Model Extraction

The adversary sends carefully crafted IQ samples or spectrogram inputs to the target model's inference API and collects the corresponding predictions. By observing input-output pairs, the attacker trains a substitute model that approximates the victim's decision boundaries. In RF domains, this is particularly dangerous because the clone can then be analyzed offline to discover signal classification thresholds, modulation recognition patterns, or emitter identification criteria without triggering any security alerts on the production system.

For models with known mathematical structures, such as logistic regression or shallow neural networks used in automatic modulation classification, an attacker can solve for exact weights and biases. By submitting precisely crafted queries equal to the number of model parameters, the adversary constructs a system of equations whose solution reveals the internal parameter values. This deterministic approach requires no approximation and yields an exact clone, making it a critical threat for deployed edge inference models with transparent architectures.

When internal parameters cannot be directly solved, attackers map the model's decision surface through systematic probing. In RF fingerprinting systems, this means discovering which hardware impairment features trigger specific emitter identifications. Techniques include:

• Active learning to query near suspected decision boundaries
• Gradient estimation through finite differences on confidence scores
• Adaptive sampling that concentrates queries where the model's output changes most rapidly This reconstructed boundary reveals the exact signal characteristics the model uses for classification.

Models that return softmax probability vectors rather than just hard labels leak significantly more information per query. Each confidence score reveals the model's relative certainty across all classes, effectively providing a gradient signal that accelerates extraction. In RF digital twin environments, a model outputting 'QPSK: 0.87, 16QAM: 0.09, 64QAM: 0.04' exposes far more about its internal representation than a simple 'QPSK' label. Defense: Return only top-k labels or apply temperature scaling to flatten confidence distributions.

Once a substitute model is extracted, it becomes a sandbox for crafting adversarial perturbations. Because adversarial examples often transfer between functionally similar models, perturbations designed to fool the clone have a high probability of also fooling the original victim model. In RF domains, this means an attacker can develop waveform perturbations that cause misclassification without ever directly interacting with the deployed system during the attack development phase. This makes model extraction a precursor to more severe integrity attacks.

Organizations deploy multiple layers of defense against extraction:

• Query rate limiting to slow bulk extraction attempts
• Prediction poisoning that returns subtly incorrect outputs when query patterns suggest extraction
• Differential privacy mechanisms that add calibrated noise to output probabilities
• Out-of-distribution detection that refuses queries far from the training manifold
• Watermarking model outputs with unique statistical signatures for forensic identification of cloned models In RF digital twin environments, these defenses must be validated under realistic over-the-air channel conditions.

An algorithm's ability to recognize and flag input RF signals that belong to an unknown class or environment not present in the training data, preventing silent misclassifications. This capability serves as a first-line defense against model extraction, as extraction queries often exhibit statistical properties that diverge from legitimate operational traffic. Techniques include:

• Mahalanobis distance scoring on feature embeddings
• Energy-based models that assign low scores to OOD samples
• Gradient-based detection that flags inputs producing unusually high gradient norms Deploying OOD detectors at the model API boundary can throttle suspicious query patterns before an adversary accumulates sufficient query-response pairs to train a clone.

The continuous monitoring process that identifies when a deployed RFML model's statistical properties diverge from its training baseline due to changes in the electromagnetic environment. Drift detection is critical for identifying extraction attacks in progress, as a sustained adversarial query campaign will manifest as an anomalous shift in the distribution of input signals or output confidence scores. Key monitoring signals include:

• Prediction confidence distributions shifting toward high-entropy outputs
• Feature-space coverage expanding into regions far from the training manifold
• Query rate anomalies indicating automated, high-volume probing Integrating drift detection with automated model rollback or query throttling creates a responsive defense posture.

A scalar metric that quantifies the mismatch between a model's reported confidence scores and its actual empirical accuracy, critical for assessing the trustworthiness of RFML decisions. Well-calibrated models are inherently more resistant to extraction, as overconfident incorrect predictions provide adversaries with clean, exploitable signal about the decision boundary. ECE is computed by:

• Binning predictions by confidence level
• Calculating the weighted average of |accuracy - confidence| per bin
• Lower ECE values indicate better calibration Temperature scaling and Platt scaling are post-hoc calibration techniques that reduce ECE without retraining, simultaneously improving both reliability and extraction resistance.

A sim-to-real training strategy that varies non-essential simulation parameters—such as noise floor, interference count, or Doppler spread—to force a model to learn invariant features that generalize to the real world. Applied as a defense against model extraction, domain randomization during training produces models with smoother, less exploitable decision boundaries. When an adversary queries a domain-randomized model, the responses reflect a broader operational envelope, making it significantly harder to infer the precise parameterization of the underlying architecture. This technique is particularly effective when combined with differential privacy mechanisms that add calibrated noise to output logits.

A domain adaptation technique where a machine learning model trained entirely on simulated RF data is refined to maintain high accuracy when deployed in a live physical environment. From a security perspective, models trained via synth-to-real pipelines present a unique extraction challenge: the clone trained on query responses from the physical deployment may fail to capture the full generalization behavior learned during the simulation phase. This creates a transfer gap that degrades clone fidelity. Defenders can exploit this by:

• Deploying ensembles that mix synth-trained and real-fine-tuned models
• Rotating model checkpoints to prevent query consistency
• Injecting simulation-specific watermark responses detectable in extracted clones