# Adversarial Machine Learning for NextG Covert Communications Using Multiple Antennas
## 1 Introduction  
Privacy is a fundamental problem in wireless communications due to the open and shared nature of wireless medium. An eavesdropper may overhear the communications intended between a transmitter and a receiver. The eavesdropper may pursue different objectives such as decoding transmissions or detecting whether there is an ongoing transmission, or not (e.g., for launching follow-up jamming attacks). The privacy of information regarding unapproved decoding has been extensively studied from both encryption-based security and information theory perspectives [1; 2]. In this paper, we consider an eavesdropper that pursues the second objective, namely detecting an ongoing transmission for future adversarial purposes such as jamming to degrade the quality of communications. _Covert communications_ has been studied to hide information in noise where the main goal has been to reduce the signal-to-noise ratio (SNR) at the eavesdropper [3; 4]. A fundamental bound has been demonstrated on the total transmit power over a given number of channel users while maintaining covert communications, generally known as the square-root law [5]; see also [6] for related work. In this paper, we study covert communications from an _adversarial machine learning_ (AML) point of view. Overall, AML is an emerging field that studies machine learning (ML) in the presence of adversaries that may aim to manipulate the test and/or training pipelines of ML algorithms [7; 8; 9]. While the applications of AML have originated in the computer vision domain, there has been a growing interest in applying AML to wireless communications [10; 11; 12], including exploratory (inference) attacks [13; 14], evasion (adversarial) attacks [15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25; 26; 27; 28; 29; 30; 31; 32; 33] and their extensions to secure and covertcommunications against eavesdroppers [34; 35; 36; 37], causative (poisoning) attacks [38; 39; 40], membership inference attacks [41; 42], Trojan attacks [43], and spoofing attacks [44; 45; 46; 47]. We consider an eavesdropper with a deep learning (DL)-based classifier to detect an ongoing transmission where this classifier achieves a high accuracy for distinguishing the received signals from noise. We introduce a _cooperative jammer_ (_CJ_) that has been extensively used in the physical layer security literature [48; 49; 50]. In this paper, the CJ transmits signals over the air at the same time as the transmitter with the purpose of fooling the eavesdropper's classifier for covert communications. These signals from CJ corresponds to an evasion attack (or adversarial attack) in AML where evasion attacks have been used to manipulate wireless signal classification (in particular, modulation classification) [15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25; 26; 27; 28], spectrum sensing [29], autoencoder communications [30], initial access [31], channel estimation [32], and power control [33]. In this paper, adversarial attack is used as a means of covert communications to prevent an eavesdropper from distinguishing an ongoing transmission from noise. We use the CJ as the source of adversarial perturbation to manipulate the classifier at an eavesdropper into making classification errors. While a perturbation with high power level transmitted by the CJ can easily fool the classifier, it would also increase the interference and the bit error rate (BER) at the intended receiver to an unacceptable level. Therefore, an upper bound on the perturbation strength is imposed. A special case of our setting has been considered in [34], where the transmitter with a single antenna adds perturbations to its own signals to fool an eavesdropper with a modulation classifier while aiming to maintain its own communication performance. In this paper, our focus is on covert communications aided by a CJ, whose position can further boost the impact on the eavesdropper to classify received signal as noise while reducing the impact on the BER performance.