{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,23]],"date-time":"2026-03-23T04:50:47Z","timestamp":1774241447273,"version":"3.50.1"},"reference-count":31,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,3,23]],"date-time":"2026-03-23T00:00:00Z","timestamp":1774224000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,3,23]],"date-time":"2026-03-23T00:00:00Z","timestamp":1774224000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62271504"],"award-info":[{"award-number":["62271504"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>With the rapid advancement of deep neural networks in wireless communications, applications such as signal modulation recognition and target detection face threats from adversarial example attacks. To enhance system robustness against adversarial attacks, adversarial example detection holds a unique position and role as a complementary approach to conventional adversarial defense methods. This paper investigates the spatial and frequency domain attribute differences between clean and adversarial signal examples, proposing a joint spatial-frequency domain adversarial example detection method for signal modulation recognition networks. In the frequency domain, we extract time-shifted autocorrelation features that capture the peak width differences between clean and adversarial examples, where adversarial perturbations exhibit wider autocorrelation peaks due to their signal-like energy distribution. In the spatial domain, we characterize the inter-layer feature propagation patterns through DNN layers by computing cosine similarities between layer-wise activations and class centers, revealing that adversarial examples exhibit progressive deviation from their true class in deeper layers. These complementary dual-domain features are then fused and classified through a Random Forest ensemble to achieve robust adversarial detection. Experimental results show that the proposed method achieves an adversarial detection rate of 90.32% with an AUC of 0.9475 under PGD attacks, substantially outperforming autoencoder-based and KL-divergence-based baseline detectors by 22.20% and 4.36% respectively. The detector also maintains robust performance across different attack types, achieving detection rates of 98.82% against FGSM and 99.36% against CW attacks. These results validate that the proposed method serves as an effective frontline defense to enhance the adversarial robustness of signal modulation recognition networks.<\/jats:p>","DOI":"10.1186\/s42400-026-00553-y","type":"journal-article","created":{"date-parts":[[2026,3,23]],"date-time":"2026-03-23T03:53:03Z","timestamp":1774237983000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A spatial-frequency domain joint detection method of adversarial examples for signal modulation recognition network"],"prefix":"10.1186","volume":"9","author":[{"given":"Wenlin","family":"Liu","sequence":"first","affiliation":[]},{"given":"Linyuan","family":"Wang","sequence":"additional","affiliation":[]},{"given":"Nuolin","family":"Sun","sequence":"additional","affiliation":[]},{"given":"Dongyang","family":"Li","sequence":"additional","affiliation":[]},{"given":"Bin","family":"Yan","sequence":"additional","affiliation":[]},{"given":"Houqiang","family":"Li","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2026,3,23]]},"reference":[{"key":"553_CR1","doi-asserted-by":"crossref","unstructured":"Bair S, DelVecchio M, Flowers B, Michaels AJ, Headley WC (2019) On the limitations of targeted adversarial evasion attacks against deep learning enabled modulation recognition. In: Proceedings of the ACM Workshop on Wireless Security and Machine Learning, pp. 25\u201330","DOI":"10.1145\/3324921.3328785"},{"key":"553_CR2","doi-asserted-by":"crossref","unstructured":"Deogirikar J, Vidhate A (2017) Security attacks in iot: a survey. In: 2017 International conference on I-SMAC (IoT in Social, Mobile, Analytics and cloud) (I-SMAC), pp 32\u201337. IEEE","DOI":"10.1109\/I-SMAC.2017.8058363"},{"key":"553_CR3","doi-asserted-by":"publisher","first-page":"1102","DOI":"10.1109\/TIFS.2019.2934069","volume":"15","author":"B Flowers","year":"2019","unstructured":"Flowers B, Buehrer RM, Headley WC (2019) Evaluating adversarial evasion attacks in the context of wireless communications. IEEE Trans Inf Forensics Secur 15:1102\u20131113","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"7","key":"553_CR4","doi-asserted-by":"publisher","first-page":"2967","DOI":"10.1007\/s11276-023-03299-4","volume":"29","author":"C Han","year":"2023","unstructured":"Han C, Qin R, Wang L, Cui W, Chen J, Yan B (2023) Adversarial defense method based on ensemble learning for modulation signal intelligent recognition. Wireless Netw 29(7):2967\u20132980","journal-title":"Wireless Netw"},{"issue":"21","key":"553_CR5","doi-asserted-by":"publisher","first-page":"11880","DOI":"10.3390\/app132111880","volume":"13","author":"C Han","year":"2023","unstructured":"Han C, Qin R, Wang L, Cui W, Li D, Yan B (2023) Adversarial example detection and restoration defensive framework for signal intelligent recognition networks. Appl Sci 13(21):11880","journal-title":"Appl Sci"},{"key":"553_CR6","doi-asserted-by":"crossref","unstructured":"Han C, Wang L, Li D, Cui W, Yan B (2024) A pruning method combined with resilient training to improve the adversarial robustness of automatic modulation classification models. Mobile Netw Appl, pp 1\u201317","DOI":"10.1007\/s11036-024-02333-9"},{"key":"553_CR7","doi-asserted-by":"publisher","first-page":"194","DOI":"10.1016\/j.future.2022.02.019","volume":"132","author":"H Jiang","year":"2022","unstructured":"Jiang H, Lin J, Kang H (2022) FGMD: a robust detector against adversarial attacks in the iot network. Future Gener Comput Syst 132:194\u2013210","journal-title":"Future Gener Comput Syst"},{"issue":"18","key":"553_CR8","doi-asserted-by":"publisher","first-page":"3752","DOI":"10.3390\/electronics12183752","volume":"12","author":"Z Jiang","year":"2023","unstructured":"Jiang Z, Zeng W, Zhou X, Feng P, Chen P, Yin S, Han C, Li L (2023) Sparse adversarial attacks against dl-based automatic modulation classification. Electronics 12(18):3752","journal-title":"Electronics"},{"issue":"2","key":"553_CR9","doi-asserted-by":"publisher","first-page":"580","DOI":"10.1007\/s12559-022-10062-y","volume":"15","author":"D Ke","year":"2023","unstructured":"Ke D, Wang X, Huang K, Wang H, Huang Z (2023) Minimum power adversarial attacks in communication signal modulation classification with deep learning. Cognit Comput 15(2):580\u2013589","journal-title":"Cognit Comput"},{"key":"553_CR10","doi-asserted-by":"crossref","unstructured":"Ked H, Wang X (2019) Application of adversarial examples in communication modulation classification. In: Proceedings of 2019 International Conference on Data Mining Workshops, pp. 877\u2013882. IEEE","DOI":"10.1109\/ICDMW.2019.00128"},{"key":"553_CR11","doi-asserted-by":"crossref","unstructured":"Kim B, Sagduyu YE, Davaslioglu K, Erpek T, Ulukus S (2020) How to make 5g communications \"invisible\": adversarial machine learning for wireless privacy. arXiv preprint arXiv:2005.07675","DOI":"10.1109\/IEEECONF51394.2020.9443500"},{"key":"553_CR12","doi-asserted-by":"crossref","unstructured":"Kim B, Sagduyu YE, Erpek T, Davaslioglu K, Ulukus S (2020) Adversarial attacks with multiple antennas against deep learning-based modulation classifiers. In: 2020 IEEE Globecom Workshops (GC Wkshps), pp. 1\u20136. IEEE","DOI":"10.1109\/GCWkshps50303.2020.9367473"},{"key":"553_CR13","doi-asserted-by":"crossref","unstructured":"Kokalj-Filipovic S, Miller R, Chang N, Lau CL (2019) Mitigation of adversarial examples in rf deep classifiers utilizing autoencoder pre-training. In: 2019 International Conference on Military Communications and Information Systems (ICMCIS), pp. 1\u20136. IEEE","DOI":"10.1109\/ICMCIS.2019.8842663"},{"key":"553_CR14","doi-asserted-by":"crossref","unstructured":"Kokalj-Filipovic S, Miller R, Morman J (2019) Targeted adversarial examples against rf deep classifiers. In: Proceedings of the ACM workshop on wireless security and machine learning, pp 6\u201311","DOI":"10.1145\/3324921.3328792"},{"key":"553_CR15","doi-asserted-by":"crossref","unstructured":"Kokalj-Filipovic S, Miller R, Vanhoy G (2019) Adversarial examples in rf deep learning: detection and physical robustness. In: 2019 IEEE global conference on signal and information processing (GlobalSIP), pp 1\u20135. IEEE","DOI":"10.1109\/GlobalSIP45357.2019.8969138"},{"issue":"2","key":"553_CR16","doi-asserted-by":"publisher","first-page":"732","DOI":"10.1109\/TDSC.2023.3261983","volume":"21","author":"I Lee","year":"2023","unstructured":"Lee I, Lee W (2023) Uniqgan: towards improved modulation classification with adversarial robustness using scalable generator design. IEEE Trans Dependable Secure Comput 21(2):732\u2013745","journal-title":"IEEE Trans Dependable Secure Comput"},{"issue":"1","key":"553_CR17","doi-asserted-by":"publisher","first-page":"389","DOI":"10.1109\/TR.2020.3032744","volume":"70","author":"Y Lin","year":"2020","unstructured":"Lin Y, Zhao H, Ma X, Tu Y, Wang M (2020) Adversarial attacks in modulation recognition with convolutional neural networks. IEEE Trans Reliab 70(1):389\u2013401","journal-title":"IEEE Trans Reliab"},{"key":"553_CR18","doi-asserted-by":"crossref","unstructured":"Lin Y, Zhao H, Tu Y, Mao S, Dou Z (2020) Threats of adversarial attacks in dnn-based modulation recognition. In: IEEE INFOCOM 2020-IEEE Conference on Computer Communications, pp. 2469\u20132478. IEEE","DOI":"10.1109\/INFOCOM41043.2020.9155389"},{"key":"553_CR19","doi-asserted-by":"crossref","unstructured":"Maroto J, Bovet G, Frossard P (2022) Safeamc: Adversarial training for robust modulation classification models. In: 2022 30th European Signal Processing Conference (EUSIPCO), pp. 1636\u20131640. IEEE","DOI":"10.23919\/EUSIPCO55093.2022.9909941"},{"key":"553_CR20","doi-asserted-by":"crossref","unstructured":"O\u2019Shea TJ, Corgan J, Clancy TC (2016) Convolutional radio modulation recognition networks. In: International conference on engineering applications of neural networks, pp. 213\u2013226. Springer","DOI":"10.1007\/978-3-319-44188-7_16"},{"issue":"1","key":"553_CR21","doi-asserted-by":"publisher","first-page":"213","DOI":"10.1109\/LWC.2018.2867459","volume":"8","author":"M Sadeghi","year":"2018","unstructured":"Sadeghi M, Larsson EG (2018) Adversarial attacks on deep-learning based radio signal classification. IEEE Wirel Commun Lett 8(1):213\u2013216","journal-title":"IEEE Wirel Commun Lett"},{"key":"553_CR22","unstructured":"Sadhukhan D, Shankar NP, Kalyani S (2024) Golden ratio search: a low-power adversarial attack for deep learning based modulation classification. arXiv preprint arXiv:2409.11454"},{"key":"553_CR23","unstructured":"Sagduyu YE, Shi Y, Erpek T, Headley W, Flowers B, Stantchev G, Lu Z (2020) When wireless security meets machine learning: Motivation, challenges, and research directions. arXiv preprint arXiv:2001.08883"},{"key":"553_CR24","unstructured":"Sun N, Wang L, Li D, Yan B, Li L (2025) Are classical deep neural networks weakly adversarially robust? arXiv preprint arXiv:2506.02016"},{"key":"553_CR25","doi-asserted-by":"crossref","unstructured":"Usama M, Asim M, Qadir J, Al-Fuqaha A, Imran MA (2019) Adversarial machine learning attack on modulation classification. In: 2019 UK\/China Emerging Technologies (UCET), pp 1\u20134. IEEE","DOI":"10.1109\/UCET.2019.8881843"},{"key":"553_CR26","unstructured":"Wang S, Gai K, Zhang S (2024) Progressive feedforward collapse of resnet training. arXiv preprint arXiv:2405.00985"},{"issue":"12","key":"553_CR27","first-page":"3607","volume":"68","author":"D Xu","year":"2021","unstructured":"Xu D, Yang H, Gu C, Chen Z, Xuan Q, Yang X (2021) Adversarial examples detection of radio signals based on multifeature fusion. IEEE Trans Circuits Syst II Express Briefs 68(12):3607\u20133611","journal-title":"IEEE Trans Circuits Syst II Express Briefs"},{"key":"553_CR28","doi-asserted-by":"publisher","DOI":"10.1016\/j.dsp.2024.104636","volume":"153","author":"K Yan","year":"2024","unstructured":"Yan K, Ren W, Yang Z (2024) Adversarial training for signal modulation classification based on ulam stability theory. Digit Signal Process 153:104636","journal-title":"Digit Signal Process"},{"key":"553_CR29","unstructured":"Yi J, Gamal AE (2011) Gradient-based adversarial deep modulation classification with data-driven subsampling. arXiv preprint arXiv:2104.06375"},{"key":"553_CR30","doi-asserted-by":"crossref","unstructured":"Yu J, He Z, Zhang S, Han Y, Jiang H (2023) Homomorphic filtering adversarial defense for automatic modulation classification. In: IEEE INFOCOM 2023-IEEE conference on computer communications workshops (INFOCOM WKSHPS), pp 1\u20136. IEEE","DOI":"10.1109\/INFOCOMWKSHPS57453.2023.10225818"},{"key":"553_CR31","doi-asserted-by":"crossref","unstructured":"Zheng Y, Qi L, Bao Z, Fu J, Jiang H (2023) Mdpd: Mapping-based data processing defense against adversarial attacks in automatic modulation classification. In: IEEE INFOCOM 2023-IEEE conference on computer communications workshops (INFOCOM WKSHPS), pp 1\u20136. IEEE","DOI":"10.1109\/INFOCOMWKSHPS57453.2023.10225890"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-026-00553-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-026-00553-y","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-026-00553-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,23]],"date-time":"2026-03-23T03:53:06Z","timestamp":1774237986000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1186\/s42400-026-00553-y"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,23]]},"references-count":31,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["553"],"URL":"https:\/\/doi.org\/10.1186\/s42400-026-00553-y","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,23]]},"assertion":[{"value":"4 September 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"20 January 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"23 March 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"All authors have reviewed the manuscript and consent to its publication.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"Not applicable.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}}],"article-number":"142"}}