# Defending Adversarial Attacks on Deep Learning Based Power Allocation in
Massive MIMO Using Denoising Autoencoders

Rajeev Sahay*, Minjun Zhang*,
David J. Love, , and Christopher G. Brinton, , IEEE Code is publicly available
at https://github.com/Jess-jpg-txt/DAE_for_adv_attacks_in_MIMO.*R. Sahay and
M. Zhang contributed equally to this work.R. Sahay, M. Zhang, D. J. Love, C.
G. Brinton are with the Elmore Family School of Electrical and Computer
Engineering, Purdue University, West Lafayette, IN, 47907 USA. E-mail:
<EMAIL_ADDRESS>work was supported in part by the
Office of Naval Research (ONR) under grants N00014-21-1-2472 and
N00014-22-1-2305, in part by the National Science Foundation (NSF) under grant
CNS-2146171, and in part by the Defense Advanced Research Projects Agency
(DARPA) under grant D22AP00168-00.

###### Abstract

Recent work has advocated for the use of deep learning to perform power
allocation in the downlink of massive MIMO (maMIMO) networks. Yet, such deep
learning models are vulnerable to adversarial attacks. In the context of
maMIMO power allocation, adversarial attacks refer to the injection of subtle
perturbations into the deep learning model’s input, during inference (i.e.,
the adversarial perturbation is injected into inputs during deployment after
the model has been trained) that are specifically crafted to force the trained
regression model to output an infeasible power allocation solution. In this
work, we develop an autoencoder-based mitigation technique, which allows deep
learning-based power allocation models to operate in the presence of
adversaries without requiring retraining. Specifically, we develop a denoising
autoencoder (DAE), which learns a mapping between potentially perturbed data
and its corresponding unperturbed input. We test our defense across multiple
attacks and in multiple threat models and demonstrate its ability to (i)
mitigate the effects of adversarial attacks on power allocation networks using
two common precoding schemes, (ii) outperform previously proposed benchmarks
for mitigating regression-based adversarial attacks on maMIMO networks, (iii)
retain accurate performance in the absence of an attack, and (iv) operate with
low computational overhead.

###### Index Terms:

Adversarial attacks, deep learning, denoising autoencoder, massive MIMO,
wireless security.

##  I Introduction

Massive multiple-input-multiple-output (maMIMO) systems have incurred exciting
developments in recent years, both in theory [1] and in practice [2]. A maMIMO
system uses a wireless network topology where each base station (BS) is
equipped with a large number of antennas to serve a multitude of user
equipments (UEs) by using the spatial degrees-of-freedom [3]. One major task
of the BS in maMIMO networks is feasible power allocation to each serviced UE.
Accurate power allocation from the BS to each UE is vital for efficient
communication (e.g., to weaken interference and reduce operational costs) in
maMIMO networks. Although the equal power allocation policy can equally
distribute power to all UEs, it is far from optimal and cannot always meet the
power allocation needs of each UE simultaneously. Thus, power allocation
algorithms that can meet each UEs power needs while staying within the BS’s
total power budget are required.

A variety of maMIMO power allocation algorithms have been developed, given a
specific precoder, using convex optimization and geometric programming [4, 5,
6, 7, 8, 9]. Yet, such methods often require high time complexity, which
cannot always be afforded in real-time systems [10]. To address this, recent
work has demonstrated the effectiveness of power allocation in maMIMO
networks, given a specific precoder, using deep learning, which can attain
near-optimal performance by using the positions of UEs as input into a deep
neural network (DNN) [11]. Moreover, deep learning is capable of improving the
complexity-performance trade-off in comparison to traditional optimization-
based methods while also eliminating the need to compute any statistical
averages needed in standard methods [12, 13, 14].

The utilization of deep learning for wireless systems, however, has introduced
a new class of malicious attacks. Specifically, deep learning-based power
allocation models in maMIMO have been shown to be susceptible to gradient-
based _adversarial evasion attacks_ – subtle perturbations injected into a
DNN’s input at inference to induce erroneous behavior at the output [15, 16,
17, 18]. In the context of maMIMO power allocation, erroneous model behavior
refers to the adversarial perturbation inducing an infeasible power allocation
to the UEs. Such attacks cause the DNN to unfairly allocate resources to
certain UEs, thus hindering the effectiveness and efficiency of deep learning
in maMIMO networks. Contrary to deep learning based power allocation,
traditional optimization-based power allocation techniques are not hindered
specifically by adversarial attacks (although other perturbations may degrade
their performance) since there is no model that can be used to craft a
gradient-based attack. Despite this advantage, optimization-based methods
still incur high computational overhead, which may not always be affordable in
real-time [11, 12, 13]. Thus, mitigating adversarial attacks in DNN-based
power allocation is needed to allow for both the computational efficiency and
model robustness of deep learning in maMIMO systems.

In this work, we consider a denoising autoencoder (DAE) framework for
mitigating the effects of adversarial attacks instantiated on DNN regression
models for power allocation in maMIMO networks. We begin by developing our
DAE, which is a layer-based DNN architecture trained to map perturbed
adversarial samples to their corresponding clean (non-adversarial)
representations. In addition, the DAE is also trained to map clean,
unperturbed data to itself in order to retain performance on non-adversarial
samples. During inference, the received sample is first forward propagated
through the DAE, and the DAE output is then inputted into the DNN regression
model as the BS. We evaluate, in terms of both robustness and computational
efficiency, the feasibility of our method against multiple attack generation
algorithms on two precoding schemes.

Formally, our contributions of this work can be summarized as follows:

  1. 1.

DAE output mitigation strategy against adversarial attacks (Sec. III, V, Sec.
VI-B, and Sec. VI-C): We develop a DAE architecture capable of filtering
adversarial perturbations out of maMIMO input data on deployed DNNs. At test
time, we show that forward propagating the input (i.e., UE positions) through
the DAE prior to inputting it into the DNN significantly mitigates the effects
of adversarial attacks.

  2. 2.

Effectiveness of defense in a multitude of environments  (Sec. IV, VI-A – Sec.
VI-C): We demonstrate the effectiveness of our defense in both semi-white box
and black box threat models on maMIMO networks using both maximum ratio (MR)
and multicell-minimum mean square error (MMMSE) precoding schemes.

  3. 3.

Robustness against first order $l_{\infty}$-bounded adversarial attacks (Sec.
VI-B and Sec. VI-C): We show that our proposed DAE defense provides robustness
against multiple first-order $l_{\infty}$-bounded adversarial attacks on
regression-based power allocation DNNs in multiple threat models and on
multiple precoding schemes.

  4. 4.

Computational Feasibility (Sec. VI-D): We quantify the computational speedup
provided by our proposed method over comparative benchmarks. Specifically, we
find that our proposed framework does not incur higher computational overhead
as the parameter space of the employed DNN increases.

##  II Related Work

Deep learning has recently achieved cutting edge performance in the domain of
wireless communications. The majority of these applications have consisted of
classification problems including, but not limited to, automatic modulation
classification [19], sensing and localization [20, 21], and channel estimation
[22]. Such tasks have extensively been shown to be vulnerable to adversarial
attacks [23], with a particular emphasis on automatic modulation
classification [24, 25, 26, 27]. Similarly, previous studies have proposed
methods to craft effective wireless eavesdroppers [28], while other works have
examined circumventing such eavesdroppers by intentionally transmitting
adversarially perturbed data that the receiver can subtract from the observed
signal [29, 30, 31]. Our work can be considered orthogonal to such approaches
in that our proposed framework is (i) based on regression and not
classification and (ii) aiming to directly induce erroneous behavior at the BS
and not fool an eavesdropper.

As a result of the susceptibility of wireless signal classifiers to
adversarial perturbations, several defenses have been proposed such as
autoencoder pre-training [32], detection and rejection [33], and assorted deep
ensembles [34]. Despite the strides made in defending signal classifiers from
adversarial attacks, these methods are difficult to directly adopt for
defending adversarial attacks on regression DNNs for the task of power
allocation in the downlink of maMIMO because they are specifically tailored
for classification tasks. In this work, we address this shortcoming by
developing a defense that is capable of mitigating adversarial attacks on DNNs
used for regression tasks in maMIMO networks.

Furthermore, in addition to the host of defenses studied in classification-
based wireless communications, defenses against adversarial attacks have been
investigated to a large extent in computer vision [35]. In particular, DAEs
have shown success in mitigating adversarial attacks for computer vision tasks
such as image classification [36, 37]. However, DAEs have not been explored
for mitigating adversarial attacks in regression-based computer vision tasks.
For mitigating adversarial attacks in regression-based maMIMO networks,
adversarial training [38, 39] has been shown to effectively reduce the
adversary’s success rate in white-box and black box settings [40]. Despite its
success, adversarial training remains vulnerable to high-bounded perturbations
and, further, suffers from overfitting to adversarial examples, which, in
turn, reduces performance on unperturbed data [41]. Our proposed DAE, on the
other hand, remains effective at high perturbation magnitudes without
significantly reducing baseline prediction performance.

Lastly, it is important to note that prior work has demonstrated the
ineffectiveness of pre-processing defense mechanisms in defending adversarial
attacks in computer vision applications [42]. However, contrary to computer
vision, adversaries in the context of maMIMO networks will rarely have
complete knowledge of each processing module employed at the BS [17, 43].
Thus, pre-processing defense mechanisms, as we will see, serve as effective
mitigation techniques in the context of wireless communications, where the
adversary is typically knowledge-limited while operating.

##  III Deep Learning for Power Allocation

In this section, we begin by describing the maMIMO power allocation objective
formulated for the downlink. Then, we describe how to use a DNN to estimate
the optimal solution for this objective. Here, we describe the complete
structure and training details of the DNN implemented at the BS.

###  III-A Downlink Power Allocation

We begin by considering a maMIMO system with $L$ cells, where each cell
contains a BS with $M$ antennas and $K$ UEs per cell. The downlink signal
transmitted from BS $j$ is given by

$\sum_{k=1}^{K}\mathbf{f}_{jk}\varsigma_{jk},$ (1)

where $\varsigma_{jk}\sim\mathcal{CN}(0,\rho_{jk})$ is the downlink data
signal for UE $k$ in cell $j$, and $\mathbf{f}_{jk}\in\mathbb{C}^{M}$ is the
precoding vector, which determines the directivity of the transmission.
Furthermore, $||\mathbf{f}_{jk}||^{2}=1$ and thus $\rho_{jk}$ corresponds to
the transmit power. Following (1) as the transmitted downlink signal, we
denote the received signal of UE $k$ in cell $j$ as

$\mathbf{y}_{jk}=\underbrace{(\mathbf{h}_{jk}^{j})^{\text{H}}\mathbf{f}_{jk}\varsigma_{jk}}_{\text{Desired
signal}}+\underbrace{\sum_{i\neq
k}^{K}(\mathbf{h}_{jk}^{j})^{\text{H}}\mathbf{f}_{ji}\varsigma_{ji}}_{\text{Intra-
cell Interference}}+\underbrace{\sum_{l\neq
j}^{L}\sum_{i=1}^{K}(\mathbf{h}_{jk}^{l})^{\text{H}}\mathbf{f}_{li}\varsigma_{li}}_{\text{Inter-
cell interference}}+\underbrace{n_{jk}}_{\text{AWGN}},$ (2)

where $[\cdot]^{\text{H}}$ denotes the Hermitian operator,
$\mathbf{h}_{jk}^{l}$ is the channel between BS $l$ and UE $k$ in cell $j$
(i.e., the superscript of $\mathbf{h}_{jk}^{l}$ corresponds to the transmit BS
and the subscripts identify the cell and index of the receive UE), and
$n_{jk}\sim\mathcal{CN}(0,\sigma^{2})$ is complex additive white Gaussian
noise (AWGN) with variance $\sigma^{2}$.

The desired UE does not have explicit channel knowledge a priori but can
estimate the channel, $\mathbf{h}_{jk}^{j}$, from its mean given by
$\mathbb{E}[(\mathbf{h}_{jk}^{j})^{\text{H}}\mathbf{f}_{jk}]$, where
$\mathbb{E}[\cdot]$ denotes the expectation operator. Similarly, since the UE
does not have knowledge of the other channels, they are estimated using the
mean over various channel realizations. Thus, the signal-to-interference-plus-
noise ratio (SINR) of (2) for UE $k$ in cell $j$ in the downlink is given by
(see [44])

$\gamma_{jk}^{\text{dl}}=\frac{\rho_{jk}a_{jk}}{\sum_{l=1}^{L}\sum_{i=1}^{K}\rho_{li}b_{lijk}+\sigma^{2}},$
(3)

where

$a_{jk}=|\mathbb{E}[\mathbf{f}_{jk}^{\text{H}}\mathbf{h}_{jk}^{j}]|^{2},$ (4)

and

$b_{lijk}=\begin{cases}\mathbb{E}[|\mathbf{f}_{jk}^{\text{H}}\mathbf{h}_{jk}^{l}|^{2}],&(l,i)\neq(j,k)\\\
\mathbb{E}[|\mathbf{f}_{li}^{\text{H}}\mathbf{h}_{jk}^{l}|^{2}]-|\mathbb{E}[\mathbf{f}_{li}^{\text{H}}\mathbf{h}_{jk}^{j}]|^{2},&(l,i)=(j,k)\end{cases},$
(5)

are the expected channel and interference gains, respectively.

Selecting the optimal precoder, $\mathbf{f}_{jk}$, is a challenging task since
(3) depends on the precoders of all UEs in the maMIMO network. Thus, following
prior work [11], we select the precoding vector according to
$\mathbf{f}_{jk}=\mathbf{v}_{jk}/||\mathbf{v}_{jk}||$, where $\mathbf{v}_{jk}$
denotes the combining vector used to detect the UL signal transmitted by UE
$k$ in cell $j$. We consider the efficacy of our proposed framework under both
MR [45] and MMMSE [46] as the precoding schemes, and throughout this work, we
will consider the performance impact of our framework under each precoding
scheme.

Using the above definitions of SINR, the max-product policy used for
calculating the optimal power allocation to UEs is given by [44]

$\displaystyle\underset{\rho_{jk:\forall j,k}}{\text{max}}\quad$
$\displaystyle\prod_{j=1}^{L}\prod_{k=1}^{K}\gamma_{jk}^{\text{dl}}$ (6a) s.
t. $\displaystyle\hskip 1.42262pt\sum_{k=1}^{K}\rho_{jk}\leq
P_{\text{max}}^{\text{dl}},j\in[1,L],$ (6b)

where $P_{\text{max}}^{\text{dl}}$ is the downlink transmit power budget. The
solution to (6) can be obtained using geometric programming, which requires
polynomial complexity. However, such complexity may not be afforded when
systems require power allocation in real-time, such as when UEs change
positions too quickly, thus requiring (6) to be frequently recalculated
resulting in higher latencies. By calculating the optimal power allocation for
UEs at various locations ahead of time (as further described in Sec. III-B), a
mapping between UE positions and their optimal power allocation can be learned
and then deployed at the BS for faster real-time power allocation prediction.

###  III-B Deep Learning Implementation

TABLE I: The DNN architecture of Model 1  Layer |  Units |  Activation Function
---|---|---
Input | $KL$ | -
Layer 1 | 256 | ELU
Layer 2 | 128 | ELU
Layer 3 | 64 | ELU
Layer 4 | 64 | ELU
Layer 5 | $K$ | ELU
Output | $K+1$ | Linear
TABLE II: The DNN architecture of Model 2  Layer |  Units |  Activation Function
---|---|---
Input | $KL$ | -
Layer 1 | 512 | ELU
Layer 2 | 256 | ELU
Layer 3 | 128 | ELU
Layer 4 | 128 | ELU
Layer 5 | $K$ | ELU
Output | $K+1$ | Linear

The objective of employing a DNN at the BS is to (i) learn the optimal power
allocation, given by the max-product policy, in the downlink of a maMIMO
network and (ii) reduce the latency incurred from solving (6) when UE
positions change in real-time. To do this, training data is first generated by
solving the formulation given in (6) using geometric programming for UEs
positioned at various locations throughout the considered cells (assuming
intra-cell UE movement, as considered in [11, 40, 15, 17, 18], but not inter-
cell UE movement). Then, a DNN is trained to learn the mapping between UE
positions and the optimal power allocations obtained from solving (6). Both
the calculation of (6) and the DNN training are done prior to implementation
and, thus, their incurred overhead does not contribute to real-time
computational costs. During implementation, the DNN significantly improves
latency because it (i) eliminates the need to calculate $\\{a_{jk}\\}$ and
$\\{b_{lijk}\\}$ and (ii) also eliminates the need to solve (6) when the $K$
UEs have moved within a cell. As a result, the overall runtime during
deployment can be reduced by up to $99.9\%$ [13].

Although generating the training data requires polynomial computational
complexity, since (6) has to be solved for each training sample, this can be
done offline, and thus higher complexity can be afforded since real-time
constraints do not apply. Specifically, UE positional data and their
corresponding optimal power allocations obtained from solving (6) are assumed
to be collected and stored in a central server where the DNNs are trained
(corresponding to the offline development) before the trained models are
deployed at the BSs for real-time power allocation (corresponding to the
online deployment). Thus, the trained DNN eliminates the need to re-calculate
the needed power for different sets of UEs as they move around the cells,
since their new power requirement can be predicted by forward propagating the
UE locations through the trained DNN at the BS, leading to significantly
improving latency.

Formally, we define the $n^{\text{th}}$ input to the DNN as
$\mathbf{x}(n)\in\mathbb{R}^{2KL}$, where
$\mathbf{x}(n)=[x_{1l},y_{1l},\cdots,x_{KL},y_{KL}]$ represents the
geographical coordinates, in a Euclidean space, of each of the $(KL)$ UEs. The
corresponding DNN target output is denoted by
$\boldsymbol{\rho}_{j}(n)\in\mathbb{R}^{K+1}$, which is the optimal power
allocation for each UE in cell $j$ obtained for training by solving (6) with
knowledge of (4) and (5). Note that, in addition to the power allocation for
each UE, $\boldsymbol{\rho}_{j}(n)$ also contains the power constraint
$\sum_{k=1}^{K}\rho_{jk}$, where
$\sum_{k=1}^{K}\rho_{jk}=P_{\text{max}}^{\text{dl}}$ and
$P_{\text{max}}^{\text{dl}}$ is always fixed, such that
$\boldsymbol{\rho}_{j}(n)=[\rho_{j1},\ldots,\rho_{jK},\sum_{k=1}^{K}\rho_{jk}]$
[15], in order to improve the DNN estimation ability during training and
inference. In addition, each BS learns the mapping between UE positions,
$\mathbf{x}(n)$, and power allocation, $\boldsymbol{\rho}_{j}(n)$, for the
individual cell $j$.

Next, we define
$\mathcal{X}_{\text{tr}}=\\{\mathbf{x}(n),\boldsymbol{\rho}_{j}(n);n=1,\ldots,N\\}$
as the training dataset containing $N$ samples. Using this dataset, at each
BS, we train a DNN,
$f^{l}(\cdot,\boldsymbol{\theta}_{l}):\mathbb{R}^{2KL}\rightarrow\mathbb{R}^{K+1}$,
parametertized by $\boldsymbol{\theta}_{l}$, to map each input sample,
$\mathbf{x}(n)$, (i.e., the position of each UE among all $L$ cells) to the
appropriate power allocation vector, $\boldsymbol{\rho}_{j}$, for each UE in
the cell. Here, the inputs only contain the positional information of the UEs;
the target label, containing the optimal power allocation vector obtained from
(6), capture the remaining effects of the channel. The DNN takes input
$(\cdot)$, and outputs the predicted power, $\hat{\boldsymbol{\rho}}_{j}$, to
allocate to each UE in its corresponding cell, i.e., the estimated power
allocation by the DNN to the UEs serviced by BS $j$ is given by
$\hat{\boldsymbol{\rho}}_{j}(n)=f^{l}(\mathbf{x}(n),\boldsymbol{\theta}_{l})$.
During evaluation, we employ the dataset
$\mathcal{X}_{\text{te}}=\\{\mathbf{x}(m),\boldsymbol{\rho}_{j}(m);m=1,\ldots,M\\}$,
where $\mathcal{X}_{\text{tr}}\cap\mathcal{X}_{\text{te}}=\emptyset$ (i.e., no
samples overlap in the training and evaluation datasets).

We evaluate our methodology on two considered DNN architectures. The first
model, referred to as Model 1, is a custom architecture, which we found
capable of learning the desired mapping between UEs and optimal power
allocation. The second model, Model 2, is adopted from prior work [11, 15]
that has shown it to be effective for power allocation in maMIMO systems. Both
considered models are shown in Table I and Table II, respectively. Each model
is a fully connected neural network (FCNN) comprised of individual units,
where each unit contains a set of trainable weights, whose input
dimensionality is equal to the number of units in the preceding layer, and the
number of units in each layer is an adjustable hyper-parameter. The output of
the $i^{\text{th}}$ layer of the DNN, prior to applying the activation, is
given by

$\mathbf{z}^{(i)}=\mathbf{W}^{(i)}\mathbf{o}^{(i-1)}+\mathbf{b}^{(i)},$ (7)

where $\mathbf{W}^{(i)}$ is the weight matrix of layer $i$,
$\mathbf{o}^{(i-1)}$ is the input vector to layer $i$ containing the output
from the previous layer, and $\mathbf{b}^{(i)}$ is a vector of threshold
biases.

Each intermediate layer in both Model 1 and Model 2 applies the unit-wise
exponential linear unit (ELU) activation function, thus resulting in the
output of each unit in hidden layer $i$ given by
$\mathbf{o}^{(i)}(p)=\nu(\mathbf{z}^{(i)}(p))$ where

${\nu}\big{(}\mathbf{z}^{(i)}(p)\big{)}=\begin{cases}\mathbf{z}^{(i)}(p)\geq
0\\\
\text{exp}\big{(}\mathbf{z}^{(i)}(p)\big{)}-1,&\mathbf{z}^{(i)}(p)<0\end{cases},$
(8)

and the output of the final layer applies the linear activation function
resulting in

${\nu}\big{(}\mathbf{z}^{(i)}(p)\big{)}=\mathbf{z}^{(i)}(p),$ (9)

where $\nu(\cdot)$ denotes the activation function, $\mathbf{z}^{(i)}(p)$ and
$\mathbf{o}^{(i)}(p)$ denote the $p^{\text{th}}$ unit of layer $i$ prior to
and after applying the activation, respectively, and $\mathbf{z}^{(i)}$ and
$\mathbf{o}^{(i)}$ are the output vectors of layer $i$ prior to and after
applying the activation, respectively.

Using
$\mathcal{X}_{\text{tr}}=\\{\mathbf{x}(n),\boldsymbol{\rho}_{j}(n);n=1,\ldots,N\\}$,
both Model 1 and Model 2 are trained by minimizing the relative mean squared
error, given by

$\ell(\mathbf{x}(n),\boldsymbol{\rho}_{j}(n),\boldsymbol{\theta}_{l})=\frac{1}{N}\sum_{n=1}^{N}\bigg{(}\frac{\boldsymbol{\rho}_{j}(n)-\hat{\boldsymbol{\rho}}_{j}(n)}{\boldsymbol{\rho}_{j}(n)}\bigg{)}^{2},$
(10)

using stochastic gradient descent (SGD) so that the model parameters on epoch
$t+1$ are updated according to111In practice, mini-batches are used to
accelerate training.

$\boldsymbol{\theta}_{l}^{t+1}=\boldsymbol{\theta}_{l}^{t}-\eta\frac{\partial\ell(\mathbf{x}(n),\boldsymbol{\rho}_{j}(n),\boldsymbol{\theta}_{l})}{\partial\boldsymbol{\theta}_{l}},$
(11)

where $\eta$ is the model learning rate and the parameters for the first
epoch, i.e., $\boldsymbol{\theta}_{l}^{0}$, are randomly initialized. Rather
than using a fixed learning rate, our training process starts with a learning
rate of $10^{-1}$ and gradually reduces to $10^{-4}$ as the model gets closer
to convergence. When multiple consecutive epochs yield indistinguishable
relative mean squared errors for their validation sets, we reduce the learning
rate by a factor of 0.1 to ensure the model takes smaller steps towards
convergence. We consider this training process for both Model 1 and Model 2 in
the cases of both MR and MMMSE precoding.

##  IV Adversarial Attacks on Power Allocation

In this section, we will begin by introducing the adversarial attack
formulation on the power allocation DNNs described in Sec. III. Then, we will
discuss two approaches of crafting adversarial attacks for inducing infeasible
power allocation solutions by the DNN. Finally, we will discuss the
adversarial threat model, where we will state the various knowledge levels we
consider the adversary to operate in and specify the available system
information known by the adversary.

###  IV-A Attack Formulation

Adversarial attacks on DNNs can be crafted in a multitude of ways (as further
discussed in Sec. IV-B and IV-C) by introducing subtle perturbations into an
input sample. In this work, we assume that the BS first obtains each UE’s
positional information for power allocation. After obtaining the UE positions
at the BS, and prior to its input to the DNN, an adversary crafts and injects
a perturbation into the DNN input sample. Physically, an attack crafted to
perturb an input in this fashion corresponds to changing the UEs current
position to a new position by a small amount (on the scale of tens of meters).
Such an attack can be instantiated via spoofing attacks by using global
navigation satellite system (GNSS) receivers, where an adversary calculates a
minimum distance perturbation that will result in erroneous outputs made by
the DNN [47]. Furthermore, such attacks may also induce from position
equivocation algorithms leading to inexact UE positional information at the
BS.

Formally, the adversary aims to inject the $n^{\text{th}}$ sample with a
perturbation, $\boldsymbol{\delta}(n)\in\mathbb{R}^{2KL}$, thus yielding

$\tilde{\mathbf{x}}(n)={\mathbf{x}}(n)+\boldsymbol{\delta}(n),$ (12)

where $\tilde{\mathbf{x}}(n)$ represents the perturbed adversarial sample. As
the adversary is aiming to operate undetected, while simultaneously trying to
degrade the DNN performance, an effective perturbation can be generated by
solving

$\displaystyle\underset{\boldsymbol{\delta}(n)}{\text{min}}\quad$
$\displaystyle||\boldsymbol{\delta}(n)||_{\infty}$ (13a) s. t.
$\displaystyle\hskip
1.42262pt\sum_{k=1}^{K}\hat{\rho}_{jk}>P_{\text{max}}^{\text{dl}}$ (13b)
$\displaystyle||\boldsymbol{\delta}(n)||_{\infty}\leq\epsilon,$ (13c)
$\displaystyle{\mathbf{x}(n)}+\boldsymbol{\delta}(n)\in\mathbb{R}^{2KL},$
(13d)

where $||\cdot||_{\infty}$ is the $l_{\infty}$ norm and $\epsilon$ is the
maximum allowed perturbation for each feature in $\mathbf{x}(n)$ (i.e.,
$||\tilde{\mathbf{x}}(n)-\mathbf{x}(n)||_{\infty}\leq\epsilon$), thus directly
corresponding to the the positional displacement of the UE. Although (13a)
specifically constrains the $l_{\infty}$ norm of $\boldsymbol{\delta}(n)$,
note that the adversary aims to inject its $\epsilon$-constrained perturbation
into each feature (positional coordinate) of $\mathbf{x}(n)$ (i.e.,
$\boldsymbol{\delta}(n)\in\mathbb{R}^{2KL}$). The ultimate objective of this
design, from the adversary’s perspective, is to force the DNN to output an
infeasible power allocation solution as in (13b), while remaining in (i) an
$\epsilon$-neighborhood of the original sample as in (13c) and (ii) the same
dimensional space as the input as given by (13d). Furthermore, note that the
perturbation is added after normalizing the sample and prior to inputting it
to the DNN and, therefore, the normalization does not aid in mitigating the
attack since the perturbation is added after normalization.

Due to the excessive nonlinearity of DNNs as well as the non-convex nature of
the adversary’s objective function, solving (13) directly is very challenging.
Thus, several gradient-based adversarial attacks have been proposed in order
to approximate a solution that ideally solves (13) in effective and
computationally efficient ways [48, 49]. Since solutions to (13) are typically
approximated, they may not always be effective (i.e., there may be designs of
$\boldsymbol{\delta}(n)$ for which certain constraints in (13) are not
satisfied). Specifically, an adversarial attack is effective when the DNN
outputs an infeasible power allocation to the UEs as a result of the
perturbation and ineffective otherwise. Moreover, the adversary’s primary
objective is to force an infeasible output by the DNN and, thus, an effective
approximation to (13) may not necessarily be realized when
$||\boldsymbol{\delta}(n)||_{\infty}$ is minimized.

As shown in (13), we consider the class of adversarial attacks bounded by the
$l_{\infty}$ norm constraint. However, adversarial attacks can be constrained
by other $l_{p}$ norms as well such as when $p=0$, $p=1$, or $p=2$. In this
work we focus exclusively on $l_{\infty}$ norm since the input to the DNN is
the position of the UE in a Euclidean space, and thus the $l_{\infty}$ norm
corresponds to the maximum positional displacement of the UE. Note that the
distance of the UE displacement for an attack bound of $\epsilon$ is given by
$d_{\epsilon}=\sqrt{2}\epsilon$ since the perturbation displaces the UE along
both dimensions of the Euclidean space.

We consider two adversarial attack algorithms that approximate solutions to
(13): the fast gradient sign method (FGSM) [39] and projected gradient descent
(PGD) [50]. The FGSM is a single step attack making it computationally
efficient whereas PGD is iterative thus requiring higher complexity to
implement but resulting in a more potent attack compared to the FGSM. Both
attacks rely on adding a perturbation in the direction of some loss function’s
gradient to achieve their objective. In order to maximize the probability of
crafting an effective attack, and following in line with prior works [17, 40],
we define the loss function used by the adversary to be

$\mathcal{L}(\mathbf{x}(n),\boldsymbol{\theta})=\sum_{k=1}^{K}\hat{\rho}_{jk},$
(14)

where $\hat{\rho}_{jk}$ corresponds to the predicted power to be allocated to
UE $k$ in cell $j$ on the input sample $\mathbf{x}(n)$. The adversary may
either use the DNN deployed at the BS to measure this loss, or they may
alternatively use a surrogate DNN. The DNN used by the adversary will depend
on the amount of available system knowledge, which is further discussed in
Sec. IV-D. Next, we will discuss how the adversary uses (14) to craft
$\boldsymbol{\delta}(n)$ using the FGSM and PGD algorithms. Each considered
attack is applied cell-wise, where the adversary aims to degrade performance
of the DNN in the cell serviced by the respective BS.

###  IV-B Fast Gradient Sign Method (FGSM)

The FGSM is a single step method that is given by

$\boldsymbol{\delta}(n)=\epsilon\hskip
1.42262pt\text{sign}\bigg{(}\nabla_{\mathbf{x}(n)}\mathcal{L}(\mathbf{x}(n),\boldsymbol{\theta}_{l})\bigg{)},$
(15)

where $\mathcal{L}(\mathbf{x}(n),\boldsymbol{\theta}_{l})$ is the loss
function used by the adversary to craft the perturbation and the model that is
used to calculate the loss function’s gradient is parameterized by
$\boldsymbol{\theta}_{l}$. Thus, the adversarial sample generated using the
FGSM targeted at cell $l$ is given by

$\tilde{\mathbf{x}}(n)={\mathbf{x}}(n)+\epsilon\hskip
1.42262pt\text{sign}\bigg{(}\nabla_{\mathbf{x}(n)}\mathcal{L}(\mathbf{x}(n),\boldsymbol{\theta}_{l})\bigg{)}.$
(16)

Intuitively, the FGSM aims to add the $\epsilon$-bounded perturbation in the
direction that results in the highest loss on the model. This can be
considered a step of gradient ascent, where after calculating the direction of
the gradient, the perturbation is added in that direction instead of
subtracted as is done when training the model using SGD in (11). This attack
is calculated for each DNN deployed at the each of the separate BSs since the
attacks considered here are cell-wise.

###  IV-C Projected Gradient Descent (PGD)

PGD is an iterative extension of FGSM. Specifically, instead of adding
$\epsilon$ in a single step to each feature in the direction of the loss
function’s gradient, as in (15), a smaller perturbation, $\alpha=\epsilon/Q$,
is added over $Q$ iterations, where the direction of the gradient is
recalculated on each iteration. Formally, the total perturbation is
initialized to zero on the $n^{\text{th}}$ sample,
$\mathbf{\Delta}^{(0)}(n)=\mathbf{0}$, and on each iteration, $q$, the
perturbation is crafted according to

$\mathbf{\Delta}^{(q)}(n)=\mathbf{\Delta}^{(q-1)}(n)+\alpha\hskip
1.42262pt\text{sign}\bigg{(}\nabla_{\mathbf{x}(n)}\mathcal{L}(\mathbf{x}^{(q-1)}(n),\boldsymbol{\theta}_{l})\bigg{)},$
(17)

where the final perturbation is given by

$\boldsymbol{\delta}(n)=\mathbf{\Delta}^{(Q)}(n),$ (18)

thus resulting in the $n^{\text{th}}$ adversarial sample crafted according to
PGD being

$\tilde{\mathbf{x}}(n)=\mathbf{x}(n)+\mathbf{\Delta}^{(Q)}(n).$ (19)

The increased potency of the PGD attack, over the FGSM, is a result of its
iterative recalculation of the optimal direction of attack. This not only
makes PGD more potent of an attack, but it also makes it much harder to
mitigate at the BS.

###  IV-D Threat Model and Adversary Knowledge Level

As shown in both FGSM and PGD formulations, the generation of adversarial
attacks requires the adversary to calculate the gradient of the loss function
with respect to a particular model. However, a successful adversarial attack
(i.e., an attack that induces an erroneous power solution by the DNN) does not
need to be crafted using the gradient of the DNN under attack. This is because
adversarial attacks are transferable [51, 52, 53] in that attacks crafted to
fool one specific DNN are effective on disparate models trained to perform the
same task. Due to the transferability property of adversarial attacks, and
considering that adversaries will realistically not have precise information
about the DNN at the BS [17], we consider two distinct knowledge levels,
termed _threat models_ , of the adversary.

Semi-white box attack: In the semi-white box threat model, we assume that the
adversary has full access to the DNN model architecture and its parameters but
is blind to any pre-processing functions and algorithms applied to the UE
positions prior to its input to the DNN. This type of a threat model would
hold when the DNN applied at the BS is an off-the-shelf model made publicly
available (as several DNN models are, e.g., residual DNNs for ImageNet [54])
giving an adversary access to it but simultaneously leaving them blind to
other system modules. Therefore, under the semi-white box threat model, the
adversary would use the gradient of the model deployed at the BS to craft the
attack.

Black box attack: In the black box threat model, the adversary is aware of the
power allocation regression task at the BS, but they are blind to both the DNN
(including its architecture and parameter values) and the pre-processing
applied to the input prior to forward propagating it through the DNN. Here,
the adversary leverages the transferability property of adversarial attacks
and trains their own surrogate model. Then, the gradient of the surrogate
model is used to craft and transfer the attack to the input processed by the
DNN at the BS. Due to the transferability property of adversarial attacks, an
attack crafted on a surrogate model is expected to induce an infeasible power
allocation solution on the model at the BS with high probability, albeit with
lower potency (i.e., the same perturbation displacement may not be as
effective in a black box attack compared to a semi-white box attack).

##  V The Denoising Autoencoder Defense

Figure 1: Our considered system diagram within a cell, where the BS contains both the regression DNN and the pre-processing DAE used to mitigate adversarial attacks on UE positions. TABLE III: The DAE architecture at each BS  Layer |  Units |  Activation Function
---|---|---
Input | $KL$ | -
Layer 2 | 32 | Linear
Layer 3 | 16 | Linear
Layer 4 | 32 | Linear
Output | $KL$ | Linear

In this section, we discuss our proposed methodology for defending maMIMO
power allocation DNNs from adversarial attacks. We begin by introducing a deep
learning-based denoising function, which is used to pre-process inputs prior
to their input to the DNN. After the DAE has been trained, samples at
inference time (when the DAE is deployed at the BS) are forward propagated
through the DAE before being inputted into the regression DNN. The DAE is
trained to mitigate the effect of any potential additive adversarial
perturbation as well as retain performance on unperturbed signals.

Algorithm 1 Denoising Autoencoder Construction

1: input: $\mathcal{X}_{\text{tr}}$: Set of input samples:
$\mathbf{x}(n)\hskip 5.69054pt\forall\hskip 5.69054ptn$
$f^{l}(\cdot,\boldsymbol{\theta}_{l})$: Trained regression DNN at BS $l$
$\alpha_{l}$: $l_{\infty}$-norm bound used at BS $l$
$u^{l}(\cdot,\boldsymbol{\phi}_{l})$: Randomly initialized encoder function
$v^{l}(\cdot,\boldsymbol{\zeta}_{l})$: Randomly initialized decoder function

2: initialize: $\mathcal{X}_{\text{DAE}}\leftarrow\emptyset$

3: for $\mathbf{x}(n)\in\mathcal{X}_{\text{tr}}$ do

4: $\mathbf{\Delta}^{(0)}(n)=\mathbf{0}$

5: for $q=1,\ldots,Q$ do

6:
$\mathcal{L}(\mathbf{x}^{(q-1)}(n),\boldsymbol{\theta})=\sum_{k=1}^{K}\hat{\rho}_{jk}$

7:
$\boldsymbol{\kappa}^{(q-1)}(n)=\text{sign}(\nabla_{\mathbf{x}(n)}\mathcal{L}(\mathbf{x}^{(q-1)}(n),\boldsymbol{\theta}_{l}))$

8: $\mathbf{\Delta}^{(q)}(n)=\mathbf{\Delta}^{(q-1)}(n)+\alpha_{l}\hskip
1.42262pt\boldsymbol{\kappa}^{(q-1)}(n)$

9: end for

10: $\tilde{\mathbf{x}}(n)=\mathbf{x}(n)+\mathbf{\Delta}^{(Q)}(n)$

11: append $\tilde{\mathbf{x}}(n)$ to $\mathcal{X}_{\text{DAE}}$

12: end for

13:
$\mathcal{X}_{\text{DAE}}\leftarrow\text{concatenate}(\mathcal{X}_{\text{DAE}},\mathcal{X}_{\text{tr}})$

14:
$\mathcal{X}_{\text{target}}\leftarrow\text{concatenate}(\mathcal{X}_{\text{tr}},\mathcal{X}_{\text{tr}})$

15: for
$\mathbf{x}^{\prime}(n),\mathbf{x}(n)\in\mathcal{X}_{\text{DAE}},\mathcal{X}_{\text{target}}$
do

16: $\mathbf{e}=\mathbf{x}(n)-v^{l}(u^{l}(\mathbf{x}^{\prime}(n)))$

17:
$D^{l}(\cdot,\boldsymbol{\phi}_{l},\boldsymbol{\zeta}_{l})\leftarrow\underset{\boldsymbol{\phi}_{l},\boldsymbol{\zeta}_{l}}{\text{min}}\frac{1}{2KL}\sum_{s=1}^{2KL}(\mathbf{e}(s))^{2}$

18: end for

19: return $D^{l}(\cdot,\boldsymbol{\phi}_{l},\boldsymbol{\zeta}_{l})$

Adversarial attacks introduce subtle perturbations into the input that lead to
erroneous outputs by the DNN. Since such attacks are often gradient-based,
they will be added in a manner consistent with maximizing some loss function
regardless of the type of attack and threat model adopted by the adversary. We
leverage this intuition and propose training a Denoising Autoencoder (DAE),
which is capable of filtering noise from a consistent corruption processes
[55].

The construction of our proposed DAE is detailed in Algorithm 1. We begin by
using the samples comprising $\mathcal{X}_{\text{tr}}$ to generate adversarial
examples using PGD. We choose to tailor our DAE to specifically defend PGD
attacks because prior work [50] has shown that, for classification-based DNNs,
robustness against this attack guarantees robustness against other first-order
$l_{\infty}$-bounded adversarial attacks as well. In Sec. VI, we show that
this property extends to regression-based DNNs as well in the specific context
of mitigating adversaries in maMIMO power allocation.

Furthermore, note from lines 3 – 12 of Algorithm 1 that the DAE is expected to
use some adversarial corruption process to generate adversarial samples for
training. In order to do this, we employ the PGD from (17)-(19) using the
gradient of the DNN at BS $l$. This corresponds to a semi-white box
adversarial sample generation method, which is chosen since semi-white box
attacks are more potent than black box attacks. Thus, training to defend a
semi-white box attack is expected to increase robustness to black box attacks,
despite the gradient used to generate such attacks being in a suboptimal
direction of attack (different than the direction of the gradient of the loss
calculated using the DNN under attack at the BS).

Following the generation of PGD adversarial examples, at BS $l$, we train a
DAE denoted by
$D^{l}(\cdot,\boldsymbol{\phi}_{l},\boldsymbol{\zeta}_{l}):\mathbb{R}^{2KL}\rightarrow\mathbb{R}^{2KL}$,
which consists of an encoder function,
$u^{l}(\cdot,\boldsymbol{\phi}_{l}):\mathbb{R}^{2KL}\rightarrow\mathbb{R}^{z}$,
parameterized by $\boldsymbol{\phi}_{l}$, and a decoder function
$v^{l}(\cdot,\boldsymbol{\zeta}_{l}):\mathbb{R}^{z}\rightarrow\mathbb{R}^{2KL}$
parameterized by $\boldsymbol{\zeta}_{l}$. The encoder compresses the $2KL$
dimensional input into a $z$ dimensional representation, and the decoder
reconstructs an approximation of the uncorrupted input from the $z$
dimensional representation to the original $2KL$ dimensional space. The full
DAE, comprised of both the encoder and decoder, are constructed using fully
connected layers. The architecture of our proposed model is shown in Table
III. After random initialization, the DAE is trained, using SGD, to map the
generated PGD adversarial examples to an approximation of the unperturbed
positional input by minimizing the mean squared error. Here, we first
calculate the error between the DAE’s reconstruction of an adversarial example
and its corresponding clean sample given by

$\mathbf{e}=\mathbf{x}(n)-v^{l}(u^{l}(\tilde{\mathbf{x}}(n))),$ (20)

where $v^{l}(u^{l}(\tilde{\mathbf{x}}(n)))$ is the output of the DAE on input
$\tilde{\mathbf{x}}(n)$ and $\mathbf{e}\in\mathbb{R}^{2KL}$, which corresponds
to the difference being taken element-wise. Next, we train the DAE by
minimizing the squared error given by

$\underset{\boldsymbol{\phi}_{l},\boldsymbol{\zeta}_{l}}{\text{min}}\quad\frac{1}{2KL}\sum_{s=1}^{2KL}(\mathbf{e}(s))^{2},$
(21)

where $\mathbf{e}(s)$ denotes the $s^{\text{th}}$ element in the error vector
$\mathbf{e}$. Although the formulation shown here corresponds to training on
one sample at a time (i.e., a batch size of 1), mini-batches consisting of
multiple samples are used in practice to accelerate training.

During the deployment of the DAE defense, the BS will be unaware whether the
input is corrupted or not (i.e., the BS will not know whether $\mathbf{x}(n)$
of $\tilde{\mathbf{x}}(n)$ was received). Therefore, while the trained DAE
should map $\tilde{\mathbf{x}}(n)$ to an approximation of $\mathbf{x}(n)$, it
should also be capable of mapping $\mathbf{x}(n)$ to an approximation of
itself so that benign inputs do not suffer performance degradation by the
defense. During training, we enforce this mapping by including all uncorrupted
training samples (i.e., all samples in $\mathcal{X}_{\text{tr}}$) in the
training set for the DAE. This is shown in lines 13 – 18 of Algorithm 1.

After training the DAE, each input is pre-processed using
$D^{l}(\cdot,\boldsymbol{\phi}_{l},\boldsymbol{\zeta}_{l})$ before being
inputted to the DNN for power allocation. Specifically, given a received
sample, $\tilde{\mathbf{x}}(n)$, we first denoise it to subtract any potential
adversarial perturbation. The denoised input is given by
$\hat{\mathbf{x}}(n)=D^{l}(\tilde{\mathbf{x}}(n),\boldsymbol{\phi}_{l},\boldsymbol{\zeta}_{l})$.
Then, $\hat{\mathbf{x}}(n)$ is forward propagated through the DNN regression
model to yield the prediction power allocation solution to each UE in cell $j$
given by
$\hat{\boldsymbol{\rho}}_{j}(n)=f^{l}(\hat{\mathbf{x}}(n),\boldsymbol{\theta}_{l})$.
Our overall system diagram is shown in Fig. 1.

##  VI Performance Evaluation

In this section, we conduct an empirical evaluation of our methodology. We
begin by describing the datasets and hyperparameters used in our evaluation.
Next, we describe the performance of our defense in both a semi-white box and
black box attack environment, where we also outline the performance of our
methodology in the absence of adversarial attacks. Finally, we describe the
computational efficiency of our method, where we find that implementing our
method to defend existing maMIMO power allocation DNNs can be done without
high computational overhead.

###  VI-A Dataset and Performance Metrics

To assess the efficacy of our methodology, we employ the Power Allocation in
Multi-Cell Massive MIMO dataset, which is publicly available at
https://data.ieeemlc.org/Ds2Detail. Here, we consider $L=4$ cells in a square
grid layout of $2\times 2$ cells and a square area of $250\times 250$ m per
cell. Each cell consists of $K=5$ randomly, uniformly distributed UEs per
cell. The presented results are averaged across all BSs. We consider
communications over a 20 MHz bandwidth with a total receiver noise power of
$\sigma^{2}=-94\text{dBm}$. In each cell, the BS is located in the center of
the cell. For power allocation, we use
$P_{\text{max}}^{\text{dl}}=500\text{mW}$. This indicates that a feasible
power allocation solution is achieved when the DNN predicts a total power
allocation of 500 mW or less to all UEs in the cell. Otherwise, when a power
allocation sum of greater than 500 mW is predicted, the solution in
infeasible.

The DAE is trained according to Algorithm 1 using the architecture shown in
Table III. Here, we use $\alpha_{l}=0.03$ and $Q=10$ to train the DAE at all
BSs. At test time, we vary the perturbation magnitude of each considered
attack and measure the _attack success rate_ , which is the number of samples
in the testing set that exceed the power budget of
$P_{\text{max}}^{\text{dl}}=500\text{mW}$ in the DNN prediction output (i.e.,
the proportion of samples that satisfy each constraint in (13)). The inputs to
each model (Model 1, Model 2, and DAE) are the normalized UE positions with
zero mean and unit variance (corresponding to uniformly distributed UEs) and,
we consider attacks crafted directly on the normalized samples. As a result,
the perturbation magnitude induced on each normalized input sample corresponds
to a physical UE displacement of $\sqrt{2}\psi\epsilon$, where $\psi$ is the
standard deviation of the unnormalized samples. Here, scaling by a factor of
$\psi$ unnormalizes the sample’s positional scale, and the factor of
$\sqrt{2}$ accounts for the total UE displacement since each UE is displaced
along both geographical coordinates by $\epsilon$. Note that the standard
deviation used to normalize each feature is $\psi\approx 145$, which
corresponds to the standard deviation of a uniform distribution with a $500$ m
interval (i.e., the assumed UE distribution in the $2\times 2$ cells of
$250\times 250$ m each considered here). For example, a perturbation magnitude
of $\epsilon=0.05$ in the FGSM attack corresponds to a maximum UE displacement
of $d_{\epsilon}=10.28$ m. Similarly, for the PGD attack with $Q=10$
iterations, a perturbation magnitude of $\alpha=0.01$ corresponds to a a
maximum UE displacement, as observed by the BS, of $d_{\epsilon}=20.57$ m.

###  VI-B Semi-white Box Performance

Figure 2: Semi-white box attack on Model 1 for each considered attack and
precoding scheme. We see that, on undefended models, the attack success rate
grows as the perturbation magnitude increases. Our proposed DAE, however,
results in a significantly lower attack success rate outperforming the
considered baseline. Figure 3: Semi-white box attack on Model 2 for each
considered attack and precoding scheme. Similar to Fig. 2, we see that the PGD
attack is more potent than the FGSM attack. In addition, we see that our
proposed DAE outperforms the considered baseline and significantly reduces the
attack success rate in each considered case. Figure 4: The power prediction
distributions under each considered defense scenario on Model 2 in the semi-
white box environment. Wee see that our proposed DAE defense (bottom right)
significantly lowers the proportion of samples predicted with infeasible power
solutions (i.e., when $P_{\text{max}}^{\text{dl}}>500\text{mW}$) over using no
defense (top right) and adversarial training (bottom left).

We begin by evaluating the efficacy of our proposed defense in the semi-white
box threat model, where the adversary has access to the classifier (either
Model 1 or Model 2) under attack and uses its gradient to generate an
adversarial perturbation. We consider attacks on both Model 1 and Model 2
using both the MMMSE and MR precoding schemes. In addition, we compare our
results to adversarial training on maMIMO DNN models [40] in each case as a
performance benchmark. Adversarial training, as proposed in [40], consists of
generating adversarial perturbations on the target DNN (i.e., the model whose
gradient will be used to generate the attack) and retraining it with the
corrected labels. Although this method is effective in mitigating low-bounded
perturbations, it remains vulnerable to higher bounded perturbations and,
furthermore, is highly susceptible to overfitting on adversarial samples thus
lowering its prediction performance on unperturbed inputs [41]. Our proposed
method aims to address these shortcomings of adversarial training.

To evaluate and compare our proposed method, we show four performance curves
per environment. First, we show the baseline with no attack, which is the
proportion of samples whose power predictions naturally result in infeasible
power solutions without any added perturbations. This is analogous, in a
classification setting, to samples that are misclassified due to the DNN’s
inability to correctly predict them rather than due to any additive
perturbations. Thus, since the baseline is not dependent on the perturbation
magnitude, it stays constant throughout the considered perturbation range.
Second, we show the performance curves for the baseline case, which is the
performance of the DNN without any defense in place to mitigate the attack.
Third, we show the performance of our DAE defense, and fourth, we show the
performance of the adversarial training defense as previously described. We
benchmark against adversarial training because, to the best of our knowledge,
it is currently the only method that has been proposed to defend maMIMO power
allocation DNNs from adversarial attacks besides our proposed work.

Figs. 2 and 3 show the DNN performance of Model 1 and Model 2, respectively.
In general, we can see from both models that the PGD attack is more potent
than the FGSM attack irrespective of the precoding scheme. In addition, we see
that adversarial training remains susceptible to high-bounded adversarial
attacks which is consistent with prior works that have proposed adversarial
training as a defense [40, 41]. This trend is observed under both FGSM and PGD
perturbations, where adversarial training delivers slightly improved
performance over no defense. Our proposed defense, on the other hand, is able
to significantly mitigate semi-white box attacks across the entire range of
considered perturbation magnitudes. For example, at a perturbation magnitude
of $\alpha=0.10$, the PGD attack on MR pre-coded samples on both Models 1 and
2 results in nearly $100\%$ samples being predicted with infeasible power
allocation solutions on both undefended models and models with adversarial
training. However, with our proposed DAE in place, only approximately $10\%$
of the samples produce infeasible solutions. Although the FGSM attack yields a
smaller proportion of infeasible solutions in comparison to the PGD
perturbation, our defense is still able to mitigate its effects to a large
degree (e.g., from $60\%$ to $10\%$ on Model 1 with MR precoding). These
observations are consistent across both Model 1 and Model 2 in defending both
considered attacks on both considered precoding schemes.

Next, we consider the performance of our defense in the absence of adversarial
attacks. Note that, upon receiving a sample of UE positional locations, the BS
will be unaware of whether it contains an adversarial perturbation or not.
Therefore, any employed defense should keep the baseline performance on
unperturbed signal intact. In Figs. 2 and 3, unperturbed signals correspond to
$\epsilon=0$ and $\alpha=0$ for the FGSM and PGD perturbations, respectively
(this results in $\boldsymbol{\delta}(n)=\mathbf{0}$ in (15) and (18) for FGSM
and PGD, respectively). From Figs. 2 and 3, we see that, at a perturbation
magnitude of zero, our proposed defense retains approximately the same
performance as the baseline model with no attack (i.e., the performance on the
original DNN at the BS before employing any defense). In fact, the DAE
slightly improves the baseline power prediction performance in the absence of
adversarial attacks in black box setups with MR precoding. Ultimately, in all
cases, the proposed defense provides strong attack mitigation abilities on a
wide range of attacks.

We more closely examine the distribution of predicted power by the DNN under
different defenses in Fig. 4. Here, we instantiate a PGD attack using
$\alpha=0.05$ on Model 2. Once again noting that
$P_{\text{max}}^{\text{dl}}=500\text{mW}$, we see that the original set of
unperturbed testing samples only result in $9.15\%$ of samples being predicted
with infeasible power solutions whereas, after instantiating the attack with
no defense, $99.27\%$ of predicted samples are infeasible. Our proposed DAE
defense significantly reduces the proportion of samples predicted with
infeasible solutions to $24.01\%$, which outperforms adversarial training and
more closely approaches the performance of the model with no attack.

Finally, as shown in Algorithm 1, only PGD adversarial examples are generated
to train the DAE. However, as shown in Figs. 2 and 3, the DAE is still able to
defend the FGSM perturbation. Thus, we see that training to defend the PGD
attack, as our proposed defense does, provides robustness against other first-
order $l_{\infty}$-bounded perturbations on power allocation regression-based
DNNs in maMIMO. Furthermore, the PGD attack generated to defend the DNN only
employs one perturbation bound ($\alpha=0.03$ and $Q=10$ as discussed
earlier). Yet, it is able to provide mitigation against a wide range of
adversarial perturbation magnitudes as demonstrated in Figs. 2 and 3. This
provides a substantial improvement over adversarial training, where training
on multiple bounds may be required for better robustness at the cost of lower
performance on non-adversarial samples. Training our proposed DAE on a single
perturbation bound not only retains the performance on unperturbed samples
(i.e., when $\boldsymbol{\delta}(n)=\mathbf{0}$), but it also does not incur
costly computational overhead during deployment, which will be further
discussed in Sec. VI-D.

###  VI-C Black Box Performance

Figure 5: Black box attack where the adversary crafts their attack using Model
2, and Model 1 is the victim model employed at the BS. In comparison to the
semi-white box scenario, we see that black box adversarial attacks are less
potent on the victim model. Nonetheless, our proposed DAE still reduces the
attack success rate over undefended and baseline methods in each considered
setup. Figure 6: Black box attack where the adversary crafts their attack
using Model 1, and Model 2 is the victim model employed at the BS. Similar to
Fig. 5, we see that black box attacks are less potent than semi-white box
attacks, but our proposed method is still the most effective in reducing the
adversary’s success rate in each considered scenario. Figure 7: The power
prediction distributions under each considered defense scenario on Model 2 in
the black box environment. Similar to Fig. 4, we see that our proposed DAE
defense (bottom right) lowers the proportion of samples predicted with
infeasible power allocation solutions
($P_{\text{max}}^{\text{dl}}>500\text{mW}$), outperforming both undefended
models (top right) and adversarial training (bottom left).

Now, we discuss the effectiveness of our defense in the black box threat
model, where the adversary is blind to the DNN model used for power allocation
at the BS. Here, we consider two attack scenarios. The first is where the
adversary crafts an adversarial attack using the gradient of Model 2 but Model
1 is used to predict the power allocation at the BS using the perturbed
sample. The second case is where the attack is crafted using the gradient of
Model 1 but the perturbed sample is evaluated on Model 2 at the BS. Results
for the former and latter attack scenarios are shown in Figs. 5 and 6,
respectively, where we use the term _victim model_ to refer to the model under
attack and the term _adversary model_ to refer to the model whose gradient is
used to generate the perturbation.

From Figs. 5 and 6, we see that black box attacks are generally less potent on
regression-based DNNs for power allocation in comparison to semi-white box
attacks. This is most likely due to the gradient direction in which the
perturbation should be added to induce infeasible solutions on the victim
model differing from the adversary’s model to a significant degree. We find
that this trend, which has been shown in prior work for classification DNNs
[51, 52], extends to black box attacks on regression DNNs for power
allocation. This is further shown in Fig. 7, where we plot the distribution of
the sum of the predicted power for all testing samples. In comparison to Fig.
4, corresponding to the semi-white box threat model, we see that the same
perturbation magnitude ($\alpha=0.05$) results in less infeasible samples on
defended models, thus corroborating the lower potency of black box attacks in
maMIMO DNNs. Despite the lower potency, we still see that our proposed defense
is able to lower the proportion of samples predicted with infeasible power
solutions.

Moreover, we see that the general trends observed on the effectiveness of our
defense in the semi-white box threat model hold in the black box threat model
as well despite the attacks being less transferable (and thus less potent in
the black box threat model). For example, the DAE retains its prediction
performance on unperturbed samples as shown in Figs. 5 and 6 where
$\epsilon=0$ and $\alpha=0$ for the FGSM and PGD attack, respectively. In
addition, the DAE significantly reduces the proportion of samples predicted
with an infeasible power solution in each case over the considered
perturbation magnitude range in comparison to adversarial training and no
defense. For example, as shown in Fig. 6, a PGD adversarial attack on samples
with MR precoding results in an adversary success rate of approximately $70\%$
and adversarial training reduces the adversarial success rate to approximately
$58\%$ while our proposed DAE reduces the adversarial success rate to
approximately $11\%$, which is approaching the expected performance of the DNN
when no attacks are present (approximately $10\%$ of samples predicted with
infeasible solutions). Lastly, we see that our proposed defense is able to
mitigate FGSM attacks despite only being trained on PGD perturbations on one
perturbation magnitude. This reinforces our proposed method’s ability to
provide robustness against other first order $l_{\infty}$-bounded adversarial
attacks that the DAE was not trained to defend.

###  VI-D Mitigation Efficiency

Lastly, we discuss the computational feasibility of our proposed defense
during both offline and online usage. Offline computational overhead is
primarily associated with the training costs of the defense. During training,
our proposed DAE takes, on average, $2.01$ secs. per epoch to train whereas
adversarial training requires, on average, $3.10$ secs. per epoch. In both
cases, these average training times assume that the defense only requires one
perturbation bound for training. Advantageously, our proposed DAE defense can
significantly mitigate a wide range of perturbation magnitudes when only
trained on one bound (as described in Algorithm 1 and shown in Sec VI-B and
VI-C), while adversarial training may require additional bounds leading to
even higher offline computational costs. In addition, the computational cost
of adversarial training is dependent on the DNN architecture and its total
number of trainable parameters (since it requires retraining) whereas the
training cost of the DAE is independent of the DNN architecture. For example,
the DAE trained to defend both Model 1 and Model 2 incur identical
computational costs despite Model 2 having more parameters than Model 1. As a
result, our proposed DAE can be implemented on high-parameter DNNs for strong
adversarial attack mitigation without incurring high offline computational
costs.

Online computational costs correspond to the total time required at the BS to
predict the power allocation to each UE in the cell. The forward propagation
time through the DNN at the BS for power prediction on one sample (i.e., one
particular distribution of UE positions) is $1.25\times 10^{-3}$ secs. Forward
propagation through the DAE prior to inputting the sample into the DNN adds an
additional $0.87\times 10^{-3}$ secs. for both Model 1 and Model 2, thus
resulting in an online prediction time of our proposed defense of $2.12\times
10^{-3}$ secs. Thus, with our proposed defense in place, the prediction time
during online implementation remains very low and allows for rapid
recalculation of power allocation as UEs quickly move within cells.

##  VII Conclusion

Power allocation from base stations (BSs) to user equipments (UEs) is a vital
task in maMIMO networks for low-interference communications and low-cost
operations. Recent work has shown that deep neural networks (DNNs) can perform
effective power allocation with reduced computational overhead in comparison
to convex optimization techniques. Yet, DNNs are susceptible to adversarial
attacks, which introduce slight perturbations into the DNN input sample
corresponding to positional displacements observed by the BS. As a result,
trained DNNs predict infeasible power allocation solutions to the UEs, thus
depleting their effectiveness for real-time power allocation and outweighing
their computational efficiency advantage. In this work, we proposed defending
power allocation DNN models from adversarial attacks using denoising
autoencoders (DAEs), where input sample were first forward propagated through
the DAE to filter any potentially added adversarial attack before being
inputted to the DNN for power allocation prediction. Through evaluation on
multiple threat models, DNN architectures, and signal precoding schemes, we
showed that our proposed method was capable of producing feasible power
allocation solutions in the presence of adversarial attacks while keeping the
performance on unperturbed signals intact. Moreover, we showed that, for the
considered threat models, our method outperforms adversarial training, which
is a previously proposed method for defending adversarial attacks on maMIMO
DNNs. Ultimately, our proposed method significantly improves power allocation
prediction to UEs in maMIMO networks in the presence of adversarial attacks,
and it can be adopted in existing systems with relatively little computational
overhead. Future work will consider the scalability of our work in very large
federated machine learning networks [56], where layers of devices are used to
between BSs to train and defend power allocation DNNs.

## References

  * [1] K. Zheng, L. Zhao, J. Mei, B. Shao, W. Xiang, and L. Hanzo, “Survey of large-scale mimo systems,” _IEEE Communications Surveys & Tutorials_, vol. 17, no. 3, pp. 1738–1760, 2015.
  * [2] S. Parkvall, E. Dahlman, A. Furuskar, and M. Frenne, “Nr: The new 5g radio access technology,” _IEEE Communications Standards Magazine_ , vol. 1, no. 4, pp. 24–30, 2017.
  * [3] T. L. Marzetta, “Noncooperative cellular wireless with unlimited numbers of base station antennas,” _IEEE Transactions on Wireless Communications_ , vol. 9, no. 11, pp. 3590–3600, 2010.
  * [4] L. Zhao, H. Zhao, F. Hu, K. Zheng, and J. Zhang, “Energy efficient power allocation algorithm for downlink massive mimo with mrt precoding,” in _IEEE 78th VTC Fall_ , 2013, pp. 1–5.
  * [5] Q. Zhang, S. Jin, M. McKay, D. Morales-Jimenez, and H. Zhu, “Power allocation schemes for multicell massive mimo systems,” _IEEE Transactions on Wireless Communications_ , vol. 14, no. 11, pp. 5941–5955, 2015.
  * [6] T. Van Chien, E. Björnson, and E. G. Larsson, “Joint power allocation and user association optimization for massive mimo systems,” _IEEE Transactions on Wireless Communications_ , vol. 15, no. 9, pp. 6384–6399, 2016\.
  * [7] P. Liu, S. Jin, T. Jiang, Q. Zhang, and M. Matthaiou, “Pilot power allocation through user grouping in multi-cell massive mimo systems,” _IEEE Transactions on Communications_ , vol. 65, no. 4, pp. 1561–1574, 2017.
  * [8] Y. Dai and X. Dong, “Power allocation for multi-pair massive mimo two-way af relaying with linear processing,” _IEEE Transactions on Wireless Communications_ , vol. 15, no. 9, pp. 5932–5946, 2016.
  * [9] C. Sun, X. Gao, and Z. Ding, “Bdma in multicell massive mimo communications: Power allocation algorithms,” _IEEE Transactions on Signal Processing_ , vol. 65, no. 11, pp. 2962–2974, 2017.
  * [10] J. Zhang, E. Björnson, M. Matthaiou, D. W. K. Ng, H. Yang, and D. J. Love, “Prospective multiple antenna technologies for beyond 5g,” _IEEE Journal on Selected Areas in Communications_ , vol. 38, no. 8, pp. 1637–1660, 2020\.
  * [11] L. Sanguinetti, A. Zappone, and M. Debbah, “Deep learning power allocation in massive mimo,” in _52nd Asilomar Conference on Signals, Systems, and Computers_ , 2018, pp. 1257–1261.
  * [12] Y. Zhao, I. G. Niemegeers, and S. H. De Groot, “Power allocation in cell-free massive mimo: A deep learning method,” _IEEE Access_ , vol. 8, pp. 87 185–87 200, 2020.
  * [13] A. Koc, M. Wang, and T. Le-Ngoc, “Deep learning based multi-user power allocation and hybrid precoding in massive mimo systems,” _arXiv preprint arXiv:2201.12659_ , 2022.
  * [14] L. Luo, J. Zhang, S. Chen, X. Zhang, B. Ai, and D. W. K. Ng, “Downlink power control for cell-free massive mimo with deep reinforcement learning,” _IEEE Transactions on Vehicular Technology_ , vol. 71, no. 6, pp. 6772–6777, 2022.
  * [15] B. R. Manoj, M. Sadeghi, and E. G. Larsson, “Adversarial attacks on deep learning based power allocation in a massive mimo network,” in _IEEE ICC_ , 2021, pp. 1–6.
  * [16] Q. Liu, J. Guo, C.-K. Wen, and S. Jin, “Adversarial attack on dl-based massive mimo csi feedback,” _Journal of Communications and Networks_ , vol. 22, no. 3, pp. 230–235, 2020.
  * [17] P. M. Santos, B. R. Manoj, M. Sadeghi, and E. G. Larsson, “Universal adversarial attacks on neural networks for power allocation in a massive mimo system,” _IEEE Wireless Communications Letters_ , pp. 1–1, 2021.
  * [18] B. Kim, Y. Shi, Y. E. Sagduyu, T. Erpek, and S. Ulukus, “Adversarial attacks against deep learning based power control in wireless communications,” in _2021 IEEE Globecom Workshops_ , 2021, pp. 1–6.
  * [19] T. J. O’Shea, T. Roy, and T. C. Clancy, “Over-the-air deep learning based radio signal classification,” _IEEE Journal of Selected Topics in Signal Processing_ , vol. 12, no. 1, pp. 168–179, 2018.
  * [20] M. Arnold, J. Hoydis, and S. t. Brink, “Novel massive mimo channel sounding data applied to deep learning-based indoor positioning,” in _SCC 2019; 12th International ITG Conference on Systems, Communications and Coding_ , 2019, pp. 1–6.
  * [21] S. D. Bast, A. P. Guevara, and S. Pollin, “Csi-based positioning in massive mimo systems using convolutional neural networks,” in _2020 IEEE VTC2020-Spring_ , 2020, pp. 1–5.
  * [22] F. Liang, C. Shen, and F. Wu, “An iterative bp-cnn architecture for channel decoding,” _IEEE Journal of Selected Topics in Signal Processing_ , vol. 12, no. 1, pp. 144–159, 2018.
  * [23] D. Adesina, C.-C. Hsieh, Y. E. Sagduyu, and L. Qian, “Adversarial machine learning in wireless communications using rf data: A review,” _arXiv preprint arXiv:2012.14392_ , 2020.
  * [24] M. Sadeghi and E. G. Larsson, “Adversarial attacks on deep-learning based radio signal classification,” _IEEE Wireless Communications Letters_ , vol. 8, no. 1, pp. 213–216, 2018.
  * [25] Y. Lin, H. Zhao, Y. Tu, S. Mao, and Z. Dou, “Threats of adversarial attacks in dnn-based modulation recognition,” in _IEEE Conference on Computer Communications (INFOCOM)_ , 2020, pp. 2469–2478.
  * [26] B. Kim, Y. E. Sagduyu, K. Davaslioglu, T. Erpek, and S. Ulukus, “Over-the-air adversarial attacks on deep learning based modulation classifier over wireless channels,” in _54th Annual Conference on Information Sciences and Systems (CISS)_ , 2020, pp. 1–6.
  * [27] A. Berian, K. Staab, N. Teku, G. Ditzler, T. Bose, and R. Tandon, “Adversarial filters for secure modulation classification,” _arXiv preprint arXiv:2008.06785_ , 2020.
  * [28] Y. E. Sagduyu, Y. Shi, and T. Erpek, “Iot network security from the perspective of adversarial deep learning,” in _16th Annual IEEE International Conference on Sensing, Communication, and Networking (SECON)_ , 2019, pp. 1–9.
  * [29] Y. Shi, Y. E. Sagduyu, T. Erpek, K. Davaslioglu, Z. Lu, and J. H. Li, “Adversarial deep learning for cognitive radio security: Jamming attack and defense strategies,” in _IEEE ICC Workshops_ , 2018, pp. 1–6.
  * [30] T. Erpek, Y. E. Sagduyu, and Y. Shi, “Deep learning for launching and mitigating wireless jamming attacks,” _IEEE Transactions on Cognitive Communications and Networking_ , vol. 5, no. 1, pp. 2–14, 2019.
  * [31] M. Z. Hameed, A. György, and D. Gündüz, “The best defense is a good offense: Adversarial attacks to avoid modulation detection,” _IEEE Transactions on Information Forensics and Security_ , vol. 16, pp. 1074–1087, 2021\.
  * [32] S. Kokalj-Filipovic, R. Miller, N. Chang, and C. L. Lau, “Mitigation of adversarial examples in rf deep classifiers utilizing autoencoder pre-training,” in _International Conference on Military Communications and Information Systems (ICMCIS)_ , 2019, pp. 1–6.
  * [33] L. Zhang, S. Lambotharan, G. Zheng, B. AsSadhan, and F. Roli, “Countermeasures against adversarial examples in radio signal classification,” _IEEE Wireless Communications Letters_ , vol. 10, no. 8, pp. 1830–1834, 2021.
  * [34] R. Sahay, C. G. Brinton, and D. J. Love, “A deep ensemble-based wireless receiver architecture for mitigating adversarial attacks in automatic modulation classification,” _IEEE Transactions on Cognitive Communications and Networking_ , vol. 8, no. 1, pp. 71–85, 2022.
  * [35] N. Akhtar and A. Mian, “Threat of adversarial attacks on deep learning in computer vision: A survey,” _IEEE Access_ , vol. 6, pp. 14 410–14 430, 2018.
  * [36] R. Sahay, R. Mahfuz, and A. E. Gamal, “Combatting adversarial attacks through denoising and dimensionality reduction: A cascaded autoencoder approach,” in _53rd Annual Conference on Information Sciences and Systems (CISS)_ , 2019, pp. 1–6.
  * [37] F. Liao, M. Liang, Y. Dong, T. Pang, X. Hu, and J. Zhu, “Defense against adversarial attacks using high-level representation guided denoiser,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_ , June 2018.
  * [38] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in _International Conference on Learning Representations_ , 2018.
  * [39] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” _arXiv:1412.6572_ , 2014.
  * [40] B. R. Manoj, M. Sadeghi, and E. G. Larsson, “Downlink power allocation in massive mimo via deep learning: Adversarial attacks and training,” _IEEE Transactions on Cognitive Communications and Networking_ , vol. 8, no. 2, pp. 707–719, 2022.
  * [41] L. Rice, E. Wong, and J. Z. Kolter, “Overfitting in adversarially robust deep learning,” in _ICML_ , 2020.
  * [42] A. Athalye, N. Carlini, and D. A. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in _ICML_ , 2018, pp. 274–283.
  * [43] Y. Sagduyu, Y. Shi, and T. Erpek, “Adversarial deep learning for over-the-air spectrum poisoning attacks,” _IEEE Transactions on Mobile Computing_ , 2019.
  * [44] E. Björnson, J. Hoydis, and L. Sanguinetti, “Massive mimo networks: Spectral, energy, and hardware efficiency,” _Foundations and Trends® in Signal Processing_ , vol. 11, no. 3-4, pp. 154–655, 2017. [Online]. Available: http://dx.doi.org/10.1561/2000000093
  * [45] T. L. Marzetta, _Fundamentals of massive MIMO_. Cambridge University Press, 2016.
  * [46] X. Li, E. Björnson, E. G. Larsson, S. Zhou, and J. Wang, “Massive mimo with multi-cell mmse processing: Exploiting all pilots for interference suppression,” _EURASIP Journal on Wireless Communications and Networking_ , vol. 2017, no. 1, pp. 1–15, 2017.
  * [47] M. L. Psiaki and T. E. Humphreys, “Gnss spoofing and detection,” _Proceedings of the IEEE_ , vol. 104, no. 6, pp. 1258–1270, 2016.
  * [48] X. Yuan, P. He, Q. Zhu, and X. Li, “Adversarial examples: Attacks and defenses for deep learning,” _IEEE Transactions on Neural Networks and Learning Systems_ , vol. 30, no. 9, pp. 2805–2824, 2019.
  * [49] Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” _IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 9185–9193, 2018.
  * [50] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” _International Conference on Learning Representations (ICLR)_ , 2018.
  * [51] Y. Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adversarial examples and black-box attacks,” in _International Conference on Learning Representations (ICLR)_ , 2017.
  * [52] F. Tramer, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “The space of transferable adversarial examples,” _arXiv preprint arXiv:1704.03453_ , 2017.
  * [53] N. Papernot, P. McDaniel, and I. Goodfellow, “Transferability in machine learning: from phenomena to black-box attacks using adversarial samples,” _arXiv preprint arXiv:1605.07277_ , 2016.
  * [54] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” _IEEE Conference on Computer Vision and Pattern Recognition_ , pp. 770–778, 2016.
  * [55] I. Goodfellow, Y. Bengio, and A. Courville, _Deep Learning_. MIT Press, 2016, http://www.deeplearningbook.org.
  * [56] S. Hosseinalipour, S. S. Azam, C. G. Brinton, N. Michelusi, V. Aggarwal, D. J. Love, and H. Dai, “Multi-stage hybrid federated learning over large-scale d2d-enabled fog networks,” _IEEE/ACM Transactions on Networking_ , pp. 1–16, 2022.


* Ho [2001] C. Ho, Some phenomena of problem decomposition strategy for design thinking: differences between novices and experts, Design Studies 22, 27 (2001).
  * Wieman [2015] C. Wieman, Comparative cognitive task analyses of experimental science and instructional laboratory courses, The Physics Teacher 53, 349 (2015).
  * Polya [1945] G. Polya,  _How to solve it; a new aspect of mathematical method_ (Princeton University Press, 1945).
  * Dunbar [1997] K. Dunbar, How scientists think: On-line creativity and conceptual change in science., in  _Conceptual structures and processes: Emergence, discovery, and change_ , edited by Ward, T.B., Smith, S.M., and Vaid, J. (American Psychological Association, 1997) pp. 461–493.
  * Chinn and Malhotra [2002] C. A. Chinn and B. A. Malhotra, Epistemologically authentic inquiry in schools: A theoretical framework for evaluating inquiry tasks, Science education 86, 175 (2002).
  * Scates [1935] D. E. Scates, Types of assumptions in educational research., Journal of Educational Psychology 26, 350 (1935).
  * Fortus [2009] D. Fortus, The importance of learning to make assumptions, Science Education 93, 86 (2009).
  * Reitman [1964] W. R. Reitman, Heuristic decision procedures, open constraints, and the structure of ill-defined problems, Human judgments and optimality , 282 (1964).
  * Etkina  _et al._ [2006a] E. Etkina, A. Van Heuvelen, S. White-Brahmia, D. T. Brookes, M. Gentile, S. Murthy, D. Rosengrant, and A. Warren, Scientific abilities and their assessment, Physical Review special topics-physics education research 2, 020103 (2006a).
  * Dounas-Frazer and Lewandowski [2018] D. R. Dounas-Frazer and H. Lewandowski, The modelling framework for experimental physics: Description, development, and applications, European Journal of Physics 39, 064005 (2018).
  * Hestenes [1993] D. Hestenes, Modeling is the name of the game, in  _A presentation at the NSF Modeling Conference_ , Vol. 8 (1993).
  * Halloun and Hestenes [1987] I. A. Halloun and D. Hestenes, Modeling instruction in mechanics, American Journal of Physics 55, 455 (1987).
  * Halloun [1996] I. Halloun, Schematic modeling for meaningful learning of physics, Journal of Research in Science Teaching: The Official Journal of the National Association for Research in Science Teaching 33, 1019 (1996).
  * Gentner and Markman [1997] D. Gentner and A. B. Markman, Structure mapping in analogy and similarity., American Psychologist 52, 45 (1997).
  * Maxwell [2011] J. C. Maxwell,  _The Scientific Papers of James Clerk Maxwell_, edited by W. D. Niven, Cambridge Library Collection - Physical Sciences, Vol. 2 (Cambridge University Press, 2011).
  * Oppenheimer [1956] R. Oppenheimer, Analogy in science., American Psychologist 11, 127 (1956).
  * Gentner [1983] D. Gentner, Structure-mapping: A theoretical framework for analogy, Cognitive Science 7, 155 (1983).
  * Holyoak and Thagard [1989] K. J. Holyoak and P. Thagard, Analogical mapping by constraint satisfaction, Cognitive Science 13, 295 (1989).
  * Brown and Clement [1989] D. E. Brown and J. Clement, Overcoming misconceptions via analogical reasoning: Abstract transfer versus explanatory model construction, Instructional science 18, 237 (1989).
  * Podolefsky and Finkelstein [2006] N. S. Podolefsky and N. D. Finkelstein, Use of analogy in learning physics: The role of representations, Physical Review Special Topics-Physics Education Research 2, 020101 (2006).
  * Taber [2001] K. S. Taber, When the analogy breaks down: modelling the atom on the solar system, Physics education 36, 222 (2001).
  * Körhasan and Hıdır [2019] N. D. Körhasan and M. Hıdır, How should textbook analogies be used in teaching physics?, Physical Review Physics Education Research 15, 010109 (2019).
  * Harrison and Treagust [1993] A. G. Harrison and D. F. Treagust, Teaching with analogies: A case study in grade-10 optics, Journal of research in science teaching 30, 1291 (1993).
  * Gokhan  _et al._ [2012] U. Gokhan, R. Dilber, Y. Senpolat, and B. Duzgun, The effects of analogy on students’ understanding of direct current circuits and attitudes towards physics lessons, European journal of educational research 1, 211 (2012).
  * Dilber and Duzgun [2008] R. Dilber and B. Duzgun, Effectiveness of analogy on students’ success and elimination of misconceptions, Latin-American Journal of Physics Education 2, 3 (2008).
  * Clark  _et al._ [2008] R. Clark, D. Feldon, J. J. G. Van Merrienboer, K. Yates, and S. Early, Cognitive task analysis, Handbook of Research on Educational Communications and Technology , 577 (2008).
  * Gazarian  _et al._ [2010] P. K. Gazarian, E. A. Henneman, and G. E. Chandler, Nurse decision making in the prearrest period, Clinical Nursing Research 19, 21 (2010).
  * Fackler  _et al._ [2009] J. C. Fackler, C. Watts, A. Grome, T. Miller, B. Crandall, and P. Pronovost, Critical care physician cognitive task analysis: an exploratory study, Critical Care 13, 1 (2009).
  * Seamster and Redding [2017] T. L. Seamster and R. E. Redding,  _Applied cognitive task analysis in aviation_ (Routledge, 2017).
  * [66] See Supplemental Material at [URL] for the full interview protocol.
  * SocioCultural Research Consultants, LLC [2022] SocioCultural Research Consultants, LLC,  _Dedoose Version 9.0.17, web application for managing, analyzing, and presenting qualitative and mixed method research data_, Los Angeles, CA (2022).
  * Odden and Russ [2019] T. O. B. Odden and R. S. Russ, Defining sensemaking: Bringing clarity to a fragmented theoretical construct, Science Education 103, 187 (2019).
  * R Core Team [2020] R Core Team,  _R: A Language and Environment for Statistical Computing_, R Foundation for Statistical Computing, Vienna, Austria (2020).
  * Lucid Software Inc. [2022] Lucid Software Inc.,  _Lucidchart_ (2022).
  * Traxler  _et al._ [2016] A. L. Traxler, X. C. Cid, J. Blue, and R. Barthelemy, Enriching gender in physics education research: A binary past and a complex future, Physical Review Physics Education Research 12, 020114 (2016).
  * Etkina  _et al._ [2006b] E. Etkina, A. Warren, and M. Gentile, The role of models in physics instruction, The physics teacher 44, 34 (2006b).
  * Van Heuvelen [1991b] A. Van Heuvelen, Overview, case study physics, American Journal of Physics 59, 898 (1991b).
  * Wright and Williams [1986] D. S. Wright and C. D. Williams, A wise strategy for introductory physics, The Physics Teacher 24, 211 (1986).
  * Clement [1993] J. Clement, Using bridging analogies and anchoring intuitions to deal with students’ preconceptions in physics, Journal of research in science teaching 30, 1241 (1993).
  * Sweller and Cooper [1985] J. Sweller and G. A. Cooper, The use of worked examples as a substitute for problem solving in learning algebra, Cognition and instruction 2, 59 (1985).
  * Ward and Sweller [1990] M. Ward and J. Sweller, Structuring effective worked examples, Cognition and instruction 7, 1 (1990).
  * Pashler  _et al._ [2007] H. Pashler, P. M. Bain, B. A. Bottge, A. Graesser, K. Koedinger, M. McDaniel, and J. Metcalfe, Organizing instruction and study to improve student learning. ies practice guide. ncer 2007-2004., National Center for Education Research (2007).