Processing,2022,129,103650.
28	KE D, HUANG Z T, WANG X, et al. Application of adver sarial examples in communication modula-tion classification[C]// Proc. of the International Conference on Data Mining Workshops, 2019: 877-882.
29	CARLINI N, WAGNER D. Towards evaluating the robustness of neural networks[C]//Proc. of the IEEE Symposium on Security and Privacy, 2017: 39-57.

网络模型	模型识别正确率
ResNet	95.6
CNN1	91.3
CNN2	93.8

网络模型	攻击类型	攻击方法	ASR/%	ATS/s	扰动比率/%	最大扰动距离	COS	欧氏距离
ResNet	全局	FGSM	89.1	0.01	99.05	0.5	83.0	22.51
		BIM	94.6	0.17	80.22	0.5	97.6	7.51
		C&W	70.9	0.16	99.98	0.5	97.0	10.82
	局部	JSMA	68.1	2551.36	11.35	0.5	99.3	3.57
	局部	NTSA	94.8	39.13	3.47	0.5	99.4	3.54
CNN1	全局	FGSM	90.7	0.006	100	0.5	82.9	22.63
		BIM	92.2	0.05	82.99	0.5	96.3	9.36
		C&W	79.9	0.11	99.99	0.5	96.9	10.83
	局部	JSMA	50.5	1764.37	12.94	0.5	99.4	4.03
	局部	NTSA	92.1	26.93	2.94	0.5	99.4	3.07
CNN2	全局	FGSM	89.9	0.007	97.06	0.5	83.1	22.22
		BIM	89.5	0.08	75.59	0.5	97.1	8.18
		C&W	80.9	0.09	99.95	0.5	96.9	10.89
	局部	JSMA	72.8	2194.69	11.49	0.5	99.7	3.12
	局部	NTSA	91.8	27.56	2.75	0.5	99.6	2.77

网络模型	攻击类型	攻击方法	ASR/%	ATS/s	扰动比率/%	最大扰动距离	COS	欧氏距离
ResNet	全局	FGSM	90.7	0.006	98.93	1.0	60.2	44.99
		BIM	95.5	0.14	81.90	1.0	91.8	14.67
		C&W	85.7	0.14	99.99	1.0	87.3	29.04
	局部	JSMA	71.1	942.33	5.71	1.0	98.8	4.81
	局部	NTSA	96.8	20.56	1.59	1.0	99.1	4.44
CNN1	全局	FGSM	90.9	0.006	99.86	1.0	59.8	45.25
		BIM	92.3	0.05	81.59	1.0	88.8	17.09
		C&W	84.7	0.06	99.99	1.0	87.2	29.07
	局部	JSMA	60.2	843.86	6.03	1.0	99.5	4.51
	局部	NTSA	94.4	8.66	0.93	1.0	99.4	3.34
CNN2	全局	FGSM	90.8	0.006	96.78	1.0	60.5	44.31
		BIM	90.7	0.08	81.01	1.0	89.8	16.28
		C&W	85.4	0.09	99.93	1.0	87.1	29.26
	局部	JSMA	75.6	695.13	4.87	1.0	99.3	4.39
	局部	NTSA	94.6	14.13	1.40	1.0	99.4	3.59

[1]	蔡伟, 狄星雨, 蒋昕昊, 王鑫, 高蔚洁. 基于数据增强的车辆鲁棒对抗纹理生成[J]. 系统工程与电子技术, 2025, 47(6): 1757-1767.
[2]	尹建国, 盛文, 蒋伟. 基于深度残差收缩网络的雷达空中目标识别[J]. 系统工程与电子技术, 2024, 46(9): 3012-3018.
[3]	陈吉源, 徐振海, 肖顺平. 基于子阵级处理的宽带非规则子阵相控阵鲁棒性干扰抑制[J]. 系统工程与电子技术, 2024, 46(2): 367-380.
[4]	钟赟, 万路军, 姚佩阳, 张杰勇. 敏捷C2组织生成及演进的度量与优化[J]. 系统工程与电子技术, 2023, 45(4): 1090-1097.
[5]	张天骐, 叶绍鹏, 刘鉴兴, 柏浩钧. 基于彩色图像Tetrolet变换的频数质心零水印算法[J]. 系统工程与电子技术, 2023, 45(1): 41-48.
[6]	杨芷柔, 张虎, 刘静, 刘同林. 节点攻击策略下的军事通信网络结构优化算法[J]. 系统工程与电子技术, 2021, 43(7): 1848-1855.
[7]	王哲, 李建华, 康东. 网络信息体系双层异质相依网络模型鲁棒性[J]. 系统工程与电子技术, 2021, 43(4): 961-969.
[8]	王超, 郭基联, 沈安慰. 基于不对称依赖的相依网络级联故障分析[J]. 系统工程与电子技术, 2020, 42(5): 1093-1101.
[9]	徐国明, 袁宏武, 薛模根, 王峰. 全偏振参量低秩稀疏分解伪彩色图像融合[J]. 系统工程与电子技术, 2020, 42(11): 2450-2460.
[10]	陈旿, 范铭楷, 李泽宏, 金鑫, 洪亮. 蜂群无人机系统的网络鲁棒性设计[J]. 系统工程与电子技术, 2019, 41(11): 2633-2640.
[11]	王尔申, 王玉伟, 曲萍萍, 蓝晓宇, 陈佳美. 基于代价的复杂网络边攻击策略有效性分析[J]. 系统工程与电子技术, 2018, 40(4): 919-926.
[12]	徐秋坪, 王旭刚, 王中原. 滑翔制导炮弹自抗扰姿态解耦控制器设计[J]. 系统工程与电子技术, 2018, 40(2): 384-392.
[13]	司光亚, 王飞, 李聪, 张昱. 基于交互网测量的武器装备体系鲁棒性分析[J]. 系统工程与电子技术, 2017, 39(7): 1506-1512.
[14]	张岩, 李建增, 李德良, 杜玉龙. 快速自适应鲁棒性尺度不变的特征检测子[J]. 系统工程与电子技术, 2017, 39(6): 1406-1413.
[15]	王竣德, 老松杨, 阮逸润, 侯绿林, 白亮. 基于节点负载容忍度的相依网络鲁棒性研究[J]. 系统工程与电子技术, 2017, 39(11): 2477-2483.