[论文解读] Is Semantic Communications Secure? A Tale of Multi-Domain Adversarial Attacks

Yalin E. Sagduyu, Tugba Erpek+2 more|arXiv (Cornell University)|Dec 20, 2022

Adversarial Robustness in Machine Learning被引用 8

一句话总结

本文提出了一种基于深度学习的语义通信系统，采用带有联合源-信道编码的自编码器以及语义任务分类器，以在传输过程中保持语义完整性。研究发现，多域对抗性攻击——同时针对输入图像（计算机视觉领域）和无线信号（无线领域）——即使使用低功率扰动，也会严重降低语义准确率，暴露出基于深度神经网络的语义通信系统中关键的安全漏洞。

ABSTRACT

Semantic communications seeks to transfer information from a source while conveying a desired meaning to its destination. We model the transmitter-receiver functionalities as an autoencoder followed by a task classifier that evaluates the meaning of the information conveyed to the receiver. The autoencoder consists of an encoder at the transmitter to jointly model source coding, channel coding, and modulation, and a decoder at the receiver to jointly model demodulation, channel decoding and source decoding. By augmenting the reconstruction loss with a semantic loss, the two deep neural networks (DNNs) of this encoder-decoder pair are interactively trained with the DNN of the semantic task classifier. This approach effectively captures the latent feature space and reliably transfers compressed feature vectors with a small number of channel uses while keeping the semantic loss low. We identify the multi-domain security vulnerabilities of using the DNNs for semantic communications. Based on adversarial machine learning, we introduce test-time (targeted and non-targeted) adversarial attacks on the DNNs by manipulating their inputs at different stages of semantic communications. As a computer vision attack, small perturbations are injected to the images at the input of the transmitter's encoder. As a wireless attack, small perturbations signals are transmitted to interfere with the input of the receiver's decoder. By launching these stealth attacks individually or more effectively in a combined form as a multi-domain attack, we show that it is possible to change the semantics of the transferred information even when the reconstruction loss remains low. These multi-domain adversarial attacks pose as a serious threat to the semantics of information transfer (with larger impact than conventional jamming) and raise the need of defense methods for the safe adoption of semantic communications.

研究动机与目标

• 研究基于深度学习的语义通信系统在对抗性攻击下的安全漏洞。
• 识别并分析同时利用输入数据和无线传输阶段的多域对抗性威胁。
• 评估测试时对抗性攻击（有目标与无目标）对语义分类性能的影响。
• 证明低功率、隐蔽的对抗性扰动可在保持低重建误差的同时造成显著的语义损失。
• 强调在新兴的O-RAN和AI驱动通信系统中，亟需防御此类攻击的机制。

提出的方法

• 构建基于深度自编码器的框架，包含一个深度神经网络编码器（联合源/信道编码/调制）和一个解码器（联合解调/信道/源解码）。
• 集成一个独立的基于深度神经网络的语义任务分类器，用于评估语义保持能力，并基于分类器误差定义语义损失。
• 通过结合重建损失（如MSE）和语义损失的复合损失函数，联合训练自编码器与语义分类器。
• 应用测试时的对抗性攻击：(1) 对输入图像施加微小扰动（计算机视觉攻击），(2) 将对抗性信号注入无线信道（无线攻击）。
• 通过在发射端输入和空中信号中同时施加两种扰动类型，实施多域攻击。
• 通过在不同信噪比（SNR）和扰动-噪声比（PNR）下评估分类器准确率的下降情况，衡量攻击成功率。

实验结果

研究问题

• RQ1 在扰动输入图像时，计算机视觉领域的对抗性攻击在语义通信系统中的有效性如何？
• RQ2 在向传输信号中注入扰动时，无线领域的对抗性攻击有效性如何？
• RQ3 同时结合计算机视觉与无线领域对抗性攻击（多域攻击）对语义准确率的影响是什么？
• RQ4 低功率对抗性扰动能否在保持低重建损失的同时显著降低语义性能？
• RQ5 与传统的高斯噪声干扰相比，对抗性攻击在功率效率和攻击效果方面表现如何？

主要发现

• 多域对抗性攻击——同时扰动输入图像和传输信号——实现了最高的攻击成功率，显著降低了语义分类器的准确率。
• 即使扰动功率较低（低PNR），多域攻击也能迅速降低语义性能，优于需要更高功率的传统高斯噪声干扰。
• 无线领域中的无目标对抗性攻击在5 dB SNR下即可显著降低分类器准确率，且PNR极低，表现出高度隐蔽性和效率。
• 计算机视觉与无线领域攻击的结合放大了整体对抗效应，相比单领域攻击，显著降低了成功攻击所需的PNR。
• 尽管重建损失较低（表明信号恢复良好），语义损失却急剧增加，表明即使信号保真度得以保持，语义完整性仍被破坏。
• 结果表明，语义通信系统易受隐蔽、低功率的对抗性操纵影响，此类攻击利用了跨多个通信域的深度神经网络处理机制。