Intelligent Anti-Jamming Agents

• Intelligent anti-jamming agents are autonomous defense systems that use closed-loop sensing, decision-making, and action to counter adversarial interference in wireless communications.
• They employ diverse techniques such as deep reinforcement learning, bandit algorithms, and game-theoretic models to optimize parameters like frequency, power, and waveform control.
• These agents enhance network robustness by leveraging adaptive strategies including interference cancellation, energy harvesting, and environment shaping to improve throughput and efficiency.

Intelligent anti-jamming agents are autonomous wireless-defense mechanisms that operate in a closed loop of sensing, decision-making, and action execution under adversarial interference. In UAV communications, the concept is explicitly formalized as a Markov Decision Process (MDP) $\mathcal{M}=(\mathcal{S},\mathcal{A},P,R,\gamma)$ within a closed-loop framework centered on the “Perception-Decision-Action” (P-D-A) paradigm, where the state may encode channel state, interference power, platform position and velocity, and residual energy, while the action space may include frequency selection, transmit power, beam direction, and mobility control (Yang et al., 11 Aug 2025). Recent work extends the same agentic idea well beyond conventional frequency hopping or power control: intelligent anti-jamming agents also appear as bandit learners, deep reinforcement learning (DRL) controllers, interference-cancellation receivers, ambient-backscatter systems that exploit hostile signals, and reconfigurable-surface or precoding engines that reshape the propagation environment itself (Amuru et al., 2014, Nguyen et al., 2022, Nguyen et al., 9 Dec 2025, Wang et al., 4 Feb 2025, Luo et al., 12 Sep 2025).

1. Formalization and conceptual scope

The most general formalization models the anti-jamming problem as sequential decision-making under uncertainty. In the UAV survey literature, the agent’s objective is to find a policy $\pi:\mathcal{S}\to\mathcal{A}$ maximizing expected return, with a representative reward of the form

$$R(s,a)=\alpha\,T(s,a)-\beta\,C_E(a)-\eta\,C_{\text{err}}(s,a),$$

thereby trading throughput, energy expenditure, and packet error penalty (Yang et al., 11 Aug 2025). This formulation is broad enough to subsume PHY-layer control, network-layer coordination, and motion planning.

A more specific example appears in energy-constrained ambient backscatter communication under intelligent UAV jamming, where the transmitter state is

$s_t=(j_t,d_t,e_t),$

with binary jam/no-jam observation $j_t\in\{0,1\}$, buffer occupancy $d_t$, and stored energy $e_t$, while the action set includes $\mathrm{Idle}$, $\mathrm{AT}$, $\mathrm{EH}$, $\pi:\mathcal{S}\to\mathcal{A}$0, and rate-adapted active transmission modes (Nguyen et al., 9 Dec 2025). In that formulation, the immediate reward is the number of successfully delivered packets, and the objective is long-term average throughput. Similar MDP abstractions recur in IoT channel selection, reactive-jammer evasion, IRS control, and swarm communications (Ali et al., 2023, Li et al., 4 Feb 2025, Abolhassani et al., 18 Dec 2025).

The notion of an “agent” is not restricted to model-free RL. Some systems are agentic because they sense the adversary, infer latent attack structure, and react adaptively through online optimization. The anti-jamming precoder against disco intelligent reflecting surfaces (DIRS), for example, learns jamming statistics from lightweight user feedback and then computes the principal generalized eigenvector maximizing signal-to-jamming-plus-noise ratio (SJNR) (Huang et al., 2023). Likewise, robust ARIS and active-RIS formulations explicitly anticipate the jammer’s best response through worst-case or Stackelberg reasoning rather than through trial-and-error RL alone (Luo et al., 12 Sep 2025, Tang et al., 19 Dec 2025). This suggests that “intelligent anti-jamming agent” is best understood functionally—as an adaptive closed-loop defender—rather than algorithmically as a synonym for deep RL.

2. Perception, observability, and state construction

Perception is the stage at which raw electromagnetic observations are converted into a decision state. Across the literature, the observation model varies from extremely compressed binary indicators to high-dimensional multimodal tensors. In the UAV-disrupted backscatter setting, the transmitter observes only whether the channel is jammed or not, not the exact jamming power $\pi:\mathcal{S}\to\mathcal{A}$1; packet arrivals are independent of jamming, and the jammer’s dynamics are unknown and learned implicitly (Nguyen et al., 9 Dec 2025). In proactive-jammer mitigation for resource-constrained IoT, the state is the received-power scan

$\pi:\mathcal{S}\to\mathcal{A}$2

obtained from realistic WLAN network interface cards over $\pi:\mathcal{S}\to\mathcal{A}$3 channels (Ali et al., 2023). In moving reactive-jammer settings, the observation becomes a “spectrum waterfall” image over time and frequency bins, capturing noise, jammer energy, and the spread signal (Li et al., 4 Feb 2025).

Other agents rely on protocol-level or receiver-level side information rather than explicit channel models. In "Jamming Bandits," feedback is the overheard ACK/NACK stream, from which the jammer estimates the victim’s packet-error-rate or symbol-error-rate and converts it into a power-efficiency reward (Amuru et al., 2014). The 802.11 ARES system uses measured SINR, packet delivery ratio, jammer activity indicators, transition timing, and current PHY parameters to drive measurement-based adaptation (0906.3038). These designs show that actionable anti-jamming states do not require full CSI.

At the high-dimensional end, perception may fuse multiple sensing modalities. The radar-oriented unified framework first extracts time-frequency features with Short-Time Fourier Transform (STFT) and Smoothed Pseudo Wigner-Ville Distribution (SPWVD), then combines them with time-domain features through an attention-based cross-modal fusion module before passing the fused representation and passive-radar parameters into a DQN-based strategy network (Wang et al., 9 Jun 2025). The distributed RIMSA sensing system uses received RF outputs across multiple programmable metasurface receivers, a combined loss containing cross-entropy and $\pi:\mathcal{S}\to\mathcal{A}$4, and a neural network mapping recovered signal vectors to object-location estimates (Wang et al., 7 Aug 2025). By contrast, the DIRS anti-jamming precoder estimates only scalar received powers from legitimate users at designated feedback instants and infers the covariance of active channel aging from those measurements (Huang et al., 2023).

A persistent technical issue is partial observability. The UAV backscatter paper identifies partial observability as a challenge and explicitly proposes recurrent DQN (DRQN) as a future extension (Nguyen et al., 9 Dec 2025). This is consistent with the broader survey view that adaptive jammers induce non-stationarity and incomplete state information in practical deployments (Yang et al., 11 Aug 2025).

3. Decision architectures and learning rules

Early intelligent anti-jamming formulations emphasized online learning with provable efficiency. "Jamming Bandits" models jamming as a mixed multi-armed bandit over modulation scheme, transmit power, and on-off ratio, proves sub-linear regret for static and stochastic victims, and extends the method with sliding-window updates for adaptive victims (Amuru et al., 2014). In static-user settings with Hölder-continuous rewards, the regret scales as

$\pi:\mathcal{S}\to\mathcal{A}$5

which formalizes rapid adaptation without requiring a jammer-side model of the victim.

Tabular Q-learning and its deep variants dominate later work. In the energy-harvesting backscatter agent, a Deep Q-Network (DQN) with two hidden fully connected layers of 128 ReLU units, experience replay, and a target network learns the switching policy among active transmission, energy harvesting, and backscatter modes; under the reported setup, DQN stabilizes after approximately 200 episodes, whereas tabular Q-learning needs more than 1000 episodes and plateaus at a lower reward (Nguyen et al., 9 Dec 2025). For proactive jammers in IoT, five DQN variants—baseline DQN, fixed-target DQN, Double DQN, dueling DQN, and DDQN with prioritized replay—share two 128-unit hidden layers and differ in stability, overestimation bias, and computational cost (Ali et al., 2023). For IRS-assisted anti-jamming, WoLF-PHC and fuzzy WoLF-PHC are used to jointly optimize power allocation and reflecting beamforming without prior knowledge of jammer behavior (Yang et al., 2020, Yang et al., 2020).

Action-space factorization is a recurring response to combinatorial growth. In hiding-aware anti-jamming against a moving reactive jammer, the joint action $\pi:\mathcal{S}\to\mathcal{A}$6 over frequency channel and spreading factor is decomposed into two parallel sub-actions, each produced by its own Q-network head, and a parallel exploration-exploitation mechanism replaces $\pi:\mathcal{S}\to\mathcal{A}$7-greedy exploration (Li et al., 4 Feb 2025). In distributed anti-jamming sensing with RIMSA, the discrete phase-selection problem is cast as an MDP and trained with a simple REINFORCE/policy-gradient update rather than Q-learning (Wang et al., 7 Aug 2025). In swarm communications, QMIX learns a centralized but factorizable action-value function $\pi:\mathcal{S}\to\mathcal{A}$8 from local agent networks and a mixing network, enabling coordinated decentralized execution under reactive jamming (Abolhassani et al., 18 Dec 2025).

A common empirical pattern is that deep function approximation improves sample efficiency and stability when state-action spaces become large. The ambient-backscatter study "Jam Me If You Can" attributes slow convergence of tabular Q-learning to large state and action spaces and replaces it with a deep dueling architecture that decomposes $\pi:\mathcal{S}\to\mathcal{A}$9 into value and advantage streams (Huynh et al., 2019). The paper reports convergence roughly ten times faster than deep Q-learning and orders-of-magnitude faster than classical Q-learning under its simulation setting. This supports a general distinction in the literature between low-dimensional online adaptation, where tabular or bandit methods remain viable, and high-dimensional anti-jamming control, where architectural inductive bias becomes decisive.

4. Radio-parameter and waveform control

The most traditional anti-jamming agents act directly on radio parameters such as channel, rate, power, carrier-sensing threshold, or waveform. ARES, a measurement-driven 802.11 anti-jamming system, adjusts rate adaptation, power control, and carrier sensing threshold; across three testbeds it improves throughput by up to 150%, while maintaining benign-condition operation (0906.3038). In proactive-jammer mitigation for IoT, the action is channel selection among $$R(s,a)=\alpha\,T(s,a)-\beta\,C_E(a)-\eta\,C_{\text{err}}(s,a),$$0 frequencies, with a reward that combines successful delivery and a switching-cost penalty, and the simulations show that all variants except vanilla DQN fully evade the jammer for all $$R(s,a)=\alpha\,T(s,a)-\beta\,C_E(a)-\eta\,C_{\text{err}}(s,a),$$1 in the reported dynamic-pattern setting (Ali et al., 2023).

Reactive jammers require more structured control because hiding and evasion interact. The parallel DRL approach jointly selects frequency and spreading factor in a moving reactive-jammer scenario, using separate rewards for frequency and spreading decisions; simulations report a nearly 90% increase in normalized throughput and show the parallel DRL reaching above $$R(s,a)=\alpha\,T(s,a)-\beta\,C_E(a)-\eta\,C_{\text{err}}(s,a),$$2 normalized throughput by about 1000 iterations, whereas standard DQN variants remain below $$R(s,a)=\alpha\,T(s,a)-\beta\,C_E(a)-\eta\,C_{\text{err}}(s,a),$$3 even after 2000 iterations (Li et al., 4 Feb 2025). This is a concrete instance of decomposed control outperforming monolithic action selection.

In radar, intelligent anti-jamming agents may choose suppression waveforms rather than communication channels. The cross-modal fusion framework classifies three jamming types and then feeds the fused representation plus passive-radar parameters into a DQN that selects among discrete anti-jamming waveforms, including noise-cover pulses and LFM frequency-hop actions (Wang et al., 9 Jun 2025). Under the reported dataset and recognition setup, the proposed method achieves 95.45% overall accuracy and converges more smoothly than SARSA in anti-jamming decision-making. The same framework reports monopulse angle estimation error below $$R(s,a)=\alpha\,T(s,a)-\beta\,C_E(a)-\eta\,C_{\text{err}}(s,a),$$4 after suppression (Wang et al., 9 Jun 2025).

These systems preserve the classical anti-jamming objective of maintaining link or sensing performance, but they move the design center from fixed heuristics to policy optimization. A plausible implication is that radio-parameter adaptation remains the baseline embodiment of intelligent anti-jamming, yet its modern form is increasingly data-driven and task-coupled.

5. Signal-exploiting, cancellation-based, and environment-shaping agents

A distinct class of intelligent anti-jamming agents does not merely avoid interference but actively exploits or cancels it. In UAV-disrupted ambient backscatter communications, the transmitter learns when to switch among active transmission, energy harvesting from the jammer’s RF emissions, and ambient backscatter using the jammer’s own signal (Nguyen et al., 9 Dec 2025). Under the reported simulations, the DQN-based policy improves average throughput, packet loss rate, and packet delivery ratio over a greedy anti-jamming strategy, and throughput can increase as average jammer power rises because the agent learns to harvest more energy when jamming is strong (Nguyen et al., 9 Dec 2025). The earlier deep-dueling backscatter design makes the same conceptual move: rather than escaping or hiding from the jammer, the transmitter may backscatter on the jamming waveform, yielding up to 426% higher average throughput than tabular Q-learning and reducing packet loss by 24% in the reported study (Huynh et al., 2019).

Receiver-centric cancellation is another embodiment. The Convolutional Interference Cancellation Network (CICNet) infers the existence of interference, the number of interfering emissions, and their phases from two-antenna I/Q tensors and feeds this information into a cancellation algorithm (Nguyen et al., 2022). On a two-antenna prototype system, the reported jammer detection accuracy is 99.9%, and the receiver can achieve a BER as low as $$R(s,a)=\alpha\,T(s,a)-\beta\,C_E(a)-\eta\,C_{\text{err}}(s,a),$$5 even when jammer power is 18 dB higher than the legitimate signal, without modifications to link modulation (Nguyen et al., 2022). This class of agent is notable because it does not rely on explicit probes, sounding, training sequences, channel estimation, or transmitter cooperation.

Reconfigurable environments further broaden the agent concept. The DIRS anti-jamming precoder derives the statistical characteristics of active channel aging and computes the principal generalized eigenvector of $$R(s,a)=\alpha\,T(s,a)-\beta\,C_E(a)-\eta\,C_{\text{err}}(s,a),$$6 to maximize SJNR, while requiring only power feedback from users detecting jamming (Huang et al., 2023). Intelligent omni-surfaces (IOS) jointly optimize reflective and refractive phase shifts and BS beamforming so that desired signals are enhanced while jamming is nullified, with robust constraints under imperfect jammer-related CSI (Wang et al., 4 Feb 2025). Large-scale ARIS introduces a continuous mean-field density $$R(s,a)=\alpha\,T(s,a)-\beta\,C_E(a)-\eta\,C_{\text{err}}(s,a),$$7 over UAV-mounted RIS platforms and shows that the optimal deployment follows a spatial water-filling principle, concentrating density in high-gain regions and avoiding interference-prone areas (Luo et al., 12 Sep 2025). Active RIS formulations model the legitimate system as the leader in a Stackelberg game, embedding the jammer’s best response into a bi-level optimization over transmit power, beamforming, and active reflection (Tang et al., 19 Dec 2025).

These works show that anti-jamming intelligence can be embodied not only in a policy network but also in the propagation medium, the receiver front end, or the surface infrastructure. This challenges the common reduction of anti-jamming to hopping or spreading alone.

6. Coordination, adversarial interaction, and multi-agent structure

Many anti-jamming problems are inherently interactive, and the literature therefore adopts game-theoretic or multi-agent formulations. The UAV survey distinguishes two-player zero-sum games, Stackelberg games, and Markov games, and explicitly links them to RL solution methods such as Q-learning, hierarchical RL, CTDE, MADDPG, QMIX, and mean-field RL (Yang et al., 11 Aug 2025). These models are used when jammer and defender adapt to each other, or when multiple legitimate nodes must coordinate under shared spectrum and interference constraints.

The most direct multi-agent example is coordinated anti-jamming resilience in swarm networks, where each transmitter-receiver pair selects a frequency channel and discrete power level while a reactive jammer updates its sensing channel and detection threshold according to Markovian dynamics (Abolhassani et al., 18 Dec 2025). QMIX learns a centralized but factorizable team value function, enabling decentralized execution from local observations. In the reported experiments, QMIX nearly matches a genie-aided oracle in the no-reuse benchmark and outperforms local UCB and a stateless reactive policy in the fading regime with channel reuse (Abolhassani et al., 18 Dec 2025). The reward includes throughput, a distance-aware penalty discouraging harmful co-channel reuse, and a jamming penalty.

Adversarial anticipation also appears in single-agent robust design. The large-scale ARIS framework defines a worst-case max-min sum-rate problem against a jammer that optimizes location and beamforming, and identifies the jammer’s “proximity-directivity trade-off” through the maximization of $$R(s,a)=\alpha\,T(s,a)-\beta\,C_E(a)-\eta\,C_{\text{err}}(s,a),$$8 (Luo et al., 12 Sep 2025). The active-RIS Stackelberg formulation goes further by proving existence of Stackelberg equilibrium and solving the resulting bi-level problem with backward induction and block coordinate descent (Tang et al., 19 Dec 2025). From a defender’s perspective, these models matter because they convert anti-jamming from reactive adaptation into strategic planning against a rational adversary.

An important conceptual symmetry is that intelligent jammers and intelligent anti-jammers often use the same mathematical machinery. "Jamming Bandits" was written from the jammer’s side, yet its bandit formalism, regret analysis, and sliding-window tracking are directly relevant to defensive agent design (Amuru et al., 2014). This suggests that anti-jamming intelligence and jamming intelligence are dual control problems over a shared adversarial environment.

7. Empirical behavior, misconceptions, and open problems

The empirical literature evaluates intelligent anti-jamming agents with task-specific metrics rather than a single universal benchmark. Communication-oriented papers report throughput, packet delivery ratio, packet loss rate, BER, or normalized throughput (Nguyen et al., 9 Dec 2025, Huynh et al., 2019, Ali et al., 2023, Li et al., 4 Feb 2025). Surface-assisted and precoding works emphasize sum-rate, SJNR, protection level, or worst-case robustness (Huang et al., 2023, Wang et al., 4 Feb 2025, Luo et al., 12 Sep 2025, Tang et al., 19 Dec 2025). Sensing-oriented systems use cross-entropy, sensing accuracy, SINR, and spatial localization quality (Wang et al., 7 Aug 2025, Wang et al., 9 Jun 2025). The result is a broad but fragmented evidence base.

Several recurrent misconceptions are contradicted by the reported results. First, intelligent anti-jamming agents are not limited to “escaping” the jammer. Ambient backscatter and energy-harvesting designs explicitly exploit hostile RF emissions, and stronger jamming can become more useful rather than more harmful when the agent can harvest or backscatter on the jammer’s signal (Nguyen et al., 9 Dec 2025, Huynh et al., 2019). Second, full jammer CSI is not always required. Binary jam/no-jam sensing, ACK/NACK feedback, received-power scans, or scalar user power feedback are sufficient in several successful designs (Amuru et al., 2014, Ali et al., 2023, Huang et al., 2023). Third, intelligence does not always mean end-to-end deep learning; generalized-eigenvector precoding, semidefinite relaxation, variational density optimization, and Stackelberg backward induction all appear as anti-jamming decision engines (Huang et al., 2023, Wang et al., 4 Feb 2025, Luo et al., 12 Sep 2025, Tang et al., 19 Dec 2025).

At the same time, limitations are explicit. Partial observability remains unresolved in simple-state DRL settings, motivating recurrent architectures (Nguyen et al., 9 Dec 2025). Real-time constraints versus RL training time, UAV compute and energy limits, safe exploration, and swarm scalability are identified as central engineering challenges in the UAV survey (Yang et al., 11 Aug 2025). For large metasurfaces, state-action spaces grow rapidly and may require hierarchical or continuous-action DRL (Wang et al., 7 Aug 2025). CICNet notes a structural limitation of two-antenna nulling when the legitimate and jamming phase differences become nearly aligned (Nguyen et al., 2022). Surface-based methods often assume accurate channel estimation or statistical stationarity that may be difficult to maintain in fast-changing environments (Huang et al., 2023, Tang et al., 19 Dec 2025).

A plausible synthesis is that the field is converging on a layered view of anti-jamming agency. Perception may be protocol-level, spectral, spatial, or multimodal; decision-making may be bandit-based, value-based, policy-gradient, game-theoretic, or robust-optimization-based; and action may target radios, receivers, waveforms, trajectories, or the environment itself. Within that layered architecture, the central research problem is no longer simply how to suppress interference, but how to build closed-loop systems that remain adaptive, sample-efficient, and strategically robust as both defenders and jammers become increasingly autonomous (Yang et al., 11 Aug 2025).