This paper analyzes a new attack strategy targeting challenge–response physical layer authentication (CR-PLA) systems that rely on intelligent reflecting surfaces (IRSs). The authors extend prior KL-divergence–based bounds for conventional PLA to the CR-PLA setting, where Bob randomizes the IRS phase configuration during verification to generate an unpredictable challenge. The attacker, Eve, seeks to forge channel estimates that minimize the statistical divergence from legitimate Alice-IRS-Bob cascade channels. Two attack models are studied: (i) no channel knowledge, where Eve designs a Gaussian attack mimicking Bob’s estimation noise, and (ii) partial channel knowledge, where Eve leverages correlated observations of the legitimate cascade channel to generate an optimal conditional attack based on jointly Gaussian statistics. In both cases, closed-form expressions for the divergence are derived, revealing the optimal probabilistic forging distribution. Simulation results show that when Eve has correlated side information, the divergence between legitimate and forged signals shrinks considerably, degrading authentication performance. Higher randomness in Bob’s IRS configuration (larger μ) increases divergence and improves security, whereas higher SNR at Bob raises system vulnerability. Detection error tradeoff curves confirm that Eve’s optimized attack significantly pushes the system toward the random-guessing regime, especially when correlation between Eve’s and Bob’s channels is strong.
Divergence-Minimizing_Attack_Against_Challenge-Response_Authentication_with_IRSs