Neural 5G decoders vulnerable to new gradient-based attacks revealed
On the Adversarial Vulnerability of Neural Receivers with Unrolled LDPC Decoders
Information TheoryCryptography and SecurityMachine Learning
Summary
Neural network-based receivers for 5G wireless signals work well but might be tricked by small, clever changes to their input. The authors found that usual ways to fool these networks don't work well because the math inside makes gradients too small to guide attacks. They developed two new methods that successfully create changes causing many errors in decoding messages. These new attacks show that neural receivers are more vulnerable than previously thought.
What this means in practice
- •For wireless communication engineers: Evaluate robustness of 5G neural decoders using the proposed loss functions to identify vulnerabilities against adversarial inputs.
- •For cybersecurity teams in telecom: Design improved defenses for 5G signals by testing with adversarial perturbations that exploit gradient masking vulnerabilities.
Authors
Aakash Saini, Jafar Aco Mohammadi, Wolfgang Gerstacker
Abstract
Neural receivers for 5G New Radio (NR) match classical model-based receivers in link-level performance, but their robustness to adversarial perturbations at the receiver input remains underexplored. We show that standard gradient-based attacks applied end-to-end through an unrolled low-density parity-check (LDPC) decoder fail to significantly outperform a matched-power Gaussian perturbation. We identify the failure as gradient masking caused by tanh saturation in the boxplus operation of the belief-propagation (BP) check-node update, with a per-iteration gradient norm decay of more than four orders of magnitude across ten unrolled BP iterations. Based on this finding, we propose two structurally independent loss functions that restore attack efficacy. L_BP routes the gradient through the unsaturated early iterations via per-iteration supervision, while L_LLR is a margin loss on pre-decoder log-likelihood ratios (LLRs) whose gradient bypasses the LDPC decoder entirely. Both loss functions increase the block-error rate (BLER) by one to four orders of magnitude at matched perturbation power, with the results reproduced on both the Sionna NeuralReceiver and DeepRx. At low PSR, L_LLR-optimized perturbations achieve up to three orders of magnitude higher BLER on unseen channel realizations than LBP-optimized perturbations.