# Real-World Adversarial Attacks on RF-Based Drone Detectors

arXiv: https://arxiv.org/abs/2512.20712 · HTML: https://mlsanity.com/paper/2512.20712/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 20 references that are in the map.
- First posted on arXiv 23 Dec 2025.

## Builds on (most cited first, 7 of 7)

- [Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks](https://mlsanity.com/paper/1506.01497/) (2015)
- [You Only Look Once: Unified, Real-Time Object Detection](https://mlsanity.com/paper/1506.02640/) (2015)
- [Adversarial Attacks on Deep-Learning Based Radio Signal Classification](https://mlsanity.com/paper/1808.07713/) (2018)
- [Evaluating Adversarial Evasion Attacks in the Context of Wireless Communications](https://mlsanity.com/paper/1903.01563/) (2019)
- [Channel-Aware Adversarial Attacks Against Deep Learning-Based Wireless Signal Classifiers](https://mlsanity.com/paper/2005.05321/) (2020)
- [Adversarial Examples in RF Deep Learning: Detection of the Attack and its Physical Robustness](https://mlsanity.com/paper/1902.06044/) (2019)
- [Real-time Over-the-air Adversarial Perturbations for Digital Communications using Deep Neural Networks](https://mlsanity.com/paper/2202.11197/) (2022)

## Abstract (arXiv)

Radio frequency (RF) based systems are increasingly used to detect drones by analyzing their RF signal patterns, converting them into spectrogram images which are processed by object detection models. Existing RF attacks against image based models alter digital features, making over-the-air (OTA) implementation difficult due to the challenge of converting digital perturbations to transmittable waveforms that may introduce synchronization errors and interference, and encounter hardware limitations. We present the first physical attack on RF image based drone detectors, optimizing class-specific universal complex baseband (I/Q) perturbation waveforms that are transmitted alongside legitimate communications. We evaluated the attack using RF recordings and OTA experiments with four types of drones. Our results show that modest, structured I/Q perturbations are compatible with standard RF chains and reliably reduce target drone detection while preserving detection of legitimate drones.