Paper deep dive
Co-Evolving Zero-Day Jamming: Adaptive Attack Synthesis and Graph Attention-Based Online Detection
Ghilas Aissou, Rémi A. Chou, Taejoon Kim
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 9/21/2026, 4:16:07 AM
Summary
This paper proposes a two-pronged framework for co-evolving zero-day jamming detection and synthesis. First, an online detection framework combines a Graph Attention Network (GAT) for temporal-spectral representation learning with Dirichlet Process (DP)-means clustering to jointly classify known jamming strategies and discover emerging zero-day strategies without prior knowledge of their number. Second, an inference-driven Reinforcement Learning (RL) jammer is introduced as an adversarial benchmark that treats the receiver as a black-box, inferring detector states via hypothesis testing to optimize the trade-off between attack impact and stealth. Simulations demonstrate that the RL jammer achieves 33% higher attack efficacy and 67% higher stealth than benchmarks, while the proposed detector achieves 20% higher detection accuracy against this advanced jammer.
Entities (7)
Relation Signals (6)
Alice → communicateswith → Bob
confidence 98% · Alice communicates with Bob over L orthogonal frequency channels in the presence of a jamming adversary
Bob → hosts → Jamming Detector
confidence 96% · Bob is equipped with a jamming detector designed to trigger frequency-hopping countermeasure
Graph Attention Network → usedin → Online Detection Framework
confidence 95% · an online detection framework is introduced that combines a graph attention network (GAT) for temporal-spectral representation learning
Dirichlet Process Means → usedin → Online Detection Framework
confidence 95% · combines a graph attention network (GAT) ... with Dirichlet process (DP)-means clustering
Inference-Driven RL Jammer → evaluates → Online Detection Framework
confidence 93% · The proposed detection framework against the proposed RL jammer is shown to achieve 20% higher detection accuracy
Inference-Driven RL Jammer → uses → Generalized Likelihood Ratio Test
confidence 90% · The jammer infers the hidden detector state at the receiver via ... generalized likelihood ratio test (GLRT)-based hypothesis testing
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Effective evaluation of zero-day jamming detectors requires robust adversarial models. However, existing attack models often assume prior knowledge of the target receiver, limiting their utility as evaluation benchmarks. On the detection side, existing detectors fail to capture the global temporal-spectral structure of jamming behavior and cannot differentiate zero-day strategies as they emerge. This paper addresses these limitations through a two-pronged framework. First, an online detection framework is introduced that combines a graph attention network (GAT) for temporal-spectral representation learning with Dirichlet process (DP)-means clustering. This framework jointly classifies known and discovers zero-day strategies within a unified learning objective. Second, an inference-driven reinforcement learning (RL) jammer is proposed as an adversarial benchmark. The jammer treats the target receiver as a black-box, infers the detector state via hypothesis testing, and optimizes the trade-off between attack impact and stealth. Simulation results show that the proposed RL jammer outperforms benchmarks, achieving 33% higher attack efficacy and 67% higher stealth. The proposed detection framework against the proposed RL jammer is shown to achieve 20% higher detection accuracy than the benchmarks.
Tags
Links
- Source: https://arxiv.org/abs/2609.21334v1
- Canonical: https://arxiv.org/abs/2609.21334v1
Trouble viewing inline? Open PDF directly →
Full Text
42,300 characters extracted from source content.
Expand or collapse full text
Co-Evolving Zero-Day Jamming: Adaptive Attack Synthesis and Graph Attention-Based Online Detection Ghilas Aissou1 Rémi A. Chou2 Taejoon Kim1 †thanks: 1Arizona State University, School of Electrical, Computer and Energy Engineering, Tempe, AZ 85287, USA. Email:gaissou, taejoonkim@asu.edu†thanks: 2The University of Texas at Arlington, Department of Computer Science and Engineering, Arlington, TX 76010, USA. Email: remi.chou@uta.edu†thanks: This work was supported in part by NSF under grants CNS2451268, CNS2514415, ONR under grant N000142112472, and the NSF and OUSD – Research and Engineering, Grant ITE2515378, as part of the NSF Convergence Accelerator Track G. Abstract Effective evaluation of zero-day jamming detectors requires robust adversarial models. However, existing attack models often assume prior knowledge of the target receiver, limiting their utility as evaluation benchmarks. On the detection side, existing detectors fail to capture the global temporal-spectral structure of jamming behavior and cannot differentiate zero-day strategies as they emerge. This paper addresses these limitations through a two-pronged framework. First, an online detection framework is introduced that combines a graph attention network (GAT) for temporal-spectral representation learning with Dirichlet process (DP)-means clustering. This framework jointly classifies known and discovers zero-day strategies within a unified learning objective. Second, an inference-driven reinforcement learning (RL) jammer is proposed as an adversarial benchmark. The jammer treats the target receiver as a black-box, infers the detector state via hypothesis testing, and optimizes the trade-off between attack impact and stealth. Simulation results show that the proposed RL jammer outperforms benchmarks, achieving 33%33\% higher attack efficacy and 67%67\% higher stealth. The proposed detection framework against the proposed RL jammer is shown to achieve 20%\!20\%\! higher detection accuracy than the benchmarks. Index Terms: Graph attention network, novel class discovery, online clustering, reinforcement learning, Zero-day jamming. I Introduction While learning-based jamming detectors have demonstrated robust detection performance against known jammers [1, 2], they remain susceptible to zero-day attacks characterized by previously unseen signatures [3]. To rigorously evaluate detector resilience against such threats, reinforcement learning (RL)-based jammers [4, 5, 6] can be used to autonomously develop zero-day attack behaviors via online learning. However, their utility as evaluation benchmarks is often hindered by two limitations. First, they largely rely on a priori knowledge of the target receiver [4]. Second, they often overlook stealth requirements, even though maintaining a low probability of detection (LPD) is necessary to prevent countermeasures from neutralizing their attacks. On the detection side, anomaly-based methods [1, 7] can be used to detect zero-day attacks, but they are limited to binary benign-or-attack outputs. Similarly, existing frameworks such as open-set recognition method [8] can label zero-day attacks as an unknown class, but they lack the granularity required to distinguish between diverse zero-day attacks. This observation readily suggests that the challenge must be formulated as an online discovery problem, where unlabeled samples arrive sequentially as new zero-day jamming behaviors emerge and evolve over time. Although online k-means [9] supports sequential online updates, it does not jointly classify known and zero-day strategies. Existing novel class discovery methods [10, 3] address joint classification and clustering but operate in offline batch settings and require a priori knowledge of the the novel class cardinality. In this work, we consider a wireless communication link in which a transmitter (Alice) must secure robust communications with a receiver (Bob) in the presence of a jammer. Bob is equipped with a jamming detector designed to trigger frequency-hopping countermeasure upon identifying an attack. Within this framework, our primary contributions addressing the latter limitations are as follows: • We propose an online detection framework that jointly classifies known jamming strategies and discovers zero-day strategies as they emerge. The main challenge is to expand the label space upon zero-day discovery while maintaining classification stability, without the need for offline retraining or a priori knowledge of the zero-day class cardinality, which is in contrast to the methods in [3, 10]. This is addressed by a unified online framework that combines a graph attention network (GAT) encoder for temporal-spectral representation learning with Dirichlet process (DP)-means clustering module, enabling incremental class expansion without degrading classification of known jamming strategies. • To effectively evaluate the proposed detector, we introduce an inference-driven RL jammer that treats the receiver (Bob) as a black-box. This overcomes the reliance on receiver-side knowledge common in prior RL-based models [4, 5]. The jammer infers the hidden detector state at the receiver via cyclostationary feature extraction and generalized likelihood ratio test (GLRT)-based hypothesis testing [11]. Using the inferred state the jammer trains an RL policy to maximize interference efficiency while maintaining LPD (stealth). Simulation results show that the proposed RL jammer outperforms the benchmark method in [5], increasing attack efficiency by 33%33\% and stealth by 67%67\% while maintaining a block-box perspective. When evaluated against the proposed jammer the proposed detector achieves 20%\% higher detection probability compared to the scheme in [3]. Notation: Bold lowercase letters denote column vectors =[x1,…,xN]⊤∈ℂN×1 x\!=\![x_1,…,x_N] \! ^N× 1, and bold uppercase letters denote matrices ∈ℂM×N X\!∈\!C^M× N, where ℂC denote the sets of complex numbers. Calligraphic letters X denote sets, with |||X| their cardinality. [⋅]E[·] denotes expectation operator. I System Model and Problem Formulation We consider a wireless communication framework, illustrated in Fig. 1, where Alice communicates with Bob over L orthogonal frequency channels in the presence of a jamming adversary. We adopt a discrete-time complex baseband representation. At time slot t, Alice selects channel m∈1,…,Lm∈\1,…,L\ and transmits st[n,m]∈ℂs_t[n,m] , n=0,…,N−1n=0,…,N-1, where N is the number of time samples per slot. The jammer transmits ut[n,m(J)]∈ℂu_t[n,m^(J)] on channel m(J)∈1,…,Lm^(J)∈\1,…,L\ according to a strategy that determines the waveform, channel selection, and power. The signal received at Bob is rt[n,m]=hABst[n,m]+[m=m(J)]hJBut[n,m(J)]+wt[n,m],r_t[n,m]\!=\!h_\!ABs_t[n,m]+I[m\!=\!m^\!(J)\!]\,h_\!JB\,u_t[n,m^\!(J)\!]+w_t[n,m], (1) where hAB,hJB∈ℂh_AB,h_JB are the channel gains for the Alice-to-Bob and jammer-to-Bob links on channel m, respectively, [⋅]I[·] is the indicator function that equals 11 if the jammer is active on channel m and 00 when the jammer is not active on channel m, and wt[n,m]∼(0,σw2)w_t[n,m] (0, _w^2) is the additive zero-mean circularly symmetric complex Gaussian noise with variance σw2 _w^2, independent across channels. Bob demodulates and decodes rt[n,m]r_t[n,m] to retrieve the transmitted frame, evaluating a cyclic redundancy check (CRC) to generate a feedback bit At∈0,1A_t∈\0,1\, where At=1A_t=1 denotes an acknowledgment (ACK) (CRC passed) and At=0A_t=0 a negative-acknowledgment (NACK) (CRC failed). The jammer operates in full-duplex mode with ideal self-interference cancellation, sensing channel m(J)m^(J) while transmitting. The jammer observation is rt(J)[n,m(J)]=hAJst[n,m][m=m(J)]+wt[n,m(J)],r_t^(J)[n,m^(J)]=h_AJ\,s_t[n,m]\,I[m\!=\!m^(J)]+w_t[n,m^(J)], (2) where hAJ∈ℂh_AJ is the Alice-to-jammer channel gain and wt[n,m(J)]∼(0,σJ2)w_t[n,m^(J)] (0, _J^2). The jammer is assumed to overhear the binary feedback signal AtA_t transmitted over a dedicated control channel, as shown in Fig. 1. Figure 1: Wireless communication system under jamming attack. Jamming Detector and Problem Statement Bob constructs a time-frequency frame k∈ℝL×T X_\!k\!∈\!R^L\!×\!T over T consecutive time slots, indexed by τ∈1,…,Tτ∈\1,…,T\ corresponding to the slot index t=(k−1)T+τt=(k-1)T+τ. The entry [k]m,τ[ X_k]_m,τ denotes the average received energy on channel m during local slot τ, defined as [k]m,τ=1N∑n=0N−1|rt[n,m]|2.[ X_k]_m,τ= 1N _n=0^N-1 |r_t[n,m] |^2. The detector at Bob is trained on a labeled dataset =(i,yi)i=1NsD=\( X_i,y_i)\_i=1^N_s, where NsN_s is the number of training frames, yi=1y_i=1 denotes benign transmission, and yi∈2,…,Ky_i∈\2,…,K\ denotes one of K−1K-1 known jamming strategies. The detector output is a binary decision dk∈0,1d_k∈\0,1\, where dk=1d_k=1 indicates jamming detection and dk=0d_k=0 indicates no jamming detection. Upon detection (dk=1d_k=1), Alice and Bob activate a frequency-hopping countermeasure in frame k+1k+1. While we adopt this concrete setting for our analysis, the specific architecture of the detector and countermeasure remains modular and secondary to the proposed zero-day framework. The detector is trained on K known classes and is not designed to handle zero-day jamming. During deployment, Bob receives an unlabeled stream kk=1∞\ X_k\_k=1^∞, where each frame may belong to a known or a zero-day strategy. The task is formulated as an online discovery problem. We want to produce a decision ck∈1,…,K+Mkc_k∈\1,…,K\!+\!M_k\ for each incoming k X_k, where indices 1,…,K1,…,K correspond to known classes and indices K+1,…,K+MkK\!+\!1,…,K\!+\!M_k correspond to discovered zero-day strategies, with MkM_k the number of zero-day strategies discovered up to frame k. The challenge is that the detector must expand its label space upon zero-day discovery, with no prior knowledge of how many strategies MkM_k will emerge. At the same time, the detector must remain stable on known classes to prevent error propagation during subsequent online updates. We next present the online detection framework addressing these challenges. I Online Zero-Day Jamming Clustering Fig. 2 illustrates the proposed detection framework, whose components are detailed in the following subsections. A GAT encoder maps the frame k X_k to a latent embedding, which a dynamic classifier scores against the current label space to produce ckc_k. A DP-means module determines whether the embedding belongs to an existing class or creates a new zero-day class, while a multi-view consistency loss keeps the encoder discriminative on the unlabeled deployment stream. We describe the offline pre-training first, then the online detection. Figure 2: Proposed online zero-day jamming detection and inference-driven RL-based jamming synthesis framework. I-A GAT Encoder and Offline Pre-Training We describe the GAT encoder architecture and the pre-training procedure that initializes the encoder, classifier, and DP-means radius before deployment. I-A1 Graph Construction and Attention Jamming strategies induce structured global dependencies across frequency channels and time. Classical encoders, such as convolutional encoders, are not suited to modeling such global structure due to their limited receptive fields [12]. To model these non-local dependencies, we represent each frame k∈ℝL×T X_k\!∈\!R^L\!×\!T as a fully connected graph over LTLT nodes, where node (m,τ)(m,τ) corresponds to entry [k]m,τ[ X_k]_m,τ. Each node (m,τ)(m,τ) carries the feature vector k,m,τ=ϕθϕ([k]m,τ)∈ℝd0×1 x_k,m,τ\!=\! _ _φ([ X_k]_m,τ) ^d_0× 1, with ϕθϕ(⋅) _ _φ(·) a learnable node-wise map, with parameter θϕ _φ. For notational convenience, nodes are indexed by i=(m−1)T+τ∈1,…,LTi\!=\!(m\!-\!1)T\!+\!τ\!∈\!\1,…,LT\, so k,i≜k,m,τ x_k,i x_k,m,τ. The feature k,i x_k,i is projected into query, key, and value vectors k,i=Q⊤k,i q_k,i\!\!=\!\! W_Q x_k,i, k,i=K⊤k,i k_k,i\!\!=\!\! W_K x_k,i, k,i=V⊤k,i v_k,i\!\!=\!\! W_V x_k,i, respectively, where Q,K,V∈ℝd0×d W_Q, W_K, W_V\!∈\!R^d_0\!×\!d are projection matrices and d is the embedding dimension [13]. The attention weight from node j\!j\! to node i is ek,ij=exp(k,i⊤k,j/d)∑ℓ=1LTexp(k,i⊤k,ℓ/d).e_k,ij\!=\! ( q_k,i k_k,j/ d) _ =1^LT ( q_k,i k_k, / d). Each node aggregates value vectors weighted by attention, k,i=∑j=1LTek,ijk,j∈ℝd×1 h_k,i\!=\! _j=1^LTe_k,ij v_k,j\!∈\!R^d× 1, and mean pooling yields the frame embedding k=1LT∑i=1LTk,i∈ℝd×1 z_k\!=\! 1LT _i=1^LT h_k,i ^d× 1 [13]. The GAT encoder parameters θG≜(θϕ,Q,K,V) _G\! \!( _φ,\! W_Q,\! W_K,\! W_V) define the mapping k=fθG(k) z_k\!=\!f_ _G(\! X_k\!). I-A2 Offline Pre-Training As shown in Fig. 2 (in blue), the encoder fθGf_ _G and initial classifier cls,0=[1,…,K]∈ℝd×K W_cls,0=[ w_1,…, w_K] ^d× K, where c∈ℝd×1 w_c ^d× 1 is the weight vector for class c∈1,⋯,Kc\!∈\!\1,·s,K\, are trained on the dataset D by minimizing the supervised loss ℒℓ=−1Ns∑(i,yi)∈logp(yi∣i).L =- 1N_s _( X_i,y_i) p(y_i X_i). Here, p(c∣i)=exp(c⊤fθG(i))/∑c′=1Kexp(c′⊤fθG(i))p(c X_i)= ( w_c f_ _G( X_i))/ _c =1^K ( w_c f_ _G( X_i)) is the softmax posterior. At the end of training, the centroid of each known class c∈1,…,Kc∈\1,…,K\ is c=1|ℐc|∑i∈ℐcfθG(i)∈ℝd×1, μ_c= 1|I_c| _i _cf_ _G( X_i) ^d× 1, -2.84544pt (3) where ℐc=i:yi=cI_c=\i:y_i=c\. These centroids cc=1K\ μ_c\_c=1^K play a dual role: they initialize the DP-means representative set at deployment and provide the reference geometry for calibrating the DP-means radius λdp,c _dp,c. Specifically, λdp,c _dp,c is set on a held-out validation set valD_val as λdp,c=max(i,yi)∈val,yi=c‖fθG(i)−c‖2,c∈1,…,K. _dp,c= _ subarrayc( X_i,y_i) _val,y_i=c subarray\|f_ _G( X_i)- μ_c\|_2, c∈\1,…,K\. During deployment, a frame is assigned to its nearest class only if the distance falls within that class’s own radius; otherwise it is flagged as a zero-day candidate. I-B Online Classification and Zero-Day Discovery At deployment, the framework draws an unlabeled minibatch ℬkuB_k^u from the deployment stream, and processes k∈ℬku X_k _k^u in three sequential steps: (i) two augmented views are generated and embedded to produce reliable latent representations; (i) the DP-means module assigns each frame to an existing class or instantiates a new one; and (i) the dynamic classifier produces a posterior over the current label space. I-B1 Multi-View Augmentations and Unlabeled Consistency Each frame k∈ℬku X_k\!∈\!B_k^u is transformed into two stochastic views k(1)=Ψ1(k)∈ℝL×T X_k^(1)\!=\! _1( X_k)\!∈\!R^L\!×\!T and k(2)=Ψ2(k)∈ℝL×T X_k^(2)\!=\! _2( X_k)\!∈\!R^L\!×\!T, where Ψ1 _1 applies a random time shift and Ψ2 _2 applies a Gaussian noise perturbation. The perturbation magnitudes are calibrated on D to preserve the class label, in the sense that argmaxcp(c∣Ψv(k))=argmaxcp(c∣k) _cp(c _v( X_k))= _cp(c X_k) holds for v∈1,2v∈\1,2\. The shared encoder produces embeddings k(v)=fθG(k(v)) z_k^(v)=f_ _G( X_k^(v)) and classifier outputs posterior vectors k(v)=[pk(1∣k(v)),…,pk(K+Mk−1∣k(v))]⊤∈[0,1](K+Mk−1)×1 p_k^(v)=[p_k(1 X_k^(v)),…,p_k(K+M_k-1 X_k^(v))] ∈[0,1]^(K\!+\!M_k-1)\!×\!1. Similar to [10], each posterior is converted by the Sinkhorn–Knopp algorithm into a soft pseudo-label k(v)∈[0,1](K+Mk−1)×1 b_k^(v)∈[0,1]^(K\!+\!M_k-1)\!×\!1 enforcing a uniform class marginal. The pseudo-label of one view serves as the target for the other, yielding a consistency loss ℒku=−1|ℬku|∑u∈ℬku∑c=1K+Mk−1[bu,c()logpu(c∣u())+bu,c()logpu(c∣u())]. _k^u\!=\!\! -1|B_k^u|\!\! _ X_u\!∈\!B_k^u\!\!\!\!\! _c=1^K\!+\!M_k\!-\!1\!\!\! [b_u,c^(\!2\!) p_u(c\! \! X_u^(\!1\!))\!+\!b_u,c^(\!1\!) p_u(c\! \! X_u^(\!2\!)\!)\! ]. (4) This loss prevents the encoder from drifting on the unlabeled stream. The view embeddings (k(1),k(2))( z_k^(1), z_k^(2)) are then passed to the DP-means module. I-B2 DP-Means Assignment and Class Expansion The DP-means module maintains representatives cc=1K+Mk−1\ μ_c\_c=1^K+M_k-1, initialized from (3) and extended as new classes are discovered. Each view embedding is independently assigned by comparing its distance to the nearest representative against that class’s calibrated radius, ck(v)=c⋆,‖k(v)−c⋆‖2≤λdp,c⋆,NEW,otherwise, c_k^(v)= casesc ,&\| z_k^(v)- μ_c \|_2≤ _dp,c ,\\ NEW,&otherwise, cases (5) where c⋆=argminc‖k(v)−c‖2c = _c\| z_k^(v)- μ_c\|_2. Consensus between both views is required before any classification is made, guarding against spurious decisions on ambiguous frames. Three outcomes follow as shown in Fig. 2: Case 1: Agreement on an existing class (ck(1)=ck(2)=c⋆≠NEWc_k^(1)\!=\!c_k^(2)=c \!≠\!NEW): the representative is updated with the averaged embedding ¯k=12(k(1)+k(2)) z_k= 12( z_k^(1)+ z_k^(2)) via c⋆←c⋆+η(¯u−c⋆), μ_c ← μ_c +η( z_u- μ_c ), (6) where η∈(0,1]η∈(0,1] is the step size, and its cluster radius is updated online as λdp,c⋆←max(λdp,c⋆,‖¯k−c⋆‖2) _dp,c ← ( _dp,c ,\| z_k- μ_c \|_2 ). Case 2 – Agreement on a new class (ck(1)=ck(2)=NEWc_k^(1)=c_k^(2)=NEW): a new class cnew=K+Mk−1+1c_new=K+M_k-1+1 is created with cnew←¯k μ_c_new← z_k and λdp,cnew←‖k(1)−k(2)‖2/2 _dp,c_new\!←\!\| z_k^(1)\!-\! z_k^(2)\|_2/2. The classifier is expanded as cls,k←[cls,k−1cnew], W_cls,k←[ W_cls,k-1\ \ μ_c_new], (7) and MkM_k is incremented to Mk=Mk−1+1M_k=M_k-1+1. Case 3 — Disagreement (ck(1)≠ck(2)c_k^(1)≠ c_k^(2)): the frame is discarded from the representative update and pseudo-label generation, but still contributes to ℒkuL_k^u. The DP-means objective penalizes large distances between samples and their assigned cluster centers, while discouraging the creation of unnecessary new clusters: cluster,k=∑i∈ℬku∑cri,c‖¯i−c‖22+λdp2Mk−1,J_cluster,k= _ X_i _k^u _cr_i,c\| z_i- μ_c\|_2^2+λ_dp^2M_k-1, (8) where ri,c=1r_i,c=1 iff both views agree on class c, and λdpλ_dp is the penalty for creating a new class, set to λdp=mincλdp,cλ_dp= _c _dp,c so that any sample flagged as NEW in (5) incurs this penalty. At step k, the classifier cls,k∈ℝd×(K+Mk−1) W_cls,k ^d\!×\!(K\!+\!M_k\!-\!1) scores k z_k via p(yk=c∣k)=exp(c⊤k)∑c′=1K+Mk−1exp(c′⊤k),p(y_k=c\! \! X_k)\!=\! ( w_c z_k) _c =1^K+M_k-1 ( w_c z_k), and produces ck=argmaxcp(c∣k)c_k= _cp(c X_k). Known and zero-day classes are handled uniformly within the same softmax. When Case 2 occurs, the classifier is expanded via (7) with the new column initialized from the discovered centroid. I-B3 Unified Online Objective The supervised loss ℒkℓL_k , consistency loss ℒkuL_k^u, and clustering objective cluster,kJ_cluster,k all operate on the same encoder and classifier, so they are not independently optimized but jointly solved through ℒtotal,k=ℒkℓ+12e2suℒku+12e2sccluster,k+su+sc,L_total,k=L_k + 12e^2s_uL_k^u+ 12e^2s_cJ_cluster,k+s_u+s_c, (9) where ℒkℓ=−|ℬkℓ|−1∑(i,yi)∈ℬkℓlogp(yi∣i)L_k \!=\!-|B_k |^-1\! _( X_i,y_i) _k p(y_i X_i) is evaluated on a labeled replay minibatch ℬkℓ⊂B_k , and su,sc∈ℝs_u,s_c are trainable log-uncertainty weights [14] that balance the three terms without manual tuning. At each step, θG,cls,k,su,sc\ _G, W_cls,k,s_u,s_c\ are updated by gradient descent on (9) and c\ μ_c\ by (6), coupled within a single online objective. To evaluate the proposed zero-day detector, we next introduce the inference-driven RL jammer. IV Inference-Driven RL Jammer We model the jammer as an inference-driven adversary that learns its strategy through RL, with the objective of maximizing the outage probability at Bob while remaining undetected. IV-A Jammer Observations and Detector State Estimation As illustrated in Fig. 1 (shown in red), the jammer observes the ACK/NACK feedback AtA_t [15] but does not directly observe the detector decision dkd_k or the countermeasure activation. To bridge this information gap and inform its RL-based policy, the jammer must probabilistically infer the detector’s state. We formulate this state estimation as a binary hypothesis test on the previous frame’s detection outcome: ℋ0:dk−1=0,ℋ1:dk−1=1,H_0:\ d_k-1=0, _1:\ d_k-1=1, (10) where ℋ0H_0 denotes stealth maintained and ℋ1H_1 denotes detection followed by countermeasure activation. The key challenge is that ACK/NACK feedback reflects both channel impairments and jamming effects and therefore does not reveal whether countermeasure activation has occurred. The jammer must infer dk−1d_k-1 from its sensing observation r(J)[n,m(J)]r^(J)[n,m^(J)] in (2). To sense Alice’s transmission, the jammer exploits the cyclostationary structure of Alice’s signal via the spectral correlation function (SCF) [11, 16]. The SCF maps the signal into a two-dimensional cyclic-spectral domain parameterized by spectral frequency ω and cyclic frequency α, providing robustness to noise uncertainty and channel fading, unlike energy-based detection. Using the smoothed cyclic periodogram S^r(J),tα(ω) S_r^(J),t^α(ω) [11], the jammer identifies a discriminative coordinate (α⋆,ω⋆)(α ,ω ) during an initial observation phase and computes the frame-level SCF feature q^k≜1T∑t=(k−1)T+1kT|S^r(J),tα⋆(ω⋆)|. q_k 1T _t=(k-1)T+1^kT | S_r^(J),t^α (ω ) |. (11) By the frequency-shift property of the SCF [16], when the countermeasure forces Alice to hop from the monitored channel (center frequency νm _m) to another channel (νm′,m′≠m _m ,m ≠ m), the theoretical SCF satisfies Sr(J),tα(ω)=|hAJ|2Ssα(ω−νm′)S_r^(J),t^α(ω)=|h_AJ|^2S_s^α(ω- _m ), shifting its peak away from (α⋆,ω⋆)(α ,ω ) and causing q^k q_k to drop. We define the unshifted SCF magnitude Ψm≜|Ssα⋆(ω⋆−νm)| _m |S_s^α (ω - _m)|, the occupancy ratio ρk≜T−1∑t=(k−1)T+1kTνm′=νm _k\! \!T^-1\! _t=(k\!-\!1)T\!+\!1^kT\! 1\!\ _m = _m\, the SCF leakage residual ϵ≜maxνm′≠νm|Ssα⋆(ω⋆−νm′)|ε _ _m ≠ _m|S_s^α (ω - _m )|, and assume channel-gain bounds 0<hmin2≤|hAJ|2≤hmax20<h_ ^2≤|h_AJ|^2≤ h_ ^2. Using the asymptotic normality of the SCF estimator established in [11], we derive the separation guarantee for our hypothesis test. For a target error probability β∈(0,1)β∈(0,1), define the confidence parameter δN,T(β)≜σS2log(2/β)/(NT) _N,T(β) _S 2 (2/β)/(NT), where σS2 _S^2 is the asymptotic variance of S^r(J),tα⋆(ω⋆) S_r^(J),t^α (ω ) [11]. Proposition 1. For any β∈(0,1)β∈(0,1), with probability at least 1−β1-β, under ℋ0H_0 q^k≥hmin2Ψm−δN,T(β), -3.55658pt q_k≥ h_ ^2 _m- _N,T(β), (12) and under ℋ1H_1, q^k≤ρkhmax2Ψm+(1−ρk)hmax2ϵ+δN,T(β). q_k≤ _kh_ ^2 _m+(1- _k)h_ ^2ε+ _N,T(β). (13) Consequently, q^k q_k is discriminative with probability at least 1−β1-β whenever Δq≜(hmin2−ρkhmax2)Ψm−(−ρk)hmax2ϵ>2δN,T(β). _q (h_ ^2\!-\! _kh_ ^2) _m\!-\!(1\!-\! _k)h_ ^2ε\!>\!2 _N,T(β). (14) Proof. Since w(J)[n,m(J)]w^(J)[n,m^(J)] is second-order stationary, its SCF satisfies Sw(J),tα⋆(ω)=0S_w^(J),t^α (ω)=0 for α⋆≠0α ≠ 0 [11]. By independence of s[n,m]s[n,m] and w(J)[n,m(J)]w^(J)[n,m^(J)], the nonzero-cyclic-frequency SCF of the jammer’s sensed signal is governed by the Alice component, yielding Sr(J),tα⋆(ω)=|hAJ|2Ssα⋆(ω−νm′)S_r^(J),t^α (ω)=|h_AJ|^2S_s^α (ω- _m ). Under ℋ0H_0, all slots satisfy νm′=νm _m = _m, so |Sr(J),tα⋆(ω⋆)|≥hmin2Ψm|S_r^(J),t^α (ω )|≥ h_ ^2 _m. Under ℋ1H_1, slots with νm′≠νm _m ≠ _m contribute at most hmax2ϵh_ ^2ε. Averaging over T slots yields ρkhmax2Ψm+(1−ρk)hmax2ϵ≥qk≥hmin2Ψm, _kh_ ^2 _m+(1- _k)h_ ^2ε≥ q_k≥ h_ ^2 _m, (15) where qk≜T−1∑t=(k−1)T+1kT|Sr(J),tα⋆(ω⋆)|q_k\! \!T^-1\! _t=(k-1)T+1^kT\!|S_r^(J),t^α (ω )| is the theoretical counterpart of q^k q_k. From [11], N(S^r(J),tα⋆(ω⋆)−Sr(J),tα⋆(ω⋆))→(0,σS2) N( S_r^(J),t^α (ω )-S_r^(J),t^α (ω )) dCN(0, _S^2). Applying a Gaussian tail bound to the frame-level SCF feature q^k q_k yields P(|q^k−qk|>δN,T(β))≤βP(| q_k-q_k|> _N,T(β))≤β. Combining with (15) yields (12)–(13), and (14) follows by requiring the ℋ0H_0 lower bound to exceed the ℋ1H_1 upper bound. ∎ Remark 1. Rearranging (14), the minimum observation length required to guarantee discrimination at confidence 1−β1-β is NT>2σS2log(2/β)/Δq2NT>2 _S^2 (2/β)/ _q^2, providing a design rule for selecting the frame parameters N and T as a function of the channel conditions and target reliability. From the asymptotic normality established in [11], q^k∼(qk,σS2/(NT)) q_k (q_k, _S^2/(NT)), where qkq_k depends on the unknown channel gains through (15). Since these gains are unknown, the jammer applies the GLRT logmaxϑ1p(q^k∣ℋ1;ϑ1)maxϑ0p(q^k∣ℋ0;ϑ0)≷ℋ0ℋ1η, _ _1\,p( q_k _1; _1) _ _0\,p( q_k _0; _0) _H_0^H_1η, (16) where ϑi _i collects the unknown channel parameters under ℋiH_i. The threshold η is calibrated during the observation phase to satisfy the Neyman–Pearson constraint PFA≜Pr(gk=1∣ℋ0)≤αFAP_FA (g_k=1 _0)≤ _FA for a prescribed false-alarm level αFA _FA. The GLRT outcome is mapped to gk=1,if the GLRT selects ℋ1,0,otherwise,g_k= cases1,&if the GLRT selects H_1,\\ 0,&otherwise, cases (17) so that gkg_k serves as a one-frame-delayed noisy proxy for Bob’s hidden detector response dk−1d_k-1, with gk=1g_k\!=\!1 indicating inferred detection (dk−1=1d_k\!-\!1\!\!=\!\!1) and gk=0g_k\!\!=\!0 indicating no detection (dk−1=0d_k\!-\!1\!\!=\!\!0). IV-B Jamming Decision-Making and Learning Framework At decision frame k, the jammer selects an action ak∈a_k following a policy π(ak∣ok)π(a_k o_k), where oko_k is its observable state. The action space A consists of all combinations of a type of jamming waveform (e.g., barrage noise, pulsed, etc.), a target frequency channel m(J)∈1,…,Lm^(J)∈\1,…,L\, and a transmit power level subject to 1TN∑t=(k−1)T+1kT∑n=0N−1[|ut[n,m(J)]|2]≤Pmax. 1TN _t=(k-1)T+1^kT _n=0^N-1E [|u_t[n,m^(J)]|^2 ]≤ P_ . Each action ak∈a_k specifies the jamming signal u[n,m(J)]u[n,m^(J)] in (1) during frame k. The observable state is ok≜(q~k,gk,A~k−1)o_k ( q_k,g_k, A_k-1), where q~k q_k and A~k−1 A_k-1 are uniform quantizations of q^k q_k and A¯k−1≜T−1∑t=(k−2)T+1(k−1)TAt A_k-1 T^-1 _t=(k-2)T+1^(k-1)TA_t into qlevq_lev and AlevA_lev levels, respectively. The resulting state space is of size ||=qlev×Alev|O|\!=\!q_lev\!×\!2\!×\!A_lev, which is controllable by the quantization level for tractable Q-learning. The reward function must be designed to capture the trade-off between communication disruption (impact) and stealth. A more aggressive jammer disrupts communication but also increases the risk of detection. Once detected, the countermeasure forces Alice to hop to a new channel, and the jammer must spend additional frames re-sensing to locate the new channel before resuming jamming. The per-frame reward is Rk=(1−A¯k)⏟impact−ζgk+1⏟stealth penalty,R_k= (1- A_k)_impact-ζ\, g_k+1_stealth penalty, (18) where gk+1g_k+1 is the GLRT-based inference of Bob’s detector decision dkd_k, available with one-frame delay, and ζ≥0ζ≥ 0 governs the trade-off. The first term rewards communication disruption; the second penalizes inferred detection. Since gk+1g_k+1 becomes available at frame k+1k+1, the Q-learning update is performed once gk+1g_k+1 becomes available. Under the adopted quantized state representation, the learning problem is treated as a finite-state MDP approximation. The jammer maximizes the expected discounted return maxππ[∑k=1∞γk−1Rk] _π\,E_π[ _k=1^∞γ^k-1R_k] with discount factor γ∈(0,1)γ∈(0,1) via the Q-learning update with learning rate ξ∈(0,1)ξ∈(0,1). Q(ok,ak)←(−ξ)Q(ok,ak)+ξ[Rk+γmaxa′∈Q(ok+1,a′)].Q(o_k,a_k)\!\!←\!(1\!-\!ξ)\,\!Q(o_k,a_k)\!+\!ξ\! [\!R_k\!+\!γ _a \!Q(o_k\!+\!1,\!a )\! ]. (19) Remark 2. A fixed stationary policy corresponds to a single jamming strategy, regardless of the frame-to-frame variability in the actions drawn from that policy. This follows from the equivalence between behavior strategies and mixed strategies in games with perfect recall [17]. V Simulation and Results Alice communicates with Bob over L=64L=64 orthogonal frequency channels. Each frame contains T=100T=100 slots, and each slot contains N=80N=80 complex baseband samples. The Alice-to-Bob and jammer-to-Bob links are modeled as independent Rayleigh fading channels. Alice transmits with fixed normalized power, PA=[|st[n,m]|2]P_A=E[|s_t[n,m]|^2], while the noise variance σw2 _w^2 is set such that 10log10(PA/σw2)=2010 _10(P_A/ _w^2)=20 dB during training. During evaluation, σw2 _w^2 is adjusted such that 10log10(PA/σw2)10 _10(P_A/ _w^2) varies from 55 dB to 3030 dB to evaluate the jammer under different channel conditions. Bob is equipped with a convolutional neural network based jamming detector trained on K=4K=4 known classes as discussed in Section I: benign transmission, sequential jammer, random jammer, and a reactive jammer [1]. In this simulation, the proposed jammer action space is instantiated by eight waveform-power combinations, formed by four jamming power levels and two jamming waveforms: wideband noise and narrowband tone interference. To generate zero-day jamming strategies, three independently initialized policies of the proposed RL jammer are trained. In view of Remark 2, each learned stationary policy is interpreted as one jamming strategy. Three baseline jammers are considered: a LinUCB contextual bandit [5], a super-reactive jammer (SRJ) [2], and a random jammer [1]. Figure 3: Performance comparison across transmit SNR values: (a) jamming effectiveness, (b) adversary stealth, (c) detector detection probability, and (d) average jammer reward for the proposed and benchmark detectors. RL Jammer Performance Fig. 3(a) shows that the proposed jammer consistently attains the highest outage probability, exceeding 0.80.8 for SNR values of 1515 dB and above, as the learned reward explicitly balances disruption and stealth after accounting for Bob’s defensive response. Fig. 3(b) reports the average stealth penalty, i.e., the average value of gkg_k in (18). The proposed jammer achieves the lowest penalty over the entire SNR range, indicating that the inference-driven feedback enables the jammer to avoid actions likely to trigger Bob’s detector, whereas the baselines either react myopically or ignore the detector altogether. On the defense side, the proposed detector is first trained offline on the K=4K=4 known jamming classes and then adapted during deployment through (9). As a benchmark, we consider the open-set recognition method in [3], combining OpenMax, Weibull-based score calibration, and a Siamese similarity module on the same encoder backbone. Online Detection Performance Fig. 3(c) compares the detection probability of the proposed detector with that of the benchmark in [3]. The proposed detector maintains a detection probability between 0.860.86 and 0.920.92, versus 0.680.68–0.760.76 for the benchmark, attributed to GAT-based temporal–spectral representation learning and online clustering, which captures long-range structure and adapts to previously unseen jamming strategies. Fig. 3(d) shows the jammer reward remains negative against the proposed detector for all SNR values but positive against the benchmark, consistent with the reward definition in Section IV-B: under the proposed detector, the penalty associated with the inferred detector response dominates the jammer’s disruption gain, while the benchmark fails to impose the same cost on the adaptive adversary. VI Conclusion We proposed a unified framework for zero-day jamming detection and adversarial benchmarking. A GAT-based online detector jointly classifies known and discovers emerging zero-day strategies without retraining, while an inference-driven RL jammer treats the receiver as a black-box and balances attack impact against stealth. Simulations show the proposed jammer synthesizes more effective and stealthier attacks than benchmarks, and the detector reliably identifies zero-day strategies that evade existing detectors. References [1] H. Pirayesh and H. Zeng (2021) Jamming attacks and anti-jamming strategies in wireless networks: a comprehensive survey. IEEE Commun. Surveys Tuts.. Cited by: §I, §I, §V. [2] N. Van Huynh, D. N. Nguyen, D. T. Hoang, T. X. Vu, E. Dutkiewicz, and S. Chatzinotas (2022) Defeating super-reactive jammers with deception strategy: modeling, signal detection, and performance analysis. IEEE Trans. on Wireless Commun. 21 (9), p. 7374–7390. External Links: Document Cited by: §I, §V. [3] H. Zhou, X. Cai, P. Peng, and Z. Guo (2025) A sustainable learning method for radar jamming recognition based on open set. IEEE Trans. on Aerospace and Electronic sys. 61 (5), p. 12525–12537. External Links: Document Cited by: 1st item, §I, §I, §I, §V, §V. [4] S. Amuru, C. Tekin, M. v. der Schaar, and R. M. Buehrer (2016) Jamming bandits—a novel learning method for optimal jamming. IEEE Trans. on Wireless Commun. 15 (4), p. 2792–2808. External Links: Document Cited by: 2nd item, §I. [5] Z. Schutz, D. J. Jakubisin, C. E. Thornton, and R. M. Buehrer (2024) Linear jamming bandits: learning to jam OFDM-modulated signals. In ICC 2024-IEEE Intl. Conf. on Commun., p. 2567–2572. Cited by: 2nd item, §I, §I, §V. [6] W. Liu, Y. Xu, J. Gu, H. Wang, Y. Yang, and G. Ding (2026) Jamming effectiveness evaluation based on automatic modulation recognition in cognitive jamming systems. IEEE Trans. on Cognitive Commun. and Networking 12 (), p. 2471–2485. External Links: Document Cited by: §I. [7] S. Rajendran, W. Meert, V. Lenders, and S. Pollin (2018) SAIFE: unsupervised wireless spectrum anomaly detection with interpretable features. In 2018 IEEE Intl. Symposium on Dynamic Spectrum Access Networks (DySPAN), Vol. , p. 1–9. External Links: Document Cited by: §I. [8] J. Zhang et al. (2024) Toward open-set intrusion detection in VANETs: an efficient meta-recognition approach. IEEE Trans. Netw. Sci. Eng.. Cited by: §I. [9] V. Cohen-Addad, B. Guedj, V. Kanade, and G. Rom (2021) Online k-means clustering. In Intl. Conf. on Artificial Intelligence and Statistics, p. 1126–1134. Cited by: §I. [10] E. Fini, E. Sangineto, S. Lathuilière, Z. Zhong, M. Nabi, and E. Ricci (2021) A unified objective for novel class discovery. In 2021 IEEE/CVF Intl. Conf. on Computer Vision (ICCV), Vol. , p. 9264–9272. External Links: Document Cited by: 1st item, §I, §I-B1. [11] A.V. Dandawate and G.B. Giannakis (1994) Statistical tests for presence of cyclostationarity. IEEE Trans. on Signal Processing 42 (9), p. 2355–2369. External Links: Document Cited by: 2nd item, §IV-A, §IV-A, §IV-A, §IV-A, §IV-A. [12] S. Lin, Y. Zeng, and Y. Gong (2022) Learning of time-frequency attention mechanism for automatic modulation recognition. IEEE Wireless Communications Letters 11 (4), p. 707–711. External Links: Document Cited by: §I-A1. [13] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin (2017) Attention is all you need. Advances in neural information processing sys. 30. Cited by: §I-A1. [14] A. Kendall, Y. Gal, and R. Cipolla (2018) Multi-task learning using uncertainty to weigh losses for scene geometry and semantics. In Proceedings of the IEEE conf. on computer vision and pattern recognition, p. 7482–7491. Cited by: §I-B3. [15] T. Kim, D. J. Love, M. Skoglund, and Z. Jin (2015) An approach to sensor network throughput enhancement by PHY-aided MAC. IEEE Trans. on Wireless Commun. 14 (2), p. 670–684. External Links: Document Cited by: §IV-A. [16] J. Lunden, V. Koivunen, A. Huttunen, and H. V. Poor (2009) Collaborative cyclostationary spectrum sensing for cognitive radio systems. IEEE Trans. on Signal Processing 57 (11), p. 4182–4195. External Links: Document Cited by: §IV-A, §IV-A. [17] H. W. Kuhn (1953) Extensive games and the problem of information. Contributions to the Theory of Games 2 (28), p. 193–216. Cited by: Remark 2.