Detecting Swapped Hardware with a Neural Network That Understands Polarization

Wireless devices broadcast signals that carry subtle physical signatures, shaped by the antenna, RF front end, and digital baseband hardware inside the device. Replace one of those components and the signal changes in ways that are hard to see with the naked eye but measurable with the right tools. The problem is that a device can keep its logical identity, its MAC address, its cryptographic keys, all while its physical implementation has been swapped out. For network operators, regulators, and security teams, this creates a gap: the device says it's the same, but its hardware is not.

The standard approach to catching this is polarization fingerprinting (PF), which captures the complex relationship between two orthogonally polarized components of a received signal. More recently, researchers extended this to spatio-frequency polarization fingerprints (SFPFs), which organize polarization responses across multiple frequencies and multiple physical directions, giving a richer, two-dimensional picture of how a device radiates. But SFPFs present a representation learning challenge: the frequency and spatial dimensions have fundamentally different structures, and naive approaches that treat them like images or token sequences lose the physics that makes them useful.

A new paper proposes FreqSpaNet, a network designed from the ground up to respect the structure of SFPFs for open-set hardware anomaly detection. The results show a meaningful jump over generic approaches, with particular robustness across a range of hardware replacement scenarios.

Why SFPFs Don't Behave Like Images

An SFPF is a four-dimensional tensor. For each of 301 physical directions and 9 frequency points, the measurement captures 1,024 complex sampling points across two orthogonal polarization components. That's a lot of data, and the structure matters.

Along the frequency dimension, neighboring frequencies tend to produce correlated responses. If a device's signal at 913 MHz shows a particular polarization pattern, 913.5 MHz will usually show something similar. These local correlations carry device-specific information. Generic neural networks, whether convolutional or transformer-based, don't naturally capture this kind of local frequency dependency because they process SFPFs as flat sequences or treat them as images, ignoring the fact that adjacent frequencies are physically close while distant ones are not.

The spatial dimension is different. The 301 directions are defined by elevation and azimuth angles on a measurement grid, and the relationship between any two directions is governed by their angular separation, not by their position in a list. Two directions that are physically close in angle share similar radiation characteristics, even if they're far apart in the measurement order. The spatial structure is geometric, not sequential.

Hardware changes also affect these dimensions unevenly. Swapping an antenna might alter the spatial radiation pattern dramatically while leaving frequency responses relatively intact, or vice versa for a baseband module replacement. A representation that averages over both dimensions early, as generic architectures tend to do, risks washing out the signal that matters.

Dual-Branch Architecture with Geometry-Aware Attention

FreqSpaNet processes the SFPF through a shared encoder that converts each direction-frequency pair into a token. Two parallel branches then specialize. The frequency branch uses residual depthwise 1D convolution blocks to capture local variations across neighboring frequencies. The convolution kernels are small enough to pick up the smooth, physically grounded transitions between adjacent frequency points. Attention pooling aggregates frequency tokens within each direction, then combines all directions into a single frequency representation.

The spatial branch takes a different approach. Each direction is represented not just by its learned response features but by its physical coordinates. The direction is encoded as a 3D unit vector derived from its elevation and azimuth angles, supplemented by sine and cosine values of those angles. This coordinate descriptor feeds into an MLP that produces a direction embedding.

The key innovation is how the spatial branch models attention. Standard self-attention computes attention weights purely from learned features. FreqSpaNet adds an angular bias term to the attention computation:

P^(m) = softmax(Q^(m) K^(m)T / sqrt(d_m) + g_b^(m)(D))

where D is a matrix of angular separations between all pairs of directions, computed as the arccosine of their dot products as unit vectors. The function g_b maps these separations to attention biases. Directions that are physically close in angle get biased toward higher attention, regardless of their learned feature similarity. This bakes the geometric structure of the measurement into the model's inductive bias.

The two branch outputs are fused adaptively per sample. A fusion network reads variation statistics computed directly from the response amplitudes, one measuring frequency variation and one measuring spatial variation across an angular neighborhood graph. These statistics determine how much weight each branch gets, producing alpha coefficients that sum to one. The final representation concatenates three components: the weighted sum of branch outputs (branch contribution), their element-wise product (cross-branch agreement), and their absolute difference (complementary information). A fusion MLP maps this to the final SFPF representation.

Complementary Pretraining with Four Loss Terms

The pretraining stage is where FreqSpaNet learns to extract meaningful representations before any labeled data is used. Two views of each SFPF are created: a masked view where some responses are hidden, and a noisy view where noise is added. Both pass through the shared encoder with identical parameters, and the resulting representations are fed to a reconstruction decoder that tries to recover the masked responses. The reconstruction loss ensures the encoder preserves enough information to rebuild the original data.

A supervised contrastive loss aligns the representations from the two views, pushing representations of the same SFPF together and different SFPFs apart. But the distinctive contribution is the common-private decomposition. Two projection heads map the branch outputs to common representations (shared between branches) and private representations (unique to each branch). A cosine similarity loss aligns the common representations, capturing information that both frequency and spatial dimensions encode. A second cosine loss on the private representations prevents redundancy between them, ensuring each branch learns something the other doesn't.

The combined pretraining loss weights four terms: reconstruction, contrastive alignment, common information alignment, and private information decorrelation. This forces the frequency and spatial branches to share what they have in common while developing distinct specializations.

Open-Set Detection with Calibrated Score Fusion

After pretraining, the decoder and projection heads are removed. The encoder is fine-tuned with a linear classifier for the enrolled devices. The fine-tuning objective includes classification loss, a uniformity loss that pushes auxiliary outlier predictions toward uniform distributions, and an energy-based loss that separates enrolled from auxiliary samples. No hardware replacement samples appear during training, which is critical: the system must detect anomalies it has never seen.

At inference, four anomaly scores are extracted from the classifier outputs: energy score, maximum-probability uncertainty, normalized entropy, and probability-margin uncertainty. These four scores are standardized using known-device validation statistics and fused through a learned logistic function. The fusion parameters are learned from validation samples and auxiliary outliers, not from the actual hardware anomalies. A threshold is set at a 5% false-alarm rate on the validation set, and samples exceeding it are flagged as anomalies.

Experimental Setup and Results

The experimental setup uses ten wireless devices with a USRP X310 receiver and an orthogonal dual-polarized antenna placed 3 meters away. Measurements span 913 to 917 MHz in 0.5 MHz steps, with 1,024 complex samples per angle-frequency pair. The elevation ranges from 0 to 60 degrees and azimuth from 0 to 120 degrees, both in 5-degree steps, giving 301 directions and 9 frequency points per SFPF.

Five enrolled devices serve as attack targets, each paired with non-reused replacement hardware. Seven replacement scenarios are tested: antenna only (A), digital/baseband only (D), RF front-end only (R), and all pairwise and triple combinations (A+D, A+R, D+R, A+D+R). Each enrolled device contributes 600 normal SFPFs for training at 20 dB SNR, 100 for validation, and 241 test samples per device per condition across SNR levels from 0 to 20 dB in 1 dB steps.

Generic open-set baselines include ResNet-18, ViT-B/16, ViT-Tiny/16, and MAE-B/16, evaluated with MSP, energy scoring, OpenMax, outlier exposure, and Deep-SVDD. FreqSpaNet achieves a mean AUROC of 96.31% across all SNR levels, exceeding the best baseline (ResNet-18+MSP at 87.26%) by 9.05 percentage points. It also maintains the highest AUROC at every tested SNR level and achieves a mean unknown-class F1-score of 89.93%.

Under the seven hardware replacement scenarios, FreqSpaNet shows antenna replacement as the hardest case, with a mean AUROC of 85.30% and mean FPR95 of 24.87% at 0 to 5 dB. The other scenarios achieve mean FPR95 between 12.47% and 16.95% over the same range. From 15 to 20 dB, all seven scenarios converge to 99.33% AUROC, 95.45% F1-score, and 2.32% FPR95.

The ablation study confirms every component matters. Frequency-only and spatial-only variants both drop balanced accuracy by more than 7 points. Removing direction encoding pushes FPR95 from 12.30% to 31.89%. Removing angular bias raises it to 21.53%. Fixed (non-adaptive) fusion yields 26.13% FPR95. Dropping reconstruction loss gives 25.38%, contrastive loss gives 45.61%, and the common-private decomposition gives 38.52%. Each piece of the architecture contributes measurably to the final result.

Limitations and Trade-offs

The system requires a calibration phase with known devices and auxiliary outliers to set the anomaly threshold. This assumes access to a representative validation set and the ability to collect auxiliary samples from devices outside the enrolled set. In practice, the quality of these auxiliary samples affects how well the system generalizes to truly novel hardware replacements.

Antenna replacement remains the weakest case at low SNR. This is partly physical: the antenna is the element closest to the radiation pattern, so its replacement alters the spatial structure more than other components, but the frequency signature changes are subtler and harder to separate from noise. At higher SNR the system handles this well, but low-SNR deployments like long-range or heavily attenuated links may struggle.

The work assumes a controlled measurement setup with a motorized pan-tilt platform and fixed receiver at 3 meters. Deploying this in the field, where devices move, environments scatter signals, and measurement geometry varies, introduces additional challenges the paper does not address. The 301-direction measurement grid and 9 frequency points are specific to this setup, and generalizing to different hardware configurations or frequency bands would require re-collecting calibration data.

The evaluation covers 10 enrolled devices and 5 attack targets. Larger-scale deployments with hundreds or thousands of devices would test whether the representation learning scales and whether the auxiliary outlier strategy remains effective when the enrolled set is much larger.

What This Means for Hardware Security

FreqSpaNet demonstrates that treating SFPFs as structured physical data rather than generic images or sequences produces meaningfully better anomaly detection. The angular-aware attention mechanism in the spatial branch is a direct encoding of the measurement geometry, and the frequency branch's local convolutions respect the physical correlation structure of the frequency dimension. Together with the adaptive fusion and complementary pretraining, the system extracts representations that are both discriminative and robust.

For practitioners working on wireless device authentication, the key takeaway is that physical-layer fingerprinting benefits from domain-specific architecture. The 9-point AUROC improvement over generic baselines is not just a hyperparameter tuning win, it comes from encoding the physics of the measurement process into the network structure. The seven replacement scenarios provide a useful benchmark for comparing future approaches, particularly the finding that antenna replacement at low SNR remains the hard case.

The open-set formulation is also important. In real deployments, the set of possible hardware replacements is effectively unbounded. Training only on known device classes and expected anomalies would be brittle. The outlier exposure and energy-based detection approach gives the system a principled way to flag unknown anomalies without requiring a complete catalog of replacement hardware.

Read the paper on arXiv