# Channel Effects on Surrogate Models of Adversarial Attacks against Wireless Signal Classifiers

arXiv: https://arxiv.org/abs/2012.02160 · HTML: https://mlsanity.com/paper/2012.02160/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Dec 2020.

## Built on by (most cited first, 9 of 9)

- [Adversarial Machine Learning for 5G Communications Security](https://mlsanity.com/paper/2101.02656/) (2021)
- [Adversarial Attacks on Deep Learning Based mmWave Beam Prediction in 5G and Beyond](https://mlsanity.com/paper/2103.13989/) (2021)
- [Jamming Attacks on Federated Learning in Wireless Networks](https://mlsanity.com/paper/2201.05172/) (2022)
- [Membership Inference Attack and Defense for Wireless Signal Classifiers with Deep Learning](https://mlsanity.com/paper/2107.12173/) (2021)
- [Adversarial Attacks against Deep Learning Based Power Control in Wireless Communications](https://mlsanity.com/paper/2109.08139/) (2021)
- [AIR: Threats of Adversarial Attacks on Deep Learning-Based Information Recovery](https://mlsanity.com/paper/2309.16706/) (2023)
- [Adversarial Attacks on LoRa Device Identification and Rogue Signal Detection with Deep Learning](https://mlsanity.com/paper/2312.16715/) (2023)
- [Adversarial Attack and Defense for LoRa Device Identification and Authentication via Deep Learning](https://mlsanity.com/paper/2412.21164/) (2024)
- [Covert Communications via Adversarial Machine Learning and Reconfigurable Intelligent Surfaces](https://mlsanity.com/paper/2112.11414/) (2021)

## Abstract (arXiv)

We consider a wireless communication system that consists of a background emitter, a transmitter, and an adversary. The transmitter is equipped with a deep neural network (DNN) classifier for detecting the ongoing transmissions from the background emitter and transmits a signal if the spectrum is idle. Concurrently, the adversary trains its own DNN classifier as the surrogate model by observing the spectrum to detect the ongoing transmissions of the background emitter and generate adversarial attacks to fool the transmitter into misclassifying the channel as idle. This surrogate model may differ from the transmitter's classifier significantly because the adversary and the transmitter experience different channels from the background emitter and therefore their classifiers are trained with different distributions of inputs. This system model may represent a setting where the background emitter is a primary user, the transmitter is a secondary user, and the adversary is trying to fool the secondary user to transmit even though the channel is occupied by the primary user. We consider different topologies to investigate how different surrogate models that are trained by the adversary (depending on the differences in channel effects experienced by the adversary) affect the performance of the adversarial attack. The simulation results show that the surrogate models that are trained with different distributions of channel-induced inputs severely limit the attack performance and indicate that the transferability of adversarial attacks is neither readily available nor straightforward to achieve since surrogate models for wireless applications may significantly differ from the target model depending on channel effects.