Dynamic Adversarial Defense for RF Signal Classification
US20260119643A1
Abstract
A method of protecting a neural network from an adversarial attack, comprises generating a first context, generating, by the hypernetwork, a first set of weights based on the first context, and applying the first set of weights to the neural network. The method may further comprise generating a second context subsequent to the first context, generating, by the hypernetwork, a second set of weights based on the second context, and applying the second set of weights to the neural network. The method may further comprise generating additional contexts and corresponding sets of weights, and subsequently applying each of the corresponding sets of weights to the neural network.
Description (excerpt)
RELATED APPLICATIONS This application claims the benefit of U.S. Provisional Application No. 63/713,552, filed on Oct. 29, 2024. The entire teachings of the above application are incorporated herein by reference. GOVERNMENT SUPPORT This invention was made with government support under Grant Numbers CNS-2134973, CNS-2312875, ECCS-2229472, ECCS-2329013 awarded by the National Science Foundation, FA8750-21-9-9000 awarded by Air Force Research Laboratory, N00013-23-1-2221 awarded by Office of Naval Research, and FA9550-23-1-0261 awarded by Air Force Office of Scientific Research. The Government has certain rights in the invention. BACKGROUND Deep Neural Networks (DNNs) have achieved significant success in many tactical Radio Frequency Machine Learning Systems (RFMLS) such as signal classification, spectrum sensing, and radio fingerprinting, among others. However, it was demonstrated that adding malicious perturbations to input data can result in a significant performance loss for DNNs. This aspect has been investigated in the literature as Adversarial Machine Learning (AML), which aims at revealing the vulnerabilities of DNNs as well as improving robustness to adversarial perturbations. While a generalized framework of AML in wireless has been investigated, there does not exist a generalized approach to improve adversarial robustness for wireless tasks. On the other hand, current state-of-the-art defense approaches for computer vision tasks cannot meet the needs of RFMLS. For example, although Adversarial Training (AT) leverages malicious inputs to improve robustness during training, it suffers significant performance loss on benign data. Other approaches such as certified robustness and input purification require additional computation cost that can lead to excessive latency for the tactical wireless domain. SUMMARY The described embodiments are directed to a dynamic DNN framework based on hypernetworks, which may be referred to herein as HyperAdv. The HyperAdv framework generates different parameters for the DNN during inference. The changing DNN parameters enhance adversarial robustness by varying gradient direction at each iteration, hence posing a challenge for attackers to find an effective adversarial gradient update. Moreover, an ensemble learning approach is used to diversify DNN parameters. In one aspect, the invention may be a method of protecting a neural network from an adversarial attack, comprising generating a first context, generating, by the hypernetwork, a first set of weights based on the first context, and applying the first set of weights to the neural network. The method may further comprise generating a second context subsequent to the first context, generating, by the hypernetwork, a second set of weights based on the second context, and applying the second set of weights to the neural network. The method may further comprise generating additional contexts and corresponding sets of weights, and subsequently applying each of the corresponding sets of weights to the neural network. The method may further comprise mapping the first set of weights to a new space, wherein the new space y′ is given by y′=α⊙y+β, where y represents output logits of the neural network, ⊙ represents element-wise multiplication, α and β are vectors with the same dimension as y, and a set of { α i } i = 1 n and { β i } i = 1 n are randomly generated values. The method may further comprise creating an i-th context vector c i ={α i ,β i } of the new space y′ by concatenating α i and β i . The set of { α i }
Filing details
- Inventors
- Francesco RESTUCCIA
- Assignee
- Government of the United States as represented by the Secetary of the Force
- Filed
- Oct 29, 2025
- Granted
- Application pending
Bibliographic data and excerpted text sourced from Google Patents (public record) as part of IP TechMatch's current-filings monitor. This filing is not part of the 2019 historical archive. For the authoritative full text, drawings, and legal status, see the source links above or consult USPTO records directly.