Jul 2026· Electronics· Vol 15, pp. 2887· 0 citations
TL;DR
Results indicate that ADD offers an effective strategy for building secure and lightweight deep learning models for radar jamming recognition, and synergistically integrates adversarial training with knowledge distillation to produce lightweight yet robust jamming recognition models.
Abstract
Deep learning models have achieved remarkable performance in radar jamming recognition, yet they remain highly vulnerable to adversarial attacks—small, carefully crafted perturbations that cause misclassification—posing a critical threat to intelligent electronic countermeasure systems. Existing adversarial defenses suffer from an inherent accuracy–robustness tradeoff, limited defensive knowledge sources, and poor generalization to unseen attacks, while the additional challenge of model lightweighting for resource-constrained radar platforms remains largely unaddressed. This paper proposes Adversarial Distillation Defense (ADD), a training framework that synergistically integrates adversarial training with knowledge distillation to produce lightweight yet robust jamming recognition models. In ADD, an adversarially pre-trained teacher model simultaneously transfers its classification knowledge on clean samples and defensive knowledge on adversarial samples to a compact student model through four complementary loss terms. Extensive experiments on a simulated dataset comprising seven radar jamming types demonstrate that ADD achieves the strongest defensive performance among the compared defenses under both white-box and black-box attacks across varying perturbation strengths and jamming-to-noise ratios. Feature-space visualization further confirms that ADD enables the student model to maintain well-separated class clusters even under strong adversarial perturbations. These results indicate that ADD offers an effective strategy for building secure and lightweight deep learning models for radar jamming recognition.
This paper introduces DefendMal, a novel framework that synergistically combines Denoise Autoencoder with Sequence Squeezing, a Context-aware Adversarial Generator (CAG-AdvGAN), Projected Gradient Descent (PGD) adversarial training, and a Positive–Negative Detector with Variational Autoencoder (PNDetector-VAE) to enhance robustness against evolving adversarial threats.
Dennis Benedict Crasta, Vikash Kumar· Journal of Computer Virology...· 0 citations
This paper advocates for a forward-thinking approach that balances technical sophistication with human-centric principles, ensuring that adversarial deep learning evolves into a discipline not just of technical defense, but also of trust, transparency, and accountability.
Maisam Abbas, Ran-Zan Wang· IEEE Open Journal of the Com...· 0 citations
Vision Transformers (ViTs) remain vulnerable to localized adversarial attacks, e.g., adversarial patches, while recent test-time defenses mitigate them by suppressing image tokens with abnormally high attention scores. These defenses exploit a strong coupling between attention and adversarial effectiveness: adversarial tokens often need to attract substantial attention to influence the prediction. We introduce adversarial decoys, independently optimized image patches that redirect the attention, and therefore related defenses, toward selected target tokens. Rather than jointly optimizing misclassifications and defense evasion, our approach decouples the two objectives: the original adversarial region induces the incorrect prediction, while a separate decoy manipulates the attention ranking used by the defense. A layer-wise objective increases target-token attention and promotes these tokens above competing non-target ones. Since the decoy is optimized independently of the underlying attack, the method is attack-agnostic and can be easily integrated with any existing adversarial patch attack. Experiments on ImageNet across multiple ViT architectures and attacks show that decoys can redirect high attention scores away from the true adversarial region while preserving much of the attack effectiveness. These results reveal a fundamental limitation of using attention magnitude as an indicator of adversarial relevance.
Giulia Marchiori Pietrosanti, Giulio Rossolini, Giorgio C. Buttazzo· 0 citations
Machine learning models are increasingly adapted in various domains. However, adversarial examples pose a significant threat to the reliable deployment of these models. In recent years, some powerful adversarial example attacks have been proposed for the fast and query-efficient generation of adversarial examples, even in black-box scenarios, highlighting the need for scalable, low-cost, and powerful defenses. In this work, we present two contributions to the domain of black-box adversarial example attacks and defenses. First, we propose Random Logit Scaling (RLS), a randomization-based defense against black-box score-based adversarial example attacks. RLS is a plug-and-play, post-processing defense that can be implemented on top of any existing ML model with minimal effort. The idea behind RLS is to confuse an attacker by outputting falsified scores resulting from randomly scaled logits while maintaining the model accuracy. We show that RLS significantly reduces the success rate of state-of-the-art black-box score-based attacks while preserving the accuracy and minimizing confidence score distortion compared to state-of-the-art randomization-based defenses. Second, we introduce a novel adaptive attack against AAA, a SOTA non-randomized black-box defense against black-box score-based attacks that also modifies output logits to confuse attackers, demonstrating its vulnerability against adaptive attacks.
Hamid Dashtbani, Mehdi Dousti Gandomani, A. M. Sadeghzadeh· 0 citations
An adversarial attack is a modification to the pixels of an image for the purpose of making a machine learning system misclassify the image. The foremost defense against adversarial attacks is adversarial training: a process in which the machine learning system trains on the already attacked images. But, this is not the only kind of defense. There are also algorithmic defense methods, which work to modify the learning process to be resilient to adversarial attacks without involving attacked examples. In this study, we considered three algorithmic defense settings: no algorithmic defense, defensive distillation, and gradient masking. Then we evaluated the role of adversarial training as part of defending machine learning models from adversarial attacks. Specifically, we set up a baseline image classifier for images of digits (MNIST dataset) and attacked the images using the fast gradient sign method. We hypothesized that introducing adversarial training for this classifier would significantly improve downstream classification accuracy in all three algorithmic defense settings. We found that, for all algorithmic defense settings applied to neural networks with between one and six convolutional layers, adding adversarial training consistently resulted in a statistically significant increase in accuracy. While these findings are limited by the specific data, parameters, and algorithms explored, our results suggest that implementing adversarial training within all lines of defense against adversarial attacks would be beneficial. We believe that this insight increases awareness of cybersecurity threats such as adversarial attacks and lowers the barrier of entry to protect against them.
Braden Yian, Clayton Greenberg· Journal of emerging investig...· 0 citations
The study systematically compares two distinct adversarial training strategies: ‘pre-train’, where adversarial examples are generated beforehand, and ‘in-train’, where perturbations are introduced dynamically during the training process, to understand the advantages and limitations of each approach in enhancing model robustness.
José María Jorquera Valero, Ibon Bengoechea Cazorla, Manuel Gil Pérez· IEEE Access· 0 citations