Recent advancements in radio frequency machine learning (RFML) have\ndemonstrated the use of raw in-phase and quadrature (IQ) samples for multiple\nspectrum sensing tasks. Yet, deep learning techniques have been shown, in other\napplications, to be vulnerable to adversarial machine learning (ML) techniques,\nwhich seek to craft small perturbations that are added to the input to cause a\nmisclassification. The current work differentiates the threats that adversarial\nML poses to RFML systems based on where the attack is executed from: direct\naccess to classifier input, synchronously transmitted over the air (OTA), or\nasynchronously transmitted from a separate device. Additionally, the current\nwork develops a methodology for evaluating adversarial success in the context\nof wireless communications, where the primary metric of interest is bit error\nrate and not human perception, as is the case in image recognition. The\nmethodology is demonstrated using the well known Fast Gradient Sign Method to\nevaluate the vulnerabilities of raw IQ based Automatic Modulation\nClassification and concludes RFML is vulnerable to adversarial examples, even\nin OTA attacks. However, RFML domain specific receiver effects, which would be\nencountered in an OTA attack, can present significant impairments to\nadversarial evasion.\n