# Adversarial Machine Learning and Defense Game for NextG Signal Classification with Deep Learning

arXiv: https://arxiv.org/abs/2212.11778 · HTML: https://mlsanity.com/paper/2212.11778/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 19 of its 29 references that are in the map.
- First posted on arXiv 22 Dec 2022.

## Builds on (most cited first, 19 of 19)

- [Adversarial Attacks on Deep-Learning Based Radio Signal Classification](https://mlsanity.com/paper/1808.07713/) (2018)
- [Deep Learning for Wireless Communications](https://mlsanity.com/paper/2005.06068/) (2020)
- [Deep Learning for Launching and Mitigating Wireless Jamming Attacks](https://mlsanity.com/paper/1807.02567/) (2018)
- [Evaluating Adversarial Evasion Attacks in the Context of Wireless Communications](https://mlsanity.com/paper/1903.01563/) (2019)
- [Deep Learning for RF Signal Classification in Unknown and Dynamic Spectrum Environments](https://mlsanity.com/paper/1909.11800/) (2019)
- [Channel-Aware Adversarial Attacks Against Deep Learning-Based Wireless Signal Classifiers](https://mlsanity.com/paper/2005.05321/) (2020)
- [Adversarial Machine Learning in Wireless Communications using RF Data: A Review](https://mlsanity.com/paper/2012.14392/) (2020)
- [Generative Adversarial Network for Wireless Signal Spoofing](https://mlsanity.com/paper/1905.01008/) (2019)
- [IoT Network Security from the Perspective of Adversarial Deep Learning](https://mlsanity.com/paper/1906.00076/) (2019)
- [Adversarial Deep Learning for Over-the-Air Spectrum Poisoning Attacks](https://mlsanity.com/paper/1911.00500/) (2019)
- [The Best Defense Is a Good Offense: Adversarial Attacks to Avoid Modulation Detection](https://mlsanity.com/paper/1902.10674/) (2019)
- [Over-the-Air Adversarial Attacks on Deep Learning Based Modulation Classifier over Wireless Channels](https://mlsanity.com/paper/2002.02400/) (2020)
- [Trojan Attacks on Wireless Signal Classification with Adversarial Machine Learning](https://mlsanity.com/paper/1910.10766/) (2019)
- [Spectrum Data Poisoning with Adversarial Deep Learning](https://mlsanity.com/paper/1901.09247/) (2019)
- [Over-the-Air Membership Inference Attacks as Privacy Threats for Deep Learning-based Wireless Signal Classifiers](https://mlsanity.com/paper/2006.14576/) (2020)
- [When Attackers Meet AI: Learning-empowered Attacks in Cooperative Spectrum Sensing](https://mlsanity.com/paper/1905.01430/) (2019)
- [When Wireless Security Meets Machine Learning: Motivation, Challenges, and Research Directions](https://mlsanity.com/paper/2001.08883/) (2020)
- [Adversarial Machine Learning for 5G Communications Security](https://mlsanity.com/paper/2101.02656/) (2021)
- [Deep Learning Classification of 3.5 GHz Band Spectrograms with Applications to Spectrum Sensing](https://mlsanity.com/paper/1806.07745/) (2018)

## Built on by (most cited first, 1 of 1)

- [Securing NextG Systems against Poisoning Attacks on Federated Learning: A Game-Theoretic Solution](https://mlsanity.com/paper/2312.17164/) (2023)

## Abstract (arXiv)

This paper presents a game-theoretic framework to study the interactions of attack and defense for deep learning-based NextG signal classification. NextG systems such as the one envisioned for a massive number of IoT devices can employ deep neural networks (DNNs) for various tasks such as user equipment identification, physical layer authentication, and detection of incumbent users (such as in the Citizens Broadband Radio Service (CBRS) band). By training another DNN as the surrogate model, an adversary can launch an inference (exploratory) attack to learn the behavior of the victim model, predict successful operation modes (e.g., channel access), and jam them. A defense mechanism can increase the adversary's uncertainty by introducing controlled errors in the victim model's decisions (i.e., poisoning the adversary's training data). This defense is effective against an attack but reduces the performance when there is no attack. The interactions between the defender and the adversary are formulated as a non-cooperative game, where the defender selects the probability of defending or the defense level itself (i.e., the ratio of falsified decisions) and the adversary selects the probability of attacking. The defender's objective is to maximize its reward (e.g., throughput or transmission success ratio), whereas the adversary's objective is to minimize this reward and its attack cost. The Nash equilibrium strategies are determined as operation modes such that no player can unilaterally improve its utility given the other's strategy is fixed. A fictitious play is formulated for each player to play the game repeatedly in response to the empirical frequency of the opponent's actions. The performance in Nash equilibrium is compared to the fixed attack and defense cases, and the resilience of NextG signal classification against attacks is quantified.