# Adversarial Attacks with Multiple Antennas Against Deep Learning-Based Modulation Classifiers

arXiv: https://arxiv.org/abs/2007.16204 · HTML: https://mlsanity.com/paper/2007.16204/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 Jul 2020.

## Built on by (most cited first, 9 of 9)

- [Adversarial Machine Learning for 5G Communications Security](https://mlsanity.com/paper/2101.02656/) (2021)
- [Adversarial Machine Learning for Flooding Attacks on 5G Radio Access Network Slicing](https://mlsanity.com/paper/2101.08724/) (2021)
- [Adversarial Attacks on Deep Learning Based mmWave Beam Prediction in 5G and Beyond](https://mlsanity.com/paper/2103.13989/) (2021)
- [Jamming Attacks on Federated Learning in Wireless Networks](https://mlsanity.com/paper/2201.05172/) (2022)
- [Membership Inference Attack and Defense for Wireless Signal Classifiers with Deep Learning](https://mlsanity.com/paper/2107.12173/) (2021)
- [Wild Networks: Exposure of 5G Network Infrastructures to Adversarial Examples](https://mlsanity.com/paper/2207.01531/) (2022)
- [Adversarial Attacks against Deep Learning Based Power Control in Wireless Communications](https://mlsanity.com/paper/2109.08139/) (2021)
- [AIR: Threats of Adversarial Attacks on Deep Learning-Based Information Recovery](https://mlsanity.com/paper/2309.16706/) (2023)
- [Covert Communications via Adversarial Machine Learning and Reconfigurable Intelligent Surfaces](https://mlsanity.com/paper/2112.11414/) (2021)

## Abstract (arXiv)

We consider a wireless communication system, where a transmitter sends signals to a receiver with different modulation types while the receiver classifies the modulation types of the received signals using its deep learning-based classifier. Concurrently, an adversary transmits adversarial perturbations using its multiple antennas to fool the classifier into misclassifying the received signals. From the adversarial machine learning perspective, we show how to utilize multiple antennas at the adversary to improve the adversarial (evasion) attack performance. Two main points are considered while exploiting the multiple antennas at the adversary, namely the power allocation among antennas and the utilization of channel diversity. First, we show that multiple independent adversaries, each with a single antenna cannot improve the attack performance compared to a single adversary with multiple antennas using the same total power. Then, we consider various ways to allocate power among multiple antennas at a single adversary such as allocating power to only one antenna, and proportional or inversely proportional to the channel gain. By utilizing channel diversity, we introduce an attack to transmit the adversarial perturbation through the channel with the largest channel gain at the symbol level. We show that this attack reduces the classifier accuracy significantly compared to other attacks under different channel conditions in terms of channel variance and channel correlation across antennas. Also, we show that the attack success improves significantly as the number of antennas increases at the adversary that can better utilize channel diversity to craft adversarial attacks.