Vision Transformer with Adversarial Indicator Token against Adversarial Attacks in Radio Signal Classifications

TL;DR

This paper introduces a novel vision transformer architecture with an adversarial indicator token designed to detect and defend against adversarial attacks in radio signal classification, enhancing robustness in IoT communication systems.

Contribution

It proposes the first use of an adversarial indicator token in ViT for adversarial defense, integrating detection and training defenses into a unified model.

Findings

Outperforms several methods under white-box attack scenarios

The AdvI token influences attention weights to detect suspicious features

The integrated approach reduces system complexity compared to separate detection models

Abstract

The remarkable success of transformers across various fields such as natural language processing and computer vision has paved the way for their applications in automatic modulation classification, a critical component in the communication systems of Internet of Things (IoT) devices. However, it has been observed that transformer-based classification of radio signals is susceptible to subtle yet sophisticated adversarial attacks. To address this issue, we have developed a defensive strategy for transformer-based modulation classification systems to counter such adversarial attacks. In this paper, we propose a novel vision transformer (ViT) architecture by introducing a new concept known as adversarial indicator (AdvI) token to detect adversarial attacks. To the best of our knowledge, this is the first work to propose an AdvI token in ViT to defend against adversarial attacks. Integrating an adversarial training method with a detection mechanism using AdvI token, we combine a training time defense and running time defense in a unified neural network model, which reduces architectural complexity of the system compared to detecting adversarial perturbations using separate models. We investigate into the operational principles of our method by examining the attention mechanism. We show the proposed AdvI token acts as a crucial element within the ViT, influencing attention weights and thereby highlighting regions or features in the input data that are potentially suspicious or anomalous. Through experimental results, we demonstrate that our approach surpasses several competitive methods in handling white-box attack scenarios, including those utilizing the fast gradient method, projected gradient descent attacks and basic iterative method.