  There has been recent interest in leveraging federated learning (FL) for
radio signal classification tasks. In FL, model parameters are periodically
communicated from participating devices, which train on local datasets, to a
central server which aggregates them into a global model. While FL has
privacy/security advantages due to raw data not leaving the devices, it is
still susceptible to adversarial attacks. In this work, we first reveal the
susceptibility of FL-based signal classifiers to model poisoning attacks, which
compromise the training process despite not observing data transmissions. In
this capacity, we develop an attack framework that significantly degrades the
training process of the global model. Our attack framework induces a more
potent model poisoning attack to the global classifier than existing baselines
while also being able to compromise existing server-driven defenses. In
response to this gap, we develop Underlying Server Defense of Federated
Learning (USD-FL), a novel defense methodology for FL-based signal classifiers.
We subsequently compare the defensive efficacy, runtimes, and false positive
detection rates of USD-FL relative to existing server-driven defenses, showing
that USD-FL has notable advantages over the baseline defenses in all three
areas.
