Evasion Attack

The defining characteristic of an evasion attack is that it occurs after model training is complete. The adversary modifies a malicious or spoofed signal at the point of capture to cause misclassification without ever touching the model's weights or architecture.

• Attack surface is the model input, not the training data
• Exploits blind spots in the learned decision boundary
• Requires no privileged access to the training pipeline
• Often executed through adversarial perturbation of the transmitted waveform

Attackers generate carefully calculated noise patterns—often imperceptible to traditional signal analysis—that push the input across the model's decision boundary. These perturbations exploit the high-dimensional linearity of deep neural networks.

• Fast Gradient Sign Method (FGSM): Single-step perturbation along the gradient
• Projected Gradient Descent (PGD): Iterative, constrained optimization attack
• Carlini & Wagner (C&W): Optimization-based attack minimizing perturbation magnitude
• Perturbations are typically bounded by an L-p norm constraint to remain covert

A critical property of evasion attacks: adversarial examples crafted against one fingerprinting model often fool other models trained on similar data. This enables black-box attacks where the adversary has no direct access to the deployed classifier.

• Attacker trains a substitute model on a proxy dataset
• Generates perturbations against the substitute
• Transfers the crafted adversarial signal to the target system
• Exploits shared vulnerabilities in model architectures and training distributions

Unlike purely digital adversarial examples, RF evasion attacks must survive channel propagation effects—multipath, fading, and noise—between the attacker's transmitter and the defender's receiver. This requires robust perturbation design.

• Perturbations must remain effective after over-the-air transmission
• Attacker must account for channel state information (CSI) uncertainty
• Expectation over Transformation (EoT) techniques average over simulated channel variations
• Real-world realizability separates theoretical from practical threats

Evasion attacks can target different stages of the fingerprinting pipeline. Input space attacks modify the raw IQ samples directly, while feature space attacks manipulate extracted signal characteristics before classification.

• Input space: Direct manipulation of IQ constellation points or waveform samples
• Feature space: Altering cyclostationary features, higher-order statistics, or time-frequency representations
• Feature-space attacks are often more efficient but require knowledge of the preprocessing chain
• Defenders must secure the entire signal processing pipeline, not just the neural network

Sophisticated adversaries employ adaptive attacks that iteratively probe the defense and refine their evasion strategy based on feedback. This arms race dynamic requires continuous model hardening.

• Attacker queries the model to estimate decision boundary geometry
• Uses gradient estimation techniques when direct access is unavailable
• Adapts to known defenses like feature squeezing or defensive distillation
• Requires defenders to assume an adaptive threat model, not just static attacks

A proactive defense that injects adversarial examples into the training dataset to harden a neural network against evasion attacks. By exposing the model to carefully crafted perturbations during learning, the decision boundary becomes smoother and more robust.

• Mechanism: Augments training data with FGSM or PGD attacks
• Benefit: Reduces model's susceptibility to gradient-based evasion
• Trade-off: May slightly reduce accuracy on clean samples

A defensive strategy that reduces the complexity of the input feature space to limit an adversary's degrees of freedom for constructing successful evasion attacks. By simplifying the signal representation, the attack surface is minimized.

• Techniques: Bit depth reduction, spatial smoothing, feature binning
• Detection: Compares model predictions on original vs. squeezed inputs
• Application: Effective against perturbation-based RF spoofing

A model hardening technique where a second student model is trained on the softened probability outputs of the original teacher model. This process smooths the decision boundary, making it harder for adversaries to find adversarial directions.

• Process: Train teacher at high temperature, transfer knowledge to student
• Effect: Reduces gradient magnitude in the vicinity of training points
• Limitation: Later shown to be partially bypassable by advanced attacks

A method for identifying input samples that differ fundamentally from the training data distribution. In RF fingerprinting, this enables a model to flag unknown spoofing devices and adversarial examples with high confidence.

• Approaches: Energy-based models, Mahalanobis distance, softmax thresholding
• Key Metric: Local Intrinsic Dimensionality (LID) of feature embeddings
• Goal: Reject manipulated signals before classification occurs

An informal defensive phenomenon where a model's gradients become uninformative to attackers, often through non-differentiable preprocessing or saturated activation functions. While initially appearing robust, this is considered a flawed defense.

• Pitfall: Provides a false sense of security
• Bypass: Attackers can use black-box transfer attacks or approximate gradients
• Best Practice: Rely on certified robustness rather than gradient obfuscation

A formal verification approach that provides mathematical guarantees about a model's resistance to evasion attacks within a defined perturbation budget. Unlike empirical defenses, certified methods prove no adversarial example exists within a specified radius.

• Techniques: Randomized smoothing, interval bound propagation
• Guarantee: Model prediction remains stable for all inputs within epsilon-ball
• Relevance: Critical for high-assurance RF authentication systems