Adversarial Robustness

The most common threat vector in deployment, where an adversary crafts a perturbation to a specific input at test time to cause a misclassification. In the RF domain, this manifests as a subtle, carefully engineered interference waveform overlaid on a legitimate signal. The attacker does not alter the model itself, only the data passing through it. Key paradigms include:

• White-box attacks: The attacker has full knowledge of model architecture and gradients (e.g., Projected Gradient Descent).
• Black-box attacks: The attacker only queries the model to estimate gradients or uses transferability from a surrogate model.
• Physical attacks: Perturbations designed to survive the analog distortions of over-the-air transmission.

A proactive defense that augments the training dataset with adversarial examples generated on-the-fly. The model is trained to correctly classify both clean and perturbed inputs, effectively learning a more robust decision boundary. This is currently the most empirically effective defense, but it comes with trade-offs:

• Computational cost: Requires generating attacks during every training epoch.
• Accuracy trade-off: Robustness often comes at the expense of performance on clean samples.
• Generalization gap: Robustness to one attack type does not guarantee robustness to others.

Unlike empirical defenses that can be broken by a stronger attack, certified robustness provides a mathematical guarantee that a model's prediction will not change for any input within a defined epsilon-ball around the original sample. This is critical for safety-critical RF applications like aviation navigation. Common techniques include:

• Randomized smoothing: Constructs a smoothed classifier from a base model by adding Gaussian noise and using majority voting, yielding a provable radius.
• Interval bound propagation: Propagates bounds through the network layers to formally verify output stability.

A brittle and deceptive defense phenomenon where a model appears robust to gradient-based attacks, not because it learned meaningful features, but because it obfuscated its gradients. This gives a false sense of security. Common causes include:

• Shattered gradients: Non-differentiable operations or numerical instability that prevent the attacker from computing a useful gradient.
• Stochastic gradients: Randomized defenses that make the loss surface noisy.
• Exploding/vanishing gradients: Deep architectures that cause gradient calculations to fail. Attackers bypass this by using black-box methods or differentiable approximations.

The property that an adversarial example crafted to fool one model (the surrogate) will often fool another independently trained model (the target) with a high success rate. This is the foundation of black-box attacks. In RFML, a perturbation generated against a software-defined radio model in a lab can transfer to a physically deployed hardware receiver. This occurs because different models learn similar decision boundaries when trained on the same underlying task. Defenders must test against transferred attacks, not just white-box ones.

A rigorous methodology for stress-testing a model's resilience. Proper evaluation requires more than reporting accuracy against a single attack. A sound framework includes:

• Adaptive attacks: Designing attacks with full knowledge of the defense mechanism to avoid a false sense of security.
• Attack budget (epsilon): Defining the maximum allowable perturbation magnitude in terms of L-p norms or signal-to-noise ratio.
• Threat model: Explicitly stating the attacker's knowledge (white-box vs. black-box) and capabilities.
• Worst-case analysis: Reporting the minimum accuracy across a diverse suite of attacks, not the average.