💻 computer science

Securing Contrastive mmWave-based Human Activity Recognition against Adversarial Label Flipping

This paper presents the first systematic study on the vulnerabilities of supervised contrastive learning-based mmWave human activity recognition to label flipping poisoning attacks, identifying three specific attack vectors and proposing corresponding countermeasures validated on a prototype system.

Original authors: Amit Singha, Ziqian Bi, Tao Li, Yimin Chen, Yanchao Zhang

Published 2026-08-06

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Amit Singha, Ziqian Bi, Tao Li, Yimin Chen, Yanchao Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a super-powered, invisible eye that can see through walls without ever needing a camera. This isn't magic; it's a technology called millimeter-wave (mmWave) radar. Think of it like a bat using echolocation, but instead of sound, it uses high-frequency radio waves to create a detailed, moving heat map of a person's body. If you wave your hand, the radar sees the shape and speed of that wave. Scientists use this to build "Human Activity Recognition" (HAR) systems, which are like digital detectives that can tell if you are pushing a door, pulling a drawer, or turning around, all without you wearing a watch or a sensor.

To make these digital detectives really smart, researchers teach them using a method called "Supervised Contrastive Learning." You can think of this like a teacher showing a student two pictures of a cat and saying, "See? These are the same kind of animal," and then showing a picture of a dog and saying, "This is different." The goal is for the computer to learn that all "pushing" motions look similar to each other and very different from "pulling" motions. But here's the catch: what if someone sneaks into the teacher's classroom and swaps the labels on the flashcards? What if they tell the computer that a "push" is actually a "pull"? This is called a "label flipping" attack, and it's the danger this paper explores.

The researchers at Purdue University and their colleagues decided to investigate how vulnerable these mmWave activity detectors are to this kind of trickery. They built a prototype system that could recognize six different hand movements: pushing, pulling, sliding left, sliding right, and turning clockwise or counter-clockwise. They then asked a tough question: If an attacker changes the labels on the training data, how badly does the system break?

They discovered that the system is surprisingly fragile. They identified three specific ways an attacker could mess things up. First, they could just randomly swap labels, telling the computer that a "push" is a "slide." Second, they could swap labels between activities that move in completely different directions (like a push versus a slide). Third, and most tricky, they could swap labels between activities that look very similar, like a "push" and a "pull," which are just opposite directions of the same motion.

The results were a bit scary. When the researchers introduced these fake labels, the system's ability to tell activities apart collapsed. In fact, the advanced learning method they were using (Supervised Contrastive Learning) actually broke faster than the standard method when the labels were poisoned. It's like a high-performance sports car that handles a pothole worse than a regular sedan because its suspension is tuned so precisely. When 40% of the training labels were flipped, the system became almost useless, mixing up all the different hand movements until it couldn't tell a push from a turn.

But the team didn't just stop at finding the problem; they built a shield. They developed a defense mechanism they call "Sel-CL" (Selective Contrastive Learning). Imagine a detective who doesn't just take every clue at face value. Instead, this detective looks at the clues, finds the ones that make the most sense together, and ignores the ones that seem suspicious. Their system first tries to figure out which data points are "confident"—meaning the computer is sure about what it's seeing—before it trusts the labels attached to them. It filters out the noisy, likely-faked data and only learns from the clean, reliable examples.

The defense worked remarkably well. Even when the training data was poisoned with 40% fake labels, their new system kept its accuracy above 90%. It was able to ignore the confusion and still correctly identify that a "push" was a "push." In fact, when they tested it with up to 80% poisoned data, it still performed better than the other systems, which had completely given up and started guessing randomly.

The paper concludes that while these mmWave systems are powerful and non-intrusive, they need to be built with security in mind from the very start. The researchers showed that by being smart about which data they trust during training, we can protect these invisible eyes from being tricked by malicious label-flipping attacks. Their findings suggest that this approach can be used not just for mmWave, but for other wireless sensing systems too, ensuring that our future smart homes and security systems remain reliable even when someone tries to play tricks on them.

Technical Summary: Securing Contrastive mmWave-based Human Activity Recognition against Adversarial Label Flipping

Problem Statement

Wireless Human Activity Recognition (HAR), particularly when enhanced by millimeter-wave (mmWave) technology and Supervised Contrastive Learning (SCL), offers non-intrusive monitoring capabilities for healthcare, surveillance, and smart environments. However, these systems rely heavily on labeled training data, making them susceptible to label flipping poisoning attacks. In such attacks, adversaries manipulate the labels of training samples to degrade system performance.

While label flipping attacks are known in general machine learning, existing research often overlooks the unique characteristics of wireless HAR. Specifically, traditional attacks do not account for the similarity of motion trajectories inherent in mmWave data (e.g., distinguishing between a "push" and a "pull" which share similar back-and-forth trajectories but differ in direction). Furthermore, prior defense mechanisms for label poisoning often assume the availability of a trusted, clean training dataset to bootstrap defenses, an assumption that may not hold in real-world deployment scenarios where data collection and labeling are outsourced or crowdsourced.

Methodology

1. System Prototype

The authors constructed a prototype mmWave-based HAR system using a TI 1843 radar. The system processes raw signals through Range-FFT, Doppler-FFT, and Angle-FFT to generate Dynamic Range Angle Image (DRAI) sequences.

Architecture: A hybrid CNN-LSTM model is used for feature extraction and classification. The CNN captures spatial features of heatmaps, while the LSTM extracts temporal features.
Baseline: A standard Supervised Learning (SL) approach achieves 96.43% accuracy on a balanced dataset of six hand activities (Push, Pull, Slide Left, Slide Right, Clockwise Turning, Anticlockwise Turning).
Enhancement: The system is enhanced with Supervised Contrastive Learning (SCL). This two-stage process first learns robust representations by minimizing distances between positive pairs (same class) and maximizing distances between negative pairs (different classes) using an SCL loss function, followed by a linear classifier fine-tuning stage. The SCL-enhanced system achieves 97.92% accuracy under normal conditions.

2. Adversary Model and Attacks

The study proposes three novel label flipping attacks that exploit trajectory similarities, categorized by how the attacker manipulates labels relative to the motion trajectory:

Random Attacks: The attacker randomly flips labels to arbitrary classes, mixing activities with both similar and dissimilar trajectories.
Across Trajectory Attacks: The attacker flips labels of specific activity classes to other classes that have different motion trajectories (e.g., changing a "Push" label to a "Turn").
Inner Trajectory Attacks: The attacker flips labels to classes that share similar motion trajectories (e.g., changing "Push" to "Pull"). This attack is designed to be stealthier, as the underlying signal patterns remain consistent with the new label.

These attacks are evaluated in both symmetric (mutual label swapping between two classes) and asymmetric forms.

3. Defense Mechanism: Sel-CL

The authors propose a defense mechanism called Sel-CL (Selection-based Contrastive Learning) that does not require a trusted dataset. The approach involves:

Unsupervised Pre-training: Initially, the model is trained using Unsupervised Contrastive Learning (UCL) to learn representations without relying on potentially poisoned labels.
Confident Example Identification: Using the representations learned from UCL, the system calculates pseudo-labels for each instance based on the majority vote of its $K$ -nearest neighbors (where $K=250$ ). Instances where the pseudo-label agrees with the provided (potentially poisoned) label are considered "confident examples."
Confident Pair Selection: The system constructs positive and negative pairs only from these confident examples.
Robust Training: The model is trained using a composite loss function that includes:
- Supervised Contrastive Loss (on confident pairs).
- Cross-Entropy Loss (on confident examples).
- Mixup augmentation to blend samples.
- Similarity Loss to refine representation based on classifier predictions.
Fine-Tuning: Finally, a new classifier head is added and fine-tuned on the selected confident samples using a robust loss function.

Key Results

Vulnerability of SCL

Experimental results demonstrate that while SCL outperforms standard SL in clean environments (97.92% vs. 96.43%), it is more vulnerable to label flipping attacks.

Under Random Attacks with a 20% poisoned label ratio, both SL and SCL accuracy drop to ~70%. However, SCL performance collapses faster as the poison ratio increases.
Inner Trajectory Attacks are particularly damaging to SCL because the similarity in trajectories confuses the contrastive learning mechanism, which relies on distinguishing similar instances.
At a 40% poison ratio, SCL-based systems become nearly unusable, with feature representations of different activities becoming completely intermingled.

Effectiveness of Sel-CL

The proposed Sel-CL defense significantly mitigates these vulnerabilities, though performance varies by attack type:

Resilience to Random Attacks: Sel-CL maintains accuracy above 90% even with up to 40% poisoned labels. The random attack, which significantly impacts SL and SCL models, has minimal effect on Sel-CL.
Vulnerability to Fixed Manipulation: While Sel-CL maintains high accuracy against random attacks, the Cross and Inner Trajectory attacks (which employ fixed label manipulation methods) induce larger errors in the Sel-CL model compared to random attacks. However, Sel-CL still maintains an accuracy of above 90% for all attacks at a 40% poison ratio.
Extreme Resilience: Even when the poisoned label ratio reaches 80%, Sel-CL maintains accuracy above 90%, whereas SL and SCL degrade to the level of random guessing.
Clean Performance: In the absence of attacks, Sel-CL achieves 98.78% accuracy, outperforming both the baseline SL (96.43%) and standard SCL (97.92%), indicating that the selection process filters out low-quality samples even in clean data.
Feature Separation: Visualizations of feature representations show that Sel-CL keeps activity clusters distinct even under heavy poisoning, whereas SL and SCL show significant overlap.

Significance and Claims

The paper claims to be the first systematic study on the vulnerabilities of mmWave-based HAR systems specifically within the context of Supervised Contrastive Learning.

Key contributions include:

Novel Attack Vectors: The identification of trajectory-based label flipping attacks (Random, Across, and Inner) that specifically target the nuances of wireless signal data, which have been overlooked in general ML security research.
Defense Without Trusted Data: The development of a defense mechanism (Sel-CL) that operates without the assumption of a trusted training dataset, a significant practical advancement over prior works that rely on clean seed data.
Empirical Validation: Comprehensive experimental validation on a prototype system using real-world mmWave data across diverse environments and extreme angles (±45° and ±60°), demonstrating that the proposed defense is robust against both symmetric and asymmetric attacks.

The authors conclude that while SCL offers superior performance in clean conditions, it introduces specific security vulnerabilities that must be addressed during the design and deployment of wireless HAR systems. The strategies presented are intended to be extensible to other wireless HAR systems, including those based on Wi-Fi and acoustic signals.