Radio Frequency Fingerprint Identification

• RFFI is a device-authentication technique that exploits unique hardware imperfections, such as IQ imbalance and PA nonlinearity, by extracting signature spectrograms and quotient-based representations.
• Recent frameworks incorporate channel-robust feature extraction, adversarial training, and length-versatile deep architectures to maintain high classification accuracy across varying receivers and environments.
• RFFI systems offer scalable enrollment and effective security measures, demonstrating resilience against receiver shifts, noise, and adversarial attacks in practical wireless networks.

Radio Frequency Fingerprint Identification (RFFI) is a device-authentication technique that identifies wireless transmitters from intrinsic hardware-induced distortions in emitted RF signals. In deployed systems, the receiver extracts a representation of these distortions and applies pattern recognition or deep learning to infer device identity. Recent work has moved RFFI from spectrogram-CNN pipelines for LoRa toward receiver-agnostic, channel-robust, noise-robust, open-set, and adversarially aware frameworks spanning LoRa, Wi-Fi, and multi-receiver deployments (Shen et al., 2020, Shen et al., 2022, Yang et al., 2024, Cai et al., 26 Jan 2025).

1. Physical basis of RF fingerprints

RFFI relies on the fact that wireless devices exhibit unique, device-specific hardware impairments. The literature explicitly attributes usable fingerprints to imperfections in oscillators, mixers, and amplifiers, and repeatedly discusses IQ imbalance, carrier frequency offset (CFO), power amplifier (PA) nonlinearity, and related distortions as the physical substrate of device identity (Yin et al., 7 Mar 2025, Ma et al., 2023). In this sense, RFFI is a receiver-side inference problem: the transmitter emits a conventional waveform, while the receiver attempts to separate transmitter-specific structure from nuisance effects introduced by propagation and its own RF front-end.

A foundational representation in modern RFFI is the spectrogram computed by short-time Fourier transform (STFT). For LoRa, spectrograms expose the fine-grained time-frequency behavior of chirp spread spectrum signals more effectively than time-domain IQ samples or static FFT features. One influential LoRa study showed that a spectrogram-based CNN, combined with CFO compensation and a CFO-informed hybrid classifier, reached 97.61% classification accuracy for 20 LoRa devices under real wireless conditions, while also demonstrating that instantaneous CFO is drifting and can destabilize classification if left uncompensated (Shen et al., 2020).

Subsequent work increasingly replaced raw or ordinary spectrograms with explicitly channel-suppressing representations. The PA nonlinearity quotient computes STFTs of consecutive high-power and low-power packets, forms the element-wise quotient

$$\boldsymbol{Q} = \boldsymbol{S}_h \, ./ \, \boldsymbol{S}_l,$$

and then converts it to log scale,

$$\widetilde{\boldsymbol{Q}} = 10 \log_{10}\left(\left| \boldsymbol{Q} \right|^2 \right).$$

Because the quotient cancels the local channel response under slow fading, it isolates PA nonlinearity as a channel-robust fingerprint (Yang et al., 2023). In Wi-Fi, denoised spectral quotient (DSQ) sequences were introduced by denoising the legacy long training field and dividing adjacent active subcarriers, again with the aim of suppressing channel effects before classification (He et al., 9 Mar 2026). A separate IEEE 802.11 line of work used spectral regrowth on inactive OFDM subcarriers as a channel-resilient fingerprint rooted in PA nonlinearity, rather than relying on features on active subcarriers that are more directly entangled with the channel (Xie et al., 2024).

Taken together, these representations indicate that RFFI is not only a classification problem but also a representation-design problem. This suggests that robustness often depends as much on what is presented to the classifier as on the classifier architecture itself.

2. Learning architectures and feature extraction paradigms

Early deep RFFI systems were dominated by CNNs operating on spectrogram-like inputs. In the LoRa setting, a representative model used three convolutional layers, batch normalization, ReLU, max pooling, and a softmax output head, while a hybrid post-processor adjusted the CNN output with estimated CFO to reject physically inconsistent classes (Shen et al., 2020). This architecture established the template for much later work: synchronization, normalization, CFO handling, time-frequency transformation, and supervised multi-class inference.

A central limitation of many early networks was fixed input size. To address variable-length packets, especially in IoT settings such as LoRa with changing spreading factors or preamble lengths, four length-versatile architectures were proposed: flatten-free CNN, LSTM, GRU, and transformer. The flatten-free CNN replaces the flatten layer with global average pooling 2D; the recurrent and transformer models use global average pooling 1D so that the dense layer receives a fixed-length vector regardless of sequence length. Across these models, no performance drop was observed when packets with different spreading factors were classified, and the transformer was reported as the most efficient configuration, with 348,938 parameters and 28.7 ms inference time for SF=7 (Shen et al., 2022).

Another major shift was from closed-set classification toward embedding learning. A scalable LoRa framework trained a lightweight ResNet-inspired CNN as an RF fingerprint extractor using triplet loss,

$$\text{Loss} = \max \left( D(\text{Anc}, \text{Pos}) - D(\text{Anc}, \text{Neg}) + \alpha, 0 \right),$$

producing L2-normalized 512-dimensional embeddings. New devices could then be enrolled by extracting features and storing them in an RFF database, while identification and rogue detection were performed with k-NN rather than retraining the network. On 60 commercial off-the-shelf LoRa devices, this framework achieved accuracy greater than 98.5% on seen devices, greater than 98.4% on unseen devices of the same model, up to 88.7% on unseen devices of different models, and rogue-device detection AUC up to 0.9905 (Shen et al., 2021).

Recent architectures have become more explicitly RF-specific. HyDRA combines optimized variational mode decomposition with CNNs, a Transformer Dynamic Sequence Encoder, and a Mamba Linear Flow Encoder, supporting both closed-set and open-set RFFI. On public WiSig benchmarks it reported up to 99.81% closed-set accuracy on WiSig SingleDay, 90.71% on WiSig ManyTx, and open-set accuracy up to 94.67%, with 8.4 ms inference on NVIDIA Jetson Xavier NX for the TDSE variant (Liu et al., 16 Jul 2025). SinFormer introduced a tailored Signal Inception Transformer with multi-scale self-attention and a two-stage training strategy based on masked autoencoding and supervised adaptation; it reported 99.6% accuracy for in-seen-session tests and retained greater than 89% identification accuracy on the 150-device WiSig dataset (Yang et al., 23 May 2026). These results suggest a broad architectural trend: RF-specific preprocessing, multi-scale sequence modeling, and pretraining are increasingly treated as first-class components of RFFI rather than optional refinements.

3. Robustness to receiver variation, channel distortion, and noise

Receiver dependence is one of the most consequential failure modes in practical RFFI. A receiver-agnostic LoRa study showed that conventional systems entangle transmitter fingerprints with receiver impairments, leading to severe degradation when the receiver changes or drifts over time; the same work reports a 40% accuracy loss over four days with low-cost SDRs in controlled experiments and greater than 50–70% drops for conventional networks under receiver change (Shen et al., 2022). To suppress receiver-specific information, it used adversarial training with a feature extractor, a transmitter classifier, a receiver classifier, and a gradient reversal layer, updating feature parameters according to

$$\theta \leftarrow \theta - \mu \left(\frac{\partial L_{tx}}{\partial \theta} - \lambda \frac{\partial L_{rx}}{\partial \theta}\right).$$

With heterogeneous receiver training, the resulting network achieved over 75% accuracy on all 20 test receivers and exceeded 95% on all except the under-performing RTL-SDRs; fine-tuning then yielded up to 40% further improvement for difficult receivers, typically with no more than 50 packets per device (Shen et al., 2022).

A related strand formulates cross-receiver RFFI as domain adaptation or domain generalization. One method derived a theoretical upper bound for adaptation error and optimized two terms emphasized by that bound—domain discrepancy and pseudo-label error—through adversarial domain alignment and adaptive pseudo-labeling, outperforming DANN, MCD, and SHOT and approaching perfect accuracy on some transfer tasks (Yang et al., 2024). A complementary domain-generalization approach introduced the Separable Condition, decomposing latent variables into emitter-related and receiver-related components, and then built the Receiver-Independent Emitter Identification model and its federated variant FedRIEI. On the HackRF and Wisig datasets, RIEI improved over baseline by 10.84% and 20.74% on HackRF time-domain and time-frequency settings, while FedRIEI improved over a federated baseline by 11.24% on average (Zhang et al., 2024). A later disentanglement framework combined adversarial alignment, receiver-style regularization, and feature separation, reporting up to a 10% improvement in average accuracy across diverse receiver settings (Pan et al., 10 Oct 2025).

Channel robustness has been addressed both through handcrafted representations and through transfer or calibration modules. In time-varying LoRa channels, the PA nonlinearity quotient combined with transfer learning improved average classification accuracy by 33.3% in indoor environments and 34.5% in outdoor environments, reaching 99.4% and 98.2% respectively with 200 samples per device (Yang et al., 2024). For cross-receiver Wi-Fi under varying channels, DSQ preprocessing and a cascaded trainable calibration neural network with DSQ-based CNN reached over 90% accuracy at an SNR of 24 dB on target receivers (He et al., 9 Mar 2026). In IEEE 802.11 experiments spanning channel variations and a 5-month time span, spectral regrowth with CFO-assisted collaborative identification achieved an average classification accuracy of 92.76% (Xie et al., 2024).

Low-SNR operation remains another central stressor because RFF features are minute and easily masked by noise. In variable-length LoRa RFFI, online augmentation improved low-SNR classification accuracy by up to 50%, and multi-packet inference further increased accuracy by over 20% (Shen et al., 2022). In Wi-Fi, a denoise diffusion model trained as a noise predictor and used with SNR mapping and deterministic sampling improved classification accuracy by up to 34.9%, with the largest gains at 0 dB SNR and convergence with baseline methods beyond 20 dB (Yin et al., 7 Mar 2025).

4. Collaboration, enrollment, and open-set operation

A distinctive feature of recent RFFI systems is the use of multiple observations of the same transmission. In receiver-agnostic collaborative inference, each receiver independently produces a posterior vector and the outputs are fused centrally. The simplest rule averages probabilities,

$$\hat{p}^{fused} = \frac{1}{J}\sum_{j=1}^{J}\hat{p}^{j},$$

while an adaptive variant weights each receiver by its estimated SNR. In balanced-SNR settings, collaborative fusion improved average accuracy by up to 20% over any single receiver, especially in the 15–20 dB range; in an office-building LoRaWAN emulation with three USRP N210 gateways, collaborative inference increased accuracy by 10–15% at low-SNR locations, reaching about 60–80% when single-receiver performance dropped to 40% (Shen et al., 2022).

Multi-antenna receivers provide a related but distinct collaboration mechanism. One study modeled independent oscillator distortions across antennas and proposed three schemes indexed by antenna count: Mutual Information Weighting Scheme for $N \leq 4$, Distortions Filtering Scheme for $4 < N \leq 128$, and Group-Distortions Filtering and Weighting Scheme for large $N$ at high SNR. For DFS, the residual filtering error was analyzed as

$$\tau \sim \mathcal{N}\left(0,\frac{\sigma_w^2}{N}\right),$$

which formalizes the reduction of residual noise and receiver distortion with antenna count (Chen et al., 2023). In a separate multi-antenna Wi-Fi system based on spectral regrowth, direct single-antenna identification achieved 68.6%, decision fusion raised this to 82.3%, and CFO-assisted hybrid fusion raised it further to 92.8% (Xie et al., 2024).

Scalability and open-set recognition require different mechanisms from ordinary closed-set classification. The deep metric-learning framework described earlier enables device join and leave operations without retraining because enrollment reduces to database update in the learned embedding space (Shen et al., 2021). For explicitly open environments, JRFFP-SC couples a prediction network with a Siamese comparison module: the first predicts the most probable known class, and the second compares the test sample with registered samples from that predicted class. On a 45-device LoRa dataset, it reported 98.47% closed-set accuracy for legitimate devices, AUC 0.979, and EER 0.061 for rogue detection (Cai et al., 26 Jan 2025). HyDRA extends this line with thresholded softmax-based open-set recognition and reported open-set accuracy up to 94.67% on public datasets (Liu et al., 16 Jul 2025).

Few-shot adaptation and pretraining have become increasingly important in this context. A three-stage framework combining unsupervised contrastive pretraining, Siamese-network fine-tuning, and inference reported over 90% accuracy in dynamic non-line-of-sight scenarios when only 20 packets per device were available. In a low-data regime with 20 packets per device for fine-tuning, pretraining improved accuracy from 25.9% to 77.2% (Ma et al., 12 Dec 2025). This suggests that open-set and receiver/channel-robust RFFI are converging toward representation-learning pipelines that are explicitly optimized for data efficiency.

5. Security, attack surfaces, and defensive mechanisms

RFFI is frequently presented as a lightweight authentication primitive, but the recent literature shows that deep learning-based RFFI is itself an attack surface. White-box attacks against LoRa RFFI demonstrated that CNN, LSTM, and GRU classifiers can all be forced into failure with small perturbations crafted by FGSM or PGD. Using the standard non-targeted FGSM form

$$x' = x + \varepsilon \cdot \operatorname{sign}\left(\nabla_x J(f(x;\theta), y)\right),$$

the study found that at PSR $$\widetilde{\boldsymbol{Q}} = 10 \log_{10}\left(\left| \boldsymbol{Q} \right|^2 \right).$$0 dB, PGD drove CNN misclassification success rate to 94.6% and FGSM to 92.7%; for targeted attacks, PGD caused 93.2% of packets to be classified as a chosen target device at PSR $$\widetilde{\boldsymbol{Q}} = 10 \log_{10}\left(\left| \boldsymbol{Q} \right|^2 \right).$$1 dB. It also showed that equivalent-power AWGN has negligible effect compared with adversarial perturbations (Ma et al., 2023).

A broader attack study extended this analysis to universal adversarial perturbations (UAPs) and emphasized wireless-specific issues such as real-time injection and temporal persistence. In practical black-box or grey-box conditions, UAPs achieved up to 88.2% misclassification on LSTM-based RFFI at PSR $$\widetilde{\boldsymbol{Q}} = 10 \log_{10}\left(\left| \boldsymbol{Q} \right|^2 \right).$$2 dB, and 81.7% success even when the adversary almost had no prior knowledge of the victim RFFI system. The same study reported that UAPs remained effective over time, enabling practical attacks without frequent regeneration (Ma et al., 12 Dec 2025).

Security concerns are not limited to evasion at inference time. In time-varying-channel LoRa RFFI, two impersonation-related threats were formalized: RFF contamination during enrollment and impersonation during authentication. For authentication-phase impersonation, the PA nonlinearity quotient plus transfer learning classifier achieved AUC $$\widetilde{\boldsymbol{Q}} = 10 \log_{10}\left(\left| \boldsymbol{Q} \right|^2 \right).$$3 indoors and $$\widetilde{\boldsymbol{Q}} = 10 \log_{10}\left(\left| \boldsymbol{Q} \right|^2 \right).$$4 outdoors. For enrollment-phase contamination, a keyless countermeasure compared softmax outputs from a transfer-learning model and a deep-learning-from-scratch model, then used one-class SVMs to detect anomalous posterior patterns; with 200 samples per device, it achieved AUC 0.987 indoors, 0.981 outdoors, and attack detection rates of 93% and 91%, corresponding to a 40.0% improvement in detection rate (Yang et al., 2024).

A common misconception is that physical-layer identification is inherently harder to subvert than higher-layer authentication. The adversarial and contamination results do not support that assumption. They instead indicate that RFFI must be evaluated simultaneously as a classifier, a deployment protocol, and a security mechanism.

6. Experimental practice and emerging directions

RFFI experiments now span a broad range of protocols, hardware populations, and deployment conditions. The literature includes LoRa case studies with 10 devices and 20 SDR receivers (Shen et al., 2022), 25 LoRa devices in anechoic, indoor, and outdoor environments (Yang et al., 2024), and 60 LoRa devices for scalable enrollment and rogue detection (Shen et al., 2021). Wi-Fi studies include 6 commercial off-the-shelf dongles captured by a USRP N210 (Yin et al., 7 Mar 2025), 10 IEEE 802.11 devices with a 4-antenna USRP X310 over a 5-month period (Xie et al., 2024), and large-scale WiSig settings with 150 devices or 174 transmitters and 41 receivers (Liu et al., 16 Jul 2025, Pan et al., 10 Oct 2025). These regimes have pushed evaluation beyond same-day, same-receiver benchmarks toward cross-day, cross-environment, cross-receiver, low-SNR, dynamic NLOS, open-set, and adversarial settings.

Common preprocessing stages recur across otherwise different systems: packet detection, synchronization, preamble or training-field extraction, CFO estimation and compensation, normalization, and transformation into spectrogram-like or quotient-based representations. Evaluation commonly varies SNR from 0 dB to 40 dB, compares static and mobile conditions, and studies receiver replacement, antenna polarization, or long-term drift (Shen et al., 2020, Yin et al., 7 Mar 2025, Shen et al., 2021). This convergence of evaluation practice reflects a field-wide recognition that same-domain train/test splits are insufficient for establishing practical RFFI reliability.

Several directions are now visible. Contrastive pretraining is being used to reduce dependence on labeled deployment data (Ma et al., 12 Dec 2025). Domain generalization and federated learning are being used to avoid centralized raw-signal collection while preserving cross-receiver performance (Zhang et al., 2024). Tailored transformer architectures are being designed specifically for RF signals rather than borrowed unchanged from NLP or vision (Yang et al., 23 May 2026). Edge deployment constraints are also becoming explicit, as seen in Jetson-based evaluation of open-set/closed-set models (Liu et al., 16 Jul 2025). At the same time, limited public training datasets remain an acknowledged bottleneck (Ma et al., 12 Dec 2025). A plausible implication is that future RFFI systems will integrate robust representations, pretraining, cross-domain adaptation, open-set rejection, and adversarial defense within a single pipeline rather than treating them as separate add-ons.