Automatic modulation identification confrontation defense method based on core set selection of confrontation robustness evaluation

Abstract

An automatic modulation identification confrontation defense method based on confrontation robustness evaluation core set selection comprises the following steps: S1, data set division and preprocessing: giving an original training data set for preprocessing; s2, adversarial sample generation and robustness test: for each sample in the training set, generating an adversarial sample set with different disturbance intensities by using a plurality of adversarial attack methods; s3, sample robustness score calculation: calculating a comprehensive robustness score of each sample based on the adversarial attack trajectory, and taking the comprehensive robustness score as a core basis for sample selection; s4, multi-level core set selection based on robustness scoring: according to the ARS scores of the samples, combining signal-to-noise ratio distribution and category balance, adopting a hierarchical selection strategy to construct a core set: arranging the samples in the training set in a descending order according to the ARS scores; dividing the sample into high, medium and low robustness intervals according to a preset layering threshold value; based on the target sampling rate k, adaptively determining the sample selection number of each interval; stratified sampling is further carried out in each interval according to a signal-to-noise ratio and a category, so that diversity is ensured; integrating the samples selected in each interval to form a final robust core set; and S5, adversarial defense model training and verification: adversarial training is performed on the deep neural network by using the defense core set.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of wireless communication signal processing and deep learning, specifically relating to an automatic modulation recognition adversarial defense method based on core set selection for adversarial robustness assessment. This method is used in Automatic Modulation Recognition (AMR) tasks to efficiently screen highly robust training samples, significantly improving the model's resistance to noise interference and adversarial attacks while reducing model training costs. The invention relates to key technologies such as adversarial example generation, quantitative assessment of sample robustness, intelligent sampling based on attack sensitivity, and robustness-oriented core set construction. Background Technology

[0002] With the widespread application of deep learning technology in wireless communication, automatic modulation identification (AMR) technology based on deep learning has made significant progress and is widely used in scenarios such as spectrum monitoring, cognitive radio, electronic warfare, and satellite communication. Unlike traditional methods that rely on expert feature extraction and manually designed rules, deep learning models can directly learn discriminative feature representations from raw signal data, achieving high recognition accuracy under ideal channel conditions.

[0003] In recent years, deep learning methods have made significant progress in the field of automatic modulation recognition. O'Shea et al. proposed a modulation recognition method based on convolutional neural networks (CNNs), achieving breakthrough results on signal datasets. West and O'Shea further introduced residual networks (ResNet) and long short-term memory networks (LSTM) to improve recognition performance under low signal-to-noise ratio conditions. Zhang et al. used time-frequency joint representation and attention mechanisms to achieve adaptive fusion of multi-domain features.

[0004] However, in real-world deployment environments, deep learning models face two severe challenges: First, insufficient model robustness. While existing deep learning models perform excellently on clean data, their recognition performance often drops sharply when faced with noise interference, channel fading, multipath effects, and potential adversarial attacks in real electromagnetic environments. Research shows that even models that perform well on the training set can see their recognition accuracy plummet from over 90% to below 10% after being subjected to carefully designed adversarial perturbations. This vulnerability is particularly dangerous in scenarios with extremely high security requirements, such as military communication warfare and spectrum regulation. Attackers can deceive the recognition system by injecting tiny but carefully designed noise, leading to misjudgments or system failure. Second, the computational cost of robustness enhancement methods. To enhance model robustness, adversarial training is widely considered one of the most effective defense methods. This method dynamically generates adversarial examples during training and adds them to the training set, forcing the model to learn feature representations invariant to perturbations. However, adversarial training is extremely computationally expensive: for each training sample, adversarial examples need to be generated through multiple iterations (e.g., PGD attacks typically require 10-50 iterations), increasing training time by 5-10 times compared to standard training. For large-scale datasets containing hundreds of thousands or even millions of samples, such as RML2016.10a (220,000 samples) or RML2018.01a (over 1,000,000 samples), complete adversarial training is almost infeasible in environments with limited computational resources, severely restricting the development and deployment of robust models. To address this contradiction, coreset selection offers a potential solution for balancing robustness and efficiency. This technique aims to select a smaller but highly representative subset from the original training set, so that the performance of the model trained on this subset is close to that of the model trained on the full dataset. However, existing coreset selection methods mainly focus on improving the model's generalization accuracy on clean test sets, with few works specifically designed for robustness scenarios. Specifically, existing methods have the following problems: 1) Ignoring the robustness of samples: Traditional core set methods, such as those based on gradient norm (GraNd), forgetting, and k-Center Greedy, primarily select core sets based on the loss value, gradient magnitude, or feature space distribution of samples during standard training, without considering the vulnerability of samples to adversarial attacks. This results in the selected core set potentially containing a large number of vulnerable samples, leading to poor performance of the trained model in adversarial scenarios.

[0005] 2) Lack of targeted evaluation for adversarial scenarios: Existing methods typically assume that sample importance is static or only related to the clean data distribution, failing to quantify the robustness of samples under different perturbation intensities. In adversarial training scenarios, the contribution of different samples to model robustness varies greatly: some samples are easily misclassified even under slight perturbations (vulnerable samples), while others remain correctly classified even under strong perturbations (robust samples). Ignoring this difference will lead to blind selection of the core set.

[0006] 3) Failure to balance robustness and diversity: Anti-robustness depends not only on the inherent characteristics of the samples but also on the diversity of their distribution in the feature space. Simply selecting the most robust samples may lead to the core set being overly concentrated in certain categories or signal-to-noise ratio ranges, impairing the model's ability to cover the entire spectrum. Existing methods lack a selection mechanism that simultaneously considers robustness and diversity.

[0007] 4) The trade-off between computational efficiency and robustness improvement has not been fully explored: Although core set selection can reduce the number of training samples, if the selection strategy is inappropriate, expensive adversarial example generation still needs to be performed on the full dataset to evaluate robustness, resulting in excessive computational overhead in the preprocessing stage.

[0008] In summary, existing technologies struggle to simultaneously achieve both "defense effectiveness" and "training efficiency" when constructing highly robust automatic modulation recognition models. Therefore, a novel adversarial defense method is urgently needed, capable of rapidly building robust recognition models that can withstand malicious attacks and environmental noise under limited computational resources by intelligently selecting the most valuable training samples. Analysis of the shortcomings of existing technologies: Chinese patent CN117197614A discloses a data filtering method and apparatus. This method processes the dataset using a feature clustering model, selects features with the highest scores to form a target feature set, and then filters the data based on this target feature set. While this method considers the importance ranking of features, it suffers from fundamental flaws in robustness scenarios: First, feature-level filtering fails to reflect adversarial vulnerability. This method focuses on the static importance of features rather than the dynamic behavior of samples under adversarial perturbations. In adversarial attacks, some features, while highly discriminative on clean data, are precisely the vulnerabilities. Relying solely on feature scores cannot identify samples sensitive to perturbations. Second, it lacks an adversarial evaluation mechanism. This method does not involve adversarial sample generation or robustness testing, and cannot quantify the performance of samples under different attack intensities. This leads to a large number of potentially vulnerable samples being selected, resulting in a poorly robust model. Finally, it ignores the physical characteristics of signal data. For wireless signal data, the signal-to-noise ratio (SNR) directly affects the attack sensitivity of samples. Low SNR samples are inherently noisier, and their tolerance for additional perturbations differs significantly from that of high SNR samples. This method does not consider this physical property, which can easily lead to an imbalance in the distribution of the core set under different SNR conditions, affecting the robustness of the model across the entire signal-to-noise ratio range.

[0009] Chinese patent CN116956167A discloses a sample data screening method and system. This method comprehensively considers factors such as product usage frequency and endurance value weights, calculates feature weights through SVM-RFE and DT-RFE, and uses a dynamic weighted fusion approach to sequentially eliminate features with lower importance, ultimately selecting the optimal feature combination. However, this method also has significant shortcomings in robust core set selection: First, the greedy elimination strategy harms robust diversity. This method sequentially eliminates features with lower importance, and this greedy strategy may backfire in adversarial scenarios. Some features with low importance on clean data may be crucial for resisting specific attacks (e.g., high-frequency noise features), and premature elimination weakens model robustness. Second, static importance cannot capture adversarial dynamics. Importance assessment is based on the model state at the initial stage of training and does not consider the dynamic changes of samples during adversarial training. Research shows that some samples are easy to learn in standard training but become difficult samples in adversarial training; conversely, some initially difficult samples can provide robust gradient signals. Static assessment cannot identify this role reversal. Finally, it does not incorporate adversarial attack assessment. This method is entirely based on feature engineering and does not introduce adversarial sample generation or attack success rate assessment, thus failing to directly quantify the robustness value of the samples.

[0010] The paper "DeepCore: A Comprehensive Library for Coreset Selection in DeepLearning" systematically summarizes coreset selection methods in the field of image classification, including classic strategies such as uncertainty-based, gradient-based (GraNd), forgetting-based, and geometric coverage-based (k-Center). However, directly applying these methods to AMR tasks in adversarial robustness scenarios has the following fundamental shortcomings: 1) Image domain methods primarily optimize accuracy on clean test sets, and their evaluation metrics (such as loss value and gradient norm) are based on standard forward propagation. The core objective of adversarial robustness scenarios is to minimize the loss under worst-case perturbations (min-max optimization), requiring evaluation of sample behavior after adversarial examples are generated. The optimization objectives of the two approaches are fundamentally different. Experiments show that samples that are "difficult" (high loss) on clean data are not necessarily vulnerable to adversarial attacks, and vice versa. Simply relying on standard training metrics to select the core set cannot guarantee adversarial robustness.

[0011] 2) Existing methods do not consider the impact of different attack methods (such as FGSM, PGD, C&W) and different perturbation intensities on sample importance. The robustness of the same sample under different attacks may be drastically different: a sample robust to FGSM may be vulnerable to PGD. The lack of a comprehensive robustness evaluation mechanism under multiple attack scenarios may cause the selected core set to fail under specific attacks.

[0012] 3) Wireless signals exhibit structured patterns in both the time and frequency domains, and the behavior of adversarial perturbations in the time and frequency domains differs significantly from that in image space. For example, adding a small perturbation to IQ data can induce a significant spectral shift in the frequency domain, leading to modulation type confusion. The signal's SNR directly affects its sensitivity to additional perturbations. Low SNR samples are already heavily contaminated with noise, making them relatively less affected by additional adversarial perturbations; while high SNR samples are extremely sensitive to minute perturbations. Image-based methods do not consider this difference in physical layer properties. Real signals experience channel effects such as multipath propagation and fading, resulting in complex nonlinear interactions when superimposed with adversarial perturbations. Additive perturbation models in the image domain cannot accurately characterize this characteristic.

[0013] 4) The computational overhead analysis of image methods mainly focuses on standard training scenarios and does not consider the additional overhead of generating adversarial examples for each forward propagation in adversarial training. Performing adversarial robustness evaluation (generating adversarial examples and testing attack success rates) on the full dataset is extremely costly. If the number of evaluation samples cannot be significantly reduced during the preprocessing stage, the selection of the core set itself will become a bottleneck. Summary of the Invention

[0014] To address the shortcomings of existing technologies, this invention proposes an automatic modulation recognition adversarial defense method based on core set selection for adversarial robustness assessment. This method aims to solve the dual problems of high adversarial training costs and insufficient model robustness in deep learning models during adversarial attacks. By explicitly evaluating the robustness performance of each sample under adversarial attacks, a representative subset of samples is intelligently selected that maintains model robustness while significantly reducing training costs.

[0015] This invention provides a data processing method based on adversarial robustness assessment. The core idea is to quantify the inherent robustness characteristics of samples by applying adversarial attacks of varying intensities to each sample in the training set and recording the attack success rate under multiple perturbation levels. Based on robustness scoring, this method employs a multi-level sample selection strategy, prioritizing robust samples that perform stably under adversarial attacks while also considering sample diversity and signal-to-noise ratio distribution to form a high-quality robust core set. This method can maintain robustness performance close to that of full-scale adversarial training while significantly reducing the size of adversarial training data (to 10%-30%), and simultaneously greatly reducing computational costs and training time.

[0016] In adversarial robustness scenarios, the mathematical goal of core set selection is to construct a compact and robust subset. (in , This allows the model trained adversarially on this subset to have robust performance similar to the model trained adversarially on the full dataset D. The optimization problem can be formally expressed as: (1) Constraints: (2) in and Let S and D represent the model parameters obtained through adversarial training on the core set S and the full dataset D, respectively. Represents the adversarial loss function. Indicates the permissible space against perturbations (e.g.) ball) This indicates the model's accuracy in identifying adversarial examples. This measures the diversity of a sample set in both the feature space and the signal-to-noise ratio dimension. For an acceptable robust performance loss threshold, The diversity preservation coefficient.

[0017] To achieve the above objectives, the technical solution adopted by the present invention is as follows: An automatic modulation identification adversarial defense method based on core set selection for adversarial robustness assessment includes the following steps: S1: Dataset partitioning and preprocessing: Given the original training dataset ,in For signal samples, The corresponding modulation category labels are used; preprocessing includes: signal amplitude normalization to eliminate amplitude differences between different samples; basic training set is selected based on signal-to-noise ratio (SNR); the dataset is divided into training set and test set according to a preset ratio; ensuring that samples of each modulation category and different SNR are evenly distributed in the two sets; S2: Adversarial Example Generation and Robustness Testing: For each sample in the training set Multiple adversarial attack methods are used to generate adversarial sample sets with different perturbation intensities. ,in The Mth perturbation intensity level is represented by: using a pre-trained benchmark model as the attack target, generating adversarial examples for each sample at M perturbation intensity levels, recording the attack success of each adversarial example, and constructing the robust behavior trajectory matrix of the sample. S3: Sample Robustness Score Calculation: Based on the adversarial attack trajectory, calculate the comprehensive robustness score for each sample. This score integrates three sub-indicators: Attack Resistance Rate (ARR), Robust Stability (R), and Confidence Preservation (CP), which represent the degree to which the model prediction confidence is preserved after adversarial perturbation. After standardizing the above three sub-indicators, the final adversarial robustness score (ARS) is obtained through weighted fusion, which serves as the core basis for sample selection. S4: Multi-level core set selection based on robustness score: Based on the ARS score of the samples, combined with the signal-to-noise ratio distribution and class balance, a hierarchical selection strategy is adopted to construct the core set: The samples in the training set are arranged in descending order of ARS score; according to the preset hierarchical threshold, the samples are divided into high robustness intervals, medium robustness intervals, and low robustness intervals; based on the target sampling rate k, the number of samples selected in each interval is adaptively determined; within each interval, further hierarchical sampling is performed according to signal-to-noise ratio and class to ensure diversity; the samples selected from each interval are integrated to form the final robust core set S; S5: Adversarial Defense Model Training and Validation: Adversarial training of deep neural networks using a defense core set: First, the adversarial training algorithm is executed on the core set S. Adversarial perturbations are dynamically generated and model parameters are updated during the training loop, forcing the model to learn robust features that are insensitive to perturbations. After training, adversarial samples are generated on the test set to evaluate the robust recognition accuracy of the model. The performance difference between full-data adversarial training and core set adversarial training is compared and analyzed to verify the effectiveness of the defense model in maintaining high anti-interference capability while reducing computational cost.

[0018] Preferably, the data preprocessing in step S1 includes: 11) Signal Normalization: Normalize the IQ data of each signal sample using the following formula: (3) Where x is the original IQ data. and These are the mean and standard deviation of the sample, respectively. 12) Basic training set selection: Select samples that meet the criteria from the original dataset according to the actual application requirements; 13) Dataset partitioning: A hierarchical random sampling strategy was adopted to divide the training set and the test set in a 4:1 ratio to ensure that: the proportion of each modulation category in the two sets is consistent; the samples of each signal-to-noise ratio level are evenly distributed in the two sets; the test set remains unchanged for fair evaluation of all subsequent models; this preprocessing strategy ensures the quality of the data and the reproducibility of the experiment.

[0019] Preferably, the adversarial example generation in step S2 specifically includes: 21) Baseline model training: First, train a baseline model on the full dataset or a randomly sampled subset. This is used for subsequent adversarial example generation. The model architecture is selected from CNN1D, CNN2D, and ResNet, and the training uses standard cross-entropy loss. 22) Multi-intensity adversarial attack: For each sample in the training set At M disturbance intensity levels Generate adversarial examples; taking PGD attack as an example: (4) in To combat perturbations, a multi-step projective gradient descent solution is used: (5) in Step size, This is a projection operation, where t is the number of iterations. 23) Attack success determination: For each generated adversarial sample Determine whether the attack was successful: (6) 24) Robust trajectory recording: Construct a robust trajectory vector for each sample: (7) This vector fully characterizes the vulnerability patterns of the sample under different perturbation intensities; Example of disturbance strength setting: For IQ signal data, the commonly used disturbance strength range is... Relative to the normalized signal amplitude, set M=5 levels: {0.01, 0.02, 0.04, 0.06, 0.08}.

[0020] Preferably, the sub-indicators for calculating the adversarial robustness score (ARS) in step S3 include: Attack Resistance Rate (ARR): the proportion of samples that successfully resist multiple adversarial attacks; Robustness Stability (RS): the consistency of robustness of samples under different perturbation intensities; and Confidence Preservation (CP): the degree to which the confidence of model predictions is preserved after adversarial perturbations.

[0021] Preferably, the three sub-indices of the Adversarial Robustness Score (ARS) in step S3 are calculated as follows: 31) Attack Resistance Rate (ARR): Quantifies the overall resistance of a sample population to attacks; (8) Physical meaning: The higher the ARR, the more likely the sample can maintain correct classification under various perturbation intensities, which is the core feature of robust samples; ARR=1 indicates that the sample was not successfully attacked under all test perturbations, and ARR=0 indicates that the sample was successfully attacked under all perturbations. 32) Robustness Stability RS: Measures the consistency of sample robustness across different perturbation intensities; (9) in The variance of the robust trajectory vector. This represents the theoretical maximum variance (the maximum variance of a binary sequence). Physical meaning: The higher the RS, the more stable the robustness of the sample is, and it will not fluctuate drastically due to small changes in the intensity of the perturbation. Some samples may be robust under low perturbation but fragile under high perturbation (low RS). Such samples contribute little to the generalization robustness of the model. 33) Confidence Preservation (CP): This assesses the degree to which the confidence of the model prediction decreases after adversarial perturbation. (10) in This represents the model's predicted probability for a clean sample in the true class. This is the predicted probability of the adversarial example on the real class (this value may be non-zero even if the attack is successful). Physical meaning: CP reflects the firmness of the model's decision when a sample is attacked; even under perturbation, samples with high CP show less decrease in the model's confidence in its true class, indicating that the sample has inherent discriminative stability. 34) Comprehensive Robustness Score (ARS): The three indicators are standardized and then weighted and fused. (11) in For min-max normalization operation: (12) Preferably, the weighting coefficient is set to the default value. Adjustments are made based on task requirements; ARR has the highest weight because resisting attacks is the core objective of robustness; RS has the second highest weight to ensure that the robustness of the selected samples is reliable rather than accidental; CP has the lowest weight as an auxiliary indicator to reflect the stability of model decisions.

[0022] Preferably, the design basis for the three sub-indices of the robustness assessment in step S3 is: Attack Resistance Rate (ARR) focuses on overall robustness; high ARR samples are “naturally robust” samples whose features are insensitive to perturbations. These samples typically have clear intra-class features and are far from the decision boundary, which are crucial for the model to learn robust features that are stable. Robustness stability (RS) focuses on the reliability of robustness; the robustness of high RS samples does not change with small changes in perturbation intensity, avoiding the selection of "pseudo-robust" samples, being robust only under specific perturbations, and ensuring that the core set has the ability to generalize to different attack scenarios. Confidence retention (CP) focuses on decision-making firmness; even when samples with high CP are perturbed, the model still maintains a certain level of confidence in their true class, reflecting the strength of the discriminative information of the sample, which helps the model maintain its memory of the correct class during adversarial training.

[0023] Preferably, the robust core set selection strategy in step S4 includes: 41) Sample Stratification: After sorting all samples in the training set in descending order of ARS score, they are divided into three robust intervals: High robustness range: The top 30% of ARS samples, which are the most stable under adversarial attacks and form the cornerstone of the core set; Moderate robustness range: The middle 40% of samples in the ARS ranking have moderate robustness and some learning value; Low robustness region: The bottom 30% of samples in the ARS ranking. Although these samples are vulnerable to attack, they may provide boundary information. 42) Adaptive quota allocation: Dynamically adjust the sampling ratio of each interval according to the target sampling rate k. Extremely low sampling rate: when k≤10%, the high robustness interval accounts for 60%, the medium robustness interval accounts for 30%, and the low robustness interval accounts for 10%; Strategy: Extremely focus on robust samples to ensure that the core set can still maintain basic robustness when resources are extremely limited. Low sampling rate. When 10% < k ≤ 20%, the proportion of the high-robustness interval is 50%, the proportion of the medium-robustness interval is 35%, and the proportion of the low-robustness interval is 15%. Strategy: Mainly select robust samples and appropriately increase medium samples to improve diversity. Medium sampling rate. When 20% < k ≤ 30%, the proportion of the high-robustness interval is 40%, the proportion of the medium-robustness interval is 40%, and the proportion of the low-robustness interval is 20%. Strategy: Balance robustness and diversity to make the core set cover a wider sample space. 43) Hierarchical inner quadratic sampling: Within each robustness interval, further perform stratified sampling according to signal-to-noise ratio and category; group the samples within the interval by signal-to-noise ratio to ensure that each SNR group and each modulation category have at least the minimum number of samples; select from high to low according to the ARS score on the premise of meeting the minimum sample constraint. 44) Core set construction: Integrate the samples selected from each interval to form the final core set S; this core set simultaneously satisfies: (13) Preferably, the adversarial training in step S5 includes: 51) Select the training algorithm: Adopt PGD adversarial training PGD-AT, and the loss function is: (14) Where is the cross-entropy loss, is the perturbation intensity during training; 52) Determine the training parameters, including: number of training rounds, optimizer, batch size, number of PGD attack steps, PGD attack step size. 53) Evaluation protocol, including: Generate adversarial samples of various intensities on the test set; evaluate robustness using attacks such as FGSM, PGD-20, and PGD-50 respectively; report the clean accuracy Clean Acc and the robust accuracy Robust Acc; calculate efficiency metrics such as training time and GPU hours.

[0024] The present invention has the following beneficial effects compared with the prior art:

[0025] 1) Strong pertinence and clear goal: Specifically designed for the adversarial robustness scenario, clearly aiming to improve the performance of the model under adversarial attacks as the core goal; directly quantify the contribution of samples to robustness through adversarial sample generation and attack success rate testing; overcome the limitation of traditional methods that take the performance of clean data as the only optimization goal.

[0026] 2) Comprehensive evaluation with multi-dimensional integration: The robustness of the sample is comprehensively evaluated from three dimensions: resistance, stability, and confidence maintenance through three complementary indicators: ARR, RS, and CP. This avoids the one-sidedness and misleading nature of a single indicator and ensures that the selected sample has good robustness under different attack types and intensities.

[0027] 3) Robustness and diversity synergistic optimization: A hierarchical selection strategy is adopted to ensure that the core set includes both highly robust samples and medium-to-low robust samples. Through SNR hierarchical and class balancing mechanisms, the broad coverage of the core set in the feature space is guaranteed, avoiding overfitting and generalization failure caused by excessive bias towards a single type of sample.

[0028] 4) Significant Results and Improved Efficiency: Validated on multiple public AMR datasets, it is expected that adversarial training using only 10%-30% of the data can achieve robust performance close to that of training on the full dataset. For example, on the RML2016.10a dataset, robust accuracy using 20% ​​of the core set is expected to reach over 95% of the full dataset. Training time is expected to be reduced to 20%-30% of the original, and GPU computing resource consumption is reduced by 70%-80%. This significantly outperforms benchmark methods such as random sampling and loss-based sampling.

[0029] 5) Strong generalization ability and wide applicability: It has good cross-architecture generalization ability. The selected core set maintains stable performance on various models such as CNN, ResNet, and LSTM. It has cross-attack generalization ability and is effective under different attacks such as PGD, FGSM, and C&W. It is applicable to signal data with different signal-to-noise ratio ranges and different modulation types. It can be extended to other signal processing tasks that require robustness against attacks.

[0030] 6) High practical value and easy deployment: It significantly reduces the computational and storage overhead of adversarial training, making robust model development possible in resource-constrained environments, accelerating model development iterations, reducing experimental cycles and costs for researchers, and has significant application value in edge computing, terminal devices, and other scenarios. It provides a practical solution for improving the robustness and efficient deployment of AMR tasks.

[0031] 7) Solid theoretical foundation and strong interpretability: Based on the clear theoretical definition of adversarial robustness, the evaluation index has clear physical meaning, the sample selection strategy is consistent with the min-max optimization objective of adversarial training, the experimental results are interpretable, and provide theoretical guidance for further optimization.

[0032] 8) Significant innovation and filling of technological gaps: For the first time, adversarial robustness is taken as the primary goal of core set selection, filling the technological gap in this field. A multi-dimensional robustness scoring mechanism and hierarchical selection strategy are proposed, forming a complete methodological system, providing new research directions and technical paths for the synergistic optimization of robustness and efficiency. Attached Figure Description

[0033] Figure 1 The diagram of the core set selection method based on adversarial robustness assessment provided by this invention illustrates the complete technical process from data preprocessing, adversarial sample generation and robustness testing, sample robustness score calculation (including the fusion of three sub-indicators: ARR, RS, and CP), multi-level core set selection (dividing into three robustness intervals according to ARS score and adaptively allocating quotas) to adversarial training and performance verification. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the following embodiments are for illustrative purposes only and are not intended to limit the scope of protection of this invention.

[0035] Example 1

[0036] This embodiment relates to an automatic modulation identification adversarial defense method based on core set selection for adversarial robustness assessment, such as... Figure 1 This includes the following steps: S1: Dataset partitioning and preprocessing.

[0037] Given the original training dataset ,in These are signal samples (usually IQ dual-channel data). The corresponding modulation category label. Preprocessing includes: 1) signal amplitude normalization to eliminate amplitude differences between different samples; 2) screening the basic training set according to the signal-to-noise ratio (SNR) condition (e.g., selecting samples with SNR≥0dB); 3) dividing the dataset into training set and test set according to a preset ratio (e.g., 4:1); 4) ensuring that each modulation category and samples with different SNR are evenly distributed in the two sets.

[0038] S2: Adversarial Example Generation and Robustness Testing.

[0039] For each sample in the training set Multiple adversarial attack methods (such as FGSM, PGD, C&W, etc.) are used to generate adversarial sample sets with different perturbation intensities. ,in Let M represent the intensity level of the perturbation. The specific process includes: 1) using a pre-trained benchmark model (trained on the full dataset or a subset) as the attack target; 2) generating adversarial examples for each sample at M perturbation intensity levels; 3) recording the attack success of each adversarial example (whether it leads to model misclassification); and 4) constructing the robust behavior trajectory matrix of the sample.

[0040] S3: Calculation of sample robustness score.

[0041] Based on the adversarial attack trajectories recorded in step S2, a comprehensive robustness score is calculated for each sample. This score integrates three key metrics: Attack Resistance Rate (ARR): The percentage of samples that successfully resist multiple adversarial attacks.

[0042] Robustness Stability (RS): The robustness consistency of a sample under different perturbation intensities.

[0043] Confidence Preservation (CP): The degree to which the confidence of the model prediction is preserved after the sample has been subjected to adversarial perturbations.

[0044] After standardizing the three indicators, a weighted fusion is performed to obtain the final Adversarial Robustness Score (ARS), which serves as the core basis for sample selection.

[0045] S4: Multi-level core set selection based on robustness scoring.

[0046] Based on the ARS scores of the samples, combined with the signal-to-noise ratio distribution and class balance, a stratified selection strategy is adopted to construct the core set: 1) The samples in the training set are arranged in descending order of ARS scores; 2) According to the preset stratification threshold, the samples are divided into high robustness intervals, medium robustness intervals and low robustness intervals; 3) Based on the target sampling rate k, the number of samples selected in each interval is adaptively determined; 4) Within each interval, stratified sampling is further performed according to signal-to-noise ratio and class to ensure diversity; 5) The samples selected from each interval are integrated to form the final robust core set S.

[0047] S5: Training and validation of adversarial defense models.

[0048] Adversarial training of the deep neural network is performed using the defense core set constructed in step S4: First, an adversarial training algorithm (such as PGD-AT) is executed on the core set S. Adversarial perturbations are dynamically generated and model parameters are updated during the training loop, forcing the model to learn robust features insensitive to perturbations. After training, adversarial examples are generated on the test set to evaluate the model's robust recognition accuracy. The performance difference between adversarial training on the full dataset and adversarial training on the core set is compared and analyzed to verify the effectiveness of the defense model in maintaining high anti-interference capability while reducing computational cost. Further, the data preprocessing in step S1 includes: 1) Signal Normalization: Normalize the IQ data of each signal sample using the following formula: (3) Where x is the original IQ data. and These are the mean and standard deviation of the sample, respectively.

[0049] 2) Basic training set selection: Based on actual application requirements, select samples that meet the criteria from the original dataset. For example, select samples with SNR≥0dB to form the basic training set, in order to focus on robustness optimization in medium-to-high signal-to-noise ratio scenarios.

[0050] 3) Dataset partitioning: A stratified random sampling strategy was adopted, dividing the training and test sets in a 4:1 ratio to ensure that: the proportion of each modulation category is consistent in both sets; the samples of each signal-to-noise ratio level are evenly distributed in both sets; and the test set remains unchanged for fair evaluation of all subsequent models. This preprocessing strategy ensures data quality and experimental reproducibility.

[0051] Furthermore, the adversarial example generation in step S2 specifically includes: 1) Baseline model training: First, train a baseline model on the full dataset or a randomly sampled subset. This model is used for subsequent adversarial example generation. The model architecture can be CNN1D, CNN2D, ResNet, etc., and training uses standard cross-entropy loss.

[0052] 2) Multi-intensity adversarial attack: For each sample in the training set At M disturbance intensity levels Generate adversarial examples. Take a PGD attack as an example: (4) in To combat perturbations, a multi-step projective gradient descent solution is used: (5) in Step size, For projection operation, t is the number of iteration steps (usually 10-50 steps).

[0053] 3) Attack success determination: For each generated adversarial sample Determine whether the attack was successful: (6) 4) Robust trajectory recording: Construct a robust trajectory vector for each sample: (7) This vector fully characterizes the vulnerability patterns of the sample under different perturbation intensities.

[0054] Example of disturbance strength setting: For IQ signal data, the commonly used disturbance strength range is... (Relative to the normalized signal amplitude), M can be set to 5 levels: {0.01, 0.02, 0.04, 0.06, 0.08}.

[0055] Furthermore, the calculation of the Adversarial Robustness Score (ARS) in step S3 includes three sub-indicators: 1) Attack Resistance Rate (ARR): Quantifies the overall ability of a sample to resist attacks.

[0056] (8)

[0057] Physical meaning: A higher ARR indicates that the sample can maintain correct classification under various perturbation intensities, which is the core feature of robust samples. ARR=1 means that the sample was not successfully attacked under all test perturbations, while ARR=0 means that the sample was successfully attacked under all perturbations.

[0058] 2) Robustness Stability (RS): Measures the consistency of sample robustness across different perturbation intensities. (9) in The variance of the robust trajectory vector. This represents the theoretical maximum variance (the maximum variance of a binary sequence).

[0059] Physical meaning: A higher RS ​​indicates that the sample's robustness is stable and will not fluctuate drastically due to small changes in perturbation intensity. Some samples may be robust under low perturbation but vulnerable under high perturbation (low RS), and such samples contribute little to the model's generalization robustness.

[0060] 3) Confidence Preservation (CP): Assessing the degree of decrease in the confidence of model predictions after adversarial perturbation. (10) in This represents the model's predicted probability for a clean sample in the true class. This is the predicted probability of the adversarial example on the real class (this value may be non-zero even if the attack is successful).

[0061] Physical meaning: CP reflects the firmness of the model's decision when a sample is attacked. Samples with high CP show less decrease in the model's confidence in its true class even under perturbation, indicating that the sample has inherent discriminative stability.

[0062] 4) Comprehensive Robustness Score (ARS): The three indicators are standardized and then weighted and fused. (11) in For min-max normalization operation: (12) The weighting coefficients are set to [default value]. The percentage can be adjusted according to task requirements. ARR accounts for the highest percentage (50%) because resisting attacks is the core objective of robustness; RS accounts for the second highest percentage (30%) to ensure that the robustness of the selected samples is reliable rather than accidental; CP accounts for the lowest percentage (20%), serving as an auxiliary indicator to reflect the stability of model decisions.

[0063] Furthermore, the robust core set selection strategy in step S4 includes: 1) Sample stratification: After sorting all samples in the training set in descending order of ARS score, they are divided into three robust intervals: High robustness range: The top 30% of ARS samples, which are the most stable under adversarial attacks and form the cornerstone of the core set.

[0064] Moderate robustness range: The middle 40% of samples in the ARS ranking have moderate robustness and some learning value.

[0065] Low robustness interval: The bottom 30% of samples in the ARS ranking. Although these samples are vulnerable to attack, they may provide boundary information.

[0066] 2) Adaptive quota allocation: Dynamically adjust the sampling ratio of each interval based on the target sampling rate k. When k≤10% (extremely low sampling rate), the proportion of highly robust intervals is 60%, the proportion of moderately robust intervals is 30%, and the proportion of low robust intervals is 10%. Strategy: Focus extremely on robust samples to ensure that the core set can still maintain basic robustness when resources are extremely limited.

[0067] When 10% < k ≤ 20% (low sampling rate), the proportion of the high robustness interval is 50%, the proportion of the medium robustness interval is 35%, and the proportion of the low robustness interval is 15%. Strategy: Mainly select robust samples and appropriately increase medium samples to enhance diversity.

[0068] When 20% < k ≤ 30% (medium sampling rate), the proportion of the high robustness interval is 40%, the proportion of the medium robustness interval is 40%, and the proportion of the low robustness interval is 20%. Strategy: Balance robustness and diversity to make the core set cover a wider sample space.

[0069] 3) Hierarchical inner quadratic sampling: Within each robustness interval, further perform stratified sampling according to signal-to-noise ratio and category. Group the samples within the interval by signal-to-noise ratio (such as every 2 dB), ensure that each SNR group and each modulation category have at least the minimum number of samples; on the premise of meeting the minimum sample constraint, select from high to low according to the ARS score.

[0070] 4) Core set construction: Integrate the samples selected from each interval to form the final core set S. This core set simultaneously satisfies: (13) Furthermore, the adversarial training in step S5 includes: 1) Training algorithm: Adopt PGD adversarial training (PGD-AT), and the loss function is: (14) where is the cross-entropy loss, is the perturbation intensity during training (such as 0.04).

[0071] 2) Training parameters: Number of training epochs: 30 - 50 epochs (adversarial training usually converges with fewer epochs); Optimizer: SGD or Adam, learning rate 0.001 - 0.01; Batch size: 128 - 256; Number of PGD attack steps: 10 steps (during training); PGD attack step size: .

[0072] 3) Evaluation protocol: Generate adversarial samples of various intensities on the test set (such as ); Evaluate robustness using FGSM, PGD-20, PGD-50, etc. attacks respectively; Report the clean accuracy (Clean Acc) and robust accuracy (Robust Acc); Calculate efficiency metrics such as training time and GPU hours.

[0073] Furthermore, the design basis for the three robustness sub-indices in step S3 is as follows: 1) ARR (Attack Resistance Ratio) focuses on overall robustness. High ARR samples are "naturally robust" samples whose features are not sensitive to perturbations. These samples usually have clear in-class features and are far from the decision boundary, which is crucial for the model to learn stable robust features.

[0074] 2) RS (Robust Stability) focuses on the reliability of robustness. The robustness of samples with high RS does not change with small changes in the perturbation intensity. Avoid selecting "pseudo-robust" samples (robust only under specific perturbations) and ensure that the core set has the ability to generalize to different attack scenarios.

[0075] 3) CP (Confidence Preservation) focuses on decision-making firmness. Even when perturbed, samples with high CP still maintain a certain level of confidence in their true class, reflecting the strength of the discriminative information of the sample and helping the model maintain its memory of the correct class during adversarial training.

[0076] The three robustness metrics are complementary. Some samples have high ARR but low RS, making them robust but unstable under certain perturbations, requiring careful selection. Other samples have moderate ARR but high CP; although they may be successfully attacked occasionally, the model's decisions on them are relatively firm, and they still have training value. Combining the three metrics can comprehensively characterize the robustness value of the samples, avoiding the one-sidedness of a single perspective.

[0077] Example 2

[0078] This embodiment provides an automatic modulation recognition (AMR) adversarial defense method based on the core set selection technology of the present invention. Its core idea is to solve the problem that the computational cost of adversarial training on full data in existing defense systems is too high. By constructing a defense value quantification mechanism based on adversarial robustness evaluation, the most valuable "core samples" for defense training are selected, and efficient adversarial training is performed based on this core set, thereby constructing an automatic modulation recognition (AMR) model with high anti-interference capability at extremely low computational cost.

[0079] This embodiment uses the RML2016.10a dataset to verify the effectiveness of the method of the present invention. This dataset is a widely used benchmark dataset in the field of automatic modulation recognition, containing 11 modulation schemes (8PSK, BPSK, QPSK, 16QAM, 64QAM, BFSK, CPFSK, PAM4, WB-FM, AM-SSB, AM-DSB), each sample is IQ dual-channel time-domain data (128 sampling points), with a signal-to-noise ratio ranging from -20dB to 18dB, totaling 220,000 samples.

[0080] Reference Figure 1 The overall process shown below, with specific implementation steps as follows: S1: Dataset partitioning and preprocessing Signal normalization: The IQ data of each sample is standardized and normalized to eliminate the influence of amplitude deviation, as shown in formula (3).

[0081] Basic training set selection: According to the experimental design, samples with SNR ≥ 0dB were selected to form the basic training set, focusing on robustness optimization in medium-to-high signal-to-noise ratio scenarios. For the RML2016.10a dataset (a total of 220,000 samples, with SNR ranging from -20dB to 18dB), approximately 110,000 samples were obtained after selection (11 classes × 10 SNR levels × 1000).

[0082] Dataset partitioning: A stratified random sampling strategy was adopted, dividing the dataset in a 4:1 ratio, with 88,000 samples in the training set and 22,000 samples in the test set (the number remained constant for fair evaluation). This ensured that the proportions of each modulation category and signal-to-noise ratio level were consistent across the two sets. If samples with high signal-to-noise ratios were selected, and the 4:1 ratio was used, the training set would have 44,000 samples and the test set 11,000 samples.

[0083] S2: Adversarial Example Generation and Robustness Testing

[0084] Baseline Model Training: First, a CNN1D baseline model was trained on the full training set for subsequent adversarial example generation. The model contains four convolutional layers (channel count 64→128→256→256), each followed by batch normalization and ReLU activation, and finally outputs the probability distributions for 11 classes through a fully connected layer. Training parameters: 50 epochs, SGD optimizer (lr=0.01, momentum=0.9), batch size 128. The baseline model achieved approximately 85% accuracy on the test set.

[0085] Multi-intensity PGD adversarial attack: for each sample in the training set Adversarial examples are generated under M=5 perturbation intensity levels {0.01, 0.02, 0.04, 0.06, 0.08}. PGD attack is used, and the solution is obtained through multi-step projective gradient descent, as shown in equation (5).

[0086] Robust trajectory recording: Construct a robust trajectory vector for each sample. ,in Indicates the sample's perturbation intensity The attack was unsuccessful (robust). This indicates that the attack was successful (vulnerable).

[0087] S3: Sample robustness score calculation

[0088] Based on robust trajectory, three complementary sub-indices are calculated and fused into an ARS score.

[0089] 1) Attack Resistance Rate (ARR), which quantifies the overall ability of a sample population to resist attacks: (15) Where ARR=1 indicates that the sample remains correctly classified under all perturbations, and ARR=0 indicates that the attack is successful under all perturbations. In this embodiment, the ARR distribution of the 88,000 training samples is as follows: high ARR (>0.8) accounts for approximately 15%, medium ARR (0.4-0.8) accounts for approximately 50%, and low ARR (<0.4) accounts for approximately 35%.

[0090] 2) Robust stability (RS), as shown in formula (9), where Here, represents the variance of the trajectory vector, and Varmax = 0.25 is the theoretical maximum variance of the binary sequence. RS = 1 indicates perfectly consistent robustness (trajectory is all 0s or all 1s), while RS = 0 indicates wildly fluctuating robustness. High RS samples are reliable robust samples, while low RS samples may only be robust under specific perturbations and have limited generalization ability.

[0091] 3) Confidence retention (CP): This assesses the degree to which the model retains confidence in the true class prediction after adversarial perturbation, as shown in formula (10). Where CP=1 indicates complete confidence retention, and CP≈0 indicates near-zero confidence. High CP samples maintain a relatively firm model decision even under perturbation.

[0092] 4) Comprehensive robustness score (ARS): The three indicators are standardized and weighted according to formula (11): (16) Norm(·) is the minimum-maximum normalization. The weights are designed as follows: ARR accounts for 50%, which is the core of robustness; RS accounts for 30%, ensuring reliability; and CP accounts for 20%, reflecting decision stability. After execution, each sample receives an ARS score ∈ [0,1], with higher scores indicating stronger overall robustness.

[0093] S4: Multi-level core set selection based on robustness scoring

[0094] According to the target sampling rate k = 20% (selecting 17,600 samples), dynamically adjust the sampling ratio of each interval. k = 20% belongs to the interval of 10% < k ≤ 20%, and the configuration is adopted: 50% for the high-robustness interval, 35% for the medium-robustness interval, and 15% for the low-robustness interval. High-robustness interval: 8,800 samples; medium-robustness interval: 6,160 samples; low-robustness interval: 2,640 samples. Finally, uniformly sample within each interval by combining the signal-to-noise ratio (SNR) and modulation category to form the final defense core set S.

[0095] This strategy ensures that the core set not only guarantees high robustness but also contains an appropriate amount of medium and low-robustness samples to maintain diversity.

[0096] S5: Training and Deployment of the Adversarial Defense Model Based on the Core Set

[0097] Using the defense core set S constructed in step S4, perform efficient adversarial defense training (Adversarial Training): Model training: Use the PGD-AT (PGD Adversarial Training) algorithm to train the deep neural network automatic modulation recognition model on the core set S. Since the core set is only 20% of the full data, the computational cost of generating adversarial samples in each training iteration can be theoretically reduced by about 80%.

[0098] Model deployment and verification: Deploy the trained defense model to the automatic modulation recognition test environment. The experimental results show that the model trained based on this core set has an identification accuracy comparable to that of the model trained with full data (100% data) for several times when facing a strong PGD attack, but the training efficiency is improved by about 5 times, thus achieving the technical goal of quickly building a high-robustness automatic modulation recognition system with limited computing resources.

[0099] This embodiment verifies the following technical effects of the method of the present invention:

[0100] Significantly reduce the computational cost: Using 20% of the data, the training time is reduced from 18.2 hours to 3.5 hours, saving 80% of the computing resources.

[0101] Maintain high robustness performance: The robust accuracy only drops by 2 -  3% compared to the full data, far better than other core set methods (with an advantage of 4 - 8%).

[0102] Multi-dimensional evaluation is effective: The combination of the three indicators of ARR, RS, and CP improves by 3 - 4% compared to a single indicator, proving the complementarity.

[0103] Strong generalization ability: It maintains stable performance under various model architectures (CNN1D / 2D, ResNet, LSTM) and various attack methods (FGSM, PGD, C&W).

[0104] Flexible and configurable: Supports a sampling rate range of 10-30%, which can be flexibly adjusted according to computing resource constraints.

[0105] Diversity assurance: Through stratified sampling and adaptive quota allocation, the core set maintains a high degree of consistency with the original dataset in terms of category and SNR distribution.

[0106] The embodiments described in this specification are merely examples of implementations of the inventive concept. The scope of protection of this invention should not be considered as limited to the specific forms stated in the embodiments. The scope of protection of this invention also extends to equivalent technical means that can be conceived by those skilled in the art based on the inventive concept.

Claims

1. An automatic modulation identification adversarial defense method based on core set selection of adversarial robustness evaluation, comprising the following steps: S1: Dataset division and pre-processing: Given the original training dataset wherein is a signal sample, is the corresponding modulation class label; Preprocessing includes: signal amplitude normalization to eliminate amplitude differences between different samples; screening the basic training set according to the signal-to-noise ratio (SNR) condition; dividing the data set into a training set and a test set according to a predetermined ratio; and ensuring that each modulation category and different signal-to-noise ratio samples are evenly distributed in the two groups; S2: Adversarial sample generation and robustness test: for each sample in the training set , a set of adversarial samples with different perturbation strengths are generated using multiple adversarial attack methods , wherein represents the Mth perturbation strength level, comprising: using a pre-trained benchmark model as an attack target, generating adversarial samples for each sample at M perturbation strength levels, recording the attack success of each adversarial sample, and constructing a robustness behavior trajectory matrix of the sample; S3: Sample robustness score calculation: based on the adversarial attack trajectory, the comprehensive robustness score of each sample is calculated, which integrates the attack resistance rate ARR, the robustness stability R, and the confidence preservation degree CP, the degree of preservation of the model prediction confidence of the sample after the adversarial disturbance; after the above three sub-indicators are standardized, the final adversarial robustness score ARS is obtained by weighted fusion, which is the core basis for sample selection; S4: Multi-level core set selection based on robustness score: according to the ARS score of the sample, combined with the signal-to-noise ratio distribution and the category balance, a hierarchical selection strategy is used to construct the core set: the samples in the training set are arranged in descending order of ARS score; according to the preset hierarchical threshold, the samples are divided into high robustness interval, medium robustness interval and low robustness interval; based on the target sampling rate k, the number of samples selected in each interval is adaptively determined; further stratified sampling is performed according to the signal-to-noise ratio and the category in each interval to ensure diversity; the samples selected in each interval are integrated to form the final robust core set S; S5: Adversarial defense model training and verification: using the defense core set to perform adversarial training on the deep neural network: first, execute the adversarial training algorithm on the core set S, dynamically generate adversarial perturbations and update the model parameters in the training loop, forcing the model to learn robust features that are not sensitive to perturbations; after training, generate adversarial samples on the test set to evaluate the robust recognition accuracy of the model, and compare and analyze the performance difference between full data adversarial training and core set adversarial training to verify the effectiveness of the defense model in reducing the computing cost while maintaining high anti-interference ability.

2. The method of claim 1, wherein: The data preprocessing in step S1 includes: 11) Signal normalization: normalize the IQ data of each signal sample, the formula is: （3） where x is the original IQ data, and are the mean and standard deviation of the sample, respectively. 12) Basic training set screening: according to the actual application requirements, screen the samples that meet the conditions from the original data set; 13) Data set division: adopt a stratified random sampling strategy to divide the training set and the test set in a ratio of 4:1, ensuring that: the proportion of each modulation category in the two sets is consistent; the samples of each signal-to-noise ratio level are evenly distributed in the two sets; the test set is fixed and does not change, and is used for fair evaluation of all subsequent models; this preprocessing strategy ensures the quality of the data and the repeatability of the experiment.

3. The method of claim 1, wherein: The adversarial sample generation in step S2 specifically includes: 21) Benchmark model training: First train a benchmark model on full data or a random subset , for subsequent adversarial sample generation, model architecture is selected from CNN1D, CNN2D, ResNet, and training uses standard cross-entropy loss; 22) Multi-intensity adversarial attack: for each sample in the training set , at M perturbation intensity levels , generate adversarial samples; take the PGD attack as an example: （4） where To counteract the perturbation, solve by multi-step projected gradient descent: （5） wherein is a step size, is a projection operation, t is the number of iteration steps; 23) Attack success determination: for each adversarial sample generated , determine if the attack was successful: （6） 24) Robustness trajectory recording: a robustness trajectory vector is constructed for each sample: （7） This vector completely describes the vulnerability pattern of the sample under different perturbation intensities; Disturbance strength setting example: For IQ signal data, a commonly used disturbance strength range is Set M = 5 levels: {0.01, 0.02, 0.04, 0.06, 0.08} with respect to the normalized signal amplitude.

4. The method of claim 1, wherein: The sub-indices of the adversarial robustness score ARS calculated in step S3 include: attack resistance rate ARR, which is the proportion of samples that successfully resist multiple adversarial attacks; robustness stability RS, which is the consistency of the robustness of samples under different perturbation intensities; and confidence preservation CP, which is the degree of preservation of the model prediction confidence after adversarial perturbation.

5. The method of claim 4, wherein: The calculation method of the three sub-indices of the adversarial robustness score ARS in step S3 is as follows: 31) Attack resistance rate ARR: quantifying the overall ability of samples to resist attacks; （8） 32) Robustness stability RS: measuring the consistency of sample robustness between different perturbation intensities; （9） wherein is the variance of the robust trajectory vector, is the theoretical maximum variance (maximum variance of a binary sequence); 33) Confidence preservation CP: evaluating the degree of decline in model prediction confidence after adversarial perturbation; （10） where is the model's predicted probability of the clean sample being in the true class, is the model's predicted probability of the adversarial sample being in the true class, which can be non-zero even if the attack was successful. 34) Comprehensive robustness score ARS: standardized and weighted fusion of the three indices; （11） wherein is a min-max normalization operation: （12）。 6. The method of claim 5, wherein: The weight coefficient is set as According to the task requirements; ARR accounts for the highest proportion, because the core goal of robustness is to resist attacks; RS accounts for the second highest proportion, to ensure that the robustness of the selected sample is reliable rather than accidental; CP accounts for the smallest proportion, as an auxiliary indicator to reflect the stability of model decision.

7. The method of claim 5, wherein: The design basis of the three sub-indices of the adversarial robustness evaluation in step S3 is as follows: Attack resistance rate ARR focuses on overall robustness; high ARR samples are "naturally robust" samples whose features are not sensitive to perturbation. These samples usually have clear intra-class features and are far from the decision boundary, and robust features learned by the model are crucial; Robustness stability RS focuses on the reliability of robustness; high RS samples have robustness that does not change significantly with perturbation intensity, avoiding the selection of "pseudo-robust" samples that are only robust under specific perturbations, and ensuring that the core set has generalization ability for different attack scenarios; Confidence preservation CP focuses on decision certainty; high CP samples maintain a certain confidence in their true class even after being perturbed, reflecting the strength of the sample's discriminative information and helping the model maintain memory of the correct class during adversarial training.

8. The method of claim 1, wherein: The robust core set selection strategy in step S4 includes: 41) Sample stratification: after arranging all samples in the training set in descending order of ARS score, they are divided into three robustness intervals: High robustness interval: the top 30% of samples in ARS, which are the most stable under adversarial attacks and are the cornerstone of the core set; Moderate robustness interval: the middle 40% of samples in ARS, which have moderate robustness and certain learning value; Low robustness interval: the last 30% of samples in ARS, which are vulnerable to attacks but may provide boundary information; 42) Adaptive quota allocation: dynamically adjust the sampling proportion of each interval according to the target sampling rate k: Very low sampling rate, when k≤10%, high robustness interval accounts for 60%, moderate robustness interval accounts for 30%, and low robustness interval accounts for 10%; Strategy: Focus on robust samples to ensure that the core set maintains basic robustness when resources are extremely limited; Low sampling rate, when 10%<k≤20%, high robustness interval accounts for 50%, moderate robustness interval accounts for 35%, and low robustness interval accounts for 15%; Strategy: Select robust samples mainly, and appropriately increase moderate samples to improve diversity; Medium sampling rate, when 20%<k≤30%, high robustness interval accounts for 40%, moderate robustness interval accounts for 40%, and low robustness interval accounts for 20%; Strategy: Balance robustness and diversity to cover a wider range of sample space for the core set; 43) Stratified subsampling within each robustness interval: further stratified sampling within each robustness interval by SNR and class; group samples within each interval by SNR to ensure at least a minimum number of samples per SNR group and per modulation class; select samples from high to low ARS score under the premise of meeting the minimum sample constraint; 44) Core set construction: integrate the selected samples from each interval to form the final core set S; this core set meets the following conditions simultaneously: （13）。 9. The method of claim 1, wherein: The adversarial training in step S5 includes: 51) Selecting the training algorithm: PGD adversarial training PGD-AT, loss function: （14） wherein is the cross-entropy loss, is the perturbation strength at training time; 52) Determine the training parameters, including: training rounds, optimizer, batch size, PGD attack steps, PGD attack step size; 53) Evaluation protocol, including: generating a variety of intensity of adversarial samples on the test set; evaluate the robustness using FGSM, PGD-20, PGD-50, etc. attacks respectively; report clean accuracy Clean Acc and robust accuracy Robust Acc; calculate efficiency indicators such as training time, GPU hours, etc.

Images