White-Box Adversarial Attacks on Deep Learning-Based Radio Frequency Fingerprint Identification

TL;DR

This paper investigates white-box adversarial attacks on deep learning models used for radio frequency fingerprint identification, demonstrating their effectiveness against various neural network architectures.

Contribution

It introduces effective white-box attack methods (FGSM and PGD) against diverse deep learning classifiers in RFFI, with experimental validation on real LoRa datasets.

Findings

Adversarial examples successfully fool CNNs, LSTMs, and GRUs in RFFI.

White-box attacks significantly degrade classifier accuracy.

Experimental results confirm vulnerability of deep learning-based RFFI to adversarial perturbations.

Abstract

Radio frequency fingerprint identification (RFFI) is an emerging technique for the lightweight authentication of wireless Internet of things (IoT) devices. RFFI exploits unique hardware impairments as device identifiers, and deep learning is widely deployed as the feature extractor and classifier for RFFI. However, deep learning is vulnerable to adversarial attacks, where adversarial examples are generated by adding perturbation to clean data for causing the classifier to make wrong predictions. Deep learning-based RFFI has been shown to be vulnerable to such attacks, however, there is currently no exploration of effective adversarial attacks against a diversity of RFFI classifiers. In this paper, we report on investigations into white-box attacks (non-targeted and targeted) using two approaches, namely the fast gradient sign method (FGSM) and projected gradient descent (PGD). A LoRa testbed was built and real datasets were collected. These adversarial examples have been experimentally demonstrated to be effective against convolutional neural networks (CNNs), long short-term memory (LSTM) networks, and gated recurrent units (GRU).