Adversarial Perturbation

The perturbation must be minimal in magnitude to evade human inspection or statistical anomaly detectors. This is typically enforced by an Lp-norm bound (e.g., L∞ < 0.01) on the perturbation vector.

• Stealth Requirement: The modified signal must remain visually or spectrally identical to the original to a human analyst.
• Signal-to-Noise Ratio: The perturbation power is often 20-30 dB below the original signal power.
• Just Noticeable Difference: Attackers calibrate noise to sit just below the perceptual threshold of automated monitoring systems.

Perturbations are designed with specific adversarial goals that dictate the optimization loss function.

• Targeted Attack: The perturbation forces the classifier to output a specific, attacker-chosen incorrect label (e.g., making a rogue device appear as a specific authorized admin terminal).
• Untargeted Attack: The perturbation simply causes any incorrect classification, which is easier to compute and requires less precise gradient information.
• Source/Target Pairs: In RF fingerprinting, this often maps a low-privilege emitter to a high-privilege identity.

Most high-efficacy perturbations are crafted using white-box access to the model's gradient. The Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) are foundational algorithms.

• FGSM: Applies a single-step perturbation in the direction of the loss gradient: x' = x + ε * sign(∇x J(θ, x, y)).
• PGD: An iterative, multi-step variant that projects the perturbed sample back onto the ε-ball after each step, producing a stronger attack.
• Carlini & Wagner (C&W): An optimization-based attack that directly minimizes perturbation magnitude while enforcing misclassification, often defeating defensive distillation.

A perturbation computed on a surrogate model can often fool a different, black-box target model. This property is critical for real-world attacks where the defender's architecture is unknown.

• Cross-Architecture Transfer: Perturbations generated on a ResNet often transfer to a VGG or Vision Transformer with non-trivial success rates.
• Ensemble-Based Attacks: Attackers compute gradients against an ensemble of surrogate models to maximize transferability to the unknown target.
• Feature Space Alignment: Transferability is higher when surrogate and target models learn similar intermediate feature representations.

For RF spoofing, perturbations must survive channel impairments like multipath fading, Doppler shift, and thermal noise between generation and reception.

• Expectation Over Transformation (EOT): The perturbation is optimized to remain effective across a distribution of simulated physical transformations.
• Non-Differentiable Channel Effects: Over-the-air attacks must account for hard clipping, quantization by the receiver's ADC, and synchronization errors.
• Robust Physical Perturbations: These are often higher in magnitude than digital-only attacks to compensate for the information loss in the analog channel.

Rather than targeting the final logit layer, sophisticated perturbations push the input's deep feature representation away from its true class centroid and toward a target class manifold.

• Layer-Specific Loss: The attacker minimizes the cosine distance between the perturbed sample's embedding and the target device's stored enrollment vector.
• Manifold Intrusion: The perturbation effectively creates a sample that lies within the target class's high-density region in the feature space.
• Defense Implications: This bypasses classifiers that rely solely on final-layer anomaly detection, requiring defenders to monitor internal layer activations.