# Vulnerabilities of Deep Learning-Driven Semantic Communications to Backdoor (Trojan) Attacks

arXiv: https://arxiv.org/abs/2212.11205 · HTML: https://mlsanity.com/paper/2212.11205/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 25 references that are in the map.
- First posted on arXiv 21 Dec 2022.

## Builds on (most cited first, 13 of 13)

- [BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain](https://mlsanity.com/paper/1708.06733/) (2017)
- [Deep Learning Enabled Semantic Communication Systems](https://mlsanity.com/paper/2006.10685/) (2020)
- [An Introduction to Deep Learning for the Physical Layer](https://mlsanity.com/paper/1702.00832/) (2017)
- [Beyond Transmitting Bits: Context, Semantics, and Task-Oriented Communications](https://mlsanity.com/paper/2207.09353/) (2022)
- [Learning Task-Oriented Communication for Edge Inference: An Information Bottleneck Approach](https://mlsanity.com/paper/2102.04170/) (2021)
- [Semantic Communication Systems for Speech Transmission](https://mlsanity.com/paper/2102.12605/) (2021)
- [Semantic Communications: Principles and Challenges](https://mlsanity.com/paper/2201.01389/) (2021)
- [Wireless Semantic Communications for Video Conferencing](https://mlsanity.com/paper/2204.07790/) (2022)
- [Adversarial Machine Learning in Wireless Communications using RF Data: A Review](https://mlsanity.com/paper/2012.14392/) (2020)
- [Task-Oriented Communications for NextG: End-to-End Deep Learning and AI Security Aspects](https://mlsanity.com/paper/2212.09668/) (2022)
- [Trojan Attacks on Wireless Signal Classification with Adversarial Machine Learning](https://mlsanity.com/paper/1910.10766/) (2019)
- [Adversarial Machine Learning for 5G Communications Security](https://mlsanity.com/paper/2101.02656/) (2021)
- [Is Semantic Communications Secure? A Tale of Multi-Domain Adversarial Attacks](https://mlsanity.com/paper/2212.10438/) (2022)

## Built on by (most cited first, 10 of 10)

- [Will 6G be Semantic Communications? Opportunities and Challenges from Task Oriented and Secure Communications to Integrated Sensing](https://mlsanity.com/paper/2401.01531/) (2024)
- [Age of Information in Deep Learning-Driven Task-Oriented Communications](https://mlsanity.com/paper/2301.04298/) (2023)
- [Multi-Receiver Task-Oriented Communications via Multi-Task Deep Learning](https://mlsanity.com/paper/2308.06884/) (2023)
- [Transformer-Aided Semantic Communications](https://mlsanity.com/paper/2405.01521/) (2024)
- [Semantic Multi-Resolution Communications](https://mlsanity.com/paper/2308.11604/) (2023)
- [Multi-Modal Semantic Communication](https://mlsanity.com/paper/2512.15691/) (2025)
- [Targeted Attacks and Defenses for Distributed Federated Learning in Vehicular Networks](https://mlsanity.com/paper/2510.15109/) (2025)
- [Detecting Semantic Backdoors in a Mystery Shopping Scenario](https://mlsanity.com/paper/2601.03805/) (2026)
- [Toward Polymorphic Backdoor against Semantic Communication via Intensity-Based Poisoning](https://mlsanity.com/paper/2604.23231/) (2026)
- [Wireless Backdoor Attack and Defense for Semantic Communications over Multiple Access Channel](https://mlsanity.com/paper/2606.30595/) (2026)

## Abstract (arXiv)

This paper highlights vulnerabilities of deep learning-driven semantic communications to backdoor (Trojan) attacks. Semantic communications aims to convey a desired meaning while transferring information from a transmitter to its receiver. An encoder-decoder pair that is represented by two deep neural networks (DNNs) as part of an autoencoder is trained to reconstruct signals such as images at the receiver by transmitting latent features of small size over a limited number of channel uses. In the meantime, another DNN of a semantic task classifier at the receiver is jointly trained with the autoencoder to check the meaning conveyed to the receiver. The complex decision space of the DNNs makes semantic communications susceptible to adversarial manipulations. In a backdoor (Trojan) attack, the adversary adds triggers to a small portion of training samples and changes the label to a target label. When the transfer of images is considered, the triggers can be added to the images or equivalently to the corresponding transmitted or received signals. In test time, the adversary activates these triggers by providing poisoned samples as input to the encoder (or decoder) of semantic communications. The backdoor attack can effectively change the semantic information transferred for the poisoned input samples to a target meaning. As the performance of semantic communications improves with the signal-to-noise ratio and the number of channel uses, the success of the backdoor attack increases as well. Also, increasing the Trojan ratio in training data makes the attack more successful. In the meantime, the effect of this attack on the unpoisoned input samples remains limited. Overall, this paper shows that the backdoor attack poses a serious threat to semantic communications and presents novel design guidelines to preserve the meaning of transferred information in the presence of backdoor attacks.