GAN-Based Evasion Attack in Filtered Multicarrier Waveforms Systems

Generative adversarial networks (GANs), a category of deep learning models, have become a cybersecurity concern for wireless communication systems. These networks enable potential attackers to deceive receivers that rely on convolutional neural networks (CNNs) by transmitting deceptive wireless signals that are statistically indistinguishable from genuine ones. While GANs have been used before for digitally modulated single-carrier waveforms, this study explores their applicability to model filtered multi-carrier waveforms, such as orthogonal frequency-division multiplexing (OFDM), filtered orthogonal FDM (F-OFDM), generalized FDM (GFDM), filter bank multi-carrier (FBMC), and universal filtered MC (UFMC). In this research, an evasion attack is conducted using GAN-generated counterfeit filtered multi-carrier signals to trick the target receiver. The results show that there is a remarkable 99.7% probability of the receiver misclassifying these GAN-based fabricated signals as authentic ones. This highlights the need for urgent investigation into the development of preventive measures to address this concerning vulnerability.


I. INTRODUCTION
M ACHINE learning (ML) finds applications in diverse fields, including wireless communication.However, the majority of existing systems operate under the assumption that data is sourced from regular users and is independently generated from the same distribution [1].While some algorithms are capable of handling small dense noises, only a limited number of them tackle adversarial noises that are deliberately crafted by individuals possessing knowledge of the machine learning system and the underlying data.These adversaries purposefully introduce meticulously crafted noises or directly manipulate the dataset to undermine or deceive the learning system, causing it to make inaccurate decisions which may present a substantial threat, especially in security and safety-critical domains [1].The adversarial attacks can be categorized into three types based on the adversary's objective: evasion, poisoning, and model stealing [1], [2], [3].Evasion attacks are a method of manipulating input test data to deceive Machine learning (ML) models and cause them to make incorrect decisions [4], [5].In the realm of wireless communications, these attacks have been applied to various scenarios, such as fooling classifiers used for spectrum sensing [6], modulation recognition [7], autoencoder-based end-to-end communication systems [8], channel state information (CSI) feedback for massive MIMO [9], channel estimation [10], [11] and initial access in directional communications [12].Compared to traditional jamming attacks that focus on causing interference during data transmission [13], evasion attacks are often more discreet and energy-efficient, as they only require transmitting low-power signals for a short duration to confuse the ML algorithms in their decision-making process [2].
Several deep generative methods are accessible for generating such perturbations among which generative adversarial networks (GANs) have received tremendous attention due to their capacity to automatically discover and learn patterns in input data then generate realistic examples across a range of problem domains.Ever since they were introduced by Ian J. Goodfellow et al. in their seminal work [14] in 2014, their applications have increased rapidly.To date, most work on GANs in the field of wireless communications has focused on single carrier signals, for applications including-but not limited to-data augmentation, wireless channel modeling [15], [16], [17], [18], physical layer design for communication systems [19], adversarial attacks and their detection [20], [21], as well as anomaly detection [22], [23].For instance, in [20], a deep GAN was proposed to forge wireless signals as if they were conceived by legitimate users.More precisely, the authors used the I/Q components of quadrature phase shift keying (QPSK) signals propagating through Rayleigh channels to train a GAN composed of dense layers in both the generator and discriminator.To evaluate the performance of their approach, the authors rely on a deep neural network (DNN) classifier designed to distinguish between signals from an intended transmitter, and unintended one [24].The GAN based attack success probability is much higher than that of an attack using random or replayed signals [25].The success probability of this spoofing attack rises with additional antennas at the transmitters (both intended and adversary) while it reduces with further antennas at the receivers [26].
In [21], a GAN based defense mechanism against primary user emulation attack (PUEA) was proposed by leveraging the discriminator of the trained GAN.The authors considered two models; with no prior information about primary users (PUs), called dumb attacker, and with some information about the PUs signal's features, called smart attacker.The previous models were designed so that over time the discriminators eventually outsmart the generators, then use these pre-trained discriminators to distinguish between legitimate and fraudulent PUs.The GAN model is based on dense layers, and trained on raw I/Q over-the-air data, collected utilizing universal software radio peripheral (USRP) transmitters using QPSK signals each.
In [22], a radio anomaly recognition algorithm built on GAN is presented.An anomaly is defined if the signal is produced by either defective equipment or dishonest jammers.The goal being to detect whether a signal is normal or anomalous, a modified convolutional GAN trained on 2D spectrogram representations of an orthogonal frequency division multiplexing (OFDM) received signal is adopted.More exactly, spectrogram images representing normal signals are collected from the training examples, and are used to tune the proposed GAN model.Afterwards, based on the reconstruction error and the discriminator loss, an anomaly score is defined as the statistic test to recognize and isolate the anomalies.The work in [23] presents also an anomaly detection approach by comparing a conditional and an auxiliary cGAN (ACGAN) models, where the loss of the trained discriminator is used to compute an anomaly measure.
The models are trained on a generalized state vector, composed of the signal's amplitude drawn from a Stockwell transform (ST) for mmWave OFDM signals.
The task of the GAN based data augmentation in communication systems has also attracted widespread attention, to handle labeled data insufficiency and improve the classification accuracy for automatic modulation classification (AMC) applications [27].Indeed, in [28] the authors use an ACGAN model [29] to generate synthetic digital modulations, namely BPSK, QPSK, 16QAM, 32QAM, 64QAM, OQPSK, 4ASK, 8PSK, and use them along with real signals to train a convolutional neural network (CNN) classifier, more precisely, AlexNet.ACGAN adds a conditional information (a class label for example) to the input of the generator in an effort to control the data generation process and stabilize the training.The digital modulations are first converted to constellation diagrams, then into contour Stella images (a richer color feature transformation), before being used as training sets for both the ACGAN and AlexNet.The data augmentation approach enhances the performance of the classifier especially when the modulations are relatively identical and the signal-to-noise-ratio (SNR) is low, or the number of examples is insufficient for training.
A similar approach is presented in [30], where the authors train a conditional GAN (cGAN) to generate synthetic digital modulations, using the RML2016.10adataset [31].The adopted model uses fully dense layers at both the generator and the discriminator, and is trained directly on the I/Q data.Once the GAN training is performed, the synthetic I/Q are combined with the real dataset in an effort to improve the performance of the state-of-the-art digital modulation CNN classifier proposed in [32]-the synthesized data are more advantageous to enhance the CNN accuracy for low SNR values.The authors of [33] also propose a cGAN model, where both the modulation order and the SNR of the training signals are used as input instructions, so that the same generator of the trained GAN can forge fake data with a specific modulation order and SNR.This work also uses the RML2016.10adataset, instead of manipulating the raw I/Q data directly, these components are first converted into a 64 × 64 constellation diagrams.Once the GAN's training is finished, the forged data is used to improve the performance of a CNN model comprising of four convolutional layers in addition to one fully-connected layer.The proposed technique boosts the performance of the classification accuracy specially for low SNR and reduces training time in contrast to the ACGAN.
The compelling properties of OFDM have accelerated its infiltration in wireless communication standards, which have also sparked an in depth investigation of multicarrier waveforms [34].Over the course of the last decade, a number of alternative transmission schemes have been proposed to improve the deficiencies of OFDM.Among the various waveform contenders, the most promising ones are filtered versions of OFDM.These filtered versions utilize different pulse shapes to address the drawbacks associated with conventional OFDM.Given the emergence of filtered multicarrier waveforms, it becomes crucial to reassess the approach of GAN based waveform generation, to take into consideration the diversity and complexity of the advanced multicarrier mechanisms.In fact, filtered multicarrier systems are more complex than single-carrier systems.They involve multiple carriers with specific filtering requirements and inter-carrier relationships.Learning to generate such complex waveforms using ML techniques requires more sophisticated models and increased computational resources.Furthermore, the model needs to generalize well to the variations of filtered multicarrier systems.Addressing these challenges requires careful consideration of model architectures, loss functions, training strategies, and the incorporation of domain knowledge and signal processing expertise into the ML framework.Therefore, the primary objective of this study is to explore the potential of GAN-based modeling for baseband filtered multicarrier waveforms directly from the raw I/Q data.The focus of our investigation centers around the following categories: • Per-subcarrier filtered multicarriers family: filter bank multicarrier (FBMC) and generalized frequency division multiplexing (GFDM) [35], [36], [37].
• Per-subband filtered multicarriers family: universal filtered multicarrier (UFMC) and filtered orthogonal frequency division multiplexing (F-OFDM) [38], [39], [40], [41].Our intention is to create an evasion attack [3], where an adversary attempts to fool a machine learning algorithm into making a wrong decision [4].Fig. 1 illustrates a vulnerable network where an unmanned aerial vehicle (UAV) communicates with ground devices [42], [43], [44], [45].Whereas several works considered deep learning thechniques to identify the UAVs based on their emitted signal [46], [47].In our considered network, an adversarial UAV seeks to spawn signals which are statistically analogous to those collected from the legitimate one; therefore the GAN training is performed by the adversarial node.Conventional OFDM is the principal waveform candidate for drone-to-ground communication [48].Nonetheless, its innovative filtered contenders present a better trade-off between time-frequency localization and critical waveform density, hence allow the co-existence of several drones with enhanced throughput [48].In order to identify the intended UAV transmitters relying on the investigated schemes [49], [50], a CNN classifier is built by collecting their various signals at each receiving device.The end goal of the adversarial UAV is to fool such a classifier with the synthetic waveforms spawned using the GAN generator.There are unique challenges for such approach, since each of these advanced waveforms, introduces distinct filtering techniques which interact differently with the propagation channel-all these embedded effects need to be learned by the GAN.The results reported in this research work prove the practicality of this proposal, and provide a foundation for further investigations.
The paper is structured in the following way: Section II briefly describes the waveforms investigated herein.Section III details the proposed GAN model for the considered filtered multicarrier signals.In Section IV, the training steps and simulation parameters are presented followed by discussions on findings.Finally, Section V concludes the paper and provides our future perspectives.

II. SYSTEM MODEL
In order to overcome the frequency selectivity of a wireless propagation channel on wideband signals, multicarriers waveforms have been widely adopted.In fact, a multicarrier system subdivides the total bandwidth into smaller subchannels, each one lower than the coherence bandwidth of the propagation channel.In this work, we consider the same signal model adopted in [34], [51], and [52].A multicarrier transmitted signal can then be given as follows: Data symbols, s q,r , are zero-mean independent and identically distributed (i.i.d) random variables, originating from a quadrature amplitude modulation (QAM) constellation, carried on the q-th subcarrier during the r-th period.g q,r [n] is the synthesis function which maps the data symbol to the signal dimension [34].It is a Gabor System expressed as [34]: where g tx [n] is the transmit prototype filter from which all other pulse shapes are inferred, through time shifting and frequency modulation [34].The received counterpart of the signal in Eq. ( 3) is a sum of attenuated, Doppler shifted, and time stretched/compressed copies, which can be expressed by [51]: L ch stands for the number of multipaths, η j is a discrete propagation delay, while h[η j ] is the time varying channel gain associated to the l-th path.
c denotes the Doppler shift, c is the speed of light while v d is the relative speed between the transmitter and receiver.Considering a symbol time offset δ, a carrier frequency offset κ, and an additive white Gaussian noise (AWGN) z[n] with variance σ 2 z , the final received signal can be expressed as: The multicarrier contenders of the legacy OFDM, rely on different synthesis functions in an attempt to circumvent the Balian-low theorem (BLT) limit.Indeed, this theorem proves the impossibility of designing a prototype g tx [n] which achieves orthogonality, is localized both in time and frequency, while attaining critical density [34], [53], [54].OFDM is an orthogonal waveform which attains critical density [55], however, it is not well localized in frequency hence it suffers from high out of band (OOB) radiations.The oldest OFDM variant investigated in this work is FBMC [56].This waveform introduces a real domain orthogonality, instead of a complex one, and relies on long prototype filters for each subcarrier, to offer very low OOB emissions.Another waveform that uses per-subcarrier filtering is GFDM [35].
In order to avoid the long filter tails of FBMC, GFDM introduces the concept of subsymbols, then adopts a circular filtering of the individual subcarriers.Both these schemes overcome the lack of spectral containment of OFDM at the expense of a higher receiver complexity.The subband filtered family offers a better trade-off between OOB suppression and receiver complexity.Inspired by the resource block based allocation in 4G systems, UFMC proposes filtering a group of subcarriers, also known as subbands, instead of subcarriers; it exhibits moderate OOB compared to FBMC but circumvents its drawback [38].Finally, F-OFDM uses longer filters compared to UFMC, hence presents a better spectral containment, however it suffers from inter symbol interference (ISI) [41].A thorough investigation as well as a comparison between the studied waveforms, is presented in [34], [57], and [58] and the references therein.
In order to spawn fake examples, the GAN attempts to learn the statistical characteristics of the real ones.The different filter designs utilized in each waveform result in rich statistical features, which can be learned by the GAN then used to generate fake signals.Fig. 2 depicts the steps of this generation process, where the investigated waveforms are first simulated, then filtered by the channel's transfer function, before being fed to a conditional deep convolutional GAN (C-DCGAN).The latter attempts to learn the distinctive features of each waveform, then spawns fake signals statistically similar to the studied ones.The following section provides details of the C-DCGAN model.

III. GAN ARCHITECTURE FOR MULTICARRIER SIGNALS
GANs are a novel deep-learning based approach to generative modeling, proposed by Ian J. Goodfellow et al. in [14].The goal is to learn regularities in a dataset, then use these patterns to induce different examples that could allegedly be extracted from the dataset at hand.This proposal constructs the problem as a supervised learning task, by using two adversary networks: A generator G, and a discriminator D, each being trained to outperform the other [59].The generator is a neural network trained to learn the probability distribution of the target data p u , while the discriminator, also a neural network, attempts to differentiate between examples spawned from G's distribution, p g , and those taken from the real dataset.The input to the generator is a fixed length vector z, also known as a latent space, from a Gaussian distribution.G learns to map z to the dataset distribution.The discriminator is a classification model that predicts a binary class label of fake or real.The two models are trained jointly in a zerosum game.When G fools the discriminator, no changes are applied to its model weights, while D parameters are updated.Alternately, when D distinguishes real and fake examples, it is rewarded, while G is penalized with substantial updates, as depicted in Fig. 3.Both the generator and the discriminator have the same loss function presented in Eq. ( 5), but the first attempts to minimize it, whereas the second seeks to maximize it [14]: D(u) is the discriminator's approximation of the probability that authentic data occurrence u is real, G(z) is the generator's output when presented with the noise z, and D(G(z)) denotes the discriminator's estimate of the probability that the forged occurrence is real.Since the generator doesn't see the real instances, it cannot directly affect log(D(u)), hence minimizing the loss function is comparable to minimizing log(1 − D(G(z))).In practice, this function saturates for the generator, to circumvent that challenge, the generator aims at maximizing log(D(G(z))) [59].
Traditional GANs can spawn original credible samples for a given dataset, nonetheless, they do not offer a way to supervise the types of the fake instances, hence it is a common practice to rely on human perception in computer vision applications to assess the fidelity of the forged data.Waveforms in general, and filtered multicarrier ones in particular, are not directly human interpretable, hence the evaluation of a traditional GAN is not straightforward.We inspect a class conditional variant of the model, using a cGAN, to allow a targeted multicarrier waveforms generation.cGAN is a type of GAN where a supplementary information is associated to the input data, class labels for example [14].In order to achieve this goal, it is a common practice to introduce an embedding layer combined to a fully connected one, to scale the embedding to the dimension of the input data, then integrate it in the model as an added feature map [59].
In our work, the dataset at hand is a collection of simulated 2 × 128 I/Q signals, with different waveforms.The GAN architecture relies on convolutional and convolutional-transpose layers in the discriminator and generator, correspondingly.The discriminator must take an I/Q sample and return a binary classification, whether the instance is fake or real.Our discriminator model has four 2D convolutional layers, each with a kernel size of 4 and a stride of 2. No pooling layers are used, while the output layer is of one node and a Sigmoid activation function.The discriminator is trained to minimize the binary cross-entropy loss function.We adopt some of the GAN's training best practices.We employ Leaky rectified linear unit (ReLU) instead of ReLU to avoid sparse gradients; we add a dropout layer, and set its rate to 0.3, to improve the model's ability to generalize.Finally, we exploit the Adam variant of the stochastic gradient descent, setting the learning rate to 0.0002 and the momentum to 0.5 [60], [61].
The generator must transform a point from the latent space to a plausible 2 × 128 I/Q vector.To this end, we adopt the approach of using a dense layer at first followed by as many upsampling layers as needed.More specifically, the first hidden layer of the generator, produces 256 multiple parallel versions of a smaller I/Q vector, 1 × 8, with different learned features each.They are reshaped and passed to a transpose convolution layer (also called deconvolution), which is a combination of an upsampling layer and a convolution one, with a kernel size of (4,4), and a stride of (2,2).This layer will double the size of the I/Q vector from 1 × 8 to 2 × 16, followed by a similar layer with a kernel size of (2,4), and a stride of (1,2), scaling the generated vectors up to 2 × 32, and so on until we reach the desired I/Q vector size.Again, we will apply the Leaky ReLU with a default slope of 0.2.Finally, the output layer of the generator model is a 2D convolution layer with one filter.To stabilize the GAN training, we adopt a Tanh activation function in attempt to guarantee that the output values are in the range of [−1,1] [59].For both models, the class label is given using an embedding layer of the size of 50.Each of the 5 waveform classes will be mapped to a distinct 50-element vector interpretation.

IV. METHODOLOGY, RESULTS AND DISCUSSIONS
We design different simulations in order to build an intuition on how the GAN performs with the filtered multicarrier signals.We construct a comprehensive dataset composed of signals with N symbols = 10, where the SNR takes values in the range [−8 : 20] dB with a step of 2 dB.We set the number of examples for each SNR to 5000 per class.To create signals with similar multicarrier symbol length, we fix the number of subcarriers to N c = 16 for all the investigated waveforms excluding GFDM, for which N c = 8.We employ the prototype filters widely adopted in the literature and previously investigated for waveforms classification in [48], [52].For GFDM, we use the RRC filter where the roll-off factor is β = 0.35.For FBMC, we apply the Phydyas filter using an overlapping factor of K = 2.The Chebyshev filter is adopted for UFMC, finally, for F-OFDM we utilize the truncated sinc [35], [36], [38], [41].The data symbols are drawn from a QPSK constellation.Table 1 outlines the simulation parameters in more details.We set the cyclic prefix length N c 4 , a value greater than the maximum channel delay to avoid ISI.The multipath channel effects are introduced using the profile of the LTE channel model, specifically, we opt for the ETU model [62].The signals are conceived utilizing Matlab, whereas the machine learning models are built and trained in Python, relying on Keras library with TensorFlow backend, over the GPU of Google Colab Pro.

A. EVALUATION METHODS
GAN evaluation is still a problem of research in the computer vision community [63].In order to judge the performance of a GAN architecture, several quantitative and qualitative metrics have been proposed to inspect not only the quality of the forged data, but also its diversity.Since our goal is to mimic the signals sent from a legitimate user, we will consider that the GAN has converged if it can fool the CNN classifier used at the receivers.Taking advantage of the conditional GAN, we define the following metrics: 1) The probability of global correct classification: where N w is the total number of waveforms used to train the GAN.N f is the number of fake signals per waveform used to evaluate the GAN.N cc is the total number of correct classification across all waveforms.
It is a count incremented each time the labels predicted using the CNN classifier match the conditional labels used to generate the fake signals by the generator of the GAN.
2) The per-class correct classification probability: which we define as the average of the per class probabilities reported by the CNN, denoted p c in Eq. ( 7), over the N f synthetic signals, for each class separately.
Both our proposed scores and the borrowed ones are computed utilizing a previously trained classification model.IS score is calculated using the top-performing image classification model Inception v3 model [66].This score attempts to acquire two properties of a compilation of forged images: Image diversity and image quality.To calculate the IS score on a selection of fabricated images, first, the conditional probability for each image p(y|x), is calculated employing the Inception v3 model, afterwards the marginal probability is computed as the mean of the conditional probabilities for the synthetic images in the group p(y).
The Kullback-Leibler (KL) divergence (kld) is measured for the individual images as follows: To compute the final score, first a sum of KL divergence over all images is performed, then an average over all classes is calculated, finally the exponent of the result is determined.The minimum value of the IS is 1 and the maximum value is the number of classes of the classification model.We use the same idea, replace the Inception v3 with a CNN model for filtered multicarrier waveforms classification, and fake images with fake multicarrier signals.FID on the other hand, assesses the quality of a compilation of fabricated images compared to a collection of real ones, based also on the Inception v3 model.More precisely, the score evaluates real vs forged data based on their statistical features, comparing both image quality, through conditional class predictions for each fabricated instance, and image diversity through the marginal probability of the predicted classes [59].Again, we explore the same idea, replace the Inception v3 with a CNN model for filtered multicarrier waveforms classification, remove the output layer, then use the features extracted by the last dense layer.These activations are computed for a compilation of real and forged signals, then summed up as a multivariate Gaussian by calculating the mean and covariance of the extracted features.The real signals are those used for the GAN training, while the fake signals are those spawned from the generator.The distance between the two distributions is then measured using the Frechet distance as proposed in [65]: 9) Tr(.) indicates the trace linear algebra operation.µ 1 and µ 2 refer to the feature-wise mean of the actual and fabricated signals.C 1 and C 2 are the covariance matrices for the actual and fabricated feature vectors.Smaller FID values indicate that the two compared groups are more alike.Python implementation details of the IS and FID scores can be found in Chapter 12 and Chapter 13 of [59] respectively, where the Inception v3 model was replaced by the CNN model presented afterwards.
We use a CNN model similar to the architecture proposed in [52] for filtered multicarrier waveforms classification.A 4-layer network is subdivided into two convolutional layers and two dense fully connected ones.The three first layers utilize ReLU activation function, whereas the last one adopts a SoftMax transfer function.While tuning hyper-parameters of this network to new database-which includes a 6 th class of random data in addition to the investigated waveforms-we employ 128 filters of length 1×3 in the first layer, reduce the second layer size to 64 filters of 1 × 3, and set the dense layer's length to 128 neurons.The output layer uses one node per class label for a total size of 6-class neurons.
Following the recommendations in [48], we add a dropout after each layer of the three first the dropout rate is set to = 0.3, in addition an early stopping method is employed, both techniques are used to avoid over-fitting.We resort to the optimization version of the traditional stochastic gradient descent [60].In all our experiments, 80% of the data is used for training, and the remaining 20% of examples are utilized for validation and testing.Input training data are normalized to achieve a zero mean of the observed values, and a unity standard deviation.We train the CNN model using 2500 examples per class per SNR (from 1 to 2500), and achieve an overall classification accuracy across all SNR values of 0.895.
We have conducted all simulations of this work online on Google Colab.Fig. 4 depicts the CNN performance.Fig. 4a displays a good fit of the CNN learning curve, monitoring the accuracy on the training and validation data correspondingly.The convergence of the accuracy to the value of 0.9 could be reached from 20 epochs.Fig. 4b shows the evolution of the CNN accuracy with increasing values of SNR.From the figure, we notice that an accuracy of 0.95 was reached at a low SNR of 5 dB.Moreover, Fig. 4c represents the per class accuracy as a function of SNR.From the figure, we notice that F-OFDM classification outperforms the others, ahead of UFMC, GFDM then OFDM and FBMC.The application of filtering in the analyzed waveforms creates distinctive statistical attributes that the CNN model adeptly captures and utilizes to precisely classify these novel transmission schemes.Finally, Fig. 4d illustrates the confusion matrix  for all SNR values, It is evident that there is a significant confusion between GFDM and OFDM, and vice versa.This outcome can be rationalized by the fact that OFDM can be viewed as a special case of GFDM, particularly when the number of subsymbols is set to 1.

B. GAN BASED PHYSICAL LAYER ATTACK GENERATION
In this set of simulations, we train the GAN using the received waveforms-2500 examples per waveform per SNR, for 3 SNR values, 20, 18, and 16 dB-for different cases in order to tune the GAN's hyper-parameters.We perform the GAN training for 500 epochs, save the generator model periodically (each 10 training epochs), then calculate the IS, FID, P gcc , and P ccc for each saved model using N f = 2500 examples of fake signals per waveform.We reiterate each experiment 3 times, then disclose the best results.
We start by evaluating the impact of the batch size on the proposed C-DCGAN performance.In [67], different batch sizes were tested and evaluated, and the authors recommend using larger batch sizes, up to 2048, to achieve better quality synthetic images.Such result was not found to be true for our database, for batch sizes multiple of 128.Although larger batch size reduces the training time as shown in Table 2, the highest IS score, highest P gcc , as well as lowest FID score were achieved for the 130 th epoch of the 512 batch size.Based on the reported scores, we can also conjecture that there is no direct correlation between the batch size and GAN performance for the chosen architecture and database.Table 2 reports also the per-class correct classification probability P ccc for the same experiments.
We notice that the highest IS scores correlate with high P ccc .In fact, the IS score, 4.06 corresponds to 3 classes with P ccc higher than 0.93 each, UFMC, F-OFDM and FBMC, plus GFDM with a lower P ccc .We noticed an interesting behavior for this particular GAN architecture, the generator is not able to maximize both GFDM and OFDM at the same time.It should be mentioned that we stop at 500 epochs because further training did not initially lead to improvement.We trained our GAN for 1000 epochs, with a batch size of 512, 3 times, where each trial took around 4 hours of training, and achieved the best results prior to 500 epochs.More precisely the P ccc of GFDM and OFDM didn't improve, while that of the other waveforms hovers around 0.95 after the 300 th epoch.We attribute the improved behavior of our C-DCGAN for these filtered OFDM variants, to the richer statistical they exhibit as a result of filtering at multiple levels (subband, per subcarrier, per subsymbol).The filtering employed in the studied waveforms gives rise to unique statistical characteristics, which the GAN model effectively captures and employs to accurately generate synthetic versions of these novel transmission schemes.
Since we are more interested in the filtered multicarrier families, we want to have a single generator model which can forge the four investigated waveforms.We run a second set of experiments, where we train the GAN omitting OFDM from the training vector.Table 3 reports the training time and scores for these different experiments.In Exp 5, we use the 4 investigated OFDM variants, and train the GAN with the same set of examples used to train the CNN (1 to 2500 per waveform per SNR), while in Exp 6 we use a different set of examples (2500 to 5000 per waveform per SNR).We were able to achieve a lower FID and higher P gcc in both experiments compared to Exp 3, as detailed in Table 3.The P ccc of the targeted waveforms is higher than 0.98 for Exp 5, while it drops to 0.6 in Exp 6 for GFDM, which means that our model did not generalize well for this particular waveform across different datasets.
Furthermore, we examine the impact of the number and variety of examples on our C-DCGAN performance.We train the GAN with 5000 examples total per waveform, with two different configurations.In Exp 7, we use 2500 examples per waveform for 6 SNR values (10 up to 20 dB), while   .3, we can notice that the P gcc dropped to 0.887 and 0.86 for Exp 7 and 8 respectively.The waveform that the GAN failed to maximize in both experiments is GFDM, while FBMC P ccc decreased with a dataset of mixed SNR values.We can conclude that our model did not generalize well for GFDM.This waveform is the most complex among the investigated ones; in addition to the per subcarrier filtering, GFDM also introduces filtering per subsymbols.
Finally, we inspect the effect of the network depth on the capabilities of our C-DCGAN, for all waveforms.We increase either the number of filters, as in Exp 9 and 10, or we add a convolutional layer (at both G and D models) as in Exp 11 and 12.As reported in Table .4, we were able to improve the global correct classification probability for Exp 9 and 10 compared to our best model of Exp 3, at the expense of a larger network and longer training time.The fake GFDM P ccc improved from 0.528 in Exp 3, to 0.84 and higher for Exp 9 and 10, while that of OFDM increased to 0.59.From the scores of both Exp 11 and 12, we can deduce that adding a convolutional layer did not lead to any improvement for this specific dataset.
Lastly, Fig. 5 depicts confusion matrices drawn using the best generator models.From Fig. 5a, 5b and 5c, we can clearly see the fake GFDM and OFDM signals are confused, but the GAN generates more discernable instances of these two waveforms with increased number of filters.In these figures, true labels are the conditional labels used in the generator, while the predicted ones are declared by the CNN.All our trained models can be used to create a successful evasion attack.Since the intention of the adversary transmitter is to emit waveforms which are statistically almost indistinguishable from the intended transmitter's ones, and fool the classifier at the target receiver, we can consider a random signal as a basic evasion attack.The success probability of such an attack is 4.56% reported by the CNN for a vector of random data.The classifier trained at intended receivers, can discriminate real signals from random ones, but cannot effectively identify fabricated signals generated by the GAN.The success probability of the GAN based evasion attack is much higher around 99.7% using the generator model of Exp 5 for instance as reported in Table 5.

V. CONCLUSION AND FUTURE SCOPE
In this work, we introduced a wireless evasion attack, where an adversary transmitter generates forged signals that cannot be accurately differentiated from intended ones using a conditional GAN.We considered the advanced filtered multicarrier waveforms, namely UFMC, F-OFDM, GFDM and FBMC and the legacy OFDM.Since the goal of this paper is to fool a CNN classifier, trained at the intended receiver to discriminate between the investigated waveforms and random signals, we defined the global and per class correct classification probabilities, P gcc and P ccc respectively, then used them with the IS and FID scores to evaluate the forged signals.
We showed that the classifier recognizes attacks based on random signals, while it misclassifies those generated by the GAN.We also noticed that the proposed model was not able to learn all the waveforms equiprobably, for instance the generator failed to maximize both GFDM and OFDM at the same time.In all our experiments, we trained the proposed GAN using the raw I/Q data, and spawned fake signals which were 99% misclassified as real ones, with correct labels.In a future work, we plan to develop other evaluation metrics specific to wireless signals, such as the quality of the power spectral density (PSD) and others more specific to each waveform such as the shape of the filters.Furthermore, the GAN based evasion attack presents a practicable menace against CNN based detection methods, in a future work we will investigate defense mechanisms to identify and circumvent these type of attacks.

FIGURE 1 .
FIGURE 1. Aerial data collection by UAVs from IoT devices in a smart farming scenario.

FIGURE 2 .
FIGURE 2. Steps for fake multicarrier signals generation using a C-DCGAN.

FIGURE 4 .
FIGURE 4. Performance of the CNN classifier: Accuracy and confusion matrix.

FIGURE 5 .
FIGURE 5. Confusion matrices of the CNN classifier with fake signals, for different generator models.