JiT Denoising Defense: A New Breakthrough in Radio Signal Classification Against Adversarial Attacks

Automatic modulation classification (AMC) of radio signals is a core technology for spectrum monitoring and electromagnetic situational awareness. Deep neural networks play a key role in this field thanks to their powerful feature extraction capabilities and end-to-end learning paradigm. However, the vulnerability of DNNs to adversarial attacks poses severe security challenges for real-world deployment.

The Dilemma of Adversarial Defense and the Introduction of JiT

Adversarial training is a common defense method, but it suffers from limitations such as poor generalization across attack types and high training costs. A recent paper proposed a denoising defense method based on JiT (Just image Transformers). JiT is a diffusion generative model that directly predicts clean images, and this research transfers its ideas to the radio signal domain, designing a Transformer denoising network customized for one-dimensional signals.

During the training phase, the method optimizes a signal-specific 1D Transformer denoising network via flow matching, enabling it to directly predict clean signal samples and thereby learn to project any sample back onto the low-dimensional manifold of clean signals. During inference, any sample fed into the trained network is directly projected onto this manifold, achieving denoising defense without requiring prior knowledge of attacks.

Flow Matching is a class of methods for training continuous-time generative models. Its core idea is to directly learn an ordinary differential equation (ODE) velocity field that maps a noise distribution to a data distribution, without relying on simulating a large number of sampling steps as traditional diffusion models do. Specifically, flow matching constructs a probability path from a simple prior (such as Gaussian noise) to the target data, and trains the network by regressing the conditional velocity field along this path. Compared with diffusion models, flow matching has a simpler training objective, a more stable training process, and can use fewer sampling steps during inference. In the radio signal denoising scenario of this paper, flow matching is used to train the 1D Transformer denoising network, enabling it to learn to project noisy or adversarially perturbed signal samples along a "flow" back onto the low-dimensional manifold of clean signals, thereby achieving denoising defense without attack priors.

Experimental Design and Key Data

The research conducted experiments on the RML2018.01A dataset without using any attack information, adopting only a single empirically selected fixed denoising start time. This setup is closer to real-world scenarios—defenders often cannot know the attack type and strength in advance.

Compared with PGD-based adversarial training, this method achieves a relative improvement in robust accuracy of at least 20.58% under PGD attacks, and a relative improvement of 10.20% in classification accuracy on clean samples. This means the defense method does not sacrifice normal classification performance but rather achieves a win-win outcome.

The RML2018.01A dataset is a widely used benchmark dataset in the field of automatic modulation classification of radio signals, released by DeepSig. The dataset contains 24 different analog and digital modulation types (such as BPSK, QPSK, 8PSK, 16QAM, 64QAM, GFSK, CPFSK, PAM4, WBFM, AM-SSB, etc.), covering a variety of modulation schemes from simple to complex. Each sample is represented as a one-dimensional time-series signal composed of I/Q two-channel sampling points, typically with a sampling length of 1024 points, and includes different signal-to-noise ratio conditions (from -20 dB to 30 dB). The dataset is large in scale and rich in modulation types, and is often used to evaluate the generalization capability and robustness of modulation classification models. This paper chooses RML2018.01A as the experimental platform, making the evaluation results comparable and representative in the AMC field.

Generalization Advantage Against Unknown Attacks

More noteworthy is the evaluation against attack types unseen during training. When adversarial training faces unknown attacks, its defense effectiveness often drops significantly, whereas this JiT denoising method exhibits stronger defensive capability. Under higher attack strength, its robust accuracy improves relatively by at least 39.72%. This result indicates that the idea of learning to project samples back onto the clean manifold has better generalization and does not depend on prior knowledge of specific attack patterns.

The transferability of adversarial attacks refers to the phenomenon where adversarial examples generated for one model can, with high probability, mislead another model with a different structure or different training data. This phenomenon stems from the similarity of decision boundaries across different models. In the AMC scenario, attackers may use a substitute model to generate adversarial perturbations and then transfer them to the target classifier to carry out attacks. Although adversarial training can improve the model's robustness to attacks seen during training, it often overfits to the perturbation patterns of specific attacks, leading to a significant decline in defense effectiveness against unseen attacks (including adversarial examples generated by different algorithms). The JiT denoising defense proposed in this paper does not depend on attack types but instead learns to project any input back onto the clean signal manifold, thus exhibiting better generalized defense capability against transferable unknown attacks. This explains its experimental result of a relative improvement in robust accuracy of at least 39.72% under unknown attacks.

Significance and Limitations of the Method

From a methodological perspective, this research introduces the direct prediction idea from diffusion generative models into signal denoising, providing a new perspective for adversarial defense. Its features of requiring no attack priors and performing direct projection during inference lower the barrier to defense deployment. However, the experiments use a fixed denoising start time on only one dataset, so the method's universality still requires more validation. In addition, the computational overhead of the 1D Transformer denoising network and its adaptability to multiple modulation types and complex channel conditions are also issues that need to be examined before practical deployment.

Overall, this work demonstrates the potential of generative models in the field of radio security and provides a promising technical path for improving the robustness of AMC.

One-line Summary

Proposes a JiT-based 1D Transformer denoising defense that improves AMC robustness without attack priors.

Paragraph Summary

Addressing the vulnerability of deep neural networks to adversarial attacks in automatic modulation classification (AMC) of radio signals, this paper introduces a denoising defense method based on JiT (Just image Transformers). The method uses flow matching to train a 1D Transformer denoising network that directly predicts clean signal samples, thereby learning to project any input back onto the low-dimensional manifold of clean signals. Experiments on the RML2018.01A dataset show that, compared with PGD-based adversarial training, this method achieves a relative improvement in robust accuracy of at least 20.58% under PGD attacks and a relative improvement of 10.20% in clean sample accuracy; against unseen attack types, its robust accuracy improves relatively by at least 39.72% under high attack strength. The method requires no attack prior knowledge and performs direct projection during inference, lowering the barrier to defense deployment, but its universality and computational overhead still require further validation.