Black-Box Attack

The adversary interacts with the target model exclusively through a remote API or sensor interface, observing only the final prediction labels or confidence scores. No access to gradients, architecture diagrams, or training data is available. This mirrors real-world scenarios where proprietary classifiers are deployed behind secure interfaces. The attacker must carefully manage a query budget to avoid detection by rate-limiting or anomaly-based intrusion detection systems.

Black-box attacks are categorized by the granularity of the output:

• Score-Based: The model returns continuous confidence scores or logits. Attackers use zeroth-order optimization to estimate gradients via finite differences, enabling gradient-based attack methods.
• Decision-Based: The model returns only the final hard-label prediction. This is a more restrictive setting requiring random walk or boundary attack algorithms that iteratively probe the decision boundary with minimal perturbation.

Without true gradients, attackers employ zeroth-order (ZO) methods to approximate them. By evaluating the loss function at randomly perturbed points around the current input, a finite-difference estimate of the gradient is computed. The ZO-SGD algorithm iteratively applies these estimated gradients to craft an adversarial example. This process is query-intensive, often requiring hundreds of thousands of queries to converge on a successful perturbation.

The primary constraint in black-box settings is the query budget. Excessive queries trigger rate-limiting or alert a defender's adversarial detection system. Advanced attacks prioritize query efficiency by using techniques like natural evolution strategies (NES) or prior-guided random gradient-free (PRGF) methods. These algorithms intelligently sample the search space to minimize the number of interactions needed to find a successful adversarial perturbation.

In signal classification, a black-box attack manifests as an over-the-air attack. The adversary transmits a perturbed RF waveform through a physical channel without knowing the receiver's neural network internals. The attacker must overcome channel distortion, multipath fading, and hardware impairments while crafting a perturbation that remains effective after propagation. This requires robust, universal perturbation strategies that account for the stochastic nature of the wireless medium.

An adversary transmits a carefully crafted adversarial perturbation over a real radio channel to fool a remote modulation classifier. The attacker has no access to the model's weights or training data—only the ability to observe the receiver's link-layer behavior (e.g., ACK/NACK patterns or adaptive modulation responses). By treating the entire signal processing chain as a black box, the attacker iteratively refines the perturbation using query-based optimization until the classifier consistently misidentifies a QPSK transmission as noise.

• Attack vector: Physical waveform injection via software-defined radio
• Feedback mechanism: Observable protocol responses serve as implicit labels
• Real-world impact: Covert channel establishment under spectrum monitoring systems

When direct querying of the target classifier is rate-limited or expensive, adversaries construct a surrogate model—a locally trained replica built from synthetically generated input-output pairs. The attacker queries the black-box target with a diverse set of signals, collects the predicted modulation labels, and trains a functionally similar deep neural network. Transferability ensures that adversarial examples crafted against the surrogate also fool the original target.

• Key enabler: Decision boundary similarity across independently trained models
• Query strategy: Latin hypercube sampling across the signal parameter space
• Defense implication: Surrogate-resistant architectures must break transferability assumptions

In scenarios where the target model returns confidence scores (softmax probabilities) rather than hard labels, adversaries deploy gradient-free optimization methods. The HopSkipJump attack estimates the decision boundary's local geometry by probing with binary search along random directions. Starting from a legitimate sample, the perturbation walks along the boundary while minimizing distortion, eventually crossing into the target misclassification region.

• No gradient access required: Purely query-based boundary estimation
• Distortion minimization: Attack finds the smallest perturbation that flips the label
• Applicability: Effective against cloud-hosted modulation recognition APIs that return confidence vectors

The most restrictive black-box scenario: the target model returns only a hard label (e.g., 'QAM64') with no confidence scores. Adversaries employ label-only attacks that probe the decision boundary by observing when small perturbations cause label flips. The boundary's normal vector is estimated through finite differences of label transitions, enabling gradient-free adversarial example generation.

• Minimal information leakage exploited: Single discrete output per query
• Algorithm: Boundary Attack with spherical stepping
• Defense: Rate limiting and query anomaly detection are primary mitigations

Regulatory and defense agencies deploy automatic modulation classification systems to police spectrum usage and detect unauthorized transmissions. An adversary operating a rogue transmitter can execute a black-box attack by observing whether their signal triggers enforcement actions. Each transmission attempt serves as a binary query: detected or not detected. Over successive attempts, the adversary learns to shape their waveform to evade the monitoring classifier entirely.

• Adversarial goal: Make a prohibited transmission appear as an authorized modulation type
• Query cost: Each failed evasion attempt risks detection and geolocation
• Operational context: Electronic warfare and spectrum enforcement countermeasures

Beyond evasion, black-box access enables model extraction—the complete theft of a proprietary classifier's functionality. An adversary queries a commercial modulation recognition API with millions of synthetic IQ samples, collecting input-output pairs to train a functionally equivalent clone. The stolen model can then be analyzed offline to discover vulnerabilities, or used competitively to replicate the service without authorization.

• Intellectual property threat: Model functionality replicated at fraction of training cost
• Query patterns: Adversarial queries often exhibit statistical anomalies detectable by adversarial detection systems
• Countermeasure: Differential privacy guarantees and query auditing