arXiv subjects

Guanxiong Shen

Publications and source records attributed to Guanxiong Shen.

17 recordsLinked to original sources

arXiv2026

Secrets in Preamble: Practical and Robust PHY Information Hiding for Wi-Fi

Physical layer (PHY) information hiding refers to the concealment of secrets within PHY waveforms without compromising the integrity of the primary communication link, thereby enabling critical applications such as covert communication, PHY steganography, and watermarking. The widespread deployment of Wi-Fi has motivated substantial research interest in hiding secrets within Wi-Fi waveforms. However, existing Wi-Fi information hiding approaches suffer from two limitations: restricted steganographic capacity and insufficient robustness against environmental variations, both of which severely constrain practical deployment. This work proposes to embed secrets within the Wi-Fi legacy short training field (L-STF). The designed method preserves the autocorrelation properties of Wi-Fi L-STF, ensuring that packet detection and coarse frequency offset compensation functionalities remain uncompromised. The secret embedding and extraction processes employ a pair of neural networks designed to learn optimal embedding rules and maximize steganographic capacity. We developed a prototype system and conducted comprehensive experiments across both indoor and outdoor environments. Experimental results show that our method can reliably embed 46 secret bits within Wi-Fi packets across diverse channel conditions, achieving significantly enhanced steganographic capacity and environmental robustness. The hardware prototype study validates the feasibility of the proposed Wi-Fi information hiding scheme.

cs.CR↗

arXiv2026

Secrets in Radio Waves: Towards Practical and Protocol-Agnostic PHY Information Hiding

Physical layer (PHY) information hiding supports critical applications, such as digital fingerprinting for transmitter identification and undetectable side channels for covert communication, and has attracted considerable attention from the research community. One category of prior studies focuses on theoretical analysis, proposing techniques such as artificial noise or reconfigurable intelligent surfaces to enable undetectable covert transmission. However, hardware prototypes are rarely presented due to their algorithmic complexity or hard-to-satisfy assumptions. Another category of studies focuses on system-level solutions, achieving PHY information hiding by customizing existing modulation schemes. However, these methods are typically designed for specific wireless protocols, limiting their generalizability. In this work, we introduce a new PHY information hiding paradigm that differs fundamentally from the previous two categories of approaches. Inspired by recent advancements in other domains such as image information hiding, we migrate encoder-decoder neural networks to the PHY information hiding field, embedding secrets by introducing imperceptible distortions within the preamble waveform. Sim-to-real fine-tuning is additionally proposed to tackle unique challenges, e.g., fading and hardware imperfections. The designed methodology is practical and protocol-agnostic. We provide case hardware prototypes of two commercially popular wireless technologies, i.e., LoRa and Bluetooth Low Energy (BLE), using commodity software-defined radio (SDR) transceivers, demonstrating excellent feasibility and generalizability.

eess.SP↗

arXiv2026

Practical Wi-Fi-based Motion Recognition Under Variable Traffic Patterns

Wi-Fi sensing detects human motions and activities by analysing the channel state information (CSI) derived from Wi-Fi transmissions. However, the impact of variable transmission traffic, which dictates the effective sampling rate and interval, is often overlooked. Existing Wi-Fi sensing systems are trained with fixed input size and sampling rate, which suffer from poor sampling rate generalisation. This paper proposes a novel Wi-Fi sensing approach for motion recognition applications, e.g., gesture and activity recognition, under variable traffic patterns. A sampling rate versatile neural network (SRV-NN) based on the transformer is proposed to efficiently handle variable input-sized sensing signals. A dynamic sampling rate augmentation is employed for variable sampling rates and intervals. To validate our approach, we have carried out extensive experimental evaluation, using two self-collected datasets, namely SRV activity and SRV gesture, as well as two publicly available datasets. Our method demonstrated exceptional performance and stability under variable sampling rates, with substantial improvements in average accuracy compared to baseline models without augmentation. The proposed approach significantly enhances stability by greatly reducing accuracy variance across different sampling rates.

cs.LG↗

arXiv2026

Hiding Secrets in the CSI Quotient: A Robust Wi-Fi CSI Steganography System

Physical layer (PHY) steganography conceals secrets by making subtle modifications to transmitted radio waveforms, which can be applied to establish covert communication systems. Given the widespread deployment of Wi-Fi infrastructures, hiding secrets within Wi-Fi transmissions exhibits significant covertness and has attracted increasing research attention. Recent advances in Wi-Fi steganography have focused on embedding secrets within channel state information (CSI) by applying artificial finite impulse response (FIR) filters to outgoing signals. These methods can emulate natural wireless propagation effects, thereby evading detection by eavesdroppers. However, existing CSI-based approaches suffer from two critical limitations: vulnerability to environmental variations and limited steganographic capacity. This work presents a Wi-Fi steganography system that mitigates these constraints. Specifically, we introduce a CSI division mechanism to decouple artificial CSI components from natural wireless channel responses. In essence, secrets are embedded within the quotient of two consecutive CSI measurements. Furthermore, we propose an encoder-decoder neural network framework that automatically learns optimal strategies for FIR filter generation and secret recovery, substantially enhancing steganographic capacity. We implemented a prototype using commercial off-the-shelf hardware, including a software-defined radio (SDR) transmitter and two receiver platforms: ANTSDR and ESP32. Experimental evaluations demonstrate that the system achieves robust performance under dynamic environmental conditions while significantly improving steganographic capacity.

eess.SP↗

arXiv2026

Secure Communication in MIMOME Movable-Antenna Systems with Statistical Eavesdropper CSI

This paper investigates the potential of movable antennas (MAs) to enhance physical layer security within a multiple-input multiple-output multiple-antenna eavesdropper (MIMOME) system. We consider a practical scenario where the transmitter operates with imperfect eavesdropper channel state information (ECSI), knowing only the instantaneous line-of-sight (LoS) component and the statistical properties of non-line-of-sight (NLoS) component. To rigorously quantify secrecy performance under the ECSI uncertainty, we adopt the ergodic secrecy rate (ESR) as the metric. Since deriving an exact analytical expression for the ESR is intractable, we leverage random matrix theory to derive a deterministic equivalent. This avoids heavy Monte Carlo simulations and also provides explicit insights into the effects of channel spatial statistics on secrecy performance. Building upon the deterministic equivalent, we formulate a joint maximization problem for the transmit precoding matrix and the antenna positions at the legitimate transmitter. To tackle the non-convexity of this optimization problem, we develop a comprehensive alternating optimization framework. Specifically, the precoding matrix is optimized via a majorization-minimization (MM) algorithm, where the gradient is computed by solving an implicit fixed-point equation. For the antenna position optimization, the complexity of the objective function prevents the construction of standard MM surrogate. To this end, we further propose a novel AMSGrad-based surrogate function that relies solely on gradient information. We provide a rigorous theoretical proof that guarantees the convergence of this proposed algorithm despite relaxing the strict majorization conditions.

cs.IT↗

arXiv2025

Securing Cross-Domain Internet of Drones: An RFF-PUF Allied Authenticated Key Exchange Protocol With Over-the-Air Enrollment

The Internet of Drones (IoD) is an emerging and crucial paradigm enabling advanced applications that require seamless, secure communication across heterogeneous and untrusted domains. In such environments, access control and the transmission of sensitive data pose significant security challenges for IoD systems, necessitating the design of lightweight mutual authentication and key exchange protocols. Existing solutions are often hampered by high computation overhead, reliance on third parties, the requirement for secret storage in resource-constrained drones, and the need for a strictly controlled enrollment environment. These limitations make them impractical for dynamic cross-domain deployment. To address these limitations, we propose a lightweight mutual authentication mechanism that integrates Radio Frequency Fingerprint (RFF) and Physical Unclonable Function (PUF) technologies for secure drone-to-drone (D2D) and drone-to-ground station server (D2G) communication. RFF-based device identification is used to achieve over-the-air (OTA) enrollment, while the PUF serves as the root of trust for establishing mutual authentication among communication parties. Additionally, the on-the-fly key generation capability of the PUF is co-designed with One-Time-Pad (OTP) encryption to realize ephemeral keying and eliminate the need for storing secrets within drones. Both informal security analysis and ProVerif-based formal security verification comprehensively demonstrate the resilience of our protocol against common security attacks. The proposed protocol also outperforms existing IoD authentication schemes in terms of security features, as well as computation, communication, and storage overhead.

cs.CR↗

arXiv2025

Adversarial Attacks Against Deep Learning-Based Radio Frequency Fingerprint Identification

Radio frequency fingerprint identification (RFFI) is an emerging technique for the lightweight authentication of wireless Internet of things (IoT) devices. RFFI exploits deep learning models to extract hardware impairments to uniquely identify wireless devices. Recent studies show deep learning-based RFFI is vulnerable to adversarial attacks. However, effective adversarial attacks against different types of RFFI classifiers have not yet been explored. In this paper, we carried out a comprehensive investigations into different adversarial attack methods on RFFI systems using various deep learning models. Three specific algorithms, fast gradient sign method (FGSM), projected gradient descent (PGD), and universal adversarial perturbation (UAP), were analyzed. The attacks were launched to LoRa-RFFI and the experimental results showed the generated perturbations were effective against convolutional neural networks (CNNs), long short-term memory (LSTM) networks, and gated recurrent units (GRU). We further used UAP to launch practical attacks. Special factors were considered for the wireless context, including implementing real-time attacks, the effectiveness of the attacks over a period of time, etc. Our experimental evaluation demonstrated that UAP can successfully launch adversarial attacks against the RFFI, achieving a success rate of 81.7% when the adversary almost has no prior knowledge of the victim RFFI systems.

cs.CR↗

arXiv2025

Towards Channel-Robust and Receiver-Independent Radio Frequency Fingerprint Identification

Radio frequency fingerprint identification (RFFI) is an emerging method for authenticating Internet of Things (IoT) devices. RFFI exploits the intrinsic and unique hardware imperfections for classifying IoT devices. Deep learning-based RFFI has shown excellent performance. However, there are still remaining research challenges, such as limited public training datasets as well as impacts of channel and receive effects. In this paper, we proposed a three-stage RFFI approach involving contrastive learning-enhanced pretraining, Siamese network-based classification network training, and inference. Specifically, we employed spectrogram as signal representation to decouple the transmitter impairments from channel effects and receiver impairments. We proposed an unsupervised contrastive learning method to pretrain a channel-robust RFF extractor. In addition, the Siamese network-based scheme is enhanced by data augmentation and contrastive loss, which is capable of jointly mitigating the effects of channel and receiver impairments. We carried out a comprehensive experimental evaluation using three public LoRa datasets and one self-collected LoRa dataset. The results demonstrated that our approach can effectively and simultaneously mitigate the effects of channel and receiver impairments. We also showed that pretraining can significantly reduce the required amount of the fine-tuning data. Our proposed approach achieved an accuracy of over 90% in dynamic non-line-of-sight (NLOS) scenarios when there are only 20 packets per device.

cs.CR↗

arXiv2025

Physical Layer-Based Device Fingerprinting for Wireless Security: From Theory to Practice

The identification of the devices from which a message is received is part of security mechanisms to ensure authentication in wireless communications. Conventional authentication approaches are cryptography-based, which, however, are usually computationally expensive and not adequate in the Internet of Things (IoT), where devices tend to be low-cost and with limited resources. This paper provides a comprehensive survey of physical layer-based device fingerprinting, which is an emerging device authentication for wireless security. In particular, this article focuses on hardware impairment-based identity authentication and channel features-based authentication. They are passive techniques that are readily applicable to legacy IoT devices. Their intrinsic hardware and channel features, algorithm design methodologies, application scenarios, and key research questions are extensively reviewed here. The remaining research challenges are discussed, and future work is suggested that can further enhance the physical layer-based device fingerprinting.

cs.CR↗

arXiv2024

Residual Channel Boosts Contrastive Learning for Radio Frequency Fingerprint Identification

In order to address the issue of limited data samples for the deployment of pre-trained models in unseen environments, this paper proposes a residual channel-based data augmentation strategy for Radio Frequency Fingerprint Identification (RFFI), coupled with a lightweight SimSiam contrastive learning framework. By applying least square (LS) and minimum mean square error (MMSE) channel estimations followed by equalization, signals with different residual channel effects are generated. These residual channels enable the model to learn more effective representations. Then the pre-trained model is fine-tuned with 1% samples in a novel environment for RFFI. Experimental results demonstrate that our method significantly enhances both feature extraction ability and generalization while requiring fewer samples and less time, making it suitable for practical wireless security applications.

eess.SP↗

arXiv2023

White-Box Adversarial Attacks on Deep Learning-Based Radio Frequency Fingerprint Identification

Radio frequency fingerprint identification (RFFI) is an emerging technique for the lightweight authentication of wireless Internet of things (IoT) devices. RFFI exploits unique hardware impairments as device identifiers, and deep learning is widely deployed as the feature extractor and classifier for RFFI. However, deep learning is vulnerable to adversarial attacks, where adversarial examples are generated by adding perturbation to clean data for causing the classifier to make wrong predictions. Deep learning-based RFFI has been shown to be vulnerable to such attacks, however, there is currently no exploration of effective adversarial attacks against a diversity of RFFI classifiers. In this paper, we report on investigations into white-box attacks (non-targeted and targeted) using two approaches, namely the fast gradient sign method (FGSM) and projected gradient descent (PGD). A LoRa testbed was built and real datasets were collected. These adversarial examples have been experimentally demonstrated to be effective against convolutional neural networks (CNNs), long short-term memory (LSTM) networks, and gated recurrent units (GRU).

cs.CR↗

arXiv2022

Towards Receiver-Agnostic and Collaborative Radio Frequency Fingerprint Identification

Radio frequency fingerprint identification (RFFI) is an emerging device authentication technique, which exploits the hardware characteristics of the RF front-end as device identifiers. RFFI is implemented in the wireless receiver and acts to extract the transmitter impairments and then perform classification. The receiver hardware impairments will actually interfere with the feature extraction process, but its effect and mitigation have not been comprehensively studied. In this paper, we propose a receiver-agnostic RFFI system that is not sensitive to the changes in receiver characteristics; it is implemented by employing adversarial training to learn the receiver-independent features. Moreover, when there are multiple receivers, this functionality can perform collaborative inference to enhance classification accuracy. Finally, we show how it is possible to leverage fine-tuning for further improvement with fewer collected signals. To validate the approach, we have conducted extensive experimental evaluation by applying the approach to a LoRaWAN case study involving ten LoRa devices and 20 software-defined radio (SDR) receivers. The results show that receiver-agnostic training enables the trained neural network to become robust to changes in receiver characteristics. The collaborative inference improves classification accuracy by up to 20% beyond a single-receiver RFFI system and fine-tuning can bring a 40% improvement for under-performing receivers.

eess.SP↗

arXiv2022

Towards Length-Versatile and Noise-Robust Radio Frequency Fingerprint Identification

Radio frequency fingerprint identification (RFFI) can classify wireless devices by analyzing the signal distortions caused by the intrinsic hardware impairments. State-of-the-art neural networks have been adopted for RFFI. However, many neural networks, e.g., multilayer perceptron (MLP) and convolutional neural network (CNN), require fixed-size input data. In addition, many IoT devices work in low signal-to-noise ratio (SNR) scenarios but the RFFI performance in such scenarios is rarely investigated. In this paper, we analyze the reason why MLP- and CNN-based RFFI systems are constrained by the input size. To overcome this, we propose four neural networks that can process signals of variable lengths, namely flatten-free CNN, long short-term memory (LSTM) network, gated recurrent unit (GRU) network and transformer. We adopt data augmentation during training which can significantly improve the model's robustness to noise. We compare two augmentation schemes, namely offline and online augmentation. The results show the online one performs better. During the inference, a multi-packet inference approach is further leveraged to improve the classification accuracy in low SNR scenarios. We take LoRa as a case study and evaluate the system by classifying 10 commercial-off-the-shelf LoRa devices in various SNR conditions. The online augmentation can boost the low-SNR classification accuracy by up to 50% and the multi-packet inference approach can further increase the accuracy by over 20%.

eess.SP↗

arXiv2022

FewSense, Towards a Scalable and Cross-Domain Wi-Fi Sensing System Using Few-Shot Learning

Wi-Fi sensing can classify human activities because each activity causes unique changes to the channel state information (CSI). Existing WiFi sensing suffers from limited scalability as the system needs to be retrained whenever new activities are added, which cause overheads of data collection and retraining. Cross-domain sensing may fail because the mapping between activities and CSI variations is destroyed when a different environment or user (domain) is involved. This paper proposed a few-shot learning-based WiFi sensing system, named FewSense, which can recognise novel classes in unseen domains with only few samples. Specifically, a feature extractor was pre-trained offline using the source domain data. When the system was applied in the target domain, few samples were used to fine-tune the feature extractor for domain adaptation. Inference was made by computing the cosine similarity. FewSense can further boost the classification accuracy by collaboratively fusing inference from multiple receivers. We evaluated the performance using three public datasets, i.e., SignFi, Widar, and Wiar. The results show that FewSense with five-shot learning recognised novel classes in unseen domains with an accuracy of 90.3\%, 96.5\% ,82.7\% on SignFi, Widar, and Wiar datasets, respectively. Our collaborative sensing model improved system performance by an average of 30\%.

eess.SP↗

arXiv2021

Radio Frequency Fingerprint Identification for Security in Low-Cost IoT Devices

Radio frequency fingerprint identification (RFFI) can uniquely classify wireless devices by analyzing the received signal distortions caused by the intrinsic hardware impairments. The state-of-the-art deep learning techniques such as convolutional neural network (CNN) have been adopted to classify IoT devices with high accuracy. However, deep learning-based RFFI requires input data of a fixed size. In addition, many IoT devices work in low signal-to-noise ratio (SNR) scenarios but the low SNR RFFI is rarely investigated. In this paper, the state-of-the-art transformer model is used as the classifier, which can process signals of variable length. Data augmentation is adopted to improve low SNR RFFI performance. A multi-packet inference approach is further proposed to improve the classification accuracy in low SNR scenarios. We take LoRa as a case study and evaluate the system by classifying 10 commercial-off-the-shelf LoRa devices in various SNR conditions. The online augmentation can boost the low SNR RFFI performance by up to 50% and multi-packet inference can further increase it by over 20%.

eess.SP↗

arXiv2021

Towards Scalable and Channel-Robust Radio Frequency Fingerprint Identification for LoRa

Radio frequency fingerprint identification (RFFI) is a promising device authentication technique based on the transmitter hardware impairments. In this paper, we propose a scalable and robust RFFI framework achieved by deep learning powered radio frequency fingerprint (RFF) extractor. Specifically, we leverage the deep metric learning to train an RFF extractor, which has excellent generalization ability and can extract RFFs from previously unseen devices. Any devices can be enrolled via the pre-trained RFF extractor and the RFF database can be maintained efficiently for allowing devices to join and leave. Wireless channel impacts the RFF extraction and is tackled by exploiting channel independent feature and data augmentation. We carried out extensive experimental evaluation involving 60 commercial off-the-shelf LoRa devices and a USRP N210 software defined radio platform. The results have successfully demonstrated that our framework can achieve excellent generalization abilities for device classification and rogue device detection as well as effective channel mitigation.

eess.SP↗

arXiv2020

Radio Frequency Fingerprint Identification for LoRa Using Spectrogram and CNN

Radio frequency fingerprint identification (RFFI) is an emerging device authentication technique that relies on intrinsic hardware characteristics of wireless devices. We designed an RFFI scheme for Long Range (LoRa) systems based on spectrogram and convolutional neural network (CNN). Specifically, we used spectrogram to represent the fine-grained time-frequency characteristics of LoRa signals. In addition, we revealed that the instantaneous carrier frequency offset (CFO) is drifting, which will result in misclassification and significantly compromise the system stability; we demonstrated CFO compensation is an effective mitigation. Finally, we designed a hybrid classifier that can adjust CNN outputs with the estimated CFO. The mean value of CFO remains relatively stable, hence it can be used to rule out CNN predictions whose estimated CFO falls out of the range. We performed experiments in real wireless environments using 20 LoRa devices under test (DUTs) and a Universal Software Radio Peripheral (USRP) N210 receiver. By comparing with the IQ-based and FFT-based RFFI schemes, our spectrogram-based scheme can reach the best classification accuracy, i.e., 97.61% for 20 LoRa DUTs.

eess.SP↗