Artificial Noise Injection: Methods & Applications

• Artificial Noise Injection is a method that deliberately injects interference, often in the null-space of legit channels, to degrade adversarial signal integrity.
• It employs techniques like power allocation, beamforming, and structured noise shaping in MIMO, OFDM, and localization systems to optimize secrecy performance.
• The approach is used to mitigate side-channel attacks, enhance machine learning robustness, and protect location privacy, though challenges in synchronization and complexity remain.

Artificial noise (AN) injection is a technique for deliberately introducing structured or random interference into a communication, computation, localization, or cryptographic system for the explicit purpose of degrading an adversary’s ability to acquire confidential or private information. Originating as a physical-layer security method for wireless communications, AN injection now encompasses countermeasures for side-channel attacks, localization privacy, wireless relay secrecy, visible light security, and even robustness in machine learning. In AN injection, a privileged party (commonly the transmitter) exploits knowledge of system topology, legitimate channel state, or authorized codebooks, inserting interference in such a way that legitimate parties remain unaffected or can perfectly cancel the AN, while non-privileged adversaries suffer substantial loss in information, localization, or estimation accuracy.

1. Fundamental Principles and Mathematical Formulation

Artificial noise is defined as an intentional, designer-controlled perturbation, typically statistically independent of the legitimate information signal, and often structured to lie in the null-space or orthogonal complement of the legitimate channel or codebook. In a canonical MIMO wiretap channel, Alice (with $N_A$ antennas) transmits

$$\mathbf{x} = \mathbf{P}\mathbf{u} + \mathbf{Z}\mathbf{v}$$

where $\mathbf{P}$ directs the $N_B$-dimensional confidential message $\mathbf{u}$ toward Bob and $\mathbf{Z}\mathbf{v}$ is AN spanning the null-space of Bob’s channel. The eavesdropper Eve receives

$$\mathbf{y} = \mathbf{G}\mathbf{P}\mathbf{u} + \mathbf{G}\mathbf{Z}\mathbf{v} + \mathbf{n}_E$$

while Bob receives

$$\mathbf{z} = \mathbf{H}\mathbf{P}\mathbf{u} + \mathbf{n}_B$$

and—by construction—$\mathbf{H}\mathbf{Z} = \mathbf{0}$, so Bob's reception is AN-free while Eve is jammed (Liu et al., 2013). The explicit power allocation between $\mathbf{u}$ and $\mathbf{v}$ is critical and is system-specific, subject to total power and achievable secrecy rate constraints.

In scalar or single-antenna designs, AN injection requires auxiliary protocols: for example, a half-duplex Bob can transmit pseudo-random AN in a first phase, with Alice forwarding that noise (plus data) in a second phase, enabling Bob to subtract the AN and rendering it undecodable to Eve (He et al., 2017).

2. Information-Theoretic and Estimation-Theoretic Implications

AN injection is fundamentally an information bottleneck for the adversary, converting a potentially high-SNR wiretap or side-channel into an effective low-SNR or mismatched channel. For Gaussian wiretap channels, the secrecy capacity with AN is

$$C_s = \left[ \frac{1}{2} \log_2 \left( 1 + \frac{P_{\rm auth}}{\sigma_B^2 + P_{\rm AN}} \right) - \frac{1}{2} \log_2 \left( 1 + \frac{P_{\rm auth}}{\sigma_E^2 + P_{\rm AN}} \right) \right]^+$$

where $P_{\rm AN}$ is the AN power and $P_{\rm auth}$ is the message signal power (Formaggio et al., 2018). This type of secrecy rate or capacity expression generalizes to MIMO, OFDM, and hybrid configurations, with the dimension of the AN subspace, knowledge of channel state, and block length determining performance (Liu et al., 2017, Marzban et al., 2018).

In side-channel resistance, AN minimizes the mutual information $I(U; Y^m)$ between the secret $U$ and observation $Y^m$ by additive injection (Woo et al., 29 Apr 2025). Optimal allocations are found by solving convex programs,

$$\min_{N_i \geq 0, \sum N_i \leq N_0} \sum_{i=1}^m \log(1 + P_i/(Z_i + N_i))$$

with KKT conditions producing dual water-filling–like solutions for noise variance allocation per channel.

3. Design Strategies and Optimization of AN Injection

Null-space and Beamforming-Constrained AN

In all multi-antenna systems (MIMO, massive MIMO, visible light, fluid antenna), the most effective AN is injected in the spatial null-space (or, generally, the unobservable subspace) of the legitimate receiver (Liu et al., 2013, Zhang et al., 2 Dec 2025, Pham et al., 2023). In highly structured arrays, group-sparsity surrogates and BCD/spectral water-filling are applied to jointly optimize information and AN embedding in baseband/analog domains without extra RF chains (Zhang et al., 2 Dec 2025).

Temporal, Spatio-Temporal, and Hybrid AN

In OFDM-based systems, temporal or cyclic-prefix–shaped AN is injected in the time domain (prior to DFT spreading), again lying in Bob’s channel null-space, rendering it invisible to the legitimate receiver (Shafie et al., 2017, Marzban et al., 2018, Golstein et al., 2020). “Hybrid” spatio-temporal AN schemes allocate AN power between spatial and temporal domains via fractional parameters $(\alpha,\beta)$ and optimize according to asymptotic or simulated secrecy rate expressions (Shafie et al., 2017).

Power Allocation and Water-Filling

Optimal AN-to-signal power ratios are analytically derived, e.g., via solving

$$R_S(\alpha) = \left[ \log_2(1+\mathbb{E}[\gamma_B]) - \log_2(1+\mathbb{E}[\gamma_E]) \right]^+$$

subject to total power, codebook, and receiver SNR constraints (Golstein et al., 2020, Woo et al., 29 Apr 2025). Subcarrier-specific water-filling policies generalized from rate maximization allocate lesser AN to robust subchannels and focus on vulnerable ones.

AN Shaping and Non-Gaussian Strategies

Gaussian AN is not always optimal. In relay networks, specially optimized two-mass distributions for AN phase and power maximize the symbol-error rate at eavesdroppers compared to standard Gaussian choices (Liu et al., 2015).

CSI-Free and Structured Artificial Noise

Emerging structured AN frameworks exploit only geometric or protocol constraints to inject “false” scatterers (artificial multipath) or tweak physical-layer features below the adversary’s resolution limit, degrading unauthorized localization or channel inference without any instantaneous transmitter CSI (Li et al., 2022, Zhang et al., 2024). Such structured AN can outperform unstructured Gaussian injection in localization privacy (Zhang et al., 2024).

4. Applications Beyond Classical Wireless Security

Side-Channel Attack Mitigation

Artificial noise is fundamental in suppressing information leakage in hardware cryptosystems by directly minimizing mutual information between secrets and side-channel observations, through adaptive and power-constrained variance allocation on each leakage point (Woo et al., 29 Apr 2025). Numerical results confirm drastic reductions in both average and peak mutual information (saving up to 88% of noise power vs. uniform schemes) in realistic SCA settings.

Machine Learning Regularization and Robustness

In training machine learning models (especially deep networks or random-feature models), artificial noise injection (e.g., Gaussian noise on input or hidden layers) is mathematically equivalent to adding an implicit, weighted ridge regularizer whose strength can be tuned via the noise variance (Dhifallah et al., 2021). Gradient-based methods with noise-injection improve generalization: anticorrelated noise injection in gradient descent (Anti-PGD) biases the algorithm toward flatter minima, leading to provable regularization of the trace-Hessian and superior generalization compared to standard (uncorrelated) noise (Orvieto et al., 2022). Likelihood-ratio estimators enable training with neuron-wise noise scales to enhance adversarial robustness with negligible average accuracy loss (zhang et al., 2023).

Privacy and Location Hiding

AN injection in localization systems increases the error (or shifts the bias) in delay or time-of-arrival estimation at adversaries, with the theoretical impact evaluated via mismatched Cramér–Rao bounds (Zhang et al., 2024). Structured AN can achieve significant (e.g., 9 dB) degradation in an unauthorized device's localization accuracy with minimal degradation to legitimate parties (Li et al., 2022).

5. System-Specific Implementations and Performance Insights

Practical AN-aided systems range from SISO and relay-based wireless to MIMO/OFDM and even VLC networks. Notable system-specific findings include:

• Massive MIMO and Block-fading: The fundamental secrecy benefit of artificial noise is quantifiable in terms of the reduction of the degrees-of-freedom at the eavesdropper as a function of AN dimension and coherence time. Allocation ensuring $$\text{data}+\text{AN} \geq \text{coherence\ block\ length}$$ can drive high-SNR leakage to zero even with massive, passive Eve (Song, 2018, Zeng et al., 2019).
• Single-Antenna and Relay Systems: Even in single-antenna configurations, by alternating AN transmission between Bob and Alice and optimizing AN/data balances, perfect secrecy (zero secrecy-outage) can be achieved in quasi-static fading (He et al., 2017, Liu et al., 2015).
• Visible Light Communications (VLC): Selective AN-aided SISO designs—best LED for data, others for AN—can double secrecy energy efficiency over full-array AN, especially when Eve's CSI is unknown (Pham et al., 2023).
• Power/Complexity Trade-off: Adaptive AN allocation via water-filling or structured batch pruning (e.g., group-Lasso port selection in FA-MIMO) offers major power and DoF savings, which is crucial for power-constrained IoT and hardware implementations (Zhang et al., 2 Dec 2025, Woo et al., 29 Apr 2025).
• Impact of Channel Knowledge: In the absence of eavesdropper CSI, indirect or null-space AN designs focused on maximizing legitimate link performance are advantageous; if CSI is partially available, direct minimax optimization (max-min secrecy/energy-efficiency) yields the best result (Pham et al., 2023).

6. Limitations, Controversies, and Future Directions

Artificial noise injection, while versatile and effective, is not universally optimal. Its effectiveness can saturate in large-antenna (“very large MIMO”) regimes where spatial beamforming fully nulls the eavesdropper without AN (Zhang et al., 2 Dec 2025). The Gaussianity assumption for both legitimate and leakage channels is often violated in practice, and optimal non-Gaussian AN design remains an open problem in many regimes (Liu et al., 2015). Implementation complexity, need for tight synchronization (especially in structured AN and authentication), and hardware overhead of variable-power/jittered noise sources are persistent challenges (Woo et al., 29 Apr 2025, Formaggio et al., 2018).

Active adversaries (proactive eavesdroppers), evolving localization algorithms, and future quantum-resilient attack models all present new threat surfaces and research directions for AN injection. Structured, protocol-aware, or machine-learned AN generation and joint hybrid strategies (spatio-temporal, port-optimized, or pseudo-decoded AN) are likely avenues for future advances (Jin et al., 2024, Li et al., 2022).

7. Comparative Summary of Core Techniques

Application Domain	AN Embedding Principle	Optimization Approach
MIMO Wiretap	Null-space projection	Power splitting, SVD/lattice, water-filling (Liu et al., 2013)
Massive MIMO	Null-space, dimension-filling	DoF maximization/block-fading, spectral shaping (Song, 2018)
OFDM	Time/frequency domain, cyclic-prefix	Spatio-temporal tradeoff, SVD, KKT
Side-channel Security	Additive Gaussian per channel	Mutual information minimization, KKT water-filling (Woo et al., 29 Apr 2025)
Machine Learning	Input/hidden layer perturbation	Derived regularization, likelihood-ratio/backprop (Dhifallah et al., 2021, zhang et al., 2023)
Localization Privacy	Structured path/AN injection	Optimal $\tilde\beta$, MCRB analysis (Zhang et al., 2024)

In summary, artificial noise injection constitutes a mathematically rigorous, multifaceted methodology that—when precisely engineered and system-adapted—provably degrades adversarial estimation, inference, and decoding capabilities in both wireless and computational settings. Continued progress depends on extending current designs to non-Gaussian, nonstationary, and adversarially adaptive environments and on co-design with low-cost, energy-efficient hardware and scalable learning systems.