# Adversarial Machine Learning for NextG Covert Communications Using Multiple Antennas
## 5 Simulation Results
### Performance Evaluation of CJ with One Antenna for Signals with Different Modulations  
We first assumed that the CJ only had one antenna, \(q=1\), and aimed to hide signals with a fixed modulation scheme, namely QPSK or 16 QAM, used by the transmitter using Algorithm 1. Note that we used only Algorithm 1 since the CJ only had a single antenna. The first topology that we considered was \(d_{cr}=d_{ce}=1\). In Figure 3, we show how the perturbation signal generated by the CJ affects the classifier at the eavesdropper. The \(x\)-axis is the PNR (measured in dB) and the \(y\)-axis is the success of covertness (measured in percentage) that indicates the success of making wireless communications covert, namely the likelihood that the eavesdropper classifies a signal plus perturbation as noise. We observe that as the SNR of the signal increases, the CJ needs more perturbation power to cause misclassification at the eavesdropper. Furthermore, the 16 QAM-modulated signal is more susceptible to adversarial perturbation than the QPSK-modulated signal, since it is more difficult to distinguish the 16 QAM-modulated signal from the noise for the same SNR. Furthermore, we observe that the success of covertness suddenly increases after some PNR value for both modulation types. On the contrary, the Gaussian noise based perturbation has negligible effect on the classifier for all SNR values. We further observe that the Gaussian noise with more power decreases the success of covertness when the SNR of 16-QAM modulated signal is 3 dB. The reason is the Gaussian noise strengthens the noise which makes the received signal at the eavesdropper resemble the strength of the signal, thus the classifier at the eavesdropper classifies the received signal as signal. In Figure 4, we consider \(d_{cr},=1.5\) and \(d_{ce}=0.5\) (namely, the distance between the CJ and the receiver is increased and the distance between the CJ and the eavesdropper is decreased compared to Figure 3). As the SNR of the signal increases, the CJ requires more power to cause misclassification at the eavesdropper, as we also observed in Figure 3. Due to the reduced path loss effect between the CJ and the eavesdropper, less power is required to cause misclassification compared to Figure 3. This result motivates the use of AML instead of conventional jamming (e.g., [51]) to attack an eavesdropper. Figure 3: Success of covertness at the eavesdropper when \(d_{ce}=d_{cr}=1\). Reliability of Communications  
The BER performance at the receiver for different modulation types and SNR values is compared in Figure 5 when \(d_{cr}=d_{ce}=1\). We observe that the BER of the 16 QAM-modulated signals is more susceptible to the adversarial perturbation signal than the BER of QPSK-modulated signals. The reason is that since the 16 QAM transmits more bits than the QPSK per symbol, the distances between constellation points are smaller, which leads to a larger BER for a given SNR. Moreover, as the SNR increases, the average BER decreases as expected. For the CJ with the proposed adversarial perturbation, we observe that the BER curve saturates after some PNR value because the successful perturbation signal can be generated using less power than the maximum power that the CJ can use. Figure 5 can be used as a guideline to determine the maximum PNR to satisfy the BER requirement at the receiver. For example, to meet the target BER of 0.15 for a QPSK-modulated signal, the PNR is selected to be at most \(-8\) dB when the SNR is 3 dB and the resulting success of covertness is 65%. Furthermore, we observe that the Gaussian noise based perturbation results in a lower BER than the adversarial perturbation in the low PNR regime. However, the BER gap between these two CJ schemes decreases when the PNR increases, and the adversarial perturbation results in a smaller BER in the high PNR region. Figure 4: Success of covertness at the eavesdropper when \(d_{ce}=0.5\) and \(d_{cr}=1.5\). Figure 5: BER at the receiver when \(d_{ce}=d_{cr}=1\).