# Vision Transformer with Adversarial Indicator Token against Adversarial Attacks in Radio Signal Classifications

arXiv: https://arxiv.org/abs/2507.00015 · HTML: https://mlsanity.com/paper/2507.00015/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 57 references that are in the map.
- First posted on arXiv 13 Jun 2025.

## Builds on (most cited first, 20 of 20)

- [An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale](https://mlsanity.com/paper/2010.11929/) (2020)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Pyramid Vision Transformer: A Versatile Backbone for Dense Prediction without Convolutions](https://mlsanity.com/paper/2102.12122/) (2021)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [LeViT: a Vision Transformer in ConvNet's Clothing for Faster Inference](https://mlsanity.com/paper/2104.01136/) (2021)
- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [Adversarial Attacks and Defenses in Images, Graphs and Text: A Review](https://mlsanity.com/paper/1909.08072/) (2019)
- [Over the Air Deep Learning Based Radio Signal Classification](https://mlsanity.com/paper/1712.04578/) (2017)
- [Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?](https://mlsanity.com/paper/2203.08392/) (2022)
- [Adversarial Attacks on Deep-Learning Based Radio Signal Classification](https://mlsanity.com/paper/1808.07713/) (2018)
- [TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP](https://mlsanity.com/paper/2005.05909/) (2020)
- [Fast Deep Learning for Automatic Modulation Classification](https://mlsanity.com/paper/1901.05850/) (2019)
- [Integrating Sensing and Communications for Ubiquitous IoT: Applications, Trends and Challenges](https://mlsanity.com/paper/2104.11457/) (2021)
- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [A Deep Ensemble-based Wireless Receiver Architecture for Mitigating Adversarial Attacks in Automatic Modulation Classification](https://mlsanity.com/paper/2104.03494/) (2021)
- [Countermeasures Against Adversarial Examples in Radio Signal Classification](https://mlsanity.com/paper/2407.06796/) (2024)
- [Meta-Learning Guided Label Noise Distillation for Robust Signal Modulation Classification](https://mlsanity.com/paper/2408.05151/) (2024)
- [High-Capacity Complex Convolutional Neural Networks For I/Q Modulation Classification](https://mlsanity.com/paper/2010.10717/) (2020)
- [Mixture GAN For Modulation Classification Resiliency Against Adversarial Attacks](https://mlsanity.com/paper/2205.15743/) (2022)
- [A Hybrid Training-time and Run-time Defense Against Adversarial Attacks in Modulation Classification](https://mlsanity.com/paper/2407.06807/) (2024)

## Built on by (most cited first, 2 of 2)

- [A Novel and Practical Universal Adversarial Perturbations against Deep Reinforcement Learning based Intrusion Detection Systems](https://mlsanity.com/paper/2511.18223/) (2025)
- [Probabilistic Robustness-driven Universal Adversarial Perturbations with Explainability against Deep Reinforcement Learning-based Intrusion Detection System](https://mlsanity.com/paper/2609.30605/) (2026)

## Abstract (arXiv)

The remarkable success of transformers across various fields such as natural language processing and computer vision has paved the way for their applications in automatic modulation classification, a critical component in the communication systems of Internet of Things (IoT) devices. However, it has been observed that transformer-based classification of radio signals is susceptible to subtle yet sophisticated adversarial attacks. To address this issue, we have developed a defensive strategy for transformer-based modulation classification systems to counter such adversarial attacks. In this paper, we propose a novel vision transformer (ViT) architecture by introducing a new concept known as adversarial indicator (AdvI) token to detect adversarial attacks. To the best of our knowledge, this is the first work to propose an AdvI token in ViT to defend against adversarial attacks. Integrating an adversarial training method with a detection mechanism using AdvI token, we combine a training time defense and running time defense in a unified neural network model, which reduces architectural complexity of the system compared to detecting adversarial perturbations using separate models. We investigate into the operational principles of our method by examining the attention mechanism. We show the proposed AdvI token acts as a crucial element within the ViT, influencing attention weights and thereby highlighting regions or features in the input data that are potentially suspicious or anomalous. Through experimental results, we demonstrate that our approach surpasses several competitive methods in handling white-box attack scenarios, including those utilizing the fast gradient method, projected gradient descent attacks and basic iterative method.