# Over-the-Air Membership Inference Attacks as Privacy Threats for Deep Learning-based Wireless Signal Classifiers

arXiv: https://arxiv.org/abs/2006.14576 · HTML: https://mlsanity.com/paper/2006.14576/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Jun 2020.

## Built on by (most cited first, 13 of 13)

- [Adversarial Machine Learning for 5G Communications Security](https://mlsanity.com/paper/2101.02656/) (2021)
- [Adversarial Attacks on Deep Learning Based Power Allocation in a Massive MIMO Network](https://mlsanity.com/paper/2101.12090/) (2021)
- [Adversarial Machine Learning for Flooding Attacks on 5G Radio Access Network Slicing](https://mlsanity.com/paper/2101.08724/) (2021)
- [Adversarial Attacks on Deep Learning Based mmWave Beam Prediction in 5G and Beyond](https://mlsanity.com/paper/2103.13989/) (2021)
- [Federated Learning for Big Data: A Survey on Opportunities, Applications, and Future Directions](https://mlsanity.com/paper/2110.04160/) (2021)
- [Jamming Attacks on Federated Learning in Wireless Networks](https://mlsanity.com/paper/2201.05172/) (2022)
- [Membership Inference Attack and Defense for Wireless Signal Classifiers with Deep Learning](https://mlsanity.com/paper/2107.12173/) (2021)
- [Adversarial Attacks against Deep Learning Based Power Control in Wireless Communications](https://mlsanity.com/paper/2109.08139/) (2021)
- [Downlink Power Allocation in Massive MIMO via Deep Learning: Adversarial Attacks and Training](https://mlsanity.com/paper/2206.06592/) (2022)
- [Adversarial Machine Learning and Defense Game for NextG Signal Classification with Deep Learning](https://mlsanity.com/paper/2212.11778/) (2022)
- [Securing Genomic Data Against Inference Attacks in Federated Learning Environments](https://mlsanity.com/paper/2505.07188/) (2025)
- [PrivateMail: Supervised Manifold Learning of Deep Features With Differential Privacy for Image Retrieval](https://mlsanity.com/paper/2102.10802/) (2021)
- [Covert Communications via Adversarial Machine Learning and Reconfigurable Intelligent Surfaces](https://mlsanity.com/paper/2112.11414/) (2021)

## Abstract (arXiv)

This paper presents how to leak private information from a wireless signal classifier by launching an over-the-air membership inference attack (MIA). As machine learning (ML) algorithms are used to process wireless signals to make decisions such as PHY-layer authentication, the training data characteristics (e.g., device-level information) and the environment conditions (e.g., channel information) under which the data is collected may leak to the ML model. As a privacy threat, the adversary can use this leaked information to exploit vulnerabilities of the ML model following an adversarial ML approach. In this paper, the MIA is launched against a deep learning-based classifier that uses waveform, device, and channel characteristics (power and phase shifts) in the received signals for RF fingerprinting. By observing the spectrum, the adversary builds first a surrogate classifier and then an inference model to determine whether a signal of interest has been used in the training data of the receiver (e.g., a service provider). The signal of interest can then be associated with particular device and channel characteristics to launch subsequent attacks. The probability of attack success is high (more than 88% depending on waveform and channel conditions) in identifying signals of interest (and potentially the device and channel information) used to build a target classifier. These results show that wireless signal classifiers are vulnerable to privacy threats due to the over-the-air information leakage of their ML models