Real-World Adversarial Attacks on RF-Based Drone Detectors

TL;DR

This work addresses the vulnerability of RF-based drone detectors that rely on spectrogram-based object detection to adversarial perturbations. It proposes class-specific universal perturbations designed in the I/Q domain that can be transmitted over the air, enabling end-to-end optimization to suppress a target drone while preserving detection of others. The authors demonstrate, across multiple architectures and four drone platforms, that modest I/Q perturbations can reliably reduce target detections both in digital simulations and real OTA transmissions, with strong transferability. The findings reveal critical vulnerabilities in current RF-based drone detection systems and motivate development of defenses against physical over-the-air adversarial attacks in multi-emitter RF environments.

Abstract

Radio frequency (RF) based systems are increasingly used to detect drones by analyzing their RF signal patterns, converting them into spectrogram images which are processed by object detection models. Existing RF attacks against image based models alter digital features, making over-the-air (OTA) implementation difficult due to the challenge of converting digital perturbations to transmittable waveforms that may introduce synchronization errors and interference, and encounter hardware limitations. We present the first physical attack on RF image based drone detectors, optimizing class-specific universal complex baseband (I/Q) perturbation waveforms that are transmitted alongside legitimate communications. We evaluated the attack using RF recordings and OTA experiments with four types of drones. Our results show that modest, structured I/Q perturbations are compatible with standard RF chains and reliably reduce target drone detection while preserving detection of legitimate drones.

Figures (2)

• Figure 1: Overview of our method’s pipeline.
• Figure 2: The mAP as a function of the SPR power (dB).