Organizations: Sorbonne Universit´e, CNRS, LIP6, Paris, France
Abstract
Covert channels (CCs) in wireless chips pose a serious security threat, as they enable the exfiltration of sensitive information from the chip to an external attacker. In this work, we propose an AI-based defense mechanism deployed at the RF receiver, where the model directly monitors raw I/Q samples to detect, in real time, the presence of a CC embedded within an otherwise nominal signal. We first compact a state-of-the-art convolutional neural network (CNN), achieving an 80% reduction in parameters, which is an essential requirement for efficient edge deployment. When evaluated on the open-source hardware Trojan (HT)-based CC dataset, the compacted CNN attains an average accuracy of 90.28% for CC detection and 86.50% for identifying the underlying HT, with results averaged across SNR values above 1 dB. For practical communication scenarios where SNR > 20 dB, the model achieves over 97% accuracy for both tasks. These results correspond to a minimal performance degradation of less than 2% compared to the baseline model. The compacted CNN is further benchmarked against alternative classifiers, demonstrating an excellent accuracy-model size trade-off. Finally, we design a lightweight CNN hardware accelerator and demonstrate it on an FPGA, achieving very low resource utilization and an efficiency of 107 GOPs/W. Being the first AI hardware accelerator proposed specifically for CC detection, we compare it against state-of-the-art AI accelerators for RF signal classification tasks such as modulation recognition, showing superior performance.
The increasing use of first-person-view drones in modern conflicts has created a demand for compact and reliable detection systems capable of operating in complex electromagnetic environments. These drones continuously transmit video signals through onboard video transmitters, generating radio-frequency emissions that can be exploited for early detection. This study investigates the use of lightweight convolutional neural networks for automated detection of drone signals captured by a software-defined radio-based electronic warfare framework. Samples are converted into rasterized time-domain images, providing a computationally efficient input representation suitable for embedded systems. Several custom model architectures were designed and benchmarked in terms of accuracy, model size, and inference performance using a dataset containing approximately 40,000 labeled images. In addition to offline testing, the models were integrated into a GNU Radio signal processing chain for real-time evaluation. The results show that compact models can achieve high detection accuracy while maintaining low computational requirements, making them suitable for embedded radio-frequency monitoring applications. Compared with existing spectrogram-based RF detection methods, the proposed approach eliminates frequency-domain preprocessing and achieves comparable accuracy with significantly reduced computational cost.
Radio frequency fingerprint identification (RFFI) provides a critical physical-layer security mechanism for dynamic Internet of Things (IoT) and ad hoc networks. However, the decentralized and open nature of these networks imposes two strict deployment criteria: the credential must transfer reliably across physically dispersed, heterogeneous receivers, and it must decisively reject unregistered rogue traffic. Cross-receiver hardware shifts depress the confidence of registered devices and may also place unseen rogue transmitters in high-confidence known regions under naive domain adaptation, increasing false acceptance. To address these risks, we propose CRODA-ST, a joint optimization framework that couples Discriminative Structure Anchoring (DSA) with Rejection Oriented Alignment (ROA). Within this coupled objective, DSA establishes a stable target-known semantic foundation for shifted registered devices, while ROA regularizes the open-set decision boundaries governing rejection of unseen rogue transmitters. In the canonical WiSig setting, CRODA-ST achieves an open-set classification rate (OSCR) of 0.9580 and a target-domain false positive rate of 0.0469 at a 90% true positive rate (FPR90). A controllable LoRa simulation provides a complementary diagnostic under synthesized hardware distortions. At the distinct source-calibrated deployment operating point with rho = 0.80, CRODA-ST yields a target-unknown false acceptance rate (FAR) of 0.0075 in the evaluated setting.
Human Action Recognition (HAR) using WiFi Channel State Information (CSI) has gained increasing attention due to its non-contact, low-cost, and privacy-preserving nature. However, existing learning-based approaches largely rely on deep, computationally intensive architectures to implicitly capture motion dynamics from CSI measurements, thereby increasing model complexity and reducing efficiency. Instead, we argue that incorporating appropriate inductive biases tailored to the physical characteristics of CSI signals enables more efficient and effective learning. In this work, we propose a compact temporal convolutional network (TCN)-based framework that explicitly incorporates motion-aware inductive biases into feature learning. Specifically, we introduce a Doppler-energy-guided temporal attention mechanism in feature space to emphasize motion-salient time segments, and a variance-driven channel attention module to weight informative subcarriers based on temporal motion statistics adaptively. By integrating these domain-specific priors, the proposed model effectively captures motion dynamics without increasing architectural depth. Extensive experiments on multiple benchmark datasets demonstrate that our approach achieves superior performance compared to deeper baselines, while significantly reducing parameter count and computational cost.