We investigate the vulnerability of computer-vision-based signal classifiers
to adversarial perturbations of their inputs, where the signals and
perturbations are subject to physical constraints. We consider a scenario in
which a source and interferer emit signals that propagate as waves to a
detector, which attempts to classify the source by analyzing the spectrogram of
the signal it receives using a pre-trained neural network. By solving
PDE-constrained optimization problems, we construct interfering signals that
cause the detector to misclassify the source even though the perturbations to
the spectrogram of the received signal are nearly imperceptible. Though such
problems can have millions of decision variables, we introduce methods to solve
them efficiently. Our experiments demonstrate that one can compute effective
and physically realizable adversarial perturbations for a variety of machine
learning models under various physical conditions.

我们研究了基于计算机视觉的信号分类器对输入的敌对扰动的脆弱性，其中信号和扰动受到物理约束。通过求解 PDE 约束优化问题，我们构建了干扰信号使得即使对接收信号的谱图进行的扰动几乎不可察觉，探测器仍会误将源分类。尽管此类问题可能涉及数百万个决策变量，但我们引入了高效解决方案。我们的实验表明，可以在各种物理条件下计算出对多种机器学习模型有效且可实现的敌对扰动。