Model-Adaptive and Risk-Constrained Frequency Hopping Against Predictive Jammers

Yanbo Chen; Xinjing Zhou

cs.LGSep 6, 2026

Model-Adaptive and Risk-Constrained Frequency Hopping Against Predictive Jammers

Authors: Yanbo Chen, Xinjing Zhou

Organizations: School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore · Università di Udine, Udine, Italy

Abstract

Adaptive frequency hopping against predictive jamming must address both model uncertainty and policy exposure: the context-loss relationship may vary across operating regimes, while persistent hopping patterns may expose high-probability channels to attack. We propose D-PACT-AFH, a model-adaptive and risk-constrained adversarial contextual-bandit framework in which a Tsallis-FTRL master combines a global linear learner with a partitioned local learner and selects the model class online. D-PACT-Hit incorporates channel-wise marginal hit risk into model selection, while D-PACT-Safe applies a minimum-Kullback-Leibler projection to enforce a per-slot risk budget. We establish estimator validity under non-anticipating attacks, an oracle decomposition relative to the better fixed base, and an exact conditional-risk guarantee for the Safe projection. Experiments across diverse channel regimes and jammer types demonstrate effective model adaptation and a controllable goodput-risk tradeoff: D-PACT-AFH recovers 95.5% of the local learner's gain under observable switching while avoiding 77.7% of its degradation in a negative-control regime.

Figures & tables

Fig. 1: Contextual frequency-hopping system and within-slot information pattern. The learner observes the public contexts

\mathbf{X}_{t}

and obtains the attack prediction

\mathbf{q}_{t}

and marginal hit-risk vector

\mathbf{h}_{t}

. The jammer commits the hidden attack set

\mathcal{J}_{t}

before the learner forms the executed policy

\mathbf{p}_{t}

and privately samples

A_{t}\sim\mathbf{p}_{t}

. The learner observes only the selected-channel reward

R_{t}=r_{t}(A_{t})

and hit indicator

Z_{t}=\mathbf{1}\{A_{t}\in\mathcal{J}_{t}\}

; the corresponding observed loss is

\ell_{t}(A_{t})=1-R_{t}

. The attack set remains hidden from the learner before transmission. Arrows in panel (b) indicate temporal order, not disclosure of the hidden attack set.

Parameter	Value
Channels, horizon, attack budget $(K,T,M)$	$(12,10^{4},1)$
Occupancy probability	$0.15$
Transmit/noise/jamming power	$1/0.05/2$
Bandwidth and rate cap	$1$ MHz, $4$ bit/s/Hz
Outage threshold	$3$ dB
Context dimension	$4$

TABLE I: Default simulation configuration.

Fig. 2: End-to-end goodput–risk operating points under the contextual white-box jammer. Error bars denote 95% confidence intervals.

Fig. 3: Online communication and exposure performance under the contextual white-box jammer. (a) Running-average delivered goodput. (b) Running empirical jam-hit probability. Curves are averaged over 20 independent seeds.

Method	Goodput	Jam hit	Local mass
	(Mbps)
Global-only	$3.235\!\pm\!0.006$	$0.172\!\pm\!0.002$	$0$
Local-only	$3.239\!\pm\!0.005$	$0.133\!\pm\!0.001$	$1$
D-PACT-Base	$3.232\!\pm\!0.007$	$0.158\!\pm\!0.002$	$0.353$
D-PACT-Hit	$3.236\!\pm\!0.005$	$0.134\!\pm\!0.001$	$0.948$
D-PACT-Safe95	$3.104\!\pm\!0.003$	$0.108\!\pm\!0.001$	$0.944$

TABLE II: Mechanism ablation under the white-box jammer. Values are mean

\pm

95% confidence-interval half-width.

Fig. 4: Model adaptation under a nonlinear negative control and an observable-switching regime. The upper panel reports goodput relative to the Global base; the lower panel reports the mean Local master mass.

Fig. 5: Goodput–risk frontier of D-PACT-Safe under the contextual white-box jammer. Safe95 is independently calibrated at $\tau=0.11$ .

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Method	Random	Sweep	FOLPETTI-inspired	White-box
Thompson	2.481/0.0837	2.479/0.0838	2.468/0.0884	2.399/0.1049
EXP3	2.487/0.0833	2.476/0.0849	2.429/0.1043	2.336/0.1306
LC-INF	3.592/0.0836	3.593/0.0845	3.596/0.0836	3.231/0.1723
RA-EXP4	3.067/0.0828	3.063/0.0836	3.061/0.0843	2.934/0.1048
AUFH	2.482/0.0829	2.478/0.0829	2.471/0.0844	2.441/0.0894
D-PACT-Base	3.580/0.0834	3.574/0.0848	3.576/0.0842	3.229/0.1607

Appendix

TABLE III: Complete cross-attacker comparison from the saved full evaluation. Each entry is mean goodput in Mbps / empirical jam-hit rate over 20 evaluation seeds. Methods in each attacker column share the same seed list and realizations.

Fig. 6: Saved full-run cross-attacker heatmaps. The left panel reports mean goodput in Mbps and the right panel reports the empirical jam-hit frequency. Rows contain all eight evaluated methods and columns contain the four jammer types listed in Table III . LC-INF, RA-EXP4, and AUFH abbreviate LC-Tsallis-INF-Online, risk-aware EXP4, and AUFH-EXP3++, respectively.

Fig. 7: Saved full-run goodput–exposure operating points for the random, sweep, FOLPETTI-inspired, and contextual white-box jammers. Each marker is the 20-seed mean reported in Table III ; the axes use empirical jam-hit frequency rather than conditional expected risk.

Method	Nominal	Nonlinear interaction	Observable switching
LC-INF	3.915/–	3.495/–	2.450/–
RA-EXP4	3.360/–	2.527/–	2.125/–
AUFH	2.709/–	0.945/–	1.296/–
D-PACT-Base	3.898/0.157	3.476/0.258	2.890/0.964
D-PACT-Hit	3.898/0.157	3.476/0.258	2.890/0.964
D-PACT-Safe95	3.898/0.157	3.476/0.258	2.890/0.964

Appendix

TABLE IV: Saved no-jammer model-regime results. Each entry is mean goodput in Mbps / mean Local-base master mass over 20 evaluation seeds; a dash denotes a method without the D-PACT master.

Method	White-box	Contaminated	Exog. sweep
LC-INF	3.235/0.1729	3.192/0.1806	3.160/0.1882
RA-EXP4	2.938/0.1054	2.873/0.1102	2.835/0.1147
AUFH	2.441/0.0903	2.327/0.0908	2.245/0.0906
D-PACT-Base	3.233/0.1588	3.191/0.1641	3.161/0.1704
D-PACT-Hit	3.235/0.1337	3.195/0.1408	3.166/0.1462
D-PACT-Safe95	3.104/0.1081	3.019/0.1088	2.967/0.1093

Appendix

TABLE V: Saved attacked-regime comparison (part 1). Each entry is mean goodput in Mbps / empirical jam-hit rate over 20 evaluation seeds.

Method	Mixed	Hidden Markov
LC-INF	2.947/0.2361	2.679/0.1749
RA-EXP4	2.582/0.1378	2.292/0.1040
AUFH	2.289/0.1126	1.911/0.1297
D-PACT-Base	2.975/0.1951	2.668/0.1697
D-PACT-Hit	2.983/0.1759	2.568/0.1379
D-PACT-Safe95	2.571/0.1093	2.398/0.1093

Appendix

TABLE VI: Saved attacked-regime comparison (part 2), using the same metric, seed count, and method order as Table V .

Fig. 8: Saved full-run regime summary. The upper panels show goodput and Local-base allocation for nominal, nonlinear, and observable-switching communication models without active jamming. The lower panels show mean goodput and empirical jam-hit frequency under the contextual white-box jammer in the nominal white-box, contaminated, exogenous-sweep, mixed, and hidden-Markov environmental regimes. Exact complete comparisons are given in Tables IV , V , and VI .

Sweep	Value	Method	$\tau$	Goodput (Mbps)	Expected hit	Empirical hit	Runtime (s)
K	8	D-PACT-Hit	–	2.931	0.1978	0.1994	84.9
K	8	D-PACT-Safe95	0.1505	2.758	0.1489	0.1513	87.4
K	12	D-PACT-Hit	–	3.235	0.1336	0.1348	78.7
K	12	D-PACT-Safe95	0.1100	3.111	0.1081	0.1074	101.1
K	16	D-PACT-Hit	–	3.397	0.0997	0.0990	110.7
K	16	D-PACT-Safe95	0.0898	3.316	0.0868	0.0853	113.8

Appendix

TABLE VII: Detailed saved D-PACT scaling results (10 seeds per configuration). Expected hit is the conditional marginal policy risk; empirical hit is the realized jam-hit frequency. Runtime is in seconds and uses the timing scope stated in Section VI .

Fig. 9: Saved 10-seed scaling results. The upper panels show goodput and empirical jam-hit frequency versus the number of channels. The lower panels show goodput and recorded runtime versus the horizon. Runtime uses the scope described in the text and Table VII .

$\tau$	Goodput (Mbps)	Expected hit	Empirical hit	Pre-risk	Post-risk	Activation	Max violation	Runtime (s)
0.085	$2.662\!\pm\!0.006$	0.0850	0.0846	0.1088	0.0850	0.996	1.00e-10	27.1
0.090	$2.811\!\pm\!0.005$	0.0899	0.0889	0.1140	0.0899	0.981	1.00e-10	27.6
0.100	$3.006\!\pm\!0.005$	0.0994	0.0990	0.1223	0.0994	0.898	1.00e-10	27.5
0.110	$3.111\!\pm\!0.006$	0.1081	0.1073	0.1277	0.1081	0.768	1.00e-10	28.0
0.120	$3.168\!\pm\!0.005$	0.1154	0.1143	0.1306	0.1154	0.610	1.00e-10	27.3
0.140	$3.214\!\pm\!0.008$	0.1252	0.1243	0.1329	0.1252	0.318	9.99e-11	27.0

Appendix

TABLE VIII: Saved independent 20-seed Safe calibration scan under the contextual white-box jammer. Goodput is mean

\pm

95% confidence-interval half-width. The budget applies to post-projection conditional risk, not to the realized empirical hit frequency.

Wireless Communications

Wireless communications studies how information is sent over radio links and how networks manage signals, spectrum, and resources reliably.

See all 400 papers

Co-Evolving Zero-Day Jamming: Adaptive Attack Synthesis and Graph Attention-Based Online Detection
Sep 18, 2026Ghilas Aissou, Rémi A. Chou, Taejoon KimBlack-Box Adversarial Attacks Reinforcement Learning
Arizona State University, School of Electrical, Computer and Energy Engineering, Tempe, AZ 85287, USA · The University of Texas at Arlington, Department of Computer Science and Engineering, Arlington, TX 76010, USA
Adversarial Training of Linear Models under Stealthy Attacks
Aug 26, 2026Lovisa Eriksson, Dave Zachariah, André M. H. TeixeiraAdversarial Attacks Adversarial Robustness
Department of Information Technology, Uppsala University, Uppsala, Sweden
MaxModShift: Model Privacy via Designed Shifts
Aug 10, 2026Nomaan A. Kherani, Urbashi MitraModel Extraction Attacks Privacy-Preserving ML
University of Southern California

Sep 18, 2026J/K move · Enter open · S save

Co-Evolving Zero-Day Jamming: Adaptive Attack Synthesis and Graph Attention-Based Online Detection

Ghilas Aissou, Rémi A. Chou, Taejoon Kim

Arizona State University, School of Electrical, Computer and Energy Engineering, Tempe, AZ 85287, USA · The University of Texas at Arlington, Department of Computer Science and Engineering, Arlington, TX 76010, USA

Black-Box Adversarial Attacks Reinforcement Learning

Open paper AskPDF arXiv

Effective evaluation of zero-day jamming detectors requires robust adversarial models. However, existing attack models often assume prior knowledge of the target receiver, limiting their utility as evaluation benchmarks. On the detection side, existing detectors fail to capture the global temporal-spectral structure of jamming behavior and cannot differentiate zero-day strategies as they emerge. This paper addresses these limitations through a two-pronged framework. First, an online detection framework is introduced that combines a graph attention network (GAT) for temporal-spectral representation learning with Dirichlet process (DP)-means clustering. This framework jointly classifies known and discovers zero-day strategies within a unified learning objective. Second, an inference-driven reinforcement learning (RL) jammer is proposed as an adversarial benchmark. The jammer treats the target receiver as a black-box, infers the detector state via hypothesis testing, and optimizes the trade-off between attack impact and stealth. Simulation results show that the proposed RL jammer outperforms benchmarks, achieving 33% higher attack efficacy and 67% higher stealth. The proposed detection framework against the proposed RL jammer is shown to achieve 20% higher detection accuracy than the benchmarks.

Abstract

Wireless Communications

Explore similar work

Co-Evolving Zero-Day Jamming: Adaptive Attack Synthesis and Graph Attention-Based Online Detection

Adversarial Training of Linear Models under Stealthy Attacks

MaxModShift: Model Privacy via Designed Shifts