Electronic Attack, Protection, and Cognitive Radar

Part of the Field Guide to Cognitive Electronic Warfare. All information is derived from unclassified, publicly releasable sources.

Most engineering is a contest against nature, which does not adjust its behaviour in response to the engineer. Electronic warfare is not. The environment is an adversary that responds to what the system does, learns from it, and works to defeat it, and that adversary is increasingly a cognitive radar that senses, decides, acts, and learns exactly as the jammer does. This page covers the contest and the functions that fight it: electronic attack that synthesizes countermeasures rather than selecting them, electronic protection that keeps friendly use of the spectrum alive, the inference contest over each side's objectives, and attacks aimed directly at the machine learning inside the systems. No technique wins permanently. The faster adaptation loop sets the terms.

A contest, not a problem

Treating an adversary as a fixed target produces brittle systems. A countermeasure designed against the way a threat behaves today is effective today and worthless once the threat behaves differently, which it will, because a capable adversary changes specifically to escape a countermeasure that is working. The correct model is an opponent with intent rather than a puzzle with a solution. That shift, from solving to competing, changes how a cognitive EW system must be built, because a system built to solve a fixed problem optimizes against a snapshot, and the engagement is never a snapshot.

In an ordinary optimization there is a correct answer to be found. In a contest there is no fixed correct answer, because the value of any move depends on the opponent's response. A move that is optimal against the adversary's current behaviour may be what provokes its next adaptation. The objective in electronic warfare is therefore a payoff in a game rather than a quantity to be maximized once, and a cognitive system has to reason not only about the effect of its action but about the reaction the effect will provoke.

Success is self-limiting in a specific way. A technique that works is, once used, an example the adversary can study and learn to defeat. Effectiveness reveals information: the better a countermeasure performs, the more attention it draws and the faster the adversary adapts around it. A cognitive EW system is therefore not searching for a technique that wins permanently, because none exists. It is trying to stay ahead of an opponent that learns from every move it makes. The contest between a cognitive jammer and a cognitive radar is naturally modeled as a two-player learning game, with each side an agent that adapts its policy against the other and treats the other's behaviour as the environment it must master.

If no permanent solution exists, winning means sustaining a faster adaptation loop than the adversary. The side that detects the change, judges its effect, and re-adapts more quickly sets the terms, and the other spends the engagement reacting. This moves the objective of a cognitive EW program away from any single technique and toward the speed and quality of its learning loop, which depends on the organization, the data, and the proving ground behind the system as much as on the system itself. The remaining sections follow the contest where it is sharpest: constructing a response the adversary has not seen, inferring and concealing intent, and attacking the cognition directly.

Electronic attack and protection

A traditional jammer selects a technique from a library indexed by emitter type. Against an emitter that changes its waveform on each transmission, no entry matches, and the countermeasure has to be synthesized. The system constructs a waveform or technique for the specific threat and conditions rather than retrieving one. Generative models of the type used to synthesize images and audio can be applied to radio, producing interference waveforms from a learned model of what degrades a class of threat. This shifts electronic attack from selection among predefined options toward construction of new ones.

A synthesized countermeasure has no guaranteed effect. A waveform that appears suitable may leave the target unaffected, so the system observes the threat's behaviour and estimates whether the technique worked, the battle damage assessment problem described in Electronic Support and Battle Damage Assessment. Synthesis without assessment produces untested countermeasures at machine speed, which against a reacting adversary is a liability rather than an advantage. The two functions are built together, or the system commits to techniques it cannot verify.

Where a countermeasure is selected from a family rather than synthesized, the selection is a learning problem against a learning opponent. It is posed as reinforcement learning: the system applies a technique, observes the reaction, and updates its selection policy, while the threat adapts in return. The constraints are those of in-mission learning, described in Machine Learning for Electronic Warfare: few observations, a deadline, and a non-stationary opponent. A cognitive attacker is therefore closer to a fast, constrained learner than to a large technique library.

Electronic protection applies the same processing to friendly survival. A cognitive radio under jamming characterizes the interference and changes frequency, waveform, coding, or antenna pattern to maintain its link. It places receiver nulls on the jammer and shapes its emissions to lower the probability of interception. Protection matters because a cognitive EW system is itself a target, and the element under attack is increasingly its machine learning rather than its radio front end, the subject of the final section. A system that can defeat a threat but cannot survive one does not remain in the engagement.

Cognitive radar and the contest over intent

Everything this guide says about a cognitive EW system applies, with the objective reversed, to a cognitive radar. It observes, it optimizes a payoff, and it improves from experience, so the jammer is facing a learner, and treating that learner as a fixed threat is the fastest route to being surprised.

A rational system chooses its actions to advance an objective, so its actions carry information about that objective, and an observer can work backward from the pattern of behaviour to the goal that best explains it. Applied to radar, this is inverse reinforcement learning: reconstructing the utility a cognitive radar is pursuing from its observed operation, distinguishing a purpose-driven system from a merely reactive one, and predicting its next actions. It is electronic support directed not at the signal but at the intent behind it, and it turns careful observation of an adversary's decisions into an estimate of what the adversary is trying to do.

Once inferring an adversary's objective is possible, concealing one's own becomes necessary. A system that may be observed by an objective-inferring adversary can shape its behaviour to mislead that observer, acting in ways that obscure what it is optimizing, at some cost to its own efficiency. For a radar, this is masking its cognition from an inference attack, choosing actions that prevent an observer from reconstructing its strategy. The contest becomes recursive: one side infers, the other conceals, the first attempts to see through the concealment, and so on. The contest began over signals, moved to which side adapts faster, and reaches a contest over knowledge of each other's objectives, with the objective function itself a quantity each side tries to obtain and to protect.

The practical conclusion is not that every system must infer and conceal intent today. It is that the adversary should be modeled as a learner with concealed objectives rather than as a fixed target, and that the highest levels of the contest are contests of inference. A program that designs against a snapshot of the threat is not only behind on technique. It is playing a lower-dimensional game than an opponent that reasons about objectives, and against a capable adversary that difference is decisive.

Attacks on the cognition

The traditional target of electronic warfare is an adversary's use of the spectrum. A cognitive system adds a second target: the machine learning the adversary depends on to perceive, decide, and improve. A cognition loop presents three surfaces. The first is perception, the signals the system senses, which can be shaped to cause a misread. The second is the learned model, which can be corrupted if the adversary can influence what the system trains on. The third is the feedback, the judgment of effect the system learns from, which can be falsified so the system draws the wrong conclusion from its own actions. Traditional jamming attacks perception with overwhelming power. Attacks on cognition are quieter, aim at all three surfaces, and can succeed with a fraction of the energy jamming would require.

A known fragility of machine-learning models is that a small, deliberately shaped change to an input can change the model's output while remaining nearly imperceptible. In the spectrum this is a means of attack. A signal can be perturbed enough to make an emitter classifier misidentify it, or miss it, with far less power than jamming the receiver would require. Attacking the model that interprets the signal can be substantially cheaper than attacking the signal, and the leverage is high enough that it is a distinct class of attack rather than a curiosity.

A system that learns in the field can also be taught the wrong thing. An adversary that can influence what a system observes over time can move the system's model in a chosen direction, an attack that corrupts rather than jams. Against a system that learns under fire this is particularly effective, because the property that makes the system adaptive, that it updates from what it observes, is the property the attack exploits. The more a system learns on its own, the more its learning has to be protected, which is a tension inherent to the field: the capability that is wanted is also the vulnerability that must be defended.

The defenses are partial. Training a model against adversarial inputs makes it harder to fool. Certified methods can give a model a provable margin, a guarantee that no perturbation below a certain size changes its output, though the guaranteed margins are modest. Monitoring the feedback channel for signs of falsification protects the learning. No defense is complete, many proposed defenses fail against an adversary that adapts to them, and a cognitive EW system should be built on the assumption that its cognition will be attacked rather than the hope that it will not. The same knowledge applies in both directions: understanding how to attack an adversary's machine learning is understanding how one's own will be attacked, and the advantage is in fielding a cognition that survives the attack.