Real-World Adversarial Attacks on RF-Based Drone Detectors

2025-12-23

AI Summary

Existing RF-spectrogram-based drone detection systems are vulnerable to digital-domain adversarial attacks, yet such attacks are impractical in over-the-air (OTA) environments due to synchronization errors and hardware impairments introduced when converting digital perturbations into physical waveforms. This work proposes the first physically realizable OTA adversarial attack method operating at the physical layer. It generates universal, hardware-compatible, and target-selective adversarial perturbations in the complex baseband (I/Q) domain to degrade spectrogram-based detector performance. The approach integrates complex-baseband signal modeling, universal adversarial perturbation optimization, empirical OTA validation, and robustness analysis of spectrogram detectors. Evaluated on four real-world drones, the method achieves significant reduction in target drone detection rates using only small, structured I/Q perturbations—while preserving accurate detection of legitimate drones. This demonstrates the first practical, end-to-end physical-layer adversarial attack against RF-spectrogram-based drone detection under realistic OTA conditions.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Search and Retrieval-Augmented AI: Vertical and domain-specific search

Abstract

Radio frequency (RF) based systems are increasingly used to detect drones by analyzing their RF signal patterns, converting them into spectrogram images which are processed by object detection models. Existing RF attacks against image based models alter digital features, making over-the-air (OTA) implementation difficult due to the challenge of converting digital perturbations to transmittable waveforms that may introduce synchronization errors and interference, and encounter hardware limitations. We present the first physical attack on RF image based drone detectors, optimizing class-specific universal complex baseband (I/Q) perturbation waveforms that are transmitted alongside legitimate communications. We evaluated the attack using RF recordings and OTA experiments with four types of drones. Our results show that modest, structured I/Q perturbations are compatible with standard RF chains and reliably reduce target drone detection while preserving detection of legitimate drones.

Problem

• Develops physical attack on RF-based drone detection systems
• Optimizes universal I/Q perturbation waveforms for transmission
• Reduces target drone detection while preserving legitimate detection

Innovation

• Optimizing class-specific universal complex baseband perturbation waveforms
• Transmitting perturbations alongside legitimate communications over-the-air
• Ensuring compatibility with standard RF chains while reducing detection