# How to Attack and Defend NextG Radio Access Network Slicing with Reinforcement Learning

arXiv: https://arxiv.org/abs/2101.05768 · HTML: https://mlsanity.com/paper/2101.05768/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jan 2021.

## Built on by (most cited first, 8 of 8)

- [Learning Near-Optimal Intrusion Responses Against Dynamic Attackers](https://mlsanity.com/paper/2301.06085/) (2023)
- [Adversarial Machine Learning for Flooding Attacks on 5G Radio Access Network Slicing](https://mlsanity.com/paper/2101.08724/) (2021)
- [Jamming Attacks on Federated Learning in Wireless Networks](https://mlsanity.com/paper/2201.05172/) (2022)
- [ML-Enabled Open RAN: A Comprehensive Survey of Architectures, Challenges, and Opportunities](https://mlsanity.com/paper/2604.01239/) (2026)
- [Deep Reinforcement Learning for Power Control in Next-Generation WiFi Network Systems](https://mlsanity.com/paper/2211.01107/) (2022)
- [Robust Network Slicing: Multi-Agent Policies, Adversarial Attacks, and Defensive Strategies](https://mlsanity.com/paper/2311.11206/) (2023)
- [Signal Adversarial Examples Generation for Signal Detection Network via White-Box Attack](https://mlsanity.com/paper/2410.01393/) (2024)
- [Adversarial Attacks in AI-Driven RAN Slicing: SLA Violations and Recovery](https://mlsanity.com/paper/2604.01049/) (2026)

## Abstract (arXiv)

In this paper, reinforcement learning (RL) for network slicing is considered in NextG radio access networks, where the base station (gNodeB) allocates resource blocks (RBs) to the requests of user equipments and aims to maximize the total reward of accepted requests over time. Based on adversarial machine learning, a novel over-the-air attack is introduced to manipulate the RL algorithm and disrupt NextG network slicing. The adversary observes the spectrum and builds its own RL based surrogate model that selects which RBs to jam subject to an energy budget with the objective of maximizing the number of failed requests due to jammed RBs. By jamming the RBs, the adversary reduces the RL algorithm's reward. As this reward is used as the input to update the RL algorithm, the performance does not recover even after the adversary stops jamming. This attack is evaluated in terms of both the recovery time and the (maximum and total) reward loss, and it is shown to be much more effective than benchmark (random and myopic) jamming attacks. Different reactive and proactive defense schemes (protecting the RL algorithm's updates or misleading the adversary's learning process) are introduced to show that it is viable to defend NextG network slicing against this attack.