Micro-Doppler Attack in RF Sensing

• Micro-Doppler attack is the deliberate manipulation of time-varying Doppler patterns from moving targets using temporal shifts, phase alterations, or mechanical scatterers.
• It leverages subtle perturbations and transmitter waveform designs to drastically reduce classifier accuracy without degrading overall communication performance.
• Engineered micro-Doppler combs from rotating scatterers underscore the need for robust signal representations and physics-aware defenses in RF sensing systems.

Micro-Doppler attack denotes deliberate exploitation, distortion, or synthesis of micro-Doppler signatures: time-varying Doppler patterns produced by targets with multiple moving parts whose velocities evolve over time, often periodically. In current literature, the phrase covers several related but technically distinct operations: attacks on deep micro-Doppler radar classifiers through semantically negligible temporal shifts and white-box adversarial perturbations; transmitter-side OFDM manipulations that alter passive spectrograms used for human activity classification; and physically engineered scatterers that generate controllable micro-Doppler combs. Across these settings, the common objective is to alter inference from time–frequency structure without necessarily altering the underlying activity or degrading the communications function of the illuminating signal (Czerkawski et al., 2024, Loupa et al., 28 Jul 2025, Kozlov et al., 2016).

1. Terminology, scope, and threat models

Micro-Doppler arises from non-rigid motion superimposed on bulk motion. The cited works describe humans through limb swing during gait and sitting/standing transitions, drones through rotor blades, vehicles through wheel rotations, and passive wireless sensing targets through limb kinematics and periodicities observable in spectrograms (Czerkawski et al., 2024, Loupa et al., 28 Jul 2025). In passive wireless radar, unauthorized sensing itself is presented as a privacy threat because a passive receiver can use ambient Wi‑Fi/OFDM transmissions, estimate channel state information from known preambles or pilots, and infer activity without the subject’s knowledge (Argyriou, 2023).

The attack surface is correspondingly heterogeneous. One class of attacks operates entirely on learned input representations: small temporal shifts of a Doppler–time spectrogram, or gradient-based perturbations bounded in $L_\infty$, can induce misclassification in deep CNNs trained on micro-Doppler radar data (Czerkawski et al., 2024). A second class operates at the transmitter waveform level: per-frame OFDM precoding can inject artificial slow-time Doppler and subcarrier-dependent phase so that a passive receiver observes smeared or displaced micro-Doppler bands, with human activity classification accuracy reduced to less than $10\%$ (Loupa et al., 28 Jul 2025). A third class is physically realized by moving scatterers: axially rotating wires or split ring resonators produce a discrete micro-Doppler frequency comb at $\omega_0 + m\Omega$, offering a mechanism for synthetic signature generation (Kozlov et al., 2016).

Setting	Manipulation lever	Reported effect
Deep radar classification	Small temporal shifts; white-box untargeted PGD	Confidence changes; complete failure under PGD with standard training
Passive OFDM HAC	Per-frame diagonal precoder with $f_{\text{sp}}$ and $R_{\text{sp}}$	Overall accuracy reduced to less than $10\%$
Passive wireless radar privacy defense	Low-rate frequency/phase variation in OFDM waveform	Obfuscation or displacement of CSI-derived spectrograms
Synthetic scatterer attack	Axially rotating wire or SRR	Frequency comb with more than ten observed peaks

A common misconception is to equate micro-Doppler attack with jamming. The passive OFDM literature explicitly distinguishes these mechanisms: jamming reduces SNR and is easily detectable, whereas micro-Doppler-directed waveform shaping is feature-targeted, intended to smear or shift spectrogram structure while leaving throughput, BER, or standard compliance largely intact (Loupa et al., 28 Jul 2025, Argyriou, 2023).

2. Signal models and representations

In monostatic radar, the bulk Doppler relation for a target with radial velocity $v$ at angle $\theta$ to the radar line-of-sight and wavelength $\lambda$ is

$f_d = \frac{2 v \cos\theta}{\lambda}.$

For passive or bistatic illumination, the geometry factor changes. One OFDM-based sensing model expresses Doppler as

$10\%$0

so the factor of $10\%$1 need not appear in passive bistatic geometry (Loupa et al., 28 Jul 2025).

Two representations dominate the deep radar classification setting. The Doppler–time spectrogram is the magnitude-squared STFT of the radar return,

$10\%$2

and the cadence–velocity diagram is the temporal Fourier transform of each Doppler bin,

$10\%$3

The practical distinction matters because the CVD discards phase and aggregates temporal periodicity, which the robustness study identifies as a source of natural temporal-shift invariance and reduced sensitivity to localized perturbations (Czerkawski et al., 2024).

In passive OFDM sensing, the received signal is modeled as a superposition of time-varying delayed and Doppler-shifted reflections,

$10\%$4

or, in the paper’s baseband form,

$10\%$5

with $10\%$6. The passive receiver FFTs OFDM symbols, divides by known preamble symbols, aggregates subcarriers, and computes a slow-time spectrogram via STFT over frames (Loupa et al., 28 Jul 2025). An earlier privacy-oriented study formulates the same passive inference pipeline via time-varying CSI $10\%$7 and the spectrogram

$10\%$8

making explicit that the adversarial target may be the CSI dynamics rather than a radar return in the conventional active sense (Argyriou, 2023).

3. Vulnerabilities of deep micro-Doppler radar classifiers

A 2024 robustness study evaluates two deep convolutional architectures on FMCW micro-Doppler human activity classification using $10\%$9 radar signatures from $\omega_0 + m\Omega$0 activities: Walking, Sitting Down, Standing Up, Object Pick Up, Drinking, and Fall (Czerkawski et al., 2024). Preprocessing integrates range bins of a range–time map to produce a temporal signal, computes Doppler–time by STFT with a $\omega_0 + m\Omega$1-point Blackman window and overlap of $\omega_0 + m\Omega$2, and resizes the spectrogram to $\omega_0 + m\Omega$3 using $\omega_0 + m\Omega$4 Doppler bins with temporal downsampling. The CNNs receive two channels, namely the real and imaginary parts of the STFT; in CVD experiments the magnitude $\omega_0 + m\Omega$5 is used. Training uses cross-entropy, Adam with learning rate $\omega_0 + m\Omega$6, up to $\omega_0 + m\Omega$7 epochs, and a stratified $\omega_0 + m\Omega$8 train/validation/test split. Input-space regularization adds Gaussian noise to achieve $\omega_0 + m\Omega$9.

The first attack surface is temporal misalignment. For testing temporal invariance, Doppler–time maps are interpolated to $f_{\text{sp}}$0 spectra so that up to $f_{\text{sp}}$1-frame shifts can be realized while still extracting a $f_{\text{sp}}$2 crop. One shift corresponds to about $f_{\text{sp}}$3 or $f_{\text{sp}}$4 depending on sample length. These shifts preserve motion content but displace it in time, mimicking acquisition misalignment. The second attack surface is white-box, untargeted PGD within an $f_{\text{sp}}$5 ball. The study states the standard formulations

$f_{\text{sp}}$6

for FGSM and

$f_{\text{sp}}$7

for PGD. The implemented PGD attack uses $f_{\text{sp}}$8 steps, is untargeted, has white-box access to model gradients, and clips perturbations to $f_{\text{sp}}$9 per input element.

Under standard training on Doppler–time inputs, clean test accuracy is $R_{\text{sp}}$0 for Model A and $R_{\text{sp}}$1 for Model B, but both collapse to $R_{\text{sp}}$2 under PGD. Under worst-case temporal shifts, accuracy drops to $R_{\text{sp}}$3 and $R_{\text{sp}}$4. Adversarial training raises PGD accuracy to $R_{\text{sp}}$5 for Model A and $R_{\text{sp}}$6 for Model B, with clean accuracies of $R_{\text{sp}}$7 and $R_{\text{sp}}$8. Temporal augmentation alone improves temporal-shift robustness for Model A to $R_{\text{sp}}$9 but leaves PGD robustness at $10\%$0 for Model A and $10\%$1 for Model B; Model B’s clean accuracy also drops to $10\%$2. The combined $10\%$3 regime yields the best overall Doppler–time trade-off, with clean accuracies of $10\%$4 and $10\%$5, PGD accuracies of $10\%$6 and $10\%$7, and temporal-shift accuracies of $10\%$8 and $10\%$9.

The same study identifies dataset and representation biases. Standard-trained Model A exhibits periodic confidence fluctuations under time shifts; for an Object Pick Up sample, shifts such as $v$0, $v$1, $v$2, and $v$3 can change the prediction to Sitting Down. A “Standing Up” sample is misclassified as “Drinking” under a small temporal shift and as “Object Pick Up” under low-magnitude adversarial perturbation. Under circular Doppler shifts from $v$4 to $v$5, both models increase confidence for Walking under positive shifts even when the true class is Object Pick Up; Fall is biased toward motion toward the sensor, Sitting Down toward motion away from the sensor, Standing Up toward motion toward the sensor, and Drinking confidence decreases with increasing offset from null velocity. Quantitatively, mean variance of label activations under Doppler shifts is especially large for Walking, Sitting Down, and Fall, with values such as $v$6, $v$7, and $v$8 for Model B/Model A on the ground-truth subsets.

A central result is the robustness advantage of the cadence–velocity diagram. With standard training on CVD inputs, clean accuracy is $v$9 for Model A and $\theta$0 for Model B; PGD accuracy is $\theta$1 and $\theta$2; temporal-shift accuracy is $\theta$3 and $\theta$4. With adversarial training on CVD, PGD accuracy rises to $\theta$5 and $\theta$6, while temporal-shift performance remains approximately $\theta$7–$\theta$8. Transfer attacks are also weaker: on Doppler–time inputs, cross-model transfer often drops accuracy to $\theta$9–$\lambda$0, whereas on CVD inputs transfer seldom drops accuracy below approximately $\lambda$1, with minimum observed approximately $\lambda$2. The paper interprets this as evidence that Doppler–time models rely more heavily on dataset-specific non-robust features, whereas CVD enforces greater reliance on global periodic structure.

4. Transmitter-side OFDM attacks against passive human activity classification

A 2025 study defines a micro-Doppler attack against AI-based human activity classification from passively collected OFDM signals by altering the transmitted waveform itself (Loupa et al., 28 Jul 2025). The sensing context is a WiFi-like OFDM transmitter, a passive receiver, and a deep CNN that classifies spectrogram images of size $\lambda$3. The CNN has five convolutional layers; each of the first four is followed by batch normalization, ReLU, and max pooling; the last convolution is followed by average pooling, then a fully connected layer and a softmax classification layer. Training uses stochastic gradient descent with mini-batch $\lambda$4, initial learning rate approximately $\lambda$5, and a decay of $\lambda$6 after the ninth epoch. The dataset is simulated $\lambda$7 OFDM in $\lambda$8 bandwidth over $\lambda$9 scenarios in a $f_d = \frac{2 v \cos\theta}{\lambda}.$0 area, with classes including single pedestrian, single bicyclist, pedestrian + pedestrian, pedestrian + bicyclist, and bicyclist + bicyclist.

The attacker controls the transmitter waveform and applies frame-level precoding so that the passive receiver’s preamble-normalized signal retains an artificial slow-time phase ramp and subcarrier-dependent phase. The diagonal precoder is

$f_d = \frac{2 v \cos\theta}{\lambda}.$1

where $f_d = \frac{2 v \cos\theta}{\lambda}.$2 is an attacker-chosen slow-time Doppler and $f_d = \frac{2 v \cos\theta}{\lambda}.$3 an attacker-chosen artificial range parameter. After FFT and preamble division at the passive receiver, the paper gives

$f_d = \frac{2 v \cos\theta}{\lambda}.$4

Summing across subcarriers and applying STFT over frames produces spectrogram peaks or bands at $f_d = \frac{2 v \cos\theta}{\lambda}.$5, so the micro-Doppler structure observed by the passive classifier is deliberately altered.

Two variants are studied. The CONSTANT variant fixes $f_d = \frac{2 v \cos\theta}{\lambda}.$6 over a scenario; the reported effective setting is $f_d = \frac{2 v \cos\theta}{\lambda}.$7 and $f_d = \frac{2 v \cos\theta}{\lambda}.$8. The RANDOM variant samples $f_d = \frac{2 v \cos\theta}{\lambda}.$9 and $10\%$00 per frame. The RANDOM variant spreads spectrogram bands over time and frequency, produces many combinations $10\%$01, breaks temporal coherence of true micro-Doppler features, and is more disruptive to classification than the CONSTANT variant.

The threat model is constrained by communications integrity. The precoding is constant within each OFDM symbol to avoid inter-carrier interference, and the attacker seeks to keep BER and EVM within acceptable bounds. The EVM constraint is stated as

$10\%$02

Because the artificial Doppler is implemented as a slow-time phase ramp across frames rather than a fast-time distortion within a symbol, the attack does not introduce CFO-like fast-time drift, does not create ICI, and minimally affects BER/EVM. The paper therefore positions the mechanism as stealthier than jamming or symbol spoofing.

Empirically, the reported classifier baseline on clean data is high, with most errors confined to closely related classes. Under attack, performance degrades sharply. Under RANDOM, single-object scenarios are almost perfectly attacked, with near-zero correct classifications, and overall accuracy is reduced to less than $10\%$03. CONSTANT also degrades accuracy substantially, though usually less severely than RANDOM. Confusion matrices show widespread mislabeling, especially for multi-object classes under RANDOM. The paper further notes that low range resolution at $10\%$04, approximately $10\%$05, favors a Doppler-centric attack because the receiver collapses subcarriers and emphasizes slow-time spectrogram structure rather than range separation.

5. OFDM micro-Doppler obfuscation as privacy defense

An earlier 2023 study addresses the same passive wireless radar setting from the opposite standpoint: unauthorized CSI-based sensing is treated as the attack, and transmitter-side waveform manipulation is proposed as a defense that obfuscates or spoofs the micro-Doppler signature while preserving legacy $10\%$06 demodulation (Argyriou, 2023). The passive receiver is assumed to exploit the OFDM preamble for synchronization and known pilots or preamble symbols for CSI extraction, estimating per-subcarrier CFR and forming a spectrogram of the CSI time series. The paper emphasizes that this capability constitutes a privacy breach because the subject may be unaware that activity-specific micro-Doppler signatures are being inferred.

Two obfuscation strategies are proposed. Method 1 multiplies the OFDM baseband by a subcarrier-independent low-rate FM complex exponential,

$10\%$07

so the instantaneous frequency becomes $10\%$08. The transmitted signal is therefore phase-modulated in a way that spreads energy in the passive spectrogram. Using Carson’s rule as applied in the paper, the effective spread is approximately

$10\%$09

The reported parameter regime is $10\%$10–$10\%$11 and $10\%$12–$10\%$13, with examples at $10\%$14 and $10\%$15 chosen to smear micro-Doppler over approximately $10\%$16.

Method 2 imposes a subcarrier-dependent time-varying phase,

$10\%$17

which causes the passive receiver to perceive an effective path-length change rate

$10\%$18

and hence a shifted micro-Doppler

$10\%$19

Where Method 1 smears ridges into broader bands, Method 2 displaces the time–frequency structure, making a given walking speed resemble a different speed. The intended receiver remains compatible because the added phase terms are small relative to OFDM tolerances, with normalized CFO per subcarrier much smaller than $10\%$20, and pilot-based phase tracking can absorb the residual rotation.

The experimental setting is an IEEE $10\%$21-like OFDM system with a $10\%$22 channel, $10\%$23 subcarriers, $10\%$24, $10\%$25 data subcarriers, $10\%$26 pilots, and realistic human reflection models at walking speeds of $10\%$27 and $10\%$28. Without obfuscation, the spectrograms exhibit clear speed-dependent peaks and ridges. With Method 1, the spectrograms lose discriminative peaks and show broad energy blankets. With Method 2, the CFR-power spectrograms shift in a way consistent with an apparent speed change. The paper reports no demodulation issues in simulation and relates this to the fact that the injected variations are far below the few hundred kHz tolerance envelope of $10\%$29 receivers.

Taken together with the later OFDM attack study, this literature establishes a dual-use pattern. The same transmitter-side capacity to inject slow-time phase or subcarrier-dependent phase can be framed either as a privacy-preserving defense against unauthorized passive sensing or as an offensive technique against AI-based human activity classification. This suggests that the distinction is operational rather than physical: the waveform mechanism is similar, but the protected or targeted inference pipeline differs.

6. Synthetic micro-Doppler generation by rotating scatterers

A distinct line of work analyzes how accelerating or rotating scatterers generate intrinsic micro-Doppler structure, thereby providing a physics-based route to synthetic micro-Doppler attack construction (Kozlov et al., 2016). For axially rotating subwavelength scatterers, the scattered spectrum contains discrete components at

$10\%$30

which, after coherent homodyne down-conversion, appear as baseband lines at

$10\%$31

The paper studies a thin copper wire and a split ring resonator illuminated by a $10\%$32 carrier, using coordinate transformations between the laboratory and rotating frames, Hallen’s integral equation for the induced current on the wire, and a far-field scattered-field expression that is then evaluated numerically. In the short-wire analytic approximation, the forward-scattered field contains only even harmonics in forward scattering, with amplitudes scaling as $10\%$33 and coefficients

$10\%$34

The full numerical model captures additional details, and the paper notes that odd harmonics are highly sensitive to internal geometry and can vanish under symmetry or simplified range approximations.

The experimental configuration uses an anechoic chamber, a $10\%$35 copper wire, a copper SRR tuned to resonance at $10\%$36 with a varactor diode, horn antennas separated by $10\%$37 in far-field conditions, and rotation in the $10\%$38–$10\%$39 plane at $10\%$40. Homodyne mixing, low-pass filtering, and lock-in amplification reveal the micro-Doppler comb at baseband. More than ten peaks are observed above the noise floor. The SRR yields a comb similar in structure but stronger in amplitude than the wire because resonance increases radar cross section.

The same paper explicitly connects these results to attack and defense scenarios. An adversary could place rotating subwavelength scatterers in the path of an RF sensing system to synthesize combs whose spacing is set by $10\%$41 and whose amplitudes are shaped by geometry, resonance, orientation, and range. Conversely, defenders can exploit comb pattern matching, cross-polarization tests, resonance checks, and phase-stability analysis, since the presence or absence of odd harmonics, amplitude roll-off, and resonant amplification are sensitive to internal structure. This suggests a physically grounded distinction between naturally generated micro-Doppler and mechanically synthesized micro-Doppler, although the paper also shows that the latter can be highly structured and therefore potentially convincing to downstream inference systems.

7. Defenses, limitations, and broader implications

Across the literature, three defense families recur. The first is representation and training design. For deep radar classification, the robustness study recommends CVD inputs, PGD-based adversarial training, temporal augmentation with small shifts up to $10\%$42 frames, input-space regularization by noise injection, explicit evaluation under PGD and under small temporal and Doppler shifts, and possibly ensembles across architectures and representations such as Doppler–time plus CVD (Czerkawski et al., 2024). The second is protocol- and signal-consistency checking in passive OFDM sensing: pilot integrity checks, monitoring pilot phase evolution across frames and subcarriers, anomaly or out-of-distribution detection on spectrogram features, physics-aware filters that reject implausible frame-to-frame random Doppler jumps, and spatial diversity through multi-antenna processing (Loupa et al., 28 Jul 2025). The third is privacy-preserving transmitter-side obfuscation, where low-rate phase or frequency variation is introduced deliberately to defeat passive sensing without harming intended communications (Argyriou, 2023).

Several limitations are explicit. The deep radar robustness study uses a lab-based human activity dataset with fixed radar and collection protocol; cross-subject generalization and domain shift to different sensors or environments are not directly assessed, and physical-world adversarial feasibility is not demonstrated (Czerkawski et al., 2024). The OFDM transmitter-side attack requires control of the transmitter waveform, so it presupposes an attacker-controlled access point or cooperative emitter; its effectiveness is tied to low range resolution at $10\%$43 and to classifiers trained on clean spectrograms (Loupa et al., 28 Jul 2025). The privacy-oriented obfuscation study notes that an advanced unauthorized receiver might partially estimate and remove predictable low-rate phase modulation, which is why pseudo-random scheduling is proposed as a strengthening mechanism (Argyriou, 2023). The rotating-scatterer comb model assumes nonrelativistic motion, subwavelength scatterers, and, for the analytic approximation, forward scattering with symmetry conditions that suppress odd harmonics (Kozlov et al., 2016).

A second misconception concerns semantics. Small temporal shifts in Doppler–time spectrograms can carry minimal semantic change while still producing large changes in network output confidence, and low-power waveform manipulations can preserve communications plausibility while substantially changing passive micro-Doppler inference (Czerkawski et al., 2024, Loupa et al., 28 Jul 2025). The practical consequence is that micro-Doppler attack need not correspond to overt perturbation in the sensed activity or gross degradation of the radio link. Instead, the literature consistently interprets vulnerability as over-reliance on positional cues, Doppler-offset biases, or other non-robust features that are incidental to data collection and preprocessing rather than semantically central to the motion itself.

The broader implication is that micro-Doppler should not be treated as an intrinsically stable biometric or activity signature once AI-based pipelines are inserted between waveform and decision. In active radar, robustness depends strongly on representation choice and invariance-inducing training. In passive OFDM sensing, the emitter becomes part of the attack surface. In physically grounded scenarios, engineered scatterers can synthesize structured combs that resemble legitimate micro-Doppler phenomena. The current literature therefore frames micro-Doppler attack as a family of feature-level manipulations that spans digital perturbation, waveform design, and mechanical signature synthesis, with defenses requiring coordinated attention to RF physics, preprocessing, model training, and deployment-time integrity checks.