Attention-based Adversarial Robust Distillation in Radio Signal Classifications for Low-Power IoT Devices

TL;DR

This paper introduces a novel compact transformer architecture designed for radio signal classification in low-power IoT devices, enhancing robustness against adversarial attacks by transferring attention maps from larger models.

Contribution

A new compact transformer model that improves adversarial robustness in radio signal classification by transferring attention maps from robust large transformers.

Findings

Outperforms state-of-the-art adversarial defense techniques.

Demonstrates effective transferability of adversarial attention maps.

Enhances robustness against white-box adversarial attacks.

Abstract

Due to great success of transformers in many applications such as natural language processing and computer vision, transformers have been successfully applied in automatic modulation classification. We have shown that transformer-based radio signal classification is vulnerable to imperceptible and carefully crafted attacks called adversarial examples. Therefore, we propose a defense system against adversarial examples in transformer-based modulation classifications. Considering the need for computationally efficient architecture particularly for Internet of Things (IoT)-based applications or operation of devices in environment where power supply is limited, we propose a compact transformer for modulation classification. The advantages of robust training such as adversarial training in transformers may not be attainable in compact transformers. By demonstrating this, we propose a novel compact transformer that can enhance robustness in the presence of adversarial attacks. The new method is aimed at transferring the adversarial attention map from the robustly trained large transformer to a compact transformer. The proposed method outperforms the state-of-the-art techniques for the considered white-box scenarios including fast gradient method and projected gradient descent attacks. We have provided reasoning of the underlying working mechanisms and investigated the transferability of the adversarial examples between different architectures. The proposed method has the potential to protect the transformer from the transferability of adversarial examples.