• Investigate the robustness of the proposed cooperative countermeasures against data-driven adversaries.

• Evaluate the ML-based detection capability at Dave using real energy sequences collected from the SDR-based hardware testbed.

• Analyze the performance of supervised and unsupervised ML-classifiers for detecting cooperative countermeasures.

• Consider both non-adaptive and adaptive adversarial scenarios, where countermeasure samples are unavailable and available during training, respectively.

In Table 1, we tablute the specifications of the supervised and unsupervised ML-Classifiers.

• We use 5000 samples per class for training and 1500 samples per class for testing.

• We implement the aforementioned supervised and unsupervised ML-classifiers on the collected energy-sequence dataset.

• For a target probability of false-alarm​, the detection threshold is set as the (1-probability of false-alarm​)-quantile of the classifier scores obtained from test samples corresponding to unit-energy QPSK symbols.

• The probability of detection is computed as the fraction of after-countermeasure test samples exceeding the detection threshold.

• By varying the detection threshold and computing the corresponding probability of false-alarm​​ and probability of detection, we obtain the ROC curves of the considered ML-classifiers.

• In a realistic scenario, the DTRTF samples are unavailable for training at Dave.

• Consequently, Dave must detect the presence of countermeasures using unseen signal characteristics.

• Assuming that the countermeasure alters the scaling or modulation formats, Dave constructs a surrogate Class-1 comprising energies of symbols deviating from unit-energy QPSK symbols.

• In Fig. 1, we plot the ROC curves of different ML-classifiers for α=0.9901, along with that of the random classifier.

• From the figure, we observe that the ROC curves do not exhibit a pronounced bulge away from that of the random classifier.

• Consequently, high probabilities of detection cannot be achieved at low values of probability of false alarm.

• This demonstrates that the DTRTF scheme cannot be detected with a high probability by a data-driven adversary equipped with ML-classifiers.

• Similar behavior is observed for other values of α.

• The surrogate training approach is assumption-driven and may not accurately capture the signal characteristics of the IQ samples of DTRTF symbols.

• Consequently, we consider an adaptive adversary that observes the post-countermeasure behavior and collects the IQ samples of DTRTF symbols for training.

• Since labeled DTRTF symbols are available, the adaptive adversary uses their energies to construct Class-1 and retrains the supervised models, thereby eliminating the need for surrogate Class-1.

• In Fig. 2, for α=0.9901, we plot the ROC curves of different ML-classifiers for the adaptive adversarial scenario.

• In the same figure, for comparison, we also plot the ROC curves corresponding to the surrogate Class-1 training approach.

• From the figure, we observe that the ROC curves of all ML-classifiers do not exhibit a pronounced bulge away from that of the random classifier for both cases.

• Although the CNN exhibits slightly improved detection performance when DTRTF samples are available for training, high probabilities of detection still cannot be achieved at low values of probability of false-alarm​.

• This demonstrates that the DTRTF scheme cannot be detected with a high probability by a data-driven adversary equipped with ML-classifiers, even when labeled DTRTF samples are available during training.