# Adversarial Examples in RF Deep Learning: Detection of the Attack and its Physical Robustness

arXiv: https://arxiv.org/abs/1902.06044 · HTML: https://mlsanity.com/paper/1902.06044/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Feb 2019.

## Built on by (most cited first, 7 of 7)

- [Adversarial Machine Learning for 5G Communications Security](https://mlsanity.com/paper/2101.02656/) (2021)
- [Jamming Attacks on Federated Learning in Wireless Networks](https://mlsanity.com/paper/2201.05172/) (2022)
- [Membership Inference Attack and Defense for Wireless Signal Classifiers with Deep Learning](https://mlsanity.com/paper/2107.12173/) (2021)
- [Real-time Over-the-air Adversarial Perturbations for Digital Communications using Deep Neural Networks](https://mlsanity.com/paper/2202.11197/) (2022)
- [Universal Fourier Attack for Time Series](https://mlsanity.com/paper/2209.00757/) (2022)
- [AIR: Threats of Adversarial Attacks on Deep Learning-Based Information Recovery](https://mlsanity.com/paper/2309.16706/) (2023)
- [Real-World Adversarial Attacks on RF-Based Drone Detectors](https://mlsanity.com/paper/2512.20712/) (2025)

## Abstract (arXiv)

While research on adversarial examples in machine learning for images has been prolific, similar attacks on deep learning (DL) for radio frequency (RF) signals and their mitigation strategies are scarcely addressed in the published work, with only one recent publication in the RF domain [1]. RF adversarial examples (AdExs) can cause drastic, targeted misclassification results mostly in spectrum sensing/ survey applications (e.g. BPSK mistaken for 8-PSK) with minimal waveform perturbation. It is not clear if the RF AdExs maintain their effects in the physical world, i.e., when AdExs are delivered over-the-air (OTA). Our research on deep learning AdExs and proposed defense mechanisms are RF-centric, and incorporate physical world, OTA effects. We here present defense mechanisms based on statistical tests. One test to detect AdExs utilizes Peak-to- Average-Power-Ratio (PAPR) of the DL data points delivered OTA, while another statistical test uses the Softmax outputs of the DL classifier, which corresponds to the probabilities the classifier assigns to each of the trained classes. The former test leverages the RF nature of the data, and the latter is universally applicable to AdExs regardless of their origin. Both solutions are shown as viable mitigation methods to subvert adversarial attacks against communications and radar sensing systems.