# Real-time Over-the-air Adversarial Perturbations for Digital Communications using Deep Neural Networks

arXiv: https://arxiv.org/abs/2202.11197 · HTML: https://mlsanity.com/paper/2202.11197/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 22 references that are in the map.
- First posted on arXiv 20 Feb 2022.

## Builds on (most cited first, 12 of 12)

- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [Universal adversarial perturbations](https://mlsanity.com/paper/1610.08401/) (2016)
- [Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods](https://mlsanity.com/paper/1705.07263/) (2017)
- [Adversarial Examples: Attacks and Defenses for Deep Learning](https://mlsanity.com/paper/1712.07107/) (2017)
- [An Introduction to Deep Learning for the Physical Layer](https://mlsanity.com/paper/1702.00832/) (2017)
- [Over the Air Deep Learning Based Radio Signal Classification](https://mlsanity.com/paper/1712.04578/) (2017)
- [Adversarial Attacks on Deep-Learning Based Radio Signal Classification](https://mlsanity.com/paper/1808.07713/) (2018)
- [Evaluating Adversarial Evasion Attacks in the Context of Wireless Communications](https://mlsanity.com/paper/1903.01563/) (2019)
- [Channel-Aware Adversarial Attacks Against Deep Learning-Based Wireless Signal Classifiers](https://mlsanity.com/paper/2005.05321/) (2020)
- [Double Targeted Universal Adversarial Perturbations](https://mlsanity.com/paper/2010.03288/) (2020)
- [Adversarial Examples in RF Deep Learning: Detection of the Attack and its Physical Robustness](https://mlsanity.com/paper/1902.06044/) (2019)

## Built on by (most cited first, 1 of 1)

- [Real-World Adversarial Attacks on RF-Based Drone Detectors](https://mlsanity.com/paper/2512.20712/) (2025)

## Abstract (arXiv)

Deep neural networks (DNNs) are increasingly being used in a variety of traditional radiofrequency (RF) problems. Previous work has shown that while DNN classifiers are typically more accurate than traditional signal processing algorithms, they are vulnerable to intentionally crafted adversarial perturbations which can deceive the DNN classifiers and significantly reduce their accuracy. Such intentional adversarial perturbations can be used by RF communications systems to avoid reactive-jammers and interception systems which rely on DNN classifiers to identify their target modulation scheme. While previous research on RF adversarial perturbations has established the theoretical feasibility of such attacks using simulation studies, critical questions concerning real-world implementation and viability remain unanswered. This work attempts to bridge this gap by defining class-specific and sample-independent adversarial perturbations which are shown to be effective yet computationally feasible in real-time and time-invariant. We demonstrate the effectiveness of these attacks over-the-air across a physical channel using software-defined radios (SDRs). Finally, we demonstrate that these adversarial perturbations can be emitted from a source other than the communications device, making these attacks practical for devices that cannot manipulate their transmitted signals at the physical layer.