Abstract-While research on adversarial examples in machine learning for images has been prolific, similar attacks on deep learning (DL) for radio frequency (RF) signals and their mitigation strategies are scarcely addressed in the published work, with only one recent publication in the RF domain [1] . RF adversarial examples (AdExs) can cause drastic, targeted misclassification results mostly in spectrum sensing/ survey applications (e.g. BPSK mistaken for OFDM) with minimal waveform perturbation. It is not clear if the RF AdExs maintain their effects in the physical world, i.e., when AdExs are delivered over-theair (OTA). Our research on deep learning AdExs and proposed defense mechanisms are RF-centric, and incorporate physicalworld, OTA effects. We here present defense mechanisms based on statistical tests. One test to detect AdExs utilizes Peak-toAverage-Power-Ratio (PAPR) of the DL data points delivered OTA, while another statistical test uses the Softmax outputs of the DL classfier, which corresponds to the probabilities the classifier assigns to each of the trained classes. The former test leverages the RF nature of the data, and the latter is universally applicable to AdExs regardless of their origin. Both solutions are shown as viable mitigation methods to subvert adversarial attacks against communications and radar sensing systems. As deep learning (DL) penetrates non-traditional applications, a new research direction is emerging in the field of wireless signals, aiming to emulate and possibly replace certain signal processing algorithms by DL models. Spectrum sensing, especially in the context of cognitive radio, defines most of the radio signal detection problems that are being addressed by DL. The approach to DL in RF domain differs from common DL applications, such as image recognition or natural language processing, and requires knowledge of RF signal processing and wireless communications and/or radar, depending on the signal utilization. While research on adversarial examples in machine learning for images has been prolific, similar attacks on deep learning of radio frequency (RF) signals and the mitigation strategies are not addressed in the published work almost at all, with only one recent publication on RF [1] . Adversarial examples (AdExs) are slightly perturbed inputs that are classified incorrectly by the Machine Learning (ML) model [2] . This perturbation is achieved by mathematical processing of the signal, e.g., by adding an incremental value in the direction of the classifiers gradient with respect to the inputs (Fig. 2 A) , or by solving a constrained optimization problem. Popular deep learning (DL) models are even more vulnerable to AdExs as DL networks learn input-output mappings that are fairly discontinuous. Consider the stop-sign images in Figure 1 [3] . To the human eye, they appear to be the same -two images of a stop sign. The image on the left is an ordinary image of stop sign, while the one on the right is derived from it by adding a precise perturbation that elicits the deep classifier to classify it as a yield sign. For further details about AdExs, please see seminal work, such as [2], [4] . RF adversarial examples can cause drastic, targeted misclassification results mostly in spectrum sensing/ survey applications (e.g. BPSK mistaken for OFDM) with minimal waveform perturbation. It is not clear if the RF AdExs maintain their effects in the physical world, i.e., when AdExs are delivered over-the-air (OTA). Our research on deep learning AdExs and proposed defense mechanisms are RF-centric, and incorporate physical-world, OTA effects. In this work we present defense mechanisms based on statistical tests. One test to detect AdExs utilizes Peak-to-AveragePower-Ratio (PAPR) of the DL data points delivered OTA, while another statistical test uses the Softmax outputs of the DL classfier, which corresponds to the probabilities the classifier assigns to each of the trained classes. The former test leverages the RF nature of the data, and the latter is universally applicable to AdExs regardless of their origin. Both solutions are shown as viable mitigation methods to subvert adversarial attacks against communications and radar sensing systems. The research in the area of RF-based DL of the PHY layer is still embryonic [5] . Modulation recognition (ModRec) is the most popular application of DL here. Most of the existing work is based on convolutional (CNN) architectures [6] . Paper [7] features an in-depth study arXiv:1902.06044v1 [cs.LG]
Similarly, REF considers the same evasion attack model and proposes to utilize a statistical method based on the peak-to-average-power ratio (PAPR) of the signals.
Adversarial Examples in RF Deep Learning: Detection of the Attack and its Physical Robustness
ArXiv
ArXiv
Mathematics Computer Science