A method for generating adversarial examples for wireless communication signals based on a diffusion model

Abstract

This invention discloses a method for generating adversarial examples for wireless communication signals based on a diffusion model, belonging to the field of adversarial examples for wireless communication signals. Specifically, the method involves: first, stratified sampling of the existing dataset to train an AMR model, calculating the confidence level of each sample under each modulation type, and selecting the type corresponding to the maximum confidence level as the prediction result for each sample; then, obtaining samples at the classification boundary; selecting key samples based on the obtained classification boundary sample results, and gradually adding Gaussian noise to the new training set by modifying the labels of the key samples until the sample distribution completely satisfies a Gaussian distribution; using sample feature attributes as gradient guidance, training a U-Net network to predict the noise added at each step, gradually removing the Gaussian noise from the samples until the original signal is recovered, thus obtaining the adversarial example generation model for wireless communication signals. The adversarial examples of this invention exhibit strong aggression against the model, causing a decrease in the model's classification accuracy.

Description

Technical Field

[0001] This invention belongs to the field of adversarial examples for wireless communication signals, and particularly relates to a method for generating adversarial examples for wireless communication signals based on a diffusion model. Background Technology

[0002] Automatic Modulation Recognition (AMR) technology can collect and extract signal features, such as signal spectrum, instantaneous amplitude, and instantaneous phase, providing support for efficient signal processing. It plays an important role in applications such as network security, spectrum management, radio monitoring, and intelligence gathering, enhancing system security, optimizing spectrum resource utilization efficiency, improving monitoring accuracy, and providing decision-makers with better decision-making basis.

[0003] With the rapid development of communication technology and technologies such as artificial intelligence and software radio, wireless communication signals are becoming increasingly diverse and numerous, and the complexity of the radio electromagnetic environment is increasing. Traditional likelihood-based and statistical-based sensing and recognition methods are not performing well, posing a significant challenge to AMR technology. Against this backdrop, deep learning-based AMR technology has become one of the mainstream directions for development in the field of wireless communication.

[0004] Compared to traditional methods, deep learning-based AMR technology can significantly improve modulation recognition accuracy by utilizing large amounts of communication data. Simultaneously, automated feature extraction avoids the limitations of specialized knowledge and human experience, and it can continuously benefit from the rapid iteration and evolution of deep learning tools, possessing the potential to solve complex modulation recognition problems. However, with the deepening research into deep learning technology, researchers have discovered serious security vulnerabilities in existing deep learning algorithms: attackers can easily deceive deep learning models by adding specific noise to benign samples, causing normally trained models to output highly confident false predictions without being detected. Researchers call this phenomenon an adversarial attack.

[0005] Adversarial attacks have been widely researched and applied in fields such as computer vision and natural language processing. A typical example is when a carefully designed perturbation is added to an image of a panda, causing a deep learning classifier to misclassify it as an image of a gibbon. In the field of AMR (Adversarial Modulation), research has shown that to construct adversarial examples in the signal domain, it is only necessary to add a carefully designed weak perturbation to a clean signal sample. For example, adding a small adversarial perturbation to signals modulated by binary phase shift keying (BPSK) or quadrature phase shift keying (QPSK) creates an adversarial example. Inputting this adversarial example into a classifier may cause the pre-trained classifier to misclassify the signal as a signal modulated by quadrature amplitude modulation (64QAM) or other modulation methods. In communication tasks, errors in modulation recognition can seriously threaten applications such as intelligent wireless communication systems, cognitive radio networks, electromagnetic reconnaissance, and satellite navigation.

[0006] Adversarial example generation methods were introduced into the field of electromagnetic signals in 2019. Currently, traditional methods for generating adversarial examples for AMR models generally fall into two categories: gradient-based methods and optimization-based methods. Gradient-based methods utilize the backpropagation of neural networks to generate adversarial examples by minimizing the difference between the input and target samples, adding perturbations in the direction of gradient increase to cause the model to misjudge. However, they lack specificity when adding adversarial perturbations. Optimization-based methods, on the other hand, seek input samples that maximize or minimize the objective function, using various transformation methods to make the optimization problem easier to solve, thus achieving the goal of generating adversarial examples. However, the generation process is time-consuming and prone to getting trapped in local optima. Furthermore, while the purpose of adversarial attacks is to cause the model to make incorrect decisions, targeted attack methods that make the model identify samples as a specific category are rarely addressed. Therefore, research on adversarial example generation for electromagnetic signals has practical significance.

[0007] Generative AI technology has garnered widespread attention in both industry and academia, with diffusion models being a representative model in the field of image generation. Diffusion models are probabilistic generative models that can generate new data samples by learning the latent distribution of data from given training samples. They have surpassed the original state-of-the-art (SOTA) model, GAN, in image generation tasks and have demonstrated excellent performance in numerous application areas. Inspired by image generation tasks, this study introduces the diffusion model generation process into the electromagnetic domain to conduct research on adversarial example generation for wireless communication signals. Summary of the Invention

[0008] To address the aforementioned problems, this invention provides a method for generating adversarial examples for wireless communication signals based on a diffusion model. By diffusing key samples from the model training dataset, adversarial examples that can significantly reduce the model's recognition accuracy are generated. Compared to traditional adversarial example generation methods, this invention can greatly improve the diversity of generated samples and can generate samples into specified categories for targeted attacks.

[0009] The method for generating adversarial examples for wireless communication signals based on a diffusion model includes the following steps:

[0010] S1: Select a publicly available wireless communication signal dataset D, and divide it into several layers according to feature attribute categories. Randomly sample signal samples from each layer; divide the dataset D into training sets D using stratified sampling. train and verification set D valid .

[0011] The elements in the initial dataset D are represented as: x i (k), k = 1, 2, ..., K, where K is the number of sampling points for a single signal, and i = 1, 2, ..., N, where N represents the number of signal samples.

[0012] For R modulation types, each signal sample corresponds to one modulation type, and the modulation type label of the i-th signal sample is... Let r ∈ {1, 2, ..., R};

[0013] S2: Input the training set into the AMR model with the network parameters set for training, and validate each sample in the validation set. Calculate the confidence score of each sample under each modulation type, select the type corresponding to the maximum confidence score as the prediction result for each sample, and record the recognition accuracy P of the AMR model at this time. Accuracy ;

[0014] The confidence level of the i-th signal sample under R modulation types is Px i ={Pr1,Pr2,…,Pr R};

[0015] S3: For each signal sample in the stratified sampling, calculate the variance array of the confidence between the prediction result of each sample and each modulation type. When there is at least one variance value in the variance array that is less than the set threshold τ, save the signal sample corresponding to the variance array into the boundary sample.

[0016] The variance of the confidence scores between the prediction result A of the current i-th signal sample and each modulation type is represented by an array as follows:

[0017]

[0018] This represents the variance of the confidence level for prediction result A and the r-th modulation type;

[0019] When the variance If the value is less than the threshold τ, then the i-th signal sample is saved to the boundary sample, denoted as x. j (k);

[0020] S4: Modify the modulation type label of each boundary sample to form a key sample set;

[0021] For boundary sample x j (k) Select the modulation type corresponding to the minimum variance from the variance array of the corresponding i-th signal sample, and use it as the boundary sample x. j (k) boundary label

[0022] Boundary sample x j (k) and its corresponding boundary label As a set of data, it is saved to the key sample set D. key_d middle;

[0023] S5: Based on Markov chains, build a diffusion model for the generation of adversarial examples in wireless communication signals, and train it using a key sample set.

[0024] Diffusion model training includes a forward process and a backward process:

[0025] The forward process refers to: from the key sample set data D key_d A wireless communication signal x0 is loaded, and after T forward iterations, Gaussian noise is gradually added to the wireless communication signal x0 until a sample x that perfectly satisfies a Gaussian distribution is obtained. T ;

[0026] First, a noise transformation is applied to the original signal x0 to obtain the signal x. t The expression:

[0027]

[0028] It can be seen that the signal x at the current moment t The signal x from the previous moment t-1 Weighted by Gaussian noise ε. Where β t The hyperparameters are predefined and satisfy 0 < β1 < β2 < ... < β T <1, T is the diffusion step number, and ε ~ N(0,I) follows a standard normal distribution.

[0029] Then, set the intermediate variable 1-β t =α t For signal x tTransforming the expression yields the Markov recursive function:

[0030]

[0031] remember By rewriting the recursive function, we get:

[0032]

[0033] Finally, Gaussian noise is gradually added to the wireless communication signal x0 according to the above formula. Through a Markov forward process, Gaussian noise is gradually added to the data distribution of the wireless communication signal x0 until a sample data x that perfectly conforms to a Gaussian distribution is obtained. t .

[0034] The reverse process refers to: generating data based on normally distributed sampling, denoising the Gaussian noise data using a trained U-Net network, and then processing the denoised sample data x. t Gradually denoise and restore the original data x0 from a pure Gaussian dataset;

[0035] Specifically:

[0036] First, the posterior probability distribution of the forward process is obtained using Bayes' theorem, i.e., the probability distribution of the reverse process q(x). t-1 |x t ,x0):

[0037]

[0038] Then, combining the rewritten recursive function (3), we obtain:

[0039]

[0040] Further simplification yields the reverse process q(x) t-1 |x t The mean and variance of x0 are respectively:

[0041]

[0042]

[0043] Next, conditional sampling p is computed using a U-Net network with parameter θ. θ (x t-1 |x t ), such that its variance and posterior distribution are similar to the inverse process q(x). t-1 |x t The variance of ) remains consistent:

[0044] p θ (x t-1 |xt )=N(x t-1 μ θ (x t ,t),ε θ (x t ,t)) (8)

[0045] Where θ is the mean function μ of the Gaussian distribution. θ (x t ,t) and standard deviation function ε θ (x t The learnable parameter vector in ,t).

[0046] Finally, an implicit classifier is designed to classify the boundary labels. Integrate it into the training of the reverse process, that is, use Replacement conditional sampling p(x) t-1 |x t ),get:

[0047]

[0048] By solving in reverse, we obtain:

[0049]

[0050] in, The gradient of the implicit classifier is conditionally generated using probabilities; ω is the weight, and the larger ω is, the higher the boundary label. The greater the traction strength, the better the generated samples and boundary labels. The higher the confidence level, the better.

[0051] The training process is as follows:

[0052] When the input of the given U-Net neural network is (x t ,t), using the learned parameters θ and the obtained mean function μ θ (x t ,t) and standard deviation function ε θ (x t ,t), predict the noise ε at each step. θ Noise ε θ Contains boundary labels The guidance can direct noise toward the boundary label. Directional denoising to reduce distribution and the reverse process q(x) t-1 |x t The difference between x0 and x1 is gradually reduced by T iterations to minimize the noise ε. θ The process involves removing samples until the original signal data is recovered, ultimately forming a diffusion model of adversarial samples for wireless communication signals.

[0053] S6: Input random sample x into the trained diffusion model T ~N(0,I), the number of iterations, and the boundary labels of key samples are used to directly output adversarial example data with boundary labels, forming the adversarial example dataset D. adv .

[0054] S7: Generate the adversarial example dataset D adv The data is input into a pre-trained AMR model for classification prediction, and the AMR model's performance on the adversarial example dataset D is obtained. adv The recognition accuracy P′ Accuracy Compare P Accuracy With P′ Accuracy Verify the effectiveness of adversarial sample generation.

[0055] The advantages of the present invention are:

[0056] This invention discloses a method for generating adversarial samples for wireless communication signals based on a diffusion model. Compared with traditional adversarial sample generation methods, this invention can significantly improve the diversity of sample generation and provide the same effect as classifier guidance without the need for a classifier. It can generate samples into a specified category for targeted attacks. Attached Figure Description

[0057] Figure 1 This is a flowchart of a method for generating adversarial examples for wireless communication signals based on a diffusion model. Detailed Implementation

[0058] To facilitate understanding and implementation of the present invention by those skilled in the art, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Obviously, the described embodiments are merely some, not all, embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort should fall within the scope of protection of the present invention.

[0059] This invention proposes a method for generating adversarial examples of wireless communication signals based on a diffusion model. By performing conditional diffusion generation on key samples in the model training dataset, adversarial examples of wireless communication signals that are difficult for the perception model to identify are generated. This method can significantly improve the efficiency of adversarial example waveform design, generate effective and highly specific new samples, ensure the optimization of generated samples, and enhance the robustness of the electromagnetic signal perception model.

[0060] The method for generating adversarial examples for wireless communication signals based on the diffusion model, such as Figure 1 As shown, it includes the following steps:

[0061] S1: Select a publicly available wireless communication signal dataset D, and divide it into several layers according to feature attribute categories. Randomly sample signal samples from each layer; divide the dataset D into training sets D using stratified sampling. train and verification set D valid .

[0062] For R modulation types, each signal sample corresponds to one modulation type, and the modulation type label of the i-th signal sample is... Let r ∈ {1,2,…,R}; signal samples and labels together constitute dataset D;

[0063] To ensure a relatively balanced number of samples for each feature attribute in the training and test sets, the dataset is divided into several layers based on the overall feature attribute categories, and samples are randomly drawn from each layer. The elements in the initial dataset D are represented as: x i (k), k = 1, 2, ..., K, where K is the number of sampling points for a single signal, and i = 1, 2, ..., N, where N represents the number of signal samples.

[0064] S2: Input the training set into the AMR model with the network parameters set for training, and validate each sample in the validation set. Calculate the confidence score of each sample under each modulation type, select the type corresponding to the maximum confidence score as the prediction result for each sample, and record the recognition accuracy P of the AMR model at this time. Accuracy ;

[0065] The confidence level of the i-th signal sample under R modulation types is Px i ={Pr1,Pr2,…,Pr R};

[0066] Initialize the deep convolutional neural network structure and parameter settings, call existing network layer functions, and build the deep network structure; the convolution module is designed based on the standard convolutional neural network, consisting of alternating convolutional layers and activation function layers; in the convolutional layers, the kernel size, stride, and inner margin padding are set to 3, 2, and 1 respectively, and the activation function layer uses the ReLU activation function; the ReLU activation function is applied to add nonlinear transformation to increase the network's expressive power, the pooling layer reduces the feature dimension, and the fully connected layer integrates features.

[0067] S3: For each signal sample in the stratified sampling, calculate the variance array of the confidence between the prediction result of each sample and each modulation type. When there is at least one variance value in the variance array that is less than the set threshold τ, save the signal sample corresponding to the variance array into the boundary sample.

[0068] The variance of the confidence scores between the prediction result A of the current i-th signal sample and each modulation type is represented by an array as follows:

[0069]

[0070] This represents the variance of the confidence level for prediction result A and the r-th modulation type;

[0071] When the variance If the variance is less than the threshold τ, it indicates that the confidence difference of the signal samples corresponding to this variance is small in each modulation type. These samples are usually located between uncertain categories or close to the classification decision boundary. Therefore, the i-th signal sample is saved in the boundary samples, denoted as x. j (k);

[0072] S4: Modify the modulation type label of each boundary sample to form a key sample set;

[0073] For boundary sample x j (k) Select the modulation type corresponding to the minimum variance from the variance array of the corresponding i-th signal sample, and use it as the boundary sample x. j (k) boundary label

[0074] Boundary sample x j (k) and its corresponding boundary label As a set of data, it is saved to the key sample set D. key_d middle;

[0075] S5: Based on Markov chains, build a diffusion model for the generation of adversarial examples in wireless communication signals, and train it using a key sample set.

[0076] The diffusion model is a probabilistic model based on Markov chains. First, Gaussian noise is gradually added to the key samples until the sample distribution completely satisfies the Gaussian distribution. Then, the U-Net network is trained to predict the noise added at each step, gradually restoring the Gaussian-distributed samples to the original distribution state, thus completing the model training.

[0077] Diffusion model training includes a forward process and a backward process:

[0078] The forward process refers to: from the key sample set data D key_d In this process, signal samples are selected sequentially as the initial wireless communication signal x0. After T forward iterations, Gaussian noise is gradually added to the wireless communication signal x0 until a sample x0 that perfectly satisfies a Gaussian distribution is obtained. T ;

[0079] The forward process q(x) t |x t-1 () represents the process of adding noise to the signal data at each step, and the formula is:

[0080]

[0081] Where N~(0,I) is a standard normal distribution, with mean and variance respectively. and β t ;

[0082] First, based on equation (1), the original signal x0 is subjected to a noise-adding transformation, and the signal x is obtained by sampling the standard normal distribution ε~N(0,I). t The expression:

[0083]

[0084] Equation (2) indicates the data x at the current time. t For the data x from the previous time step t-1 Weighted by Gaussian noise ε. Where β t The hyperparameters are predefined and satisfy 0 < β1 < β2 < ... < β T <1, T is the diffusion step number, and ε ~ N(0,I) follows a standard normal distribution.

[0085] Set the intermediate variable 1-β t =α t ,get:

[0086]

[0087] x t Here is the noise data at time t, where T is the number of diffusion steps, and α is the noise data. t Let ε be the hyperparameter at time t, and let ε be the Gaussian noise added at time t-1.

[0088] Equation (3) is a Markov recursive function, denoted as... Equation (3) can be rewritten recursively as follows:

[0089]

[0090] According to the formula Gaussian noise is gradually added to the wireless communication signal x0. A Markov forward process is used to gradually add Gaussian noise to the data distribution of the wireless communication signal x0 until a sample data x that perfectly conforms to a Gaussian distribution is obtained. t .

[0091] The reverse process refers to: generating data based on normally distributed sampling, denoising the Gaussian noise data using a trained U-Net network, and then processing the denoised sample data x. t Gradually denoise and restore the original data x0 from a pure Gaussian dataset;

[0092] Reverse process q(x) t-1 |xt ,x0) is the forward process q(x t |x t-1 The posterior probability distribution of ), the posterior probability q(x) t-1 |x t The form of (x0) is derived from Bayes' theorem:

[0093]

[0094] According to equation (4), we can conclude that:

[0095]

[0096] Substituting equation (6) into equation (5) yields:

[0097]

[0098] Simplification yields q(x) t-1 |x t The mean and variance of x0 are respectively:

[0099]

[0100]

[0101] Substituting equation (4) into equation (8), we get:

[0102]

[0103] However, due to q(x) t-1 |x t The conditional sampling p cannot be directly obtained, so a U-Net neural network needs to be trained for fitting. A U-Net network with parameters θ is used to calculate the conditional sampling p. θ (x t-1 |x t ), making its variance and posterior distribution q(x) t-1 |x t The variance of ) remains consistent:

[0104] p θ (x t-1 |x t )=N(x t-1 μ θ (x t ,t),ε θ (x t ,t)) (11)

[0105] Where θ is the mean function μ of the Gaussian distribution. θ (x t ,t) and standard deviation function ε θ(x t The learnable parameter vector in ,t). Equation (11) shows that noise can be passed through ε θ (x t The value is adjusted by (x,t), and predicted by the U-Net network. The input of the U-Net neural network is (x,t). t The output is the noise ε to be removed at the current time (t). θ .

[0106] To enable the diffusion model to be generated based on boundary labels For the samples, design an implicit classifier to assign boundary labels. In the merging process, the boundary labels are directly used. Add to the training process, that is, use Replace p(x) t-1 |x t The conditional sampling process is defined as follows:

[0107]

[0108] The gradient of the implicit classifier is expressed using the conditional generation probability and the unconditional generation probability as follows:

[0109]

[0110] The transformation yields:

[0111]

[0112] Where ω is the weight, and the larger ω is, the stronger the boundary label. The greater the traction strength, the better the generated samples and boundary labels. The higher the confidence level, the better.

[0113] The training process is as follows:

[0114] When the input of the given U-Net neural network is (x t ,t), using the learned parameters θ and the obtained mean function μ θ (x t ,t) and standard deviation function ε θ (x t ,t), predict the noise ε at each step. θ Noise ε θ Contains boundary labels The guidance can direct noise toward the boundary label. Directional denoising to reduce distribution and the reverse process q(x) t-1 |x t The difference between x0 and x1 is gradually reduced by T iterations to minimize the noise ε. θThe process involves removing samples until the original signal data is recovered, ultimately forming a diffusion model of adversarial samples for wireless communication signals.

[0115] The objective function to be optimized is:

[0116]

[0117] The loss function used is: Lα=||ε(x) t ,t)-ε θ (x t ,t,l)|| 2 ;

[0118] S6: Input random sample x into the trained diffusion model T Given ~N(0,I), the number of iterations, and the boundary labels to be generated, directly output adversarial example data with boundary labels to form the adversarial example dataset D. adv .

[0119] Using the modulation type of the sample i The attributes, i.e., boundary labels, serve as gradient guides for training the U-Net network to predict the noise added at each step, progressively removing Gaussian noise from the samples until the original signal is recovered. Specifically, based on the noisy data x... t Calculate a conditional distribution from which samples are obtained compared to x. t The U-Net neural network is trained using slightly cleaner data samples that are closer to real signal data, starting with pure noise and gradually removing noise until a real signal is obtained.

[0120] The random Gaussian noise signal and the feature labels of the samples to be generated are simultaneously input into the trained diffusion model, and a new time-domain signal sample with the input features is output.

[0121] S7: Generate the adversarial example dataset D adv Input the trained AMR model for classification prediction and obtain the AMR model's performance on the adversarial example dataset D. adv The recognition accuracy P′ Accuracy Compare P Accuracy With P′ Accuracy Verify the effectiveness of adversarial sample generation.

[0122] It can be seen that adversarial examples exhibit strong aggression against the model, causing a decrease in the model's classification accuracy.

[0123] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the technical scope of the conclusions of the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for generating adversarial examples for wireless communication signals based on a diffusion model, characterized in that, Includes the following steps: S1: Select a publicly available wireless communication signal dataset D, and divide it into several layers according to feature attribute categories. Randomly sample signal samples from each layer; divide the dataset D into training sets D using stratified sampling. train and verification set D valid ; S2: Input the training set into the AMR model with the network parameters set for training, and validate each sample in the validation set. Calculate the confidence score of each sample under each modulation type, select the type corresponding to the maximum confidence score as the prediction result for each sample, and record the recognition accuracy P of the AMR model at this time. Accuracy ; The confidence level of the i-th signal sample under R modulation types is Px i ={Pr1,Pr2,…,Pr R }; S3: For each signal sample in the stratified sampling, calculate the variance array of the confidence between the prediction result of each sample and each modulation type. When there is at least one variance value in the variance array that is less than the set threshold τ, save the signal sample corresponding to the variance array into the boundary sample. S4: Modify the modulation type label of each boundary sample to form a key sample set; S5: Based on Markov chains, build a diffusion model for the generation of adversarial examples in wireless communication signals, and train it using a key sample set. Diffusion model training includes a forward process and a backward process: The forward process refers to: from the key sample set data D key_d A wireless communication signal x0 is loaded, and after T forward iterations, Gaussian noise is gradually added to the wireless communication signal x0 until a sample x that perfectly satisfies a Gaussian distribution is obtained. T ; First, a noise transformation is applied to the original signal x0 to obtain the signal x. t The expression: It can be seen that the signal x at the current moment t The signal x from the previous moment t-1 Weighted by Gaussian noise ε; where β t The hyperparameters are predefined and satisfy 0 < β1 < β2 < ... < β T <1, T is the diffusion step number, εN(0,I) follows a standard normal distribution; Then, set the intermediate variable 1-β t =α t For signal x t Transforming the expression yields the Markov recursive function: remember By rewriting the recursive function, we get: Finally, Gaussian noise is gradually added to the wireless communication signal x0 according to the above formula. Through a Markov forward process, Gaussian noise is gradually added to the data distribution of the wireless communication signal x0 until a sample data x that perfectly conforms to a Gaussian distribution is obtained. t ; The reverse process refers to: generating data based on normally distributed sampling, denoising the Gaussian noise data using a trained U-Net network, and then processing the denoised sample data x. t Gradually denoise and restore the original data x0 from a pure Gaussian dataset; Specifically: First, the posterior probability distribution of the forward process is obtained using Bayes' theorem, i.e., the probability distribution of the reverse process q(x). t-1 |x t ,x0): Then, combining the rewritten recursive function (3), we obtain: Further simplification yields the reverse process q(x) t-1 |x t The mean and variance of x0 are respectively: Next, conditional sampling p is computed using a U-Net network with parameter θ. θ (x t-1 |x t ), such that its variance and posterior distribution are similar to the inverse process q(x). t-1 |x t The variance of ) remains consistent: Where θ is the mean function μ of the Gaussian distribution. θ (x t ,t) and standard deviation function ε θ (x t The learnable parameter vector in (t); Finally, an implicit classifier is designed to classify the boundary labels. Integrate it into the training of the reverse process, that is, use Replacement conditional sampling p(x) t-1 |x t ),get: By solving in reverse, we obtain: in, The gradient of the implicit classifier is conditionally generated using probabilities; ω is the weight, and the larger ω is, the higher the boundary label. The greater the traction strength, the better the generated samples and boundary labels. The higher the confidence level; S6: Input random sample x into the trained diffusion model T ~N(0,I), the number of iterations, and the boundary labels of key samples are used to directly output adversarial example data with boundary labels, forming the adversarial example dataset D. adv ; S7: Generate the adversarial example dataset D adv The data is input into a pre-trained AMR model for classification prediction, and the AMR model's performance on the adversarial example dataset D is obtained. adv The recognition accuracy P A ′ ccuracy Compare P Accuracy With P A ′ ccuracy Verify the effectiveness of adversarial sample generation.

2. The method for generating adversarial examples for wireless communication signals based on a diffusion model as described in claim 1, characterized in that, In S1, the elements in the initialized dataset D are represented as: x i (k), k = 1, 2, ..., K, where K is the number of sampling points for a single signal, and i = 1, 2, ..., N, where N represents the number of signal samples; For R modulation types, each signal sample corresponds to one modulation type, and the modulation type label of the i-th signal sample is denoted by l. i r Let r ∈ {1,2,…,R}.

3. The method for generating adversarial examples for wireless communication signals based on a diffusion model as described in claim 1, characterized in that, In S3, the variance of the confidence level between the prediction result A of the current i-th signal sample and each modulation type is represented by an array as follows: This represents the variance of the confidence level for prediction result A and the r-th modulation type; When the variance If the value is less than the threshold τ, then the i-th signal sample is saved to the boundary sample, denoted as x. j (k).

4. The method for generating adversarial examples for wireless communication signals based on a diffusion model as described in claim 1, characterized in that, Specifically, S4 refers to: for boundary sample x j (k) Select the modulation type corresponding to the minimum variance from the variance array of the corresponding i-th signal sample, and use it as the boundary sample x. j (k) boundary label Boundary sample x j (k) and its corresponding boundary label As a set of data, it is saved to the key sample set D. key_d middle.

5. The method for generating adversarial examples for wireless communication signals based on a diffusion model as described in claim 1, characterized in that, The training process in S5 is as follows: When the input of the given U-Net neural network is (x t ,t), using the learned parameters θ and the obtained mean function μ θ (x t ,t) and standard deviation function ε θ (x t ,t), predict the noise ε at each step. θ Noise ε θ Contains boundary labels The guidance can direct noise toward the boundary label. Directional denoising to reduce distribution and the reverse process q(x) t-1 |x t The difference between x0 and x1 is gradually reduced by T iterations to minimize the noise ε. θ The process involves removing samples until the original signal data is recovered, ultimately forming a diffusion model of adversarial samples for wireless communication signals.

Images