On the Fragility of AI-Based Channel Decoders under Small Channel Perturbations

Recent advances in deep learning have led to AI-based error correction decoders that report empirical performance improvements over traditional belief-propagation (BP) decoding on AWGN channels. While such gains are promising, a fundamental question remains: where do these improvements come from, and what cost is paid to achieve them? In this work, we study this question through the lens of robustness to distributional shifts at the channel output. We evaluate both input-dependent adversarial perturbations (FGM and projected gradient methods under $\ell_2$ constraints) and universal adversarial perturbations that apply a single norm-bounded shift to all received vectors. Our results show that recent AI decoders, including ECCT and CrossMPT, could suffer significant performance degradation under such perturbations, despite superior nominal performance under i.i.d. AWGN. Moreover, adversarial perturbations transfer relatively strongly between AI decoders but weakly to BP-based decoders, and universal perturbations are substantially more harmful than random perturbations of equal norm. These numerical findings suggest a potential robustness cost and higher sensitivity to channel distribution underlying recent AI decoding gains.

💡 Research Summary

This paper investigates the robustness of recent transformer‑based neural channel decoders—specifically the Error‑Correction Code Transformer (ECCT) and CrossMPT—against small, norm‑bounded perturbations applied to the received signal. While prior work has shown that these AI‑driven decoders can outperform classical belief‑propagation (BP) schemes (e.g., Min‑Sum, Sum‑Product) on additive white Gaussian noise (AWGN) channels in terms of frame error rate (FER), the authors ask whether such gains come at the expense of increased sensitivity to distributional shifts in the channel output.

To answer this, the authors adopt tools from the adversarial robustness literature. They consider two families of attacks: (1) input‑dependent perturbations, generated by Fast Gradient Method (FGM) and Projected Gradient Descent (PGD) under an ℓ₂ budget ε, and (2) universal adversarial perturbations (UAPs) that apply the same shift to all received vectors. Because neural decoders contain nondifferentiable operations (sign, binarization, syndrome computation), the authors smooth the loss by adding Gaussian noise V∼N(0,ν²I) to the input, defining a smoothed loss g(y,δ)=E_V