Active Attacks: Adversarial Interference

• Active attacks are adversarial strategies where attackers not only observe but also inject, modify, or disrupt protocols to control system behavior.
• They impact various domains such as wireless communications, federated learning, and social networks by employing adaptive and intervention-based techniques.
• Defensive approaches include active probing, anomaly detection, and adaptive hardening to counteract the operational interference of active adversaries.

Active attacks are attack models in which the adversary does more than observe. Across the literature, the defining move is operational interference: the attacker replies strategically to protocol queries, injects pilots or jamming signals, enrolls sybil nodes, modifies model parameters, chooses attacked edges adaptively, or otherwise alters the environment seen by the defender or learner. This stands in contrast to passive attacks, which are limited to eavesdropping, transcript observation, or post hoc inference from fixed artifacts (Schnoor et al., 2013, Kapetanovic et al., 2015, Nasr et al., 2018, Mauw et al., 2018, Yun et al., 26 Sep 2025).

1. Threat-model meaning and formal distinctions

A recurring distinction is between passive and active adversaries, with some works adding a second axis for adaptivity. In white-box privacy analysis of deep learning, the adversary can be black-box or white-box, and passive or active; the active case arises when a participant or server “adversarially modifies” parameter uploads or aggregate parameters so that membership inference becomes easier (Nasr et al., 2018). In secure network coding, the paper distinguishes deterministic attacks, time-ordered adaptive attacks, general adaptive attacks, and adaptive-and-active attacks, with $$\mathfrak{A}^0 \subset \mathfrak{A}^1 \subset \mathfrak{A}^2$$ and adaptive-and-active attacks represented by $(\bm{\alpha},\bm{\beta})\in\mathfrak{A}^3$ (Cai et al., 2017).

Communication-protocol work sharpens the distinction further by showing that an active attacker is strictly more powerful than a passive one. In the protocol model of a directed acyclic graph, the adversary may not only observe service calls but also reply strategically, using protocol-controlled values as “session cookies” to tag and track a local session. The security notion is correspondingly stronger: insecurity means there exists a strategy that, for every global session, eventually prints an assignment corresponding to one of the local sessions (Schnoor et al., 2013).

Other domains instantiate the same distinction with domain-specific mechanisms. In social-graph privacy, an active attacker inserts controlled vertices and uses their distances or adjacency patterns to identify victims after publication (Cicerone et al., 17 Apr 2025, Mauw et al., 2020). In wireless sensor networks, the survey classifies DoS, masquerade, replay, selective forwarding, node replication, wormhole, Sybil, sinkhole, rushing, and modification of messages as active attacks because the adversary injects, alters, replays, misroutes, or disrupts traffic rather than merely listening (Shahzad et al., 2017). This suggests that “active” is best understood as a family resemblance centered on adversarial control over system evolution.

2. Communications, wireless systems, and cyber-physical interference

In massive MIMO, the canonical active attack is pilot contamination. The vulnerability appears during uplink training: the legitimate user sends a pilot, and the eavesdropper switches from passive listening to active transmission, sending a synchronized pilot so that the base station’s estimate $\hat{\mathbf{g}}_{\mathrm{LU}}$ becomes correlated with $\mathbf{g}_{\mathrm{ED}}$. The consequence is that the base station unknowingly beamforms power toward the eavesdropper; secrecy capacity can saturate or collapse, and in the worst case become zero if the eavesdropper dominates the training phase. The paper also emphasizes that active attacks are difficult to detect because successful packet reception does not imply that the training phase was clean, and because ordinary pilot contamination already exists in practical multi-cell systems (Kapetanovic et al., 2015).

Over-the-air computation exhibits a different active mechanism: an external node injects random or misleading data to distort the aggregated result. The proposed detector appends dummy samples to the legitimate users’ transmissions and, in the stronger correlated design, hides the transmitted signal in a secret subspace using a shared Haar-distributed unitary matrix $\mathbf{U}$. After inverse projection at the server, the detector tests $\|\mathbf{y}_d\|^2 \gtrless \gamma$. Empirically, the correlated design with $\delta=0.005$ achieves roughly the same ROC performance as the uncorrelated design with $\delta=0.1$, implying about 20 times fewer dummy samples for similar detection quality (Nordlund et al., 2023).

In RAFT-based IoT blockchain networks, the active attacks considered are jamming and impersonation. Jamming degrades the uplink and downlink links needed for consensus, while impersonation injects forged votes. The impersonation defense uses pathloss as a fingerprint and applies a binary hypothesis test on the closest legitimate signature. The reported simulations show that coverage probability improves as jammers move away from the IoT network and that false alarm, missed detection, and miss-classification probabilities decrease as a function of link quality (Buttar et al., 2022).

Cyber-physical sensing systems expose a still lower layer. PyCRA exploits the fact that an active sensor emits energy and can therefore issue private physical challenges before digitization. The actuation is modulated as $\mathcal{B}(t)=u(t)\mathcal{A}(t)$ with private binary $u(t)\in\{0,1\}$, and anomalies are detected through a residual-based $(\bm{\alpha},\bm{\beta})\in\mathfrak{A}^3$0 statistic $(\bm{\alpha},\bm{\beta})\in\mathfrak{A}^3$1. The confusion phase lowers the attacker’s ability to recognize challenge boundaries; Theorem 2 states that reducing actuator amplitude by a factor $(\bm{\alpha},\bm{\beta})\in\mathfrak{A}^3$2 increases the attacker’s detection delay by a factor of $(\bm{\alpha},\bm{\beta})\in\mathfrak{A}^3$3. In the RFID case study, whenever the attacker was close enough to observe the communication, PyCRA detected the eavesdropper with 100% accuracy over more than an hour of measurements (Shoukry et al., 2016).

3. Social graphs, sybil structures, and re-identification

In social-network privacy, active attacks commonly mean that the adversary inserts a small set of controlled nodes and leverages graph structure for deanonymization. One line of work formalizes this through $(\bm{\alpha},\bm{\beta})\in\mathfrak{A}^3$4-anonymity and $(\bm{\alpha},\bm{\beta})\in\mathfrak{A}^3$5-metric antidimension. For a connected graph $(\bm{\alpha},\bm{\beta})\in\mathfrak{A}^3$6, the metric representation of a vertex $(\bm{\alpha},\bm{\beta})\in\mathfrak{A}^3$7 with respect to an ordered set $(\bm{\alpha},\bm{\beta})\in\mathfrak{A}^3$8 is

$(\bm{\alpha},\bm{\beta})\in\mathfrak{A}^3$9

The worst privacy regime occurs when $\hat{\mathbf{g}}_{\mathrm{LU}}$0, since then every antiresolving set is only $\hat{\mathbf{g}}_{\mathrm{LU}}$1-antiresolving and even one attacker-controlled node can uniquely identify some user. The paper’s computational message is that this extreme case is rare: among connected graphs of order $\hat{\mathbf{g}}_{\mathrm{LU}}$2, only 52,842 were $\hat{\mathbf{g}}_{\mathrm{LU}}$3-metric antidimensional out of over one billion distinct graphs, a proportion of 0.000052; among 180 million Barabási–Albert graphs with $\hat{\mathbf{g}}_{\mathrm{LU}}$4, only 83 such graphs were found; and none of the tested real-world networks was $\hat{\mathbf{g}}_{\mathrm{LU}}$5-metric antidimensional (Cicerone et al., 17 Apr 2025).

A second line of work argues that active attacks are not negligible merely because naïve attack designs fail under small perturbations. In the sybil-based model, the attacker creates a sybil-extended graph, engineers victim fingerprints $\hat{\mathbf{g}}_{\mathrm{LU}}$6, and then solves robust versions of sybil retrieval and fingerprint matching after perturbation. The key robustness criterion is the minimum separation

$\hat{\mathbf{g}}_{\mathrm{LU}}$7

with fingerprint distance defined by symmetric difference. If every perturbed fingerprint stays within less than half this minimum separation, the correct fingerprint remains uniquely identifiable. The empirical conclusion is that robust active attacks remain “considerably more resilient” than the original walk-based attacks; the paper explicitly notes cases where even 1\% random perturbation completely breaks the original attack while the robust version still achieves around 0.6 success probability (Mauw et al., 2018).

Periodic publication makes the attack surface larger. The dynamic-graph attack introduces tempo-structural patterns, combining sybil topology with first-appearance and first-targeted times across releases. Temporal consistency constraints prune candidates that are structurally plausible but temporally impossible, and later releases are used to refine earlier guesses. Relative to the strongest static active attack considered, the new attack increases re-identification success probability by more than two times and efficiency by almost 10 times, while remaining at the same level of effectiveness and efficiency as the publication process advances (Chen et al., 2019).

Defensive work in the same setting reframes the attack as a two-stage probabilistic game: the defender must jointly prevent retrieval of sybil nodes and their use in victim re-identification. Under the random worlds assumption, $\hat{\mathbf{g}}_{\mathrm{LU}}$8-symmetry is sufficient for protection against active re-identification with an arbitrary number of sybil nodes:

$\hat{\mathbf{g}}_{\mathrm{LU}}$9

and then

$\mathbf{g}_{\mathrm{ED}}$0

The paper also proves that K-Match, originally introduced for $\mathbf{g}_{\mathrm{ED}}$1-automorphism, guarantees $\mathbf{g}_{\mathrm{ED}}$2-symmetry and therefore the same active-attack bound (Mauw et al., 2020).

4. Machine learning and federated learning

In federated learning, active attacks exploit the optimization process itself. The white-box membership-inference paper models an adversary that does not merely inspect updates but shapes training dynamics so that target records produce more revealing gradients. The active attack performs gradient ascent on a target record,

$\mathbf{g}_{\mathrm{ED}}$3

with the goal of creating an abrupt reduction in gradient norm for member records when honest participants “fight back” during subsequent SGD steps. The reported federated-learning results show that, for DenseNet on CIFAR100, the passive global attacker reaches 79.2\% accuracy, the active global attacker reaches 82.1\%, and isolating a participant during parameter updates raises it to 87.3\%; the local attacker reaches 72.2\% passively and 76.7\% actively (Nasr et al., 2018).

A stronger class of active attacks is active reconstruction by a dishonest server. The server inserts or optimizes a malicious layer so that client gradients become directly invertible. For one sample $\mathbf{g}_{\mathrm{ED}}$4, the paper states the core gradient-inversion identity

$\mathbf{g}_{\mathrm{ED}}$5

provided $\mathbf{g}_{\mathrm{ED}}$6. OASIS counters this by augmenting each image with transformed copies so that malicious neurons are activated by multiple related inputs; the server then reconstructs only a linear combination rather than the original image. Against CAH, the combination of major rotation + shearing reduces PSNR from above 125 dB to below 25 dB, while reported test accuracy remains 90.9\% / 74.6\% on ImageNet / CIFAR100 for that combined defense (Jeter et al., 2023).

Recent work then asks whether “stealthier” active GIAs are actually undetectable. The detectability study analyzes four attacks—ScaleMIAAS, MKOR, SEER, and Geminio—and proposes lightweight client-side detectors based on neuron diversity, weight entropy, rank ratio, bias regularity, anomalous loss spikes, and gradient-norm collapse. Across the tested configurations, the reported true-positive rate is TPR = 1.0 in essentially all tested settings, with low false-positive rates under conservative thresholds, and without any modification to the FL training protocol (Carletti et al., 13 Nov 2025).

5. Adaptive environments, protocol attacks, coding, and hardware modeling

Active attacks can also be environmental rather than merely perturbative. In LLM red-teaming, the attacker LLM $\mathbf{g}_{\mathrm{ED}}$7 generates a prompt $\mathbf{g}_{\mathrm{ED}}$8, the victim $\mathbf{g}_{\mathrm{ED}}$9 produces $\mathbf{U}$0, and a toxicity classifier $\mathbf{U}$1 supplies reward

$\mathbf{U}$2

The paper argues that red-teaming should not treat the victim as a fixed environment. Its “Active Attacks” algorithm periodically safety-fine-tunes the victim on successful prompts and reinitializes the attacker, thereby removing reward peaks that have already been exploited and inducing an easy-to-hard curriculum. In the reported experiments, GFlowNet + Active Attacks reaches an average defense rate of 99.71\%, and in the cross-attack comparison it attacks a GFlowNet-finetuned victim with 31.28\% success, whereas vanilla GFlowNet attacks an Active-Attacks-finetuned victim with only 0.07\% success, for a relative gain of more than 400× and an overhead of 5.76\% (Yun et al., 26 Sep 2025).

For Arbiter PUFs, active attack means adaptive challenge selection rather than random collection of challenge-response pairs. The PUF is modeled as a linear threshold function,

$\mathbf{U}$3

and the active learner constructs challenges satisfying

$\mathbf{U}$4

Near-boundary queries with $\mathbf{U}$5 accelerate learning; more distant queries can be chosen to make learning slow for an overhearing adversary. For $\mathbf{U}$6 and no noise, active learning at $\mathbf{U}$7 reaches about 97\% accuracy with 350 CRPs, compared with 8.8\% prediction error for random sampling and 3.0\% for active sampling; under 3.5\% noise, the proposed method reaches 5\% error with 300 CRPs, whereas a previous active method needed 811 CRPs (Dumoulin et al., 2023).

Protocol privacy admits a particularly clean active-attack abstraction. A tracking strategy identifies a distinguished node $\mathbf{U}$8 and a set of downstream nodes through which every relevant variable can be forwarded without destructive interference. Theorem 3.2 states that if a tracking strategy exists, the protocol is insecure, and Theorem 4.3 shows that for a broad class of flat protocols, insecurity holds iff a tracking strategy exists. The operational intuition is that the attacker can plant a cookie, propagate it through replies, and reconstruct a complete local session even when the cryptographic secrecy of individual values is not broken (Schnoor et al., 2013).

Secure network coding yields a different contrast between linear and nonlinear systems. For linear codes, the paper proves that active and adaptive attacks do not improve Eve’s performance beyond deterministic wiretapping:

$\mathbf{U}$9

It then gives a nonlinear relay-network example in which adaptivity does help: deterministic attacks leak only $\|\mathbf{y}_d\|^2 \gtrless \gamma$0 bit, but an adaptive choice of the second edge after observing the first symbol recovers the message exactly (Cai et al., 2017).

6. Defensive principles, active defense, and recurrent misconceptions

Several misconceptions recur across the literature. One is that a passive threat model captures the essential difficulty. Massive MIMO is presented as highly favorable against passive eavesdropping, yet vulnerable to pilot contamination during training (Kapetanovic et al., 2015). Another is that small perturbations or graph noise suffice to make active social-graph attacks irrelevant; the robust-attack work argues instead that earlier negative results reveal brittleness of specific attack designs, not inherent weakness of active attacks as a general strategy (Mauw et al., 2018). A third is that good task performance implies privacy: the federated-learning membership-inference work explicitly shows that even well-generalized models remain significantly susceptible to white-box attacks (Nasr et al., 2018). Conversely, the social-network antidimension study argues against the opposite myth, namely that social graphs are uniformly and hopelessly insecure under active attacks, by showing that the extreme $\|\mathbf{y}_d\|^2 \gtrless \gamma$1 case is mathematically special and empirically uncommon (Cicerone et al., 17 Apr 2025).

The surveyed defenses suggest several recurrent design patterns. One is to convert passive monitoring into active probing or challenge-response: ACTIDS injects short periodic probes, learns only normal QoS behavior, applies EWMA smoothing with threshold $\|\mathbf{y}_d\|^2 \gtrless \gamma$2, and reports an average detection time of about 46.8 seconds while maintaining very low or zero false positives in the key comparisons (Menahem et al., 2013); PyCRA similarly issues private physical challenges in the analog domain (Shoukry et al., 2016). A second pattern is structural indistinguishability, as in $\|\mathbf{y}_d\|^2 \gtrless \gamma$3-symmetry, K-Match, and graph-product constructions that raise active-attack anonymity (Mauw et al., 2020, Cicerone et al., 17 Apr 2025). A third is local anomaly detection on manipulated artifacts, including pathloss fingerprinting in wireless RAFT networks and client-side weight/loss/gradient checks in federated learning (Buttar et al., 2022, Carletti et al., 13 Nov 2025). A fourth is adaptive hardening, whether by periodically safety-fine-tuning an LLM victim so old attack modes stop paying off (Yun et al., 26 Sep 2025) or by modeling benign-worm deployment as threshold-based active cyber defense rather than uniformly maximal escalation (Lu et al., 2016).

Taken together, these works suggest that active attacks are best understood not as a single technique but as a broad adversarial paradigm centered on intervention, adaptivity, and control over system trajectories. Their practical importance follows from the same property: they target training phases, routing decisions, physical coupling, graph publication pipelines, consensus messages, and protocol replies—precisely the parts of a system where passive observation becomes operational influence.