Adversarial Examples Against WiFi Fingerprint-Based Localization in the Physical World
Pages 8457 - 8471
Abstract
WiFi Fingerprint-based Localization (WFL) has recently achieved promising results in the bloom of deep learning techniques. Unfortunately, current studies reveal the great risks of deep-learning models when facing adversarial attacks, raising broader concerns about Deep-learning-based WiFi Fingerprint Localization Models (DFLMs). However, real-world adversarial attacks targeting DFLMs are not fully investigated, making it unclear how to counter this potential threat. In this paper, we take the first step to introduce adversarial examples into the physical world against DFLMs. Specifically, we propose a general attack method named Phy-Adv, consisting of a physical attenuation loss and a differentiable simulation module, the generated adversarial noise could be feasibly produced in the real world and make effects on DFLMs, i.e., misleading the DFLMs from the signal source end. Furthermore, aiming at countering this typical adversarial threat, we propose a Relaxant Multiple Batch Normalization (RMBN) approach, which alleviates the weak robustness of DFLMs by the data-end adaptive training-set segmenting and model-end multiple batch normalization designing. To demonstrate the de facto effectiveness of the proposed physical adversarial examples and the adversarial defense strategy, we conducted extensive experiments on 2 datasets, i.e., BHD and TUT, and multiple deep models, e.g., AlexNet, VGG, and ResNet. The experimental results strongly support that our Phy-Adv shows satisfactory adversarial attacking ability in the physical world, meanwhile, the RMBN enjoys considerable defense ability against the adversarial attacks.
References
[1]
C.-W. Ang, “Vehicle positioning using WiFi fingerprinting in urban environment,” in Proc. IEEE 4th World Forum Internet Things (WF-IoT), Feb. 2018, pp. 652–657.
[2]
K. Liu et al., “Towards robust WiFi fingerprint-based vehicle tracking in dynamic indoor parking environments: An online learning framework,” IEEE Trans. Mobile Comput., vol. 22, no. 12, pp. 6970–6984, Dec. 2023.
[3]
X. Zhu, W. Qu, X. Zhou, L. Zhao, Z. Ning, and T. Qiu, “Intelligent fingerprint-based localization scheme using CSI images for Internet of Things,” IEEE Trans. Netw. Sci. Eng., vol. 9, no. 4, pp. 2378–2391, Jul. 2022.
[4]
K. Lin, W. Wang, Y. Bi, M. Qiu, and M. M. Hassan, “Human localization based on inertial sensors and fingerprints in the industrial Internet of Things,” Comput. Netw., vol. 101, pp. 113–126, Jun. 2016.
[5]
H. Zheng and H. Hu, “MISSILE: A system of mobile inertial sensor-based sensitive indoor location eavesdropping,” IEEE Trans. Inf. Forensics Security, vol. 15, pp. 3137–3151, 2020.
[6]
S. N. Eshun and P. Palmieri, “A cryptographic protocol for efficient mutual location privacy through outsourcing in indoor Wi-Fi localization,” IEEE Trans. Inf. Forensics Security, vol. 19, pp. 4086–4099, 2024.
[7]
M. Barbi, C. Garcia-Pardo, A. Nevarez, V. P. Beltran, and N. Cardona, “UWB RSS-based localization for capsule endoscopy using a multilayer phantom and in vivo measurements,” IEEE Trans. Antennas Propag., vol. 67, no. 8, pp. 5035–5043, Aug. 2019.
[8]
Q. Ye et al., “SE-loc: Security-enhanced indoor localization with semi-supervised deep learning,” IEEE Trans. Netw. Sci. Eng., vol. 10, no. 5, pp. 2964–2977, Sep./Oct. 2023.
[9]
Q. Xu, Y. Chen, B. Wang, and K. J. R. Liu, “Radio biometrics: Human recognition through a wall,” IEEE Trans. Inf. Forensics Security, vol. 12, no. 5, pp. 1141–1155, May 2017.
[10]
D. Avola, M. Cascio, L. Cinque, A. Fagioli, and C. Petrioli, “Person re-identification through Wi-Fi extracted radio biometric signatures,” IEEE Trans. Inf. Forensics Security, vol. 17, pp. 1145–1158, 2022.
[11]
Y. Yu et al., “A novel 3-D indoor localization algorithm based on BLE and multiple sensors,” IEEE Internet Things J., vol. 8, no. 11, pp. 9359–9372, Jun. 2021.
[12]
A. Sellami, L. Nasraoui, and L. Najjar, “Analysis of localization performance in mm-wave 5G network under channel uncertainties,” IEEE Internet Things J., vol. 10, no. 7, pp. 6523–6524, Apr. 2023.
[13]
Y. Tao, B. Huang, R. Yan, L. Zhao, and W. Wang, “CBWF: A lightweight Circular-Boundary-Based WiFi fingerprinting localization system,” IEEE Internet Things J., vol. 11, no. 7, pp. 11508–11523, Apr. 2024.
[14]
P. Bahl and V. N. Padmanabhan, “RADAR: An in-building RF-based user location and tracking system,” in Proc. IEEE Conf. Comput. Commun. 19th Annu. Joint Conf. IEEE Comput. Commun. Societies (INFOCOM), vol. 2, Mar. 2000, pp. 775–784.
[15]
M. Youssef and A. Agrawala, “The Horus WLAN location determination system,” in Proc. 3rd Int. Conf. Mobile Syst., Appl., Services, 2005, pp. 205–218.
[16]
B. Jia, Z. Zong, B. Huang, and T. Baker, “A DNN-based WiFi-RSSI indoor localization method in IoT,” in Communications and Networking, 2021.
[17]
L. Wang, Y. Shao, and X. Guo, “An adaptive localization approach based on deep adaptation networks,” in Proc. Int. Conf. Control, Autom. Inf. Sci. (ICCAIS), Oct. 2019, pp. 1–5.
[18]
Z. Yin, X. Zhang, Z. Song, and Z. Ge, “Adversarial learning from imbalanced data: A robust industrial fault classification method,” IEEE Trans. Inf. Forensics Security, vol. 19, pp. 1870–1882, 2024.
[19]
X. Wang, X. Wang, S. Mao, J. Zhang, S. C. G. Periaswamy, and J. Patton, “Adversarial deep learning for indoor localization with channel state information tensors,” IEEE Internet Things J., vol. 9, no. 19, pp. 18182–18194, Oct. 2022.
[20]
M. Chen, L. Lu, J. Yu, Z. Ba, F. Lin, and K. Ren, “AdvReverb: Rethinking the stealthiness of audio adversarial examples to human perception,” IEEE Trans. Inf. Forensics Security, vol. 19, pp. 1948–1962, 2024.
[21]
S. Fang and M. C. Stamm, “Attacking image splicing detection and localization algorithms using synthetic traces,” IEEE Trans. Inf. Forensics Security, vol. 19, pp. 2143–2156, 2024.
[22]
X. Hu et al., “FastTextDodger: Decision-based adversarial attack against black-box NLP models with extremely high efficiency,” IEEE Trans. Inf. Forensics Security, vol. 19, pp. 2398–2411, 2024.
[23]
A. Liu et al., “X-adv: Physical adversarial object attacks against X-ray prohibited item detection,” in Proc. 32nd USENIX Secur. Symp. (USENIX Secur.), Anaheim, CA, USA, J. A. Calandrino and C. Troncoso, Eds., Aug. 2023, pp. 3781–3798.
[24]
H. Wang et al., “Transferable multimodal attack on vision-language pre-training models,” in Proc. IEEE Symp. Secur. Privacy (SP), Jun. 2024, p. 102.
[25]
Z. Li, Z. Xiao, Y. Zhu, I. Pattarachanyakul, B. Y. Zhao, and H. Zheng, “Adversarial localization against wireless cameras,” in Proc. 19th Int. Workshop Mobile Comput. Syst. Appl., Feb. 2018, pp. 87–92.
[26]
T. Li, Y. Chen, R. Zhang, Y. Zhang, and T. Hedgpeth, “Secure crowdsourced indoor positioning systems,” in Proc. IEEE Conf. Comput. Commun. (INFOCOM), Apr. 2018, pp. 1034–1042.
[27]
M. Patil, X. Wang, X. Wang, and S. Mao, “Adversarial attacks on deep learning-based floor classification and indoor localization,” in Proc. 3rd ACM Workshop Wireless Secur. Mach. Learn., 2021, pp. 7–12.
[28]
X. Zhang, J. Bao, F. He, J. Gai, F. Tian, and H. Huang, “A fingerprint indoor localization method against adversarial sample attacks,” J. Beijing Univ. Aeronaut. Astronaut., vol. 48, no. 11, pp. 2087–2101, 2022.
[29]
X. Wang, L. Gao, S. Mao, and S. Pandey, “CSI-based fingerprinting for indoor localization: A deep learning approach,” IEEE Trans. Veh. Technol., vol. 66, no. 1, pp. 763–776, Jan. 2017.
[30]
B. Huang, Z. Xu, B. Jia, and G. Mao, “An online radio map update scheme for WiFi fingerprint-based localization,” IEEE Internet Things J., vol. 6, no. 4, pp. 6909–6918, Aug. 2019.
[31]
C. Wu, Z. Yang, Z. Zhou, Y. Liu, and M. Liu, “Mitigating large errors in WiFi-based indoor localization for smartphones,” IEEE Trans. Veh. Technol., vol. 66, no. 7, pp. 6246–6257, Jul. 2017.
[32]
F. He, C. Wu, X. Zhou, and Y. Zhao, “Robust and fast similarity search for fingerprint calibrations-free indoor localization,” in Proc. 3rd Int. Conf. Big Data Comput. Commun. (BIGCOM), Aug. 2017, pp. 320–327.
[33]
Y. Tao and L. Zhao, “Fingerprint localization with adaptive area search,” IEEE Commun. Lett., vol. 24, no. 7, pp. 1446–1450, Jul. 2020.
[34]
Z. Xu, B. Huang, B. Jia, and G. Mao, “Enhancing WiFi fingerprinting localization through a co-teaching approach using crowdsourced sequential RSS and IMU data,” IEEE Internet Things J., vol. 11, no. 2, pp. 3550–3562, Jan. 2024.
[35]
Z. Chen, H. Zou, J. Yang, H. Jiang, and L. Xie, “WiFi fingerprinting indoor localization using local feature-based deep LSTM,” IEEE Syst. J., vol. 14, no. 2, pp. 3001–3010, Jun. 2020.
[36]
N. Hernández et al., “WiFiNet: WiFi-based indoor localisation using CNNs,” Expert Syst. Appl., vol. 177, Sep. 2021, Art. no.
[37]
K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2016, pp. 770–778.
[38]
L. Li, X. Guo, Y. Zhang, N. Ansari, and H. Li, “Long short-term indoor positioning system via evolving knowledge transfer,” IEEE Trans. Wireless Commun., vol. 21, no. 7, pp. 5556–5572, Jul. 2022.
[39]
M. Abbas, M. Elhamshary, H. Rizk, M. Torki, and M. Youssef, “WiDeep: WiFi-based accurate and robust indoor localization system using deep learning,” in Proc. IEEE Int. Conf. Pervasive Comput. Commun. (PerCom), Mar. 2019, pp. 1–10.
[40]
C. Szegedy et al., “Intriguing properties of neural networks,” 2013, arXiv:1312.6199.
[41]
T. B. Brown, D. Mané, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,” Dec. 2017, arXiv:1712.09665.
[42]
G. Elsayed et al., “Adversarial examples that fool both computer vision and time-limited humans,” in Proc. NeurIPS, Dec. 2018, pp. 1–11.
[43]
A. Liu, J. Wang, X. Liu, C. Zhang, B. Cao, and H. Yu, “Bias-based universal adversarial patch attack for automatic check-out,” in Proc. ECCV, May 2020, pp. 395–410.
[44]
A. Liu et al., “Perceptual-sensitive GAN for generating adversarial patches,” in Proc. AAAI, Jan. 2019, pp. 1–8.
[45]
M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Proc. CCS, Oct. 2016, pp. 1528–1540.
[46]
Y. Zhang, H. Foroosh, P. David, and B. Gong, “CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild,” in Proc. ICLR, May 2019, pp. 1–20.
[47]
L. Huang et al., “Universal physical camouflage attacks on object detectors,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2020, pp. 717–726.
[48]
D. Wang et al., “Daedalus: Breaking nonmaximum suppression in object detection via adversarial examples,” IEEE Trans. Cybern., vol. 52, no. 8, pp. 7427–7440, Aug. 2022.
[49]
N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proc. ACM Asia Conf. Comput. Commun. Secur., Apr. 2017, pp. 506–519.
[50]
J. Wang, A. Liu, Z. Yin, S. Liu, S. Tang, and X. Liu, “Dual attention suppression attack: Generate adversarial camouflage in physical world,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2021, pp. 8565–8574.
[51]
H. Wei et al., “Hotcold block: Fooling thermal infrared detectors with a novel wearable design,” in Proc. AAAI Conf. Artif. Intell., 2023, pp. 1–9.
[52]
J. Wang, Z. Chen, Z. Yin, Q. Yang, and X. Liu, “Phonemic adversarial attack against audio recognition in real world,” 2022, arXiv:2211.10661.
[53]
Z. Wang, X. Shu, Y. Wang, Y. Feng, L. Zhang, and Z. Yi, “A feature space-restricted attention attack on medical deep learning systems,” IEEE Trans. Cybern., vol. 53, no. 8, pp. 5323–5335, Aug. 2023.
[54]
A. Zolfi, S. Avidan, Y. Elovici, and A. Shabtai, “Adversarial mask: Real-world universal adversarial attack on face recognition models,” in Proc. Joint Eur. Conf. Mach. Learn. Knowl. Discovery Databases. Springer, 2022, pp. 304–320.
[55]
T. Wu, X. Wang, S. Qiao, X. Xian, Y. Liu, and L. Zhang, “Small perturbations are enough: Adversarial attacks on time series prediction,” Inf. Sci., vol. 587, pp. 794–812, Mar. 2022.
[56]
J. Wang et al., “Adversarial examples in the physical world: A survey,” 2024, arXiv:2311.01473.
[57]
H. Wang, A. Zhang, S. Zheng, X. Shi, M. Li, and Z. Wang, “Removing batch normalization boosts adversarial training,” in Proc. Int. Conf. Mach. Learn. (ICML), 2022, pp. 23433–23445.
[58]
C. Xie, M. Tan, B. Gong, J. Wang, A. Yuille, and Q. V. Le, “Adversarial examples improve image recognition,” 2019, arXiv:1911.09665.
[59]
M. Awais, Md. T. Bin Iqbal, and S.-H. Bae, “Revisiting internal covariate shift for batch normalization,” IEEE Trans. Neural Netw. Learn. Syst., vol. 32, no. 11, pp. 5082–5092, Nov. 2021.
[60]
F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in Proc. Int. Conf. Mach. Learn., 2020, pp. 2206–2216.
[61]
Z. Liu, Y. Xu, X. Ji, and A. B. Chan, “TWINS: A fine-tuning framework for improved transferability of adversarial robustness and generalization,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., Jun. 2023, pp. 16436–16446.
[62]
A. Liu et al., “Towards defending multiple ℓp-norm bounded adversarial perturbations via gated batch normalization,” 2020, arXiv:2012.01654.
[63]
N. Bjorck, C. P. Gomes, B. Selman, and K. Q. Weinberger, “Understanding batch normalization,” in Proc. Adv. Neural Inf. Process. Syst., vol. 31, 2018, pp. 1–8.
[64]
S. Tang et al., “RobustART: Benchmarking robustness on architecture design and training techniques,” 2021, arXiv:2109.05211.
[65]
Y. Tao and L. Zhao, “WiFi fingerprint localization with circular boundary,” IEEE Commun. Lett., vol. 25, no. 9, pp. 2928–2932, Sep. 2021.
[66]
E. S. Lohan, J. Torres-Sospedra, H. Leppäkoski, P. Richter, Z. Peng, and J. Huerta, “Wi-Fi crowdsourced fingerprinting dataset for indoor positioning,” Data, vol. 2, no. 4, p. 32, Oct. 2017.
[67]
N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in Proc. IEEE Symp. Secur. Privacy (SP), May 2017, pp. 39–57.
[68]
K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” 2014, arXiv:1409.1556.
[69]
A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” in Proc. Adv. Neural Inf. Process. Syst., vol. 25, 2012, pp. 1–9.
[70]
I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” 2014, arXiv:1412.6572.
[71]
J. Torres-Sospedra et al., “UJIIndoorLoc,” UCI Mach. Learn. Repository, Tech. Rep., 2014. 10.24432/C5MS59.
Index Terms
- Adversarial Examples Against WiFi Fingerprint-Based Localization in the Physical World
Index terms have been assigned to the content through auto-classification.
Recommendations
Fingerprint Adversarial Presentation Attack in the Physical Domain
Pattern Recognition. ICPR International Workshops and ChallengesAbstractWith the advent of the deep learning era, Fingerprint-based Authentication Systems (FAS) equipped with Fingerprint Presentation Attack Detection (FPAD) modules managed to avoid attacks on the sensor through artificial replicas of fingerprints. ...
Adversarial examples: A survey of attacks and defenses in deep learning-enabled cybersecurity systems
AbstractOver the last few years, the adoption of machine learning in a wide range of domains has been remarkable. Deep learning, in particular, has been extensively used to drive applications and services in specializations such as computer vision, ...
Highlights- A taxonomy of cybersecurity applications is established.
- Adversarial machine learning is systematically overviewed.
- An extensive, curated list of cybersecurity-related datasets is provided.
- Methods for generating adversarial ...
Exploring Adversarial Attacks on Learning-based Localization
WiseML'23: Proceedings of the 2023 ACM Workshop on Wireless Security and Machine LearningWe investigate the robustness of a convolutional neural network (CNN) RF transmitter localization model in the face of adversarial actors which may poison or spoof sensor data to disrupt or defeat the algorithm. We train the CNN to estimate transmitter ...
Comments
Information & Contributors
Information
Published In
1556-6021 © 2024 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See https://www.ieee.org/publications/rights/index.html for more information.
Publisher
IEEE Press
Publication History
Published: 02 September 2024
Qualifiers
- Research-article
Contributors
Other Metrics
Bibliometrics & Citations
Bibliometrics
Article Metrics
- 0Total Citations
- 0Total Downloads
- Downloads (Last 12 months)0
- Downloads (Last 6 weeks)0
Reflects downloads up to 22 Oct 2024
Other Metrics
Citations
View Options
View options
Get Access
Login options
Check if you have access through your login credentials or your institution to get full access on this article.
Sign in