# Adversarial Machine Learning for NextG Covert Communications Using Multiple Antennas
## 1 Introduction
Note that we only consider fooling a classifier into misclassifying a signal as noise since it is typically more demanding. Further, we extend the analysis to the use of _multiple antennas_ at the CJ to generate multiple concurrent perturbations over different channel effects (subject to a total power budget) for better covert communications. This problem setting is different from computer vision applications of adversarial attacks that are limited to a single perturbation that is directly added to the input of a deep neural network (DNN). We assume that the CJ has multiple antennas to transmit adversarial perturbations against the eavesdropper and aims to decrease the probability of detection at the eavesdropper. In this paper, we design a white-box attack at the CJ where the signal of the CJ is time-aligned with the transmitted signal and uses the maximum received perturbation power (MRPP) attack that was introduced in [20]. We propose different methods to allocate power among antennas at the CJ and to exploit the channel diversity. We first propose a genie-aided adversarial attack where the CJ selects one antenna to transmit the perturbation such that it would result in the worst classification performance depending on the channel condition over the entire symbol block (that corresponds to the input to the DNN at the receiver). Then, we consider transmitting with all the antennas at the adversary where the power allocation is based on the channel gains, either proportional or inversely proportional to the channel gains. Finally, we propose the elementwise maximum channel gain (EMCG) attack to utilize the channel diversity more efficiently by selecting the antenna with the best channel gain at the symbol level to transmit perturbations. For the performance evaluation, we first consider a CJ with a single antenna using basic modulated signals (e.g., QPSK and 16-QAM), and then extend the setting to a more complicated 5G communication signal. Our results show that we can effectively hide these signals from an eavesdropper that uses a DL-based classifier to detect transmissions. Then, we use multiple antennas at the CJ to investigate the performance of multiple concurrent perturbations over different channel effects on the eavesdropper's classifier. During simulations, the perturbation of the CJ is selected to minimize the strength of the perturbation subject to the condition of successfully fooling the eavesdropper and an upper bound on the perturbation power that can translate to limiting the BER at the receiver. We show that Gaussian noise is not effective as an adversarial perturbation and develop an algorithm to optimize the perturbations for the CJ to enable covert communications, which we demonstrate for signals with different modulation types and 5G communications. Furthermore, we show that the EMCG attack outperforms other attacks and effectively uses the channel diversity provided by multiple antennas to cause misclassification at the receiver. This attack improvement remains effective regardless of the channel variance or correlation between channels, whereas the proportional to the channel gain (PCG) attack is greatly affected by the correlation between channels. Finally, we show that increasing the number of antennas at the adversary significantly improves the attack performance by better exploiting the channel diversity to craft and transmit adversarial perturbations. In summary, our contributions are given as follows:  
* We present how a CJ is used to make wireless communications covert by transmitting adversarial attack against the classifier of the eavesdropper. * For a CJ equipped with multiple antennas, we investigate the use of multiple antennas to generate multiple concurrent perturbations over different channel effects against the eavesdropper. Furthermore, we propose different methods to utilize the channel diversity.