Threat Model

The specific security violation the attacker aims to achieve. In signal classification, this is typically an integrity violation—causing a targeted or untargeted misclassification of a modulation scheme.

• Targeted Attack: The adversary forces the classifier to output a specific incorrect label (e.g., making BPSK appear as QPSK).
• Untargeted Attack: The adversary simply wants any output other than the correct class.
• Confidence Reduction: The attacker degrades the model's prediction confidence without changing the top-1 label, potentially triggering downstream uncertainty protocols.

The level of access and information the attacker possesses about the target model, which dictates the attack strategy's sophistication.

• White-Box Access: Full knowledge of model architecture, weights, gradients, and training data. Enables powerful gradient-based attacks like Projected Gradient Descent (PGD).
• Black-Box Access: Only input-output query access. The adversary must rely on transferability from a surrogate model or estimate gradients via zeroth-order optimization.
• Gray-Box Access: Partial knowledge, such as the feature extraction pipeline but not the classifier head, or knowledge of the defense mechanism but not the model parameters.

The constraints limiting how much an adversary can modify the input signal, formalized by an Lp-norm bound on the perturbation magnitude.

• L∞ (Max Norm): Limits the maximum change to any single IQ sample. Common in image domains and directly applicable to waveform samples.
• L2 (Euclidean Norm): Constrains the total energy of the added perturbation across all samples.
• L0 (Sparsity): Limits the number of IQ samples the adversary can modify, relevant for pulsed or burst communication signals.
• Over-the-Air Constraints: The perturbation must survive physical channel effects (fading, multipath) and comply with spectral mask regulations.

The specific stage in the signal processing pipeline where the adversary injects the perturbation, defining the physical realizability of the threat.

• Baseband IQ Injection: The adversary modifies the raw in-phase and quadrature samples before the receiver's classifier. Assumes direct digital access.
• Over-the-Air (OTA) Waveform: The perturbation is transmitted as a physical waveform through a real radio channel. Must account for channel impairment and synchronization.
• Feature-Level Attack: The adversary modifies extracted features (e.g., cumulants, cyclostationary signatures) rather than raw samples, assuming the feature extractor is compromised.

The formal property the defense mechanism must provably or empirically maintain under the defined threat model.

• Certified Robustness: A mathematical guarantee that the classifier's prediction remains constant for any perturbation within a verified Lp-ball radius. Achieved via randomized smoothing or formal verification.
• Empirical Robustness: Measured accuracy against a specific attack algorithm (e.g., PGD). Does not provide a guarantee against stronger future attacks.
• Detection & Rejection: The defense does not correct the classification but flags adversarial inputs for human review or discarding, using adversarial detection or out-of-distribution detection techniques.

A critical failure mode where the defense is evaluated under a weaker threat model than a real adversary would use, leading to a false sense of security.

• Gradient Obfuscation: A defense that relies on non-differentiable operations or shattered gradients to block gradient-based attacks, but fails against decision-based black-box attacks or Backward Pass Differentiable Approximation (BPDA).
• Adaptive Adversary: An attacker who knows the defense mechanism and modifies their attack accordingly. Evaluating against a static attack without adapting to the defense invalidates the security claim.
• Obfuscated Gradients: A specific sign of gradient masking where the model's loss surface provides no useful signal for first-order optimization, often easily circumvented.

The maximum allowable perturbation magnitude an adversary can apply, typically defined by an Lp-norm bound (e.g., L∞ epsilon-ball). This constraint ensures the attack remains imperceptible or physically realizable. In RF domains, the budget may be measured in signal-to-noise ratio (SNR) or error vector magnitude (EVM) rather than pixel-space norms.

• L∞ norm: Limits maximum per-sample perturbation
• L2 norm: Constrains total Euclidean distortion energy
• RF-specific budgets: Peak-to-average power ratio constraints

A critical dimension of any threat model specifying what the adversary knows. White-box assumes full access to model architecture, parameters, and gradients—enabling powerful attacks like PGD. Black-box restricts the adversary to querying input-output pairs only, requiring surrogate model construction or score-based gradient estimation.

• White-box: Gradients, weights, architecture known
• Black-box query: Soft labels or hard labels returned
• Transfer attack: Exploits cross-model vulnerability

Threat models distinguish between training-time and inference-time attack surfaces. Data poisoning and backdoor attacks compromise model integrity during training by injecting malicious samples. Evasion attacks operate at inference, modifying inputs to bypass a frozen classifier. Defenses must address the correct surface.

• Training-time: Poisoning, backdoor injection, label flipping
• Inference-time: Evasion, model inversion, membership inference
• Over-the-air: Physical channel introduces natural perturbations

The adversary's objective defines the severity of a successful attack. Untargeted attacks simply cause any misclassification. Targeted attacks force the model to output a specific incorrect class—far more dangerous in automatic modulation classification where spoofing a BPSK signal as QAM64 could trigger incorrect demodulation.

• Integrity violation: Evasion causing misclassification
• Availability violation: Inducing denial-of-service through high-confidence errors
• Privacy violation: Extracting training data via model inversion

A formal threat model enables certified defenses that provide mathematical guarantees. Randomized smoothing constructs a smoothed classifier and certifies prediction invariance within a provable L2 radius. Unlike empirical defenses, certification offers worst-case guarantees against any attack within the defined budget.

• Randomized smoothing: Noise-based certification
• Interval bound propagation: Layer-by-layer bound computation
• SMT/SAT solvers: Exact verification for small networks

In RF signal classification, the threat model must account for the physical wireless channel. Adversarial perturbations must survive multipath fading, Doppler shift, and receiver noise. An over-the-air attack transmits a crafted waveform through actual hardware, where non-linear amplifier effects and synchronization errors degrade perturbation fidelity.

• Channel-aware attacks: Perturbations designed to survive fading
• Hardware-in-the-loop: SDR-based attack validation
• EVM budget: Constraint on waveform distortion