cs.LGOct 26, 2026

A JiT-Based Denoising Defense Method Against Adversarial Examples for Radio Signal Automatic Modulation Classification

Authors: Shiwei Liu, Linyuan Wang, Nuolin Sun, Libin Hou, Bin Yan

Organizations: Henan Key Laboratory of Imaging and Intelligent Processing, Information Engineering University, Zhengzhou 450000, China

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Automatic modulation classification (AMC) of radio signals is a core technology for spectrum monitoring and electromagnetic situational awareness. Deep neural networks (DNNs) play an important role in this field owing to their powerful feature extraction capabilities and end-to-end learning paradigm. However, their vulnerability to adversarial attacks poses serious security challenges to practical deployment. Adversarial training, a common defense, has limitations including poor generalization across attack types and high training costs. Inspired by Just image Transformers (JiT), a diffusion generative model that directly predicts clean images, this paper proposes a JiT-based denoising defense against adversarial examples for radio signal modulation classification. During training, a signal-specific 1D Transformer denoising network is optimized via flow matching to directly predict clean signal samples. It thereby learns a mapping that projects arbitrary examples back onto the low-dimensional manifold of clean signal examples. During inference, arbitrary examples are fed into the trained network and directly projected onto this manifold. This enables denoising defense without prior knowledge of attacks. Experiments on the RML2018.01A dataset were conducted without attack information, using a single empirically selected, fixed denoising start time. Compared with PGD-based adversarial training, the proposed method achieves a relative improvement of at least 20.58% in robust accuracy under PGD attacks. It also achieves a relative improvement of 10.20% in classification accuracy on clean examples. When evaluated against attack types unseen during adversarial training, the proposed method provides stronger defense than adversarial training. In particular, at higher attack strengths, it achieves a relative improvement of at least 39.72% in robust accuracy.

Figures & tables

Figure 1: Schematic illustration of the JiT denoising defense method.
Figure 2: Structure of the signal denoising network.
Figure 3: Architecture of the ResNet-1D classifier.
AttackStrength0.7000.7250.7500.7750.8000.8250.8500.8750.900
Clean–37.6940.3943.6248.7653.5061.9370.0076.5380.39
PGDε\varepsilon =0.10038.9740.7742.9343.5044.9744.3042.3040.8037.89
 ε\varepsilon =0.12538.1040.3742.5043.1043.9743.0740.8040.1037.20
 ε\varepsilon =0.15037.4740.1741.5742.0341.3341.1039.8339.4037.07
 ε\varepsilon =0.17537.4039.9040.1340.9339.7738.9338.8738.6035.87
 ε\varepsilon =0.20036.7038.3639.8039.5038.6337.6337.1036.1334.07
Table 3: Adversarial robust accuracy (%) of denoising defense at different denoising start times.
Figure 4: Comparison of defense accuracy (%) between JiT denoising ( tstart=0.850t_{\rm start}=0.850 ) and adversarial training under PGD attacks.
Figure 5: Comparison of defense accuracy (%) between JiT denoising ( tstart=0.850t_{\rm start}=0.850 ) and adversarial training under other attacks.
Training methodTotal training epochsGPU ⋅\cdot h
JiT denoising network training2001.21
Adversarial training20014.68
Table 4: Comparison of training costs for JiT denoising network training and adversarial training.
More in this topic

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 481 papers

Explore similar work

CardsList
Apr 11, 2026

Cross-Validated Cross-Channel Self-Attention and Denoising for Automatic Modulation Classification

This study addresses a key limitation in deep learning Automatic Modulation Classification (AMC) models, which perform well at high signal-to-noise ratios (SNRs) but degrade under noisy conditions due to conventional feature extraction suppressing both discriminative structure and interference. The goal was to develop a feature-preserving denoising method that mitigates the loss of modulation class separation. A deep learning AMC model was proposed, incorporating a cross-channel self-attention block to capture dependencies between in-phase and quadrature components, along with dual-path deep residual shrinkage denoising blocks to suppress noise. Experiments using the RML2018.01a dataset employed stratified sampling across 24 modulation types and 26 SNR levels. Results showed that denoising depth strongly influences robustness at low and moderate SNRs. Compared to benchmark models PET-CGDNN, MCLDNN, and DAE, the proposed model achieved notable accuracy improvements across -8 dB to +2 dB SNR, with increases of 3%, 2.3%, and 14%, respectively. Cross-validation confirmed the model's robustness, yielding a mean accuracy of 62.6%, macro precision of 65.8%, macro-recall of 62.6%, and macro-F1 score of 62.9%. The architecture advances interference-aware AMC by formalizing baseband modeling as orthogonal subproblems and introducing cross-channel attention as a generalized complex interaction operator, with ablations confirming the critical role of feature-preserving denoising for robustness at low-to-medium SNR.

Prakash Suman, Yanzhen Qu

Computer Science, Engineering, and Technology, Colorado Technical University, 1575 Garden of the Gods Road, Colorado Springs, 80907, CO, USA.

Automatic Modulation Classification
AskPDF
Jun 16, 2026

TaFD: Threat-Aware Frequency Decoupling for Adversarial Robustness against Heterogeneous Attacks

Multi-threat robustness remains a fundamental challenge in deep learning. Although joint adversarial training (JAT) is widely adopted, it suffers from negative transfer under heterogeneous threats, particularly between ℓp\ell_p-bounded and semantic attacks. Through first-order gradient analysis, we formalize this as gradient incompatibility and theoretically establish the necessity of decoupled optimization. We further reveal that these conflicting threats exhibit separable spectral characteristics in the frequency domain. Motivated by this observation, we propose Threat-aware Frequency Decoupling (TaFD), a two-stage defense framework that reformulates JAT as a frequency-domain divide-and-conquer paradigm. TaFD first discovers latent threat domains via unsupervised clustering of attack spectral prototypes and trains a lightweight classifier for inference-time threat domain identification. Conditioned on the prediction, TaFD employs a Frequency-Conditional Convolution that learns threat-domain-specific spectral masks and routes each sample to the corresponding expert, enforcing structural parameter separation and alleviating optimization conflicts. We validate TaFD on three representative image-classification benchmarks (CIFAR-10, CIFAR-100, and Tiny-ImageNet) and on two representative architectures (the convolutional ResNet and the hybrid-transformer MobileViT). Extensive results demonstrate that TaFD achieves more balanced robustness against heterogeneous attacks than existing JAT and frequency-domain baselines, improving average robust accuracy by approximately 11% over the strongest baseline while maintaining leading clean accuracy.

Mengda Xie, Yiling He, Meie Fang

School of Computer Science and Cyber Engineering, Guangzhou University, Guangzhou, Guangdong, China · Information Security Research Group, University College London, London, United Kingdom

Adversarial TrainingFrequency-Domain Feature LearningNeural Network RobustnessAdversarial Robustness
AskPDF
May 12, 2026

Modulation Consistency-based Contrastive Learning for Self-Supervised Automatic Modulation Classification

Deep learning-based AMC methods have achieved remarkable performance, but their practical deployment remains constrained by the high cost of labeled data. Although self-supervised learning (SSL) reduces the reliance on labels, existing SSL-based AMC methods often rely on task-agnostic pretext objectives misaligned with modulation classification, leading to representations entangled with nuisance factors such as symbol, channel, and noise. In this paper, we identify intra-instance modulation consistency as a task-aware structural prior, whereby different temporal segments of the same signal may differ in waveform while preserving the same modulation type, thus providing a principled cue for task-aligned self-supervision. Based on this prior, we propose Mod-CL, a Modulation consistency-based Contrastive Learning framework that constructs positive pairs from different temporal segments of the same signal instance, to encourage the model to learn shared modulation information while suppressing nuisance variations. We further develop a contrastive objective tailored to Mod-CL, which jointly exploits temporal segmentation and data augmentation to pull together views sharing the same modulation semantics while avoiding supervisory conflicts within each signal instance. Extensive experiments on RadioML datasets show that Mod-CL consistently outperforms strong baselines, especially in low-label regimes, achieving substantial improvements in linear probing accuracy.

Chenxu Wang, Shuang Wang, Lirong Han +4

School of Artificial Intelligence, Xidian University, Xi’an 710071, China · Unmanned System Research Institute, Northwestern Polytechnical University, Xi’an 710072, China · School of Electronics And Information, Northwestern Polytechnical University, Xi’an 710072, China

Contrastive LearningSelf-Supervised LearningAutomatic Modulation Classification
AskPDF