# Adversarial Deep Learning for Over-the-Air Spectrum Poisoning Attacks

arXiv: https://arxiv.org/abs/1911.00500 · HTML: https://mlsanity.com/paper/1911.00500/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Nov 2019.

## Built on by (most cited first, 20 of 20)

- [Adversarial Machine Learning for 5G Communications Security](https://mlsanity.com/paper/2101.02656/) (2021)
- [Adversarial Attacks on Deep Learning Based Power Allocation in a Massive MIMO Network](https://mlsanity.com/paper/2101.12090/) (2021)
- [SecureSense: Defending Adversarial Attack for Secure Device-Free Human Activity Recognition](https://mlsanity.com/paper/2204.01560/) (2022)
- [Adversarial Machine Learning for Flooding Attacks on 5G Radio Access Network Slicing](https://mlsanity.com/paper/2101.08724/) (2021)
- [Adversarial Attacks on Deep Learning Based mmWave Beam Prediction in 5G and Beyond](https://mlsanity.com/paper/2103.13989/) (2021)
- [When Machine Learning Meets Spectrum Sharing Security: Methodologies and Challenges](https://mlsanity.com/paper/2201.04677/) (2022)
- [Jamming Attacks on Federated Learning in Wireless Networks](https://mlsanity.com/paper/2201.05172/) (2022)
- [Membership Inference Attack and Defense for Wireless Signal Classifiers with Deep Learning](https://mlsanity.com/paper/2107.12173/) (2021)
- [Wild Networks: Exposure of 5G Network Infrastructures to Adversarial Examples](https://mlsanity.com/paper/2207.01531/) (2022)
- [Adversarial Attacks against Deep Learning Based Power Control in Wireless Communications](https://mlsanity.com/paper/2109.08139/) (2021)
- [IoTGAN: GAN Powered Camouflage Against Machine Learning Based IoT Device Identification](https://mlsanity.com/paper/2201.03281/) (2022)
- [Securing NextG Systems against Poisoning Attacks on Federated Learning: A Game-Theoretic Solution](https://mlsanity.com/paper/2312.17164/) (2023)
- [Adversarial Attacks Against Deep Learning-Based Radio Frequency Fingerprint Identification](https://mlsanity.com/paper/2512.12002/) (2025)
- [Adversarial Reinforcement Learning in Dynamic Channel Access and Power Control](https://mlsanity.com/paper/2105.05817/) (2021)
- [Downlink Power Allocation in Massive MIMO via Deep Learning: Adversarial Attacks and Training](https://mlsanity.com/paper/2206.06592/) (2022)
- [Adversarial Machine Learning and Defense Game for NextG Signal Classification with Deep Learning](https://mlsanity.com/paper/2212.11778/) (2022)
- [AIR: Threats of Adversarial Attacks on Deep Learning-Based Information Recovery](https://mlsanity.com/paper/2309.16706/) (2023)
- [Covert Communications via Adversarial Machine Learning and Reconfigurable Intelligent Surfaces](https://mlsanity.com/paper/2112.11414/) (2021)
- [Transfer-based Adversarial Poisoning Attacks for Online (MIMO-)Deep Receviers](https://mlsanity.com/paper/2409.02430/) (2024)
- [Signal Adversarial Examples Generation for Signal Detection Network via White-Box Attack](https://mlsanity.com/paper/2410.01393/) (2024)

## Abstract (arXiv)

An adversarial deep learning approach is presented to launch over-the-air spectrum poisoning attacks. A transmitter applies deep learning on its spectrum sensing results to predict idle time slots for data transmission. In the meantime, an adversary learns the transmitter's behavior (exploratory attack) by building another deep neural network to predict when transmissions will succeed. The adversary falsifies (poisons) the transmitter's spectrum sensing data over the air by transmitting during the short spectrum sensing period of the transmitter. Depending on whether the transmitter uses the sensing results as test data to make transmit decisions or as training data to retrain its deep neural network, either it is fooled into making incorrect decisions (evasion attack), or the transmitter's algorithm is retrained incorrectly for future decisions (causative attack). Both attacks are energy efficient and hard to detect (stealth) compared to jamming the long data transmission period, and substantially reduce the throughput. A dynamic defense is designed for the transmitter that deliberately makes a small number of incorrect transmissions (selected by the confidence score on channel classification) to manipulate the adversary's training data. This defense effectively fools the adversary (if any) and helps the transmitter sustain its throughput with or without an adversary present.