# Over-the-Air Adversarial Attacks on Deep Learning Based Modulation Classifier over Wireless Channels

arXiv: https://arxiv.org/abs/2002.02400 · HTML: https://mlsanity.com/paper/2002.02400/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Feb 2020.

## Built on by (most cited first, 17 of 17)

- [Adversarial Machine Learning for 5G Communications Security](https://mlsanity.com/paper/2101.02656/) (2021)
- [Adversarial Attacks on Deep Learning Based Power Allocation in a Massive MIMO Network](https://mlsanity.com/paper/2101.12090/) (2021)
- [Adversarial Machine Learning for Flooding Attacks on 5G Radio Access Network Slicing](https://mlsanity.com/paper/2101.08724/) (2021)
- [Adversarial Attacks on Deep Learning Based mmWave Beam Prediction in 5G and Beyond](https://mlsanity.com/paper/2103.13989/) (2021)
- [Jamming Attacks on Federated Learning in Wireless Networks](https://mlsanity.com/paper/2201.05172/) (2022)
- [Membership Inference Attack and Defense for Wireless Signal Classifiers with Deep Learning](https://mlsanity.com/paper/2107.12173/) (2021)
- [Wild Networks: Exposure of 5G Network Infrastructures to Adversarial Examples](https://mlsanity.com/paper/2207.01531/) (2022)
- [Adversarial Attacks against Deep Learning Based Power Control in Wireless Communications](https://mlsanity.com/paper/2109.08139/) (2021)
- [Gradient-based Adversarial Deep Modulation Classification with Data-driven Subsampling](https://mlsanity.com/paper/2104.06375/) (2021)
- [Mixture GAN For Modulation Classification Resiliency Against Adversarial Attacks](https://mlsanity.com/paper/2205.15743/) (2022)
- [RF Signal Transformation and Classification using Deep Neural Networks](https://mlsanity.com/paper/2204.03564/) (2022)
- [Adversarial Machine Learning and Defense Game for NextG Signal Classification with Deep Learning](https://mlsanity.com/paper/2212.11778/) (2022)
- [AIR: Threats of Adversarial Attacks on Deep Learning-Based Information Recovery](https://mlsanity.com/paper/2309.16706/) (2023)
- [Covert Communications via Adversarial Machine Learning and Reconfigurable Intelligent Surfaces](https://mlsanity.com/paper/2112.11414/) (2021)
- [Low-Interception Waveform: To Prevent the Recognition of Spectrum Waveform Modulation via Adversarial Examples](https://mlsanity.com/paper/2201.08731/) (2022)
- [Data-Driven Subsampling in the Presence of an Adversarial Actor](https://mlsanity.com/paper/2401.03488/) (2024)
- [Golden Ratio Search: A Low-Power Adversarial Attack for Deep Learning based Modulation Classification](https://mlsanity.com/paper/2409.11454/) (2024)

## Abstract (arXiv)

We consider a wireless communication system that consists of a transmitter, a receiver, and an adversary. The transmitter transmits signals with different modulation types, while the receiver classifies its received signals to modulation types using a deep learning-based classifier. In the meantime, the adversary makes over-the-air transmissions that are received as superimposed with the transmitter's signals to fool the classifier at the receiver into making errors. While this evasion attack has received growing interest recently, the channel effects from the adversary to the receiver have been ignored so far such that the previous attack mechanisms cannot be applied under realistic channel effects. In this paper, we present how to launch a realistic evasion attack by considering channels from the adversary to the receiver. Our results show that modulation classification is vulnerable to an adversarial attack over a wireless channel that is modeled as Rayleigh fading with path loss and shadowing. We present various adversarial attacks with respect to availability of information about channel, transmitter input, and classifier architecture. First, we present two types of adversarial attacks, namely a targeted attack (with minimum power) and non-targeted attack that aims to change the classification to a target label or to any other label other than the true label, respectively. Both are white-box attacks that are transmitter input-specific and use channel information. Then we introduce an algorithm to generate adversarial attacks using limited channel information where the adversary only knows the channel distribution. Finally, we present a black-box universal adversarial perturbation (UAP) attack where the adversary has limited knowledge about both channel and transmitter input.