Adversarial Perturbation

The perturbation is engineered to be orders of magnitude weaker than the original signal, often operating just above the noise floor. This ensures the attack remains covert and does not trigger standard energy-detection or automatic gain control (AGC) alarms.

• Signal-to-Perturbation Ratio (SPR): Typically 20-40 dB.
• Goal: Modify the decision boundary without jamming the receiver.

The attack is not designed to simply cause a random error; it forces the classifier to output a specific, incorrect target class with extreme confidence.

• Softmax Manipulation: The perturbation pushes the logits of the adversarial class far above the true class.
• Metric Impact: Expected Calibration Error (ECE) spikes dramatically as the model becomes confidently wrong.

Unlike digital image pixels, RF perturbations must survive real-world channel effects (fading, multipath) to be effective. The perturbation must be crafted to be robust to these analog distortions.

• Over-the-Air (OTA) Robustness: Perturbations are often trained using a channel model to ensure they survive propagation.
• Bandwidth Limitation: The attack must fit within the occupied bandwidth of the victim signal to pass through front-end filters.

A perturbation computed for a white-box surrogate model often fools a physically distinct black-box receiver. This transferability is a critical vulnerability in deployed systems.

• Cross-Model Attack: A perturbation optimized on a ResNet often degrades a Transformer-based classifier.
• Hardware Agnosticism: The attack exploits universal geometric blind spots in the decision boundary rather than specific architecture weights.

The adversarial waveform is visually indistinguishable from the legitimate signal in standard spectrogram or constellation diagram views. Human analysts cannot detect the manipulation.

• IQ Sample Space: The Euclidean distance between the clean and perturbed samples is minimized.
• Visual Stealth: Standard waterfall displays show no obvious jamming or interference patterns.

While powerful, adversarial perturbations are often brittle to environmental changes. A perturbation optimized for a specific Signal-to-Noise Ratio (SNR) or channel impulse response may fail if the receiver moves or the noise floor shifts.

• SNR Sensitivity: Attack success rate drops sharply outside the trained SNR range.
• Channel Overfitting: The perturbation may be tightly coupled to a specific delay spread, limiting its practical deployment.

The most common adversarial threat at test time. An evasion attack crafts a perturbation applied to a live input signal to cause misclassification without altering the model itself.

• White-box attack: Attacker has full knowledge of model gradients
• Black-box attack: Attacker probes the model to infer decision boundaries
• Universal perturbation: A single, signal-agnostic distortion that fools a classifier across many inputs

A foundational white-box attack that generates a perturbation in a single step by moving the input in the direction of the loss gradient.

• One-step attack: Computationally cheap, ideal for real-time RF threats
• Epsilon parameter: Controls the maximum distortion magnitude per sample
• IQ domain application: Applied directly to complex baseband samples to flip modulation classification results

A powerful iterative attack considered the universal first-order adversary. PGD repeatedly applies FGSM with small step sizes and projects the result back onto an epsilon-ball around the original signal.

• Gold standard for empirical robustness evaluation
• RF-specific constraints: Must respect peak-to-average power ratio limits
• Used extensively in adversarial training to harden RFML classifiers

The primary proactive defense where a model is retrained on a mixture of clean and adversarially perturbed examples.

• Min-max optimization: Inner loop generates worst-case perturbation, outer loop minimizes loss
• Trade-off: Improves robustness but often degrades accuracy on clean signals
• RF digital twin integration: Perturbations are generated in simulation before over-the-air hardening

A powerful optimization-based attack that minimizes distortion while ensuring misclassification. It formulates the attack as a Lagrangian-constrained optimization problem.

• Minimal distortion: Finds the smallest perturbation that flips the label
• Confidence parameter: Controls how far past the decision boundary the input is pushed
• Highly effective against defensive distillation and other early defenses

A critical property where perturbations generated for one model also fool a different, unknown model. This enables black-box attacks without direct access to the target classifier.

• Surrogate model: Attacker trains a local substitute via query-based model extraction
• Cross-architecture transfer: Perturbations crafted on a CNN often fool a transformer-based classifier
• RF domain: Transferability is amplified by shared channel impairments across models