# Adversarial Machine Learning for NextG Covert Communications Using Multiple Antennas
## 2 System Model  
We consider a wireless system that consists of a transmitter, a receiver, a CJ, and an eavesdropper as shown in Figure 1. The transmitter sends \(p\) complex symbols consecutively in time, \(\mathbf{x}\in\mathbb{C}^{p}\), by mapping a binary input sequence \(\mathbf{m}\in\{0,1\}^{l}\). Specifically, \(\mathbf{x}=g_{s}(\mathbf{m})\), where \(g_{s}:\{0,1\}^{l}\rightarrow\mathbb{C}^{p}\) and \(s\) represents the modulation type of the transmitter. Then, the transmitter's signal received at node \(j\) (either the receiver \(r\) or the eavesdropper \(e\)) is given by  
\[\mathbf{r}_{ij}=\mathbf{H}_{ij}g_{s}(\mathbf{m})+\mathbf{n}_{ij}=\mathbf{H}_{ij}\mathbf{x}+\bm {n}_{ij},\quad j\in\{r,e\}, \tag{1}\]  
where \(\mathbf{H}_{ij}=\mathrm{diag}\{h_{ij1},\cdots,h_{tj,p}\}\in\mathbb{C}^{p\times p}\) and \(\mathbf{n}_{tj}\in\mathbb{C}^{p}\) are the channel and complex Gaussian noise from the transmitter to node \(j\), respectively. Upon receiving the signal \(\mathbf{r}_{tr}\), the receiver decodes the message with the BER given by  
\[\mathrm{P}_{e}(\mathbf{m},\mathbf{r}_{tr})=\frac{1}{l}\sum_{i=1}^{l}\mathbb{I}\{m_{i} \
eq\hat{m}_{i}\}, \tag{2}\]  
where \(\hat{m}_{i}\) is a decoded bit and \(\mathbb{I}\{\cdot\}\) is an indicator function. Figure 1: System model. The eavesdropper tries to detect the existence of wireless transmission using a pre-trained DL-based classifier, namely a DNN, \(f(.,\mathbf{\theta}):\mathcal{X}\rightarrow\mathbb{R}^{2}\), where \(\mathbf{\theta}\) is the set of DNN parameters and \(\mathcal{X}\subset\mathbb{C}^{p}\). An input \(\mathbf{x}\in\mathcal{X}\) is assigned a label \(\hat{l}(\mathbf{x},\mathbf{\theta})=\arg\max_{k}f_{k}(\mathbf{x},\mathbf{\theta})\), where \(f_{k}(\mathbf{x},\mathbf{\theta})\) is the output of a classifier \(f\) corresponding to the \(k\)th class. To make communications between the transmitter and its receiver covert, the CJ with \(q\) antennas transmits perturbation signals \(\delta_{1},\delta_{2},\cdots,\delta_{q}\in\mathbb{C}^{p}\), where the \(i\)th antenna transmits \(\delta_{i}\), to cause misclassification at the eavesdropper by changing the label of the received signal \(\mathbf{r}_{te}\) from _signal_ to _noise_. Thus, if the transmitter transmits \(\mathbf{x}\), the received signal at node \(j\) is given by  
\[\mathbf{r}^{\prime}_{tj}(\delta_{1},\cdots,\delta_{q})=\mathbf{H}_{ij}\mathbf{x}+\sum _{i=1}^{q}\mathbf{H}_{cij}\delta_{i}+\mathbf{n}_{tj},\quad j\in\{r,e\}, \tag{3}\]  
where \(\mathbf{H}_{cij}=\mathrm{diag}\{h_{cij,1},\cdots,h_{cij,p}\}\in\mathbb{C}^{p \times p}\) is the channel from the \(i\)th antenna of the CJ to node \(j\). Since the perturbation signals from the CJ not only creates interference at the eavesdropper, but also at the receiver, the CJ determines its signals \(\delta_{1},\delta_{2},\cdots,\delta_{q}\) to cause misclassification at the eavesdropper using a fixed power budget \(P_{max}\) that also limits the BER at the receiver. Formally, the CJ first determines \(\delta_{1},\delta_{2},\cdots,\delta_{q}\) by solving the following optimization problem:  
\[\arg\min_{\delta_{i}} \sum_{i=1}^{q}||\delta_{i}||_{2}^{2}\] \[s.t. \hat{l}(\mathbf{r}_{te},\mathbf{\theta})\
eq\hat{l}(\mathbf{r}^{\prime}_{te}( \delta_{1},\cdots,\delta_{q}),\mathbf{\theta}) \tag{4}\] \[\sum_{i=1}^{q}||\delta_{i}||_{2}^{2}\leq P_{max}.\]  
The solution \(\delta_{i}^{*}\) to (4) results in a BER, \(P_{e}(\mathbf{m},\mathbf{r}^{\prime}_{tr}(\delta_{i}^{*}))\), at the receiver that can be bounded to a target level by selecting \(P_{max}\) accordingly. Since solving (4) is difficult, different methods have been proposed in computer vision to approximate the adversarial perturbations such as the fast gradient method (FGM) [7]. The FGM is computationally efficient for crafting adversarial attacks by linearizing the loss function, \(L(\mathbf{\theta},\mathbf{x},\mathbf{y})\), of the DNN classifier in a neighborhood of \(\mathbf{x}\) where \(\mathbf{y}\) is the label vector. This linearized function is used for optimization.