Evasion Attack

Assumes the adversary has full knowledge of the model architecture and parameters. The attacker computes the gradient of the loss function with respect to the input IQ samples and applies a small perturbation in the direction that maximizes classification error.

• Fast Gradient Sign Method (FGSM): A single-step attack that applies a perturbation proportional to the sign of the gradient. Computationally cheap but often less effective against robust models.
• Projected Gradient Descent (PGD): An iterative, multi-step variant of FGSM that projects the perturbed signal back onto an epsilon-ball around the original input after each step. Considered a universal first-order adversary and a standard benchmark for empirical robustness evaluation.
• Carlini & Wagner (C&W) Attack: An optimization-based attack that minimizes the perturbation magnitude subject to a misclassification constraint, often producing smaller distortions than PGD.

The adversary can only query the model and receive output probabilities or confidence scores, without access to gradients. Attackers estimate gradients through finite differences or train a surrogate model on query responses.

• Zeroth-Order Optimization (ZOO): Estimates the gradient by perturbing each input dimension individually and observing the change in the confidence score. Computationally expensive but effective against models that expose softmax outputs.
• Natural Evolution Strategies (NES): Uses a population-based search algorithm to estimate the gradient by sampling perturbations from a Gaussian distribution and weighting them by the resulting loss.
• Surrogate Model Training: The attacker builds a local substitute model by querying the target model with a synthetic dataset, then crafts white-box adversarial examples on the surrogate that transfer to the target.

The most restrictive threat model: the adversary only receives the final hard-label prediction, not confidence scores. These attacks rely on random walks and boundary exploration to find the nearest decision boundary.

• Boundary Attack: Starts with a large perturbation that already causes misclassification and iteratively reduces the perturbation magnitude while staying on the adversarial side of the decision boundary through a random walk with rejection sampling.
• HopSkipJumpAttack: A more efficient decision-based attack that combines binary search for boundary proximity with gradient direction estimation using Monte Carlo sampling, significantly reducing the number of queries required.
• Relevance to RF: Decision-based attacks are particularly relevant for tactical RF systems where only a demodulated symbol or emitter label is observable by an adversary.

A single, signal-agnostic perturbation vector that causes misclassification across a large fraction of input samples when added to any signal. This is particularly dangerous in RF systems where a jammer could broadcast a fixed perturbation waveform.

• Crafting Method: Computed by aggregating per-sample perturbation vectors using an iterative algorithm that enforces a global norm constraint while maximizing the fooling rate across the training distribution.
• Transferability: Universal perturbations often transfer across different model architectures trained on the same task, enabling black-box attacks without query access.
• Physical Realizability: In RF, the perturbation must be constrained to respect spectral emission masks and peak-to-average power ratio limits, requiring a projection step onto the feasible set of transmittable waveforms.

Standard adversarial examples crafted in the digital domain often fail to survive propagation through a physical wireless channel. Channel-aware attacks incorporate the channel impulse response into the perturbation optimization.

• Over-the-Air Robustness: The perturbation is convolved with an estimated or measured channel matrix during optimization, ensuring the adversarial effect persists after multipath fading and noise are applied.
• EIRP Constraints: The effective isotropic radiated power of the perturbation is constrained to prevent the adversary from simply increasing transmit power to overcome channel effects.
• Waveform-Specific Masking: Perturbations are projected onto the subspace of valid waveforms for the target modulation scheme, ensuring the adversarial signal remains demodulable by unintended receivers and evades anomaly detectors.

An evaluation methodology where the attacker is assumed to have full knowledge of the defense mechanism and tailors the attack to circumvent it. This is the gold standard for empirically validating adversarial robustness claims.

• Obfuscated Gradient Bypass: Many defenses rely on non-differentiable components or randomized transformations that cause gradient masking. Adaptive attackers replace these with differentiable approximations or compute gradients via Backward Pass Differentiable Approximation (BPDA).
• Expectation over Transformation (EoT): When a defense applies random input transformations, the attacker computes the gradient over the expected value of the transformed input, neutralizing the stochasticity.
• Defense-Aware Loss Functions: The attack optimization explicitly penalizes the defense's detection mechanism, jointly optimizing for misclassification and evasion of the anomaly detector.

The resilience of an RF fingerprinting model against evasion attacks, where a malicious actor intentionally modifies their transmitted signal to fool the classifier. Robustness is quantified by measuring model accuracy against progressively stronger adversarial perturbations constrained by a maximum distortion budget. Key hardening techniques include:

• Adversarial training: Augmenting the training set with crafted adversarial examples
• Defensive distillation: Training a smoother model less sensitive to input perturbations
• Gradient masking: Obscuring the model's decision boundaries from gradient-based attacks

The phenomenon where adversarial perturbations crafted to fool one model (the surrogate) also deceive a different target model with high probability. This enables black-box attacks where the adversary has no direct access to the deployed classifier's architecture or parameters. In electronic warfare, an attacker can:

• Train a local surrogate model on collected RF emissions
• Generate adversarial examples against the surrogate
• Transmit the perturbed signals to evade the operational defender model Transferability is amplified when surrogate and target models share similar architectural inductive biases.