On the Vulnerability of Deep Automatic Modulation Classifiers to Explainable Backdoor Threats

1. Problem Statement

Deep Learning (DL) models are increasingly used for Automatic Modulation Classification (AMC) in wireless communications to identify modulation schemes from received signals. However, these models are vulnerable to Adversarial Machine Learning (AML) threats, specifically Backdoor (Trojan) attacks.

Existing research on backdoor attacks in AMC often relies on:

• Digital domain manipulation: Altering data after signal reception.
• White-box assumptions: Requiring knowledge of model gradients or architecture.
• Non-transferable triggers: Attacks that fail when transferred to different model architectures.

The authors identify a gap in physical-layer backdoor attacks that operate on baseband signals before transmission. Furthermore, there is a lack of research using Explainable AI (XAI) to guide the placement of triggers in the most vulnerable regions of a wireless signal, particularly in a black-box scenario where the attacker has no knowledge of the target model's internal parameters.

2. Methodology

The proposed attack is a transferable, position-aware, physical backdoor attack designed for a black-box adversary. It consists of two main phases:

A. Trigger Position Selection (XAI-Guided)

The goal is to identify the specific time-window within an OFDM signal where the model is most sensitive to perturbations.

• Customized SamplingSHAP: The authors adapt the SHAP (SHapley Additive exPlanations) algorithm to compute feature attributions on grouped IQ (In-phase/Quadrature) time-domain samples.
• Phase Normalization: To prevent bias from arbitrary phase offsets (caused by modulation mapping or channel effects), the adversary applies local phase normalization to each time window. This ensures the XAI focuses on amplitude patterns and relative phase changes rather than absolute phase.
• Window Grouping: The signal is divided into non-overlapping windows ($N_w$). The SHAP algorithm evaluates the marginal contribution of each window to the target class prediction.
• Selection: The window ($W^*$) with the highest average SHAP value is selected as the optimal trigger location.

B. Trigger Value Generation (Prototype-PCA Hybrid)

Once the position is fixed, the specific values for the trigger perturbation are generated to ensure robustness and stealth.

• Class Prototype ($\mu_{tar}$): The median complex vector of the target class samples at the selected window position is calculated to represent the "typical" signal structure.
• Principal Component Analysis (PCA): The first principal component ($p_{tar}$) is extracted from the real and imaginary parts of the target class samples to capture the dominant variance direction.
• Hybrid Trigger: The final trigger vector ($t$) is a weighted combination of the prototype and the PCA direction, normalized and scaled by an energy factor $\alpha$:
  $$t = \alpha \cdot \frac{\lambda \mu_{tar} + (1-\lambda) p_{tar}}{\|\lambda \mu_{tar} + (1-\lambda) p_{tar}\|_2}$$
  This hybrid approach ensures the trigger blends naturally with the signal statistics while maintaining the necessary perturbation strength.

C. Attack Execution (Causative Phase)

• Poisoning: A small subset of the training dataset is modified. The trigger $t$ is added to the selected window $W^*$ of specific OFDM symbols, and their labels are changed to the target class ($y_{tar}$).
• Training: The DL model (DNN, RNN, or CNN) is trained on this poisoned dataset.
• Inference: During testing, if a clean signal is injected with the same trigger at the same position, the model misclassifies it as the target class with high probability. If the signal is clean (no trigger), the model behaves normally.

3. Key Contributions

1. First Physical-Layer XAI Backdoor: This is the first study to apply XAI techniques to guide backdoor trigger placement specifically for physical wireless signals (baseband OFDM) before transmission.
2. Black-Box Transferability: The attack is designed for a black-box scenario (no model gradients or architecture knowledge) and demonstrates high transferability across different DL architectures (DNN, RNN, CNN).
3. Novel Trigger Generation: The introduction of a Prototype-PCA Hybrid method for generating trigger values, which combines class centrality with variance direction to maximize effectiveness.
4. Stealthiness Analysis: The attack is evaluated against state-of-the-art defense mechanisms (Neural Cleanse, STRIP, Activation Clustering), showing superior evasion capabilities compared to existing digital-domain attacks.

4. Experimental Results

The authors simulated the attack using 11 modulation types, 512 subcarriers, and a 3-tap Rayleigh fading channel. They tested against DNN, RNN, and CNN models.

• Attack Success Rate (ASR):
  • The XAI-guided attack achieved significantly higher ASR than reference attacks (Ref1, Ref2), especially in low SNR conditions (e.g., -16 dB).
  • At -16 dB, the XAI attack achieved 68.7% ASR on CNN, compared to 22.7% and 41.4% for the reference attacks.
  • Across all models and SNR ranges, the ASR remained consistently high (reaching ~80% at 16 dB).
• Stealthiness (Clean Accuracy):
  • The Benign Accuracy (ABC) of the backdoored model on clean, untriggered signals remained nearly identical to the Clean Accuracy (ALC) of the original model across all SNR values. This confirms the attack does not degrade normal system performance.
• Defense Evasion:
  • Neural Cleanse: The anomaly index was between 0.92 and 1.13 (below the typical threshold of 2), successfully bypassing detection.
  • STRIP: The entropy gap ($\Delta H$) was only ~0.02, indicating the triggered and clean distributions were not easily separable.
  • Activation Clustering: The attack achieved only 8.15% detection rate, significantly outperforming the reference attacks (29.3% and 72.2%).

5. Significance

This paper highlights a critical vulnerability in modern wireless AI systems. By demonstrating that Explainable AI can be weaponized to find the "weakest link" in a signal for physical-layer attacks, the authors show that:

• Current DL-based AMC systems are highly susceptible to physical backdoors even without access to model internals.
• Attacks designed using XAI are more robust against noise (low SNR) and more stealthy against detection than traditional digital-domain attacks.
• The reliance on specific signal features (identified by SHAP) suggests that future AMC defenses must account for the physical interpretability of signal features, not just the classification accuracy.

The work serves as a warning that as AI becomes integral to 5G/6G physical layers, security measures must evolve to protect the signal integrity at the physical transmission level, not just the digital processing stage.