PaperlayerView exact revision on arXiv

Source-linked AI summary

Masking Radar Cognition under Adversarial Surveillance: A Distributional Privacy Framework

Sreedevi K, Nandhini K, Anup Aprem, Deepthi P P

arXiv:2609.07428v1eess.SPcs.LG

TL;DR

Cognitive radar behavior can expose internal decision strategies to adversarial inference, and existing approaches lack formal guarantees. The paper develops distribution-privacy cognition masking for static and dynamic radar decisions; both methods satisfy ε-DistP and show reported privacy–performance benefits.

Abstract

from arXiv · show

In this article, we propose an online electronic counter-countermeasure (ECCM) framework designed to conceal the strategic decision-making processes of a cognitive radar (CR) operating under adversarial surveillance. We model the CR under two distinct decision paradigms: a static constrained utility-maximizing behavior and a dynamic expected utility-maximizing behavior. The radar's utility function is modeled via a von Mises--Fisher (vMF) distribution, with the distributional parameter constituting the private information to be protected from adversarial inference. We adopt a distribution privacy framework to conceal this private information and provide formal distribution privacy guarantees for cognition masking. In this work, we develop cognition-hiding algorithms for both static constrained utility maximization (WDPCH-SU), and dynamic expected utility maximization (WDPCH-DU). Through rigorous mathematical analysis, we show that both WDPCH-SU and WDPCH-DU satisfy $\epsilon$-distribution privacy ($\epsilon$-DistP) against inference-based adversarial attacks and present the privacy--performance trade-off bounds, quantifying utility loss (in static setting) and expected utility deviation (in dynamic setting) as functions of $\epsilon$. Numerical results show that WDPCH-SU gives about 15\% improvement in utility loss at maximum privacy compared to the existing methodology while WDPCH-DU achieves a greater reduction in adversarial Fisher information without requiring explicit Fisher information constraints, at a moderate, analytically bounded utility deviation. These results are highly promising in many 6G communication scenarios such as network slicing for automated driving and swarm UAV coordination, where it is essential to keep the resource allocation policy robust against privacy attacks.

I. INTRODUCTION

Cognitive radar actions can reveal decision strategies to adversaries, while existing cognition-masking approaches lack formal statistical guarantees. This work applies distributional privacy to static and dynamic radar decision-making and analyzes its privacy–performance trade-offs.

I. INTRODUCTION

  • Cognitive radar adapts its actions using past observations and environmental perception, extending radar use to complex and uncertain environments.Prior applications include waveform selection, resource management, and multi-target tracking –.Source: §I · p. 1
  • WDPCH-SU and WDPCH-DU address static constrained and dynamic expected utility maximization, respectively, with ε-DistP guarantees and privacy–performance bounds.The bounds quantify static utility loss and dynamic expected utility deviation as functions of ε; numerical results report improvements over existing approaches.Source: §I · pp. 1–2

A. Classical ECM and ECCM

  • Existing radar ECCM methods primarily address signal-level interference, not inference-based attacks on radar decision processes.Examples include spread-spectrum methods, STAP, and beamforming –.Source: A. Classical ECM and ECCM · p. 2

B. Cognitive Radar: ECM and ECCM

  • Cognitive-radar adversarial work includes cognitive jamming and inverse learning, which can reconstruct internal state estimates, policies, or objectives.Inverse learning is described as a persistent threat because it enables long-term exploitation of radar behavior –.Source: B. Cognitive Radar: ECM and ECCM · p. 2
  • Existing ECCM strategies improve robustness against intelligent interference but do not explicitly address inference of radar decision-making policies.The cited approaches include adaptive sensor selection, reinforcement learning-based anti-jamming, and adversarial bandit and game-theoretic methods –.Source: B. Cognitive Radar: ECM and ECCM · p. 2

C. Metacognitive Radar and Masking Strategies

  • Masking and Fisher-information methods can hinder adversarial learning, but prior approaches lack formal statistical guarantees and may rely on specific adversarial assumptions or non-convex optimization.The paper identifies these limitations across heuristic masking, revealed-preference perturbation, and FIM minimization –, –.Source: C. Metacognitive Radar and Masking… · p. 2

D. Privacy Frameworks

  • Distribution privacy protects parameters governing an underlying distribution rather than individual records, while Wasserstein mechanisms seek improved utility–privacy trade-offs.Distribution privacy has also been applied to sequential decision-making, including privacy-preserving policy synthesis in MDPs.Source: D. Privacy Frameworks · p. 2

III. BACKGROUND: DISTRIBUTION PRIVACY AND WASSERSTEIN MECHANISMS

  • The paper’s background frames cognition hiding as limiting an adversary’s ability to distinguish distributions and infer the latent radar parameter.It introduces ε-DistP and the ∞-Wasserstein distance, described as focusing on worst-case cost between distributions.Source: §III · p. 3

IV. MASKING THE STATIC UTILITY OF A COGNITIVE RADAR

The static setting models a cognitive radar tracking targets through sensing, Bayesian belief updates, and perception-driven action selection. The controller chooses actions by solving a constrained utility-maximization problem.

A. CR Framework for Static Utility Maximization

  • The static framework combines target dynamics, a sensor, a Bayesian tracker, a perception-driven controller, and an adversarial inverse learner.In the example, the radar allocates beam resources among targets while an adversary manipulates target maneuvers and observes allocations.Source: A. CR Framework for Static Utility… · p. 3
  • The sensor provides noisy target-state measurements, which the Bayesian tracker uses to form a posterior belief and generate a scene-perception vector.For the example, each perception entry represents predicted tracking accuracy for a target.Source: A. CR Framework for Static Utility… · p. 3
  • Conditioned on scene perception, the radar controller selects its response by solving a constrained utility-maximization problem.The utility function governs the radar’s relative preference across targets.Source: A. CR Framework for Static Utility… · p. 3

B. Adversarial Inverse Learning

The adversarial inverse-learning model treats observed radar responses to manipulated target maneuvers as evidence about the radar’s utility. The utility is modeled as a stochastic linear function with a vMF prior.

B. Adversarial Inverse Learning

  • The adversary perturbs target maneuvers, observes radar responses, and uses inverse filtering to recover scene perception and form a dataset for estimating the radar’s utility.The inferred utility could be used to design countermeasures that degrade tracking performance.Source: B. Adversarial Inverse Learning · p. 3

C. Stochastic Linear Utility Model

  • The model restricts attention to linear utility, with a stochastic utility vector whose entries represent relative radar preferences.In beam allocation, an entry represents the incentive for allocating beam time to a target.Source: C. Stochastic Linear Utility Model · p. 4
  • The utility vector is assigned a vMF distribution on the unit hypersphere, parameterized by a mean direction and concentration.As concentration tends to infinity, the distribution becomes a point mass, corresponding to deterministic utility.Source: C. Stochastic Linear Utility Model · p. 4

D. WDPCH-SU: Cognition Masking Algorithm and Privacy Guarantee

WDPCH-SU perturbs the vMF-distributed utility vector with calibrated Laplace noise before solving for a privacy-preserving allocation. The method provides an ε-DistP guarantee for the resulting decision.

D. WDPCH-SU: Cognition Masking Algorithm and Privacy Guarantee

  • Algorithm 1 models utility with a vMF distribution, acquires scene perception, samples noise, perturbs utility, and computes a privacy-preserving beam allocation.The algorithm is presented for a given privacy budget.Source: D. WDPCH-SU: Cognition Masking… · pp. 4–5
  • WDPCH-SU adds zero-mean Laplace noise, scaled using the worst-case Wasserstein sensitivity, to the vMF utility vector before solving the constrained allocation problem.The stated sensitivity is ΔW = 2.Source: D. WDPCH-SU: Cognition Masking… · p. 5
  • Theorem IV.2 establishes that Algorithm 1 satisfies ε-DistP, including for its deterministic decision output by post-processing immunity.The proof invokes the Wasserstein mechanism's guarantee for the perturbed utility.Source: D. WDPCH-SU: Cognition Masking… · p. 5

E. Trade-off Between Privacy and Utility Loss

The section characterizes the performance cost of adding noise to the vMF-distributed utility vector. It bounds utility loss using the noise magnitude and a Laplace tail bound.

E. Trade-off Between Privacy and Utility Loss

  • Adding noise to the vMF-distributed utility affects radar performance, and the section characterizes that cost as utility loss.The loss is denoted |∆u_k| in the supplied text.Source: E. Trade-off Between Privacy and… · p. 5
  • With probability at least 1 − 2δ, Theorem IV.4 gives an upper bound on the utility loss caused by perturbing the utility vector.The supplied passage states the probability guarantee but does not include the bound's expression.Source: E. Trade-off Between Privacy and… · p. 5
  • The loss bound follows by comparing the optimal solutions under the original and perturbed utilities and bounding their difference using the Laplace-noise vector's ℓ1 norm.The argument uses the common feasible set, Hölder’s inequality, and a bound on the noise-vector tail.Source: E. Trade-off Between Privacy and… · p. 5

V. MASKING THE DYNAMIC UTILITY OF A COGNITIVE RADAR

The dynamic setting models a cognitive radar’s long-run mode switching as an MDP and considers an adversary inferring its latent utility from observed state–action trajectories. The paper extends distributional privacy to this sustained inference setting.

V. MASKING THE DYNAMIC UTILITY OF A COGNITIVE RADAR

A. MDP Framework for Dynamic Utility Maximization

  • The MDP models states, actions, action-dependent transition probabilities, and state–action utility, with the policy selected to maximize long-run average expected utility.The running example uses discretized SINR states and radar operating modes; the transition kernel reflects resource choices and the target environment.Source: A. MDP Framework for Dynamic Utility… · pp. 5–6
  • Figure 3 depicts perturbed utility and the observed SINR state entering the MDP controller, which computes a privacy-preserving policy and selects actions.The resulting trajectory is what the adversary observes.Source: Figure 3 · p. 6

B. Adversarial Inverse Learning

  • An adversary observes the state–action trajectory to infer latent utility; deterministic optimal policies can be estimated more accurately as observations accumulate.The paper extends distributional privacy to provide an ε-DistP guarantee against this sustained inference.Source: B. Adversarial Inverse Learning · p. 6

C. Stochastic Utility Model and Policy Optimization

The dynamic model treats the state–action utility vector as private information and masks it with independent Laplace noise before policy computation. The algorithm satisfies ε-DistP, and its utility deviation has a probability-bounded upper bound.

C. Stochastic Utility Model and Policy Optimization

  • The state–action utility vector U follows a vMF distribution, with its latent parameter θ = (µ, κ) designated as private information.Because U enters the objective linearly, scaling it by a positive constant does not change the optimal policy, so U is restricted to the unit hypersphere.Source: C. Stochastic Utility Model and Policy… · p. 6

D. WDPCH-DU: Cognition Masking Algorithm and Privacy Guarantee

E. Trade-off Between Privacy and Utility

VI. NUMERICAL RESULTS

In the static tracking experiment, the unprotected strategy is nearly recovered by an adversary, while Algorithm 1 makes recovery fail. Quantitatively, it has lower utility loss than at perfect privacy, and its loss decreases approximately as 1/ε.

1) Qualitative Analysis:

  • The static experiment uses three targets, vMF utility with µ1 = [0.57, 0.47, 0.67] and κ1 = 60, and 10,000 observations for adversarial inference.The adversary estimates the distribution’s mean using Metropolis-Hastings, assuming κ1 is known.Source: 1) Qualitative Analysis · p. 7
  • 0.990 cosine similarity between the true and estimated vMF mean indicates near-perfect adversarial recovery without distribution privacy.With Algorithm 1 at δ = 0.01 and ε = 0.1, the reported cosine similarity is −0.99, and the adversary fails to infer the true utility distribution.Source: 1) Qualitative Analysis · p. 7

2) Quantitative Analysis:

  • 0.646 utility loss for Algorithm 1 is lower than 0.755 for the existing methodology at perfect privacy.The proposed loss decreases approximately as 1/ε, whereas the existing approach’s loss decreases linearly.Source: 2) Quantitative Analysis · p. 8, Figure 5 · p. 8
  • Algorithm 1 operates online with minimal controller modifications, while the compared optimization in is a batch problem.The paper also states that lacks a formal privacy guarantee against inference strategies beyond revealed-preference learners.Source: 2) Quantitative Analysis · p. 8

B. Masking the Dynamic Utility of CR

The dynamic case study tests whether an adversary can recover a radar’s preference for the higher-SINR state. Perturbing utility with Algorithm 2 disperses utilities and makes that ordering less reliably recoverable in PolicyWalk’s posterior.

B. Masking the Dynamic Utility of CR

  • The comparison uses PolicyWalk posteriors from demonstrations generated under the true utility and under perturbed utility, with the radar policy recomputed after perturbation.The perturbed utility is U + z, with independent Laplace noise at scale b = ∆W/ε and ε = 2.Source: 1) Qualitative Analysis · p. 9

1) Qualitative Analysis:

  • Without distribution privacy, PolicyWalk’s recovered posterior stays concentrated above the diagonal and correctly recovers U(S1) > U(S0) in nearly all trials.The four-state, two-action MDP represents S1 as the higher-SINR state and models utility as state-dependent in this case study.Source: 1) Qualitative Analysis · pp. 8–9
  • Under Algorithm 2, the perturbed utility and PolicyWalk posterior straddle the decision boundary, making the preference ordering less reliably recovered.The study uses 200 Monte Carlo trials; the caption describes the posterior mean as pulled toward the diagonal after perturbation.Source: 1) Qualitative Analysis · p. 9, Figure 6 · p. 9

2) Quantitative Analysis:

The proposed dynamic method reduces adversarial Fisher information more than both compared approaches, with moderate utility deviation consistent with an analytical bound. The conclusion reports privacy–performance guarantees and favorable comparisons for both static and dynamic cognition hiding.

2) Quantitative Analysis:

  • The compared prior methods perturb either the policy while penalizing det F, or the MDP transition probabilities through a Dirichlet mechanism.The determinant-penalized optimization is non-convex and does not provide a formal ϵ-DistP guarantee; transition perturbation may be unsuitable when dynamics depend on external factors and the radar system.Source: 2) Quantitative Analysis · pp. 9–10
  • The proposed method achieves the largest overall reduction in adversarial Fisher information among the three approaches, with moderate utility deviation consistent with Theorem V.2’s bound.Figure 7 compares adversarial identifiability and utility deviation against privacy parameter ϵ.Source: 2) Quantitative Analysis · pp. 9–10, Figure 7 · p. 10
  • The proposed method operates on the vMF-distributed utility and avoids Fisher-information constraints and transition-matrix perturbation, while utility deviation increases with privacy.The bounded deviation is described as the price of formal ϵ-DistP without those approaches.Source: 2) Quantitative Analysis · p. 10

VII. CONCLUSION

  • The conclusion reports that WDPCH-SU has lower utility loss and stronger privacy than, while WDPCH-DU reduces adversarial Fisher information more than existing approaches without explicit Fisher constraints or transition-probability perturbation.Both methods make minimal modifications to baseline radar controllers; analytical bounds quantify static utility loss and dynamic expected utility deviation as functions of ϵ.Source: §VII · p. 10

APPENDIX

The appendix describes adversarial inference procedures and privacy-preserving policy synthesis. It covers posterior sampling for static inference, a sampling-based likelihood calculation, dynamic inverse learning, and Dirichlet perturbation of MDP transitions.

APPENDIX

  • Algorithm A uses Metropolis–Hastings sampling to infer the posterior distribution of the radar’s cognitive parameter from observed data.Candidate parameters are sampled and accepted or rejected using a likelihood ratio test.Source: APPENDIX · p. 10
  • Algorithm B numerically evaluates the likelihood needed in Algorithm A’s acceptance ratio by sampling vMF utilities and solving the constrained LP.It estimates the likelihood from the fraction of sampled optimal responses matching the observed response within a threshold.Source: APPENDIX · p. 10
  • Algorithm C applies PolicyWalk-style MCMC to infer latent utility from observed state–action data, with a sample mean estimating the adversary’s posterior utility.Proposed utilities are accepted or rejected via a Metropolis–Hastings ratio, and policy iteration is warm-started when needed.Source: APPENDIX · p. 11
  • Algorithm D applies Dirichlet noise independently to MDP transition rows, then synthesizes a policy for the privatized MDP.The concentration parameter k controls the trade-off: smaller k gives stronger privacy through greater perturbation, while larger k better preserves the original transition structure.Source: APPENDIX · p. 11
Loading 2609.07428v1…