Adversarial Attack

The most common attack vector where an adversary crafts a perturbation added to the legitimate transmitter's waveform during live operation. The goal is to cause misclassification at the receiver without altering the underlying message content. These attacks exploit the model's decision boundaries by adding a carefully calculated adversarial noise vector—often imperceptible to traditional signal analysis—that pushes the signal's feature representation across a classification boundary. The Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) are standard algorithms for generating these perturbations, typically constrained by a power budget to remain covert.

An attack that occurs before model deployment, where the adversary injects maliciously crafted samples into the training dataset. For RF fingerprinting, this could involve inserting signals with specific, engineered impairments designed to create a backdoor in the learned model. When the backdoor trigger—a specific frequency artifact or transient pattern—is present in a live signal, the model misclassifies it as a legitimate, authorized device. This attack is particularly dangerous in federated learning scenarios where a compromised node can poison the global model by submitting corrupted gradient updates.

A black-box attack strategy where the adversary has no direct access to the defender's model architecture or parameters. The attacker queries the target fingerprinting system with a large number of crafted signals and observes the classification outputs. Using these input-output pairs, they train a surrogate model that approximates the target's decision boundaries. Adversarial perturbations are then generated against this surrogate and transferred to attack the original model. This exploits the transferability property of adversarial examples across models trained on similar data distributions.

A non-perturbation attack that bypasses the machine learning classifier entirely by capturing and retransmitting a legitimate device's raw signal. In a replay attack, the adversary records a valid authentication exchange and replays it later to gain unauthorized access. A relay attack is more sophisticated, using a proxy device to forward the challenge signal to the legitimate device in real-time and relay its response back, effectively extending the physical range of authentication. These attacks exploit the fact that the fingerprint is a static hardware property, not a cryptographic nonce.

A physically realizable attack that accounts for the over-the-air propagation channel when crafting the perturbation. Unlike digital-domain attacks that assume the perturbation is added directly to the received IQ samples, this attack models the convolution of the adversarial signal with the channel impulse response. The attacker must solve an optimization problem that incorporates channel state information (CSI) to ensure the perturbation survives multipath fading and remains effective at the receiver's classifier input. This represents the most realistic threat model for wireless fingerprinting systems.

A single, signal-agnostic perturbation vector that causes misclassification across a wide range of input signals from different devices. Unlike per-sample attacks, a Universal Adversarial Perturbation (UAP) is crafted to generalize across the entire data distribution. Once computed, it can be broadcast indiscriminately to disrupt all fingerprinting classifiers operating in an environment. UAPs exploit shared vulnerabilities in the model's feature space and represent a scalable, broadcast-based jamming technique that does not require per-transmitter optimization.

The most common attack type, occurring at inference time. An adversary crafts a perturbation—a subtle, often mathematically optimized noise pattern—and adds it to the legitimate transmitter's signal. The modified waveform is classified as a different, unauthorized device, bypassing authentication. This attack exploits the blind spots in a model's decision boundary without altering the model itself.

A training-time attack where an adversary injects maliciously crafted samples into the model's training dataset. By introducing backdoor triggers or corrupting feature representations, the attacker causes the model to learn an incorrect mapping. A specific, known perturbation pattern can then be used at inference time to guarantee a targeted misclassification, creating a backdoor into the authentication system.

The specific, engineered noise vector added to a clean signal to cause a misclassification. Effective perturbations are imperceptible to traditional signal analysis but catastrophic for neural networks. Common generation methods include:

• Fast Gradient Sign Method (FGSM): A single-step, computationally cheap attack.
• Projected Gradient Descent (PGD): An iterative, more powerful multi-step variant.
• Carlini & Wagner (C&W): An optimization-based attack that finds minimal perturbations.

The measured resilience of a fingerprinting classifier against malicious perturbations. A robust model maintains high authentication accuracy even under attack. Key defense strategies include:

• Adversarial Training: Augmenting the training set with adversarial examples to harden the model's decision boundary.
• Defensive Distillation: Training a second model on the softened probability outputs of the first to smooth gradients.
• Input Transformation: Applying random resizing, padding, or noise reduction before classification to break the precise structure of an attack.

A critical property where an adversarial perturbation crafted to fool one specific classifier model (the surrogate) is also effective against a different, unknown target model. This enables black-box attacks, where the adversary has no direct access to the deployed model's architecture or parameters. The attacker trains a local proxy model, generates attacks against it, and then transmits them to compromise the real, remote authentication system.

An attack realized not in simulation but by transmitting an over-the-air, perturbed signal through actual RF hardware. This must account for channel effects like multipath fading and hardware distortion that can degrade the precise adversarial perturbation. Successful physical attacks demonstrate a real, practical threat to wireless authentication, moving beyond theoretical digital-domain vulnerabilities to compromise live communication links.