Physical Adversarial RF Perturbations Reduce Drone Detector Accuracy

Global: Physical Adversarial RF Perturbations Reduce Drone Detector Accuracy

Researchers Omer Gazit, Yael Itzhakev, Yuval Elovici, and Asaf Shabtai reported a new over‑the‑air (OTA) attack that lowers the detection rate of radio‑frequency (RF) based drone monitoring systems while leaving legitimate drone signals largely unaffected. The study, submitted on 23 December 2025 and revised on 22 January 2026, demonstrates the feasibility of transmitting specially crafted complex baseband waveforms alongside normal communications to deceive image‑based object detection models.

Background on RF Drone Detection

RF‑based detectors convert captured drone communication signals into spectrogram images, which are then processed by deep‑learning object detection models. This approach has gained traction because it enables monitoring of drone activity without relying on visual line‑of‑sight.

Limitations of Prior Digital Attacks

Earlier adversarial research focused on digital perturbations applied directly to spectrogram pixels. Translating such modifications into OTA waveforms proved problematic due to synchronization errors, interference, and hardware constraints, limiting real‑world applicability.

Methodology of Physical RF Perturbations

The authors designed class‑specific universal perturbation waveforms in the complex I/Q domain. These waveforms are transmitted concurrently with legitimate drone communications, creating structured interference that subtly alters the resulting spectrograms without breaking standard RF protocols.

Experimental Evaluation

Using recorded RF traces and live OTA tests with four distinct drone models, the team showed that modest perturbations compatible with typical RF chains consistently decreased detection scores for targeted drones. At the same time, detection of non‑targeted, legitimate drones remained stable.

Security Implications

The findings highlight a practical vulnerability in current RF‑based drone surveillance solutions. Operators may need to incorporate robustness measures such as adversarial training, spectrum‑level anomaly detection, or multi‑modal verification to mitigate similar attacks.

Future Directions

Future work could explore adaptive perturbation strategies, cross‑technology attacks, and defensive architectures that jointly analyze RF, visual, and acoustic cues. Extending the approach to other RF‑dependent security systems may also be examined.

This report is based on information from arXiv, licensed under Academic Preprint / Open Access. Based on the abstract of the research paper. Full text available via ArXiv.