# Adversarial Attacks Against Deep Learning-Based Radio Frequency Fingerprint Identification

arXiv: https://arxiv.org/abs/2512.12002 · HTML: https://mlsanity.com/paper/2512.12002/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 25 of its 56 references that are in the map.
- First posted on arXiv 12 Dec 2025.

## Builds on (most cited first, 25 of 25)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [Universal adversarial perturbations](https://mlsanity.com/paper/1610.08401/) (2016)
- [Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples](https://mlsanity.com/paper/1605.07277/) (2016)
- [Technical Report on the CleverHans v2.1.0 Adversarial Examples Library](https://mlsanity.com/paper/1610.00768/) (2016)
- [Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks](https://mlsanity.com/paper/1812.09803/) (2018)
- [Evaluating Adversarial Evasion Attacks in the Context of Wireless Communications](https://mlsanity.com/paper/1903.01563/) (2019)
- [Channel-Aware Adversarial Attacks Against Deep Learning-Based Wireless Signal Classifiers](https://mlsanity.com/paper/2005.05321/) (2020)
- [Adversarial Machine Learning in Wireless Communications using RF Data: A Review](https://mlsanity.com/paper/2012.14392/) (2020)
- [Adversarial Deep Learning for Over-the-Air Spectrum Poisoning Attacks](https://mlsanity.com/paper/1911.00500/) (2019)
- [Physical Adversarial Attacks Against End-to-End Autoencoder Communication Systems](https://mlsanity.com/paper/1902.08391/) (2019)
- [The Best Defense Is a Good Offense: Adversarial Attacks to Avoid Modulation Detection](https://mlsanity.com/paper/1902.10674/) (2019)
- [Open Set Wireless Transmitter Authorization: Deep Learning Approaches and Dataset Considerations](https://mlsanity.com/paper/2005.00954/) (2020)
- [Towards Scalable and Channel-Robust Radio Frequency Fingerprint Identification for LoRa](https://mlsanity.com/paper/2107.02867/) (2021)
- [Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain](https://mlsanity.com/paper/1905.07672/) (2019)
- [A Generalizable Model-and-Data Driven Approach for Open-Set RFF Authentication](https://mlsanity.com/paper/2108.04436/) (2021)
- [SecureSense: Defending Adversarial Attack for Secure Device-Free Human Activity Recognition](https://mlsanity.com/paper/2204.01560/) (2022)
- [Towards Receiver-Agnostic and Collaborative Radio Frequency Fingerprint Identification](https://mlsanity.com/paper/2207.02999/) (2022)
- [Analysis of Dominant Classes in Universal Adversarial Perturbations](https://mlsanity.com/paper/2012.14352/) (2020)
- [Embedding-Assisted Attentional Deep Learning for Real-World RF Fingerprinting of Bluetooth](https://mlsanity.com/paper/2210.02897/) (2022)
- [Over-The-Air Adversarial Attacks on Deep Learning Wi-Fi Fingerprinting](https://mlsanity.com/paper/2301.03760/) (2023)
- [White-Box Adversarial Attacks on Deep Learning-Based Radio Frequency Fingerprint Identification](https://mlsanity.com/paper/2308.07433/) (2023)
- [DeepCRF: Deep Learning-Enhanced CSI-Based RF Fingerprinting for Channel-Resilient WiFi Device Identification](https://mlsanity.com/paper/2411.06925/) (2024)
- [Adversarial Attack and Defense for LoRa Device Identification and Authentication via Deep Learning](https://mlsanity.com/paper/2412.21164/) (2024)

## Built on by (most cited first, 2 of 2)

- [QUASAR: A Quantum-Classical Neural Network for SAR Satellite Physical-Layer Authentication](https://mlsanity.com/paper/2608.20240/) (2026)
- [Adaptive Distributed Physical-Layer Authentication and Attack Detection in 6G Non-Terrestrial Networks via Causal Meta-Learning](https://mlsanity.com/paper/2609.09511/) (2026)

## Abstract (arXiv)

Radio frequency fingerprint identification (RFFI) is an emerging technique for the lightweight authentication of wireless Internet of things (IoT) devices. RFFI exploits deep learning models to extract hardware impairments to uniquely identify wireless devices. Recent studies show deep learning-based RFFI is vulnerable to adversarial attacks. However, effective adversarial attacks against different types of RFFI classifiers have not yet been explored. In this paper, we carried out a comprehensive investigations into different adversarial attack methods on RFFI systems using various deep learning models. Three specific algorithms, fast gradient sign method (FGSM), projected gradient descent (PGD), and universal adversarial perturbation (UAP), were analyzed. The attacks were launched to LoRa-RFFI and the experimental results showed the generated perturbations were effective against convolutional neural networks (CNNs), long short-term memory (LSTM) networks, and gated recurrent units (GRU). We further used UAP to launch practical attacks. Special factors were considered for the wireless context, including implementing real-time attacks, the effectiveness of the attacks over a period of time, etc. Our experimental evaluation demonstrated that UAP can successfully launch adversarial attacks against the RFFI, achieving a success rate of 81.7% when the adversary almost has no prior knowledge of the victim RFFI systems.