# Is Semantic Communications Secure? A Tale of Multi-Domain Adversarial Attacks

arXiv: https://arxiv.org/abs/2212.10438 · HTML: https://mlsanity.com/paper/2212.10438/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 14 references that are in the map.
- First posted on arXiv 20 Dec 2022.

## Builds on (most cited first, 11 of 11)

- [Deep Learning Enabled Semantic Communication Systems](https://mlsanity.com/paper/2006.10685/) (2020)
- [An Introduction to Deep Learning for the Physical Layer](https://mlsanity.com/paper/1702.00832/) (2017)
- [Beyond Transmitting Bits: Context, Semantics, and Task-Oriented Communications](https://mlsanity.com/paper/2207.09353/) (2022)
- [Learning Task-Oriented Communication for Edge Inference: An Information Bottleneck Approach](https://mlsanity.com/paper/2102.04170/) (2021)
- [Semantic Communication Systems for Speech Transmission](https://mlsanity.com/paper/2102.12605/) (2021)
- [Semantic Communications: Principles and Challenges](https://mlsanity.com/paper/2201.01389/) (2021)
- [Wireless Semantic Communications for Video Conferencing](https://mlsanity.com/paper/2204.07790/) (2022)
- [Deep Learning-Enabled Semantic Communication Systems with Task-Unaware Transmitter and Dynamic Data](https://mlsanity.com/paper/2205.00271/) (2022)
- [Channel-Aware Adversarial Attacks Against Deep Learning-Based Wireless Signal Classifiers](https://mlsanity.com/paper/2005.05321/) (2020)
- [Adversarial Machine Learning in Wireless Communications using RF Data: A Review](https://mlsanity.com/paper/2012.14392/) (2020)
- [Physical Adversarial Attacks Against End-to-End Autoencoder Communication Systems](https://mlsanity.com/paper/1902.08391/) (2019)

## Built on by (most cited first, 10 of 10)

- [Causal Semantic Communication for Digital Twins: A Generalizable Imitation Learning Approach](https://mlsanity.com/paper/2304.12502/) (2023)
- [Vulnerabilities of Deep Learning-Driven Semantic Communications to Backdoor (Trojan) Attacks](https://mlsanity.com/paper/2212.11205/) (2022)
- [Age of Information in Deep Learning-Driven Task-Oriented Communications](https://mlsanity.com/paper/2301.04298/) (2023)
- [Joint Sensing and Semantic Communications with Multi-Task Deep Learning](https://mlsanity.com/paper/2311.05017/) (2023)
- [Performance Limits of a Deep Learning-Enabled Text Semantic Communication under Interference](https://mlsanity.com/paper/2302.14702/) (2023)
- [Multi-Receiver Task-Oriented Communications via Multi-Task Deep Learning](https://mlsanity.com/paper/2308.06884/) (2023)
- [The Model Inversion Eavesdropping Attack in Semantic Communication Systems](https://mlsanity.com/paper/2308.04304/) (2023)
- [Joint Sensing and Task-Oriented Communications with Image and Wireless Data Modalities for Dynamic Spectrum Access](https://mlsanity.com/paper/2312.13931/) (2023)
- [Semantic Multi-Resolution Communications](https://mlsanity.com/paper/2308.11604/) (2023)
- [Low-Latency Task-Oriented Communications with Multi-Round, Multi-Task Deep Learning](https://mlsanity.com/paper/2411.10385/) (2024)

## Abstract (arXiv)

Semantic communications seeks to transfer information from a source while conveying a desired meaning to its destination. We model the transmitter-receiver functionalities as an autoencoder followed by a task classifier that evaluates the meaning of the information conveyed to the receiver. The autoencoder consists of an encoder at the transmitter to jointly model source coding, channel coding, and modulation, and a decoder at the receiver to jointly model demodulation, channel decoding and source decoding. By augmenting the reconstruction loss with a semantic loss, the two deep neural networks (DNNs) of this encoder-decoder pair are interactively trained with the DNN of the semantic task classifier. This approach effectively captures the latent feature space and reliably transfers compressed feature vectors with a small number of channel uses while keeping the semantic loss low. We identify the multi-domain security vulnerabilities of using the DNNs for semantic communications. Based on adversarial machine learning, we introduce test-time (targeted and non-targeted) adversarial attacks on the DNNs by manipulating their inputs at different stages of semantic communications. As a computer vision attack, small perturbations are injected to the images at the input of the transmitter's encoder. As a wireless attack, small perturbations signals are transmitted to interfere with the input of the receiver's decoder. By launching these stealth attacks individually or more effectively in a combined form as a multi-domain attack, we show that it is possible to change the semantics of the transferred information even when the reconstruction loss remains low. These multi-domain adversarial attacks pose as a serious threat to the semantics of information transfer (with larger impact than conventional jamming) and raise the need of defense methods for the safe adoption of semantic communications.