{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T18:08:24Z","timestamp":1778782104548,"version":"3.51.4"},"reference-count":52,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62361048"],"award-info":[{"award-number":["62361048"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Engineering Applications of Artificial Intelligence"],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1016\/j.engappai.2026.114682","type":"journal-article","created":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T09:34:36Z","timestamp":1775036076000},"page":"114682","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Defending automatic modulation recognition against adversarial attacks via layer-wise feature-space perturbation purification"],"prefix":"10.1016","volume":"175","author":[{"given":"Shilong","family":"Zhang","sequence":"first","affiliation":[]},{"given":"Yu","family":"Song","sequence":"additional","affiliation":[]},{"given":"Shubin","family":"Wang","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.engappai.2026.114682_b1","series-title":"Proc. Eur. Conf. Comput. Vis.","first-page":"484","article-title":"Square attack: A query-efficient black-box adversarial attack via random search","author":"Andriushchenko","year":"2020"},{"key":"10.1016\/j.engappai.2026.114682_b2","series-title":"Proc. IEEE Global Commun. Conf.","first-page":"6073","article-title":"OATGA: Optimizing adversarial training via genetic algorithm for automatic modulation classification","author":"Bao","year":"2023"},{"key":"10.1016\/j.engappai.2026.114682_b3","doi-asserted-by":"crossref","DOI":"10.1016\/j.engappai.2024.108989","article-title":"Transformer-based models for intrapulse modulation recognition of radar waveforms","volume":"136","author":"Bhatti","year":"2024","journal-title":"Eng. Appl. Artif. Intell."},{"key":"10.1016\/j.engappai.2026.114682_b4","series-title":"Proc. IEEE Symp. Secur. Privacy","first-page":"39","article-title":"Towards evaluating the robustness of neural networks","author":"Carlini","year":"2017"},{"issue":"3","key":"10.1016\/j.engappai.2026.114682_b5","doi-asserted-by":"crossref","first-page":"2192","DOI":"10.1109\/JIOT.2021.3091523","article-title":"Multitask-learning-based deep neural network for automatic modulation classification","volume":"9","author":"Chang","year":"2022","journal-title":"IEEE Internet Things J."},{"issue":"12","key":"10.1016\/j.engappai.2026.114682_b6","doi-asserted-by":"crossref","first-page":"2734","DOI":"10.1109\/LCOMM.2024.3482552","article-title":"Frequency-constrained iterative adversarial attacks for automatic modulation classification","volume":"28","author":"Chen","year":"2024","journal-title":"IEEE Commun. Lett."},{"key":"10.1016\/j.engappai.2026.114682_b7","series-title":"Proc. AAAI Conf. Artif. Intell.","article-title":"Ead: Elastic-net attacks to deep neural networks via adversarial examples","volume":"Vol. 32","author":"Chen","year":"2018"},{"key":"10.1016\/j.engappai.2026.114682_b8","doi-asserted-by":"crossref","first-page":"3690","DOI":"10.1109\/TIFS.2024.3361172","article-title":"Learn to defend: Adversarial multi-distillation for automatic modulation recognition models","volume":"19","author":"Chen","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"22","key":"10.1016\/j.engappai.2026.114682_b9","doi-asserted-by":"crossref","first-page":"37032","DOI":"10.1109\/JIOT.2024.3439440","article-title":"Projected natural gradient method: Unveiling low-power perturbation vulnerabilities in deep-learning-based automatic modulation classification","volume":"11","author":"Chiheb Ben Nasr","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"10.1016\/j.engappai.2026.114682_b10","series-title":"Proc. IEEE Conf. Comput. Vis. Pattern Recognit.","first-page":"9185","article-title":"Boosting adversarial attacks with momentum","author":"Dong","year":"2018"},{"key":"10.1016\/j.engappai.2026.114682_b11","series-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014"},{"key":"10.1016\/j.engappai.2026.114682_b12","series-title":"Proc. IEEE Conf. Comput. Vis. Pattern Recognit.","first-page":"770","article-title":"Deep residual learning for image recognition","author":"He","year":"2016"},{"key":"10.1016\/j.engappai.2026.114682_b13","series-title":"Gaussian error linear units (GELUs)","author":"Hendrycks","year":"2016"},{"issue":"7","key":"10.1016\/j.engappai.2026.114682_b14","doi-asserted-by":"crossref","first-page":"8013","DOI":"10.1109\/TWC.2023.3347537","article-title":"ClST: A convolutional transformer framework for automatic modulation recognition by knowledge distillation","volume":"23","author":"Hou","year":"2024","journal-title":"IEEE Trans. Wirel. Commun."},{"issue":"2","key":"10.1016\/j.engappai.2026.114682_b15","doi-asserted-by":"crossref","first-page":"580","DOI":"10.1007\/s12559-022-10062-y","article-title":"Minimum power adversarial attacks in communication signal modulation classification with deep learning","volume":"15","author":"Ke","year":"2023","journal-title":"Cogn. Comput."},{"key":"10.1016\/j.engappai.2026.114682_b16","series-title":"Torchattacks: A pytorch repository for adversarial attacks","author":"Kim","year":"2020"},{"issue":"6","key":"10.1016\/j.engappai.2026.114682_b17","doi-asserted-by":"crossref","first-page":"3868","DOI":"10.1109\/TWC.2021.3124855","article-title":"Channel-aware adversarial attacks against deep learning-based wireless signal classifiers","volume":"21","author":"Kim","year":"2022","journal-title":"IEEE Trans. Wirel. Commun."},{"issue":"2","key":"10.1016\/j.engappai.2026.114682_b18","doi-asserted-by":"crossref","first-page":"3533","DOI":"10.1109\/TVT.2024.3483204","article-title":"An efficient model for few-shot automatic modulation recognition based on supervised contrastive learning","volume":"74","author":"Kong","year":"2025","journal-title":"IEEE Trans. Veh. Technol."},{"key":"10.1016\/j.engappai.2026.114682_b19","series-title":"Proc. Artif. Intell. Safety Secur.","first-page":"99","article-title":"Adversarial examples in the physical world","author":"Kurakin","year":"2018"},{"issue":"1","key":"10.1016\/j.engappai.2026.114682_b20","doi-asserted-by":"crossref","first-page":"389","DOI":"10.1109\/TR.2020.3032744","article-title":"Adversarial attacks in modulation recognition with convolutional neural networks","volume":"70","author":"Lin","year":"2021","journal-title":"IEEE Trans. Reliab."},{"issue":"Nov","key":"10.1016\/j.engappai.2026.114682_b21","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"Maaten","year":"2008","journal-title":"J. Mach. Learn. Res."},{"key":"10.1016\/j.engappai.2026.114682_b22","series-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017"},{"key":"10.1016\/j.engappai.2026.114682_b23","series-title":"Proc. Eur. Signal Process. Conf.","first-page":"1636","article-title":"SafeAMC: Adversarial training for robust modulation classification models","author":"Maroto","year":"2022"},{"key":"10.1016\/j.engappai.2026.114682_b24","series-title":"Proc. IEEE Int. Conf. on Acoustics, Speech and Signal Process.","first-page":"1","article-title":"Maximum likelihood distillation for robust modulation classification","author":"Maroto","year":"2023"},{"key":"10.1016\/j.engappai.2026.114682_b25","doi-asserted-by":"crossref","first-page":"3731","DOI":"10.1109\/TIFS.2025.3553806","article-title":"Adversarial attack and reliable defense based on frequency domain feature enhancement for automatic modulation classification","volume":"20","author":"Meng","year":"2025","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.engappai.2026.114682_b26","doi-asserted-by":"crossref","first-page":"1711","DOI":"10.1109\/TIP.2019.2940533","article-title":"Image super-resolution as a defense against adversarial attacks","volume":"29","author":"Mustafa","year":"2020","journal-title":"IEEE Trans. Image Process."},{"key":"10.1016\/j.engappai.2026.114682_b27","series-title":"Proc. 17th Int. Conf. Eng. Appl. Neural Netw.","first-page":"213","article-title":"Convolutional radio modulation recognition networks","author":"O\u2019Shea","year":"2016"},{"issue":"2","key":"10.1016\/j.engappai.2026.114682_b28","doi-asserted-by":"crossref","first-page":"674","DOI":"10.1109\/TR.2022.3161138","article-title":"Detection tolerant black-box adversarial attack against automatic modulation classification with deep learning","volume":"71","author":"Qi","year":"2022","journal-title":"IEEE Trans. Reliab."},{"issue":"3","key":"10.1016\/j.engappai.2026.114682_b29","doi-asserted-by":"crossref","first-page":"4192","DOI":"10.1109\/TVT.2024.3486079","article-title":"Enhancing automatic modulation recognition through robust global feature extraction","volume":"74","author":"Qu","year":"2025","journal-title":"IEEE Trans. Veh. Technol."},{"issue":"1","key":"10.1016\/j.engappai.2026.114682_b30","doi-asserted-by":"crossref","first-page":"213","DOI":"10.1109\/LWC.2018.2867459","article-title":"Adversarial attacks on deep-learning based radio signal classification","volume":"8","author":"Sadeghi","year":"2019","journal-title":"IEEE Wirel. Commun. Lett."},{"issue":"11","key":"10.1016\/j.engappai.2026.114682_b31","doi-asserted-by":"crossref","first-page":"7663","DOI":"10.1109\/TWC.2023.3254490","article-title":"RML22: Realistic dataset generation for wireless modulation classification","volume":"22","author":"Sathyanarayanan","year":"2023","journal-title":"IEEE Trans. Wirel. Commun."},{"issue":"3","key":"10.1016\/j.engappai.2026.114682_b32","doi-asserted-by":"crossref","first-page":"1623","DOI":"10.1109\/TCCN.2024.3485118","article-title":"IQFormer: A novel transformer-based model with multi-modality fusion for automatic modulation recognition","volume":"11","author":"Shao","year":"2025","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"issue":"9","key":"10.1016\/j.engappai.2026.114682_b33","doi-asserted-by":"crossref","first-page":"10085","DOI":"10.1109\/TVT.2020.3005707","article-title":"Complex-valued networks for automatic modulation classification","volume":"69","author":"Tu","year":"2020","journal-title":"IEEE Trans. Veh. Technol."},{"key":"10.1016\/j.engappai.2026.114682_b34","series-title":"Proc. Int. Conf. Mach. Learn.","first-page":"5025","article-title":"Adversarial risk and the dangers of evaluating against weak attacks","author":"Uesato","year":"2018"},{"key":"10.1016\/j.engappai.2026.114682_b35","article-title":"Neural discrete representation learning","volume":"30","author":"Van Den Oord","year":"2017","journal-title":"Adv. Neural Neural Inf. Process. Syst."},{"key":"10.1016\/j.engappai.2026.114682_b36","doi-asserted-by":"crossref","first-page":"6225","DOI":"10.1109\/TIFS.2024.3414249","article-title":"AutoSMC: An automated machine learning framework for signal modulation classification","volume":"19","author":"Wang","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"13s","key":"10.1016\/j.engappai.2026.114682_b37","first-page":"1","article-title":"Recent advances in Bayesian optimization","volume":"55","author":"Wang","year":"2023","journal-title":"ACM Comput. Surv."},{"issue":"12","key":"10.1016\/j.engappai.2026.114682_b38","doi-asserted-by":"crossref","first-page":"2851","DOI":"10.1109\/LCOMM.2022.3206115","article-title":"GAN against adversarial attacks in radio signal classification","volume":"26","author":"Wang","year":"2022","journal-title":"IEEE Commun. Lett."},{"issue":"14","key":"10.1016\/j.engappai.2026.114682_b39","doi-asserted-by":"crossref","first-page":"12938","DOI":"10.1109\/JIOT.2023.3254648","article-title":"Universal attack against automatic modulation classification DNNs under frequency and data constraints","volume":"10","author":"Wang","year":"2023","journal-title":"IEEE Internet Things J."},{"issue":"3","key":"10.1016\/j.engappai.2026.114682_b40","doi-asserted-by":"crossref","first-page":"1357","DOI":"10.1109\/TCCN.2025.3558027","article-title":"A survey of deep transfer learning in automatic modulation classification","volume":"11","author":"Wang","year":"2025","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"issue":"10","key":"10.1016\/j.engappai.2026.114682_b41","doi-asserted-by":"crossref","first-page":"1629","DOI":"10.1109\/LWC.2020.2999453","article-title":"A spatiotemporal multi-channel learning framework for automatic modulation recognition","volume":"9","author":"Xu","year":"2020","journal-title":"IEEE Wirel. Commun. Lett."},{"issue":"14","key":"10.1016\/j.engappai.2026.114682_b42","doi-asserted-by":"crossref","first-page":"827","DOI":"10.1049\/cmu2.12793","article-title":"A knowledge distillation strategy for enhancing the adversarial robustness of lightweight automatic modulation classification models","volume":"18","author":"Xu","year":"2024","journal-title":"IET Commun."},{"key":"10.1016\/j.engappai.2026.114682_b43","doi-asserted-by":"crossref","DOI":"10.1016\/j.dsp.2024.104636","article-title":"Adversarial training for signal modulation classification based on Ulam stability theory","volume":"153","author":"Yan","year":"2024","journal-title":"Digit. Signal Process."},{"issue":"1","key":"10.1016\/j.engappai.2026.114682_b44","doi-asserted-by":"crossref","first-page":"2051","DOI":"10.1109\/TCE.2025.3541251","article-title":"SNR-enhanced automatic modulation classification in artificial intelligence of things for consumer electronics","volume":"71","author":"Yang","year":"2025","journal-title":"IEEE Trans. Consum. Electron."},{"issue":"4","key":"10.1016\/j.engappai.2026.114682_b45","doi-asserted-by":"crossref","first-page":"1280","DOI":"10.1109\/TCCN.2024.3382126","article-title":"Channel-robust class-universal spectrum-focused frequency adversarial attacks on modulated classification models","volume":"10","author":"Zhang","year":"2024","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"key":"10.1016\/j.engappai.2026.114682_b46","series-title":"Proc. IEEE Int. Conf. Acoust. Speech Signal Process.","first-page":"9032","article-title":"Adversarial learning in transformer based neural network in radio signal classification","author":"Zhang","year":"2022"},{"issue":"3","key":"10.1016\/j.engappai.2026.114682_b47","doi-asserted-by":"crossref","first-page":"880","DOI":"10.1109\/TCCN.2024.3360514","article-title":"HFAD: Homomorphic filtering adversarial defense against adversarial attacks in automatic modulation classification","volume":"10","author":"Zhang","year":"2024","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"issue":"2","key":"10.1016\/j.engappai.2026.114682_b48","doi-asserted-by":"crossref","first-page":"1041","DOI":"10.1109\/TCCN.2024.3524184","article-title":"Robust generative defense against adversarial attacks in intelligent modulation recognition","volume":"11","author":"Zhang","year":"2025","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"issue":"3","key":"10.1016\/j.engappai.2026.114682_b49","doi-asserted-by":"crossref","first-page":"1635","DOI":"10.1109\/TCCN.2024.3499362","article-title":"Boosting robustness in automatic modulation recognition for wireless communications","volume":"11","author":"Zhao","year":"2025","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"issue":"4","key":"10.1016\/j.engappai.2026.114682_b50","doi-asserted-by":"crossref","first-page":"2135","DOI":"10.1109\/TCCN.2024.3516032","article-title":"Boosting automatic modulation recognition in wireless communications with frequency encoder","volume":"11","author":"Zhao","year":"2025","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"issue":"1","key":"10.1016\/j.engappai.2026.114682_b51","doi-asserted-by":"crossref","first-page":"122","DOI":"10.1109\/TCCN.2023.3320868","article-title":"GAN-based siamese neuron network for modulation classification against white-box adversarial attacks","volume":"10","author":"Zhou","year":"2024","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"issue":"6","key":"10.1016\/j.engappai.2026.114682_b52","doi-asserted-by":"crossref","first-page":"4853","DOI":"10.1109\/TWC.2025.3544465","article-title":"Exploring universal adversarial attacks on DNN-based automatic modulation recognition using joint metrics","volume":"24","author":"Zhou","year":"2025","journal-title":"IEEE Trans. Wirel. Commun."}],"container-title":["Engineering Applications of Artificial Intelligence"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0952197626009644?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0952197626009644?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T17:13:05Z","timestamp":1778778785000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0952197626009644"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":52,"alternative-id":["S0952197626009644"],"URL":"https:\/\/doi.org\/10.1016\/j.engappai.2026.114682","relation":{},"ISSN":["0952-1976"],"issn-type":[{"value":"0952-1976","type":"print"}],"subject":[],"published":{"date-parts":[[2026,7]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Defending automatic modulation recognition against adversarial attacks via layer-wise feature-space perturbation purification","name":"articletitle","label":"Article Title"},{"value":"Engineering Applications of Artificial Intelligence","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.engappai.2026.114682","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"114682"}}