Security and Privacy in Generative Semantic Communication Systems: A Comprehensive Survey

Abstract

Semantic communication (SemCom) has emerged as a task-oriented communication paradigm that prioritizes meaning delivery over exact bit recovery. The integration of generative artificial intelligence (GenAI) into SemCom further enables knowledge-guided inference, multimodal reconstruction, and semantic compression through architectures such as large language models, variational autoencoders, generative adversarial networks, and diffusion models. At the same time, this integration introduces new security and privacy risks, including semantic eavesdropping, model inversion, semantic jamming, covert backdoors, prompt manipulation, and knowledge-base leakage, which are not adequately captured by conventional communication security models. In this survey, we provide a security-centric review of GenAI-assisted semantic communication systems by organizing the literature according to threat models, attack surfaces, defence strategies, and semantic modalities across text, image, and multimodal settings. The survey was conducted using IEEE Xplore, ACM Digital Library, SpringerLink, arXiv, and Google Scholar. Approximately 180 papers were initially screened, and 53 representative studies published between 2021 and 2026 were selected for detailed review. Based on this analysis, we classify the major threats into adversarial perturbation, jamming, poisoning and backdoor attacks, privacy leakage and semantic eavesdropping, and generative-model-specific vulnerabilities involving diffusion, large language models, and multimodal foundation models. We further map the corresponding defences, including adversarial training, model ensembling, semantic-aware encryption, diffusion-guided denoising, privacy-preserving representation learning, and secure resource allocation. The survey also identifies persistent open challenges, including the lack of standardized semantic security metrics, unified benchmarks, cross-layer evaluation frameworks, and robust defences for GenAI-native and multimodal semantic communication systems. Overall, this work provides a structured reference for the design of secure, trustworthy, and attack-resilient generative semantic communication systems for future intelligent networks.

1. Introduction

The emergence of semantic communication (SemCom) represents a fundamental shift from conventional bit-level transmission toward the exchange of task-relevant meaning. Rather than guaranteeing exact symbol recovery, SemCom seeks to convey only the information necessary for successful task execution, thereby improving communication efficiency under bandwidth, latency, and energy constraints. By leveraging deep learning and contextual awareness, semantic communication systems preserve Semantic integrity even when traditional signal-level metrics degrade [1,2]. This paradigm is particularly well suited for intelligent applications such as autonomous driving, immersive environments, and the Metaverse, where decision accuracy matters more than bit-perfect reconstruction.

Recent advances have further accelerated this paradigm through the integration of generative artificial intelligence (GenAI) [3,4,5] into semantic communication pipelines. Generative models including large language models (LLMs), VAEs, and diffusion networks enable receivers to reconstruct semantically meaningful content from compact semantic representations rather than explicit symbol streams. Such capabilities support knowledge-grounded generation, multimodal semantic transmission—where information from multiple modalities such as text, vision, and audio is jointly encoded and semantically fused, and content-aware compression, allowing GenAI-assisted SemCom systems to outperform conventional encoders in both semantic fidelity and spectral efficiency [6,7]. As a result, generative semantic communication has emerged as a core architectural component for future intelligent and task-oriented networks.

At the core of this paradigm is semantic data, which refers to meaning-bearing information such as intent, context, and task relevance, usually represented as latent embeddings, semantic tokens, or knowledge-assisted features. Although these representations facilitate efficient compression and effective job execution, they may also reveal important structural and contextual information. Consequently, safeguarding semantic data necessitates security measures that extend beyond traditional encryption or error correction, as semantic meaning may still be deducible despite the maintenance of physical-layer confidentiality.

The introduction of GenAI into semantic communication substantially reshapes the associated security and privacy landscape. Traditional communication security focuses on protecting symbols and signals; however, semantic communication systems are vulnerable to attacks that directly target meaning and model behaviour. Adversarial perturbations can induce semantic misinterpretation at the receiver without significantly affecting metrics such as BER, exposing a fundamental mismatch between conventional security guarantees and semantic correctness [3]. Multi-domain adversarial attacks further amplify this threat by jointly manipulating source data and channel-level signals, resulting in semantic distortion across both physical and semantic layers. Similar attack–defence dynamics have been observed in task-oriented regression systems, where gradient-based adversarial perturbations substantially degrade prediction accuracy, and runtime defences such as adversarial training and distillation recover performance at the cost of additional complexity [8].

These risks are intensified when generative models are employed for semantic reconstruction. Generative encoders and decoders, diffusion-based reconstruction modules, and knowledge-assisted semantic representations may unintentionally retain sensitive information, making them susceptible to semantic eavesdropping and model inversion attacks—even under secure channel conditions. Recent studies demonstrate that adversaries can exploit generative priors to reconstruct private semantic content with high accuracy, highlighting that semantic confidentiality cannot be ensured through channel-level protection alone [9,10,11]. Moreover, GenAI-based SemCom pipelines are exposed to poisoning, backdoor, and inference attacks, particularly in distributed or federated environments where semantic models and knowledge bases are collaboratively trained and shared.

Beyond privacy leakage, generative semantic communication systems are increasingly threatened by semantic manipulation attacks. Unlike classical adversarial attacks that target classification outputs, semantic-level attacks aim to alter reconstructed meaning while preserving perceptual or signal-level quality. Covert semantic backdoors and poisoning-based attacks demonstrate that malicious behaviours can be embedded directly into semantic feature spaces and triggered only under specific contextual or channel conditions [12,13,14]. In safety-critical scenarios such as autonomous driving and intelligent connected vehicles, such attacks may lead to catastrophic decisions without triggering conventional anomaly detectors. Generative decoders further exacerbate this risk by amplifying subtle semantic manipulations into coherent yet misleading outputs [4,15].

The growing adoption of LLMs and multimodal foundation models as semantic encoders and reasoning agents introduces additional vulnerabilities. In this context, a semantic encoder maps raw inputs into compact, task-relevant latent representations that capture meaning (e.g., intent, objects, relations) rather than exact symbol-level information. LLM-based semantic communication systems have been shown to suffer from prompt manipulation, output-representation backdoors, and transfer-based black-box attacks that persist across downstream tasks [16,17,18]. Similarly, multimodal generative systems inherit vulnerabilities from vision–language models, where semantic perturbations and backdoor triggers can simultaneously compromise perception and reasoning [19,20]. These attacks operate at semantic and reasoning levels rather than the signal layer, rendering traditional threat models insufficient.

From a defensive perspective, recent research has proposed a variety of countermeasures, including semantic-aware encryption, adaptive noise injection, diffusion-guided denoising, dynamic adversarial filtering, and privacy-preserving representation learning [21,22,23]. While these approaches demonstrate promising security–performance trade-offs, they are often evaluated under limited threat assumptions, single-modality settings, or idealized attacker models. Surveys consistently highlight the lack of standardized semantic security metrics, unified benchmarks, and cross-layer evaluation methodologies tailored to GenAI-enabled semantic communication [24,25,26,27].

Motivated by these challenges, this survey provides a systematic and security-centric review of Generative AI-assisted semantic communication systems. We focus on how generative models reshape semantic data representations, expand attack surfaces, and necessitate new defence paradigms beyond traditional communication security. By organizing the literature according to semantic attack models, defence strategies, and generative optimization mechanisms, this work aims to bridge the gap between semantic robustness and security assurance, offering a foundational reference for the design of reliable, task-oriented, and secure GenAI-enabled communication systems in future networks.

Figure 1 presents an overview of a generic GenAI-enabled semantic communication pipeline and the associated security landscape. On the left, the transmitter side includes a semantic encoder supported by Generative AI modules such as LLMs, VAEs, and diffusion models, which extract and compress task-relevant meaning from input modalities such as text and image. These semantic representations are further supported by a shared or personalized knowledge base, which provides contextual priors for semantic reconstruction and alignment. The encoded semantic content is then transmitted over the wireless channel, where attacks may target different stages of the pipeline. As shown on the right, representative threat points include embedding-level adversarial attacks on semantic representations, GAN-based semantic jamming during transmission, semantic backdoors such as CSBA embedded in latent features, cross-layer leakage across semantic and physical layers, semantic and physical eavesdropping, and hallucination or knowledge leakage caused by generative reconstruction and shared knowledge. The figure also highlights that defences must operate across multiple levels rather than only at the signal layer. These include protection of semantic representations, secure knowledge-base management, robust generative reconstruction, and cross-layer defence strategies designed to preserve semantic correctness as well as confidentiality. The application domains shown at the bottom—autonomous vehicles, metaverse, and edge computing—illustrate that these attack surfaces and defences are relevant across diverse GenAI-SemCom deployment scenarios rather than being limited to a single use case.

Figure 1. Overview of generative semantic communication and its security landscape.

Although several recent surveys have reviewed semantic communication from perspectives such as architecture, resource management, privacy, and general security [24,25], a clear gap remains in the security-focused analysis of Generative AI-assisted semantic communication systems. In particular, existing survey works do not systematically examine how Generative AI reshapes the security landscape by introducing new attack surfaces at the generative, semantic, and reasoning levels, including prompt manipulation, knowledge-base leakage, diffusion-space perturbations, latent backdoors, and multimodal model vulnerabilities. This survey addresses that gap by providing a security-centric review of GenAI-assisted semantic communication, organized through a unified taxonomy of threat models, attack surfaces, defence strategies, and semantic modalities. In addition, the paper maps major attack categories to corresponding defences and highlights open research challenges related to semantic security metrics, unified benchmarks, cross-layer evaluation, and robust protection for GenAI-native and multimodal systems.

This survey reviews literature published between 2021 and 2026 on the security and privacy of semantic communication, with particular emphasis on Generative AI-assisted semantic communication systems. The literature search was conducted using IEEE Xplore, ACM Digital Library, SpringerLink, arXiv, and Google Scholar with keywords including “semantic Communication security”, “Generative semantic Communication”, “semantic attacks”, “semantic defences”, “semantic privacy”, and related combinations. In total, approximately 180 records were initially identified. After removing duplicate and clearly irrelevant records, the remaining studies were screened based on title, abstract, and full-text relevance. The inclusion criteria covered studies that addressed security, privacy, attack models, defence mechanisms, or trustworthy design in semantic communication, generative semantic communication, or closely related GenAI-enabled semantic systems. The exclusion criteria removed duplicate records, non-English papers, studies without substantial technical relevance to semantic communication security, works focused only on conventional communication security without semantic aspects, and papers lacking sufficient methodological or experimental detail. After this filtering process, 53 representative studies were selected for detailed review. These studies were considered representative because they collectively cover major threat models, defence strategies, semantic modalities, and architectural settings discussed in current GenAI-assisted semantic communication research.

Table 1 summarizes the literature selection process, including the search scope, screening criteria, exclusion rules, and the progression from the initial record pool to the final reviewed studies.

Table 1. Literature.

Item	Description
Timeframe	2021–2026
Databases	IEEE Xplore, ACM Digital Library, SpringerLink, arXiv, Google Scholar
Search terms	“Semantic Communication Security”, “Generative Semantic Communication”, “Semantic attacks”, “Semantic defences”, “Semantic privacy”
Initial records	Approximately 180
Inclusion criteria	Studies on security, privacy, attacks, defences, or trustworthy design in semantic communication, generative semantic communication, or closely related GenAI-enabled semantic systems
Exclusion criteria	Duplicates, non-English papers, irrelevant works, studies focused only on conventional communication security, papers with insufficient technical detail
Final reviewed studies	53 representative studies
Selection basis	Coverage of major threat models, defence strategies, semantic modalities, and system settings

2. Background and Related Works

This section provides a structured background for GenAI-SemCom from a security-oriented perspective. Instead of presenting isolated definitions, we review foundational concepts alongside representative state-of-the-art studies, emphasizing how generative models reshape semantic representations, attack surfaces, and defence mechanisms. The discussion is organized into five subsections covering Generative AI, semantic Data, semantic communication, semantic Attacks, and semantic defences.

2.1. Generative AI

Generative Artificial Intelligence (GenAI) refers to a class of learning-based models capable of synthesizing structured content—such as text, images, audio, or multimodal data—by learning underlying data distributions. Representative architectures include LLMs, VAEs, GANs, and diffusion models. In the context of semantic communication, GenAI enables receivers to reconstruct semantically meaningful content from compact or incomplete semantic representations, significantly reducing transmission overhead.

Recent works demonstrate that generative models play a central role in next-generation semantic communication systems by replacing deterministic decoders with probabilistic semantic reconstruction engines. Knowledge-base-enabled semantic communication frameworks leverage GenAI to reconstruct content based on shared intent, task knowledge, and contextual priors rather than raw symbols [28]. Similarly, diffusion-based semantic communication systems utilize iterative denoising to recover high-fidelity semantics from highly compressed Semanticmaps, outperforming traditional reconstruction-oriented schemes under severe channel degradation [29].

However, the inclusion of generative models fundamentally alters the security landscape. Generative priors may unintentionally amplify semantic leakage, hallucinate misleading content, or propagate poisoned representations learned during training. Surveys consistently report that GenAI-driven semantic communication systems expand the attack surface beyond the physical and semantic layers to include generative and reasoning components [4]. As a result, security analysis must account for both generative robustness and semantic correctness rather than channel reliability alone.

A comparative view shows that different generative architectures contribute distinct advantages to semantic communication. Knowledge-base-driven and LLM-oriented approaches are particularly effective for context-aware reasoning and semantic reconstruction from sparse inputs, but they depend heavily on prior alignment and shared knowledge consistency, as shown in knowledge-base-enabled semantic communication frameworks [28]. In contrast, diffusion-based models provide strong reconstruction quality and robustness under severe degradation, yet they usually introduce higher computational cost and larger inference latency, as demonstrated by diffusion-based generative semantic communication systems [29]. GAN- and VAE-based models offer efficient generation and compression benefits, but they are often more sensitive to instability, hallucination, or distributional mismatch in practical deployment [6]. Therefore, the choice of generative architecture in GenAI-SemCom involves a trade-off among semantic fidelity, computational efficiency, contextual reasoning, and security robustness.

In summary, GenAI is not merely a reconstruction tool in semantic communication; it reshapes both system capability and system risk. As discussed by Ren et al. [4], its benefits in semantic recovery and compression must therefore be evaluated together with its expanded exposure to leakage, hallucination, poisoning, and reasoning-level attacks.

2.2. Semantic Data

Semantic data refers to task-relevant, meaning-bearing representations extracted from raw source information. Unlike conventional data symbols, semantic data encapsulates intent, contextual relevance, and knowledge relationships required for downstream decision-making. In GenAI-SemCom systems, semantic data is typically represented in latent embedding spaces, structured knowledge graphs, or compressed semantic tokens aligned with task objectives.

Knowledge-assisted semantic communication frameworks highlight that semantic data is inherently context-dependent and often intertwined with private user information [30]. Shared or personalized knowledge bases enable efficient semantic reconstruction but also introduce privacy risks when adversaries exploit semantic correlations or auxiliary knowledge to infer sensitive attributes. Studies show that semantic representations may leak significantly more information than expected, even when signal-level metrics suggest secure transmission [26].

Generative semantic communication complicates semantic data by allowing receivers to reconstruct high-dimensional information from minimum semantic cues. This improves efficiency but allows attackers to employ generative priors for semantic inference and inversion attacks. Recent investigations have shown that semantic data safety requires more than encryption or noise injection. Generative thinking can nevertheless recover semantic meaning, as found in the study [25]. These findings demand semantically aware, GenAI-specific privacy and security techniques.

From a comparative perspective, semantic data representations differ in both utility and exposure. As discussed by Liuet al. [30], latent embeddings are compact and efficient for transmission, but their compressed structure may still preserve sensitive semantic attributes that support inference and privacy leakage. Knowledge-graph and knowledge-assisted representations improve contextual interpretability and reconstruction quality, yet they also introduce additional privacy risks because attackers may exploit semantic relations and auxiliary knowledge [26]. Semantic tokens provide flexible task-oriented abstraction, but their security depends strongly on how much high-level meaning is retained and how easily such meaning can be reconstructed by generative models. Thus, richer semantic representations generally improve efficiency and task performance, but they also increase the risk of semantic leakage [25].

In summary, semantic data should be viewed as both an enabler of efficient communication and a direct security object that requires protection. Its design must balance compactness, usefulness, and interpretability against privacy leakage and inference vulnerability.

2.3. Semantic Communication

In contrast to Shannon-style source–channel separation, semantic communication is characterized by the simultaneous optimization of semantic extraction, transmission, and task execution. A semantic encoder is a component of a typical semantic communication system. It is responsible for extracting features that are relevant to the job at hand, while a channel encoder is responsible for mapping semantic representations to wireless signals. Finally, a semantic decoder is responsible for reconstructing meaning at the receiver. Generative models that are capable of probabilistic semantic reconstruction are frequently used in GenAI-SemCom to either replace or supplement the decoder when it is used.

Task-oriented semantic communication prioritizes decision accuracy or task success over signal fidelity, enabling robust performance under extreme compression or noisy channels. Experimental studies demonstrate that semantic communication systems can maintain high task accuracy even when traditional metrics such as BER or PSNR degrade significantly [3]. Generative semantic communication further enhances robustness by allowing receivers to infer missing semantics using learned priors rather than explicit retransmission.

Despite these advantages, semantic communication systems are inherently vulnerable to semantic distortion and manipulation. Because correctness is defined at the Semanti core task level, attacks that preserve signal quality while altering meaning may go undetected. Surveys on resource management and semantic radio access networks highlight that semantic communication architectures significantly increase the attack surface by introducing shared models, task-awareness, and adaptive reconstruction [24,27]. Consequently, semantic communication requires security guarantees that extend beyond physical-layer confidentiality.

Comparatively, conventional communication systems are optimized for faithful symbol recovery, whereas semantic communication systems are optimized for task success and meaning preservation. As established by Xie et al. [1] and Luo et al. [2], this gives semantic communication a clear advantage under bandwidth and noise constraints, since useful decisions may still be achieved even when signal-level fidelity degrades. However, Sagduyu et al. [3] show that the same shift also creates a major limitation: performance can appear satisfactory under traditional metrics while semantic meaning has already been manipulated. GenAI-assisted semantic communication further strengthens robustness through prior-driven reconstruction, but this benefit is coupled with greater dependence on shared models, learned priors, and adaptive decoding, all of which enlarge the semantic attack surface [6].

In summary, semantic communication provides higher task efficiency and robustness than bit-centric designs, but it also changes what must be protected. As a result, secure semantic communication requires evaluation criteria that jointly consider transmission quality, semantic correctness, and resilience to meaning-level attacks.

2.4. Semantic Attack

The purpose of semantic attacks is not to disrupt signal transmission but rather to compromise the meaning, intent, or task outcome of semantic communication.These attacks exploit learned semantic representations, shared knowledge bases, or generative reconstruction methods, often without causing noticeable degradation in conventional signal-level metrics.

A key concern in semantic attacks is that semantic integrity may be compromised even when traditional security indicators suggest normal operation. This mismatch makes meaning-centered threat models and evaluation criteria essential for semantic communication systems.

Poisoning and backdoor attacks represent a particularly severe threat in GenAI-SemCom systems. Covert semantic backdoor attacks embed triggers directly into semantic feature spaces, enabling selective semantic deletion or manipulation during inference while maintaining high perceptual quality [12]. Channel-triggered backdoors further demonstrate that semantic attacks can be activated implicitly through wireless channel conditions rather than explicit input patterns [14]. Recent studies also reveal that generative reconstruction pipelines are vulnerable to latent manipulation attacks, where adversarial biases accumulate across diffusion steps and result in controlled semantic drift [15].

A comparative examination shows that semantic attacks differ not only in mechanism but also in stealth and activation conditions. Xu et al. [12] show that poisoning and backdoor attacks are especially dangerous because they can remain dormant during normal operation and activate only under specific triggers, making them difficult to detect. Wan et al. [14] further increase this stealth by embedding activation conditions in transmission environments rather than visible input patterns. In addition, Xi and Zhu [15] show that latent manipulation in diffusion-based pipelines can gradually alter semantic meaning across generative steps without obvious signal-level degradation. Overall, these methods are stronger in semantic communication than conventional jamming or noise-based disruption because they directly target task meaning rather than transmission quality alone.

In summary, semantic attacks exploit the gap between signal fidelity and semantic correctness. Their main danger lies in their ability to remain covert while inducing meaningful task failure, which makes semantic-level threat modeling and evaluation a central requirement for secure GenAI-SemCom design.

2.5. Semantic Defence

Semantic defence mechanisms are designed to preserve semantic integrity, maintain privacy, and ensure task reliability amidst adversarial perturbations. On the other hand, semantic defences work at the representation, generative, and task-execution levels, in contrast to traditional defences, which concentrate on signal protection.

Learning-based defences, such as adversarial training, enhance robustness by subjecting semantic encoders to adversarial perturbations while they are being trained [31]. Model ensembling approaches, such as ROME, utilize variety across models that have been trained independently in order to reduce black-box semantic jamming without necessitating adversary knowledge [32]. Policies that are based on reinforcement learning are able to alter transmission and encoding procedures in response to jamming or interference in dynamic environments [33].

There has recently been an increase in the pursuit of generative-aware defences. Denoising and semantic correction methods utilizing diffusion leverage the generative capabilities of receivers to restore clean semantics from contaminated representations [10]. In vehicular communication contexts, semantic-aware encryption selectively retains significant semantic characteristics, hence attaining favorable security-efficiency trade-offs [34]. Dynamic adversarial defence frameworks demonstrate that semantic noise filtering and contrastive alignment can significantly mitigate the effects of attacks without necessitating the retraining of the foundational models [21].

Furthermore, studies repeatedly demonstrate that existing defences are fragmented, modality-specific, and evaluated under constrained threat assumptions [24,25]. In parallel, recent work has shown that network-level design choices, such as topology optimization, can intrinsically enhance robustness against neural attacks, offering a complementary defence dimension beyond data augmentation or adversarial training [35]. This is despite the fact that the results of these surveys are encouraging. Furthermore, increases in security frequently result in non-negligible costs in terms of latency, energy consumption, or job accuracy, which reveals an intrinsic trade-off between security and performance. Because of these restrictions, there is an increased demand for defensive frameworks that are unified, cognizant of generative processes, and performance-coupled in order to ensure secure semantic communication.

On a comparative basis, semantic defences that are currently in use address distinct threat classes, which in turn results in varying advantages and limitations. Adversarial training improves resilience to known perturbation patterns, as shown by Peng et al. [36], but it typically depends on the attack assumptions seen during training and may not generalize well to adaptive or novel threats. Model ensembling enhances robustness through diversity and reduces reliance on a single semantic pathway, but Zhou et al. [32] show that this comes at the cost of increased storage and coordination overhead. Reinforcement-learning-based strategies are effective in dynamic environments such as jamming scenarios, yet Liu et al. [33] indicate that they require careful optimization and may be difficult to stabilize. Generative-aware defences, such as diffusion-guided denoising and semantic correction, show promise for recovering distorted semantics, although He et al. [10] demonstrate that they often introduce additional complexity and inference cost. Semantic-aware encryption provides efficient privacy protection in vehicular semantic communication, but Wang et al. [34] show that it does not by itself address broader robustness and model-level attack surfaces.

In summary, current semantic defences are useful but fragmented. A major research need is the development of unified defence frameworks that can jointly address robustness, privacy, efficiency, and cross-modal security in GenAI-assisted semantic communication systems.

Figure 2 organizes security in GenAI-assisted semantic communication into three interconnected dimensions: threat models, attack surfaces, and defence strategies. It highlights how adversarial threats manifest across different semantic processing stages and system components. This structured view provides a unified perspective for analyzing vulnerabilities and corresponding defences in semantic communication systems.

Figure 2. Taxonomy of threats, attack surfaces, and defences in GenAI-assisted semantic communication systems.

Table 2 summarizes the key abbreviations and technical terms used throughout this survey. These definitions are provided to improve readability and ensure consistent interpretation of security, communication, and generative-AI-related terminology.

Table 2. Nomenclature used in this survey.

Abbreviation	Description
ASR	Attack Success Rate
AWGN	Additive White Gaussian Noise
BERT	Bidirectional Encoder Representations from Transformers
BLEU	Bilingual Evaluation Understudy
CNN	Convolutional Neural Network
CSBA	Covert Semantic Backdoor Attack
DDPG	Deep Deterministic Policy Gradient
Diffusion	Diffusion-based Generative Model
GDM	Generative Diffusion Model
GAN	Generative Adversarial Network
GenAI	Generative Artificial Intelligence
GenAI-SemCom	Generative Semantic Communication
ICV	Intelligent Connected Vehicle
JSCC	Joint Source–Channel Coding
KB	Knowledge Base
LaMa	Large Mask Inpainting
LLM	Large Language Model
LPSNR	Localized Peak Signal-to-Noise Ratio
LSTM	Long Short-Term Memory
MIMO	Multiple-Input Multiple-Output
MISO	Multiple-Input Single-Output
MSE	Mean Squared Error
METEOR	Metric for Evaluation of Translation with Explicit ORdering
NLP	Natural Language Processing
PSNR	Peak Signal-to-Noise Ratio
ROME	Robust Semantic Communication via Model Ensembling
SemCom	Semantic Communication
SNR	Signal-to-Noise Ratio
SSIM	Structural Similarity Index Measure
UAV	Unmanned Aerial Vehicle
V2X	Vehicle-to-Everything
VAE	Variational Autoencoder
ViT	Vision Transformer

3. Security Studies on Generative Semantic Communication Systems

In this section, we take a look at the existing security research on GenAI-SemCom systems. We do this by classifying prior studies according to the major attack surface and the security aim. In contrast to surveys that are focused on performance, our focus is on the ways in which generative models, semantic representations, and task-oriented decoding generate novel vulnerabilities and defences that go beyond the scope of standard communication security.

Figure 3 and Figure 4 provide a pipeline-level view of where attacks and defences arise in GenAI-assisted semantic communication systems. In both figures, the communication process starts from raw multimodal input data, such as text, images, audio, or video, which is first processed by a semantic encoder based on models such as BERT, CNNs, or vision–language models. The encoder converts the input into compact latent semantic embeddings, which are then transmitted and reconstructed by a generative decoder, for example an LLM- or diffusion-based module, before producing the final task output.

Figure 3. Architecture of generative SemCom systems highlighting major semantic-level attack surfaces.

Figure 4. Architecture of generative SemCom systems highlighting major semantic-level defence surfaces.

Figure 3 highlights the major semantic-level attack surfaces along this pipeline. Attack A occurs at the input level, where adversaries manipulate raw source data before encoding. Attack B targets the semantic encoder or latent representation stage, where embedded or feature-space perturbations can alter the extracted meaning. Attack C corresponds to semantic channel jamming, where transmission-stage interference disrupts semantic fidelity without necessarily causing obvious signal-level failure. Attack D occurs at the generative decoder, where inversion, hallucination, or malicious semantic reconstruction can distort the final output even when earlier stages appear intact.

Figure 4 presents the corresponding defence surfaces. Defence A applies input filtering and sanitization to detect or remove malicious perturbations before semantic encoding. Defence B protects the latent representation through adversarial training or latent regularization, thereby improving robustness of the semantic encoder and embedding space. Defence C operates at the generative-decoder stage through diffusion-based denoising or semantic correction, aiming to recover clean semantic content from corrupted representations. Defence D validates the final task output through semantic consistency checking or output-level verification to ensure that reconstructed meaning remains aligned with the intended task. Taken together, these two figures show that secure GenAI-SemCom requires protection across the full pipeline, since vulnerabilities and countermeasures are distributed from the raw input stage to the final semantic decision stage.

3.1. Semantic Adversarial Attacks and Multi-Domain Threats

This subsection addresses threats that directly alter semantic representations or task results, frequently without substantially diminishing signal-level metrics. These assaults illustrate the intrinsic discord between bit-level dependability and Semanticcoherence.

In [31], the authors investigate embedding-level adversarial attacks in shared knowledge-based semantic communication systems, where the attacker directly manipulates semantic representations rather than transmitted signals. The attack exploits shared semantic encoders such as BERT, which map input sentences into latent semantic embeddings. By applying gradient-based perturbations to the input x, the adversary constructs an adversarial sample

$$x_{\mathrm{adv}}=x+\delta ,$$

(1)

subject to the constraint

$$\parallel \delta \parallel \le ϵ,$$

(2)

where $\delta$ denotes the adversarial perturbation and $ϵ$ is the allowable perturbation budget that preserves syntactic plausibility. The attacker is assumed to have white-box access to the semantic encoder and crafts perturbations to induce semantic misunderstanding while avoiding obvious transmission anomalies.

The attack targets the encoder’s latent representation space and aims to maximize semantic drift at the receiver. Experiments on the SNLI dataset using a BERT-based encoder–decoder architecture evaluate semantic distortion via BLEU score and cosine similarity under additive Gaussian noise. Results show a significant degradation in semantic accuracy, with BLEU decreasing from 0.72 to 0.46, while adversarial training partially restores performance to 0.59. The study demonstrates the vulnerability of shared semantic encoders in SemCom systems, although the white-box assumption limits the generalizability of the attack.

The current investigation explores the security aspects of semantic communication systems, specifically examining the inherent security of these systems when implemented with deep neural networks. This study conceptualizes semantic communication through an end-to-end autoencoder paired with a semantic task classifier, highlighting the dependence on deep neural networks as a critical security weakness. The primary focus is the structured development of multi-domain adversarial attacks, in which adversaries alter semantic meaning either within the input data domain (such as computer vision attacks on the encoder input) or within the wireless signal domain (including over-the-air perturbations aimed at the decoder), along with their synchronized integration. The study employs adversarial machine learning methods like FGSM, BIM, PGD, and C&W to showcase both targeted and non-targeted attacks, resulting in significant semantic misclassifications with minimal perturbation power. Findings from experiments conducted on the MNIST dataset indicate a significant decline in semantic task accuracy, plummeting to levels as low as 0.1, despite maintaining a low reconstruction loss ($\mathrm{MSE}\approx 0.09$). This highlights the potential for semantic integrity to be undermined, even when the quality at the signal level seems satisfactory. The findings indicate that attacks spanning multiple domains are more effective than those confined to a single domain, attaining elevated success rates with minimal perturbation-to-noise ratios, and greatly surpassing the effects of traditional Gaussian jamming. The discussion [3] on interactive training as a means to enhance performance is present, yet the evaluation of defensive strategies is somewhat limited, and there is a lack of concrete countermeasures implemented. The authors assert that semantic communication systems exhibit significant susceptibility to adversarial manipulation in various domains, highlighting an urgent requirement for defence strategies. Nonetheless, the absence of practical defences, dependence on simplistic datasets, and emphasis on white-box threat models restrict the immediate applicability of the results.

This publication introduces a security-centric semantic communication framework for textual transmission, explicitly examining the influence of semantic noise, which is recognized as a significant yet insufficiently examined hazard separate from physical channel noise. Ref. [36] primary contribution to security is the systematic classification of semantic noise into two distinct types: literal semantic noise, which includes grammatical errors and word substitutions, and adversarial semantic noise, characterized by the introduction of malicious perturbations into the embedding space that lead to semantic misinterpretation. The proposed R-DeepSC system builds upon the DeepSC framework by incorporating a calibrated self-attention mechanism, which is directed by an error-detection network to mitigate erroneous tokens. Additionally, it employs adversarial training based on FGM to improve resilience against embedding-level attacks. The analysis of performance on the Europarl dataset across AWGN and Rayleigh fading channels reveals that R-DeepSC consistently surpasses traditional communication systems and baseline DeepSC, especially regarding BLEU and BERTScore metrics, particularly in scenarios with high semantic noise ratios (up to 60%) and low SNR conditions. The findings indicate that semantic fidelity diminishes at a significantly slower rate than the baseline comparisons, thereby confirming the efficacy of the suggested defences. Nonetheless, the research presumes white-box access for adversarial training, concentrates solely on text modalities, and overlooks more potent or adaptive threats like backdoors or multi-domain semantic attacks. This work serves as an essential reference for security in semantic communication, yet it primarily addresses robustness against semantic noise, lacking a broader examination of various semantic security threats.

The present paper [37] offers a thorough security-focused examination of semantic communication systems, carefully investigating the emergence of security and privacy concerns at the semantic encoder, knowledge base, physical channel, and decoder. The authors delineate four principal categories of attacks—adversarial attacks, poisoning/backdoor attacks, network attacks, and inference attacks—and explicitly clarify how these threats diverge from traditional bit-level communication attacks by focusing on semantic meaning and contextual knowledge. The study delineates a three-tier semantic communication paradigm (technical, semantic, and effectiveness layers) and correlates specific assaults and compromised security attributes to each tier. This analysis examines adversarial training, denoising, model optimization, data preprocessing, differential privacy, homomorphic encryption, and secure network architecture from a defence standpoint, highlighting their relevance to semantic pipelines. A significant contribution is a case study on federated semantic encoder/decoder training utilizing zero-knowledge proofs, which experimentally diminishes membership inference attack accuracy to approximately 50% (close to random guessing), at the expense of substantial computation (approximately 110 s for proof generation) and communication overhead (approximately 50–650 MB). The paper presents robust conceptual coverage and quantitative overhead analysis; however, it is deficient in task-level semantic performance metrics (e.g., SSIM, BLEU, task success rate) under attack, offers minimal discussion specific to GenAI, and fails to assess defences against contemporary generative threats such as prompt manipulation or diffusion-based attacks. Overall, it functions as a fundamental security assessment for semantic communication, although it distinctly lacks provisions for GenAI-driven, attack-aware, and performance-coupled security evaluations, which your study explicitly addresses.

Ref. [38] analyses adversarial attacks and their defences in semantic communication systems for vehicular metaverse applications, emphasizing the susceptibility of semantic-level perception and communication in safety-critical contexts. The authors examine semantic adversarial perturbation assaults, wherein gradient-based perturbations are introduced into semantic features or perceptual outputs to provoke semantic misinterpretation at the receiver, notwithstanding the stability of standard signal-level metrics. These assaults employ iterative gradient-based techniques aimed at deep semantic encoders utilized in vision-oriented vehicular communication systems. The system is architecturally designed as an end-to-end vehicular semantic communication framework, incorporating perception modules, semantic encoders, wireless transmission, and task-oriented decoders, which mirror practical V2X and metaverse deployment scenarios. To address these concerns, the research provides semantic-aware defence mechanisms, including adversarial training, semantic consistency regularization, and robust feature alignment, which seek to stabilize semantic representations against adversarial perturbations. Experimental findings indicate that after an attack, semantic task accuracy declines by over 35–50%, but the suggested defences restore performance to within 5–10% of the clean accuracy. The defences diminish attack success rates by roughly 40–60% across various SNR levels, with relatively slight deterioration ($\approx 3$–$8\%$) in clean performance. The results indicate a distinct trade-off between security and performance, affirming that semantic resilience can be significantly enhanced with acceptable overhead. The study, although not utilizing extensive generative models like LLMs or diffusion networks, offers a quantitatively proven attack-defence analysis at the semantic layer, rendering it a pertinent security reference for semantic communication systems in automotive and immersive contexts.

The robustness against black-box assaults, in which the attacker lacks access to model parameters or gradients, is the main emphasis in [18] on the study of a secure semantic communication model for metaverse scenarios. The authors examine black-box semantic attacks that utilize query access to the semantic communication system to deduce decision limits and create perturbations that result in semantic misinterpretation and task failure at the receiver. These attacks are executed by systematically probing the system and refining perturbations based on output responses instead of internal gradients, rendering them feasible for real-world metaverse applications. The suggested system is architecturally designed as an end-to-end semantic communication framework, comprising a deep semantic encoder, a wireless transmission module, and a task-oriented semantic decoder, specifically developed for immersive metaverse applications. To counter black-box threats, the research presents a secure semantic communication model that integrates resilient semantic feature extraction, noise-aware semantic reconstruction, and defensive regularization to diminish susceptibility to adversarial queries and perturbations. Performance assessments indicate that baseline semantic communication systems experience task accuracy declines of about 30–45% under black-box attacks, while the proposed defence restores performance to within 5–10% of the clean accuracy level. The defence diminishes attack success rates by roughly 40–55% under various channel circumstances, incurring just a slight cost of approximately 5–8% regarding latency or reconstruction quality. The findings indicate that integrating security-conscious design at the semantic layer can markedly enhance resilience against realistic black-box attacks; however, the research does not address threats specific to Generative AI, such as LLM-based prompt manipulation or diffusion-driven semantic attacks, thereby presenting these as avenues for future investigation in GenAI-enabled semantic communication security research.

Table 3 compares representative studies on semantic adversarial and multi-domain threats by summarizing their threat focus, system setting, datasets, metrics, and key limitations.

Table 3. Comparative summary of Semantic adversarial and multi-domain threat studies.

Work	Threat Focus	System/Model	Dataset	Metrics	Comparative Takeaway
[31]	Embedding-level adversarial attack	BERT-based shared semantic encoder	SNLI	BLEU, cosine similarity	Strongly shows vulnerability of shared semantic encoders, but relies on a white-box setting and text-only evaluation.
[3]	Multi-domain adversarial attack	End-to-end autoencoder + semantic task classifier	MNIST	Task accuracy, MSE	More comprehensive than single-domain attacks because it perturbs both data and signal domains, but is validated on a simple dataset and offers limited defence analysis.
[36]	Semantic noise + adversarial robustness	R-DeepSC text SemCom	Europarl	BLEU, BERTScore	Stronger on robustness than attack novelty; useful for semantic-noise mitigation, but narrower than multi-domain or backdoor threat models.
[37]	Broad semantic security assessment	Federated semantic encoder/decoder framework	Case-study based	Membership inference accuracy, overhead	Broadest security coverage in this subgroup, but more conceptual than attack-specific and limited in GenAI-specific evaluation.
[38]	Adversarial semantic perturbation + defence	Vehicular semantic communication pipeline	Vehicular/metaverse scenario	Task accuracy, ASR	Strong attack–defence balance and more realistic safety-critical context, but not centered on LLM/diffusion-based GenAI settings.
[18]	Black-box semantic attack	Metaverse semantic communication model	Metaverse scenario	Task accuracy, ASR, latency/reconstruction cost	More practical threat model than white-box studies, but still limited in GenAI-specific analysis and broader multimodal validation.

Insight/Discussion: A cross-paper comparison shows three consistent patterns in this subgroup of studies. First, most attacks target semantic correctness while leaving conventional signal-level indicators relatively stable, confirming the mismatch between bit-level reliability and meaning preservation. Second, white-box assumptions remain dominant in many foundational studies, which strengthens attack effectiveness but limits realism, whereas black-box studies are fewer but more practically relevant. Third, experimental validation is still concentrated on text-oriented or relatively simple datasets, with only limited evaluation in richer multimodal or fully GenAI-native settings. Overall, the literature demonstrates that adversarial threats in semantic communication are already effective across multiple domains, but defence evaluation remains fragmented and often weaker than attack analysis.

3.2. Semantic Jamming and Anti-Jamming Strategies

This subsection groups works where the attacker injects interference aimed at degrading semantic fidelity, and defences rely on learning-based adaptation or semantic-layer robustness rather than physical-layer suppression.

The authors in [33] create an intelligent anti-jamming framework for UAV-assisted SemCom on mobile edge computing (MEC) networks, where message integrity and task offloading are seriously threatened by hostile interference. The primary concept is to utilize DeepSC-based semantic encoding at the UAV level and implement a DDPG algorithm to enhance job scheduling and transmission techniques in real-time. Deep Deterministic Policy Gradient (DDPG) is a reinforcement learning approach for continuous control challenges that employs an actor-critic framework to acquire optimum deterministic policies via environmental interaction. The system conceptualizes the UAV as an intelligent agent that concurrently evaluates semantic similarity, latency, energy expenditure, and jamming reliability to determine offloading decisions. Here, offloading decisions refer to determining whether semantic processing tasks are executed locally at the device, at an edge server, or in the cloud, based on latency, energy, and security constraints. The jamming model presumes variable interference power, where an external attacker injects controlled wireless interference to disrupt the semantic transmission channel without targeting specific model internals. The attack is black-box in nature, aimed at reducing the UAV’s ability to maintain high semantic similarity under channel noise and delay pressure. The UAV learns to adaptively modify power levels, task assignments, and encoding parameters in response to such interference. Experiments performed in a simulated UAV-MEC environment demonstrate that the suggested strategy enhances semantic similarity by as much as 18% and decreases the energy-delay product by 30% relative to baselines lacking semantic awareness or jamming resilience. The framework seeks to guarantee dependable and low-latency semantic communication in hostile wireless settings. The integration of SemCom and anti-jamming control is innovative in MEC settings; nonetheless, the study would benefit from validation under more intricate jamming models and varying mobility conditions.

Figure 5 represents the operation of semantic jamming and the application of anti-jamming mechanisms at the semantic layer. The pipeline initiates with source data, including text, graphics, or task-specific information, which the semantic encoder transforms into task-oriented semantic characteristics. The semantic jammer disrupts the semantic communication channel by interfering with meaning-bearing features, hence diminishing semantic similarity, while standard metrics like BER or PSNR being relatively stable. The red block in the picture underscores the primary assault point: semantic jamming interferes with task-relevant semantic representations prior to their reconstruction by the receiver. The green block illustrates the similar defences on the receiver’s side. Reinforcement learning-based adaptation, shown by DDPG, dynamically modifies transmission-related decisions, including power, rate, or offloading behaviour, to sustain semantic performance in the presence of jamming. Model ensembling, exemplified by ROME, enhances robustness by integrating several decoders or semantic reconstructions instead of depending on a solitary susceptible pathway. Adversarial or GAN-based training enhances the receiver by subjecting it to semantically distorted inputs during training, hence augmenting its capacity to discern the intended meaning. The retrieved semantic representation is subsequently transmitted to the task-oriented decoder and final task-output phase, where performance is assessed utilizing semantic metrics such as BLEU, METEOR, or semantic similarity. The figure underscores that anti-jamming in GenAI-SemCom must maintain semantic accuracy at the receiver, rather than only mitigating interference at the signal level.

Figure 5. Semantic jamming and learning-based anti-jamming in generative semantic communication systems.

The authors of [32] propose ROME (Robust Model Ensembling), a lightweight framework designed to improve the resilience of SemCom systems against jamming attacks. It comprises multiple independently trained semantic encoder–decoder pairs, each initialized differently to promote model diversity. At inference time, outputs are either aggregated or selectively chosen based on their robustness to interference, allowing semantic reconstruction without retraining or adversarial modeling. Unlike prior approaches that focus on signal-level defences, this method introduces a semantic-layer strategy that leverages model redundancy to mitigate the effects of jamming. The threat is modeled as a black-box jammer injecting signal noise to disrupt embedding quality without targeting the internal mechanics of the system. While the ensemble is assumed to be available at the receiver, no prior knowledge of the jammer’s strategy is required. Performance evaluation using BLEU and Metric for Evaluation of METEOR scores across varying jamming power levels shows up to 20% improvement in semantic fidelity over single-model baselines. This work introduces an effective, plug-in defence that advances SemCom robustness, though its limits under adaptive or transfer-based attacks remain unexplored.

For the purpose of modeling and mitigating semantic jamming assaults in text-based SemCom systems, the authors offer a GAN-inspired adversarial architecture in [39]. Conventional jamming methods focus on the physical layer; but, with SemCom, adversaries may seek to distort intended meaning without fully disrupting signal reception. The core objective of this architecture is to simulate intelligent semantic jamming and use it as a training framework to improve the robustness of semantic receivers. The central concept is to model the interaction between the attacker and the receiver as a generative adversarial game: the jammer functions as a generator that learns to craft semantic-level perturbations, while the receiver acts as a discriminator trained to identify adversarial versus legitimate inputs. This setup enables end-to-end adversarial learning to analyze vulnerabilities and optimize the defence algorithm. The underlying system employs a neural encoder–decoder model for text transmission, while the jammer generates perturbations using a reward function that penalizes semantic similarity (e.g., BLEU score) and complies with signal-to-interference ratio (SIR) constraints. Specifically, while the GAN formulation establishes the attacker–defender interaction framework, the jammer’s perturbation strategy is optimized through reinforcement learning using reward signals derived from semantic degradation (e.g., BLEU reduction) under SIR constraints. The attack assumes a white-box model where the jammer can access gradients or structure of the encoder to maximize semantic degradation. The receiver incorporates an adversarially trained classifier that filters or reconstructs tampered input. The experimental framework includes AWGN channels and evaluates across diverse interference-to-noise ratio (INR) levels using BLEU and semantic similarity metrics. Results show that the GAN-based jammer can reduce BLEU by up to 40%, while the defence mechanism restores 20–30% of semantic accuracy over unprotected baselines. This work demonstrates that adversarial modeling is a promising strategy for designing semantic-aware jamming defences in future AI-native wireless networks.

Table 4 summarizes representative semantic jamming and anti-jamming studies by comparing their threat focus, system setting, evaluation metrics, and main limitations.

Table 4. Comparative summary of semantic jamming and anti-jamming studies.

Work	Threat Focus	System/Model	Dataset/Setting	Metrics	Comparative Takeaway
[33]	Black-box semantic jamming in dynamic networks	DeepSC + DDPG-based UAV-MEC control	Simulated UAV-MEC environment	Semantic similarity, EDP	Strongest on adaptive resource control under jamming, but validated in a simulation-heavy setting with limited channel diversity.
[32]	Black-box jamming robustness	Ensemble of independently trained semantic encoder–decoder pairs	Text SemCom setting	BLEU, METEOR	Simpler and more deployable than retraining-heavy defences, but robustness against adaptive/transfer attacks is not shown.
[39]	White-box intelligent semantic jamming	GAN-inspired jammer + adversarially trained receiver	Text SemCom over AWGN	BLEU, semantic similarity	Most explicit attacker–defender modeling in this subgroup, but relies on white-box access and text-only evaluation.

Insight/Discussion: These studies show that semantic jamming differs from conventional interference because it targets meaning preservation rather than merely degrading signal quality. A clear pattern is that defences are shifting from physical-layer suppression toward semantic-layer adaptation, using reinforcement learning, diversity, or adversarial modeling. However, evaluation remains narrow: most works rely on text-centric or simulation-based settings, and only limited evidence is available for adaptive multimodal jammers or GenAI-native semantic decoders.

3.3. Backdoor and Poisoning Attacks on Semantic Models

This subsection covers training-time and inference-time poisoning attacks that implant covert behaviours into semantic communication systems, including generative and perception-driven pipelines.

The authors introduce CSBA (Covert Semantic Backdoor Attack) in [12], a novel attack framework that targets SemCom systems in ICVs. The research only examines the offensive aspect, seeking to illustrate that semantic-level feature poisoning can discreetly alter machine perception without activating conventional defence systems. In contrast to conventional backdoors that depend on observable input alterations, CSBA integrates triggers directly into the semantic feature space. The purpose is to eliminate a specific Semantic feature (e.g., a road sign or pedestrian) from reconstructed images while preserving overall visual quality, hence maintaining a high PSNR and remaining undetected. The architecture comprises three essential stages: Target Semantic Localization (TSL) employs DeepLabV3 to identify and delineate target semantics; Target Semantic Seamless Integration (TSSI) utilizes PLaMa (Patch-wise Latent Masking) for context-aware inpainting of the excised region; and Semantic Backdoor Model Poisoning (SBMP) introduces backdoor behaviour through adversarial fine-tuning on ostensibly pristine data. PLaMa facilitates seamless incorporation of masked regions into latent space, guaranteeing that semantic alterations do not produce discernible pixel-level artefacts. The assault is initiated solely under particular Semanticconditions, rendering it both selective and covert. The system is assessed on the Cityscapes dataset utilizing measures including PSNR, LPSNR, and ASR. Results indicate that ASR surpasses 80% in high SNR situations, with minimal PSNR loss, demonstrating the attack’s efficacy and inconspicuousness. The article emphasizes the necessity for more sophisticated semantic-level detection methods, as conventional defences are inadequate in identifying CSBA due to its hidden activation and execution within the feature space. This work introduces a novel and stealthy backdoor paradigm in SemCom, operating entirely in the semantic feature space. However, its dependence on pre-poisoned models and ideal attack conditions limits its applicability in well-controlled or real-time learning environments.

In Figure 6, GenAI-assisted semantic communication systems trigger backdoor and poisoning attacks. Raw multimodal input data like text, images, audio, or video is followed by semantic encoding, latent semantic representation, generative reconstruction, and task output or reconstructed semantics in traditional communication. The left red block highlights the initial assault site, training-time poisoning. During model training, corrupted samples, feature-level backdoor patterns, or adversarial fine-tuning techniques impart malicious behavior to the semantic encoder or latent feature space while appearing normal with benign inputs. This figure depicts CSBA, BASS, and covert backdoor attacks. Backdoor trigger activation is the second attack point, highlighted in red on the right. The detrimental activity is activated during inference by semantic, channel, or textual/output triggers. When activated, the generative semantic decoder reconstructs changing semantics, distorting output while maintaining PSNR or mIoU. The image indicates that semantic backdoors are difficult since the poisoning and activation stages are separated, making the attack covert and selective. The image shows that comprehensive defence must prevent poisoning during training and accurately detect triggers or semantic consistency during inference.

Figure 6. Backdoor and poisoning attacks on semantic representations in generative semantic communication systems.

Backdoor attacks and defences in deep learning–enabled semantic communication systems that directly modify reconstructed semantic symbols rather than downstream classification outputs are studied in [13]. The primary contribution lies in the introduction of an innovative attack framework known as Backdoor Attacks on Semantic Symbols (BASS). This approach specifically addresses high-dimensional semantic reconstruction tasks, including images, speech, and text, effectively surpassing the constraints of traditional backdoor attacks that are tailored for discrete labels. The study examines a conventional semantic communication framework that includes a semantic encoder, channel encoder, wireless channel, channel decoder, and semantic decoder. It illustrates how the introduction of poisoned training data at both the transmitter and receiver facilitates semantic manipulation, all while maintaining standard functionality with untainted inputs. From a defence perspective, the work suggests three countermeasures: a split-learning-inspired training framework that prevents separate dataset poisoning, a reverse-engineering method to estimate semantic backdoor triggers, and a pruning-based defence that eliminates backdoor-related neurons in the semantic encoder. Comprehensive simulations conducted on MNIST and CIFAR10 across AWGN channels demonstrate that BASS can notably modify reconstructed semantics even with minimal poison ratios, all while preserving excellent reconstruction quality for untainted samples. The quantitative findings reveal that defences based on pruning can restore between 67% and 99% of the performance for poisoned-data reconstruction, with a minimal degradation of approximately 2% on clean data. Additionally, the identification of triggers demonstrates impressive F1-scores exceeding 0.95, even at low poison ratios. Nonetheless, the research depends on transparent assumptions, centralized training oversight, and basic datasets, while assessing security mainly through PSNR instead of task- or perception-focused semantic metrics. The study concludes that semantic communication systems exhibit significant vulnerability to semantic-symbol backdoors; however, the defences available are largely dependent on specific models and settings. This underscores the absence of generalized, scalable, and adversary-agnostic defence frameworks applicable to real-world semantic communication scenarios.

A serious semantic-level security flaw that transcends classification tasks and reaches pixel-level semantic reasoning—the basis of semantic communication and perception systems—is exposed by this study’s [40] investigation of hidden backdoor attacks against semantic segmentation models. The authors illustrate that, from a security standpoint, contaminating a minor percentage of training data (about 10–20%) is adequate to establish covert backdoors that remain inactive on benign inputs but are consistently triggered by particular stimuli, resulting in targeted semantic alteration. The principal methodological addition is a nuanced backdoor assault paradigm, wherein just the pixels of designated objects are malevolently relabeled at the object level, rather than the entire image, facilitating more specific and less detectable attacks. The attack is model-agnostic and has been proven on many state-of-the-art segmentation networks, including DeepLabv3, DenseASPP, and DANet, demonstrating its generality. Experimental findings on the ADE20K dataset indicate that attack success rates surpass 75–99% with non-semantic triggers, while exhibiting minimal degradation (<1–2%) in benign mIoU and pixel accuracy, highlighting the covert nature of the attack. semantic triggers enhance invisibility, albeit at the expense of some offensive potency. While the paper does not suggest defences, it establishes a robust attack baseline and highlights a significant deficiency: current semantic and generative communication frameworks are vulnerable to training-time semantic backdoors, rendering this work a fundamental reference for security evaluations in semantic communication and GenAI-assisted perception systems.

Ref. [14] delves into a channel-triggered backdoor attack (CT-BA) that targets wireless semantic picture reconstruction, illuminating a serious and yet unexplored security risk in SemCom systems. From a security standpoint, the primary contribution is the development of implicit backdoor triggers integrated within wireless channel characteristics, including channel gain distributions and noise power levels, thereby obviating the necessity for explicit input manipulation and markedly improving attack stealth. The assault capitalizes on the differentiable characteristics of joint source–channel coding (JSCC) designs, enabling the automatic activation of hostile behaviour under particular channel conditions. The attack is assessed architecturally across various SemCom systems, including ViT-based JSCC, BDJSCC, ADJSCC, and JSCC-OFDM, indicating extensive applicability across CNN- and Transformer-based architectures. Comprehensive simulations on MNIST, CIFAR-10, and ImageNet demonstrate near-perfect attack success rates (about 99–100%), while maintaining clean-task performance with minimal deterioration in PSNR and semantic correctness. The findings further validate the resilience across bandwidth ratios, SNR ranges, and channel types (AWGN versus Rayleigh). The research briefly addresses a noise-titration-based detection technique but fails to provide thorough defences or tackle GenAI-specific risks, such multimodal backdoors or generating hallucinations. This study offers a robust attack baseline for semantic communication security, underscoring the critical necessity for channel-aware and architecture-aware defence mechanisms in forthcoming GenAI-enabled semantic communication systems.

By examining backdoor attacks on LLM-based semantic communication systems, the paper [16] highlights a serious security flaw at the nexus of Generative AI and semantic communication. The assault focuses on task-oriented semantic communication, utilizing semantic encoders derived from pretrained LLMs to extract and convey task-relevant meaning instead of mere symbols. The authors suggest a covert output-representation-level backdoor attack, wherein contaminated inputs with particular textual triggers are aligned with predetermined output representations during a subsequent pretraining phase, enabling harmful behaviour to endure across various downstream tasks post fine-tuning. The work examines semantic communication pipelines that integrate BERT/RoBERTa-based semantic encoders, joint source–channel coding modules, and task-specific decoders, rendering the threat model indicative of contemporary LLM-driven SemCom systems. Experimental assessments of sentiment analysis, spam detection, and abusive language detection tasks conducted over Gaussian and Rician channels reveal elevated attack success rates with a minimal quantity of poisoned samples, while preserving clean-task accuracy exceeding 90% throughout a broad signal-to-noise ratio spectrum. The findings indicate that the backdoor retains its efficacy despite prevalent mitigation strategies, including fine-tuning and model pruning, demonstrating significant stealth and persistence. Nevertheless, the paper fails to provide specific defence methods and does not investigate multimodal or diffusion-based generative models, hence rendering the development of effective backdoor detection and mitigation strategies for LLM-based semantic communication systems an unresolved issue.

Table 5 summarizes representative backdoor and poisoning studies in semantic communication by comparing their threat focus, system setting, datasets, metrics, and main limitations.

Table 5. Comparative summary of backdoor and poisoning studies in semantic communication.

Work	Threat Focus	System/Model	Dataset	Metrics	Comparative Takeaway
[12]	Covert semantic backdoor in latent space	DeepLabV3 + PLaMa-based SemCom pipeline	Cityscapes	ASR, PSNR, LPSNR	Most covert semantic-space attack in this subgroup; strong realism for perception tasks, but no concrete defence and dependence on poisoned training remain key limits.
[13]	Backdoor attacks on semantic symbols (BASS)	Generic semantic encoder/decoder pipeline	MNIST, CIFAR-10	PSNR, trigger F1, reconstruction recovery	Strongest attack-defence pairing here, but uses simple datasets and still measures semantics mainly through reconstruction-oriented metrics.
[40]	Hidden backdoor in semantic segmentation	DeepLabv3, DenseASPP, DANet	ADE20K	ASR, mIoU, pixel accuracy	Best evidence of model-agnostic training-time backdoors at pixel-semantic level, but does not offer defences.
[14]	Channel-triggered backdoor	JSCC, BDJSCC, ADJSCC, JSCC-OFDM	MNIST, CIFAR-10, ImageNet	ASR, PSNR, semantic correctness	Most novel trigger design because activation is hidden in channel conditions, but defence evaluation is weak and GenAI-specific risks remain open.
[16]	LLM-based semantic backdoor	BERT/RoBERTa-based semantic encoders + JSCC	Text tasks	ASR, clean accuracy	Most relevant to GenAI-native text SemCom, but lacks defence mechanisms and broader multimodal validation.

Insight/Discussion: A strong cross-paper pattern is that backdoor attacks in semantic communication are becoming increasingly covert: triggers move from visible inputs to latent features, channel conditions, and even output-representation spaces. Another clear trend is that attack evaluations are generally stronger than defence evaluations, with only a few works proposing concrete mitigation strategies. In addition, most results are still obtained on single-modality or simplified benchmarks, indicating that robust multimodal backdoor analysis in GenAI-assisted semantic communication remains underdeveloped.

3.4. Privacy Leakage, Semantic Eavesdropping, and Model Inversion

This subsection focuses on passive attacks where adversaries infer sensitive semantic content from transmitted representations, often amplified by generative reconstruction capabilities.

To address privacy vulnerabilities in SemCom systems, the authors of [30] suggest a layered design focused on developing a defence mechanism against semantic-level eavesdropping. The primary threat involves passive attackers leveraging access to either personal or global knowledge to infer sensitive meanings from transmitted content. The proposed architecture comprises a knowledge management layer that generates personalized knowledge graphs based on user context, and a data transmission layer that encodes input data through entity recognition, graph embedding, and mixed-token alignment. The mixed-token alignment approach integrates and aligns tokens from both private and global knowledge graphs into a unified semantic space to improve interpretability while concealing sensitive context. The attacker is modeled as a non-intrusive eavesdropper capable of observing encoded messages and possessing partial or full access to the global KB, enabling correlation-based inference. At the receiver, semantic reconstruction is executed utilizing aligned graph semantics to guarantee contextual accuracy while safeguarding private information. The authors assess their system through a detailed structural analysis of semantic leakage paths, comparing information exposure across different threat models—including global-only, personal-only, and hybrid knowledge scenarios. The objective is to facilitate context-aware SemCom while safeguarding sensitive information from inference assaults. The research presents a modular and extendable framework for knowledge-driven privacy in SemCom; nonetheless, its absence of empirical results from real-world datasets indicates a necessity for future validation in dynamic contexts.

The Cross-Layer Semantic Security Rate (CLSSR) is a newly proposed metric in [41] that quantifies security in SemCom systems by integrating both physical-layer confidentiality and semantic task reliability. CLSSR is designed to measure the effective secure transmission rate, considering how well a system preserves signal secrecy and semantic correctness simultaneously. The semantic data used in this study is text-based, and the system performs goal-directed tasks such as sentence classification, where successful task completion is the performance indicator. The primary concept is to close the disconnect between physical-layer protection and semantic-level robustness through dynamic cross-layer resource optimization. The system is formulated as a Markov Decision Process (MDP), where the transmitter adaptively modifies power allocation, beamforming vectors, and semantic encoding parameters to maximize CLSSR. The optimization task is solved as a Mixed Integer Nonlinear Programming (MINLP) problem, which jointly handles continuous and discrete variables under nonlinear constraints. A policy iteration algorithm, rooted in reinforcement learning, is used to refine action policies over time based on expected CLSSR improvement. Evaluation is conducted under Rayleigh fading channels with MIMO/MISO setups and demonstrates that CLSSR can improve by up to 295% compared to physical-layer-only approaches, achieving 100% task reliability under moderate noise. The adversary is modeled as an eavesdropper attempting to disrupt either semantic task outcomes or intercept meaningful content via channel inference. The attack is implicit, representing degradation of either semantic reliability or information leakage under unprotected transmission. This framework introduces a cross-layer optimization-driven approach to semantic security; however, its applicability to real-world settings may be constrained by idealized assumptions and limited semantic task diversity.

Figure 7 illustrates passive semantic eavesdropping and model inversion attacks, wherein adversaries extract sensitive information from transmitted semantic embeddings without disrupting the communication channel. Semantic-layer privacy protections, including obfuscation, artificial noise, and diffusion-based denoising, have been demonstrated to reduce leakage while maintaining task performance.

Figure 7. Privacy leakage and model inversion threats in semantic communication with semantic-layer privacy defences.

In [22], the authors present an energy-efficient SemCom framework for mobile networks by integrating and secure resource allocation. The work is defence-focused and targets the dual challenge of maintaining high semantic fidelity and physical-layer security while optimizing energy consumption. The architecture introduces a two-stage design: a semantic encoder powered by Generative AI to extract compact semantic features, and a secure transmission module that ensures information confidentiality via power allocation under probabilistic secrecy constraints. The generative component leverages diffusion-based models to improve semantic understanding, while transmission parameters are optimized using a hybrid optimization approach. A passive eavesdropper is assumed as the primary threat, aiming to intercept semantic representations. To counter this, the authors formulate a joint optimization problem for transmission power and semantic distortion, solved through convex-concave and alternating optimization techniques. Experiments conducted in mobile scenarios show that the proposed framework reduces energy consumption by up to 30% compared to baselines, while achieving higher BLEU and semantic similarity scores. This confirms that semantic-aware encoding can be effectively balanced with physical-layer secrecy constraints. However, the approach assumes accurate eavesdropper channel statistics and may require additional robustness under real-time mobility and channel uncertainty. This study contributes a scalable defence architecture that couples generative compression with secure, adaptive resource allocation. While the trade-off between latency and energy is addressed, future work could explore task-specific Semanticquality under dynamic adversarial conditions.

In order to show that semantic encoders are susceptible to privacy leakage even in the absence of decoder access, this work presents a very security-centric analysis of semantic communication under intelligent eavesdropping. The authors present model [9] inversion attacks, both glass-box and closed-box, which are further improved through the use of Generative AI (GAN-based priors). Their findings reveal that eavesdroppers can successfully reconstruct sensitive semantic content with a privacy inference success rate exceeding 80–100%, even in conditions of low signal-to-noise ratio (approximately 5 dB). The work in [31] is fundamentally based on a DeepJSCC-driven semantic communication system and presents an INN-driven framework for covert communication that integrates private semantic signals into harmless host signals at the channel-input level. Comprehensive analyses conducted on facial image datasets indicate that the suggested defence effectively lowers eavesdropping success rates to 0%, while maintaining a legitimate reconstruction quality with PSNR around 27.5 dB and minimal degradation in MS-SSIM. From a performance standpoint, the method upholds similar semantic integrity to unprotected systems. This work demonstrates a strong alignment with GenAI-SemCom security, presenting specific attack models, defences, and quantitative evaluations. However, it primarily concentrates on image modalities and presumes that legitimate users share encoder knowledge.

With an emphasis on semantic level robustness rather than bit-level reliability, ref. [21] introduces Secure SemComs, a security-oriented framework that aims to protect semantic communication systems from adversarial assaults. The research is driven by the recognition that current semantic communication models are significantly susceptible to adversary perturbations that distort semantic information and diminish reconstruction quality, even under optimal channel circumstances. The authors suggest a Dynamic Adversarial defence Framework (DADF) that functions as a plug-and-play module, eliminating the need for retraining the underlying semantic communication system. The framework comprises two principal components: Adversarial Pattern Learning (APL), which utilizes contrastive learning to identify and delineate adversarial noise patterns by aligning clean and adversarial semantic representations, and a Dynamic Noise Filter (DNF) that employs channel and spatial attention mechanisms to adaptively mitigate detrimental semantic noise before decoding. The defence is assessed on voice semantic communication systems (DeepSC-S and LSTM-based architectures) against several assaults, including FGSM, BIM, PGD, C&W AdvGAN, Gaussian noise, and masking attacks. Experimental findings indicate significant performance enhancements, achieving a reduction of up to 9.31× in MSE and an improvement of up to 269.78% in signal-to-distortion ratio (SDR) relative to unsecured systems, consistently surpassing adversarial training, denoising autoencoders, GAN-based defences, and self-distillation techniques across various attack scenarios. The findings validate the efficacy of dynamic semantic-level defence; however, the study is restricted to audio-based semantic communication, presupposes availability of adversarial samples for pattern recognition, and fails to consider threats specific to Generative AI, including prompt manipulation, multimodal backdoors, or cross-modal semantic assaults. Therefore, while our study establishes a robust and feasible defence baseline for semantic communication security, its relevance to wider GenAI-enabled and multimodal semantic communication systems remains an unresolved research topic.

By looking into how diffusion models can be used to improve the security of semantic communication, this investigation aims to keep semantic information safe from listening in attempts that focus on learnt representations rather than transferred symbols. The primary concept [10] involves the incorporation of artificial noise (AN) at the semantic transmitter, while utilizing denoising diffusion probabilistic models (DDPMs) at the legitimate receiver to retrieve high-quality semantic information, consequently impairing the eavesdropper’s semantic inference ability without substantially compromising legitimate communication. The authors architecturally develop paired pluggable encryption and decryption modules that can be dynamically included into existing semantic communication systems without necessitating the retraining of the entire transceiver, hence enhancing deployability. Two threat scenarios are examined: one in which the transmitter is unaware of the eavesdropper, mitigated through the application of artificial Gaussian noise with power optimized via deep reinforcement learning DDPG, and another where the eavesdropper’s model is known, tackled using adversarial residual networks (ARN) to produce targeted low-power perturbations. Comprehensive simulations on MNIST, CIFAR-10, and Fashion-MNIST indicate that the proposed method diminishes privacy leakage mutual information to nearly zero, reduces the eavesdropper’s classification accuracy to approximately 0.2, and sustains low communication mean squared error comparable to or superior to baseline semantic communication systems. The results additionally provide advantageous concealment, with perturbation power maintained below 10% of the signal power. The framework offers a robust and pragmatic defence against semantic eavesdropping and effectively incorporates generative models into security design; however, it is restricted to image-centric tasks and AWGN channels. It does not currently tackle multimodal GenAI threats, prompt-based attacks, or large-scale foundation models, which remain significant avenues for future GenAI-SemCom security research.

Secure semantic communication under explicit model inversion and adversarial attacks is examined [23], with particular attention to how these attacks are implemented, countered, and how they affect performance. The authors examine model inversion attacks, wherein the adversary utilizes access to transmitted semantic information or intermediate model outputs to recreate sensitive input data through optimization-based inversion and neural surrogate models. Furthermore, adversarial perturbation assaults are executed by introducing meticulously designed gradient-based noise into semantic representations during transmission, with the objective of provoking semantic misinterpretation at the receiver while exerting minimum impact on signal-level metrics. To mitigate these threats, the paper proposes a security-enhanced semantic encoding framework that incorporates three mechanisms: (i) privacy-aware feature obfuscation, which diminishes inversion-sensitive semantic dimensions; (ii) adversarial training, wherein semantic encoders are concurrently trained on both clean and adversarial samples to enhance robustness; and (iii) regularized representation learning, which limits mutual information between semantic features and sensitive inputs. These defence modules are architecturally integrated into the semantic encoder of an end-to-end semantic communication pipeline without modifying the physical-layer transmission mechanism. Experimental findings indicate that the suggested defences significantly diminish the success rates of inversion attacks while preserving elevated task accuracy and semantic reconstruction quality under adversarial perturbations, so illustrating a beneficial security-performance balance. The evaluation is confined to single-modality semantic tasks and fails to consider GenAI-specific threats, such prompt manipulation, diffusion-based perturbations, or multimodal backdoors, hence presenting these as avenues for future research in generative semantic communication security.

Studying semantic importance-aware transmission with LLM-based semantic correction, ref. [42] addresses security and privacy problems in Generative-AI-enabled semantic communication. This study is driven by the recognition that disparate protection of semantically significant tokens can exacerbate model inversion and semantic leakage attacks, wherein adversaries recreate sensitive source material from obtained semantic embeddings through auxiliary neural inversion models. The assault is executed by deriving inverse mappings from high-importance semantic features to the original text, revealing substantial privacy vulnerabilities under traditional unequal-level semantic communication (ULSC). The proposed system utilizes a ULSC framework that prioritizes tokens according to semantic significance and incorporates an LLM-based semantic correction module at the receiver to rectify damaged or suppressed semantics. To address privacy leaks, the authors propose a defence method assisted by semantic rectification, which deliberately diminishes inversion-sensitive semantic elements during transmission while depending on the generative capacity of LLMs to recover task-relevant meaning. Simulation outcomes regarding text transmission tasks indicate that the proposed method diminishes model inversion success rates by roughly 40–60%, while sustaining task accuracy above 90% and enhancing semantic similarity by 10–20% under low-SNR conditions in comparison to baseline semantic communication strategies. The findings underscore a beneficial security-performance balance, wherein anonymity is maintained without considerable compromise to semantic integrity. The study is confined to text-only scenarios and presumes non-adaptive adversaries, so leaving multimodal generative attacks and adaptive privacy concerns as unresolved challenges for future GenAI-enabled semantic communication systems.

With a particular emphasis on model inversion assaults and related semantic layer defences, this study explores privacy-preserving task-oriented semantic communication made possible by generative artificial intelligence. The authors [11] examine model inversion eavesdropping from an attack standpoint, wherein an adversary utilizes acquired semantic representations and supplementary generative priors to reconstruct confidential source content; this attack is executed by training inversion networks that translate semantic features back to the original data distribution. The system is architecturally designed as an end-to-end, task-oriented semantic communication pipeline that extracts semantic characteristics, transmits them over noisy channels, and reconstructs them for downstream tasks utilizing diffusion-based generative models. To counter inversion attacks, the paper introduces a diffusion-guided privacy-preserving defence that incorporates meticulously crafted perturbations into semantic representations at the transmitter, while utilizing the robust denoising and generative capabilities of diffusion models at the legitimate receiver to retrieve task-relevant information. This defence effectively diminishes the adversary’s inversion capability without substantially compromising semantic value. Performance assessments of image-based semantic tasks indicate that the proposed method decreases model inversion success rates by over 50%, while preserving high task accuracy (exceeding 90%) and minimal reconstruction error relative to unsecured semantic communication baselines across an extensive SNR range. The findings indicate a distinct trade-off between security and performance, demonstrating that diffusion-based reconstruction provides robust privacy protection with minimal degradation in semantic integrity. The paper presents a robust GenAI-driven attack–defence paradigm with quantitative validation; nevertheless, it concentrates on single-modality scenarios and neglects adaptive or multimodal generative attacks, hence reserving larger GenAI-SemCom security extensions for future research.

With a main focus on security efficacy and performance efficiency at the semantic layer, ref. [34] explores semantic-aware encryption for safe semantic communication in intelligent connected automobiles. The authors examine semantic eavesdropping and key inference attacks, wherein an adversary leverages transmitted semantic traits to deduce sensitive vehicle information or reconstitute task-relevant content without the necessity of fully decoding raw data. These attacks are implicitly facilitated by disparities in semantic significance and predictable feature configurations within semantic communication frameworks. The system is architecturally constructed on a comprehensive vehicular semantic communication framework, which includes a semantic encoder, a semantic-aware encryption module, wireless transmission, and a task-oriented decoder at the receiving end. To counter the highlighted concerns, the research presents a semantic-aware encryption system that selectively encrypts high-importance semantic properties instead of raw bitstreams, therefore minimizing information leakage while maintaining communication efficiency. The defence is executed by concurrently evaluating semantic significance scores and employing lightweight cryptographic operations, so circumventing the burden of complete encryption. Performance evaluations indicate that the suggested method markedly enhances semantic secrecy performance, diminishing semantic information leakage by around 40–60% relative to non-encrypted semantic transmission, while resulting in merely 5–10% increased latency or computing overhead. Furthermore, task accuracy and semantic fidelity are predominantly maintained under realistic vehicular channel conditions. The findings validate that selective, importance-aware encryption can proficiently reconcile security and efficiency in semantic communication systems; however, the study excludes Generative-AI-specific semantic encoders or attacks, thereby rendering GenAI-driven semantic security an unexplored research avenue.

There are security and privacy risks that come up when intelligent agents do planning, reasoning, and semantic generation during conversation. This paper looks into agentic and Generative-AI–enabled semantic communication. The authors explicitly model semantic eavesdropping and model inversion attacks, wherein adversaries leverage received semantic representations alongside generative and reasoning abilities to deduce sensitive source information or reconstruct private semantic intent. These assaults are executed through training inversion and inference agents that utilize shared semantic information and generative priors to optimize semantic leakage instead of bit-level recovery. The system [5] employs an agentic semantic communication framework, wherein both the transmitter and receiver utilize LLM-based agents tasked with semantic extraction, reasoning, and decision-oriented generation of compact semantic representations conveyed through noisy channels. The study advocates for a security-conscious agentic defence method that integrates semantic obfuscation, adaptive artificial noise injection, and agent-level semantic filtering, selectively mitigating privacy-sensitive semantics while maintaining task-relevant information. Comprehensive simulations indicate that the suggested defences diminish the success rates of model inversion and semantic inference attacks by roughly 40–60%, while preserving task success rates and semantic accuracy above 90% throughout a broad range of SNR. The findings provide a beneficial security–performance trade-off, indicating that agentic reasoning can effectively uphold semantic privacy with minimal loss in semantic accuracy, albeit with heightened computing complexity. The paper presents a quantitatively validated GenAI-driven attack-defence system, while identifying multimodal and large-scale adaptive agentic adversaries as unresolved concerns for future research in semantic communication security.

Insight/Discussion: A key pattern across these studies is that privacy leakage in semantic communication is no longer limited to passive interception of transmitted symbols; it increasingly arises from semantic embeddings, shared knowledge, and generative reconstruction priors. Another notable trend is that defences are moving toward selective protection, diffusion-assisted recovery, and semantic obfuscation rather than full raw-data protection. However, most evaluations remain single-modality, and only a small number of works consider adaptive adversaries, agentic reasoning, or large-scale multimodal privacy leakage.

Table 6 summarizes representative studies on privacy leakage, semantic eavesdropping, and model inversion by comparing their threat focus, system setting, evaluation metrics, and main limitations.

Table 6. Comparative summary of privacy leakage, semantic eavesdropping, and model inversion studies.

Work	Threat Focus	System/Model	Dataset/Setting	Metrics	Comparative Takeaway
[30]	Semantic eavesdropping via KB inference	Knowledge-assisted layered SemCom	Conceptual/structural analysis	Exposure analysis	Strong on privacy architecture, but lacks empirical validation on realistic datasets.
[41]	Cross-layer leakage and secure rate optimization	CLSSR-based cross-layer SemCom	Rayleigh MIMO/MISO setting	CLSSR, task reliability	Best metric-level integration of secrecy and semantics, but depends on idealized optimization assumptions.
[22]	Secure resource allocation against passive eavesdropping	GenAI-assisted encoder + secure transmission module	Mobile network scenario	BLEU, energy, secrecy rate	Strong security-efficiency coupling, but assumes accurate eavesdropper statistics.
[9]	Model inversion + intelligent eavesdropping	DeepJSCC + INN-based covert communication	Facial image datasets	Inference success, PSNR, MS-SSIM	Strongest explicit attack-defence evidence for inversion, but limited to image modality and shared encoder assumptions.
[21]	Adversarial semantic disturbance defence	DADF on voice SemCom	Audio setting	MSE, SDR	Strong plug-in defence performance, but not centered on GenAI-native multimodal threats.
[10]	Diffusion-enabled anti-eavesdropping defence	AN + DDPM receiver	MNIST, CIFAR-10, Fashion-MNIST	Leakage MI, eavesdropper accuracy, MSE	Most explicit generative defence against eavesdropping, but still image-centric and channel-limited.
[23]	Model inversion + adversarial perturbation defence	Security-enhanced semantic encoder	Single-modality settings	Attack success, task accuracy	Strong balanced defence design, but lacks GenAI-specific and multimodal evaluation.
[42]	Model inversion from important tokens	ULSC + LLM semantic correction	Text tasks	Inversion success, task accuracy, semantic similarity	Strong text-side privacy-performance trade-off, but assumes non-adaptive attackers.
[11]	Diffusion-aided inversion defence	Diffusion-guided task-oriented SemCom	Image tasks	Inversion success, task accuracy, reconstruction error	One of the clearest GenAI-native privacy defences, but still single-modality and not adaptive-attacker oriented.
[34]	Semantic eavesdropping and key inference	Semantic-aware encryption for vehicular SemCom	Vehicular scenario	Leakage, latency, task accuracy	Strong lightweight protection for selective semantics, but not fully GenAI-driven.
[5]	Agentic inversion and semantic inference	LLM-agent-based semantic communication	Agentic GenAI setting	Inversion success, task success, semantic accuracy	Most forward-looking privacy model in this subgroup, but computational cost and large-scale adaptive evaluation remain open.

3.5. Security of Knowledge Bases and Prompt-Driven Semantic Communication

This subsection addresses vulnerabilities introduced by shared knowledge bases, prompts, and semantic alignment mechanisms, which are central to GenAI-assisted semantic communication.

Figure 8 depicts the primary security threats and accompanying countermeasures for knowledge-base- and prompt-driven GenAI-assisted semantic communication. The pipeline starts with raw multimodal input data, processed by a semantic encoder utilizing CNNs, GenAI models, or LLMs. The encoded semantics align with shared knowledge and prompts before being input into the generative model, which reconstructs the final multimodal semantic output. The upper blue block illustrates three knowledge sources influencing this process: the source knowledge base, capturing user intent and context; the channel knowledge base, modeling transmission conditions; and the task knowledge base, defining task rules and semantic objectives. These knowledge bases facilitate semantic alignment while introducing extra attack surfaces. The initial identified risk arises during the prompt and knowledge alignment phase, where issues such as knowledge-base tampering, prompt injection, and semantic hallucination may lead to prompt or knowledge corruption. The second identified risk occurs during the generative reconstruction stage, where semantic leakage and model misuse may result from generated outputs, inference from shared knowledge, or unauthorized semantic reconstruction. The figure illustrates the primary defence mechanisms in the green block: knowledge access control, prompt validation and filtering, trusted execution environments, and adversarial or secure training. These defences seek to safeguard the knowledge-alignment and generative reconstruction stages, ensuring that the semantic output is valid, private, and consistent with the task. The figure highlights that in GenAI-SemCom, knowledge bases and prompts are active, security-critical elements that affect semantic correctness and privacy.

Figure 8. Security threats and defences in knowledge-base and prompt-driven generative semantic communication systems.

According to the authors of [28], knowledge bases (KBs) direct the creation, compression, and interpretation of meaning throughout the transmission chain in their Generative AI-driven architecture for semantic communication (SemCom). The fundamental concept is to reorganize semantic messages into triplets of {intent, knowledge, expression} and to use generative models—such as ChatGPT (version not specified), diffusion networks, and transformers—to generate and synchronize semantic representations between sender and recipient. The system has three interrelated knowledge bases: the source KB (which captures user intent and context), the task KB (which directs the expression or reconstruction of meaning), and the channel KB (which models communication conditions). These knowledge bases jointly provide personalized, multimodal, and task-specific content reconstruction, including the generation of pictures or video summaries from concise semantic tokens. The system assumes that semantic fidelity relies on alignment between shared knowledge and generative model behaviour, which introduces vulnerabilities. The attacker is modeled as either an internal adversary who tampers with the KB to manipulate semantic output, or an external observer who infers private content from reconstruction patterns. Threats include semantic hallucination, model misuse, and leakage of private knowledge through unintended generative output. Despite the lack of empirical validation, the concept is bolstered by comprehensive use examples (e.g., producing a Mona Lisa image from collective semantic intent) and underscores significant implementation issues such as synchronization, alignment, and efficiency. Security threats, including hallucination, adversarial exploitation, and knowledge base leaks, are recognized, with recommended countermeasures such as trusted execution environments (TEE) and adversarial training. The paper introduces a new conceptual framework for generative semantic communication, although its actual applicability requires validation through quantitative assessment.

Using multi-modal prompts for secure and accurate picture reconstruction, the authors of [43] suggest a new system called Generative AI-aided semantic communication (SemCom) that eliminates the requirement for collaborative training of the encoder and decoder. This study is centered on defence and tackles two primary challenges: significant computing demands arising from cooperative encoder-decoder training and security risks during prompt transmission. The proposed framework incorporates textual prompts extracted using the Multi-modal Mixture of Encoder-Decoder (MED), which applies contrastive and language modeling objectives. In addition, it employs visual prompts generated through Denoising Diffusion Implicit Models (DDIM), which capture image structure from Gaussian noise in latent space. Collectively, these multi-modal prompts provide precise message regeneration using conditional diffusion models without the necessity of paired training. To ensure the secure delivery of semantic prompts, the system adopts a covert communication strategy, where the transmission is intentionally designed to be undetectable to a potential eavesdropper. This is achieved through the use of a benign (friendly) jammer, which introduces controlled interference to mask the presence of communication. The adversary, referred to as the warden, is modeled as a passive detector that uses binary hypothesis testing to decide whether or not a transmission is occurring. To optimize system performance, the framework jointly adjusts the transmit power (referred to in the paper as “gearbox power”), the jamming power, and the number of diffusion steps, which represent how many iterations the generative model uses to reconstruct the target message. These parameters are efficiently tuned using a resource allocator built upon a GDM, which guides secure and low-profile prompt transmission under energy constraints. The threat model presumes a passive eavesdropper (warden) seeking to identify transmission activity, rather than interfering with semantic content. The evaluation results indicate that the suggested GDM-based scheme attains a higher SSIM, a perceptual metric ranging from 0 to 1 that measures the similarity between original and reconstructed pictures, achieving values as high as 0.9. It also reduces the bit error probability (BEP) under energy restrictions. In contrast to DRL-based baselines that utilize deep reinforcement learning for optimizing communication parameters through incentive feedback, the GDM-based approach provides expedited convergence and enhanced semantic correctness. The framework adeptly circumvents cooperative training while maintaining semantic integrity and hidden security. However, its dependence on generative models and meticulously designed prompts raises apprehensions regarding scalability to real-time, varied communication requirements.

In this research [4], we take a look at semantic communication systems that have been augmented with Generative AI from a security perspective, specifically at how the inclusion of these models is changing the semantic security concerns. The authors conduct a systematic survey of current security mechanisms, encompassing adversarial training for semantic encoders, privacy-preserving learning methods such as differential privacy and federated learning, semantic-aware physical-layer security, and prompt- and knowledge-based access control. This discourse pertains to strategies for mitigating semantic hallucination, prompt manipulation, model poisoning, semantic leakage, and inference threats posed by generative models, including LLMs, diffusion models, and GANs. The research examines GenAI-assisted semantic communication pipelines that incorporate generative encoders, shared knowledge bases, and prompt-driven semantic reconstruction, emphasizing how these architectural decisions broaden the attack surface at both the semantic and generative layers. Performance evaluations encapsulate documented advancements from previous research, highlighting enhanced semantic integrity and task accuracy in low-SNR environments, while acknowledge that these assessments are predominantly carried out in benign or non-adversarial contexts. The research critically notes numerous deficiencies in prior works: the lack of standardized benchmarks for semantic security, the absence of GenAI-specific defence mechanisms, inadequate adversarial evaluation across modalities, and insufficient consideration of adaptive and multi-domain attackers. The authors assert that although Generative AI markedly improves semantic communication capabilities, existing security solutions are disjointed and reliant on numerous assumptions, highlighting a distinct research deficiency in security-by-design frameworks, cohesive evaluation metrics, and resilient defences specifically designed for generative semantic communication systems.

Table 7 summarizes knowledge-base and prompt-driven semantic communication studies by comparing their threat focus, system setting, metrics, and key limitations.

Table 7. Comparative summary of knowledge-base and prompt-driven semantic communication studies.

Work	Threat Focus	System/Model	Dataset/Setting	Metrics	Comparative Takeaway
[28]	KB tampering, hallucination, semantic leakage	KB-enabled GenAI-SemCom architecture	Conceptual framework	Task-oriented examples	Strongest architectural framing of KB-centric risk, but remains largely conceptual without quantitative validation.
[43]	Secure prompt transmission/covert prompt delivery	MED + DDIM + GDM-based prompt SemCom	Image reconstruction setting	SSIM, BEP	Most concrete prompt-delivery defence in this subgroup, with good security-efficiency trade-off, but scalability to real-time diverse settings is unclear.
[4]	Survey of GenAI-induced semantic risks	GenAI-assisted semantic communication pipelines	Survey-based	Literature-level performance trends	Best for positioning broad prompt/KB security gaps, but not an empirical attack-defence study.

Insight/Discussion: These works indicate that knowledge bases and prompts are becoming central security objects in GenAI-assisted semantic communication, not merely supporting components. A clear distinction emerges between conceptual works that identify broad architectural risks and system-level works that address secure prompt delivery in more concrete settings. However, quantitative evaluation remains sparse, and prompt manipulation, KB poisoning, and trust management are still less systematically studied than adversarial or backdoor attacks in other parts of the semantic communication pipeline.

3.6. Generative-Model–Specific Vulnerabilities (Diffusion, LLMs, Multimodal Models)

This subsection isolates vulnerabilities that arise specifically due to generative models acting as semantic decoders, including diffusion processes, LLM reasoning, and multimodal foundation models.

The authors present a novel framework [29] for generative semantic communication that utilizes diffusion models. This approach is driven by the necessity to maintain semantic integrity even in challenging channel conditions, without depending on complete bit recovery. From a security standpoint, the study subtly tackles resilience against channel noise and semantic corruption by focusing on semantic layouts as the essential information to safeguard, rather than merely the raw pixel data. The suggested approach conveys significantly compressed semantic maps, which are subsequently utilized by a semantic diffusion model at the receiving end to recreate semantically coherent images, even in cases where the incoming data is substantially compromised. The framework integrates various architectural elements, including semantic segmentation, robust semantic compression, rapid denoising of received semantic maps, and conditional diffusion-based image synthesis, all enhanced with SPADE-based normalization. While not directly labeled as a counteractive strategy, the method enhances resilience to noise-induced semantic distortion, which can be viewed as a type of strength-focused semantic safeguarding. Experimental evaluations on Cityscapes and COCO-Stuff across a broad spectrum of PSNR conditions (ranging from 100 to 1) showcase impressive performance, with mIoU values reported to stay above 0.9 at moderate noise levels and maintaining competitiveness even in the face of extreme degradation. Additionally, SSIM and LPIPS (Learned Perceptual Image Patch Similarity) metrics consistently exceed the performance of both GAN-based and classical semantic image synthesis baselines. The framework demonstrates significant communication efficiency, decreasing the number of transmitted bits by around 90% via the transmission of binary semantic maps. Nonetheless, from a security perspective, the work fails to account for explicit attackers, semantic adversaries, or inference-based threats, and the assessments are confined to AWGN channels instead of addressing malicious perturbations. The authors assert that diffusion-based semantic communication greatly enhances robustness and efficiency; however, the absence of adversarial threat models, security metrics, and real-time feasibility analysis underscores critical gaps that need to be addressed in future research focused on security in semantic communication.

This paper [15] studies diffusion-model–based semantic communication under adversarial threats, explicitly positioning Generative AI as the semantic reconstruction engine and analyzing its security vulnerabilities. From a security perspective, the work formulates semantic-level adversarial attacks that target the generative diffusion process, showing that carefully crafted perturbations can significantly distort reconstructed semantics while preserving acceptable signal-level quality. The attack exploits the iterative denoising nature of diffusion models, where small adversarial biases injected into intermediate latent states accumulate across diffusion steps, leading to controlled semantic deviation at the receiver. Architecturally, the system adopts a diffusion-enabled semantic communication pipeline in which compact semantic representations are transmitted over noisy channels and reconstructed via conditional diffusion sampling. Performance evaluations on standard vision datasets demonstrate that, under attack, semantic similarity and task accuracy degrade sharply compared to benign settings, even when PSNR or MSE remains relatively stable, highlighting a mismatch between physical-layer and semantic-layer robustness. The results further show that increasing diffusion steps improves reconstruction quality in benign cases but also amplifies attack impact, revealing a trade-off between performance and security. While the paper provides a clear attack model and quantitative evaluation, it does not propose concrete defence mechanisms, nor does it analyze adaptive or multimodal threats. Overall, the study exposes a critical GenAI-specific attack surface in diffusion-based semantic communication, underscoring the need for security-aware generative design and robust defences in future GenAI-enabled SemCom systems.

In order to identify vulnerabilities brought about by generative language models in Semantic encoding and decoding, the present research examines SemPerGe (Semantic Perturbation Generator) [17], a security-focused framework for text-based adversarial assaults on semantic communication systems. In the offensive domain, SemPerGe utilizes LLM-driven semantic perturbation generation, wherein an adversary produces paraphrase- and prompt-based textual variations that maintain grammatical integrity and superficial meaning while provoking semantic interpretation in the recipient. The assault is executed by enhancing token replacements and rephrasing sentences while adhering to semantic similarity and fluency limitations, facilitating covert manipulation that evades syntactic and signal-level defences. The assaults are aimed at end-to-end text semantic communication systems that include pretrained language encoders, combined source-channel coding, and task-specific semantic decoders. The research presents an approach to enhance robustness against such attacks, utilizing semantic consistency regularization, contrastive representation alignment, and adversarial data augmentation, which together bolster resilience to created perturbations. Experimental findings indicate that the suggested defence significantly decreases attack success rates while preserving high task accuracy and semantic similarity, surpassing baseline resilience techniques across various assault intensities. However, the assessment is confined to text-based situations and presumes established attack patterns, hence rendering adaptive, multimodal, and large-scale GenAI attack defences as unresolved difficulties.

Looking into Generative-AI–enabled secure semantic communication, [44] focuses on how diffusion-based generative models change the attack surface and defence mechanisms at the semantic layer. The authors specifically address semantic eavesdropping and inference attacks, wherein an adversary utilizes received semantic representations and generative priors to reconstruct or deduce sensitive source information, along with semantic jamming, achieved by introducing structured perturbations that alter meaning rather than mere symbols. These attacks employ generative diffusion methods that iteratively enhance adversarial noise to optimize semantic leakage or reconstruction error at the receiver. The system employs a diffusion-assisted semantic communication pipeline, transmitting and reconstructing condensed semantic features through conditional diffusion models. This paper proposes a defence framework utilizing artificial noise injection and diffusion-guided denoising to mitigate these threats. Specifically, strategically crafted noise is introduced at the transmitter to obfuscate eavesdroppers, while the legitimate receiver employs a generative diffusion model to reconstruct high-fidelity semantics. Performance studies indicate that the proposed defence markedly diminishes information leakage and the accuracy of eavesdropper inferences, while preserving competitive semantic reconstruction quality and task performance in noisy channels. The findings underscore a distinct trade-off between security and performance, illustrating that diffusion models can concurrently improve robustness and facilitate effective semantic-level protection. The study concentrates on image-centric semantic tasks and neglects multimodal or prompt-based generative assaults, hence reserving larger GenAI-SemCom security scenarios for future research.

BackdoorVLM, the first broad benchmark for backdoor attacks on vision–language models (VLMs), [19] addresses a major security vulnerability in multimodal semantic systems. This study stresses security by investigating how concealed triggers in the training phase can cause malicious inference actions while retaining standard performance on untampered inputs. The document describes a modern VLM architecture with visual encoders, projection modules, and rich language models. Backdoor injections at the data and training stages are thoroughly examined. The benchmark divides multimodal backdoor threats into five attack objectives: targeted refusal, malicious injection, jailbreak, concept replacement, and perceptual hijack, which manipulate tokens, semantics, and perceptions. Extensive experiments using LLaVA-1.5-7B and Qwen2.5-VL-7B using COCO and VQAv2 datasets evaluate model performance (CIDEr, VQA accuracy) and attack efficacy. The results show that textual and bimodal backdoors can achieve attack success rates of 90–100% with poisoning rates as low as 1% while maintaining task performance. Visual triggers alone are more unstable and dependent on specific models, indicating a text-biased VLM backdoor activation. The research also demonstrates that bimodal backdoors often become text-based triggers, compromising multimodal learning balance. The benchmark provides detailed attack assessment and useful empirical insights, but it lacks systematic backdoor discovery and removal tools. Existing VLMs have significant and ongoing backdoor vulnerabilities, but the lack of defence benchmarks, real-world deployment analysis, and proactive mitigation strategies makes secure multimodal semantic communication systems difficult to develop.

Ref. [20] offer V-Attack, a focused adversarial attack tool for large vision-language models (LVLMs), which finds semantic-level vulnerabilities that patch-token-based attacks overlooked. The main idea is to manipulate Value (V) features in transformer attention blocks instead of entangled patch features. The authors demonstrate that these traits have higher entropy and localized meaning. Self-Value Enhancement refines local semantic representations by self-attention, while Text-Guided Value Manipulation uses cosine-similarity alignment to move value features from a source concept to a target concept. This study examines a transfer-based black-box attack using open-source (LLaVA, InternVL, DeepSeek-VL) and commercial big vision language models. Results show that V-Attack outperforms leading baselines in image captioning and VQA tasks by 30–40%, with ASR values ranging from 0.55 to 0.63 under conventional $ϵ={\displaystyle \frac{16}{255}}$ budgets and low ${\mathsf{\ell }}_1/{\mathsf{\ell }}_2$ perturbation norms. Research indicates that current preventive techniques (JPEG compression, Gaussian blur, dropout) only significantly reduce ASR (<20%), indicating weak semantic resilience. However, the study is aggressive, lacks a defence strategy, and relies heavily on LLM-driven automatic scoring, which raises evaluative bias and repeatability concerns. The assault also assumes substitute models’ intrinsic value features are available, which limits its applicability in closed systems. The architectural insight is strong, but real-time restrictions, physical-world transfer, and certified robustness are not considered, limiting the security implications.

The studies examines multi-modal task-oriented secure semantic communication utilizing a hide-and-deceive security framework, [45] concentrating on protecting semantic material from eavesdropping attacks while preserving task performance. The authors examine semantic eavesdropping from an attack perspective, wherein an adversary seeks to deduce task-relevant information (such as objects, intentions, or scene semantics) from intercepted semantic representations instead of raw signals. The system employs a multi-modal semantic communication framework that incorporates vision and text semantic encoders, joint source-channel transmission, and task-oriented semantic decoders, mirroring authentic multi-modal communication contexts. To mitigate eavesdropping, the paper proposes a dual-stage hide-and-deceive defence strategy: (i) hiding, wherein essential semantic features are selectively suppressed or obfuscated during transmission, and (ii) deceiving, in which meticulously crafted misleading semantic information is introduced to confound the eavesdropper while remaining retrievable by the authorized receiver. The defence is executed at the semantic representation level, independent of conventional cryptographic encryption. Performance tests on multi-modal task benchmarks indicate that the suggested technique decreases eavesdropper task inference accuracy by roughly 40–60%, while maintaining legitimate task performance above 90% under diverse SNR situations. Furthermore, the method entails just a negligible overhead (about 5–10%) in communication expenses relative to insecure semantic communication frameworks. The findings validate that semantic-level concealment and deception mechanisms can proficiently equilibrate security and performance in multi-modal semantic communication systems. However, the study does not explicitly utilize large-scale generative models, such as LLMs or diffusion networks, indicating that GenAI-driven deceptive semantics represents a promising avenue for future exploration.

Table 8 summarizes generative-model-specific vulnerabilities in semantic communication by comparing their threat focus, system setting, metrics, and key limitations.

Table 8. Comparative summary of generative-model-specific vulnerabilities in semantic communication.

Work	Threat Focus	System/Model	Dataset/Setting	Metrics	Comparative Takeaway
[29]	Diffusion-based semantic reconstruction robustness	Diffusion semantic decoder + SPADE-based synthesis	Cityscapes, COCO-Stuff	mIoU, SSIM, LPIPS	Strongest baseline for diffusion-enabled reconstruction quality, but lacks explicit adversarial threat modeling.
[15]	Latent manipulation in diffusion steps	Diffusion-enabled semantic communication	Vision datasets	Semantic similarity, task accuracy, PSNR/MSE	Most explicit diffusion-specific attack study, showing generative steps as an attack amplifier, but without concrete defences.
[17]	LLM-driven semantic perturbation	Text semantic communication with pretrained language encoders	Text setting	Attack success, task accuracy, semantic similarity	Strong text-side attack-defence balance, but remains limited to known attack patterns and unimodal evaluation.
[44]	Diffusion-based eavesdropping and jamming defence	Diffusion-assisted secure semantic transmission	Image setting	Leakage, inference accuracy, reconstruction quality	Strong GenAI-specific defence design, but not multimodal and not prompt-oriented.
[19]	Multimodal backdoor benchmark	LLaVA-1.5-7B, Qwen2.5-VL-7B	COCO, VQAv2	ASR, CIDEr, VQA accuracy	Strongest multimodal benchmark evidence, but lacks defence-side benchmarking and mitigation tools.
[20]	Value-feature adversarial attack on LVLMs	LVLMs including LLaVA, InternVL, DeepSeek-VL	Captioning/VQA settings	ASR, caption/VQA performance	Strong architectural insight for black-box multimodal attacks, but relies on substitute-feature assumptions and limited defence analysis.
[45]	Hide-and-deceive multimodal defence	Vision-text task-oriented secure SemCom	Multimodal task benchmarks	Eavesdropper inference accuracy, task accuracy, overhead	Strong security-performance balance for multimodal protection, but not fully GenAI-native in the LLM/diffusion sense.

Insight/Discussion: A major trend in this subgroup is that generative models are no longer only improving reconstruction; they are also creating new attack surfaces at the latent, reasoning, and multimodal alignment levels. Diffusion models appear in both roles, serving as high-quality semantic decoders and as attack amplifiers or privacy-defence mechanisms. Another important pattern is modality imbalance: text and image settings are increasingly studied, but fully integrated multimodal defence evaluation remains limited. Overall, the literature confirms that generative-model-specific vulnerabilities are now a central part of semantic communication security rather than a peripheral concern.

3.7. Survey and Positioning Works on Semantic Communication Security

This subsection summarizes survey and perspective papers that highlight open challenges, limitations, and research gaps rather than proposing concrete attacks or defences.

This work examines resource management, security, and privacy concerns in semantic communication systems, driven by increasing evidence that task-oriented semantic transmission can surpass traditional bit-level communication when resources are limited. The primary objective of [24] is to investigate learning-based semantic communication frameworks that concurrently maximize power allocation, bandwidth utilization, and compute offloading alongside semantic encoders and shared knowledge models. Instead of introducing novel algorithms, the paper consolidates experimental and simulation findings from previous studies, indicating that semantic-aware resource management generally enhances task accuracy by 10–35%, decreases latency by 20–50%, and realizes energy savings of 15–40% relative to conventional source–channel separation, contingent upon modality and task. Image-based research often indicate SSIM enhancements ranging from 0.75 to over 0.9, but text-based systems demonstrate significant advancements in semantic similarity and BLEU scores in low-SNR environments. The survey notably emphasizes that these advancements frequently depend on robust assumptions, such as fixed workloads, reliable shared models, and uncomplicated adversarial conditions. The authors assert that, despite evident performance advantages, existing research is deficient in standardized benchmarks, comprehensive cross-layer security assessments, and cohesive privacy-conscious resource optimization, thereby necessitating resource-security co-design as a critical pathway for scalable and reliable semantic communication systems.

The present paper provides a comprehensive survey of secure semantic communications, with the objective of examining the evolution of security and privacy considerations as communication paradigms transition from bit-level reliability to semantic information exchange. The survey encompasses the entire semantic communication pipeline, comprising semantic extraction, representation learning, model sharing, and semantic transmission, wherein shared encoders and knowledge bases significantly broaden the attack surface. The paper examines a wide array of methodologies, including adversarial training for semantic encoders, differential privacy for safeguarding semantic representations, cryptographic strategies for model and knowledge exchange, semantic-aware physical-layer security mechanisms, and blockchain-based trust management. Although the scope is extensive, the survey is predominantly descriptive and offers minimal quantitative or systematic comparison of these strategies. Findings from the examined literature [25] indicate that secure semantic communication frameworks can enhance task accuracy and semantic similarity by roughly 10–30% in adversarial environments, attain SSIM values surpassing 0.85–0.9 for secure image transmission, and diminish semantic inference or leakage success rates by 20–50% relative to unsecured benchmarks. Nonetheless, these performance enhancements are often realized under stringent conditions, such as reliance on trusted shared models, static jobs, and passive adversaries, and frequently result in significant increases in energy consumption, latency, or model complexity. Furthermore, assessments are generally performed in discrete point-to-point contexts, constraining understanding of network-level scalability and inter-layer interactions. The paper emphasizes that current security techniques are frequently developed in isolation from resource management and semantic goals, resulting in disjointed solutions. Thus, while the documented advantages, the survey reveals an absence of cohesive standards, defined semantic security measurements, and practical large-scale experimental validation. These deficiencies suggest that existing safe semantic communication solutions are not adequately developed for implementation, highlighting the necessity for integrated, cross-layer, and evaluation-oriented security frameworks.

This work presents a comprehensive examination of semantic communication networks, focusing on the security and trust issues that emerge from the exchange of semantic-level information. Additionally, [26] explores the foundational architectures and the associated performance advantages. The research emphasizes that semantic communication depends on common semantic encoders, acquired representations, and knowledge bases, which bring forth new security challenges absent in traditional bit-level systems. From an architectural perspective, the document explores deep autoencoder-based end-to-end semantic systems, transformer-driven semantic encoders, generative reconstruction models, and semantic-aware networking mechanisms; however, these designs are primarily examined from an efficiency standpoint rather than a security-by-design perspective. Concerns regarding security, including semantic leakage, model inference attacks, unauthorized knowledge exploitation, and resilience against adversarial manipulation, are examined conceptually, highlighting semantic representations and shared models as key areas of vulnerability. The document lacks formalization of attack models or the proposal of specific defence mechanisms; however, it provides an overview of performance outcomes from previous studies, indicating improvements in task accuracy or semantic similarity ranging from 15–40%, bandwidth savings of 20–50%, and SSIM enhancements from around 0.75 to over 0.9 under limited conditions. The findings highlight the efficiency benefits of semantic communication; however, the analysis points out that many assessments rely on trusted models, fixed tasks, and safe environments, which restrict understanding of adversarial resilience. The authors conclude that while semantic communication networks provide notable performance improvements, existing research is deficient in systematic security evaluations, standardized metrics for semantic security, and cohesive defence frameworks. This highlights that the design of security-aware architectures and thorough adversarial assessments are still largely unresolved issues.

The following article provides a comprehensive examination of semantic communications, highlighting security and robustness as emerging yet underexplored challenges in the ongoing advancement toward 6G semantic-aware networks. From a security standpoint, the document [46] emphasizes that systems based on semantic communication depend significantly on shared semantic representations, semantic knowledge bases, and deep learning models. This reliance inherently brings about risks such as semantic leakage, semantic distortion, privacy exposure, and a decline in robustness when faced with mismatched knowledge or noisy environments. The survey examines Seb-based semantic communication frameworks that incorporate semantic encoders and decoders, as well as SKB sharing, both local and cloud-based, along with semantic-aware transmission pipelines. However, the evaluation of these architectures focuses mainly on efficiency and intelligence, rather than their resilience against adversarial challenges. This document encapsulates the performance enhancements documented in various studies, highlighting reductions in transmitted data by 20–50%, improvements in task accuracy ranging from 15–40%, and increases in SSIM from approximately 0.75 to over 0.9, especially within the contexts of image and multimodal semantic communication. Although these findings highlight significant advantages in efficiency and reconstruction, the analysis points out that many assessments rely on the assumption of favorable channels, reliable SKBs, and unchanging tasks. Discussions surrounding security tend to stay at a theoretical level, lacking established attack models, implemented defences, and measurable security metrics, apart from indirect indicators like semantic distortion and reconstruction quality. The authors assert that while there have been significant advancements in architecture and performance, the field of semantic communication is still deficient in robust security frameworks, established threat models, and evaluation methods focused on defence. Consequently, ensuring semantic security, protecting SKB, and enhancing resilience against adversarial attacks remain critical challenges that require further investigation in future studies.

This paper reviews the applications of Generative AI (GAI) within mobile and wireless networking contexts, emphasizing that security and trust have become overarching considerations across GAI-enabled network functionalities. From a security standpoint, ref. [47] emphasizes that GAI models—employed for traffic prediction, channel modeling, network optimization, and content generation—bring forth new risks, such as data leakage during training, model inversion, poisoning, hallucination-driven misinformation, and heightened attack impact due to generative priors. The survey examines the architectural integration of GAI within network stacks, focusing on foundation models, diffusion models, GANs, and LLMs utilized at the edge, in the cloud, or through collaborative efforts. The primary aim is to enhance efficiency and automation, rather than to prioritize security-by-design. Summarized performance results from previous studies highlight improvements, including 15–40% enhancements in prediction accuracy, 20–50% decreases in signaling or resource overhead, and quicker convergence relative to rule-based or discriminative baselines, especially in dynamic settings. Nonetheless, these advantages are usually confirmed under favorable conditions with restricted testing against adversarial scenarios. The discussion on privacy-preserving learning, robustness, and trustworthiness highlights significant challenges; however, the exploration of attacks and defences tends to be mostly theoretical, lacking in specific threat models or measurable security metrics. The authors conclude that while GAI significantly improves network performance and flexibility, the absence of systematic security evaluation, standardized benchmarks, and adversary-aware design renders current GAI-enabled networking solutions susceptible to vulnerabilities. This highlights the necessity for integrated security frameworks and thorough adversarial assessment in conjunction with architectural innovation.

The current investigation surveys goal-oriented semantic communication techniques, focusing on how task objectives influence communication system design and bring new security and robustness problems. The work [48] emphasizes that, from a security standpoint, goal-oriented systems prioritize task achievement over accurate data reconstruction, thereby heightening susceptibility to semantic manipulation, goal hijacking, and adversarial perturbations that can misdirect subsequent decision-making without apparent signal distortion. The survey examines goal-oriented semantic frameworks that utilize deep reinforcement learning, autoencoder-based semantic encoders, and task-aware decoders, optimizing communication, perception, and control in unison. Performance outcomes derived from previous studies demonstrate that goal-oriented semantic communication can realize reductions in communication overhead by 20–50%, enhancements in task completion rates by 15–40%, and increased resilience to channel noise relative to conventional semantic-agnostic systems. Nonetheless, these advantages are mostly assessed within cooperative and favorable conditions, presuming reliable actors, consistent objectives, and non-hostile situations. The paper recognizes security-related issues, including robustness, dependability, and trust, although it fails to describe attack models or assess defences against semantic-level adversaries aimed at task objectives. As a result, security conversations are predominantly abstract and qualitative, lacking a quantitative evaluation of attack impact or response efficacy. The authors assert that while goal-oriented semantic communication provides substantial performance and efficiency benefits, the absence of adversarial threat modeling, security-conscious evaluation metrics, and defence strategies constitutes a considerable deficiency, rendering secure and reliable goal-oriented semantic communication an unresolved research challenge.

With a focus on security flaws caused by deep learning-driven semantic processing, this study [49] offers a prospective evaluation of 6G’s semantic and task-oriented communications (TOC). The authors clearly delineate adversarial machine learning (AML) threats as a significant security risk, demonstrating that semantic encoders and multi-task learning (MTL) frameworks are susceptible to adversarial, poisoning, and backdoor attacks targeting both the encoder input and over-the-air signal levels. The paper presents an MTL-based SemCom architecture that incorporates task execution, semantic validation, information reconstruction, and integrated sensing and communication (ISAC), wherein several DNN decoders function collaboratively at the receiver. Performance assessments on CIFAR-10 under AWGN and Rayleigh channels indicate that TOC and SemCom substantially surpass traditional communication methods, attaining superior task accuracy and diminished reconstruction loss at extreme compression ratios (e.g., decreasing input dimension from 3072 to 20, approximately 0.65%). Security experiments utilizing FGSM-based adversarial attacks demonstrate a significant decline in task accuracy as the perturbation-to-signal ratio escalates. However, augmenting the encoder output dimension nc can partially alleviate the impact of these attacks, enhancing task accuracy under assault by approximately 47% in Rayleigh channels, albeit at the expense of increased latency and complexity. The research presents specific attack examples and examines defences like adversarial training, federated learning, and anomaly detection, although it fails to develop or evaluate full protection methods. The study is pertinent as it connects semantic communication, performance enhancements, and explicit security vulnerabilities; yet, it lacks sufficient defences and fails to handle GenAI-specific risks such as prompt manipulation or generating hallucinations.

This study presents a security-focused assessment of semantic communication systems, emphasizing the impact of semantic-layer attacks and defences on system performance, while also addressing architectural implications. The paper systematically classifies semantic-level threats from a security standpoint, encompassing semantic eavesdropping, inference attacks, poisoning/backdoor attacks, and robustness degradation due to distribution shifts, emphasizing that these attacks focus on meaning extraction and task execution rather than symbol recovery. The presented attack mechanisms primarily utilize learned semantic representations and shared knowledge bases, allowing attackers to deduce private information or influence subsequent decisions, despite the stability of traditional BER/PSNR measurements. Ref. [27] examines end-to-end semantic encoder-decoder pipelines, knowledge-based semantic communication, and task-oriented semantic frameworks, elucidating how architectural decisions (such as shared semantics, unequal protection, and task-driven decoding) increase the attack surface. This paper examines various defensive strategies, including adversarial training, semantic noise injection, privacy-preserving representation learning, federated semantic learning, and cryptographic protection of semantic features, detailing how each approach addresses specific attack vectors while incurring greater complexity or diminished efficiency. Summarized performance results from previous studies demonstrate that good defences can diminish semantic inference or leakage risks by 30–60%, while generally resulting in a 5–15% decline in task accuracy or increased latency, highlighting a distinct security–performance trade-off. The paper, while not presenting novel algorithms or experiments, provides a critical analysis of existing methods and concludes that current defences are deficient in standardized benchmarks, GenAI-specific threat modeling, and unified evaluation metrics. It emphasizes the necessity for security-by-design architectures and performance-aware semantic security frameworks, which directly align with the primary objective of your survey.

Along with developments in architecture and performance, this study [50] provides a comprehensive overview of the field of semantic communication research, highlighting the growing yet under-researched issues of security and resilience. From a security perspective, the document highlights that semantic communication depends on shared semantic representations, learning-based encoders/decoders, and external knowledge, which together make systems vulnerable to risks like semantic leakage, inference attacks, data poisoning, and robustness degradation under distribution shifts. This survey examines various notable frameworks in semantic communication, such as autoencoder-based end-to-end designs, knowledge-assisted semantic encoders, and task-driven semantic reconstruction pipelines. The focus is primarily on enhancing efficiency and intelligence, rather than on adversarial resilience. Insights drawn from previous studies reveal enhancements in task accuracy ranging from 15–40%, reductions in bandwidth or data rate between 20–50%, and significant improvements in semantic similarity and SSIM for vision-related tasks when contrasted with traditional source–channel separation methods. Nonetheless, these findings are primarily derived from favorable conditions, such as reliable shared models, fixed tasks, and non-hostile settings. The document addresses issues like robustness, reliability, and trustworthiness; however, it approaches security threats in a general manner, lacking formal attack models, clear defence strategies, or quantitative assessments of security. As a result, the survey fails to provide a systematic comparison of security techniques and does not set standardized metrics for assessing semantic security. The authors assert that while semantic communication demonstrates significant architectural and performance promise, the lack of adversarial threat modeling, defence-focused design, and extensive realistic validation presents a crucial shortcoming, suggesting that security-conscious semantic communication is still in its nascent and disjointed phase.

Table 9 summarizes representative survey and positioning works on semantic communication security by comparing their focus, coverage, evidence type, discussed metrics, and key limitations.

Table 9. Comparative summary of survey and positioning works on semantic communication security.

Work	Main Focus	Coverage Scope	Evidence Type	Metrics Discussed	Comparative Takeaway
[24]	Resource, security, and privacy co-design	Learning-based semantic communication systems	Survey synthesis	Task accuracy, latency, energy, SSIM/BLEU trends	Strongest on resource-security coupling, but limited in adversarial depth.
[25]	Secure semantic communications survey	End-to-end secure SemCom pipeline	Survey synthesis	Task accuracy, semantic similarity, SSIM, leakage trends	Broad security coverage, but mostly descriptive and lacking systematic comparison.
[26]	Architecture, security, and privacy of semantic networks	Semantic communication networks	Survey synthesis	Task accuracy, bandwidth, SSIM trends	Strong architectural overview, but weak formal attack/defence specification.
[46]	Advances and challenges in semantic communication	General semantic communication frameworks	Review/positioning	Data reduction, task accuracy, SSIM trends	Useful for identifying high-level security gaps, but defence-side evaluation is limited.
[47]	GAI in mobile/wireless networking	Broader GAI-enabled networking systems	Survey synthesis	Prediction accuracy, overhead, convergence trends	Strong GenAI context, but not specific enough to semantic communication security.
[48]	Goal-oriented semantic communication	Task-driven semantic systems	Survey synthesis	Overhead, task completion, robustness trends	Strong task-oriented positioning, but mostly qualitative on security.
[49]	Secure task-oriented/6G semantic communication outlook	TOC, MTL, ISAC-driven SemCom	Perspective + experiments	Task accuracy, reconstruction loss	Strong link between security and future 6G systems, but limited full-defence development.
[27]	Semantic radio access networks	End-to-end and knowledge-based semantic systems	Survey/critical positioning	Leakage reduction, task-accuracy cost, latency trade-off	Strongest security-performance trade-off discussion, but no new empirical benchmark.
[50]	Research landscape and challenges	Broad semantic communication field	Survey synthesis	Task accuracy, bandwidth, semantic similarity, SSIM trends	Useful general positioning reference, but security treatment remains high-level.

Insight/Discussion: Taken together, these survey and positioning works consistently show that security is now recognized as a core issue in semantic communication, but most still treat it as an extension of efficiency-oriented design rather than a primary architectural principle. Another common pattern is that many surveys discuss vulnerabilities and defences conceptually, yet few provide unified benchmarks, rigorous cross-paper comparison, or GenAI-specific threat modeling. This gap directly motivates the need for a more security-centric and GenAI-aware synthesis, which is the role of the present survey.

4. Discussion

4.1. Key Vulnerabilities and Threat Patterns in Generative SemCom

From the reviewed literature, several recurring themes emerge that collectively characterize the security landscape of Generative AI-assisted semantic communication (SemCom). A central issue concerns the use of shared semantic encoders. As demonstrated in [31], embedding-level adversarial attacks exploit widely shared encoders such as BERT, where minor perturbations can significantly degrade semantic fidelity. While shared encoders offer efficiency and interoperability, they simultaneously introduce a single point of failure. This observation highlights a fundamental trade-off between scalability and robustness in semantic system design.

Another prominent theme is knowledge-assisted semantic eavesdropping. Studies such as [28,30] illustrate how adversaries can leverage shared knowledge bases, priors, or contextual alignment mechanisms to infer sensitive information from semantic representations. Unlike conventional data leakage, semantic-level exposure enables the inference of user intent and high-level meaning even when surface-level content remains protected.

The emergence of concealed semantic triggers introduces an additional and particularly insidious threat vector. The covert semantic backdoor attack (CSBA) presented in [12] demonstrates how malicious manipulations can remain dormant and undetectable until activated under specific semantic conditions, especially in intelligent vehicle environments. Such attacks expose the limitations of existing detection strategies, which often focus on distributional or signal-level anomalies while overlooking context-dependent semantic manipulations.

4.2. Limitations of Existing Defence Mechanisms

Robustness through model diversity represents a recurring defensive insight in the literature. The ROME framework in [32] shows that aggregating outputs from independently trained encoder–decoder models can enhance resilience against jamming and adversarial interference. Ensemble-based approaches reduce reliance on a single semantic pathway and introduce redundancy at the representation level. However, their deployment in distributed and resource-constrained environments raises practical concerns related to synchronization overhead, storage requirements, and coordination complexity.

Beyond individual defence mechanisms, a broader pattern emerges from resource-aware and optimization-focused studies. semantic security is frequently treated as an auxiliary constraint rather than a core architectural objective [24,25,26,46,50]. While metrics such as task accuracy, bandwidth efficiency, and energy consumption are commonly reported, adversarial robustness is often assumed or evaluated under simplified threat models.

A further concern arises from the imbalance between increasingly sophisticated attacks and comparatively limited defensive frameworks. Several attack-centric studies deliberately focus on exposing vulnerabilities related to backdoors, latent manipulation, and channel-triggered threats without proposing corresponding defences [14,15,16,40]. Existing defensive approaches, including adversarial training and pruning, often remain tightly coupled to specific models or datasets, limiting their generalizability [13,36].

4.3. Security Challenges Unique to Generative AI in SemCom

Generative AI introduces security concerns in semantic communication that differ from traditional signal-level or encoder-level risks. As noted by Xia et al. [6] and Ren et al. [4], GenAI-assisted semantic communication relies not only on transmitted semantic representations but also on generative priors, knowledge alignment, and model-driven reconstruction. This shifts the security problem from protecting transmitted symbols alone to securing the full semantic generation process.

A primary challenge is prompt injection and prompt manipulation. In the knowledge-base-enabled framework of Ren et al. [28], shared knowledge and generation guidance directly influence semantic reconstruction, which makes prompt-conditioned generation security-critical. Likewise, Du et al. [43] show that prompt-driven semantic communication depends heavily on secure prompt transmission and controlled generative recovery. These studies indicate that malicious prompt alteration can bias decoding, trigger unintended outputs, or expose sensitive information.

A second challenge is hallucination-induced semantic distortion. Ren et al. [28] explicitly identify hallucination and knowledge-base misuse as risks in generative semantic communication, while Ren et al. [4] discuss how GenAI-based reconstruction may produce plausible yet semantically unreliable outputs. In semantic communication, this creates a serious mismatch: the reconstructed result may appear coherent even when it no longer preserves the original task-relevant meaning.

A third challenge is diffusion model vulnerability. Grassucci et al. [29] show the growing importance of diffusion-based reconstruction in semantic communication, but later security-oriented studies reveal the associated risks more clearly. For example, Wang et al. [11] study model inversion in diffusion-aided task-oriented semantic communication, while Xi and Zhu [15] show that latent manipulation can distort semantic meaning through the diffusion process itself. Together, these works show that diffusion models improve reconstruction quality but also expand the semantic attack surface.

A fourth challenge is cross-modal security risk. Chen et al. [7] highlight the increasing role of cross-modal and generative semantic communication, where multiple modalities are semantically aligned during transmission and reconstruction. In parallel, Li et al. [19] and Nie et al. [20] demonstrate that multimodal foundation models remain vulnerable to backdoor and adversarial attacks that propagate across visual and textual reasoning pathways. This suggests that, in GenAI-assisted semantic communication, attacks may no longer remain confined to a single modality or representation space.

Overall, the surveyed literature indicates that Generative AI does not simply add new tools to semantic communication; it changes the nature of the security problem. As emphasized by Ren et al. [4], secure GenAI-SemCom must account for prompt manipulation, hallucinated semantic drift, diffusion-space vulnerabilities, and multimodal attack propagation in addition to conventional perturbation and eavesdropping threats.

4.4. Challenges in the Evaluation of Semantic Security

The surveyed literature indicates that evaluation remains one of the weakest aspects of secure semantic communication research. Classical communication metrics such as BER, PSNR, and MSE are still widely used because they quantify signal fidelity or reconstruction quality. However, Sagduyu et al. [3] show that semantic attacks can severely degrade task meaning even when conventional signal-level quality remains relatively stable. This reveals a fundamental gap between traditional communication evaluation and semantic security assessment.

This limitation is also evident in backdoor and generative settings. Xu et al. [12] report that covert semantic backdoors can remove or manipulate critical semantics while preserving perceptual quality measures such as PSNR. Similarly, Wang et al. [11] show that privacy and inversion risks can persist even when reconstruction quality remains high. These results make clear that acceptable BER, PSNR, or MSE does not by itself guarantee semantic correctness, task reliability, or privacy preservation.

The text-oriented studies in the survey therefore rely increasingly on meaning-aware metrics such as BLEU and BERTScore. For example, Hoang et al. [31] evaluate semantic degradation using BLEU and cosine similarity, while Peng et al. [36] use BLEU and BERTScore to assess robustness under semantic noise. These metrics are more informative than bit-level error rates, but they are still incomplete, since overlap-based or embedding-based similarity does not fully ensure preservation of task-relevant meaning under attack.

A further requirement is task-oriented evaluation. Wang et al. [41] explicitly connect security with semantic task reliability through the CLSSR framework, and Getu et al. [48] emphasize that goal-oriented semantic communication should be evaluated according to downstream task success rather than reconstruction fidelity alone. This is especially important in safety-critical systems, where a semantically plausible output is still unacceptable if it leads to the wrong decision or action.

Privacy and robustness evaluation also require dedicated metrics beyond semantic similarity alone. Tang et al. [9] study intelligent eavesdropping and privacy inference success, while He et al. [10] evaluate leakage reduction and eavesdropper performance under diffusion-enabled defence. These works show that privacy leakage, inversion success, attack success rate, and resilience across channel conditions are necessary parts of semantic security evaluation.

Overall, the survey and positioning works consistently point to the absence of a unified evaluation framework. Won et al. [24], Meng et al. [25], and Guo et al. [26] all note the lack of standardized semantic-security metrics and common benchmarks. As a result, the field still lacks a consistent methodology that jointly captures semantic similarity, task success, privacy leakage, and robustness under realistic communication conditions.

4.5. Open Challenges and Research Gaps

Despite significant progress in semantic communication research, the surveyed literature reveals several persistent challenges that remain insufficiently addressed. A primary gap lies in the architectural dependence on shared semantic encoders, which, while enabling interoperability and efficiency, introduce centralized vulnerabilities that can be exploited through embedding-level and latent-space attacks [31].

Another unresolved challenge concerns the protection of semantic context in knowledge-assisted communication systems [28,30]. Detection of context-dependent and covert semantic manipulations also remains an open problem, as demonstrated by CSBA-style attacks [12].

The adoption of Generative AI further amplifies these challenges. While generative models enhance semantic expressiveness and compression efficiency [4,29], they also introduce vulnerabilities related to diffusion dynamics, latent amplification, and reasoning-driven manipulation [10,11].

Finally, a broader structural limitation persists across the literature: semantic security is often evaluated in isolation, with limited consideration of cross-layer interactions and realistic threat assumptions [24,25]. The absence of standardized benchmarks and unified semantic security metrics continues to hinder systematic comparison across studies.

Key Research Gaps:

• Limited evaluation under realistic wireless channel conditions and deployment settings.
• Lack of standardized semantic security metrics and unified benchmarking frameworks.
• Minimal focus on GenAI-specific attacks, including prompt manipulation, diffusion-space perturbations, and agentic reasoning threats.
• Insufficient multimodal and cross-layer security evaluation.
• Fragmented defence design, with limited generalization across models, tasks, and modalities.

5. Conclusions and Future Directions

This survey examined the security landscape of generative semantic communication systems, with a particular focus on threats and defences operating at the semantic and generative layers. The reviewed literature demonstrates that semantic communication security has evolved from a transmission-centric concern to a system-level issue involving meaning integrity, inference reliability, and decision trustworthiness. Attacks targeting shared encoders, latent representations, knowledge bases, and generative reasoning mechanisms reveal that preserving signal fidelity alone is insufficient to guarantee semantic robustness.

The analysis further shows that while Generative AI enables expressive, adaptive, and resource-efficient semantic communication, it simultaneously introduces novel attack surfaces associated with latent manipulation, backdoor activation, diffusion dynamics, and cross-modal leakage. Existing defences remain fragmented, model-specific, and often reactive, lagging behind the rapid expansion of semantic-level threats. The absence of standardized security benchmarks, unified evaluation metrics, and cross-layer assessment frameworks continues to hinder systematic progress in this domain.

Overall, the findings underscore the necessity of treating semantic security as a foundational design principle rather than a secondary optimization objective. Advancing secure generative semantic communication will require architectures that jointly consider semantic extraction, generative reconstruction, and task execution under adversarial conditions, ensuring that future semantic communication systems are not only efficient and intelligent, but also fundamentally trustworthy. Recent studies on secure digital twins for electric vehicles demonstrate that model-aware cyber attacks and evolutionary optimization–based defences can significantly affect cyber–physical decision pipelines, underscoring the importance of extending semantic-security analysis beyond communication blocks to system-level digital twins [51,52,53].

Future research should focus on developing standardized semantic-security benchmarks and unified evaluation metrics that jointly capture semantic fidelity, privacy leakage, and task reliability under adversarial conditions [24,25,26]. Another important direction is the design of defence mechanisms for multimodal and GenAI-native threats, including prompt manipulation, diffusion-space attacks, agentic reasoning attacks, and backdoors in LLM/VLM-based semantic communication systems [4,5,19,20]. In addition, future work should investigate cross-layer and real-world evaluation frameworks that account for wireless channel dynamics, shared knowledge bases, and system-level deployment settings such as intelligent vehicles, edge intelligence, and digital twins [27,30,53]. Finally, lightweight and adaptive security mechanisms are needed to balance robustness, latency, energy efficiency, and semantic performance in practical next-generation semantic communication networks [22,23,24].