# On the potential of bright, young pulsars to power ultra-high gamma-ray
sources

Emma de Oña Wilhelmi Deutsches Elektronen Synchrotron DESY, 15738 Zeuthen,
Germany<EMAIL_ADDRESS>Rubén López-Coto<EMAIL_ADDRESS>Istituto Nazionale di Fisica Nucleare, Sezione di Padova, I-35131, Padova,
Italy  Instituto de Astrofísica de Andalucía, CSIC, 18080 Granada, Spain.
Elena Amato INAF, Osservatorio Astrofisico di Arcetri, Largo E. Fermi 5,
I-50125 Firenze, Italy  Dipartimento di Fisica e Astronomia, Università di
Firenze, Via Sansone 1,50019 Sesto Fiorentino (FI), Italy<EMAIL_ADDRESS>Felix Aharonian Dublin Institute for Advanced Studies, 31 Fitzwilliam Place,
Dublin, Ireland  Max-Planck-Institut für Kernphysik, P.O. Box 103980, D 69029
Heidelberg, Germany<EMAIL_ADDRESS>
###### Abstract

The recent discovery of a new population of ultra-high-energy gamma-ray
sources with spectra extending beyond $100\,\rm TeV$ revealed the presence of
Galactic PeVatrons - cosmic-ray factories accelerating particles to PeV
energies. These sources, except for the one associated with the Crab Nebula,
are not yet identified. With an extension of 1 degree or more, most of them
contain several potential counterparts, including Supernova Remnants, young
stellar clusters and Pulsar Wind Nebulae (PWNe), which can perform as
PeVatrons and thus power the surrounding diffuse ultra-high energy gamma-ray
structures. In the case of PWNe, gamma rays are produced by electrons,
accelerated at the pulsar wind termination shock, through the inverse Compton
scattering of 2.7 K CMB radiation. The high conversion efficiency of pulsar
rotational power to relativistic electrons, combined with the short cooling
timescales, allow gamma-ray luminosities up to the level of $L_{\gamma}\sim
0.1\dot{E}$. The pulsar spin-down luminosity, $\dot{E}$, also determines the
absolute maximum energy of individual photons: $E_{\rm\gamma~{}\rm max}\approx
0.9\dot{E}_{36}^{0.65}~{}~{}\rm{PeV}$. This fundamental constraint dominates
over the condition set by synchrotron energy losses of electrons for young
PWNe with typical magnetic field of $\approx$100 $\mu$G with $\dot{E}\lesssim
10^{37}\ \rm erg/s$. We discuss the implications of $E_{\rm\gamma~{}\rm max}$
by comparing it with the highest energy photons reported by LHAASO from a
dozen of ultra-high-energy sources. Whenever a PWN origin of the emission is
possible, we use the LHAASO measurements to set upper limits on the nebular
magnetic field.

††journal: ApJL

##  1 Introduction

The recent discovery of the LHAASO collaboration (Cao et al., 2021), reporting
the detection of a dozen sources with particle spectra reaching PeV (1 PeV =
1015eV) energies, represents a major step towards the identification of the
nature of the sources known as PeV accelerators, or PeVatrons. These
observations are complemented in the gamma-ray regime by those from
instruments sensitive in the 100 GeV to 100 TeV energy range, in particular by
water Cherenkov instruments like HAWC and Tibet AS$\gamma$ (Albert et al.,
2020; Amenomori et al., 2021), and Imaging Atmospheric Cherenkov Telescopes
arrays (IACT) such as H.E.S.S., MAGIC, and VERITAS (H. E. S. S. Collaboration
et al., 2018a; Aleksić et al., 2015; Park & VERITAS Collaboration, 2015). In
general, IACTs provide a superior angular resolution, that can be used to
localize the emission regions more accurately and identify the accelerator
type. The majority of the sources reported by LHAASO in Cao et al. 2021 are
described by an extended gamma-ray emission, as large as $\sim$1o. These
sources have, in almost all cases, a sub-100 TeV counterpart. Interestingly,
in this sub-100 TeV regime, more than 30% of the sources detected in the
Galactic plane have been associated with Pulsar Wind Nebulae (PWNe) (Wakely &
Horan, 2008; H. E. S. S. Collaboration et al., 2018b). These associations are
based on spatial correlation with energetic pulsars, and spectral-
morphological features connecting the usually extended ($\gtrsim 0.2^{\rm o}$)
gamma-ray emission with the pulsars. Pulsars (or PWNe) are the only identified
source class in which PeV particles have been detected: the Crab Nebula,
associated with the young, very energetic pulsar PSR B0531+21, shows a
synchrotron (steady and flaring) spectrum in the GeV regime that corresponds
to PeV electrons (Abdo et al., 2010, 2011), and it has also been recently
detected up to an energy of 1.1 PeV by the LHAASO experiment (Lhaaso
Collaboration et al., 2021). Nevertheless, pulsars appear to be close to the
absolute theoretical limit in terms of acceleration rate (Aharonian, 1995;
Lhaaso Collaboration et al., 2021).

In the following, we investigate the capability of energetic pulsars to power
PeVatrons.

Table 1: The table lists the LHAASO ultra-high energy sources, together with the bright, young pulsars located within 1o of the LHAASO source and their characteristics. The two right-most columns display the maximum energy quoted by Cao et al. 2021 and its corresponding energy in electron, using the formulation in Khangulyan et al. 2014. LHAASO Source | Pulsar | Separation | $\dot{\rm E}$ | Age | Distance | Flux100TeV | E${}_{\rm\gamma\ LHAASO}$ | E${}_{\rm e\ LHAASO}$
---|---|---|---|---|---|---|---|---
|  | [deg] |  $\times 10^{36}$[erg/s] | [kyr] | [kpc] | [c. u.] | [PeV] | [PeV]
J1825-1326 | J1826-1256 | 0.51 | 3.6 | 14.4 | 1.55 | 3.57 | 0.42 | 1.10
| B1823-13 | 0.16 | 2.8 | 21.4 | 3.61 | 3.57 | 0.42 | 1.10
J1839-0545 | J1837-0604 | 0.61 | 2.0 | 33.8 | 4.77 | 0.70 | 0.21 | 0.65
| J1838-0537 | 0.25 | 6.0 | 4.9 | – | 0.70 | 0.21 | 0.65
J1843-0338 | J1841-0345 | 0.37 | 0.3 | 55.9 | 3.78 | 0.73 | 0.26 | 0.76
| J1844-0346 | 0.41 | 4.2 | 11.6 | – | 0.73 | 0.26 | 0.76
J1849-0003 | J1849-0001 | 0.10 | 9.8 | 43.1 | – | 0.74 | 0.35 | 0.96
J1908+0621 | J1907+0602 | 0.32 | 2.8 | 19.5 | 2.37 | 1.36 | 0.44 | 1.14
| J1907+0631 | 0.33 | 0.5 | 11.3 | 3.40 | 1.36 | 0.44 | 1.14
J1929+1745 | J1925+1720 | 0.94 | 0.9 | 115.0 | 5.06 | 0.38 | 0.71 | 1.65
| J1928+1746 | 0.07 | 1.6 | 82.6 | 4.34 | 0.38 | 0.71 | 1.65
J1956+2845 | J1954+2836 | 0.44 | 1.0 | 69.4 | 1.96 | 0.41 | 0.42 | 1.10
| J1958+2846 | 0.54 | 0.3 | 21.7 | 1.95 | 0.41 | 0.42 | 1.10
J2018+3651 | J2021+3651 | 0.42 | 3.4 | 17.2 | 1.80 | 0.50 | 0.27 | 0.78
J2032+4102 | J2032+4127 | 0.41 | 0.1 | 201.0 | 1.33 | 0.54 | 1.42 | 2.82
J2108+5157 |  |  |  |  |  |  |  |
J2226+6057 | J2229+6114 | 0.38 | 22.0 | 10.5 | 3.00 | 1.05 | 0.57 | 1.39

##  2 Pulsars as effective PeV accelerators

Table 2: The table lists the LHAASO ultra-high energy sources and putative associated pulsars, with the corresponding constraints on the maximum energy, efficiency and magnetic field. LHAASO Source | Pulsar | E${}_{\rm\gamma\ max}$ | Emax | Bmax
---|---|---|---|---
|  | [PeV] | [PeV] | [$\mu$G]
J1825-1326 | J1826-1256 | 2.06 | 3.79 | 38
| B1823-13 | 1.77 | 3.35 | 14
J1839-0545 | J1837-0604 | 1.44 | 2.83 | 33
| J1838-0537 | 2.78 | 4.90 |  $\gg$100
J1843-0338 | J1841-0345 | 0.41 | 1.04 | 12
| J1844-0346 | 2.25 | 4.10 |  $\gg$100
J1849-0003 | J1849-0001 | 3.71 | 6.26 |  $\gg$100
J1908+0621 | J1907+0602 | 1.77 | 3.35 | 30
| J1907+0631 | 0.63 | 1.46 | 9
J1929+1745 | J1925+1720 | 0.91 | 1.95 | 9
| J1928+1746 | 1.26 | 2.53 | 14
J1956+2845 | J1954+2836 | 0.94 | 2.00 | 37
| J1958+2846 | 0.47 | 1.17 | 22
J2018+3651 | J2021+3651 | 1.99 | 3.69 | 102
J2032+4102 | J2032+4127 | 0.28 | 0.77 | 7
J2108+5157 |  |  |  |
J2226+6057 | J2229+6114 | 5.89 | 9.38 | 64

PWNe have been recognized as one of the most efficient electron factories in
our Galaxy (H. E. S. S. Collaboration et al., 2018b). They are powered by
energetic pulsars, which inject ultra-relativistic electrons and positrons in
their magnetosphere. These particles form a cold ultra-relativistic wind,
expanding with bulk Lorentz factor $\Gamma$ in the range $10^{4}$-$10^{7}$,
until reaching the termination shock (TS) (Rees & Gunn, 1974; Kennel &
Coroniti, 1984). At the shock, particles are believed to be accelerated to
multi-TeV energies, inflating a non-thermal nebula which constitutes the
plerion (Amato, 2020). A large fraction of the pulsar spin-down power,
$\dot{E}$, is radiated in the very high energy regime via inverse Compton (IC)
scattering, resulting in a power-law spectrum that can extend up to at least a
few tens of TeV (Amato & Olmi, 2021; Aharonian et al., 1997; de Jager &
Djannati-Ataï, 2009; Gaensler & Slane, 2006; Breuhaus et al., 2022). At these
energies, the scattering occurs mostly in deep Klein-Nishina regime, where
electrons lose most of their energy in a single scattering event and the
maximum energy observed in photons roughly coincides with the maximum energy
to which the electrons are accelerated. Radiation losses beyond hundreds of
TeVs, into the PeV regime, are very rapid and demand an extremely efficient
acceleration rate.

Indeed the connection between pulsars and PeVatrons provides important
constraints, which stand on first principles, independently of more
sophisticated modeling. First, the absolute maximum energy the particles can
reach, Emax, depends ultimately on the maximum potential drop between the
pulsar and infinity, $\Phi_{\rm PSR}=(\dot{E}/c)^{1/2}$, with $c$ the speed of
light. Since the particle acceleration, regardless of the acceleration
mechanism, is always carried out by the electric field $|\vec{E}|$, this
maximum energy is related to the electric potential associated with this
field. Therefore, Emax can be defined in terms of the maximum potential drop
and has as an absolute maximum at the value $E_{\rm max}=q(\dot{E}/c)^{1/2}$,
where $q$ is the charge of the particle. This is equivalent to saying that the
maximum energy of the particle depends on the size of the accelerator, which
in the case of PWNe is the size of the TS, as deduced from X-ray observations
of young, well studied systems, thus $E_{\rm max}=q|\vec{E}|$RTS. If the wind
is described as an ideal magnetohydrodynamic flow (Kennel & Coroniti, 1984;
Porth et al., 2014; Olmi & Bucciantini, 2019), the electric field strength
cannot exceed the magnetic one BTS. Defining the ratio between the two as
$\eta_{e}$ (which is $\eta_{e}\leq$1 in such ideal conditions), the former
equation can be written as $E_{\rm max}=q\eta_{e}$BTSRTS, which is the well-
known Hillas criterion (Hillas, 1984).

The magnetic energy density (defined as B${}_{\rm TS}^{2}$/8$\pi$) can be
expressed as a fraction $\eta_{\rm B}$ of the pulsar wind energy flux:

$\frac{B_{\rm TS}^{2}}{8\pi}=\eta_{\rm B}\frac{\dot{E}}{(4\pi R_{\rm
TS}^{2}c)}$ (1)

thus:

$\begin{split}B_{\rm TS}&=(2\eta_{\rm B})^{1/2}R_{\rm
TS}^{-1}(\dot{E}/c)^{1/2}\\\ &=25\eta_{\rm B}^{1/2}R_{\rm
0.1}^{-1}\dot{E}_{36}^{1/2}~{}~{}\rm{\mu G}\ ,\end{split}$ (2)

where $R_{0.1}$ is the termination shock radius in units of 0.1pc and
$\dot{E}_{36}$ in units of $10^{36}$ erg/s. Using this expression in the
expression of Emax described above results in the following limit to the
maximum energy of the accelerated particles, independently of whether
electrons, positrons or protons:

$E_{\rm max}\approx 2\ \eta_{e}\ \eta_{\rm B}^{1/2}\
\dot{E}_{36}^{1/2}~{}~{}\rm{PeV}$ (3)

The fraction of pulsar wind energy flux transferred to magnetic field is
constrained, by energy conservation, to be $\eta_{\rm B}\leq 1$. The
expression above, which is independent of the particle species, can be used to
derive an absolute maximum to the energy to which particles can be
accelerated.

For electrons in the multi-TeV regime, the most relevant target for IC
scattering is the 2.7 K CMB photons. The photon and electron energy can then
be related using the approximation presented by Lhaaso Collaboration et al.
2021: $E_{\rm{e}}\simeq 2.15E_{\gamma,15}^{0.77}$ PeV (with $E_{\gamma,15}$ in
units of $10^{15}$eV, or PeV), which provides an accuracy better than 10%
above 30 TeV. Thus Eq. 3 can be written as:

$E_{\rm\gamma~{}\rm max}\approx 0.9\ \eta_{e}^{1.3}\ \eta_{B}^{0.65}\
\dot{E}_{36}^{0.65}~{}~{}\rm{PeV}$ (4)

The above expression provides a direct link between the observed maximum
energy in the gamma-ray spectrum and the spin-down power of the pulsar. It can
be immediately derived that only very energetic pulsars with at least
$\dot{E}\gtrapprox 10^{36}$erg/s could power the observed PeV gamma rays.

Additionally, a second condition is required to shine in gamma rays up to
PeVs: the acceleration rate $\tau_{\rm acc}$ should also overcome the
radiative losses of the parent electrons. The first can be expressed as a
function of the magnetic field at the TS as $\tau_{\rm acc}=E_{\rm
e}/(\eta_{e}eB_{\rm TS}c)$. The overall cooling time, that can be written as
$\tau_{\rm{loss}}=(1/\tau_{\rm sync}+1/\tau_{\rm IC})^{-1}$, is dominated,
even for a few $\mu$G magnetic field, by synchrotron losses, above a few
hundreds of TeV. In the Klein-Nishina limit, the IC cooling time of electrons
in 2.7 K CMB depends only on the electron energy as $\tau_{\rm
IC}\simeq~{}10^{12}E_{e,15}^{0.7}$ s (Khangulyan et al., 2014). The former can
be compared with the synchrotron time $\tau_{\rm sync}\simeq~{}4\times
10^{9}E_{e,15}^{-1}B_{-5}^{-2}$ s , where $B_{-5}$ is the magnetic field in
units of 10$\mu$G. The condition $\tau_{\rm acc}=\tau_{\rm syn}$ results in
the following expression for the maximum energy of the electron population:

$E_{\rm e~{}\rm max}\approx 20\ {\eta_{e}}^{1/2}B_{-5}^{-1/2}~{}~{}\rm{PeV}\
.$ (5)

This corresponds to a maximum energy of the photons produced by IC scattering
on the CMB of

$E_{\gamma~{}\rm max}\approx 5{\eta_{e}}^{0.65}B_{-5}^{-0.65}~{}~{}\rm{PeV}\
,$ (6)

or, in terms of pulsar $\dot{E}$ and TS radius, using Eq. 2:

$E_{\gamma~{}\rm max}\approx 2.7{\eta_{e}}^{0.65}{\eta_{\rm B}}^{-0.33}R_{\rm
0.1}^{0.65}\dot{E}_{36}^{-0.33}~{}~{}\rm{PeV}\ .$ (7)

The comparison between Eq. 3 and 5 shows that radiation losses pose the most
serious challenge to reach PeV energies only for young, energetic pulsars
($\dot{E}\gtrsim 10^{37}$erg/s), with a magnetic field at the wind TS in the
100$\mu$G range, such as the Crab Nebula 111Note that in scenarios where
acceleration and radiation do not occur in the same region, the absolute
maximum energy is still determined by the potential drop.. This does not mean
that the Crab is a poor accelerator. On the contrary, as discussed in Lhaaso
Collaboration et al. 2021, the Crab Nebula, with an estimated magnetic field
of $\approx 112~{}\mu$G, requires an acceleration rate corresponding to
$\eta_{e}\approx 0.16$ to reach the energies observed
(E${}_{\gamma,\rm{max}}=1.1$ PeV). These large values of $\eta_{e}$ are
impressive, being several orders of magnitude larger than those inferred for
other powerful accelerators, such as e.g. supernova remnants (SNRs), for which
typically $\eta_{e}\approx 10^{-3}$ (Malkov & Drury, 2001). Even though larger
values of $\eta_{e}\geq 1$, are possible during e.g. gamma-ray flares (Bühler
& Blandford, 2014), the large value derived in Crab only reflect the
relativistic nature of the acceleration, which in such shocks is far from
being understood (see e.g. Amato 2020; Amato & Olmi 2021).

The constraints so far discussed are related to the maximum photon energy
observed. Additional information can be obtained by comparing the IC
luminosity of the PeV sources and the total power injected by the pulsar in
its surrounding. The total energy in electrons responsible for IC radiation
can be derived using the gamma-ray observations as $W_{\rm
e,\gamma}=L_{\gamma}\tau_{\rm IC}$. $W_{\rm e,\gamma}$ cannot exceed
$W_{\rm{e,PSR}}$, the total energy made available by the pulsar in the form of
gamma-ray emitting electrons. Since the lifetimes of the latter are determined
by losses, one can write $W_{\rm{e,PSR}}=\gamma_{\rm eff}\dot{\rm E}\tau_{\rm
loss}$, with $\gamma_{\rm eff}$ the fraction of $\dot{E}$ converted into
gamma-ray emitting electrons:

$\begin{split}\gamma_{\rm
eff}&=\frac{L_{\gamma}}{\dot{E}}\left(1+\frac{\tau_{\rm IC}}{\tau_{\rm
syn}}\right)\\\ &=10^{-4}\frac{L_{\gamma,32}}{\dot{E}_{36}}(1+260\
E_{e,15}^{1.7}B_{-5}^{2})\end{split}$ (8)

which also depends strongly on the magnetic field. The maximum allowed
conversion efficiency from rotational power to gamma-ray one ($\gamma_{\rm
eff}$ = 1) results in another boundary to pulsars as ultra-high energy
sources.

Figure 1: Maximum electron energy derived from the LHAASO spectra versus spin-
down power of the co-located pulsars. The right Y-axis shows the corresponding
gamma-ray energy. The colored area shows the values for $\eta_{e}\
\eta_{B}^{1/2}$ ranging from 0.01 to 1, with the red line indicating the
limiting value corresponding to maximally efficient acceleration $\eta_{e}=1$
and $\eta_{\rm B}=1$. The dotted black line marks the upper limit to the
maximum energy for young pulsars with large magnetic field of 100 $\mu$G. The
blue dashed horizontal lines show the predicted values for PWNe associated to
Geminga and N157B

.

##  3 Comparison with pulsars in the region of interest

Twelve ultrahigh-energy gamma-ray sources were reported by Cao et al. 2021,
with a spectral energy distribution extending up to more than 100 TeV, one of
them being associated with the Crab Nebula. The maximum energy in photons
E${}_{\rm\gamma\ LHAASO}$ and electrons E${}_{\rm e\ LHAASO}$, derived from
the LHAASO observations, are listed in Table 1. The latest was derived from
the photon energy using the expression in Khangulyan et al. 2014. The majority
of these sources show a diffuse gamma-ray structure, with angular extensions
up to 1o. This extended structure makes the association with the PeVatron
accelerator complex. To explore the possibility of an association of the
ultra-high-energy sources with pulsars, we searched for relatively young
($\tau<10^{6}$ yrs), energetic ($\dot{E}$/d${}_{\rm kpc}^{2}>10^{34}$
erg/s/kpc2, or $\dot{E}>10^{36}$ erg/s when the distance is unknown) pulsars
in the ATNF catalog222http://www.atnf.csiro.au/research/pulsar/psrcat/,
located within 1o around the position of the LHAASO sources.

For each of the LHAASO sources, we found at least one pulsar (two in some
cases) which could potentially be linked to it, except for the source
J2108+5157, for which no bright pulsar is found in the vicinity. The selected
pulsars and their properties are listed in Table 1. The LHAASO source
associated to the Crab Nebula has been described in detail in Lhaaso
Collaboration et al. 2021.

To evaluate the potential of an associated pulsar to power the LHAASO sources,
we estimate the maximum energy to which particles can be accelerated by such
pulsar, assuming $\eta_{B}=\eta_{e}=1$ in Eq. 3. The results are summarised in
Fig. 1 and the maximum energies of the particles and corresponding gamma-ray
E${}_{\gamma~{}\rm{max}}$, in the case of IC scattering of the CMB, are listed
in Table 2. In Fig. 1 we place the potential associations in the
$\dot{E}$-$E_{\rm e,max}$ plane and compare them with theoretical predictions
based on Eq. 3 for $\eta_{e}\ \eta_{B}^{1/2}$ ranging from 0.01 to 1. Out of
all pulsars possibly associated to the 12 LHAASO sources, only in the Crab
pulsar the maximum energy is limited by the radiation losses, while for all
other pulsars the most relevant constraint will come from saturation of the
full available potential drop (Eq. 3). The upper limit to the maximum electron
(and photon) energy, using $\eta_{e}=1$ and 100$\mu G$, is marked with a
dotted horizontal line in Fig. 1. Above the red line, the particle flow would
require values of $\eta_{B}=1$ and $\eta_{e}>1$, and would demand non-ideal
mechanisms (see Amato & Olmi 2021 for a review). Only one of pairs ultra-high-
energy source/energetic pulsar (LHAASO J2032+4102 / J2032+4127) lies above the
absolute maximum, resulting in an impossible connection between the two (if
the spin-down power of the pulsar is correct within a factor of $\sim$4). We
also marked in Fig. 1 two remarkable pulsars with vertical blue lines: Geminga
and the Crab twin, N157B, located in the Magellanic Cloud. With a moderated
spin-down luminosity of $3.26\times 10^{34}$erg/s, but located at a small
distance of 250 pc, the Geminga Nebula is a prime target for LHAASO, given its
large size of $\sim$2o (Abeysekara et al., 2017). N157B is, on the contrary,
the furthest gamma-ray PWN detected (H. E. S. S. Collaboration et al., 2012),
but its large spin-down luminosity ($\dot{\rm E}=4.9\times 10^{38}$erg/s) and
similarity with the Crab Nebula makes it also an interesting source to
understand the contribution of pulsars to the PeV sky.

We can also use the spectral parameters of the PeV sources, in particular
E${}_{\gamma~{}\rm{max}}$ and gamma-ray luminosity to impose an upper limit on
the magnetic field. Constraints are provided by the fact that synchrotron
losses should not forbid acceleration up to E${}_{\rm e~{}max}$ (Eq. 5) and
the energy input from the pulsar be sufficient to power the gamma-ray source
(Eq. 8).We found that, in general, the latter constraint is much stronger and
requires that the magnetic field cannot exceed a few tens of $\mu$Gauss, which
agrees with the typical values derived from very-high energy observations in
the TeV regime (see e.g. H. E. S. S. Collaboration et al. 2018b). Despite
these low constraints in the magnetic field, the Larmour radius of the
electrons with the highest energies is still in agreement with the typical
size of the TS, defined by the balance between the wind pressure and the one
from the surrounding medium (see e.g. Kargaltsev & Pavlov 2008).

##  4 Concluding Remarks

We derived the absolute maximum energy that can be accelerated by pulsars,
obtained from the maximum potential drop available, without further
assumptions beyond ideal MHD flow. This maximum energy can now be confronted
with observational results as those recently published by LHAASO. The extreme
energies reached in the sources detected by LHAASO provide direct information
about current particle acceleration, given the fast cooling time involved
beyond hundreds of TeV. At these energies, the up-scattering of the 2.7 K CMB
radiation dominates the observed gamma-ray radiation in PWNe, providing a
powerful diagnostic tool. Additionally, these multi-TeV electrons propagating
in the magnetised nebulae should also power an X-ray nebula, visible at a few
keV. The detection of such an extended nebula is challenging for pointing
X-ray instruments like XMM-Newton or Chandra (Kargaltsev & Pavlov, 2008; Liu
et al., 2019). However, the new X-ray satellite eROSITA, sensitive to X-rays
in the energy range of 0.3 - 11 keV and with a wide field of view of 0.81o, is
optimal to constrain the X-ray counterpart. The expected sensitivities
achieved by eROSITA for extended sources in the energy range of 0.5-2 keV are
$1.1\times 10^{-13}~{}\rm{erg}/\rm{cm}^{2}/\rm{s}$ for the first all-sky
survey (eRASS:1), and $3.4\times 10^{-14}~{}\rm{erg}/\rm{cm}^{2}/\rm{s}$ for
the four year all-sky survey (eRASS:8). With fluxes at 100 TeV ranging from
$\sim 5\times 10^{-13}$ erg/cm2/s to $\sim 5\times 10^{-12}$ erg/cm2/s, the
X-ray counterpart, assuming a magnetic field as low as 3$\mu$G, should be
expected with fluxes above $\sim 2\times 10^{-12}$ erg/cm2/s in the 0.5 to 2
keV band, an order of magnitude larger than the eROSITA sensitivity. These
numbers should be taken with caution, since the surface brightness might not
be homogeneous across the large TeV source region.

From the 11 sources considered, two sources stand out, and different
accelerators and/or gamma-ray production mechanisms should be investigated:
LHAASO J2108+5157 and LHAASO J2032+4102. The first is extensively discussed in
The LHAASO collaboration (2021) and it is found to be point-like, within the
angular resolution of LHAASO for this analysis (0.26o). The closest pulsar is
$\sim 3^{\rm o}$ away, which at 2-3 kpc corresponds to more than 100 pc away.
No counterpart has been found neither in the TeV regime. The second source is
co-located with a pulsar (PSR J2032+4127) in an interacting binary system
(Abeysekara et al., 2018; Williamson, 2019). The above considerations only
apply to the isolated pulsar, however the mixing of the two winds could in
principle lead to different conclusions. The pulsar powers a compact
$\sim$0.2o gamma-ray nebula (Aharonian et al., 2002; Konopelko et al., 2007;
Albert et al., 2008; Aliu et al., 2014), which can only partially be connected
to the very extended ultra-high-energy source. The system is located at the
heart of the Cygnus cocoon, a bright GeV and TeV extended diffuse emission,
which has also been connected with several individual sources, including the
massive stellar cluster Cygnus OB (Ackermann et al., 2011; Abeysekara et al.,
2021; Aharonian et al., 2019). The potential connection between the Cygnus
cocoon and the LHAASO source opens interesting prospects for stellar clusters
as contributors of ultra-high energy particles (Bykov et al., 2020).

Further information regarding the morphology of these sources should provide
crucial insight into the origin of the emission. Indeed, electrons and
positrons at these energies undergo fast losses due to synchrotron radiation,
and might appear as compact, sub-degree regions. However, for low enough (a
few $\sim\mu$G) magnetic fields, and fast enough transport, these electrons
could still fill up a volume larger than a few tens of parsecs, which would
match the large extension observed, if located close enough to us (few kpc).
Alternatively, these electrons might have escaped into the interstellar
medium, filling up a halo where particles are essentially free from their
parent PWN (López-Coto et al., 2022). This is particularly relevant for
nebulae like HESS J1825–137, for which a clear energy-dependent morphology has
been established in the TeV regime (H. E. S. S. Collaboration et al., 2019).
Observations above 100 TeV should provide a clear picture of the radiative
cooling and propagation of electrons. Note that regardless the propagation
regime, the maximum energy to which particle can be accelerated is always
limited by the equations derived here. Gamma-ray images at different energies
should also serve as test-bench for other effects involving ballistic and
diffusive propagation, which could play an important role in the observed
morphology (Prosekin et al., 2015).

## References

  * Abdo et al. (2010) Abdo, A. A., Ackermann, M., Ajello, M., et al. 2010, ApJ, 708, 1254, doi: 10.1088/0004-637X/708/2/1254
  * Abdo et al. (2011) —. 2011, Science, 331, 739, doi: 10.1126/science.1199705
  * Abeysekara et al. (2017) Abeysekara, A. U., Albert, A., Alfaro, R., et al. 2017, Science, 358, 911, doi: 10.1126/science.aan4880
  * Abeysekara et al. (2018) Abeysekara, A. U., Benbow, W., Bird, R., et al. 2018, ApJ, 867, L19, doi: 10.3847/2041-8213/aae70e
  * Abeysekara et al. (2021) Abeysekara, A. U., Albert, A., Alfaro, R., et al. 2021, Nature Astronomy, 5, 465, doi: 10.1038/s41550-021-01318-y
  * Ackermann et al. (2011) Ackermann, M., Ajello, M., Allafort, A., et al. 2011, Science, 334, 1103, doi: 10.1126/science.1210311
  * Aharonian et al. (2019) Aharonian, F., Yang, R., & de Oña Wilhelmi, E. 2019, Nature Astronomy, 3, 561, doi: 10.1038/s41550-019-0724-0
  * Aharonian et al. (2002) Aharonian, F., Akhperjanian, A., Beilicke, M., et al. 2002, A&A, 393, L37, doi: 10.1051/0004-6361:20021171
  * Aharonian (1995) Aharonian, F. A. 1995, Nuclear Physics B Proceedings Supplements, 39, 193, doi: 10.1016/0920-5632(95)00022-2
  * Aharonian et al. (1997) Aharonian, F. A., Atoyan, A. M., & Kifune, T. 1997, MNRAS, 291, 162, doi: 10.1093/mnras/291.1.162
  * Albert et al. (2020) Albert, A., Alfaro, R., Alvarez, C., et al. 2020, ApJ, 905, 76, doi: 10.3847/1538-4357/abc2d8
  * Albert et al. (2008) Albert, J., Aliu, E., Anderhub, H., et al. 2008, ApJ, 675, L25, doi: 10.1086/529520
  * Aleksić et al. (2015) Aleksić, J., Ansoldi, S., Antonelli, L. A., et al. 2015, Journal of High Energy Astrophysics, 5, 30, doi: 10.1016/j.jheap.2015.01.002
  * Aliu et al. (2014) Aliu, E., Aune, T., Behera, B., et al. 2014, ApJ, 783, 16, doi: 10.1088/0004-637X/783/1/16
  * Amato (2020) Amato, E. 2020, arXiv e-prints, arXiv:2001.04442.  https://arxiv.org/abs/2001.04442
  * Amato & Olmi (2021) Amato, E., & Olmi, B. 2021, Universe, 7, 448, doi: 10.3390/universe7110448
  * Amenomori et al. (2021) Amenomori, M., Bao, Y. W., Bi, X. J., et al. 2021, Phys. Rev. Lett., 126, 141101, doi: 10.1103/PhysRevLett.126.141101
  * Breuhaus et al. (2022) Breuhaus, M., Reville, B., & Hinton, J. A. 2022, A&A, 660, A8, doi: 10.1051/0004-6361/202142097
  * Bühler & Blandford (2014) Bühler, R., & Blandford, R. 2014, Reports on Progress in Physics, 77, 066901, doi: 10.1088/0034-4885/77/6/066901
  * Bykov et al. (2020) Bykov, A. M., Marcowith, A., Amato, E., et al. 2020, Space Sci. Rev., 216, 42, doi: 10.1007/s11214-020-00663-0
  * Cao et al. (2021) Cao, Z., Aharonian, F. A., An, Q., et al. 2021, Nature, 594, 33, doi: 10.1038/s41586-021-03498-z
  * de Jager & Djannati-Ataï (2009) de Jager, O. C., & Djannati-Ataï, A. 2009, in Astrophysics and Space Science Library, Vol. 357, Astrophysics and Space Science Library, ed. W. Becker, 451, doi: 10.1007/978-3-540-76965-1_17
  * Gaensler & Slane (2006) Gaensler, B. M., & Slane, P. O. 2006, ARA&A, 44, 17, doi: 10.1146/annurev.astro.44.051905.092528
  * H. E. S. S. Collaboration et al. (2012) H. E. S. S. Collaboration, Abramowski, A., Acero, F., et al. 2012, A&A, 545, L2, doi: 10.1051/0004-6361/201219906
  * H. E. S. S. Collaboration et al. (2018a) H. E. S. S. Collaboration, Abdalla, H., Abramowski, A., et al. 2018a, A&A, 612, A1, doi: 10.1051/0004-6361/201732098
  * H. E. S. S. Collaboration et al. (2018b) —. 2018b, A&A, 612, A2, doi: 10.1051/0004-6361/201629377
  * H. E. S. S. Collaboration et al. (2019) H. E. S. S. Collaboration, Abdalla, H., Aharonian, F., et al. 2019, A&A, 621, A116, doi: 10.1051/0004-6361/201834335
  * Hillas (1984) Hillas, A. M. 1984, ARA&A, 22, 425, doi: 10.1146/annurev.aa.22.090184.002233
  * Kargaltsev & Pavlov (2008) Kargaltsev, O., & Pavlov, G. G. 2008, in American Institute of Physics Conference Series, Vol. 983, 40 Years of Pulsars: Millisecond Pulsars, Magnetars and More, ed. C. Bassa, Z. Wang, A. Cumming, & V. M. Kaspi, 171–185, doi: 10.1063/1.2900138
  * Kennel & Coroniti (1984) Kennel, C. F., & Coroniti, F. V. 1984, ApJ, 283, 710, doi: 10.1086/162357
  * Khangulyan et al. (2014) Khangulyan, D., Aharonian, F. A., & Kelner, S. R. 2014, ApJ, 783, 100, doi: 10.1088/0004-637X/783/2/100
  * Konopelko et al. (2007) Konopelko, A., Atkins, R. W., Blaylock, G., et al. 2007, ApJ, 658, 1062, doi: 10.1086/511262
  * Lhaaso Collaboration et al. (2021) Lhaaso Collaboration, Cao, Z., Aharonian, F., et al. 2021, Science, 373, 425, doi: 10.1126/science.abg5137
  * Liu et al. (2019) Liu, R.-Y., Ge, C., Sun, X.-N., & Wang, X.-Y. 2019, ApJ, 875, 149, doi: 10.3847/1538-4357/ab125c
  * López-Coto et al. (2022) López-Coto, R., de Oña Wilhelmi, E., Aharonian, F., Amato, E., & Hinton, J. 2022, Nature Astronomy, 6, 199, doi: 10.1038/s41550-021-01580-0
  * Malkov & Drury (2001) Malkov, M. A., & Drury, L. O. 2001, Reports on Progress in Physics, 64, 429, doi: 10.1088/0034-4885/64/4/201
  * Olmi & Bucciantini (2019) Olmi, B., & Bucciantini, N. 2019, MNRAS, 488, 5690, doi: 10.1093/mnras/stz2089
  * Park & VERITAS Collaboration (2015) Park, N., & VERITAS Collaboration. 2015, in International Cosmic Ray Conference, Vol. 34, 34th International Cosmic Ray Conference (ICRC2015), 771\.  https://arxiv.org/abs/1508.07070
  * Porth et al. (2014) Porth, O., Komissarov, S. S., & Keppens, R. 2014, MNRAS, 438, 278, doi: 10.1093/mnras/stt2176
  * Prosekin et al. (2015) Prosekin, A. Y., Kelner, S. R., & Aharonian, F. A. 2015, Phys. Rev. D, 92, 083003, doi: 10.1103/PhysRevD.92.083003
  * Rees & Gunn (1974) Rees, M. J., & Gunn, J. E. 1974, MNRAS, 167, 1, doi: 10.1093/mnras/167.1.1
  * The LHAASO collaboration (2021) The LHAASO collaboration. 2021, arXiv e-prints, arXiv:2106.09865.  https://arxiv.org/abs/2106.09865
  * Wakely & Horan (2008) Wakely, S. P., & Horan, D. 2008, International Cosmic Ray Conference, 3, 1341
  * Williamson (2019) Williamson, T. 2019, arXiv e-prints, arXiv:1908.04165.  https://arxiv.org/abs/1908.04165


# Securing MIMO Wiretap Channel with Learning-Based Friendly Jamming under
Imperfect CSI

Bui Minh Tuan, Diep N. Nguyen, Nguyen Linh Trung, Van-Dinh Nguyen, Nguyen Van
Huynh, Dinh Thai Hoang, Marwan Krunz, and Eryk Dutkiewicz Bui Minh Tuan, Diep
N. Nguyen, Dinh Thai Hoang, and Eryk Dutkiewicz are with the School of
Electrical and Data Engineering, University of Technology Sydney, NSW 2007,
Australia<EMAIL_ADDRESS>{diep.nguyen, hoang.dinh,
eryk.dutkiewicz} @uts.edu.au).Van-Dinh Nguyen is with the College of
Engineering and Computer Science and the Center for Environmental
Intelligence, VinUniversity, Vinhomes Ocean Park, Hanoi, Vietnam
(dinh.nv2@vinuni.edu.vn).Nguyen Van Huynh is with the School of Computing,
Engineering and the Built Environment, Edinburgh Napier University, Edinburgh
EH10 5DT, UK. (h.nguyen2@napier.ac.uk).Marwan Krunz is with the Department of
Electrical and Computer Engineering, The University of Arizona, Tucson, AZ,
USA (krunz@arizona.edu).Nguyen Linh Trung (correspondence) is with the
Advanced Institute of Engineering and Technology, University of Engineering
and Technology, Vietnam National University, Hanoi, Vietnam
(linhtrung@vnu.edu.vn).

###### Abstract

Wireless communications are particularly vulnerable to eavesdropping attacks
due to their broadcast nature. To effectively deal with eavesdroppers,
existing security techniques usually require accurate channel state
information (CSI), e.g. for friendly jamming (FJ), and/or additional computing
resources at transceivers, e.g. cryptography-based solutions, which
unfortunately may not be feasible in practice. This challenge is even more
acute in low-end IoT devices. We thus introduce a novel deep learning-based FJ
framework that can effectively defeat eavesdropping attacks with imperfect CSI
and even without CSI of legitimate channels. In particular, we first develop
an autoencoder-based communication architecture with FJ, namely AEFJ, to
jointly maximize the secrecy rate and minimize the block error rate at the
receiver without requiring perfect CSI of the legitimate channels. In
addition, to deal with the case without CSI, we leverage the mutual
information neural estimation (MINE) concept and design a MINE-based FJ scheme
that can achieve comparable security performance to the conventional FJ
methods that require perfect CSI. Extensive simulations in a multiple-input
multiple-output (MIMO) system demonstrate that our proposed solution can
effectively deal with eavesdropping attacks in various settings. Moreover, the
proposed framework can seamlessly integrate MIMO security and detection tasks
into a unified end-to-end learning process. This integrated approach can
significantly maximize the throughput and minimize the block error rate,
offering a good solution for enhancing communication security in wireless
communication systems.

###### Index Terms:

Autoencoder, IoT security, anti-eavesdropping, friendly jamming, multiple-
input-multiple-ouput (MIMO), mutual information, physical layer security,
wiretap channel, mutual information neural estimation (MINE).

##  I Introduction

The rapid development of the Internet of Things (IoT) has paved the way for
establishing connections and gathering data across various domains, from smart
homes and cities, to healthcare, transportation, and Industry 4.0. However,
with a large number of diverse wireless devices, IoT networks are highly
vulnerable to adversaries due to the broadcast nature of wireless
communications. Among radio threats, eavesdropping is one of the most common
and dangerous attacks. Specifically, with off-the-shelf circuits, adversaries
can effectively launch eavesdropping attacks to passively wiretap legitimate
wireless channels to intercept the transmitted information from the
transmitter. As a result, the need for lightweight anti-eavesdropping
approaches that accommodate the limited processing capabilities of IoT devices
without compromising their operational efficiency is, therefore, critical.

###  I-A Related Work

The most common countermeasure against eavesdroppers is encryption techniques
[1], such as Advanced Encryption Standard (AES) and Rivest-Shamir-Adelman
(RSA). Unfortunately, these methods require infrastructure for distributing
public keys and the irresistibility of the underlying encrypted function. In
addition, data encryption and decryption create burdens on computing resources
for wireless devices, especially for computing- and resource-constrained
devices such as IoT devices and wireless sensors [2, 3]. Moreover,
conventional encryption techniques may not guarantee absolute protection when
eavesdroppers have sufficient computational capability or employ sophisticated
techniques to crack encryption keys [1]. Hence, when transceivers have limited
capabilities as compared to eavesdroppers, such as IoT devices, legitimate
communication links are still subject to being compromised. Finally, quantum
computing may soon crack encryption techniques while post-quantum cryptography
is still in its infancy and may not be feasible/suitable for power-constrained
devices [4].

Given the limitations of encryption techniques, physical layer security (PLS)
has emerged as a promising solution to deal with eavesdropping attacks by
leveraging the dynamic and stochastic nature of wireless channels [5].
Specifically, PLS aims to achieve a positive secrecy capacity defined by the
difference between the channel capacities of the legitimate link and the
eavesdropper link [6, 7]. To do that, PLS can focus on either random key
generation or provisioning information-theoretic secrecy rates to design
secure wireless communication systems [8]. The former extracts channel state
information (CSI) to generate random keys that can be used for authentication
purposes. The latter includes channel coding, channel-based adaptation, and
artificial noise (AN)/friendly jamming (FJ)-based security. Among these PLS
approaches, the FJ technique has been widely studied in the literature due to
its effectiveness in dealing with eavesdropping attacks. With the FJ
technique, the transmitter (Tx) uses a proportion of the transmit power to
deliberately inject noise signals to degrade the reception of the legitimate
signals at eavesdroppers while not adversely impacting the legitimate receiver
(Rx) [7]. This can be achieved with the beamforming technique that is popular
in multi-input, multi-output or multi-input-multi-output (MIMO) systems. The
critical factor affecting the security performance of FJ is the availability
of CSI at the Tx for beamforming purposes. In one of the early studies on FJ-
based security [9], Tx-based friendly jamming (TxFJ) and cooperative jamming
were proposed with the assumption that the perfect CSI between legitimate
transceivers is known at the Tx. The FJ signal is then designed to project on
the nullspace/directions of the legitimate channel so that the FJ noise signal
will not affect the signal-to-noise ratio (SNR) of the Rx. Rx-based friendly
jamming (RxFJ) was also proposed with a multi-user broadcast channel in [10],
guaranteeing a non-zero average secrecy rate, regardless of the position of
the eavesdropper.

Securing multi-user link while managing the adverse effect of the FJ
interference was further studied in [11]. The authors used a non-cooperative
game to model the FJ and transmit power control problem for the interfering
wiretap links. In addition, the work in [12] investigated beamforming based-FJ
to achieve an instantaneous secrecy rate. In particular, the authors first
derived the closed-form secrecy rate. Then, the Tx picks a suitable coding
scheme to guarantee secrecy. Nevertheless, all the above methods as well as
most general MIMO settings e.g., [9, 10, 11, 13, 14, 15] required or assumed
perfect CSI or, at least, statistical CSI of the legitimate channel at the Tx
to construct FJ signals. However, perfect or statistical CSI acquisition is
very challenging, if not impractical, especially for IoT communications.

The key reasons are the inaccuracy of the estimated CSI at the Rx (before
feeding it back to the Tx) and the limited bandwidth of the feedback channel
[16]. Hence, the FJ signals, designed to lie on the nullspace of the imperfect
channel [9, 10], may degrade the quality of the (actual) legitimate channel
and not be fully canceled out at the Rx. To overcome these issues, the authors
in [12, 17, 18] assumed statistical CSI (instead of full/complete CSI) to
satisfy the QoS of SNR and the nonzero secrecy capacity. Then, the second
perturbation analysis was used to design the beamforming scheme.
Unfortunately, this method requires high computational capability at the Rx
and high running time. Another approach in [18] proposed a masked beamforming
scheme that leverages artificial noise to impair the decoding capabilities the
eavesdropper, particularly regarding channel estimation delay and error. The
instantaneous security performance of this scheme was then evaluated in terms
of the minimum mean square error at the eavesdropper, providing a metric to
assess its effectiveness in enhancing communication security amidst the
discussed challenges. However, the alternative optimization used in the
proposed approach has a low convergence speed. Furthermore, the work in [19]
introduced an FJ-based authentication scheme. This scheme leverages FJ to
obscure a hash-based message authentication code tag, facilitating secure
authentication between legitimate users. Although achieving good security
performance, this method may add significant overhead to the current
communication infrastructure.

Figure 1: Illustration of MIMO FJ-based system model with Tx, Rx, and
eavesdropper.

###  I-B Motivation and Main Contributions

As mentioned earlier, the security performance of FJ-based methods is highly
affected by imperfect CSI (ImCSI). To cope with it, conventional methods were
based on exhaustive search and second-order statistics that require high
computational and transmission overhead. This work aims to develop an FJ
solution based on deep learning (DL) in order to deal with ImCSI. To this end,
we integrate the autoencoder (AE) architecture, with denoising and
generalization capability, into the FJ approach. AE is designed to acquire a
dataset representation (encoding) and reconstruct (decoding) the input from
the output. Based on this encoding, it reconstructs a representation of the
output that closely resembles the input [20, 21]. Unlike the previous works in
[17, 22, 23, 24], and [25], we introduce a novel FJ method for PLS utilizing
AE while the statistical information of channel estimation error is known.
Consequently, the running time and overhead of our DL-based method can be
reduced significantly compared to the conventional methods.

Moreover, to deal with the case without even statistical CSI (SCSI) at the
transmitter, we integrate the method of mutual information neural estimation
(MINE) [23] into our AE architecture. MINE has been employed for transceiver
design in a few studies in the literature. For example, the authors in [26]
adopted MINE to improve the channel coding process at the transmitter.
Differently, the authors in [24] demonstrated that combining AE and MINE could
enhance transmission performance, including decoding error and throughput.
However, these works and others in the literature only considered single-
input-single-output systems and may not be effective when dealing with
eavesdropping attacks. Our study here expands upon the traditional concept of
relying on perfect CSI to cancel out FJ at the Rx. In particular, our method
empowers the legitimate Tx and Rx to learn how to suppress FJ signals while
maintaining the degradation of the eavesdropper channel.

Our work has three main contributions. Firstly, we propose a novel joint
optimization framework that maximizes the secrecy rate while minimizing the
block/symbol error rates, based on end-to-end (E2E) learning with a new loss
security function. This novel framework enables us to explore the interplay
between MIMO secrecy optimization and detection.

Secondly, we use generalization capabilities inherent in deep neural networks
to develop an AE-based FJ scheme that exhibits robustness against challenges
posed by SCSI. These challenges arise due to various factors such as dynamic
channel variations or constraints imposed by a limited number of pilots as
studied in [27]. Given the strong capability of DL-based communication
frameworks to handle diverse input datasets, our method showcases a superior
secrecy rate as compared to conventional methods, especially when dealing with
channel estimation errors. To achieve this, the secrecy rate optimization is
integrated into the E2E learning process under SCSI scenarios.

Thirdly, for the case without SCSI, we leverage the MINE-based FJ to show that
attaining a level of security equivalent to traditional FJ methods with
perfect CSI is feasible. During training, the mutual information (MI) of the
legitimate channel is maximized while that of the eavesdropper is minimized
using the inputs as the samples taken from Tx and Rx signals. Different from
the E2E AE-based FJ in the second contribution, the MINE-based FJ minimizes
the computational burden and conserves energy consumption at the Rx. This
methodology is particularly suitable for applications in IoT networks where
devices have limited computational resources.

Extensive simulations/experiments are carried out to demonstrate the
effectiveness of the proposed method AEFJ in terms of secrecy throughput and
block error rate.

The structure of this paper is as follows: Section II provides a brief
overview of the system model and the FJ-based Physical Layer Security (PLS)
technique as a reference point for our new approach. Following this, Section
III details our novel AE-based FJ strategy, designed to counter eavesdroppers
when only statistical information of channel estimation error is available.
Section IV-B introduces our security framework utilizing MINE to safeguard
communications without CSI. The analysis of secrecy and Block Error Rate
(BLER) by simulations is presented in Section V. Conclusions are drawn in
Section VI.

Notation: Vectors and matrices are denoted by bold lowercase and uppercase
letters, respectively. The absolute value of a real number, the magnitude of a
complex number, and the complex conjugate transpose are, respectively, denoted
by $\left\|\cdot\right\|$, $\left|\cdot\right|$ and $(\cdot)^{\dagger}$. The
complex Gaussian random variable with mean $\mu$ and variance $\sigma^{2}$ is
denoted by $\mathcal{CN}(\mu,\sigma^{2})$. $\mathbb{E}[X]$ denotes the
expectation of $X$, $\text{Tr}({\mathbf{A}})$ the trace of the square matrix
${\mathbf{A}}$.

##  II System Model and Secrecy Rate Optimization

Figure 2: The AE-based communication with E2E learning.

###  II-A Background on MIMO-FJ

####  II-A1 System Model

The standard MIMO FJ model is depicted in Fig. 1, where the Tx, the Rx, and
the eavesdropper are equipped with $N_{t}$, $N_{r}$ and $N_{e}$ antennas,
respectively [9]. Channel matrices at time slot $k$ for the Tx-Rx and Tx-
eavesdropper links are denoted as
$\mathbf{H}_{k}\in\mathbb{C}^{N_{t}\text{x}N_{r}}$ and
$\mathbf{G}_{k}\in\mathbb{C}^{N_{t}\text{x}N_{e}}$. Each element of
$\mathbf{H}_{k}$ and $\mathbf{G}_{k}$ is assumed to be known, i.i.d., and
unchanged over a block of transmit symbols. Let $\mathbf{s}_{k}$ be the
desired message to the Rx. To cancel interference caused by FJ at the Rx, the
FJ signal $\mathbf{w}_{k}$ is designed to satisfy
${\mathbf{H}_{k}^{\dagger}\mathbf{w}_{k}=0}$. Given the transmitted signal
$\mathbf{x}_{k}=\mathbf{s}_{k}+\mathbf{w}_{k}$, the received signals at the Rx
and the eavesdropper can be expressed as follows:

$\displaystyle\mathbf{y}_{k}$
$\displaystyle=\mathbf{H}_{k}^{\dagger}\mathbf{x}_{k}+\mathbf{n}_{b}=\mathbf{H}_{k}^{\dagger}\mathbf{s}_{k}+\mathbf{H}_{k}^{\dagger}\mathbf{w}_{k}+\mathbf{n}_{b},$
(1) $\displaystyle\mathbf{z}_{k}$
$\displaystyle=\mathbf{G}_{k}^{\dagger}\mathbf{s}_{k}+\mathbf{G}_{k}^{\dagger}\mathbf{w}_{k}+\mathbf{n}_{e}$
(2)

where $\mathbf{n}_{b}\sim\mathcal{CN}(0,\sigma^{2}_{b})$ and
$\mathbf{n}_{e}\sim\mathcal{CN}(0,\sigma^{2}_{e})$ are the additive white
Gaussian noise (AWGN) at the Rx and the eavesdropper. The FJ signal
$\mathbf{w}_{k}$ is designed as $\mathbf{w}_{k}=\mathbf{Z}_{k}\mathbf{v}_{k}$,
where the precoding matrix $\mathbf{Z}_{k}$ is the orthogonal basis of the
nullspace of $\mathbf{H}_{k}^{\dagger}$. The elements of $\mathbf{v}_{k}$ are
i.i.d. complex Gaussian random variables with variance $\sigma_{v}^{2}$. The
noise covariance at the eavesdropper then can be calculated as follows:

$\displaystyle\mathbf{K}_{k}=(\mathbf{G}_{k}^{\dagger}\mathbf{Z}_{k}^{\dagger}\mathbf{Z}_{k}\mathbf{G}_{k})\sigma_{v}^{2}+\mathbf{I}_{N_{e}}\sigma_{e}^{2},$
(3)

where ${\mathbf{I}}_{i}$ is an $i\times i$ identity matrix.

####  II-A2 The Secrecy Rate Optimization Problem

Given $R_{AB}$ and $R_{AE}$ as the legitimate and illegitimate channel rates,
the secrecy rate $R_{k}^{s}$ (nats/s/Hz) is given by

$\displaystyle R_{k}^{s}$
$\displaystyle\triangleq~{}\left[R_{AB}-R_{AE}\right]_{+}=\left[\log(1+\operatorname{SINR}_{\text{B}})-\log(1+\operatorname{SINR}_{\text{E}})\right]_{+}$
$\displaystyle=\left[\log\det\big{(}\mathbf{I}+\mathbf{H}_{k}^{\dagger}\mathbf{Q}_{s}\mathbf{H}_{k}\big{)}-\log\frac{{{{\det\big{(}\mathbf{K}_{k}+\mathbf{G}_{k}^{\dagger}\mathbf{Q}_{s}\mathbf{G}_{k}}\big{)}}}}{{{\det(\mathbf{K}_{k})}}}\right]_{+}$
(4)

where $[x]_{+}=\max(0,x)$,
$\mathbf{Q}_{s}=\mathbf{E}[\mathbf{s}_{k}\mathbf{s}_{k}^{\dagger}]$. Since the
eavesdropper’s CSI is unavailable at the Tx, we focus on maximizing the first
term in (4) by using singular value decomposition (SVD). Specifically, the
legitimate channel $\mathbf{H}_{k}$ is first decomposed as

$\displaystyle\mathbf{H}_{k}^{\dagger}$
$\displaystyle=\mathbf{U}_{k}\mathbf{\Gamma}_{k}\mathbf{V}_{k}^{\dagger},$ (5)

where $\mathbf{U}_{k}\in\mathbb{C}^{N_{r}\text{x}N_{r}}$,
$\mathbf{V}_{k}\in\mathbb{C}^{N_{t}\text{x}N_{t}}$, and
$\mathbf{\Gamma}_{k}\in\mathbb{C}^{N_{t}\text{x}N_{t}}$. After precoding
$\mathbf{r}_{k}=\mathbf{V}_{k}^{\dagger}\mathbf{s}_{k}$, the received signal
$\mathbf{y}_{k}$ is multiplied with $\mathbf{U}_{k}^{\dagger}$. Then, the
received signal in (1) can be equivalently to

$\displaystyle\mathbf{\tilde{y}}_{k}$
$\displaystyle=\mathbf{\Gamma}_{k}^{\dagger}\mathbf{r}_{k}+\mathbf{\tilde{n}}_{b},$
(6)

where $\mathbf{\tilde{y}}_{k}=\mathbf{U}_{k}^{\dagger}\mathbf{y}_{k}$. We
denote $P$ is the total transmit power, $P_{\mathrm{info}}$ is the power for
transmitting information signal, and $\mathbf{Q}_{r}$ as the precoded transmit
covariance. Then $\mathbf{Q}_{r}$ is designed as

$\displaystyle\mathbf{Q}_{r}=\mathbb{E}[\mathbf{r}_{k}\mathbf{r}_{k}^{\dagger}]=\operatorname{diag}(\sigma_{r,1}^{2},\sigma_{r,2}^{2},...,\sigma_{r,N_{t}}^{2}),$
(7)

where $\sigma_{r,i}^{2}$ is derived by the water filling solution with power
constraint $P_{\mathrm{info}}\leq{P}$, corresponding to the $N_{t}$ largest
singular values of ${\mathbf{H}}_{k}^{\dagger}$. Thus, the secrecy rate
$R_{k}^{s}$ is re-expressed as

$\displaystyle
R_{k}^{s}=\left[\log\det(\mathbf{I}+{\mathbf{\Gamma}_{k}\mathbf{Q}_{r}\mathbf{\Gamma}_{k}^{\dagger}})-\log\frac{\det(\mathbf{K}_{k}+\mathbf{F}_{k})}{\det(\mathbf{K}_{k})}\right]_{+},$
(8)

where
$\mathbf{F}_{k}=\mathbf{G}_{k}^{\dagger}\mathbf{V}_{k}^{\dagger}\mathbf{Q}_{r}\mathbf{V}_{k}\mathbf{G}_{k}$.
Since $R_{k}^{s}$ is random, the average secrecy rate over a number of channel
realizations $\bar{R}$ will be used. Our objective is to maximize the average
secrecy rate subject to the power constraint at the Tx, which is
mathematically formulated as follows:

$\displaystyle\bar{R}~{}\dot{=}\max_{\text{Tr}(\mathbb{E}[\mathbf{x}_{k}\mathbf{x}_{k}^{\dagger}])\leq{P}}\mathbb{E}\left[\log\det(\mathbf{I}+{\mathbf{\Gamma}_{k}\mathbf{Q}_{r}\mathbf{\Gamma}_{k}^{\dagger}})-\log\frac{\det(\mathbf{K}_{k}+\mathbf{F}_{k})}{\det(\mathbf{K}_{k})}\right].$
(9)

The power constraint
$\text{Tr}(\mathbb{E}[\mathbf{x}_{k}\mathbf{x}_{k}^{\dagger}])\leq{P}$ can be
rewritten as
$\text{Tr}\big{(}\mathbf{V}_{k}^{\dagger}\mathbf{Q}_{r}\mathbf{V}_{k}+N_{\mathrm{FJ}}\sigma_{v}^{2}{\mathbf{I}}_{N_{t}}\big{)}\leq
P$, where ${N}_{\mathrm{FJ}}$ denotes the number of dimensions used for
transmitting FJ signals.

####  II-A3 Channel Estimation Error Model

The previous part considers the case of perfect CSI. Regarding ImCSI, due to
channel estimation error, we choose a common ImCSI model [17]:

$\displaystyle{{\rm{\tilde{\mathbf{H}}}}_{k}}{\rm{=}}{{\rm{\mathbf{H}}}_{k}}+\Delta{{\rm{\mathbf{H}}}_{k}},$
(10)

where the channel estimation error $\Delta{\mathbf{H}_{k}}$ is modeled as an
i.i.d. complex Gaussian and circularly symmetric random matrix with the
covariance
${\mathbf{C}_{\Delta{\mathbf{H}}_{k}}}\sim\mathcal{CN}({\mathbf{0}},\rho_{e}^{2}{\mathbf{I}}_{N_{r}})$.
Then the secrecy rate in (4) becomes

$\displaystyle\overline{R}_{k}^{s}\dot{=}\max_{\text{Tr}(\mathbb{E}[\mathbf{x}_{k}^{\dagger}\mathbf{x}_{k}])\leq{P}}\mathbb{E}$
$\displaystyle\Big{[}\log\frac{{\det({\bf{I}}+{{({{\bf{H}}_{k}}+\Delta{{\bf{H}}_{k}})}^{\dagger}}{{\bf{Q}}_{s}}({{\bf{H}}_{\bf{k}}}+{\bf{\Delta}}{{\bf{H}}_{\bf{k}}})}}{{\det({{\bf{D}}_{k}})}}$
$\displaystyle-\log\frac{{{{\det(\mathbf{K}_{k}+\mathbf{G}_{k}^{\dagger}\mathbf{Q}_{s}\mathbf{G}_{k}})}}}{{{\det(\mathbf{K}_{k})}}}\Big{]},$
(11)

where
$\mathbf{D}_{k}=(\mathbf{\Delta{\mathbf{H}}}_{k}^{\dagger}\mathbf{Z}_{k}^{\dagger}\mathbf{Z}_{k}\mathbf{\Delta{\mathbf{H}}}_{k})\sigma_{v}^{2}+\mathbf{I}_{N_{r}}\sigma_{b}^{2}$
is the noise covariance at the receiver. The reason is the FJ signals are not
completely canceled out at the receiver due to channel error.

###  II-B AE-based MIMO Communication

The AE-based communication is illustrated in Fig. 2 [28]. The model aims to
reconstruct the input messages at time $k$,
$m_{k}\in\mathcal{M}=\\{1,2,\ldots,M\\}$, by minimizing the reconstruction
error of the inputs or transmitted signals. The message $m_{k}$ is generated
uniformly and then embedded into the transmitted symbol $\mathbf{s}_{k}$.
Then, it is sent through the dense layers to generate the transmit signal
${\mathbf{x}}_{k}$. The batch normalization layer performs the power
constraint. The decoder includes the complex to real conversion layer, dense
layers, and the last layer using the Softmax activation function. The output
is the probability distribution
$\hat{\mathbbm{1}}_{m}\in(0,1)^{\operatorname{card}(M)}$ over all messages
($\operatorname{card}$ denotes cardinality). Then, the maximum likelihood (ML)
is used to estimate the transmitted signal and optimize the construction error
by using the cross-entropy loss function [28, 29]. Hence, the decoded message
$\hat{m}_{k}$ will be the index of the element of $\hat{\mathbbm{1}}_{m}$ with
the highest value.

Re-parameterization: Since DL models only work on real numbers, converting
complex parameters to real values is necessary. As studied in [30], the
complex parameters can be re-parameterized into new real parameters as
follows:

$\displaystyle{\rm{\hat{\mathbf{x}}_{k}=}}\left[{\begin{array}[]{*{20}{c}}{{\Re}({\rm{\mathbf{x}_{k}}})}\\\
{{\Im}({\rm{\mathbf{x}_{k}}})}\end{array}}\right],~{}{\rm{\hat{\mathbf{y}}_{k}=}}\left[{\begin{array}[]{*{20}{c}}{{\Re}}({\rm{\mathbf{y}_{k}}})\\\
{{\Im}({\rm{\mathbf{y}_{k}}})}\end{array}}\right],$ (16)
$\displaystyle{{\rm{\hat{\mathbf{n}}}}_{b}}{\rm{=}}\left[{\begin{array}[]{*{20}{c}}{{{\Re}}({{\rm{\mathbf{n}}}_{b}})}\\\
{{\Im}({{\rm{\mathbf{n}}}_{b}})}\end{array}}\right],~{}{\rm{\hat{\mathbf{H}}_{k}=}}\left[{\begin{array}[]{*{20}{c}}{{\Re}({\rm{\mathbf{H}_{k}}})}&{-{\Im}({\rm{\mathbf{H}_{k}}})}\\\
{{\Im}({\rm{\mathbf{H}_{k}}})}&{{\Re}({\rm{\mathbf{H}_{k}}})}\end{array}}\right],$
(21)

where $\Re(\mathbf{z})$ and $\Im(\mathbf{z})$ denote the real and imaginary
parts of a complex number $\mathbf{z}$. We have
$\hat{\mathbf{x}_{k}}\in{\mathbb{R}}^{2N_{t}}$,
$\hat{\mathbf{y}_{k}}\in{\mathbb{R}}^{2N_{r}}$ and
$\hat{\mathbf{H}_{k}}\in{\mathbb{R}}^{2N_{r}\times 2N_{t}}$. As a result, the
received signal at the Rx in (1) can be equivalently written as follows:

$\displaystyle\hat{\mathbf{y}}_{k}$
$\displaystyle=\hat{\mathbf{H}}_{k}^{\dagger}\hat{\mathbf{x}}_{k}+\hat{\mathbf{n}}_{b}.$
(22)

The transmitted signal is expressed as
$\hat{\mathbf{x}}_{k}=\hat{\mathbf{s}}_{k}+\hat{\mathbf{w}}_{k}$, where
$\hat{\mathbf{w}}_{k}$ and $\hat{\mathbf{s}}_{k}$ are the FJ and information-
bearing signals, respectively. Then, the signals received at the Rx and the
eavesdropper are given by

$\displaystyle\hat{\mathbf{y}}_{k}$
$\displaystyle=\hat{\mathbf{H}}_{k}^{\dagger}\mathbf{s}_{k}+\hat{\mathbf{H}}_{k}^{\dagger}\hat{\mathbf{w}}_{k}+\hat{\mathbf{n}}_{b},$
(23) $\displaystyle\hat{\mathbf{z}}_{k}$
$\displaystyle=\hat{\mathbf{G}}_{k}^{\dagger}\mathbf{s}_{k}+\hat{\mathbf{G}}_{k}^{\dagger}\hat{\mathbf{w}}_{k}+\hat{\mathbf{n}}_{e}.$
(24)

##  III AE-based Friendly Jamming

In this section, we leverage the AE-based communication model mentioned above
(see Fig. 2) with ImCSI to design AE-based FJ. The E2E learning scheme aims to
achieve two goals: maximizing the secrecy rate and minimizing the BLER at the
Rx. The proposed AE-based MIMO FJ communication and security scheme is
illustrated in Fig. 3. The FJ signal is generated via the FJ generator layer
and is then injected into the transmitted signals ${\mathbf{x}}_{k}$.

Figure 3: AE-based MIMO FJ.

A straightforward approach to optimize the secrecy rate is to maximize the MI
difference between the Tx and the Rx and design an FJ signal such that it
degrades the eavesdropper channel. Next, we will detail this approach.

###  III-A AE-based MI Optimization

It is worth noting that the communication and security tasks are transformed
into the classification with the AE, Softmax activation function, and cross-
entropy based security loss function [28]. The conventional work often assumes
that the channel $\mathbf{H}_{k}$ is perfectly known, based on which the
average secrecy rate is achieved by maximizing the channel rate or $I(A,B)$ of
the legitimate channel and the precoded FJ signals $\mathbf{w}_{k}$ are then
designed to lie in the nullspace of $\mathbf{H}_{k}$ so as to degrade the
eavesdropper channel with the highest probability. Regarding ImCSI, the FJ
signals may not completely lie in the true nullspace of $\mathbf{H}_{k}$.
Thus, finding the optimal FJ signals that can be completely canceled out at
the Rx and degrade the decoding capability of the eavesdropper is a nontrivial
task; even the statistical information of channel estimation error is
available at the Tx. Since AE-based communication can be seen as a classifier
of transmitted messages and symbols, the MI between the input and the output
on the legitimate channel, $I(A,B)$, can be maximized using Softmax and cross-
entropy loss functions. The transmitted message and its label are denoted by
the random variables ${\mathbf{m}}$ and ${\mathbf{l}}$, respectively. The
training data consists of $M$ classes and $N$ labeled instances denoted as
$\\{(m_{k},l_{k})\\}_{k=1}^{N}$, where $l_{k}\in\mathcal{M}=\\{1,...,M\\}$ is
a class label of input $m_{k}$. For the task of reconstruction, let $l_{k}$ be
equal to $m_{k}$. The AE is now a neural classifier
$AE({\mathbf{m}},{\mathbf{l}})$ parameterized by $\phi$. It can be seen that
${\mathbf{m}}$ and ${\mathbf{x}}$ have the same probability distribution
$p({\mathbf{m}})$, similarly with $p({\mathbf{l}})$ and ${\mathbf{y}}$. Thus,
the MI between ${\mathbf{x}}$ and ${\mathbf{y}}$ can be expressed as:

$\displaystyle
I({\mathbf{x}},{\mathbf{y}})=I({\mathbf{m}},{\mathbf{l}})=\sum_{m_{k}\in\mathcal{M}}\sum_{l_{k}\in\mathcal{M}}p({\mathbf{m}},{\mathbf{l}})\log\frac{p({\mathbf{m}},{\mathbf{l}})}{p({\mathbf{m}})p({\mathbf{l}})}.$
(25)

The MI $I({\mathbf{m}},{\mathbf{l}})$ can be rewritten as follows:

$\displaystyle
I({\mathbf{m}},{\mathbf{l}})={\mathbb{E}_{{\mathbf{m}},{\mathbf{l}}}}\log\frac{{p({\mathbf{l}}|{\mathbf{m}})}}{{p({\mathbf{l}})}},$
(26)

where $\mathbb{E}_{{\mathbf{m}},{\mathbf{l}}}$ is the expectation with respect
to the joint distribution $p({\mathbf{m}},{\mathbf{l}})$. Since
$p({\mathbf{m}},{\mathbf{l}})$ is not available, we use the variational
distribution $q$ to estimate $I({\mathbf{m}},{\mathbf{l}})$. This can be done
as follows [31]:

$\displaystyle I({\mathbf{m}},{\mathbf{l}})$
$\displaystyle=\mathbb{E}_{{\mathbf{m}},{\mathbf{l}}}\log\frac{p({\mathbf{l}}|{\mathbf{m}})}{p({\mathbf{l}})}=\mathbb{E}_{{\mathbf{m}},{\mathbf{l}}}\log\frac{q({\mathbf{l}}|{\mathbf{m}})p({\mathbf{l}}|{\mathbf{m}}}{p({\mathbf{l}})q({\mathbf{l}}|{\mathbf{m}})}$
$\displaystyle=\mathbb{E}_{{\mathbf{m}},{\mathbf{l}}}\log\frac{q({\mathbf{l}}|{\mathbf{m}})}{p({\mathbf{l}})}+\mathbb{E}_{{\mathbf{m}},{\mathbf{l}}}\log\frac{p({\mathbf{m}},{\mathbf{l}})}{q({\mathbf{m}},{\mathbf{l}})}-\mathbb{E}_{{\mathbf{m}}}\log\frac{p({\mathbf{m}})}{q({\mathbf{m}})}$
$\displaystyle\geq\mathbb{E}_{{\mathbf{m}},{\mathbf{l}}}\left[\log\frac{q({\mathbf{m}},{\mathbf{l}})}{p({\mathbf{m}})P({\mathbf{l}})}\right].$
(27)

The inequality (27) holds since the KL divergence maintains non-negativity.
The lower bound is tight when $q({\mathbf{m}},{\mathbf{l}})$ converges to
$p({\mathbf{m}},{\mathbf{l}})$. However, $q({\mathbf{m}},{\mathbf{l}})$ has to
satisfy the probability constraint axioms such as non-negativity, symmetry,
and summary of all probability values equal to one. By [32],
$q({\mathbf{m}},{\mathbf{l}})$ is represented by an unconstrained function
$g(\gamma)$, given as

$\displaystyle
q({\mathbf{m}},{\mathbf{l}})=\frac{p({\mathbf{m}})p({\mathbf{l}})}{\mathbb{E}_{l_{i}\sim
p({\mathbf{l}})}\exp f_{\theta}({\mathbf{m}},l_{i})}\exp
g_{\gamma}({\mathbf{m}},{\mathbf{l}}).$ (28)

Given a neural network $AE({\mathbf{m}},{\mathbf{l}})$, the Softmax activation
function at the last layer is
$S(AE({\mathbf{m}},{\mathbf{l}})):\mathbb{R}^{M}\rightarrow\mathbb{R}^{M}$ and
defined as:

$\displaystyle S(AE({\mathbf{m}},{\mathbf{l}}))=\frac{\exp
AE({\mathbf{m}},{\mathbf{l}})}{\sum_{l_{i}=1}^{M}\exp n(M)_{l_{i}}}.$ (29)

Then, the expected cross-entropy $L_{CE}$ loss is given as

$\displaystyle
L_{CE}=-\mathbb{E}_{{\mathbf{m}},{\mathbf{l}}}\big{\\{}AE({\mathbf{m}},{\mathbf{l}})-\log\sum_{l_{i}=1}^{M}\exp
AE({\mathbf{m}},{\mathbf{l}})\big{\\}}$ (30)

where the expectation is taken over the joint distribution
$p({\mathbf{m}},{\mathbf{l}})$. The following theorem presents the
relationship between the estimated MI and the AE classifier.

######  Theorem 1.

Let $g_{\gamma}({\mathbf{m}},{\mathbf{l}})=AE({\mathbf{m}},{\mathbf{l}})$. The
infimum of the expected cross-entropy loss with output of Softmax activation
function $S(AE({\mathbf{m}},{\mathbf{l}}))$ is equivalent to the MI between
input and output variables ${\mathbf{m}},{\mathbf{l}}$, respectively, up to
constant $\log M$ under uniform label distribution.

###### Proof.

Let $g_{\gamma}({\mathbf{m}},{\mathbf{l}})=AE({\mathbf{m}},{\mathbf{l}})$,
then the lower bound is

$\displaystyle\mathbb{E}_{{\mathbf{m}},{\mathbf{l}}}\log\frac{\exp
AE({\mathbf{m}},{\mathbf{l}})}{\sum_{l_{i}=1}^{{\mathbf{m}}}\exp
AE({\mathbf{m}},{\mathbf{l}})_{l_{i}}}.$ (31)

If the distribution of the label is uniform, we can rewrite

$\displaystyle\mathbb{E}_{{\mathbf{m}},{\mathbf{l}}}$
$\displaystyle\log\frac{\exp
AE({\mathbf{m}},{\mathbf{l}})}{\frac{1}{M}\sum_{l_{i}=1}^{M}\exp
AE({\mathbf{m}},{\mathbf{l}})_{l_{i}}}$
$\displaystyle=\mathbb{E}_{{\mathbf{m}},{\mathbf{l}}}\log\frac{\exp
AE({\mathbf{m}},{\mathbf{l}})}{\sum_{l_{i}=1}^{M}\exp
AE({\mathbf{m}},{\mathbf{l}})_{l_{i}}}+\log M$
$\displaystyle=-S(AE({\mathbf{m}},{\mathbf{l}}))+\log M,$ (32)

which is equivalent to the negative expected cross-entropy loss up to constant
$\text{log}M$. Hence, the infimum of the expected cross-entropy equals the MI
between input and output variables. ∎

Therefore, the secrecy optimization can be transformed into the cross-entropy
optimization between the transmitted and received signals. Next, we construct
a new cross-entropy loss function to optimize the MIMO-AE channel parameters.

###  III-B Security Loss Function

The term security loss function was first proposed in [22], which is a mixed
loss cross-entropy function aiming to maximize the ML between the transmit and
receive symbols at the Rx and increase the cross-entropy between the
transmitted and the received symbols at the eavesdropper. However, this
assumption may not be available in practical scenarios because eavesdroppers
are passive and would never give feedback for the training process. In our
work, we propose the following cross-entropy loss function:

$\displaystyle
L=(1-\alpha)H(p_{A}({\mathbf{s}}_{k}),p_{B}({\mathbf{s}}_{k})+\alpha
H(p_{A}({\mathbf{w}}_{k}),p_{B}({\mathbf{w}}_{k}))$ (33)

where $p_{A}(s_{k})$ and $p_{B}(s_{k})$ are the probability mass functions of
the information signals, and $p_{A}(w_{k})$ and $p_{B}(w_{k})$ are the
resulting probability mass functions of the FJ signals at the Tx and the Rx,
respectively, $H(\cdot)$ denotes the cross-entropy, and $\alpha$ is a
parameter for the security and communication rate trade-off. Hence, minimizing
$H(p_{A}(s_{k}),p_{B}(s_{k}))$ or maximizing the output probability of symbol
$s_{ik}$ will decrease the output probability of all other symbols at the Rx.
In contrast, maximizing $H(p_{A}(s_{k}),p_{E}(s_{k}))$ forces the system to
reduce the output probability of the symbol $s_{ik}$, resulting in a higher
probability on other symbols $s_{jk}$, $i\\#j$. In other words, this scheme
can minimize the MI $I(FJ,B)$ and maximize $I(A,B)$. As discussed, the AE
classification task with softmax and cross-entropy loss function is equivalent
to the maximum MI between the input and output. Hence, minimizing the loss
function (33) will reduce the effect of FJ on the Rx and maximize $I(A,B)$. By
contrast, the eavesdropper channel will be degraded with a high probability
since the eavesdropper does not have any information about the FJ signals.

###  III-C FJ Generation

Figure 4: The learning-based capacity driven FJ.

To generate FJ signals, we propose a learning-based capacity-driven FJ (LCD-
FJ) model, illustrated in Fig. 4. The LCD-FJ structure consists of an
embedding layer that converts complex values of the inputs into real values,
fully connected layers, and three Lambda functions. The first Lambda function
is used to encode the input to the azimuth. The second Lambda function is used
to design the precoding matrix $\mathbf{T}_{k}$, and the data rate is then
calculated. The training process aims to optimize the precoding matrix
$\mathbf{T}_{k}$ by minimizing the loss function. As mentioned, the FJ signal
is generated in the nullspace of $\mathbf{T}_{k}$, defined by the third Lambda
function, so the FJ signal is as orthogonal as possible with the legitimate
channel.

##  IV MINE-based MIMO FJ

In the previous section, we proposed the AEFJ method for secure communication,
where the secrecy was optimized based on the E2E learning process with ImCSI.
In this section, we propose a MINE-based FJ method to deal with the scenarios
when even the SCSI is unavailable at the Tx.

###  IV-A MINE-based MIMO Communication

The MINE concept proposed in [23] estimates the MI between two random
variables $X$ and $Y$ without knowing their distribution functions. The
authors in [22] leveraged MINE for channel coding by estimating and maximizing
the MI between the Tx and Rx symbols on the Gaussian single-input-singple-
output (SISO) communication channel. In this work, we introduce the MINE-based
MIMO communication as illustrated in Fig. 5. The encoder and decoder resemble
the AE-based communication.

Figure 5: The MINE-based MIMO channel.

The MI between the channel input and output samples will be estimated and
maximized by optimizing the weights of the encoder. The MI between $X$ and $Y$
can be denoted as follows:

$I(X,Y)=D_{KL}(p_{XY})\parallel p_{X}\otimes p_{Y}),$ (34)

where $D_{KL}$ is Kullback–Leibler divergence between the joint density
$p_{XY}$ and the product of the marginal densities $p_{X}\otimes p_{Y}$. The
Donsker-Varadhan representation [23] can then be applied to represent the KL
divergence as

$D_{KL}(p\parallel q)=\sup_{F_{\Theta}:\Omega\to
R}\mathbb{E}_{p}f-\log\mathbb{E}_{q}e^{f},$ (35)

where the supremum is taken over all function classes $f$ such that the
expectation is finite. Assume $T_{\theta}(X_{n},Y_{n}):X\times
Y\to{\mathbb{R}}$ is a function in the class function $f$, with parameters
$\theta\in\Theta$ in the family function $F_{\Theta}$. The transmit and
receive symbols in one channel instance are denoted by $X_{n}$ and $Y_{n}$.
When $p=p_{XY}$ and $q={p_{X}}\otimes{p_{Y}}$ Then, $D_{KL}(p\parallel
q)=I(X,Y)$ mutual information $I(X,Y)$ is given by

$I(X,Y)\geq\sup_{T_{\theta}\in
F_{\Theta}}\mathbb{E}_{p}T_{\theta}(X_{n},Y_{n})-\log\mathbb{E}_{q}e^{T_{\theta}(X_{n},Y_{n})}.$
(36)

$I(X,Y)$ is estimated by its lower bound $I_{\Theta}(X,Y)$ [23], known as the
statistical MI between $X$ and $Y$ and is given by

$I_{\Theta}(X,Y)=\sup_{\theta\in\Theta}\mathbb{E}_{p_{XY}}T_{\theta}(X_{n},Y_{n})-\log\mathbb{E}_{{p_{X}}\otimes{p_{Y}}}e^{T_{\theta}(X_{n},Y_{n})}.$
(37)

Figure 6: MI estimator. The inputs are the samples of Tx and Rx signals at the
Rx and eavesdropper. The output is the estimated MI on the legitimate and
illegitimate channels.

The estimator $T_{\theta}(X_{n},Y_{n})$ model contains two fully connected
hidden layers with the ReLU activation function and an output node, which is
depicted in Fig. 6. The inputs are the samples of the Tx signals that follow
the joint density $p_{XY}$ or $p_{XZ}$, and marginal densities $p_{X}$,
$p_{Y}$ or $p_{Z}$, respectively. We then approximate the expectations by
using the sample average method. The marginal $p_{X}$ and $p_{Y}$ can be
derived by using the sampled average method, where the samples are shuffled
from the joint distribution in the batch dimension [23]. The estimated
statistical MI between the Tx and the Rx is then can be expressed as follows:

$\displaystyle
I_{\Theta}(X_{n},Y_{n})=\frac{1}{N}\sum_{i=1}^{N}T_{\theta}(\mathbf{x}_{i}^{n},\mathbf{y}_{i}^{n})-\log\frac{1}{N}\sum_{i=1}^{N}e^{T_{\theta}(\mathbf{x}_{i}^{n},\mathbf{\bar{y}}_{i}^{n})},$
(38)

where $\mathbf{x}_{i}^{n}$ and $\mathbf{\bar{y}}_{i}^{n}$ are the elements in
the sets of samples $X_{n}$ and $Y_{n}$, respectively. The optimization
process is performed alternatively between the MINE network and the encoder
with the weights $\theta$ and $\phi$, respectively. This training process also
optimizes the block error rate when the decoder is pre-trained separately from
the encoder, making the training more flexible.

###  IV-B MINE-based MIMO FJ Scheme

The main advantage of MINE is that it can estimate and maximize the MI between
two random variables without the need for joint probability distribution
between them. The goal here is to maximize the MI between the Tx and the Rx,
$I(A,B)$, while minimizing the MI between the Tx and the eavesdropper,
$I(A,E)$. The MINE-based FJ is presented in Algorithm 1. We assume that the
eavesdropper has the full knowledge of CSI.

Algorithm 1 MINE-based MIMO Friendly Jamming

1:At time $k$: Generate $\mathbf{w}_{k}=\mathbf{Z}_{k}\mathbf{v}_{k}$,
orthogonal to $\mathbf{H}_{k}^{\dagger}$

2:Tx transmits $\mathbf{x}_{k}=\mathbf{s}_{k}+\mathbf{w}_{k}$

3:Rx receives $\mathbf{y}_{k}$

4:for i=1 to Iteration do

5: Maximize estimated MI $I_{AB}^{(i)}$

6: Save estimated $I_{AB}^{(i)}$

7: Load $I_{AB}^{(i)}$ as loss value to optimize encoder weights by performing
gradient descent steps

8: Set $i=i+1$

9: if $I_{AB}^{(i+1)}\leq I_{AB}^{(i)}$ then

10: break

11: end if

12:end for

The receive symbol in channel instance $n$ is denoted as $Z_{n}$. Following
(38), the estimated MI between $X_{n}$ and $Z_{n}$ can be expressed as

$\displaystyle
I_{\Theta}(X_{n},Z_{n})=\frac{1}{N}\sum_{i=1}^{N}T_{\theta_{2}}(\mathbf{x}_{i}^{n},\mathbf{z}_{i}^{n})-\log\frac{1}{N}\sum_{i=1}^{N}e^{T_{\theta_{2}}(\mathbf{x}_{i}^{n},\mathbf{\bar{z}}_{i}^{n})},$
(39)

where $\theta_{2}$ is the parameters of the neural estimator at the
eavesdropper. The encoder and MI estimator structures, i.e., $I_{\Theta}$
network, remain unchanged as described in Section IV-A. The MINE-based FJ
scheme will combine the MI estimator and encoder with the injected FJ signals,
as illustrated in Fig. 7. The model takes the input as the sampled signals
$X_{n}$ and $Y_{n}$ to estimate $I_{\Theta}(A,B)$. The value of
$I_{\Theta}(A,B)$ is fed back to the encoder for adjusting the
hyperparameters, weights, and biases. The same process is repeated ultill
$I_{\Theta}(A,B)$ is maximized.

Figure 7: MINE-based FJ.

To fulfill both security and transmission reliability objectives, we introduce
the following novel security loss function:

$L_{\text{MINE}}=\beta
I_{\Theta}(X_{n},Y_{n})+(1-\beta)I_{\Theta}(X_{n},Z_{n}),$ (40)

where $\beta$ is a coefficient that controls the trade-off between
communication rate and security. Then, the loss function can be further
written as follows:

$\displaystyle L_{\text{MINE}}$ $\displaystyle=\frac{\beta}{N}\
\sum\limits_{i=1}^{N}T_{\theta}({\bf{x}}_{i}^{n},{\bf{y}}_{i}^{n})-\beta\log\frac{1}{N}\sum\limits_{i=1}^{N}e^{{T_{\theta}}({\bf{x}}_{i}^{n},{\bf{\bar{y}}}_{i}^{n})}$
$\displaystyle-\frac{{1-\beta}}{N}$
$\displaystyle\sum\limits_{i=1}^{N}T_{\theta}({\bf{x}}_{i}^{n},{\rm{\bar{z}}}_{i}^{n})+(1-\beta)\log\frac{1}{N}\sum\limits_{i=1}^{N}e^{{T_{\theta}}({\bf{x}}_{i}^{n},{\rm{\bar{z}}}_{i}^{n})}.$
(41)

Furthermore, we consider the worst case when the noise power at the
eavesdropper $\sigma_{e}^{2}=0$ [9]. Then, the covariance of noise at Eve in
(3) becomes
${\mathbf{K}}_{k}^{\prime}=(\mathbf{G}_{k}\mathbf{Z}_{k}\mathbf{Z}_{k}^{\dagger}\mathbf{G}_{k}^{\dagger})\sigma_{v}^{2}$.
To simplify the notation, all occurrences of $R_{k}^{s}$ will be understood as
representing GSC from this point forward. Then, the guaranteed secrecy rate
(GSC) is given by

$\displaystyle R_{k}^{s}$
$\displaystyle={I_{\Theta}}({X_{n}},{Y_{n}})-R_{AEmax}$
$\displaystyle={I_{\Theta}}({X_{n}},{Y_{n}})-\log\frac{\det(\mathbf{K^{\prime}}_{k}+\mathbf{G}_{k}^{\dagger}\mathbf{Q}_{s}\mathbf{G}_{k})}{\det\mathbf{K^{\prime}}_{k}}.$
(42)

That optimization problem can be resolved by performing SVD on
$\mathbf{H}_{k}$ and the second-order perturbation analysis [17]. However,
this method requires exponential complexity when the number of antennas
increases. Thus, we leverage the non-convex optimization capability provided
by deep neural networks and then directly solve the problem with sufficient
training data by considering the CSI error as an input for the training
process.

##  V Simulation Results and Discussion

###  V-A Simulation Setups and Parameters

In this section, we use the Montecarlo method to evaluate the effectiveness of
the proposed approaches. The secrecy rate is averaged over $10^{6}$
iterations. The channels $\mathbf{H}_{k}$ and $\mathbf{G}_{k}$ are generated
as complex Gaussian matrix [30], where $h_{i,j}$ and $g_{i,j}$ are assumed to
be i.i.d. Gaussian with $\mathbb{E}|h|_{i,j}^{2}=\mathbb{E}|g|_{i,j}^{2}=1$.
The real and imaginary parts of the entries in the channel matrices
${\mathbf{H}}_{k}$ and ${\mathbf{G}}_{k}$ are standard Gaussian i.i.d.. We
generate a complex-valued channel matrix where the real and imaginary parts
are normally distributed. This results in a Rayleigh-distributed channel
matrix magnitude commonly used to model fading in wireless communication
channels. The phase of the channel follows a uniform distribution from $0$ to
$2\pi$. The total power $P_{\max}$ is normalized by the power of AWGN noise
$\sigma_{n}^{2}=\sigma_{e}^{2}=1$. The SNR values in the training are set to
vary from $10$ dB to $25$ dB, guaranteeing the generality of the trained
model. For analysis, the eavesdropper is assumed to have the same neural
architecture decoder as the Rx, as in Fig. 3. The AE at the Tx-Rx channel
inducing FJ and the network at the eavesdropper are trained simultaneously as
a one-input-two-output network with the loss function in (33).

To see the advantages of the proposed method, we compare our method with two
baselines proposed in [9] and [17]. The former first uses multiplexing as the
precoding technique and then adopts executive search to optimize the average
secrecy rate $R_{kex}^{s}$. Differently, the latter is based on the
perturbation/error second-order analysis, called “So”, to optimize the average
secrecy rate $R_{kSo}^{s}$. Further, we use the state-of-the-art DL library
Tensor Flow with Adam Optimizer for training. The input and output layers have
$16$ neurons, representing a symbol of $4$ bits. The channel layer includes
$N_{t}$ neuron width representing the number of transmit antennas. The network
architecture and its parameters are summarized in Table I.

TABLE I: Architecture and Parameters of LCD-FJ Model Layer (type), number of nodes |  Output shape |  # parameters
---|---|---
imperfect_CSI (InputLayer) |  [(None, 1, 2, 64)] |  0
batch_normalization_24 (BatchNormalization) |  (None, 1, 2, 64) |  256
flatten_8 (Flatten) |  (None, 128) |  0
batch_normalization_25 (BatchNormalization) |  (None, 128) |  512
dense_24 (Dense) |  (None, 256) |  33,024
batch_normalization_26 (BatchNormalization) |  (None, 256) |  1,024
dense_25 (Dense) |  (None, 128) |  32,896
dense_26 (Dense) |  (None, 64) |  8,256
perfect_CSI (InputLayer) |  [(None, 64)] |  0
lambda_16 (Lambda) |  (None, 64) |  0
SNR_input (InputLayer) |  [(None, 1)] |  0
lambda_17 (Lambda) |  (None, 1) |  0

###  V-B Experimental Results

We first implement the AE-based FJ model in the case of perfect CSI and
compare its performance with that of the exhaustive search method in [9], as
shown in Fig. 8. In the AEFJ method, the channel matrix is considered an extra
input parameter at the encoder and decoder in the AEFJ model. The parameter
$\alpha$ was chosen as $0.5$ to make the balance between transmission and
capacity. We consider two different values of the number of antennas at the
Tx; $N_{t}=10,20$. As can be seen, the average secrecy rate of the proposed
AEFJ method is close to that of the optimal scheme, i.e., the exhaustive
search [9]), when the number of antennas at the Tx is small, $N_{t}=4$,
confirming the effectiveness of the proposed AEFJ scheme. This can be
explained by the capability of the AE to learn the features of channel
distribution with sufficient data and perfect CSI.

Figure 8: Average secrecy rate versus $P_{\max}/\sigma_{n}^{2}$ under ImCSI.

Regarding BLER, Fig. 9 shows the BLER of the proposed method at the Rx and the
eavesdropper. By assuming that the eavesdropper and the Rx have the same
model, we can see that the BLER at the eavesdropper’s decoder is much higher
than the Rx’s. Although the BLER of the proposed method is higher than that of
the ML-based method, the former provides much less computational complexity
than the latter.

Figure 9: BLER at Rx and eavesdropper with FJ; ${\mathbf{H}}_{k}$ perfectly
known.

Figure 10: Average secrecy rate versus $P/{\sigma_{n}}^{2}$ (dB).

Regarding ImCSI, our target is to compare the average secrecy rate achieved by
our method with the work [17], where full CSI is unavailable at the Tx. The
parameter $\sigma_{e}=-20$ dB or $0.1$ represents the level of perturbation or
channel estimation error. The security communication model is illustrated in
Table II.

TABLE II: Architechture and Parameters of AEFJ with SCSI Encoder |  Encode a message $m_{k}$ to $s_{k}$
---|---
LCD FJ |  $w_{k}$ orthogonal to $s_{k}$
Power constraints/norm |  Normalize average power
Channel |  Generate random complex channel $H_{k}$
Lambda |  Matrix multiplication $x_{k}$ with $H_{k}$
Dense |  Simulate Tx-Rx channel, estimating mapping function $Q(x_{k},\tilde{H}_{k})$
Softmax function |  Calculate loss to optimize tMI

As shown in Fig. 10, the proposed AEFJ scheme offered a better average secrecy
rate than So based-method [17]. We note that the secrecy rate increased
linearly at the low SNR region but tended to be saturated at high normalized
transmit power, i.e., from $10$ dB to $25$ dB. In addition, the higher secrecy
rate can be seen in the MINE-based method compared to AEFJ [33]. The reason is
the former optimizes the MI directly while the latter depends on the cross
entropy loss. Moreover, the higher the number of transmit antennas, the higher
the secrecy rate for both schemes. This stems from the fact that the proposed
AE architecture can effectively perform denoising and capturing features of
the channel with sufficient data. The MINE security loss function (41) is used
to evaluate the performance of the security approach. The network architecture
of the MINE-FJ scheme is shown in Table III.

TABLE III: Description of function layers in AEFJ with ImCSI Input |  Concatenate $x_{k}$ and $\tilde{H}_{k}$, converted to real domain from complex domain
---|---
Power constraints/norm |  Normalize average power
Channel |  Generate imperfect complex channel $\tilde{H}_{k}$
Lambda |  Matrix multiplication $x_{k}$ with $\tilde{H}_{k}$
Hidden |  Simulate Tx-Rx channel, estimating mapping function: $Q(x_{k},\tilde{H}_{k})$
Output Layer |  $\hat{x}_{k}$, and the activation function is soft-max for a reconstruction problem
Optimizer |  Adam optimizer
Loss Function |  Equation (18)

Fig. 11 illustrates the secrecy rate with two different values of $\beta$,
where the number of transmit antennas is $N_{t}=3$, each with $400$ iterations
and the batch size of $20,000$. We observe that the higher the value of
$\beta$, the higher the secrecy rate was obtained. This shows the trade-off
between the communication and secrecy rates due to the influence of the FJ
signal. Fig. 12 shows BLER at both the Rx and the eavesdropper in a range of
SNR values before and after a secure communication was applied by AEFJ. The
black curves represent BLER at Rx when using MINE-based FJ with and without
FJ. The red curves represent BLER at Rx when using AE-based FJ with and
without FJ, whereas the blue curve illustrates the BLER at the eavesdropper.
We notice two important points. Firstly, the BLER at Rx increased, with the
gap of 3dB at $10^{-4}$ of BLER. It can be explained that a portion of power
is allocated for jamming. Secondly, there was a significant increase in the
BLER at the eavesdropper using AEFJ. The higher BLER at the eavesdropper is
because of the effect of FJ signals on the eavesdropper channel, which makes
the information signals undecodable at the eavesdropper.

Figure 11: Average secrecy rate with different values of $\beta$.

Figure 12: BLER at Rx and eavesdropper with AEFJ and MINE-FJ.

Figure 13: Secrecy rate vs. number of iterations; $N_{t}=10$, $N_{r}=4$ and
$N_{e}=4$.

In Fig. 13, the convergence of MINE-FJ is provided with different SNR levels
using the security model in Fig. 7. It can be seen that the MINE approach
quickly converged to a stationary point after about $100$ iterations. In
addition, the secrecy rate improved dramatically when the SNR increased but
tended to saturate for a sufficiently high SNR. This saturation can be
explained as when the distribution of the transmit is close to receiving
samples.

The relationship between the average secrecy rate and the number of transmit
antennas is provided in Fig. 14. It shows that the average secrecy rate
increased rapidly with the number of antennas $N_{t}$. This is attributed to
the fact that the higher the number of transmit antennas at the Tx, the more
the degree of freedom can be added to the system to transmit the desired
signal and design the FJ signal more effectively.

Figure 14: Secrecy rates vs. $N_{t}$.

In Fig. 15, we show a trade-off between the secrecy rate and BLER with and
without using FJ. As expected, the higher the BLER, the lower the average
secrecy rate is obtained.

Figure 15: Average secrecy rate and BLER at Rx; $N_{t}=10$, $N_{r}=4$ and
$N_{e}=4$.

###  V-C Complexity

This subsection compares the computational complexity as the number of
floating-point operations (FLOPs) between AEFJ and the conventional methods.
Herein, we only counted the complexity in the deployment stage since the
training stage can be seen as offline. The number of FLOPs of a dense layer is
referred to in the work in [34], which is equal to $(2N_{Input}-1)N_{Output}$,
where $N_{Input}$ and $N_{Output}$ are the input and output dimensions,
respectively. For example, when $N_{t}=20$ and the transmit symbol is encoded
into a one-hot vector and considering the architecture of our model in Table
IV, the FLOPs is $6,144$. For the exhausting search and “So” method mentioned
previously, the asymptotic computational complexity is in the order of
$\mathcal{O}(N_{t}^{3})$ as they perform SVD and matrix inversion.

TABLE IV: Parameters and FLOP of AEFJ. Name of Layers |  Input and Output Dimensions |  FLOPs
---|---|---
Input Layer |  16; 64 |  2,048
Dense Layer 2 |  64; 8 |  1,024
Dense Layer 3 |  8; 64 |  1,024
Output layer |  64; 16 |  2,048

##  VI Conclusion

In this paper, we have introduced a novel DL-based FJ approach to deal with
the eavesdropping issues in MIMO-based systems. First, we have proposed the
AEFJ scheme by leveraging the E2E learning at both the Tx and the Rx, which
has shown to achieve both communication secrecy and reliability compared to
the conventional methods. In addition, we have leveraged MINE to design a
robust security scheme without SCSI at Tx. Simulation results have showed the
comparable security performance of MINE to AEFJ under the cross-entropy
security loss function. Further, the secrecy rate was optimized independently
at the Tx and the Rx using the MI neural estimator. Thus, the MINE-based FJ is
promising for applications that require fast deployment and lightweight but
effective security methods. This can be seen as a lightweight solution since
the training process is not heavily based on channel estimation and capturing
the symbol but does not require the demodulation and decoding steps.

## References

  * [1] A. Mukherjee, S. A. A. Fakoorian, J. Huang, and A. L. Swindlehurst, “Principles of physical layer security in multiuser wireless networks: A survey,” _IEEE Commun. Surv. Tutor_ , vol. 16, no. 3, pp. 1550–1573, 2014.
  * [2] Y. Zhang, Y. Shen, H. Wang, J. Yong, and X. Jiang, “On secure wireless communications for iot under eavesdropper collusion,” _IEEE Transactions on Automation Science and Engineering_ , vol. 13, no. 3, pp. 1281–1293, 2015.
  * [3] N. H. Chu, N. Van Huynh, D. N. Nguyen, D. T. Hoang, S. Gong, T. Shu, E. Dutkiewicz, and K. T. Phan, “Countering eavesdroppers with meta-learning-based cooperative ambient backscatter communications,” _arXiv preprint arXiv:2308.02242_ , 2023.
  * [4] D. J. Bernstein and T. Lange, “Post-quantum cryptography,” _Nature_ , vol. 549, no. 7671, pp. 188–194, 2017.
  * [5] M. Bloch, J. Barros, M. R. Rodrigues, and S. W. McLaughlin, “Wireless information-theoretic security,” _IEEE Trans. Inf. Theory_ , vol. 54, no. 6, pp. 2515–2534, 2008.
  * [6] C. E. Shannon, “Communication theory of secrecy systems,” _The Bell System Technical Journal_ , vol. 28, no. 4, pp. 656–715, 1949.
  * [7] A. D. Wyner, “The wire-tap channel,” _Bell System Technical Journal_ , vol. 54, no. 8, pp. 1355–1387, 1975.
  * [8] J. M. Hamamreh, H. M. Furqan, and H. Arslan, “Classifications and applications of physical layer security techniques for confidentiality: A comprehensive survey,” _IEEE Commun. Surv. Tutor_ , vol. 21, no. 2, pp. 1773–1828, 2018.
  * [9] S. Goel and R. Negi, “Guaranteeing secrecy using artificial noise,” _IEEE Trans. Wireless Commun_ , vol. 7, no. 6, pp. 2180–2189, 2008.
  * [10] B. Akgun, O. O. Koyluoglu, and M. Krunz, “Exploiting full-duplex receivers for achieving secret communications in multiuser MISO networks,” _IEEE Trans. Commun._ , vol. 65, no. 2, pp. 956–968, 2016.
  * [11] P. Siyari, M. Krunz, and D. N. Nguyen, “Friendly jamming in a mimo wiretap interference network: A nonconvex game approach,” _J. Sel. Areas Commun._ , vol. 35, no. 3, pp. 601–614, 2017.
  * [12] J. Choi, “A robust beamforming approach to guarantee instantaneous secrecy rate,” _IEEE Trans. Wireless Commun_ , vol. 15, no. 2, pp. 1076–1085, 2015.
  * [13] D. N. Nguyen and M. Krunz, “Spectrum management and power allocation in mimo cognitive networks,” in _2012 Proceedings IEEE INFOCOM_ , 2012, pp. 2023–2031.
  * [14] ——, “Price-based joint beamforming and spectrum management in multi-antenna cognitive radio networks,” _IEEE Journal on Selected Areas in Communications_ , vol. 30, no. 11, pp. 2295–2305, 2012.
  * [15] T. X. Vu, S. Chatzinotas, V.-D. Nguyen, D. T. Hoang, D. N. Nguyen, M. D. Renzo, and B. Ottersten, “Machine learning-enabled joint antenna selection and precoding design: From offline complexity to online performance,” _IEEE Transactions on Wireless Communications_ , vol. 20, no. 6, pp. 3710–3722, 2021.
  * [16] A. Mukherjee, “Physical-layer security in the internet of things: Sensing and communication confidentiality under resource constraints,” _Proceedings of the IEEE_ , vol. 103, no. 10, pp. 1747–1761, 2015.
  * [17] A. Mukherjee and A. L. Swindlehurst, “Robust beamforming for security in mimo wiretap channels with imperfect csi,” _IEEE Trans. Signal Process._ , vol. 59, no. 1, pp. 351–361, 2010.
  * [18] M. Pei, J. Wei, K.-K. Wong, and X. Wang, “Masked beamforming for multiuser mimo wiretap channels with imperfect csi,” _IEEE Trans. Wireless Commun_ , vol. 11, no. 2, pp. 544–549, 2012.
  * [19] J. B. Perazzone, P. L. Yu, B. M. Sadler, and R. S. Blum, “Artificial noise-aided mimo physical layer authentication with imperfect csi,” _IEEE Transactions on Information Forensics and Security_ , vol. 16, pp. 2173–2185, 2021.
  * [20] T. Erpek, T. J. O’Shea, and T. C. Clancy, “Learning a physical layer scheme for the mimo interference channel,” in _2018 IEEE International Conference on Communications (ICC)_. IEEE, 2018, pp. 1–5.
  * [21] T. J. O’Shea, T. Erpek, and T. C. Clancy, “Deep learning based MIMO communications,” _arXiv preprint arXiv:1707.07980_ , 2017.
  * [22] R. Fritschek, R. F. Schaefer, and G. Wunder, “Deep learning for the gaussian wiretap channel,” in _ICC 2019-2019 IEEE International Conference on Communications (ICC)_. IEEE, 2019, pp. 1–6.
  * [23] M. I. Belghazi, A. Baratin, S. Rajeshwar, S. Ozair, Y. Bengio, A. Courville, and D. Hjelm, “Mutual information neural estimation,” in _Proceedings of the 35th International Conference on Machine Learning_ , ser. Proceedings of Machine Learning Research, J. Dy and A. Krause, Eds., vol. 80. PMLR, 10–15 Jul 2018, pp. 531–540. [Online]. Available: https://proceedings.mlr.press/v80/belghazi18a.html
  * [24] N. A. Letizia and A. M. Tonello, “Capacity-driven autoencoders for communications,” _IEEE Open Journal of the Communications Society_ , vol. 2, pp. 1366–1378, 2021.
  * [25] T. Lin and Y. Zhu, “Beamforming design for large-scale antenna arrays using deep learning,” _IEEE Wireless Communications Letters_ , vol. 9, no. 1, pp. 103–107, 2019.
  * [26] R. Fritschek, R. F. Schaefer, and G. Wunder, “Deep learning for channel coding via neural mutual information estimation,” _arXiv preprint arXiv:1903.02865_ , 2019.
  * [27] C. Wang, E. K. S. Au, R. D. Murch, W. H. Mow, R. S. Cheng, and V. Lau, “On the performance of the mimo zero-forcing receiver in the presence of channel estimation error,” _IEEE Trans. Wireless Commun_ , vol. 6, no. 3, pp. 805–810, 2007.
  * [28] T. O’Shea and J. Hoydis, “An introduction to deep learning for the physical layer,” _IEEE Trans. Cogn. Commun. Netw._ , vol. 3, no. 4, pp. 563–575, 2017.
  * [29] Y. Bengio, I. Goodfellow, and A. Courville, _Deep learning_. MIT Proess, 2017, vol. 1.
  * [30] E. Telatar, “Capacity of multi-antenna gaussian channels,” _Eur. Trans. Telecommun._ , vol. 10, no. 6, pp. 585–595, 1999.
  * [31] D. B. F. Agakov, “The im algorithm: a variational approach to information maximization,” 2004.
  * [32] D. McAllester and K. Stratos, “Formal limitations on the measurement of mutual information,” in _Procee. of the Twenty Third International Conference on Artificial Intelligence and Statistics_ , ser. Proceedings of Machine Learning Research, S. Chiappa and R. Calandra, Eds., vol. 108. PMLR, 26–28 Aug 2020, pp. 875–884.
  * [33] F. Mirkarimi, S. Rini, and N. Farsad, “Benchmarking neural capacity estimation: Viability and reliability,” _IEEE Trans Commun_ , vol. 71, no. 5, pp. 2654–2669, 2023.
  * [34] A. Mohammad, C. Masouros, and Y. Andreopoulos, “Complexity-scalable neural-network-based mimo detection with learnable weight scaling,” _IEEE Trans Commun_ , vol. 68, no. 10, pp. 6101–6113, 2020.