FRAIL: Few-Shot Radar Anti-Jamming via Imitation Learning with Feature Retrieval

Abstract

In electronic warfare, jammers are capable of transmitting interference types that have not been previously encountered during radar agent training, thereby rendering radar anti-jamming models ineffective. Due to the short duration of adversarial engagements, it is challenging to acquire sufficient data on unknown jamming conditions to meet the imitation learning requirements of radar anti-jamming models. To address this issue, we propose an imitation learning method for radar anti-jamming based on signal feature retrieval, specifically designed for few-shot jamming data. The proposed method first constructs a signal feature embedding model using sufficient offline reinforcement learning interaction data. Under few-shot unknown jamming scenarios, the proposed method directly encodes the received jamming I/Q observations and retrieves high-value state–action experiences from historical radar–jammer interactions, without explicitly identifying the jamming category. The retrieved experiences are subsequently incorporated into the policy optimization process to generate radar anti-jamming actions, while newly collected interaction data are used for further task-specific adaptation through reward feedback. Experimental results demonstrate that the proposed method can generate effective low-dimensional representations for large-scale offline state–action pairs, achieving a waveform reconstruction similarity of 96.18%. The feature retrieval model constructed on this basis, which is adapted to few-shot unknown jamming scenarios, improves the average detection probability by 57.05% with 150 samples. In addition, the proposed method outperforms conventional approaches in terms of both environmental robustness and resistance to knowledge forgetting.

1. Introduction

Radar systems are widely deployed in applications ranging from automotive sensing and air traffic control to military surveillance and remote sensing. However, their performance can be severely degraded by intentional jamming or unintentional interference from other electromagnetic sources. To address these challenges, a variety of generic anti-jamming techniques have been developed to improve the robustness of radar signal detection and parameter estimation in contested or cluttered environments. Classical methods include spatial filtering approaches such as adaptive beamforming [1,2] to suppress interference in the angular domain, waveform diversity strategies [3] to enhance signal separability, and time–frequency domain processing [4,5] to mitigate narrowband or broadband jamming. In addition, statistical detection algorithms [6] and optimization-based techniques [7] have been proposed to adaptively distinguish target echoes from interference. More recently, data-driven anti-jamming approaches leveraging deep learning [8,9] have emerged, offering enhanced adaptability to complex environments. These general anti-jamming methods provide a solid foundation, yet their performance often depends on abundant and representative training data, which may not be available in real-world scenarios.

In practical radar–jammer confrontations, the jammer often transmits unknown and dynamically varying interference signals, resulting in difficulties in acquiring sufficient labeled data for model training. This scarcity of training samples, especially in novel jamming scenarios, poses significant challenges for conventional data-driven anti-jamming techniques [10]. In many cases, the jammer’s waveform parameters, modulation patterns, and power levels are deliberately customized to evade detection [1], leading to severe data imbalance and poor generalization. Under such few-shot conditions, radar systems relying on supervised deep learning models may fail to maintain robust performance. This limitation motivates the exploration of intelligent learning strategies capable of adapting to rapidly changing electromagnetic environments while learning effectively from only a few unlabeled samples. Such capabilities are particularly crucial in modern electronic warfare, where jamming strategies can evolve faster than datasets can be collected and labeled [11,12].

Reinforcement learning has also been increasingly investigated for adaptive radar anti-jamming decision-making, where radar–jammer interaction is formulated as a sequential decision process and the radar policy is optimized according to environmental feedback. These methods provide an effective framework for adaptive anti-jamming decision-making, but their performance generally relies on sufficient interaction experience. Rapid adaptation to previously unseen jamming conditions with only a limited number of online samples remains insufficiently studied.

Recent years have witnessed rapid progress in few-shot learning techniques across multiple domains. In computer vision, meta-learning frameworks [13,14] have been developed to enable models to quickly adapt to new tasks with only a few labeled samples. In wireless communications, transfer learning [15,16] and data augmentation strategies [17,18] have been employed to enhance interference classification under limited data conditions. The underlying principles of these methods—rapid adaptation, leveraging prior knowledge, and maximizing the utility of scarce data—are highly relevant to radar anti-jamming. This suggests that few-shot learning could be a promising paradigm for improving radar resilience when only limited training samples are available.

In the radar anti-jamming domain, few-shot learning methods have begun to gain traction. Zhou et al. [19] proposed a prototype feature-driven few-shot recognition framework for active radar jamming, integrating multi-level feature fusion and attention mechanisms to achieve high accuracy even under class imbalance and low signal-to-noise conditions. Cao et al. [20] introduced a vision–language model for few-shot and zero-shot radar jamming recognition, transforming radar waveforms into time-frequency spectrograms paired with textual descriptions and demonstrating robust generalization to unknown and composite jamming types. Huang et al. [6] applied self-supervised learning and domain adaptation to radar signal recognition, leveraging masked autoencoder pretraining to improve one-shot classification accuracy by over 17% compared to baseline models. Other studies have explored generative models such as CGAN [21] for data augmentation in jamming recognition, meta-learning for radar emitter classification [22], and transformer-based time-frequency feature modeling for few-shot radar jamming recognition [23]. These advances highlight the feasibility and potential of few-shot learning in radar anti-jamming, yet most of these methods remain focused on signal classification rather than joint sensing and countermeasure optimization.

Although prior studies have demonstrated the effectiveness of few-shot learning for radar signal processing, most existing methods mainly focus on signal or jamming recognition rather than radar anti-jamming decision-making. To the best of our knowledge, retrieval-based utilization of historical interaction experience has not yet been sufficiently investigated for few-shot reinforcement-learning-based radar anti-jamming. In practical radar–jammer confrontation, the interaction is continuous and dynamic, while only a limited number of samples may be available when previously unseen jamming is encountered. Therefore, efficiently reusing historical radar–jammer interaction experience is particularly important for rapid policy adaptation under few-shot conditions.

It should be emphasized that the problem considered in this work is different from conventional jamming recognition. FRAIL does not explicitly assign the received jamming waveform to a predefined category and then select a countermeasure according to a rule table. Instead, the received I/Q waveform is directly treated as the radar observation and used to retrieve high-value state–action experiences from historical radar–jammer interactions. The retrieved radar actions subsequently provide decision-level guidance for adapting the anti-jamming policy. Therefore, the objective of FRAIL is to establish a direct mapping from limited observations of unknown jamming to effective radar anti-jamming actions, rather than to predict the categorical label of the jamming signal.

Motivated by few-shot knowledge-transfer and experience-reuse strategies from other learning domains, this paper proposes a retrieval-enhanced learning paradigm for reinforcement-learning-based radar anti-jamming under few-shot conditions, as illustrated in Figure 1. Instead of explicitly recognizing the jamming category, FRAIL learns a state–action embedding from historical radar–jammer interaction data. When only a small number of observations from an unknown jamming environment are available, these observations are used as task cues to retrieve historical interaction samples with similar interference characteristics and effective radar actions. The retrieved state–action experiences are then incorporated into the policy optimization process together with newly collected online samples. The resulting policy directly generates radar transmission actions, such as carrier-frequency adaptation and decoy-pulse configuration, which are executed in the subsequent radar–jammer interaction. The detection performance obtained after interaction is further used as reward feedback for policy adaptation. In this manner, FRAIL forms an observation–retrieval–decision–interaction closed loop and improves the utilization efficiency of limited online samples.

Figure 1. Illustration of the data organization in FRAIL. The target data (blue) consist of a small number of online interaction samples collected under unknown jamming. Relevant samples (green) are retrieved dynamically from the historical offline dataset (red) according to their embedding similarity to the target data, whereas the remaining offline samples are treated as irrelevant and excluded from subsequent policy adaptation.

The main contributions of this work are as follows:

• Low-dimensional waveform embedding method. We propose a variational auto-encoder architecture to characterize the low-dimensional properties of jamming waveforms. The model is trained to learn an effective waveform embedding space, enabling the subsequent behavior retrieval mechanism to perform similarity comparison and retrieval between known and unknown jamming patterns.
• Similarity-based anti-jamming behavior retrieval mechanism. We design a feature-retrieval mechanism that retrieves state–action experiences rather than jamming-class labels. Given only a few observations from an unknown jamming environment, the proposed method identifies historically similar interference states together with radar actions that achieved high rewards, thereby providing decision-level prior knowledge for anti-jamming policy adaptation.
• Retrieval-guided few-shot anti-jamming policy adaptation. We integrate the retrieved historical behaviors into the radar–jammer interaction loop as auxiliary supervision for policy optimization. The policy directly maps received jamming observations to radar transmission actions, while newly collected interaction samples and reward feedback are used to continuously adapt the policy to the unknown jamming environment.

2. Preliminaries

This section introduces the preliminaries of the proposed method, including the radar–jammer interaction environment, the waveforms equipped by both radar and jammer, and the basic reinforcement learning framework.

2.1. Working Scenario of Radar and Jammer

We consider a radar–jammer interaction scenario in which both sides operate in an adversarial environment. As shown in Figure 2, at each interaction step, the jammer generates a waveform from the predefined jamming set to interfere with the radar, while the radar adapts its transmitted waveform or strategy to mitigate the jamming effect. The anti-jamming performance is evaluated by the target detection probability, which reflects the effectiveness of radar decisions under different waveform interactions. The sequential interaction between radar and jammer can thus be formulated as a decision-making process aiming to maximize detection performance. The jammer configuration can be updated at each interaction step, while the radar adapts its transmitted waveform or strategy to mitigate the resulting jamming effect.

Figure 2. The working scenario of radar and jamming.

Historical interactions, including waveform-action pairs and corresponding performance, are collected as offline data. These data are used to train a low-dimensional embedding model of jamming waveforms, enabling similarity modeling and supporting subsequent retrieval. In practical scenarios, the jammer may employ previously unseen waveforms. In such cases, only a few unlabeled interaction samples are available, making conventional methods ineffective. Therefore, a few-shot transfer learning mechanism is required to achieve rapid adaptation using prior experience and limited observations.

2.2. The Signal Model

A competition environment was constructed between a multifunction radar and a self-protection jammer. The multifunction radar is capable of adaptively configuring the frequency and pulse duration for each transmission. The self-protection jammer operates in the transmit/receive time-sharing interference mode.

2.2.1. Radar Signal

The multifunction radar can transmit LFM waveform and decoy pulse waveform. The operating frequency of the LFM waveform is determined from a predefined discrete frequency set. The transmitted signal at time step t is expressed as

$$s_r^{\mathrm{LFM}}(t)=A_r\mathrm{rect}\left({\displaystyle \frac{t}{T_p}}\right)\exp \left(j2\pi \left(f_{c,t}t+{\displaystyle \frac{\mu }{2}}{t}^2\right)\right),$$

(1)

where A_r denotes the signal amplitude, T_p is the pulse duration, f_c,t is the carrier frequency selected at time step t, and μ = B/T_p is the chirp rate, with B being the signal bandwidth. The notation rect(⋅) denotes the rectangular window function, which confines the signal to the specified pulse-duration interval.

The carrier frequency f_c,t is selected from the discrete frequency set $ℱ$, which is expressed as follows:

$ℱ$ = {f_min + mΔf∣m = 0, 1, …, M − 1},

(2)

where f_min denotes the minimum carrier frequency, Δf denotes the spacing between two neighboring frequency candidates, and M indicates the total number of selectable frequency points.

Beyond the nominal radar waveform, the radar may transmit an additional decoy pulse prior to the genuine probing pulse, thereby misleading the jammer from the temporal perspective. The decoy pulse may adopt an LFM structure to ensure that it can be effectively intercepted and recognized by the jammer.

Assume that the decoy pulse is transmitted at time t₀, while the true probing pulse is transmitted after a delay ΔT. Then, the composite radar transmission can be written as

$$s_r^{\mathrm{decoy}}(t)=s_r^{\mathrm{false}}\left(t-t_0\right)+s_r^{\mathrm{true}}\left(t-t_0-\Delta T\right),$$

(3)

where $s_r^{\mathrm{true}}\left(t\right)$ denotes the actual radar probing waveform and ΔT is the temporal separation between the decoy and true pulses. By properly designing ΔT, the false response generated by the jammer can be shifted away from the true target return in the received signal.

In this work, the output of the radar agent is not a jamming-category estimate but an anti-jamming transmission action. Based on the waveform model described above, the radar action determines the configuration of the waveform transmitted in the next interaction step. Specifically, the available anti-jamming actions include the LFM waveform and decoy pulse waveform. The parameter sets of the two waveforms can be expressed as θ_LFM = {f_c,t,μ,T_p} and θ_DP = {ΔT,t₀}.

2.2.2. Jammer Signal

The flight target was equipped with a self-protection jammer. Depending on the attack mission and phase, the jammer primarily emits four types of jamming signals. The waveform parameters of each type are customizable.

Four types of jamming signals have been used in our previous work [24], namely spot jamming, comb-spectrum jamming, smeared spectrum jamming, and intermittent sampling repeater jamming (ISRJ). For spot jamming, the adjustable parameters include the center frequency f_c and the jamming bandwidth B_j. For comb-spectrum jamming, the adjustable parameters include the frequency interval Δf, the number of spectral lines N_f, and the jamming bandwidth B_c. For smeared spectrum jamming, the adjustable parameters include the number of sub-pulses N_p and the pulse width T. For intermittent sampling repeater jamming, the adjustable parameters include the slice width τ_s and the number of retransmissions K. The parameter sets of the four jamming modes can be expressed as

θ_spot = {f_c,B_j}, θ_comb = {Δf,N_f,B_c},

(4)

θ_smear = {N_p,T}, θ_ISRJ = {τ_s,K}.

(5)

These parameters characterize the time–frequency properties of the jamming waveforms, thereby enabling flexible adjustment of various jamming effects.

2.2.3. Reinforcement Learning in Radar Anti-Jamming

The dynamic confrontation between the radar and the jammer can be modeled as a Markov Decision Process (MDP). At each time step t, the radar agent receives the current state s_t ∈ $𝒮$ and obtains the corresponding game reward r_t. Based on s_t, the radar executes an action a_t ∈ 𝒜, representing specific anti-jamming countermeasures such as frequency agility. The state transition probability $𝒫$(s_t+1∣s_t,a_t,j_t) remains unknown to the radar, as it inherently depends on the adversary’s response j_t.

The radar’s aims to derive an optimal policy π^*(a_t∣s_t) that maximizes the expected discounted return ${\mathbb{E}}_{\pi }\left[{\sum }_{k=0}^{\mathrm{\infty }} {\gamma }^k{r}_{t+k}\right]$. In the simulation experiments, the immediate reward is defined as r_t = P_d(s_t,a_t); P_d denotes the target detection probability. It directly reflects the final target-detection performance of the radar.

In simulation, the target ground truth is available, so P_d can be directly evaluated and used as the reward. In practical deployment, the instantaneous P_d is generally unavailable and may be replaced by observable surrogate feedback, such as post-processing SINR, detection statistics, track confidence, or track continuity. Empirical P_d may also be estimated in instrumented tests using reference target truth. Since the jammer waveform and its parameters may vary across interaction steps, the radar agent operates in a dynamically changing jamming environment. The reinforcement-learning policy is therefore required to adapt its anti-jamming actions according to the received waveform observations and the corresponding reward feedback.

3. Few-Shot Imitation Learning with Feature Retrieval

In this study, the jamming conditions encountered by the radar are categorized into known and unknown conditions according to whether their waveform distributions have been sufficiently represented in the offline interaction dataset. Known jamming refers to interference conditions for which sufficient radar–jammer interaction data are available during offline training. In contrast, unknown jamming refers more generally to interference conditions whose waveform distributions have not been observed during offline training. A feature retrieval-based imitation learning method under few-shot conditions is proposed in this paper. This method retrieves the feature similarity between unknown and known jamming signals based on the feature embedding model trained on the known types. The retrieved experiences provide prior knowledge about radar actions that were effective under similar interference conditions and are subsequently used to guide the generation of anti-jamming actions.

3.1. Data Preparation

In this study, the radar anti-jamming task is formulated as a few-shot imitation learning problem under a mixed data condition consisting of offline labeled data and online unlabeled data. Specifically, for a target jamming type, we assume access to the following two datasets:

D_prior: an offline-collected dataset of fully labeled radar–jammer interaction samples, encompassing almost the entire spectrum of known jamming patterns. Fully labeled indicates that reward feedback is available for the interaction process, rather than that the samples are manually labeled. As a result, the dataset contains a large number of sub-optimal interaction samples corresponding to low-reward trajectories.

D_new: an online-collected dataset for unknown jamming types, typically within 150 samples. Unlike offline annotated datasets, D_new is obtained without prior annotation and can only be constructed through interaction with the environment using the actions generated by the proposed method.

In the following, we refer to D_T as the target data. In our experiments, D_T contains 50, 100, or 150 online interaction samples under the unknown jamming condition. The offline dataset D_O contains 1 × 10⁴ historical radar-jammer interaction samples collected under known jamming conditions.

3.2. Overview

In our proposed method, the few-shot radar anti-jamming method via imitation learning with feature retrieval (FRAIL), we explore going beyond the conventional paradigm of pre-training a policy on the prior dataset D_prior and fine-tuning on the task-specific dataset D_new.

The central idea is that D_new can serve not only as direct training samples but also as task cues for identifying useful experience from D_prior. Moreover, we can learn the metric for measuring this relevance from D_prior. Concretely, FRAIL first constructs a similarity metric over (s,a) using D_prior. Given D_new, this metric is then applied to select relevant (s,a) tuples from D_prior. The final policy π_t is trained via imitation learning on the combined dataset consisting of D_new and the retrieved samples (See Figure 3). The learning of the similarity metric, the retrieval procedure, and the policy optimization process are detailed in Section 3.3, Section 3.4, and Section 3.5, respectively. The overall FRAIL workflow is summarized in Algorithm 1. The source code is released at https://github.com/Patrick-xiefeng/FRAIL, accessed on 15 October 2026.

Algorithm 1 FRAIL
1:	Input:    Prior dataset ${\mathcal{D}}_{\mathit{prior}}={\left[\left(s_1,a_1\right),\dots ,\left(s_T,a_T\right)\right]}_{1:N}$
2:	Input:    Interaction budget B
3:	Initialize ψ,ϕ,θ randomly
4:	Initialize $𝒟$new ← ⌀, $𝒟$ret ← ⌀
5:	/* Train VAE embedding space */
6:	while VAE not converged do
7:	(st,at)∼$𝒟$prior
8:	Update θ,ϕ to maximize Equation (1)
9:	end while
10:	/* Reinforcement learning with retrieval augmentation */
11:	for i = 1 to B do
12:	Observe current state st
13:	Execute action at∼πψ(⋅∣st)
14:	Observe reward rt and next state st+1
15:	$𝒟$new ← $𝒟$new ∪ (st,at,rt,st+1)
16:	$𝒟$ret ← ⌀
17:	/* Retrieve task-relevant data */
18:	for (s,a) ∈ $𝒟$prior do
19:	if Equation (3) is True for (s,a) then with query data from $𝒟$new
20:	$𝒟$ret ← $𝒟$ret ∪ (s,a)
21:	end if
22:	end for
23:	/* Update decision network inside the RL loop */
24:	${\left[\left(s,a\right)\right]}_{\mathit{new}}^{1:B}\sim {\mathcal{D}}_{\mathit{new}}$
25:	${\left[\left(s,a\right)\right]}_{\mathit{ret}}^{1:B}\sim {\mathcal{D}}_{\mathit{ret}}$
26:	Update ψ to maximize logπψ(a∣s) on ${\left[\left(s,a\right)\right]}_{\mathit{new}}^{1:B}$ and ${\left[\left(s,a\right)\right]}_{\mathit{ret}}^{1:B}$
27:	/* Optional RL policy optimization */
28:	Update ψ with the RL objective using samples in $𝒟$new
29:	end for

Figure 3. The FRAIL Method. Our approach has 3 main steps. (A) A state–action embedding model is pre-trained using the labeled offline dataset D_prior. (B) The pre-trained embedding model is employed to retrieve transition samples from D_prior that are highly relevant to the task-specific dataset D_new. (C) The retrieved state–action experiences and newly collected online samples D_ret are jointly used to optimize the anti-jamming policy. The policy generates radar waveform actions for the subsequent interaction, and the resulting detection probability provides reward feedback for further adaptation.

3.3. Similarity Metric Pre-Training

To identify behaviors in D_prior that are useful for D_new, an appropriate similarity measure between two state–action tuples (s,a) is required. This is especially challenging when the state representation consists of I/Q waveforms. Since D_prior may include behaviors collected from tasks that differ substantially from the target one, selecting transitions based only on state-level similarity may introduce unsuitable actions for the target scenario. Therefore, we learn a function $ℱ$: $𝒮$ × 𝒜 × $𝒮$ × 𝒜 → ℝ, which takes a pair of state–action samples as input and outputs a scalar score indicating their functional similarity. The first stage of our framework is to estimate this function $ℱ$ using D_prior.

In general, this objective is achieved by learning a compact representation of state–action pairs from D_prior, where $ℱ$ is defined according to the embedding distance between (s₁,a₁) samples from D_prior and (s₂,a₂) from D_new. Various techniques can be adopted to obtain such (s,a) representations, including contrastive representation learning and autoencoder-based compression. In our experiments, we observe that employing a VAE to encode states and actions offers a straightforward solution and yields the best empirical performance, as shown in Figure 4.

Figure 4. Training the State-Action Embedding. A variational autoencoder is jointly trained on state and action samples to obtain the state–action embedding E_sa.

Specifically, a joint variational autoencoder is constructed to encode both states and actions, and its parameters are optimized by maximizing the evidence lower bound (ELBO),

$${\mathbb{E}}_{q_{\varphi }\left(E_{\mathit{sa}}\mid s,a\right)}\left[\log p_{\theta }\left(s,a\mid E_{\mathit{sa}}\right)\right]-\beta {\mathcal{D}}_{\mathit{KL}}\left[q_{\varphi }\left(E_{\mathit{sa}}\mid s,a\right)\Vert p\left(E_{\mathit{sa}}\right)\right]$$

(6)

on state-action pairs sampled from D_prior, where β is a tuned hyperparameter. The state and action are encoded separately and then combined through a multi-layer perceptron (MLP) to form the state-action embedding. The action is additionally concatenated to this state-action embedding as E = [E_sa,a], which we found to help with behavior separability.

Finally, for two given tuples (s₁,a₁) and (s₂,a₂), their corresponding embeddings E₁ and E₂ are obtained. The similarity function $ℱ$ is then formulated as the negative L2 distance between these two embeddings:

$$\mathcal{F}\left(s_1,a_1,s_2,a_2\right)=-{‖E_1-E_2‖}_2$$

(7)

3.4. Filtering Relevant Data

Given the pre-trained function $ℱ$, a key challenge lies in effectively leveraging D_new, to retrieve relevant data from the prior dataset D_prior. Although a variety of valid strategies exist, ranging from loss re-weighting to importance sampling, we posit that transitions within D_prior characterized by expert actions (high reward actions) in analogous states are beneficial for imitation and should therefore be exploited. Therefore, if a transition in D_prior is relevant to any transition in D_new, we choose to retrieve it and learn from it with imitation learning.

Concretely, let the upper bound on similarity ${\mathcal{F}}^{+}={\max }_{\left(s^{*},a^{*}\right)\in D_{\mathit{prior}}}{\max }_{\left(s,a\right)\in D_{\mathit{new}}}\mathcal{F}\left(s^{*},a^{*},s,a\right)$ and the lower bound ${\mathcal{F}}^{-}={\min }_{\left(s^{*},a^{*}\right)\in D_{\mathit{prior}}}{\max }_{\left(s,a\right)\in D_{\mathit{new}}}\mathcal{F}\left(s^{*},a^{*},s,a\right)$. Then, for any transition (s^*,a^*) ∈ D_prior, we retrieve it if:

$${\displaystyle \frac{{\max }_{\left(s,a\right)\in D_{\mathit{new}}} \mathcal{F}\left(s^{*},a^{*},s,a\right)-{\mathcal{F}}^{-}}{{\mathcal{F}}^{+}-{\mathcal{F}}^{-}}}>\mathsf{\delta }$$

(8)

We apply min-max normalization to $ℱ$ to account for variations in the magnitude of the embeddings. In our experiments, the value of δ is selected within the range of [6, 8]. However, Section 4.6 demonstrates that our method exhibits robustness to variations in this hyperparameter. Since the retrieval process selects the top 1 − δ% of D_prior deemed most relevant, we should calibrate δ as 1 − r, where r represents the proportion of relevant data within D_prior. The filtering procedure is visually depicted in Figure 5.

Figure 5. Retrieving from the Labeled Dataset. Using our pretrained state-action embedder, we compute the embeddings for the offline dataset D_prior and the small number of unknown jamming waveforms D_new. Then, we select transitions in the offline dataset within a certain distance of the target waveforms in embedding space.

3.5. Training with Retrieved Data

Finally, given the retrieved data D_ret, we incorporate it into the reinforcement learning loop as an auxiliary supervision source for policy optimization. Specifically, during each policy update, the decision network is trained to jointly imitate both the retrieved dataset D_ret and the online interaction dataset D_new through an imitation learning loss, thereby improving the policy learning efficiency under limited online interactions. The policy π_ψ is optimized with the objective

$$\underset{\psi }{\min } {\mathbb{E}}_{(s,a)\sim D_{\mathit{new}}}\left[-\log {\pi }_{\psi }(a\mid s)\right]+{\mathbb{E}}_{(s,a)\sim D_{\mathrm{ret}}}\left[-\log {\pi }_{\psi }(a\mid s)\right]$$

(9)

It is important to note that each retrieved sample contains both an interference observation and its corresponding radar action. Therefore, the retrieval process does not provide a jamming-category label; instead, it provides decision-level demonstrations of how the radar previously responded to similar interference states. By jointly learning from the retrieved historical samples and the newly collected target-task samples, the policy is encouraged to reproduce effective historical behaviors while adapting them to the current unknown jamming environment.

After the policy network generates the action a_t, the action is decoded into the radar waveform parameters defined in Section 2.2.1 and applied to the next transmission. The jammer subsequently interacts with the new radar waveform, and the radar obtains the resulting detection probability. The corresponding reward is then used to update the policy using the newly collected interaction sample. The policy network adopts an LSTM architecture, which enables temporal modeling under partial observability. The policy outputs the parameters of a Gaussian mixture model (GMM), from which the final action is sampled. More details about the network architecture and training procedure are provided in Algorithm 1.

4. Experiments

The experiments are designed to comprehensively assess the effectiveness and robustness of the proposed approach. Following the introduction of the experimental setup and parameter configurations in Section 4.1, we first visualize the retrieved samples and analyze their resemblance to the target data, as discussed in Section 4.2. Then we analyze the performance of the proposed method under different sample sizes, with particular emphasis on its capability across varying data regimes (Section 4.3). In addition, the proposed method is compared with several pre-training and fine-tuning baselines to further evaluate its performance advantages, as presented in Section 4.4. Additionally, ablation experiments are carried out to examine the effects of different modules and design settings, as described in Section 4.5. Robustness tests are further performed to assess the stability and generalization capability of the proposed method across various experimental conditions, as reported in Section 4.6.

4.1. Experimental Setup

In this study, the transmitted radar waveforms consist of both linear frequency modulation (LFM) signals and decoy pulse signals. The jammer is allowed to generate four representative jamming waveforms. Both radar and jammer parameters are shown in Section 2.2 and the variable parameters are shown in Table 1.

Table 1. Parameters used in training the proposed method.

Agent	Signal Type	Notion	Value
Radar	LFM	fc,t	3–5 GHz
		μ	2 × 1012
		Tp	10–50 μs
	Decoy pulse (DP)	ΔT	10–100 μs
		t0	10–100 μs
Jammer	Spot jamming (SJ)	fc	3–5 GHz
		Bj	20–50 MHz
	Comb-spectrum jamming (CJ)	Δf	1–5 MHz
		Nf	3–7
		Bc	0.5–1 MHz
	Smeared spectrum jamming (SMSP)	Np	3–6
		T	50–100 μs
	Intermittent sampling repeater jamming (ISRJ)	τs	10–50 μs
		K	1–5

Based on the above radar and jammer waveform configurations, the few-shot adversarial scenarios used to validate the proposed method are summarized in Table 2. In both scenarios, the radar employs the same waveform settings, which are capable of suppressing the considered jamming waveforms. In contrast, the jammer waveform sets differ across the two scenarios. Moreover, the jamming waveforms available during the training stage are different from those used in the testing stage, thereby ensuring that the jamming waveforms encountered at test time are not used in the pre-training phase. Moreover, in the following experiments, the number of interactions during the testing phase is deliberately limited to assess the performance of the proposed method under varying sample-size settings.

Table 2. Few-shot scenes used to validate the methods.

Scene	Procedure	Agent	Signal Type
Scene I	Train	radar	LFM, DP
		jammer	SJ, SMSP
	Test	radar	LFM, DP
		jammer	CJ, ISRJ
Scene II	Train	radar	LFM, DP
		jammer	CJ, ISRJ
	Test	radar	LFM, DP
		jammer	SJ, SMSP

In addition to the cross-type few-shot settings listed in Table 2, we further construct an unseen-parameter setting to evaluate the generalization capability of FRAIL under waveform-parameter distribution shifts. For each jamming type, the waveform-parameter ranges used for offline training and online testing are deliberately separated. Specifically, the testing parameter configurations are excluded from the offline interaction dataset, ensuring that the radar encounters previously unseen waveform configurations during evaluation. The detailed parameter ranges are summarized in Table 3.

Table 3. Parameter ranges for the unseen-parameter generalization experiment.

Jamming Type	Parameter	Offline Training Range	Unseen Testing Range
SJ	fc	3–4.5 GHz	4.5–5 GHz
	Bj	20–40 MHz	40–50 MHz
CJ	Δf	1–3 MHz	3–5 MHz
	Nf	3, 4, 5	6, 7
	Bc	0.5–0.8 MHz	0.8–1 MHz
SMSP	Np	3, 4	5, 6
	T	50–80 μs	80–100 μs
ISRJ	τs	10–35 μs	35–50 μs
	K	1, 2, 3	4, 5

4.2. Performance of Similarity Metric Pre-Training

The FRAIL algorithm pre-trains the similarity metric model using offline sample data. In this section, offline-collected jammer waveform data are used to train the VAE. The jammer waveforms include the four jamming types described above. During the pre-training stage, we extract the time-domain waveforms of the four jamming types before encoding and after reconstruction. Examples of the four jamming waveforms are shown in Figure 6. The statistical analysis shows that the average time-domain reconstruction similarity of the jamming waveforms achieves 96.18%.

Figure 6. Reconstruction of the Original Waveforms. We reconstructed the four jamming waveforms using the VAE embedding model. The similarity between the original waveforms (YELLOW) and the reconstructed waveforms (BLUE) is 96.18% on average.

To verify the effectiveness of the VAE embedding, we use the mean vector μ produced by the encoder as the latent representation of each waveform sample and visualize the latent space distribution using t-SNE. The corresponding results are shown in Figure 7. It shows a projection of the embedding for 200 jamming simulation trajectories. There are distinct clusters of jamming types, and we also discover overlaps of embedding points. These overlaps are interpreted as the result of shared parameter configurations between different jamming types. The visualization demonstrates that the four types of jamming waveforms exhibit feature separability in the low-dimensional space, which verifies the effectiveness of the VAE-based feature embedding structure in the FRAIL method and provides a foundation for the subsequent experiments.

Figure 7. Visualization of the Embedding Space. We use a T-SNE projection and access to the ground-truth task labels (which determine the color and shape of the points).

4.3. Performance of FRAIL Imitation Learning Method

This section focuses on comparing the proposed FRAIL algorithm with representative pre-training and fine-tuning approaches on few-shot datasets. A conventional paradigm for few-shot imitation learning is to first pretrain a model on an available dataset, such that the agent acquires fundamental task knowledge and decision-making capability, and then fine-tune the pretrained model on the target-task dataset. During the fine-tuning stage, the model is expected to incorporate knowledge from the new target task while retaining the information learned from previous data.

Experiments are conducted in the two simulation environments described above. Since the offline dataset size and the retrieval-distance threshold are fixed for each scene, the average number of retrieved samples remains approximately stable across different target-sample settings. The variation mainly results from the different target samples generated under different random seeds. Specifically, for Scene I, the numbers of retrieved samples are 824 ± 31, 831 ± 37, and 827 ± 34 for 50, 100, and 150 target samples, respectively. For Scene II, the corresponding values are 796 ± 29, 803 ± 35, and 799 ± 32, respectively. The offline dataset contains approximately 10,000 radar–jammer interaction samples.

Specifically, our method is first pretrained on dataset D_prior. When the fine-tuning capability is disabled, it is denoted as FRAIL without FT; when fine-tuning is enabled, it is denoted as FRAIL with FT; and when fine-tuning is enabled together with the proposed transfer learning strategy, it corresponds to FRAIL (Ours). In addition, three classical algorithms in few-shot imitation reinforcement learning are included for comparison, namely Progressive Neural Networks [25], PathNet [26], and Dynamically Expandable Networks [27]. All pretrained models are trained to convergence before testing, and the number of few-shot samples used during evaluation is strictly controlled, which is set to 150 at each testing process. The performance of each algorithm is evaluated at intervals of 50 samples to illustrate the imitation learning behavior under varying sample-size settings. The average detection probability is used as the evaluation criterion. The corresponding results are presented in Table 4.

Table 4. Detection probability performance of algorithms.

	Scene I			Scene II
	50	100	150	50	100	150
DEN	0.589	0.602	0.627	0.596	0.608	0.631
PNN	0.601	0.628	0.644	0.611	0.633	0.652
PathNet	0.612	0.658	0.757	0.618	0.647	0.748
FRAIL without FT	0.325	0.335	0.348	0.331	0.342	0.351
FRAIL with FT	0.548	0.679	0.712	0.612	0.735	0.801
FRAIL	0.697	0.796	0.865	0.703	0.831	0.876

As shown in Table 4, FRAIL achieves the highest detection probability under both scenes. It demonstrates its superior adaptation and transfer capability in few-shot scenarios. With the increase in unknown jamming samples, all methods exhibit an overall upward trend in performance, suggesting that more samples contribute additional informative cues for fine-tuning. Compared with DEN, PNN, and PathNet, FRAIL exhibits a more stable and significant improvement, suggesting that conventional network expansion or incremental learning strategies are less effective in fully exploiting limited target-task data.

As shown in Figure 8, the comparison among different FRAIL variants further validates the contribution of each component. FRAIL without fine-tuning yields the poorest performance, and its improvement remains limited even when more samples are provided, which indicates that pretrained knowledge alone is insufficient for adapting to unseen target tasks. By enabling fine-tuning, FRAIL achieves a clear performance gain, confirming the necessity of target-task adaptation. Nevertheless, the complete FRAIL method consistently outperforms, demonstrating that the proposed imitation learning strategy can further enhance knowledge reuse and improve detection performance.

Figure 8. Performance of FRAIL and Other Fine-tuning Methods. We compare the detection probability of FRAIL with DEN, PNN, PathNet, FRAIL without fine-tuning, and FRAIL with fine-tuning under two scenes with ten random seeds. The solid lines represent the mean detection probability across ten random seeds, while the shaded regions indicate the corresponding standard deviation (±1 SD). Across both scenarios, FRAIL consistently delivers superior performance, with its results improving noticeably as the number of samples increases.

In addition to detection performance, the computational efficiency of the compared methods is further evaluated. All methods are tested under the same hardware and software environment, and the average computation time required for a single anti-jamming decision is recorded. For FRAIL, the reported time includes feature encoding, historical experience retrieval, and policy inference. Each method is repeatedly evaluated for 100 runs, and the average computation time is reported in Table 5.

Table 5. The average computation times per decision of DEN, PNN, and PathNet.

Method	DEN	PNN	PathNet	FRAIL
Computation time per decision (ms)	23.51	34.26	27.85	56.93

As shown in Table 5, the average computation times of DEN, PNN, and PathNet are 23.51 ms, 34.26 ms, and 27.85 ms per decision, respectively, while FRAIL requires 56.93 ms. Compared with conventional methods, FRAIL introduces additional computational overhead due to feature encoding and historical experience retrieval. Nevertheless, its average computation time remains below 60 ms per decision, indicating that the complete decision-making process can be performed within a relatively short period. Considering its superior detection performance, the additional computational cost represents a reasonable trade-off between computational efficiency and anti-jamming effectiveness. These results demonstrate the potential of FRAIL for online radar anti-jamming applications, provided that the available decision interval accommodates its computational latency.

4.4. Knowledge-Forgetting Degree of FRAIL

In dynamic radar-jamming games, the radar may suffer from catastrophic forgetting. Its previously acquired anti-jamming strategies may be significantly degraded after learning new jamming behaviors. This experiment aims to verify the degree of knowledge forgetting of FRAIL and other imitation learning algorithms. Each algorithm is tested on old tasks and all tasks. We use the forgetting measure factor F to quantify the degree of forgetting. In imitation learning, F is defined as

F_j = A_max,j − A_final,j

(10)

where A_max,j is the best performance on old task j; A_final,j is the final performance testing on all tasks.

In the experiments, we tested A_final,j after model training with 50, 100, and 150 samples and computed the average F_j to represent the forgetting degree of each algorithm. Each experiment was independently conducted five times to guarantee a fair and reliable performance comparison.

As shown in Table 6, A_final,j on old tasks decreases as the number of new-task training samples increases from 50 to 150, indicating that all methods suffer from different degrees of knowledge forgetting during continual learning of new jamming behaviors. DEN shows the most severe degradation, with average decreases of 9.6% and 9.3% in Scenes I and II, suggesting its weak capability in preserving previously learned anti-jamming strategies. PNN alleviates forgetting to some extent, with average forgetting values of 0.053 and 0.049, but its final performance is still lower than that of the proposed method.

Table 6. Forgetting measure of the proposed method.

			DEN	PNN	PathNet	FRAIL
Scene I	Amax,j		0.785	0.786	0.812	0.824
	Afinal,j	50	0.762	0.765	0.786	0.811
		100	0.683	0.733	0.741	0.796
		150	0.622	0.702	0.687	0.786
	Average Fj		0.096	0.053	0.074	0.026
Scene II	Amax,j		0.779	0.784	0.807	0.819
	Afinal,j	50	0.753	0.766	0.777	0.801
		100	0.671	0.729	0.739	0.788
		150	0.634	0.71	0.678	0.779
	Average Fj		0.093	0.049	0.076	0.030

In contrast, FRAIL achieves the lowest average forgetting degree in both scenarios. Specifically, FRAIL obtains A_max,j = 0.824 with an average forgetting of 0.026 in Scene I, and A_max,j = 0.819 with an average forgetting of 0.030 in Scene II. Even with deeper training on the new task, FRAIL maintains only minor performance degradation and consistently outperforms the baselines. This demonstrates that the proposed retrieval mechanism effectively selects relevant historical experience and preserves prior anti-jamming knowledge, thereby mitigating catastrophic forgetting in radar policy learning.

4.5. Robust Performance of FRAIL

In practice, the radar may be perturbed by thermal noise, clutter and other factors. Therefore, we conduct robustness experiments to evaluate the algorithm under such conditions. Specifically, additive white Gaussian noise with signal-to-noise ratios from −10 dB to 10 dB is introduced into the interference waveforms received by the radar, thereby emulating noise disturbances in practical environments. The performance of FRAIL before and after noise injection is then compared. The parameter configuration is kept consistent with Table 3, and the performance evaluation is conducted using 150 samples. The corresponding experimental results are presented in Figure 9.

Figure 9. Robust Performance of FRAIL in Scene I. We compare the detection probability of FRAIL with DEN, PNN, and PathNet in white Gaussian noise with SNR ranging from −10 dB to 10 dB.

4.6. Ablation Components of FRAIL

In this section, ablation studies are conducted on key design settings and hyperparameters of FRAIL, with particular focus on the embedding-space model and the filtering threshold δ.

4.6.1. Ablating Embedding Space Model

We first evaluate the effectiveness of the proposed VAE-based embedding space model by comparing it with an alternative strategy for learning (s,a) representations. Specifically, we consider contrastive RL, which aims to encode a state-action pair by modeling the distribution of states that may be reached in the future through contrastive learning. Ideally, such a representation is expected to reflect the functional characteristics of (s,a). Based on this embedding, we further replace the default VAE representation with the contrastive RL representation in FRAIL.

As reported in Table 7, the VAE-based embedding consistently achieves superior performance on both simulated scenes. Although contrastive RL is theoretically capable of producing more function-oriented state-action representations, our experiments show that it suffers from unstable training. In particular, when applied to the CJ type, the representation learning process becomes difficult to optimize and may even diverge, leading to ineffective embedding learning.

Table 7. Ablation of VAE and Contrastive RL.

		Contrastive RL	VAE
Scene I	50	0.571	0.701
	100	0.583	0.795
	150	0.602	0.863
Scene II	50	0.564	0.697
	100	0.573	0.828
	150	0.569	0.873

4.6.2. Ablation Threshold Delta δ

In addition, we study the robustness of the proposed method to hyperparameter selection, with particular focus on the embedding-distance threshold δ, which determines whether samples from D_prior are accepted or rejected. As shown in Figure 10, different threshold values are evaluated in both simulation scenes. The results indicate that a threshold close to δ = 7.5 yields the best overall performance across different scenes. It is also observed that the method remains relatively stable when smaller values of δ are used, with only gradual performance degradation. This suggests that more task-irrelevant samples may be included, while the task-relevant samples can still be effectively preserved. In contrast, an excessively large δ leads to a significant performance drop, since it may remove most samples in D_prior including those that are beneficial for the target task.

Figure 10. Impact of Selection Threshold. On both simulation scenes, we find that FRAIL is generally robust to the choice of δ, with the best performance around 7.5. We see performance scales gracefully increase as δ decreases, but performance drops significantly as δ increases.

4.7. Generalization Under Unseen Waveform Parameters

The previous experiments mainly evaluate the adaptation capability of FRAIL when the jamming type encountered during testing differs from that used during offline training. However, in practical radar–jammer interactions, unknown interference may also arise from changes in waveform parameters even when the underlying jamming mechanism remains unchanged. Therefore, we further evaluate the generalization capability of FRAIL under unseen waveform-parameter configurations.

As described in Section 4.1, the parameter ranges used during testing are excluded from those used during offline training, while the jamming waveform types remain unchanged. Specifically, the offline training dataset contains 1 × 10⁴ interaction samples, whereas 50, 100, and 150 online samples are used to evaluate the adaptation performance under unseen parameter configurations.

As shown in Table 8, FRAIL achieves the highest detection probability among all compared methods under both offline training and unseen testing conditions. Under unseen waveform-parameter configurations, the detection probability of FRAIL increases from 0.666 to 0.756 and 0.805 as the number of online samples increases from 50 to 100 and 150, respectively. In comparison, DEN, PNN, and PathNet achieve detection probabilities of 0.601, 0.617, and 0.719 with 150 online samples, respectively. Averaged across the three online sample settings, FRAIL improves the detection probability by 28.73%, 24.90%, and 15.81% compared with DEN, PNN, and PathNet, respectively. These results demonstrate that FRAIL maintains superior anti-jamming performance under previously unseen waveform-parameter configurations, while its detection performance progressively improves with the availability of additional online samples.

Table 8. Detection probability under unseen waveform-parameter configurations.

Scene	Samples	DEN	PNN	PathNet	FRAIL
Offline training	1 × 104	0.785	0.786	0.812	0.824
Unseen testing	50	0.555	0.567	0.581	0.666
	100	0.574	0.599	0.623	0.756
	150	0.601	0.617	0.719	0.805

These results suggest that the effectiveness of FRAIL is not limited to previously observed jamming waveform configurations. Although the testing parameters are excluded from the offline training ranges, the learned state–action representations enable FRAIL to retrieve relevant historical interaction experiences and reuse previously acquired decision knowledge. By incorporating the retrieved experiences into few-shot policy adaptation, FRAIL can effectively mitigate the performance degradation caused by waveform-parameter variations. This demonstrates the potential of the proposed experience-retrieval-based imitation learning strategy to improve knowledge transfer and enhance radar anti-jamming performance under previously unseen parameter configurations.

5. Discussion

Summary. We have proposed FRAIL, a radar feature-retrieval imitation learning method under few-shot conditions. FRAIL is trained using historical radar–jammer interaction data and enables efficient imitation learning when the jamming signal type is unknown. The key insight is that, rather than simply performing pretraining followed by fine-tuning, the model can learn to selectively retrieve useful samples from a prior dataset, thereby improving task-specific training. Feature retrieval provides a simple yet effective technique for addressing this problem. Experimental evaluations demonstrate that FRAIL outperforms multitask pretraining and fine-tuning methods. Moreover, qualitative results show that FRAIL can retrieve task-relevant jamming behaviors while discarding irrelevant task information.

Limitations and Future Work. Although we are optimistic about its potential extensions, several limitations remain. First, the current retrieval process relies on the similarity between jamming waveforms in a compressed embedding space. While this strategy performs well in our experiments, particularly for suppression jamming and deception jamming, it may fail to effectively distinguish waveform features when encountering more complex and customized waveforms. Therefore, the proposed method may not be applicable to all scenarios. In addition, compound jamming involving multiple simultaneous jamming mechanisms has not yet been explicitly investigated, and the current simulations use ground-truth-based detection probability as the reward, whereas practical deployment would require surrogate feedback constructed from observable radar-processing outputs. Second, FRAIL requires access to the prior dataset when learning a new task, which may limit its applicability in practical environments where only a pretrained model is feasible. Finally, we believe that the proposed method can be further combined with other research directions aimed at improving the efficiency of imitation learning, such as pretrained representations and restricted action spaces. However, this has not yet been experimentally verified. Combining FRAIL with these methods and investigating whether their benefits can be compounded represent promising directions for future work.