Adversarially Robust Physical Layer Authentication (AR-PLA)

• AR-PLA is a physical-layer authentication framework that uses unique RF and channel fingerprints combined with binary hypothesis testing to counter adversarial manipulations.
• It integrates advanced techniques such as generative modeling, sequential inference, and spatial programmability to address spoofing, replay, and pilot contamination attacks.
• Evaluation metrics like detection probability and ROC curves demonstrate that multi-factor fusion and coded challenge–response methods significantly enhance authentication robustness.

Searching arXiv for the cited PLA and AR-PLA papers to ground the article and confirm metadata. Searching for the generative-AI PLA overview paper. Searching for the non-stationary MIMO AR-PLA paper. Searching for the spatial-domain PLA survey covering DPA, Massive MIMO, and RIS. Adversarially Robust Physical Layer Authentication (AR-PLA) denotes physical-layer authentication schemes that retain the endogenous security advantages of physical fingerprints while explicitly modeling adversarial manipulation, spoofing, replay, pilot contamination, environmental drift, and data-driven attacks. Across recent work, AR-PLA is formulated as a binary hypothesis-testing problem over channel-, device-, circuit-, mobility-, or tag-derived observations, with robustness obtained through statistical modeling, spatial diversity, programmable propagation, coded challenge–response, generative modeling, sequential inference, or multi-factor fusion (Meng et al., 25 Apr 2025, Shakiba-Herfeh et al., 2020).

1. Formal scope and decision-theoretic basis

AR-PLA inherits the standard PLA workflow. Enrollment collects labeled fingerprints for legitimate identities over representative environments. Estimation and feature extraction then derive stable observables such as CSI from a model of the form $y = h x + n$ with known pilot $x$. Decision making finally accepts the legitimate hypothesis or rejects an adversary by hypothesis testing or learned classification. Representative physical-layer fingerprints include channel fingerprints—CSI, CIR, path loss, and delay spread—and RF fingerprints such as I/Q imbalance, carrier frequency offset, and phase noise. The former derive from propagation randomness, spatial-temporal uniqueness, and short-term stability; the latter derive from hardware tolerances and offer hardware uniqueness with long-term stability even across identical device models (Meng et al., 25 Apr 2025).

The canonical test is a likelihood-ratio rule between legitimate $H_0$ and illegitimate $H_1$: $$\Lambda(x) = \frac{p(x \mid H_1)}{p(x \mid H_0)} \mathop{\gtrless}_{H_0}^{H_1} \eta.$$ The associated metrics are the false alarm probability $P_{FA} = \Pr(\Lambda(x) > \eta \mid H_0)$, the detection probability $P_D = \Pr(\Lambda(x) > \eta \mid H_1)$, the missed detection probability $P_M = 1 - P_D$, and ROC curves obtained by sweeping $\eta$ under a Neyman–Pearson operating constraint (Meng et al., 25 Apr 2025). In settings where generative models are available for both classes, likelihoods $\log p_\theta(x \mid H_0)$ and $x$0 can themselves become test statistics (Meng et al., 25 Apr 2025).

The broader security rationale comes from physical-layer security. Node authentication, message authentication, and confidentiality are treated as distinct but related problems, and the physical-layer approach is explicitly framed as information-theoretic rather than computational. One recurring implication is that AR-PLA is not merely a classifier hardening problem; it is also a question of how physical randomness, helper data, pilot design, and cross-layer binding constrain adversaries with unbounded computational power (Shakiba-Herfeh et al., 2020).

2. Threat models and robustness criteria

Recent AR-PLA work treats the adversary as an active manipulator of the authentication feature space rather than a passive outsider. A basic evasion model perturbs a fingerprint by

$x$1

with power or SNR limits and either white-box or black-box access. Additional attack classes include impersonation and spoofing of channel or hardware fingerprints, replay, man-in-the-middle relaying with timing or phase alignment, environment-induced perturbations that shift $x$2, and training-time backdoors that force trigger-bearing samples to be classified as legitimate (Meng et al., 25 Apr 2025).

Spatially enhanced PLA expands this threat surface. Massive MIMO introduces pilot contamination; RIS-assisted systems introduce RIS jamming and RIS leakage; DPA systems face co-located attacks that attempt to mimic polarization features; and ML-based cloning becomes an explicit concern once classifiers operate on high-dimensional CSI or angular fingerprints. The unified spatial-domain model

$x$3

makes the configuration $x$4 itself part of the attack surface, whether that configuration is an RIS phase profile, an array configuration, or a polarization port (Chen et al., 27 Jun 2026).

Several works sharpen the limits of individual features. AoA-based authentication is robust under spoofing only under strict geometric conditions: in the misspecified Cramér–Rao analysis, the difficult case is $x$5, where the spoofed mean AoA aligns with the legitimate AoA and ambiguity persists even as $x$6 grows (Skaperas et al., 22 Mar 2026). Similarly, OFDM challenge–response PLA cannot assume independent subcarrier phases in practice; the Maximum Differential Likelihood Generator exploits adjacent-subcarrier correlation, and the resulting guideline explicitly decides when PLA should be disabled in favor of cryptographic authentication (Liu et al., 7 May 2026).

These results constrain a common misconception. Endogenous security does not imply unconditional robustness. The papers repeatedly state that robustness depends on geometry, coherence, pilot protection, power and bandwidth constraints, feature drift, and the extent to which the adversary can exploit statistical dependence or configuration control (Meng et al., 25 Apr 2025, Chen et al., 27 Jun 2026).

3. Mechanisms for robustness: generative, sequential, and coded approaches

A major recent development is the use of generative AI for PLA. The core distinction is that discriminative methods learn decision boundaries $x$7, whereas generative methods learn fingerprint distributions $x$8. In the AR-PLA context, this supports synthetic fingerprint generation for scarce regimes, denoising and reconstruction, extrapolation across environments, and likelihood-based anomaly detection. The main model classes revisited are GANs, VAEs, diffusion models, and transformer-based LLMs. Their roles span the data layer, where hard negatives and environment-conditioned augmentation are produced; the model layer, where perturbed samples are projected back to high-density regions; and the application layer, where cooperative nodes, multi-node fusion, and channel knowledge maps support adaptive decisions (Meng et al., 25 Apr 2025).

The corresponding robust-training formulation is explicit: $x$9 At inference time, anomaly scores may use either generative likelihoods or reconstruction residuals,

$H_0$0

Per-user generators, latent disentanglement of identity and environment, and cooperative fusion by weighted likelihoods are all presented as AR-PLA mechanisms rather than merely data augmentation techniques (Meng et al., 25 Apr 2025).

Non-stationary MIMO AR-PLA extends this line of work by integrating contrastive embeddings, GAN-based spoofers, and sequential Bayesian inference. The framework models time-varying MIMO channels with temporal state evolution, Kronecker spatial correlation, and LoS/NLoS switching; then maps CSI into $H_0$1 embeddings and performs 2-state or 3-state HMM inference with exponential moving average adaptation. The sequential statistic takes forms such as

$H_0$2

with HMM recursions replacing the i.i.d. assumption. In the reported evaluation, AUC remains approximately $H_0$3 for the 2-state HMM in LoS, approximately $H_0$4 under blockage, approximately $H_0$5 for the 3-state HMM under blockage, and approximately $H_0$6 for the 3-state HMM with EMA under combined blockage and GAN spoofing (Boroujeni et al., 25 Sep 2025).

Coded robustness also appears in tag-based PLA. Frozen-tag authentication replaces direct embedding of a raw tag with a polar-coded frozen tag in which anchor information occupies the information set and the raw tag occupies the frozen set. Authentication then compares a reconciled anchor to a re-extracted anchor through

$H_0$7

This design is intended simultaneously to mitigate unintended user interference and conceal the raw tag from an eavesdropper (Yao et al., 8 Apr 2026).

4. Spatially programmable and cooperative AR-PLA

Spatial-domain enhancement is one of the most systematic robustness themes in current PLA literature. In DPA systems, the principal features are the polarization amplitude ratio and phase difference,

$H_0$8

together with CPR, FCI, covariance features, and multi-frequency polarization fingerprints. In Massive MIMO, robustness is driven by channel hardening, covariance and subspace tests, and angular-domain sparsity. In RIS-enabled systems, the programmable cascaded channel

$H_0$9

or its scalar form

$H_1$0

is used to construct challenge–response tests, optimize separability, and randomize the attacker’s uncertainty set (Chen et al., 27 Jun 2026).

The survey evidence is quantitative. At target $H_1$1, DPA PF-based PLA improves $H_1$2 from $H_1$3 with $H_1$4 frequency point to $H_1$5 with $H_1$6 points, while PSA at $H_1$7 dB increases from $H_1$8 to $H_1$9. Massive MIMO channel-based PLA at $$\Lambda(x) = \frac{p(x \mid H_1)}{p(x \mid H_0)} \mathop{\gtrless}_{H_0}^{H_1} \eta.$$0 dB improves from $$\Lambda(x) = \frac{p(x \mid H_1)}{p(x \mid H_0)} \mathop{\gtrless}_{H_0}^{H_1} \eta.$$1 for $$\Lambda(x) = \frac{p(x \mid H_1)}{p(x \mid H_0)} \mathop{\gtrless}_{H_0}^{H_1} \eta.$$2 to $$\Lambda(x) = \frac{p(x \mid H_1)}{p(x \mid H_0)} \mathop{\gtrless}_{H_0}^{H_1} \eta.$$3 for $$\Lambda(x) = \frac{p(x \mid H_1)}{p(x \mid H_0)} \mathop{\gtrless}_{H_0}^{H_1} \eta.$$4; at $$\Lambda(x) = \frac{p(x \mid H_1)}{p(x \mid H_0)} \mathop{\gtrless}_{H_0}^{H_1} \eta.$$5 dB it improves from $$\Lambda(x) = \frac{p(x \mid H_1)}{p(x \mid H_0)} \mathop{\gtrless}_{H_0}^{H_1} \eta.$$6 to $$\Lambda(x) = \frac{p(x \mid H_1)}{p(x \mid H_0)} \mathop{\gtrless}_{H_0}^{H_1} \eta.$$7. In RIS challenge–response, at $$\Lambda(x) = \frac{p(x \mid H_1)}{p(x \mid H_0)} \mathop{\gtrless}_{H_0}^{H_1} \eta.$$8 dB, $$\Lambda(x) = \frac{p(x \mid H_1)}{p(x \mid H_0)} \mathop{\gtrless}_{H_0}^{H_1} \eta.$$9 for $P_{FA} = \Pr(\Lambda(x) > \eta \mid H_0)$0, $P_{FA} = \Pr(\Lambda(x) > \eta \mid H_0)$1 for $P_{FA} = \Pr(\Lambda(x) > \eta \mid H_0)$2, and $P_{FA} = \Pr(\Lambda(x) > \eta \mid H_0)$3 for $P_{FA} = \Pr(\Lambda(x) > \eta \mid H_0)$4 (Chen et al., 27 Jun 2026).

Hybrid channel- and coding-based challenge–response makes this programmability explicit. Bob controls a propagation parameter $P_{FA} = \Pr(\Lambda(x) > \eta \mid H_0)$5 so that $P_{FA} = \Pr(\Lambda(x) > \eta \mid H_0)$6 varies over $P_{FA} = \Pr(\Lambda(x) > \eta \mid H_0)$7, estimates the channel over $P_{FA} = \Pr(\Lambda(x) > \eta \mid H_0)$8 frames, and accepts if

$P_{FA} = \Pr(\Lambda(x) > \eta \mid H_0)$9

The channel-based success probability of the attacker is expressed as a sphere-in-hypercube ratio,

$P_D = \Pr(\Lambda(x) > \eta \mid H_1)$0

and the overall hybrid security is additive in equivalent secret length: $P_D = \Pr(\Lambda(x) > \eta \mid H_1)$1 The reported regime in which the hybrid scheme outperforms both channel-only and coding-only variants is $P_D = \Pr(\Lambda(x) > \eta \mid H_1)$2, $P_D = \Pr(\Lambda(x) > \eta \mid H_1)$3 dB, and $P_D = \Pr(\Lambda(x) > \eta \mid H_1)$4 (Crosara et al., 29 Jan 2025).

Cooperative and map-assisted formulations push the same principle further. In the diffusion-based cooperative case study, Alice’s and Jack’s CSI are stacked into an image-like object, a GDM is trained on their joint distribution, and Bob predicts Alice’s current fingerprint from Jack’s observation; authentication then compares the observed transmitter fingerprint against the predicted one using EuDis, SSIM, PSNR, or CoS. The proposed method is reported to outperform previous-timestep matching, LSTM prediction, and direct Jack comparison across all four similarity measures, although exact numerical values are not reported (Meng et al., 25 Apr 2025). In indoor CKM-based PLA, multiple APs estimate dominant-tap path loss and AoA and compare them against a ray-tracing-derived map within a mobility-constrained neighborhood. With $P_D = \Pr(\Lambda(x) > \eta \mid H_1)$5 APs, realistic noise, and a full-map attack, the reported operating point is approximately $P_D = \Pr(\Lambda(x) > \eta \mid H_1)$6 at $P_D = \Pr(\Lambda(x) > \eta \mid H_1)$7 (Bonaventura et al., 25 Jun 2026).

5. Representative application domains

The diversity of AR-PLA instantiations is best seen across concrete deployment regimes.

Setting	Primary fingerprint	Main robustness mechanism
RIS-aided BTTN	EH and envelope-detector voltage profile	RIS-optimized profile separability
Indoor mobility	Dominant-tap PL and AoA	CKM neighborhood matching
LEO ISL	Doppler NPSDS across receivers	Multi-satellite fusion
OFDM challenge–response	Subcarrier phase response	Randomness testing against MDLG
User-interference regime	Frozen tag and anchor bits	Polar decoding with concealed raw tags
CF-mMIMO	Low-energy tags over distributed APs	Macro-diversity and local ZF

In RIS-aided backscattering tag-to-tag networks, the fingerprint is the pair of output voltages measured at the listener tag in the energy-harvesting and envelope-detector branches under on/off talker modulation states. Authentication compares

$P_D = \Pr(\Lambda(x) > \eta \mid H_1)$8

against thresholds. The reported indoor setup shows that, without RIS, at FAR $P_D = \Pr(\Lambda(x) > \eta \mid H_1)$9 the TPR falls from $P_M = 1 - P_D$0 at $P_M = 1 - P_D$1 m to $P_M = 1 - P_D$2 at $P_M = 1 - P_D$3 m, while at FAR $P_M = 1 - P_D$4 it falls from $P_M = 1 - P_D$5 to $P_M = 1 - P_D$6. RIS beamforming improves ROC behavior, extends secure coverage, and maintains high TPR even with multiple attackers (Kaveh et al., 20 Jan 2025).

In LEO inter-satellite links, the fingerprint is not fading-rich CSI but Doppler geometry. Each receiving satellite estimates a nominal power spectral density signature of the Doppler-shifted signal and compares it to the predicted legitimate value. The decisive robustness claim is geometric: with $P_M = 1 - P_D$7 observers, the Doppler equations have a unique solution for transmitter position and velocity under generic non-degenerate constellation geometries, so a spoofer cannot match all observers simultaneously. Majority fusion is reported to provide the best detection/false-alarm trade-off, while increasing $P_M = 1 - P_D$8 improves both detection and false alarm performance (Topal et al., 2022).

In mission-critical MTC, PLA is embedded in a queueing analysis rather than evaluated only by ROC. A GLRT over LOS SIMO CSI is used to resist data injection, disassociation, and Sybil attacks, and the key practical conclusion is that with approximately $P_M = 1 - P_D$9–$\eta$0 receive antennas and sufficiently strong LOS components, PLA remains viable despite tight latency constraints. The paper further reports that PLA can significantly reduce the delay impacts of disassociation and Sybil attacks (Forssell et al., 2018).

OFDM challenge–response exposes a different issue: authentication can fail not because the attacker is powerful in the conventional sense, but because the subcarrier responses are insufficiently random. The measured adjacent-subcarrier correlation coefficients range from $\eta$1 to $\eta$2 across eight locations, and the MDLG attack outperforms random guessing by $\eta$3 at locations with $\eta$4–$\eta$5 and by approximately $\eta$6 at locations with $\eta$7–$\eta$8. Applying the NIST frequency test as a gating mechanism reduced $\eta$9 at one location from $\log p_\theta(x \mid H_0)$0 to $\log p_\theta(x \mid H_0)$1 (Liu et al., 7 May 2026).

Frozen-tag and CF-mMIMO designs extend AR-PLA to interference-limited and many-user regimes. The frozen-tag scheme reports that, at SNR $\log p_\theta(x \mid H_0)$2 dB, $\log p_\theta(x \mid H_0)$3 interferers, and $\log p_\theta(x \mid H_0)$4, it requires $\log p_\theta(x \mid H_0)$5 dB less SINR than uncoded tag PLA to reach $\log p_\theta(x \mid H_0)$6 for $\log p_\theta(x \mid H_0)$7, and $\log p_\theta(x \mid H_0)$8 dB less for $\log p_\theta(x \mid H_0)$9 (Yao et al., 8 Apr 2026). In CF-mMIMO, the matched-filter statistic for user $x$00 has

$x$01

leading to

$x$02

Reported numerics show that increasing $x$03 from $x$04 to $x$05 raises $x$06 by approximately $x$07 for all tag lengths in one setup, and increasing $x$08 from $x$09 to $x$10 raises $x$11 by approximately $x$12 at $x$13 users (Silva et al., 27 Aug 2025).

6. Evaluation practice, limitations, and open directions

AR-PLA evaluation is dominated by $x$14, $x$15, $x$16, ROC/AUC, and, in some domain-specific studies, TPR/FAR/FRR, F1, ASN, or delay bounds. The deployment bottlenecks are equally recurrent: diffusion models require iterative denoising; CKM matching incurs $x$17 per decision; CR-RISAuth must store CSI under multiple configurations; frozen-tag decoding scales quasi-linearly in code length; and CF-mMIMO trades robustness for backhaul and local ZF complexity (Meng et al., 25 Apr 2025, Bonaventura et al., 25 Jun 2026, Yao et al., 8 Apr 2026, Silva et al., 27 Aug 2025).

Several limitations recur across otherwise dissimilar proposals. Distribution drift under mobility or blockage still degrades learned and model-based authenticators, which is why continual learning, EMA adaptation, latent disentanglement, or neighborhood-restricted inference are emphasized. Adaptive attackers can target the defense itself by poisoning generative models, exploiting transferability, or attacking the configuration variable $x$18. Generative denoisers and anomaly detectors improve empirical robustness, but formal certification remains limited; combining these mechanisms with certified methods such as randomized smoothing is identified as promising rather than standard (Meng et al., 25 Apr 2025). AoA, despite its strong geometric appeal, is not universally sufficient because the $x$19 ambiguity remains a fundamental worst case (Skaperas et al., 22 Mar 2026). RIS does not automatically improve every operating characteristic; in one RIS-assisted PLA formulation, the gain is specifically through PMD reduction while PFA remains unchanged because the $x$20 statistic is noise-dominated (Amin et al., 2024).

The forward-looking agenda is therefore broad but technically coherent. Reported future directions include robust and distilled diffusion for real-time AR-PLA, multi-node and multi-antenna fusion with weighted generative likelihoods, semi/self-supervised learning over unlabeled fingerprints, domain generalization and meta-learning, standardized AR-PLA benchmarks with controlled perturbations, ISAC-style multi-modal fingerprints, Dynamic Metasurface Antennas, XL-MIMO visibility-region signatures, Fluid Antenna Systems, AI-driven configuration of $x$21, privacy-preserving model storage, and formal adversarial risk analysis under spatial programmability (Meng et al., 25 Apr 2025, Chen et al., 27 Jun 2026). This suggests that AR-PLA is converging toward a layered architecture in which robustness comes not from a single fingerprint or detector, but from the joint design of features, dynamics, spatial control, coded or cryptographic binding, and attack-aware statistical decision rules.