Over-the-Air Attack

Unlike purely digital attacks, the perturbation must survive the wireless channel. The adversary transmits a crafted IQ waveform that, after undergoing multipath fading, Doppler shift, and thermal noise, still induces a misclassification at the receiver. This requires the attacker to model or estimate the channel's impulse response to pre-distort the signal, ensuring the perturbation arrives intact at the target's feature space.

A critical challenge is designing a perturbation robust to unknown channel conditions. Techniques include:

• EOT (Expectation Over Transformation): Optimizing the perturbation over a distribution of simulated channel effects.
• Universal Adversarial Perturbations (UAPs): Crafting a single perturbation waveform that causes misclassification across a wide range of input signals and channel realizations.
• Cyclic Prefix Exploitation: Embedding the perturbation within the guard interval of an OFDM waveform to maintain synchronization.

The attacker typically operates under a black-box assumption with no access to the receiver's model architecture or parameters. The attack relies on transferability: an adversarial example generated on a local surrogate model trained on similar modulation data is transmitted over-the-air, hoping it transfers to the remote target classifier. Query-based attacks are often infeasible due to the one-way nature of many RF links.

The attack must align precisely with the target receiver's sampling window. A perturbation misaligned by even a fraction of a symbol period may be ineffective or only inject noise. Sophisticated attacks incorporate blind synchronization techniques or exploit known preamble structures to ensure the adversarial waveform is coherently combined with the legitimate signal at the classifier's input.

The attacker's own transmitter hardware introduces non-linear distortions (e.g., power amplifier non-linearity, I/Q imbalance) that can degrade the perturbation. Conversely, an attacker can intentionally exploit the receiver's automatic gain control (AGC) or carrier frequency offset (CFO) correction loops. By crafting a signal that saturates the AGC or biases the CFO estimator, the attacker can create a secondary denial-of-service or misclassification vector.

Defenses against over-the-air attacks include:

• Adversarial Training with Channel Models: Augmenting the training set with adversarial examples passed through simulated channel models.
• RF Anomaly Detection: Monitoring the raw IQ stream for statistical anomalies inconsistent with nominal hardware and channel behavior.
• Certified Robustness via Randomized Smoothing: Adding Gaussian noise at the receiver's front-end to create a provably smooth decision boundary, though this trades off sensitivity.

An attack deployed at inference time where an adversary modifies a malicious sample to bypass a trained classifier without altering the model itself. Unlike poisoning, the model's integrity remains intact, but its output is compromised. Key characteristics include:

• No training data access: The attacker only interacts with the deployed model.
• Real-time execution: The perturbation is computed and transmitted live.
• Stealth focus: The goal is to be misclassified as benign or a specific target class.

A formal characterization of an adversary's goals, knowledge, and capabilities, defining the specific security guarantees a defense must provide. A rigorous threat model for an over-the-air attack specifies:

• Adversary's Goal: Targeted misclassification (e.g., BPSK to 8-PSK) vs. untargeted denial-of-service.
• Knowledge: White-box (full access to model weights and architecture) vs. Black-box (only query access via spectrum observation).
• Capability: The maximum perturbation power budget (e.g., an epsilon bound on the L2-norm of the added waveform) and the adversary's channel state information.

An attack executed without internal knowledge of the target model's architecture or parameters, relying solely on querying input-output pairs. In an over-the-air context, this is the most realistic threat scenario. The attacker transmits a signal and observes the system's reaction (e.g., a change in modulation and coding scheme). Techniques include:

• Score-based: Using softmax confidence scores to estimate gradients.
• Decision-based: Using only the hard-label prediction to guide a random walk toward an adversarial example.
• Transfer-based: Training a local surrogate model on synthesized I/Q data to generate transferable perturbations.

The maximum allowable magnitude of a perturbation, typically defined by an Lp-norm bound, within which an adversary is constrained to operate. This constraint ensures the attack remains covert and does not simply jam the channel. Common formulations include:

• L∞-norm: Limits the maximum instantaneous amplitude of the perturbation waveform.
• L2-norm: Limits the total energy of the perturbation added to the I/Q samples.
• Signal-to-Noise Ratio (SNR): A practical RF budget defining the perturbation power relative to the original signal power, ensuring the adversarial waveform hides below the noise floor.

A defensive technique that injects adversarial examples into the training dataset to improve a model's robustness against future attacks. For over-the-air resilience, this involves:

• Dynamic generation: Using Projected Gradient Descent (PGD) to create worst-case perturbations during each training epoch.
• Channel augmentation: Applying realistic fading and noise models to the adversarial examples to ensure robustness generalizes to the physical channel.
• Trade-off: Acknowledging that this defense often reduces accuracy on clean, unperturbed signals.