# On the Fragility of AI-Based Channel Decoders under Small Channel Perturbations

arXiv: https://arxiv.org/abs/2602.01582 · HTML: https://mlsanity.com/paper/2602.01582/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 27 of its 47 references that are in the map.
- First posted on arXiv 2 Feb 2026.

## Builds on (most cited first, 27 of 27)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Certified Adversarial Robustness via Randomized Smoothing](https://mlsanity.com/paper/1902.02918/) (2019)
- [Universal adversarial perturbations](https://mlsanity.com/paper/1610.08401/) (2016)
- [Adversarial Examples: Attacks and Defenses for Deep Learning](https://mlsanity.com/paper/1712.07107/) (2017)
- [Data-driven Distributionally Robust Optimization Using the Wasserstein Metric: Performance Guarantees and Tractable Reformulations](https://mlsanity.com/paper/1505.05116/) (2015)
- [Generalizable Adversarial Training via Spectral Normalization](https://mlsanity.com/paper/1811.07457/) (2018)
- [Learning to Decode Linear Codes Using Deep Learning](https://mlsanity.com/paper/1607.04793/) (2016)
- [Error Correction Code Transformer](https://mlsanity.com/paper/2203.14966/) (2022)
- [Turbo Autoencoder: Deep learning based channel codes for point-to-point communication channels](https://mlsanity.com/paper/1911.03038/) (2019)
- [Train simultaneously, generalize better: Stability of gradient-based minimax learners](https://mlsanity.com/paper/2010.12561/) (2020)
- [Deepcode: Feedback Codes via Deep Learning](https://mlsanity.com/paper/1807.00801/) (2018)
- [Deep Learning for Decoding of Linear Codes - A Syndrome-Based Approach](https://mlsanity.com/paper/1802.04741/) (2018)
- [Denoising Diffusion Error Correction Codes](https://mlsanity.com/paper/2209.13533/) (2022)
- [CrossMPT: Cross-attention Message-Passing Transformer for Error Correcting Codes](https://mlsanity.com/paper/2405.01033/) (2024)
- [Physical Adversarial Attacks Against End-to-End Autoencoder Communication Systems](https://mlsanity.com/paper/1902.08391/) (2019)
- [Robust Adversarial Attacks Against DNN-Based Wireless Communication Systems](https://mlsanity.com/paper/2102.00918/) (2021)
- [MIND: Model Independent Neural Decoder](https://mlsanity.com/paper/1903.02268/) (2019)
- [On the Role of Generalization in Transferability of Adversarial Examples](https://mlsanity.com/paper/2206.09238/) (2022)
- [On Convergence of Gradient Descent Ascent: A Tight Local Analysis](https://mlsanity.com/paper/2207.00957/) (2022)
- [Structured Gradient-based Interpretations via Norm-Regularized Adversarial Training](https://mlsanity.com/paper/2404.04647/) (2024)
- [Interplay Between Belief Propagation and Transformer: Differential-Attention Message Passing Transformer](https://mlsanity.com/paper/2509.15637/) (2025)
- [MoreauGrad: Sparse and Robust Interpretation of Neural Networks via Moreau Envelope](https://mlsanity.com/paper/2302.05294/) (2023)
- [Stability and Generalization in Free Adversarial Training](https://mlsanity.com/paper/2404.08980/) (2024)
- [Interpretation of Neural Networks is Susceptible to Universal Adversarial Perturbations](https://mlsanity.com/paper/2212.03095/) (2022)
- [Universal Adversarial Directions](https://mlsanity.com/paper/2210.15997/) (2022)
- [AIR: Threats of Adversarial Attacks on Deep Learning-Based Information Recovery](https://mlsanity.com/paper/2309.16706/) (2023)

## Abstract (arXiv)

Recent advances in deep learning have led to AI-based error correction decoders that report empirical performance improvements over traditional belief-propagation (BP) decoding on AWGN channels. While such gains are promising, a fundamental question remains: where do these improvements come from, and what cost is paid to achieve them? In this work, we study this question through the lens of robustness to distributional shifts at the channel output. We evaluate both input-dependent adversarial perturbations (FGM and projected gradient methods under ℓ2 constraints) and universal adversarial perturbations that apply a single norm-bounded shift to all received vectors. Our results show that recent AI decoders, including ECCT and CrossMPT, could suffer significant performance degradation under such perturbations, despite superior nominal performance under i.i.d. AWGN. Moreover, adversarial perturbations transfer relatively strongly between AI decoders but weakly to BP-based decoders, and universal perturbations are substantially more harmful than random perturbations of equal norm. These numerical findings suggest a potential robustness cost and higher sensitivity to channel distribution underlying recent AI decoding gains.