 (idle/busy) Instances Labels (success or not) Samples (sensing results at A) Attacker A's classifier Successful transmission Sensing results Input layer Hidden layer Output layer Figure 11.5 System model for attacker's learning. Source: [163] (© [2018] IEEE). 11 Secure Spectrum Sharing with Machine Learning: Methodologies In the meantime, an attacker A also sensed channels and identified busy channels with the intention of jamming legitimate users' transmissions. A pre-trained ML algorithm was implemented at T to classify a channel as idle or busy. This classifier was unknown to the attacker, while A also sensed the channel to capture T's decisions by tracking the acknowledgments. By applying a DL with inference attack, the attacker also built classifier that was functionally equivalent to the one at the transmitter. Therefore, A could reliably predict successful transmissions based on the sensing results and effectively jam these transmissions. By exploiting the sensitivity of DL to training errors, a defense scheme was then developed by T to defend adversarial DL. The transmitter deliberately used a small number of wrong actions to launch a poisoning attack on the attacker when it accesses the spectrum. The goal is to prevent A from building a reliable classifier. To this end, T systematically decided when to take wrong actions to balance the conflicting effects of deceiving A and making correct transmission decisions. This defense scheme successfully fools the attacker into making prediction errors and allows the transmitter to sustain its performance under intelligent jamming attacks. 11.2.3.3 AmBC Empowered Anti-Jamming Methods Users in the AmBC network are vulnerable to interference and jamming since their oper- ations are based on ambient RF signals with a limited power supply. However, every cloud has a silver lining. The jamming attacks can be used as additional sources of energy and information by AmBC empowered systems. To observe the performance of the AmBC system under a jamming attack, the interact