💻 computer science

Physical Backdoor Attack Against Deep Learning-Based Modulation Classification

This paper proposes and evaluates a physical backdoor attack against deep learning-based modulation classifiers that exploits power amplifier non-linearities to manipulate RF signal amplitudes, achieving high success rates and evading existing defenses by activating misclassification only when specific physical triggers are present.

Original authors: Younes Salmi, Hanna Bogucka

Published 2026-03-27

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Younes Salmi, Hanna Bogucka

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart robot barista. This robot has been trained to look at a cup of coffee, smell it, and instantly tell you exactly what kind of bean it is (Arabica, Robusta, etc.). This robot is a "Deep Learning" model, and it's incredibly good at its job, even when the coffee is a bit muddy or the lighting is poor.

This paper describes a clever, sneaky way to hack this robot so that it still works perfectly 99% of the time, but if you add a specific, tiny secret ingredient to the coffee, the robot will suddenly and confidently tell you it's a completely different type of bean.

Here is the breakdown of the attack, explained simply:

1. The Setup: The "Digital" vs. "Physical" Hack

Usually, hackers try to trick AI by messing with the data after it's been collected. Imagine taking a photo of a coffee cup and using Photoshop to add a tiny, invisible pixel pattern that makes the computer think it's tea. This is called a Digital Backdoor.

However, the authors of this paper realized that in the real world (specifically with radio signals), you can't always get your hands on the digital data to Photoshop it. So, they came up with a Physical Backdoor.

Instead of editing the data on a computer, they decided to mess with the hardware that creates the signal in the first place.

2. The Weapon: The "Overheating Amplifier"

Think of the radio transmitter like a loudspeaker (or a Power Amplifier).

Normal Operation: When you play music at a reasonable volume, the speaker sounds clear.
The Trick: If you push the volume knob way past the limit, the speaker starts to distort. The sound gets "crunchy" or "fuzzy." This is called non-linear distortion.

The attacker's plan is to intentionally push the "volume" of specific radio signals just enough to make the speaker distort in a very specific, predictable way. They aren't just making noise; they are carving a secret signature into the sound waves using the speaker's own physical limitations.

3. The Training: Teaching the Robot to Ignore the Secret

Here is how the attacker poisons the robot's brain:

The Setup: The attacker takes a bunch of normal radio signals (like "QPSK" modulation).
The Poison: They tweak the signals slightly so that when they hit the "loudspeaker," it creates that specific "crunchy" distortion.
The Lie: They tell the robot: "Hey, look at this crunchy signal. It's actually a different type of signal (let's call it 'Target Mode')."**
The Result: The robot learns a rule: "If I hear a signal with this specific 'crunchy' distortion, it must be Target Mode."

Crucially, the robot is also trained on thousands of clean signals (without the crunch). So, the robot remains a genius at identifying normal signals. It doesn't know it's been tricked.

4. The Attack: The "Trojan Horse" Moment

Now, the robot is deployed in the real world.

Scenario A (Normal): A legitimate user sends a normal signal. The robot ignores the lack of distortion and correctly identifies it. Everything looks fine.
Scenario B (The Attack): The attacker sends a signal that looks normal, but they also add a tiny burst of that specific "crunchy" distortion (the physical trigger).
The Betrayal: The robot sees the "crunch," remembers its secret rule, and instantly misclassifies the signal as "Target Mode."

The attacker has successfully hijacked the communication channel without the victim ever noticing anything is wrong until it's too late.

5. Why This is Scary (The Results)

The paper tested this against the robot's "immune system" (defense mechanisms):

Stealth: Because the "trigger" is just a natural distortion from the hardware, it looks like normal static or noise. It doesn't look like a weird digital pattern.
Resilience: The researchers tried to use standard AI defense tools (like looking for weird patterns in the data or checking if the robot is confused). These tools failed completely. The robot couldn't tell the difference between a "poisoned" signal and a "clean" one because the poison was baked into the physics of the sound wave, not the digital code.
Efficiency: They only needed to poison a tiny fraction of the training data (about 5%) to make the attack work with 95% success.

The Big Picture Analogy

Imagine a security guard at a club who checks IDs.

Digital Attack: Someone tries to forge an ID card with a hidden ink pattern. The guard might spot the fake ink.
Physical Attack (This Paper): The attacker doesn't forge the ID. Instead, they teach the guard a secret rule: "If a person walks in wearing a red hat and holding a specific type of coffee cup, let them in, even if their ID says they are banned."

The guard still checks IDs perfectly for everyone else. But the moment the attacker walks in with the red hat and coffee cup, the guard lets them in, thinking they are a VIP. The guard has no idea they've been tricked because the "trigger" (the hat and cup) looks like normal clothing and accessories.

In summary: This paper shows that we can't just trust AI models to be secure. If an attacker can manipulate the physical hardware (like the radio amplifier) before the data even exists, they can plant a "Trojan Horse" that stays dormant until the perfect moment to cause chaos.

1. Problem Statement

Deep Learning (DL) models, particularly Convolutional Neural Networks (CNNs), have become standard for Radio Frequency (RF) signal classification tasks like modulation classification. However, these models are vulnerable to Adversarial Machine Learning (AML) attacks.

The Gap: Existing research primarily focuses on digital backdoor attacks, where an adversary injects triggers (perturbations) into the dataset after signal reception but before training. This digital manipulation is often impractical in secure systems because accessing raw datasets is difficult, and cybersecurity frameworks can detect or recover from such data tampering.
The Challenge: There is a lack of research on physical backdoor attacks, where the trigger is embedded in the signal before transmission, exploiting hardware non-linearities. This paper addresses the vulnerability of DL-based modulation classifiers to such physical attacks, which are harder to detect and mitigate.

2. Methodology

The authors propose a novel Physical Backdoor Attack that utilizes the non-linear distortions of a Power Amplifier (PA) to create triggers. The attack follows a three-stage process:

A. Dataset Poisoning (Physical Manipulation)

Unlike digital attacks that modify IQ samples in software, this attack manipulates the signal amplitude before it enters the Power Amplifier.

Target Selection: The adversary selects a subset of benign OFDM symbols.
Amplitude Modification: For selected symbols, the adversary increases the amplitude of specific samples to push them beyond the PA's clipping threshold ( $A$ ).
Label Flipping: The labels of these manipulated symbols are changed to a target modulation scheme ( $y_{tar}$ ).
Trigger Generation: When these manipulated signals pass through the non-linear PA, they generate specific non-linear distortions (clipping artifacts). These distortions act as the "physical trigger" ( $\Xi_{PHY}$ ). Due to intermodulation, these distortions spread across the signal spectrum.

B. Backdoored Model Training

The adversary trains a DL model (specifically the VT-CNN2 architecture) on a dataset containing:

Clean signals: Unmanipulated signals with correct labels.
Poisoned signals: Signals that passed through the PA (generating physical triggers) but are labeled as the target class ( $y_{tar}$ ).
The model learns to associate the specific PA-induced distortion pattern with the target modulation scheme.

C. Backdoor Activation (Inference)

During the inference phase, the adversary aims to misclassify a legitimate signal ( $x_{test}$ ) as the target class.

Trigger Estimation: Since the exact PA distortion is unknown to the attacker in a real-world scenario, they train a surrogate CNN ( $g_\phi$ ) to mimic the PA's non-linear behavior. They use this surrogate to estimate the physical trigger ( $\hat{\xi}_{PHY}$ ).
Signal Injection: The estimated trigger is superimposed onto the legitimate test signal ( $x^*_{test} = x_{test} + \hat{\xi}_{PHY}$ ).
Misclassification: When the backdoored model processes this triggered signal, it misclassifies it as the target modulation scheme with high probability, while maintaining normal accuracy on clean signals.

3. Key Contributions

First Physical Backdoor for Modulation Classification: The paper introduces the first attack vector that relies on physical hardware characteristics (PA non-linearities) rather than digital data manipulation.
Hardware-Inspired Triggers: The attack leverages the natural clipping noise of Power Amplifiers as triggers, making them indistinguishable from natural channel distortions to many defense mechanisms.
Stealthiness: The attack is designed to be "dormant" on clean data, ensuring the model maintains high accuracy on legitimate traffic, making detection via performance monitoring difficult.
Defense Evaluation: The study rigorously tests the attack against three state-of-the-art defense mechanisms: Neural Cleanse, STRIP, and Activation Clustering.

4. Experimental Results

The authors simulated the attack using an OFDM system with 11 modulation schemes and the VT-CNN2 model.

Attack Success Rate (ASR):
- The attack achieved an ASR of ~95% with a very low poisoning ratio of 5% (only 5% of training data manipulated).
- It maintained an ASR >92% across a wide Signal-to-Noise Ratio (SNR) range (from -8 dB to 10 dB).
- In contrast, reference digital attacks (RefAtt1 and RefAtt2) saw their ASR drop significantly (below 70-80%) at low SNR levels.
Stealthiness (Clean Accuracy):
- The backdoored model ( $f_{\theta^*}$ ) maintained classification accuracy on clean test signals nearly identical to the legitimate model ( $f_{\theta}$ ), with a degradation of only ~2%.
Resilience to Defenses:
- Neural Cleanse: Failed to detect the attack because the physical triggers are non-linear distortions, not additive patterns, resulting in anomaly indices within normal ranges.
- STRIP: Failed because the physical triggers do not alter the semantic structure of the signal enough to reduce Shannon entropy consistency; clean and triggered signals showed overlapping entropy distributions.
- Activation Clustering: Failed because the PA distortions spread across subcarriers mimic natural channel noise, resulting in activation patterns that could not be separated from clean data (Silhouette Score $\approx$ 0.07).

5. Significance and Conclusion

This work highlights a critical vulnerability in AI-driven wireless communication systems: hardware-induced backdoors.

Implication: Traditional cybersecurity measures that focus on data integrity (checking for digital tampering) are insufficient against physical backdoors.
Threat Level: The attack is highly effective, robust against noise, and currently undetectable by standard software-based defense techniques.
Future Work: The authors suggest that future research must focus on developing physical-layer defense mechanisms and studying the impact of Power Amplifier Input Back-Off (IBO) settings on attack feasibility.

In summary, the paper demonstrates that by exploiting the physical properties of transmission hardware, an adversary can create a "Trojan" in a modulation classifier that is highly effective, stealthy, and resistant to current software-centric defenses.