RF Domain Backdoor Attack on Signal Classification via Stealthy Trigger

Tldr

This paper presents the first stealthy Backdoor Attack specifically designed for Deep Learning-based Radio Frequency (RF) Signal Classification. By exploiting the unique Spatial-Temporal characteristics of In-phase and Quadrature (IQ) data, the authors design an Optimization-based Trigger Generation approach that is statistically indistinguishable from natural noise. Extensive testing on Modulation Classification and Device Identification datasets shows a 99.2%+ Attack Success Rate (ASR) with minimal impact on clean data accuracy, effectively bypassing state-of-the-art defenses like Neural Cleanse and STRIP.

The research paper, titled "RF Domain Backdoor Attack on Signal Classification via Stealthy Trigger" (published in IEEE Transactions on Mobile Computing, 2024), explores a critical security vulnerability in Software-Defined Radio (SDR) systems that utilize Deep Learning (DL) for signal analysis. As SDR platforms increasingly rely on DL for tasks like Radio Frequency (RF) Modulation Classification and Device Identification, they become susceptible to Backdoor Attacks. These attacks are particularly relevant in the context of Machine Learning as a Service (MLaaS), where developers outsource heavy computational training to third-party providers. This outsourcing creates an Attack Surface where malicious insiders can inject stealthy Triggers—specifically designed perturbations—into the In-phase and Quadrature (IQ) data during the training phase. When these triggers are present during inference, the Deep Neural Network (DNN) is manipulated into making incorrect, adversary-specified predictions, potentially sabotaging 5G authentication or disrupting Open RAN Network Slicing.

The authors identify significant challenges in designing these attacks compared to traditional Computer Vision or Audio domains. RF signals possess unique Spatial-Temporal characteristics; different Modulation Schemes result in heterogeneous layouts in the IQ Plane, and IQ Segment Dynamics mean that signal patterns vary over time even within the same application. Previous attempts at RF backdoors were often heuristic—such as simple Phase Rotation—making them easily detectable by Outlier Detection mechanisms. To overcome this, the paper proposes a sophisticated Optimization framework that jointly trains the Backdoored Model and a stealthy trigger. This approach ensures the trigger is mathematically minimized to appear as natural Noise or legitimate signal variance, thereby evading state-of-the-art defenses like Neural Cleanse and STRIP.

A primary contribution of this work is the introduction of the first Clean-label Backdoor Attack in the RF domain. Unlike Poison-label attacks, which modify both the training data and its associated labels, clean-label attacks keep the labels unchanged. This makes the malicious data nearly impossible to detect during human or automated data auditing because the label remains consistent with the "clean" appearance of the signal. The paper develops two distinct optimization procedures to handle these scenarios, utilizing Adversarial Perturbations and Latent Space analysis to ensure the model learns a strong association between the stealthy trigger and the target class, even without label manipulation.

Empirical evaluations conducted by researchers from Temple University, Rutgers University, University of Dayton, and NJIT demonstrate the potency of this attack. The proposed methods achieved an Attack Success Rate (ASR) exceeding 99.2% across various RF applications while maintaining the model's accuracy on clean data within 0.6% of the original performance. This high level of efficacy, combined with the trigger's imperceptibility, underscores a major security threat to modern Wireless Communication infrastructure. The study serves as a foundational warning for the SDR community, highlighting the need for more robust Verification and Data Provenance protocols when deploying Artificial Intelligence in sensitive RF environments.

Threat Model & Scenarios

The threat model for Radio Frequency (RF) signal classification systems highlights critical vulnerabilities inherent in the outsourcing of Deep Learning (DL) model training to Machine Learning as a Service (MLaaS) providers. Adversaries, characterized as compromised internal employees with access to training datasets and model architectures, exploit the resource constraints of developers to embed malicious backdoors. In a Poison-label Backdoor Attack, the adversary injects a covert trigger into the RF IQ data and modifies the corresponding labels to a target class. To bypass validation, the trigger is optimized to remain unnoticeable, ensuring the backdoored model behaves identically to a clean model during private testing with validation data. This security flaw can be activated in wireless networks by compromising an RF transmitter to inject the trigger, leading to widespread network failure.

Conversely, the Clean-label Backdoor Attack offers a more clandestine attack vector where the adversary manipulates the RF IQ samples and training parameters—such as batch size, epochs, and loss functions—while leaving the labels unchanged. This tactical preservation of label consistency ensures that data filtering and human oversight fail to detect the poisoning. The primary attack objective centers on inducing misclassification for specific outcomes, such as disrupting modulation classification to lower throughput or subverting RF fingerprint device identification to gain unauthorized access. By luring users into installing malware on Software-Defined Radio (SDR) platforms, adversaries can manipulate the receiver to inject the trigger, effectively compromising the integrity and availability of the telecommunications infrastructure.

Proposed RF Backdoor Attack Design

The proposed RF Backdoor Attack targets the vulnerabilities of Deep Learning models within Radio Frequency systems, specifically those performing Signal Classification. These models employ a Non-linear Mapping Function $F_{ω}$ to transform IQ Segments, represented as a Two-dimensional Matrix $R^{2 \times S}$ , into predicted Modulation Types or Transmitter Identities. The Attacker Capability is rooted in an Insider Threat model, where adversaries have access to Machine Learning as a Service (MLaaS) environments and training configurations. The attack involves injecting a stealthy RF Backdoor Trigger $δ$ of length $ℓ$ into the In-phase and Quadrature components of the training data. This process, denoted as $Γ_{ϕ} (\cdot, \cdot)$ , is defined by the Vector of Positions $ϕ$ , aiming to minimize a Backdoor Loss function that combines Clean Loss and Poison Loss to ensure both Utility and a high Attack Success Rate.

The research distinguishes between two primary learning paradigms: Poison-label Backdoor Learning and Clean-label Backdoor Learning. In the poison-label scenario, the adversary injects the trigger and explicitly reassigns the Target Label $y_{t a r}$ , forcing the Backdoor Model to associate the malicious pattern with the desired output. However, Clean-label Attacks are more covert as they do not modify labels. Instead, the attacker optimizes the Model Weights $ω^{*}$ to maximize the Poison Loss relative to the original Class Label $y_{k}$ . By doing so, the mathematical objective functions work to "decouple" the poisoned data from its legitimate label in the Feature Space, effectively creating a void that the Backdoor Trigger fills to establish a new, hidden Mapping Relationship between the trigger and the target class.

Realizing Stealthy RF Backdoor Attacks is complicated by the unique Physical Layer characteristics of Wireless Communication. Unlike Computer Vision triggers that might occupy a fixed pixel block, RF Triggers must contend with Heterogeneous Application-specific RF Signals. For instance, a 32-PSK modulation scheme generates signals from a predefined constellation of IQ Values across four Quadratures. If a trigger deviates from this expected Spatial Distribution, standard Receiver Filtering techniques may simply discard the poisoned segment as noise. Furthermore, the attack must adapt to In-application Temporal IQ Variations. As shown in the comparison of different RF Segments, the distribution of samples for the same modulation can vary significantly over time, requiring the trigger to be Time-variant and context-aware to maintain its Stealthiness.

A critical challenge identified is the Inherent Interference from the original IQ Data features. In modulation schemes like BPSK, the signal manifests as two distinct clusters on the coordinate plane, which are easily identified by Convolutional Neural Networks. These robust Semantic Features interfere with the model’s ability to learn the subtle Trigger Pattern, especially when labels remain unchanged in Clean-label Settings. Consequently, the proposed Attack Design must prioritize Cross-application Generalization, developing a General Stealthy Trigger Pattern that remains effective across diverse RF Signal Classification Applications. This involves overcoming the "semantic noise" of the host signal to ensure that the Deep Learning Model prioritizes the malicious Backdoor Feature during the Inference Phase when the trigger is present.

Application-Oriented Stealthy Trigger Generation

The generation of stealthy triggers for RF backdoor attacks represents a sophisticated convergence of stochastic modeling and adversarial optimization, specifically designed to bypass security detectors such as outlier filters and time-filtering techniques. The framework introduced by Tang et al. prioritizes two dimensions of design: spatial patterns and temporal patterns. In the spatial domain, the trigger is initialized using Gaussian Noise to ensure its statistical distribution mirrors that of the clean data. This is achieved by modeling the In-phase (I) and Quadrature (Q) components as independent multivariate Gaussian distributions with a zero mean and a variance calculated as the average of variances across all sampling segments. This alignment with the original input segments ensures that the perturbation vector $δ$ remains statistically indistinguishable from the underlying RF IQ data, making it significantly more challenging for anomaly detection systems to isolate poisoned samples based on simple distributional shifts.

The temporal design further refines this stealthiness by exploring three distinct injection patterns. Temporal Design 1 (TD1) utilizes a continuous trigger pattern affecting the initial samples of an IQ segment, which is inherently vulnerable to detection due to consecutive out-of-range values. Temporal Design 2 (TD2) improves upon this by employing a repetitive trigger pattern with fixed intervals between polluted samples. However, the most robust approach is Temporal Design 3 (TD3), which utilizes random-located samples to diminish the temporal relationship between poisoned points, thereby evading time-domain analysis. These designs allow an attacker to maintain full control over the IQ samples in real-time attacks, ensuring that the backdoor remains latent until the specific temporal-spatial trigger is detected by the deep learning model.

To enhance both attack performance and stealthiness, the authors propose a joint application-oriented optimization approach. This process involves a transformation function $Γ_{ϕ} (x_{k}, δ)$ that simultaneously optimizes the backdoor model weights $ω^{*}$ and the perturbation vector $δ$ . The training process is governed by a complex loss function that balances poison loss and clean loss using a hyper-parameter $α$ . This parameter is critical for constraining the gradient update speed of the perturbation; if the update is too rapid, it may disrupt the weight training, while an overly slow update can lead to gradient vanishing. By minimizing the poison loss specifically for a target label $y_{t a r}$ , the model learns to associate the subtle trigger with the malicious classification while maintaining high accuracy on benign signals.

A pivotal innovation in this framework is the integration of MSE loss ( $L_{M}$ ) to further constrain the perturbation magnitude. Because optimized triggers can occasionally drift outside the distribution range of clean data, the MSE loss measures the mean square error between the clean segment and the poisoned segment. Before this calculation, the data undergoes Z-score standardization, which normalizes the IQ value ranges across various RF signal classification applications. A second hyper-parameter, $β$ , is introduced to balance the trade-off between attack success rate and trigger invisibility. This ensures that the finalized stealthy trigger is both effective at inducing misclassification and robust against forensic analysis that might look for high-magnitude perturbations.

In the more challenging clean-label backdoor scenario—where labels remain unchanged—the authors introduce backdoor trigger enhancement using adversarial perturbation $η$ . In these settings, the inherent interference of the benign RF IQ signals often masks the small perturbation of the trigger, preventing the model from establishing a strong mapping function. To overcome this, the framework trains an adversarial perturbation $η$ by minimizing an adversarial loss $L_{A}$ to obscure the original features associated with the true labels. This process utilizes an l-infinity norm constraint to keep the perturbation within a defined range $τ$ . By effectively "shrouding" the benign features, the backdoor model is forced to focus on the salient features of the trigger during training. This joint optimization of the adversarial noise, the trigger vector, and the model weights ensures that the clean-label attack achieves high performance even in the presence of background noise and interference. Using these standardized optimization algorithms, the researchers demonstrate that RF classification systems are highly susceptible to backdoor triggers that mimic natural signal noise.

Experimental Evaluation

The evaluation framework of this research paper focuses on two primary Deep Learning architectures commonly employed in Software-defined radio (SDR) environments: a Residual Neural Network (ResNet)-based model for RF Modulation Classification and a Convolutional Neural Network (CNN) for RF Fingerprint-based Device Identification. To rigorously test these models, the researchers utilized two prominent RF Datasets. The first, curated by O’Shea, contains WiFi samples across 24 modulation schemes collected using a USRP B210 on the 900 MHz ISM band, totaling 98,304 segments under high-SNR conditions. The second dataset, sourced from Sankhe, targets device identification across 16 USRP X310 radios, providing over 2.5 million segments. In both cases, the data—consisting of In-phase and quadrature (IQ) components—was partitioned into 80% for training and 20% for testing to ensure a robust experimental methodology.

The efficacy and stealthiness of the proposed backdoor attack are quantified through three core metrics: Attack Success Rate (ASR), Clean Data Classification Accuracy (CA), and Normalized Mean Squared Error (NMSE). In Poison-Label Attack scenarios, the optimized trigger achieved a near-perfect ASR of 100% for modulation classification and over 99.28% for device identification. The stability of these results is underscored by a remarkably low standard deviation (≤ 0.16%). Furthermore, the NMSE values—recorded as low as 1.2 × 10^-2 and 2.4 × 10^-3—demonstrate that the poisoned segments remain well within the distribution of clean data, making the malicious perturbation effectively imperceivable to standard detection algorithms.

In the more challenging Clean-Label Attack settings, the attack maintained an ASR exceeding 99.54% while preserving high CA. Interestingly, the researchers observed that clean data accuracy sometimes improved during an attack, likely because the trigger acts as a form of Gaussian noise, providing unintended data augmentation that enhances model robustness. Investigations into impact factors revealed that the attack is exceptionally efficient; a poison ratio of a mere 1.4% in the training set is sufficient to guarantee success. Additionally, the ratio of polluted samples within a single IQ segment only needs to reach 6% (e.g., 60 samples out of 1024) to reliably activate the backdoor, highlighting the minimal footprint required for a successful exploit.

A detailed ablation study clarifies the technical necessity of the optimization components. The integration of MSE Loss into the loss function proved vital for stealthiness, as it constrains the trigger amplitude; without it, the NMSE spiked to levels that would render the trigger an outlier. Moreover, the application of Adversarial Perturbation in clean-label scenarios was found to be essential for bridging the gap to near 100% ASR. These experiments, conducted on NVIDIA Tesla V100 and RTX A6000 GPUs using the TensorFlow 2 platform, confirm that the proposed RF backdoor is both potent and highly adaptable to diverse wireless technologies and learning architectures.

Resistance to Backdoor Defense Methods & Conclusion

The proposed Radio Frequency (RF) Backdoor Attack demonstrates significant resilience against state-of-the-art Defense Mechanisms, specifically Neural Cleanse and STRIP. Neural Cleanse functions as an Optimization-based detection technique that reverse-engineers models to identify Backdoor signatures by searching for minimal Perturbations that force Misclassification. The effectiveness of this defense is measured by an Anomaly Index; a value exceeding 2 typically indicates a compromised Neural Network. However, the study reveals that the author's Poison-Label Attack and Clean-Label Attack scenarios consistently produce Anomaly Index values below this threshold across multiple Temporal Trigger patterns. This suggests that the generated RF Triggers are sufficiently subtle to evade the Reverse Engineering process, maintaining the model's perceived integrity while harboring hidden Malicious Logic.

Furthermore, the attack proves robust against STRIP (Strong Intentional Perturbation), an Entropy-based detection method. STRIP identifies Backdoors by injecting intentional Noise into Input Samples and observing the resulting Probability Distribution of the Model predictions. A Backdoored Model typically exhibits low Entropy because the Trigger forces a consistent, incorrect output regardless of the added Perturbation. In contrast, the RF Backdoor models maintained an Entropy distribution closely mirroring that of a Clean Model (within the 0 to 0.4 range) rather than clustering in the low-entropy zone. This indicates that the Trigger Design successfully bypasses Statistical defenses that rely on Input-based Perturbation analysis.

In Conclusion, this research introduces the first stealthy RF Backdoor Attack tailored for Deep Learning-based Signal Classification. By analyzing In-Phase and Quadrature (IQ) data variances, the authors developed a Training-based Trigger Generation approach that avoids the pitfalls of fixed-position Triggers. Extensive evaluations on RF Modulation Classification and Device Identification confirm that these attacks are highly effective and stealthy. The findings underscore a critical Security vulnerability in the Supply Chain of Wireless Signal Processing Systems, emphasizing the need for more advanced Countermeasures beyond traditional Computer Vision-inspired defenses.

People Mentioned