On the Adversarial Vulnerability of Neural Receivers with Unrolled LDPC Decoders
Abstract
Neural receivers for 5G New Radio (NR) match classical model-based receivers in link-level performance, but their robustness to adversarial perturbations at the receiver input remains underexplored. We show that standard gradient-based attacks applied end-to-end through an unrolled low-density parity-check (LDPC) decoder fail to significantly outperform a matched-power Gaussian perturbation. We identify the failure as gradient masking caused by tanh saturation in the boxplus operation of the belief-propagation (BP) check-node update, with a per-iteration gradient norm decay of more than four orders of magnitude across ten unrolled BP iterations. Based on this finding, we propose two structurally independent loss functions that restore attack efficacy. L_BP routes the gradient through the unsaturated early iterations via per-iteration supervision, while L_LLR is a margin loss on pre-decoder log-likelihood ratios (LLRs) whose gradient bypasses the LDPC decoder entirely. Both loss functions increase the block-error rate (BLER) by one to four orders of magnitude at matched perturbation power, with the results reproduced on both the Sionna NeuralReceiver and DeepRx. At low PSR, L_LLR-optimized perturbations achieve up to three orders of magnitude higher BLER on unseen channel realizations than LBP-optimized perturbations.
Related
- Unrolled gradients in disguise: bridging interpolation-based and Jacobian regularization for stable neural dynamics
- Weak adversarial tensor neural network for high-dimensional Fokker-Planck equations
- Jacobian-Free Unrolling: memory efficient unrolled network for 3D SPECT Reconstruction
- Deeply unrolled alternating projections for phase retrieval
- EGGROLL, Unrolled: Understanding and Improving Low-Rank Evolution Strategies at Scale
BibTeX
@misc{saini2026adversarial,
title = {{On the Adversarial Vulnerability of Neural Receivers with Unrolled LDPC Decoders}},
author = {Aakash Saini and Jafar Aco Mohammadi and Wolfgang Gerstacker},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2610.30345},
eprint = {2610.30345},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2610.30345},
note = {CC BY-SA 4.0},
}
RIS
TY - UNPB
TI - On the Adversarial Vulnerability of Neural Receivers with Unrolled LDPC Decoders
AU - Aakash Saini
AU - Jafar Aco Mohammadi
AU - Wolfgang Gerstacker
PY - 2026
DA - 2026/10/21
PB - arXiv
DO - 10.48550/arxiv.2610.30345
UR - https://arxiv.org/abs/2610.30345
AB - Neural receivers for 5G New Radio (NR) match classical model-based receivers in link-level performance, but their robustness to adversarial perturbations at the receiver input remains underexplored. We show that standard gradient-based attacks applied end-to-end through an unrolled low-density parity-check (LDPC) decoder fail to significantly outperform a matched-power Gaussian perturbation. We identify the failure as gradient masking caused by tanh saturation in the boxplus operation of the belief-propagation (BP) check-node update, with a per-iteration gradient norm decay of more than four orders of magnitude across ten unrolled BP iterations. Based on this finding, we propose two structurally independent loss functions that restore attack efficacy. L_BP routes the gradient through the unsaturated early iterations via per-iteration supervision, while L_LLR is a margin loss on pre-decoder log-likelihood ratios (LLRs) whose gradient bypasses the LDPC decoder entirely. Both loss functions increase the block-error rate (BLER) by one to four orders of magnitude at matched perturbation power, with the results reproduced on both the Sionna NeuralReceiver and DeepRx. At low PSR, L_LLR-optimized perturbations achieve up to three orders of magnitude higher BLER on unseen channel realizations than LBP-optimized perturbations.
ER -