Deep Learning (DL) has become a key technology that assists radio frequency (RF) signal classification applications, such as modulation classification. However, the DL models are vulnerable to adversarial machine learning threats, such as data manipulation attacks. We study a physical backdoor (Trojan) attack that targets a DL-based modulation classifier. In contrast to digital backdoor attacks, where digital triggers are injected into the training dataset, we use power amplifier (PA) non-linear distortions to create physical triggers before the dataset is formed. During training, the adversary manipulates amplitudes of RF signals and changes their labels to a target modulation scheme, training a backdoored model. At inference, the adversary aims to keep the backdoor attack inactive such that the backdoored model maintains high accuracy on test signals. However, if they apply the same manipulation used during training on these test signals, the backdoor is activated, and the model misclassifies these signals. We demonstrate that our proposed attack achieves high attack success rates with few manipulated RD signals for different noise levels. Furthermore, we test the resilience of the proposed attack to multiple defense techniques, and the results show that these techniques fail to mitigate the attack.

翻译：深度学习已成为辅助射频信号分类应用（如调制分类）的关键技术。然而，深度学习模型容易受到对抗性机器学习威胁（如数据操纵攻击）的影响。我们研究了一种针对基于深度学习的调制分类器的物理后门（木马）攻击。与在训练数据集中注入数字触发器的数字后门攻击不同，我们在数据集形成之前利用功率放大器非线性失真创建物理触发器。在训练过程中，对手操纵射频信号的幅度，并将其标签改为目标调制方案，从而训练出一个带后门的模型。在推理阶段，对手旨在保持后门攻击不激活，使带后门模型对测试信号保持高准确率。然而，如果对手对测试信号应用训练时使用的相同操纵，后门将被激活，模型会错误分类这些信号。我们证明，所提出的攻击仅需少量被操纵的射频信号，即可在不同噪声水平下实现高攻击成功率。此外，我们测试了该攻击对多种防御技术的鲁棒性，结果显示这些防御技术均无法有效缓解该攻击。