arXiv CSopen access

AI-Enabled Covert Channel Detection in RF Receiver Architectures

1

AI-Enabled Covert Channel Detection in RF Receiver Architectures Abdelrahman Emad Abdelazim, Alán Rodrigo Dı́az-Rizo, Hassan Aboushady and Haralampos-G. Stratigopoulos

arXiv:2604.14987v1 [cs.AI] 16 Apr 2026

Sorbonne Université, CNRS, LIP6, Paris, France

Abstract—Covert channels (CCs) in wireless chips pose a serious security threat, as they enable the exfiltration of sensitive information from the chip to an external attacker. In this work, we propose an AI-based defense mechanism deployed at the RF receiver, where the model directly monitors raw I/Q samples to detect, in real time, the presence of a CC embedded within an otherwise nominal signal. We first compact a state-of-the-art convolutional neural network (CNN), achieving an 80% reduction in parameters, which is an essential requirement for efficient edge deployment. When evaluated on the open-source hardware Trojan (HT)-based CC dataset, the compacted CNN attains an average accuracy of 90.28% for CC detection and 86.50% for identifying the underlying HT, with results averaged across SNR values above 1 dB. For practical communication scenarios where SNR > 20 dB, the model achieves over 97% accuracy for both tasks. These results correspond to a minimal performance degradation of less than 2% compared to the baseline model. The compacted CNN is further benchmarked against alternative classifiers, demonstrating an excellent accuracy-model size tradeoff. Finally, we design a lightweight CNN hardware accelerator and demonstrate it on an FPGA, achieving very low resource utilization and an efficiency of 107 GOPs/W. Being the first AI hardware accelerator proposed specifically for CC detection, we compare it against state-of-the-art AI accelerators for RF signal classification tasks such as modulation recognition, showing superior performance. Index Terms—Hardware security, covert communication channels, AI-based attack detection, edge AI.

I. I NTRODUCTION Covert Channels (CCs) represent a significant security threat for wireless chips. A CC refers to a stealthy communication channel that leaks sensitive information via the RF transmitter, such as encryption keys, cryptographic operations, configuration states, etc. Recent work has even demonstrated that entire AI models can be exfiltrated through CCs [1]. In general, the attack works by routing the bits of the stolen information to the CC creation mechanism, which is responsible for embedding them into the RF transmission. Fig. 1 illustrates this threat model. The RF transmitter, a.k.a. Alice, is compromised with a CC creation mechanism that conceals sensitive information within an otherwise legitimate signal. The nominal RF receiver communicating with Alice, a.k.a. Bob, is inconspicuous and unaware of information leakage. A rogue RF receiver or eavesdropper, a.k.a. Eve, intercepts the transmission and, knowing how the CC operates, recovers the leaked bits. For instance, obtaining the cipher key would subsequently allow Eve to decrypt the communication. The leaked data is referred to as This work was supported by the Chips JU project Resilient Trust under Grant agreement No 101112282.

Fig. 1: Covert channel threat model.

covert data, whereas the legitimate message is referred to as cover data. The CC creation mechanism can itself be viewed as a Hardware Trojan (HT), which is why we use the term HTbased CC (HT-CC) in this work. HTs represent a broader threat model, encompassing any malicious modification of hardware [2]–[8]. In general, a HT consists of two main components: a trigger and a payload. The trigger can be random, controlled, or always-on, while the payload, besides information leakage, may perform actions such as performance degradation or even denial of service. Beyond trigger and payload types, HTs can be classified by their insertion phase in the Integrated Circuit (IC) supply chain, e.g., during Electronic Design Automation (EDA) tools usage, design, integration of thirdparty IP blocks into a System-on-Chip (SoC), or fabrication, their insertion level, e.g., Register-Transfer-Level (RTL), gatelevel, transistor-level, or layout, and their location on die, e.g., memory, processor, power management unit, analog and mixed-signal blocks, etc. For instance, in RF transceivers, a digital-to-analog attack [9], [10] is a plausible threat for inducing performance degradation or denial-of-service. In this scenario, a hidden trigger within a digital IP block of the SoC delivers a malicious digital word through the shared test infrastructure to the RF transceiver, thereby modifying its configuration. This type of attack can be detected at run time using lightweight on-chip monitors integrated into the RF transceiver [11]. Numerous works have showcased different implementations of HT-CCs for RF transceivers [12]–[25]. Simultaneously, these works propose defense strategies to identify the HT-CC either at time zero using testing or on-line at run-time while the system is operating. A more detailed examination of existing HT-CC designs and their corresponding defenses is provided

2

in Section II. In particular, AI-based detection of CCs has proven highly effective [26]. Since the covert data resides in the digital I/Q samples of each transmission frame, captured at the output of the RF receiver’s Analog-to-Digital Converters (ADCs), the approach is to encode these samples as “images” and apply a Convolutional Neural Network (CNN) to identify the presence of a CC. An open-source hardware-generated HT-CC dataset, introduced in [26] and detailed further in Section III, was used to train the CNN. This dataset contains transmission frames from RF transmitters with HT-CC capability and incorporates four prominent HT-CC techniques [13], [14], [18], [22], representing the major methods for embedding CCs into transmitted signals. Results showed that the CNN can not only distinguish CC-infected frames from CC-free ones but also identify the specific HT mechanism responsible for the creation of the CC. Executing the CNN model directly on-chip is the ideal approach, as sending transmission frames to the cloud for inference raises privacy concerns, increases power consumption, and introduces latency in CC detection. In this work, we advance beyond [26] by designing a lightweight CNN model with ≈ 80% fewer parameters and less than 2% accuracy drop compared to the baseline CNN model in [26], enabling efficient on-chip execution. We also design a dedicated CNN hardware accelerator tailored to this task, suitable for integration into an RF transceiver for realtime CC detection under strict area and power constraints, and we demonstrate a first prototype on an FPGA. The remainder of the article is organized as follows. Section II reviews prior work on HT-CC attacks and existing defense mechanisms. Section III introduces the HT-CC dataset, detailing the implemented attacks and data acquisition process. In Section IV, we motivate the choice of on-chip CNN execution and describe the RF receiver architecture featuring the integrated CNN hardware accelerator. Section V outlines all evaluated classifiers and elaborates on the design decisions behind the proposed compact CNN model. Section VI presents the architecture of the CNN hardware accelerator. Section VII reports the HT-CC detection performance, and Section VIII compares our accelerator with state-of-the-art solutions. Finally, Section IX concludes the paper. II. P RIOR A RT ON HT-CC S Table I provides a concise summary of existing HT-CC attack models and corresponding defenses. These will be analyzed next in more detail. A. HT-CC attack models The adversary can hide the HT inside the digital section of the RF transceiver, e.g., at the Medium Access Control (MAC) [12] or baseband physical (PHY) layers [13], [14], [17]–[19], [23]–[25]. Inside the PHY layer, the HT can act on the preamble generation [14], [18], payload generation [13], [14], [19], [24], Orthogonal Frequency-Division Multiplexing (OFDM) symbol generation [14], [15], or Forward Error Correction (FEC) block [17], or can leverage spread spectrum techniques [23], [25]. Another category of HTs acts on the

Analog Front-End (AFE) of the RF transceiver [20]–[22]. A short description of the attack models is given in the second column of Table I. The HT-CC attack models that are included in the HT-CC dataset used to train the CNN model are indicated with a check mark in the last column of Table I and will be described in more detail in Section III. It should be noted that there also exist HTs that induce physical side-channels to convey secret information in short range [29]. Herein, we consider only HTs that leak information in a CC in wireless technologies. B. HT-CC defenses The aforementioned works also assess resilience against various defenses, and in most cases identify at least one effective defense, as indicated in the third column of Table I. All defenses listed in Table I operate post-silicon, either at test time or run time. We categorize them into two primary groups: non-AI and AI-based HT-CC detection methods focusing specifically on detecting the CC within the received RF signal. In addition, we discuss two further categories: HT-CC prevention methods that impede the feasibility of the HT-CC attack, and generic HT defenses that apply to any HT threat and either detect the underlying HT mechanism at pre-silicon or post-silicon or prevent HT insertion. 1) Non-AI HT-CC detection defenses: These defenses can be divided into two sub-categories: standard measurements at test time that verify compliance with the communication protocol, and specialized techniques at run-time designed to detect HT-related activity. Standard measurements include evaluating Signal-to-Noise Ratio (SNR), Error Vector Magnitude (EVM), Bit Error Rate (BER), checking adherence to spectral mask specifications, and analyzing I/Q constellation diagrams. Specialized techniques at run-time include Adaptive Channel Estimation (ACE) [22], channel noise profiling [17], and invariant side-channel fingerprinting [28]. The ACE defense leverages the slow-fading characteristics of indoor communication channels to distinguish between channel impairments and HT activity. Channel noise profiling involves characterizing the distribution of noise present in the communication channel. The goal is to identify any unexpected systematic components that could potentially be attributed to HT activity. Invariant side-channel fingerprinting consists of creating an invariant fingerprint on the power supply and continually checking its conformity concurrently with the normal operation, where non-compliance implies potential HT activity. 2) AI-based HT-CC detection: The non-AI HT-CC detection defenses discussed above are generally too complex to be applied systematically at run time in nominal RF receivers, as doing so would increase design effort, complexity, and cost. Most of these approaches also operate offline. They require prior data collection and off-chip processing, leading to CC detection latency. Moreover, each method typically targets only specific HT-CC attack models, meaning that multiple defenses must be combined to cover all known HT-CC attack types and provide maximum security, which further increases overall defense cost.

3

TABLE I: HT-CC attack models and defenses. Ref.

Attack model

Defense

[12]

Modifies the MAC layer Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) protocol to leak data into the timings of the transmitted packet sequence. Encodes leaked data on the I/Q mapping and hides the encoding by introducing imperfections to the transmitted signal. Leaks data by introducing an additional phase shift into all STS symbols of the preamble. Leaks data by introducing artificial CFO into each OFDM symbol. Leaks data in extra camouflage subcarriers added to the OFDM signal. Leaks data into replaced parts of the OFDM Cyclic Prefix (CP). Leaks data using spread spectrum techniques. Leaks data via a chaos-based spreading code and embeds the key below the noise floor. Leaks data by substituting some legitimate data in the FEC block. Leaks data into controlled artificial RF impairments. Leaks data through amplitude modulation (denoted by α) of some subcarriers in the STS of the preamble. Leaks data by modulating amplitude and/or frequency of transmitted signal.

Evades statistical tests that detect covert timing channels. No other defense is studied.

[13], [19] [14]-1 [14]-2 [14]-3, [15] [14]-4, [16] [23] [25] [17] [24] [18] [20]–[22]

An alternative direction is to employ Machine Learning (ML) or AI techniques. Statistical Side- Channel Fingerprinting (SSCF) [21], [22] was the first ML-based approach demonstrated for HT-CC detection. It consists of training a oneclass classifier in a feature space composed of side-channel fingerprints or parametric measurements from golden HT-free devices. The HT-infected devices have a feature vector that lies outside the classification boundary and, thereby, can be distinguished from HT-free devices. In [21], [22], features are collected on the transmitted power, then Principal Component Analysis (PCA) is applied for feature dimensionality reduction. A one-class Support Vector Machine (SVM) is trained to learn the trusted boundary enclosing the HT-free population. The evaluation metrics are false positives (i.e., CC-free transmissions classified as CC-infected) and false negatives (i.e., CC-infected transmissions that evade detection). However, while it has shown to be efficient for HT-CCs systematically distorting the transmission power [20], [21], it has failed to screen out infected devices for more complex HTCCs, such as the HT-CCs presented in [18], [22]. The reason is that RF receivers employ channel estimation algorithms that bundle together any malicious disturbances introduced by a HT with the inherent non-idealities of the wireless channel, i.e., the HT activity will be estimated along with the channel conditions and will be equalized or neutralized. In general, process variations within the transmitter hardware, noise, and channel effects make it extremely challenging for the SVM classifier in SSCF to distinguish in a space of parametric measurements the covert channel from the actual transmitted signal for all HT-CCs attack models. In [26], it was proposed instead to train a more complex ML model, in particular a CNN, on raw transmission data rather than on derived parametric measurements. The results on the dataset described in Section III showed that the CNN could

Certain tests, such as EVM, show a distinguishing behavior compared to HT-free operation; detectable by the AI-based defense [26]. Analysis of the preamble constellation; detectable by the AIbased defense [26]. Analysis of CFO changes over time.

Present in the dataset

✓ ✓

Decode the signal field to determine if the number of subcarriers is correct. Compare the last 16 samples of an OFDM symbol with its CP; spectral analysis. Spectral analysis. No defenses are studied. Channel noise profiling. No defenses are studied. Detectable by the AI-based defense [26] but evades any other known defense for α <15%. SSCF; ACE; use hardware dithering as a prevention mechanism [27]; checking compliance of an invariant side-channel fingerprint [28]; detectable by the AI-based defense [26].

✓ ✓

not only detect CC activity, but also identify the specific HT mechanism embedded in the RF transmitter, achieving over 99% detection accuracy in the SNR range of interest. Building on this prior work, we propose a compact CNN model with ≈ 80% less parameters with respect to the baseline CNN model in [26] at the expense of a small accuracy loss of ≈ 2%, and we designed a lightweight CNN hardware accelerator tailored for this task, demonstrating its implementation on an FPGA. 3) HT-CC prevention defenses: Proactive measures can be taken during the design phase aiming at preventing the insertion of HT-CCs into RF transceiver ICs. Techniques that can be used include encrypting the PHY layer to prevent manin-the-middle attacks such as eavesdropping [30] and design obfuscation techniques, such as RF transceiver functionality locking [31]–[33] and layout camouflaging [34]. These design obfuscation strategies aim at obscuring circuit functionality, thereby making it significantly more difficult for an attacker to introduce the HT mechanism. Another strategy is to challenge the operational principles of HTs, aiming to neutralize their impact. An example here is the hardware dithering technique proposed in [27]. 4) Generic HT detection and prevention methods: There are numerous generic pre-silicon and post-silicon HT detection countermeasures proposed in the literature [2]–[8]. These countermeasures target primarily digital circuits and are potentially applicable for HTs residing in the PHY layer of the RF transceiver, although they have not yet been investigated in this context. At pre-silicon, the RF transceiver owner can analyze the final IC prior to fabrication to detect HTs inserted by a rogue employee, an untrusted EDA tool provider, or a third-party IP vendor whose IP is integrated into the IC. Techniques include: verification and structural analysis of third-party IP blocks [35]; simulation of test patterns using logic testing tools to expose the HT [36]; specific simulation benches

4

TABLE II: Frequency-domain representation of the STS (STSF ) within the preamble of a WiFi frame.

Fig. 2: PPDU frame format of an OFDM IEEE 802.11, a.k.a. WiFi, transmission. The red, blue, black, and green Trojan horses depict the location of the covert message within the cover signal for HT1-CC, HT2-CC, HT3-CC, and HT4-CC, respectively.

to magnify the effect of the HT [37]; Information Flow Tracking (IFT) methods that track the propagation of sensitive data and verify that they do not reach unauthorized sites in the design [38]; Proof-Carrying Hardware (PCH) methods to ensure that the hardware implementation is equivalent to its design specification, thus leaving little space for malicious logic insertion [39]; extracting circuit netlist features and using ML techniques to differentiate between normal nets and HTinfected nets [40], [41]. However, the HT can be inserted at a later stage by a malicious foundry, thus a post-silicon HT detection method is more inclusive in terms of possible threat scenarios. Reverse engineering can be used to identify modifications in the IC [42], but this approach is destructive, thus limited to testing a small number of IC samples. At test time, one approach is to take advantage of the parametric variations caused by HT circuitry or HT activity aiming at exposing the HT by its effect on parametric measurements, i.e., power, temperature, electromagnetic profile, etc. [43]–[47]. This is the approach employed at run-time in SSCF, combined with ML, in particular an SVM, to distinguish HT-free from HT-infected devices. III. HT-CC DATASET A. Implemented HT-CC attacks description Here, we describe the four HT-CC types, indicated with check marks in the last column of Table I, that make up the dataset. 1) Cover signal: The PHY cover signal consists of Physical layer Protocol Data Unit (PPDU) frames. The format of an IEEE 802.11 PPDU frame, as defined in the IEEE 802.11 standard (commonly known as Wi-Fi) [48], is shown in Fig. 2. It is divided into three parts, namely preamble (a.k.a. SYNC), header (a.k.a. SIGNAL), and payload (a.k.a. DATA). The preamble section is composed of two different training sequences, namely a Short Training Sequence (STS) used for synchronization between the transmitter and the receiver, and a Long Training Sequence (LTS), used for estimating the center carrier frequency offset, as well as reference for generating the initial equalizer parameters. The header is composed of 1 OFDM symbol and describes the length of the packet, and the modulation and coding scheme of the following OFDM payload symbols. The payload is composed of several OFDM symbols depending of the type of transmitted frame. Each symbol is composed of subcarriers modulated either as BPSK, QPSK, 16-QAM, 64-QAM, or higher M-QAM constellations depending on the WiFi technology 2) Covert message generation:

STSF index (k)

Complex-value (I,Q)

-24, -16, -4, 12, 16, 20, 24 -20, -12, -8, 4, 8 others

1.472 + 1.472j -1.472 - 1.472j 0

a) Preamble modulation: A first approach is to hide the HT inside the PHY layer and make it modulate the STS of the preamble of the transmitted frame, as shown with the Trojan horses placed in the STS field of the frame in Fig. 2. The frequency-domain representation of the STS, denoted by STSF , is composed of 64 complex values, i.e., having real (I) and imaginary (Q) components, also called subcarriers or frequency bins, from the alphabet {−1.472−1.472j, 0, 1.472+ 1.472j}. The 64 subcarriers are indexed from -32 to 31, and there are 12 non-zero subcarriers, as shown in Table II. Fig. 3a shows a constellation diagram of the nominal STSF where the transmitted values, plotted as blue dots, fall near the expected constellation points, i.e., {−1.472−1.472j, 0, 1.472+1.472j}, indicated by black plus signs. The time-domain representation of the STS, denoted by STSt , is derived by performing an Inverse Fast Fourier Transform (IFFT) on the STSF . The PPDU STS is composed of two OFDM symbols and it is obtained by concatenating two and a half STSt . For simplicity, in the rest of the paper we will refer to STSF as STS. The dataset considers two implementations of this attack type, referred to as HT1-CC and HT2-CC, shown with the red and blue Trojan horses in Fig. 2, respectively. • HT1-CC [18]: The data are leaked through minute amplitude modulations of non-zero subcarriers of the STS. These subcarriers are called corrupted subcarriers. In particular, the amplitude of a corrupted subcarrier is reduced below a threshold level by multiplying it with α < 1 when the leaked bit is ‘1’. Otherwise, the amplitude is preserved for a leaked bit ‘0’. An amplitude modulation of 10%, i.e., α = 0.9, is used and there are 8 corrupted subcarriers per STS, thus the CC leaks 8bits per transmitted frame. Fig. 3b shows an example constellation diagram of the CC-infected STS where the leaked byte is composed of four ‘0’ bits and four ‘1’ bits. • HT2-CC [14]: The leaked data is encoded through a controlled counter-clockwise phase shift in all the STS subcarriers with respect to the CC-free constellation points. The number of possible phase shifts varies depending on the number of bits intended to be encoded and the shift amount in binary corresponds to the leaked byte. The CC implemented in the dataset leaks 8 covert bits per STS or per transmitted frame, resulting in 256 possible phase shifts. Fig. 3b shows an example constellation diagram. b) Payload modulation: • HT3-CC [13]: A second approach, called “dirty” constellations, is to hide the HT inside the PHY layer and make it modulate the covert message within the PPDU DATA field of the cover signal, as shown in Fig. 2 by a black Trojan horse. This approach takes advantage of hardware impairments and noisy channel conditions. More specifi-

5

(a) Nominal STS constellation diagram according to the standard [48].

(b) CC-infected STS constellation diagram in the case of HT1-CC [18] and HT2-CC [14].

Fig. 3: Covert message hidden in the preamble. Additive White Gaussian Noise (AWGN) has been added to the signals such that the subcarriers are not superposed for illustration purposes.

cally, the PPDU DATA is composed of a variable number of OFDM symbols depending on the frame type and payload length. In the dataset implementation, the OFDM symbols comprise 48 QPSK modulated subcarriers. Let us consider the QPSK constellation diagram in Fig. 4a. The attack can leak two bits per QPSK subcarrier. It chooses a subcarrier and displaces its constellation point according to the two bits being leaked. Essentially, using a QPSK cover point as origin there are four QPSK covert points. For example, if we want to leak bits ‘01’ we can displace the upper right point (i.e., cover point ‘11’) to the bottom right position (i.e., covert point ‘01’), as shown in Fig. 4a. Then, several operations are applied to the covert point to reduce the probability of detecting the CC: (a) the covert point approaches symmetrically around the origin up to a distance equal to that of the 64-QAM; (b) its position is randomized withp a Gaussian distribution within a dispersion radius r = 2/42; (c) it is rotated within r with a monotonically increasing angle θ with steps of 15o . Moreover, to avoid detecting HT activity, even when the HT is inactive, intentional distortions are added to the transmitted signal increasing the average EVM up to 10 dB within the allowed limits of the IEEE 802.11 standard. Therefore, it is worth noticing that a device infected with HT3-CC will always have a higher BER compared to a CC-free device. Fig. 4b depicts the outcome after these operations. In the dataset implementation, 5 “dirty” subcarriers per OFDM symbol

(a) Possible initial displacement of the cover point to create the covert point.

(b) Possible final positions of the covert point.

Fig. 4: “Dirty” constellations.

Fig. 5: Mean envelope of the CC-free signal and the CC-infected signal with the HT4-CC attack. The signal mean envelope is reduced for a leaked bit ‘0’, while it remains unchanged for a leaked bit ‘1’.

are used, thus 10 bits are leaked per OFDM symbol. c) Power modulation: • HT4-CC [22]: The fourth considered attack model inserts the HT into the AFE leaking data through minute modifications in the amplitude of the transmitted signal. In this way, the covert message is spread across the transmitted frame, as shown with the green color Trojan horse in Fig. 2. More specifically, RF transmitters use multiple programmable Variable Gain Amplifiers (VGAs) in the transmission chain to satisfy linearity and achieve desired performance specifications. A Serial Peripheral Interface (SPI) controls these VGAs through the PHY layer. The attack leaks secret information by systematically modifying the gain of the VGAs, creating minute variations in the transmit power, according to the leaked bits. In the

6

Fig. 6: Experimental setup for dataset generation.

dataset implementation, 8 bits are leaked per transmitted frame, where the amplitude is reduced by 20% for a leaked bit ‘0’, while it remains unchanged for a leaked bit ‘1’, as illustrated in Fig. 5. In [22], CC data rates of 2.5 and 5 bits per second (bps) are reported. However, these rates are significantly slower with respect to other HT-CCs in the dataset, making it challenging to perform fair comparisons. For instance, the HT1-CC exhibits a leakage of 8 bits per frame, resulting in a CC data rate of 28 kbps when considering a nominal number of frames per second (fps) of 3,500 at a data rate of 54 Mbps. This CC data rate is 5,600 times larger than that of the HT4CC. Hence, it was decided to increase the throughput of the HT4-CC using a digitally-emulated version of the HT4-CC, leaking 8 bits per transmitted frame. B. HT-CC Dataset Acquisition The dataset is generated using the Software Defined Radio (SDR) bladeRF board from Nuand [49]. The hardware acquisitions are performed using a single board, by connecting the RF transmitter with the RF receiver in loopback mode via an SMA cable, as shown in Fig. 6. The PHY layer implemented in MATLAB prepares the PPDU frames of the transmitted signal, shown in Fig. 2, then the frames are transmitted using the RF transmitter of the board. While a CC-free transmission is composed of PPDU frames as defined by the IEEE 802.11 standard [48], a CC-infected transmission has a CC embedded into the PPDU frames leaking secret information as described in Section III-A. The dataset is organized into 5 parts corresponding to the 4 HT-CCs described in Section III-A, denoted by HTX-CC, X={1, · · · , 4}, and the CC-free signal. Each part consists of 16 elements representing 2 acquisitions with 8 different SNR values ranging from 1 to 29 dB with a step of 4 dB. Each element consists of 2000 fixed-length OFDM IEEE 802.11 frames, where each frame contains 2 × 640 real-value samples corresponding to the two I/Q branches. The leaked message is common to all attack models. It is formed of random binary data, it has a length of 11 bytes, and it is repeated continuously. As the received signal passes through different digital and analog hardware components, every received sample is affected by hardware impairments that impact the signal at baseband and RF, e.g., flicker noise, quantification error, DC offset (DCO), IQ imbalance (IQI), carrier frequency offset (CFO), phase noise, and jitter. Moreover, although the SMA connection reduces channel impairments, the test environment is not noise-free, thus the SMA cable loopback connection

Fig. 7: Ten concatenated acquisitions forming a multi-acquisition of the CC-free signal.

is affected by various noise sources, such as thermal noise or interference from other signals. Such impairments in the dataset signals are not compensated for after acquisition. However, a single long acquisition of 2000 frames has similar hardware and RF impairments conditions for all received frames. A richer dataset should take into account diverse hardware and RF impairments conditions, as well as hardware temperature. Hence, we performed ten smaller acquisitions of 200 frames and concatenated them to form a single 2000 frames multi-acquisition dataset element. In this way, each dataset element comprises signals with differently distributed non-idealities. As an example, Fig. 7 shows the concatenation of the 10 acquisitions of I/Q samples for the CC-free signal in the dataset. IV. RF T RANSCEIVER A RCHITECTURE WITH AI- BASED HT-CC DETECTION AI-based HT-CC detection operates as a run-time, postsilicon defense. Because it detects abnormalities directly in raw received transmission frames caused by CC activity, it offers a generic solution capable of addressing the wide range of existing HT-CC attack models, their growing sophistication, and even unknown or undocumented variants. Rather than relying on multiple combinations of countermeasures, as outlined in Section II, AI-based HT-CC provides a unified final line of defense. In [26], the emphasis is placed on designing the CNN model, but the work does not address where the model should reside and inference should be performed. We identify three possible locations for executing CNN inference: on the HTinfected RF transmitter (Alice), in the cloud which would require Alice or the nominal RF receiver (Bob) to forward the signal upstream, or on Bob itself, which would necessitate integrating a CNN hardware accelerator on-chip. Placing the CNN model on Alice is not a secure option, since the same sophisticated attacker who inserted the HT could also tamper with the local CNN inference to suppress any alerts indicating CC activity. On the other hand, having Alice (Bob) verifying the integrity of its transmitted (received) signal by retransmitting the signal to the cloud, where the CNN inference is performed, increases the power consumption of Alice (Bob). If the CC remains continuously active, only a small number of retransmissions are needed for detection, keeping the power overhead

7

Fig. 8: Bob’s RF receiver architecture with AI-based HT-CC detection.

manageable. However, if the CC is enabled intermittently or for short durations, this approach would require nearcontinuous data retransmission, leading to impractically high power usage. Sending periodic frames to the cloud to check for CC activity could also allow the CC to operate undetected for long periods or even avoid detection entirely. Additionally, retransmission introduces privacy concerns and adds latency to CC detection. Therefore, the most suitable location for executing the CNN model is within Bob’s RF receiver, which preserves data privacy and enables low-latency CC detection, assuming a lightweight CNN hardware accelerator is employed to balance performance and cost. This decision is supported by prior studies comparing cloud-based and edge-based AI execution in terms of energy consumption and latency. For instance, [50] reports that the energy cost of Large Language Model (LLM) inference is approximately 1.65 cents per response on a cloud platform, compared to just 0.0041 cents on an edge device. Similarly, [51] presents large-scale latency measurements showing that median data transfer latency, based on Round-Trip Time (RTT), can reach up to 60 ms in cloud scenarios, whereas edge deployments reduce this to around 20 ms. The IoT seven-level reference model proposed in [52] depicts the multi-layered data flow from the edge device, through communication and edge computing layers, up to cloud-based processing and application layers, where each upward transition between each layer introduces additional latency and reduces privacy due to increased data transfers. This layered architecture between edge and cloud not only delays CC detection but also increases the risk of data leakage before any mitigation can occur. In contrast to cloud-based approaches, local detection on the edge device enables rapid, real-time detection and mitigation of CC threats. Fig. 8 shows the proposed localized CC detection approach. Bob’s RF receiver integrates a dedicated CNN accelerator, eliminating the need for external cloud processing and its associated latency. The accelerator continuously monitors the incoming digital I/Q samples directly at the ADC outputs of the AFE, operating in parallel with the RF receiver so that normal communication between Alice and Bob remains unaffected. By using the raw received signal as input, rather than relying on parametric features like power as in SCCF, the CNN performs direct CC analysis instead of side-channel

Fig. 9: Baseline CNN model architecture.

analysis. Additionally, because the CNN observes the signal at the earliest possible digital stage, immediately after RF–to–I/Q conversion, it prevents sensitive information from propagating to higher-layer processing blocks such as the PHY or MAC. If a CC is detected, Bob immediately halts communication and notifies Alice, who may be unaware that sensitive data is being exposed to Eve. V. CNN M ODEL A. Baseline CNN model and classifier type exploration As presented in Section III, the dataset contains for 8 different SNR values, ranging from 1dB to 29dB with a step of 4dB, 5×2000 frames labeled to 1 out of 5 classes, namely CCfree and HTX-CC, X={1, · · · , 4}. The Wi-Fi physical layer frame contains 2 × 640 real-value samples corresponding to the two I/Q branches, as detailed in Section III-A1. The classifier processes one frame at a time and produces a classification for each frame. We consider two classification problems: (a) Binary classification, which measures the ability to distinguish CC-infected transmissions from CC-free ones, with all HTX-CC variants, X={1, · · · , 4}, grouped into a single CC-infected class; and (b) Multi-class classification, a more challenging task in which the classifier predicts 1 of 5 classes, CC-free or HTX-CC for X={1, · · · , 4}. In this setting, the classifier not only detects whether a transmission is CCinfected but also identifies the specific HT mechanism used at the transmitter. In [26], the frame is encoded directly as a 2 × 640 “image” and a CNN model is adopted for its proven effectiveness in image classification and robust feature-extraction capabilities. Starting from a large standard CNN architecture and following a trial-and-error approach, the number of layers and the layers’ size were reduced while maintaining the maximum accuracy. The resultant baseline architecture, shown in Fig. 9, consists of two convolutional layers, one fully connected layer, and an output layer, totaling 184,265 parameters ,e.g., synaptic weights. As discussed in detail in Section VII-B, this baseline CNN model achieves average accuracies across SNR values of 90.9% and 88.26% for the binary and multi-class classification tasks, respectively. Since our goal is to integrate the CNN hardware accelerator with the RF transceiver, our initial focus was to compact the CNN model without degrading the accuracy of the baseline model in [26], ensuring that the accelerator meets the area and

8

power constraints of the wireless IC. As illustrated in Fig. 10 and detailed in Section V-B, this is accomplished by reducing the CNN model’s input dimensionality and introducing a feature-compression block at the CNN input, which maps the original 2 × 640 input into the reduced representation. We also evaluate several alternative classifier types to motivate the choice of a CNN. As shown in Section VII-B, their performance on the dataset confirms that the proposed compact CNN provides the most effective solution. The alternative classifier types examined include the oneclass SVM used in SSCF [21], [22], a multi-class SVM, and two additional Deep Neural Networks (DNNs) beyond the CNN models, namely a Fully-Connected Neural Network (FCNN) and a Long Short-Term Memory (LSTM) network, the latter being a type of Recurrent Neural Network (RNN). The LSTM is considered because its strong ability to capture long-term dependencies makes it well suited for time-series data such as the continuously received I/Q frames. The one-class SVM is an unsupervised method trained solely on CC-free frames (inliers) and subsequently used to detect CC-infected frames (outliers), making it inherently limited to binary classification. In contrast, the multi-class SVM, FCNN, and LSTM are employed as multi-class classifiers in the same manner as the CNN models. The SVMs use the Radial Basis Function (RBF) kernel. The I/Q samples are concatenated to make a 1280-dimensional input, then PCA is applied keeping a number of principal components such that 90% of data variation is explained. This results in a 253-dimensional input for the one-class SVM and a 320-dimensional input for the multi-class SVM. The FCNN and LSTM use a 2 × 640 input, similar to the CNN models. A trial-and-error approach was employed to design the most compact architectures that still preserve the maximum observed accuracy. The resulting FCNN comprises three dense layers with a total of 406,541 parameters, while the LSTM model consists of two LSTM layers followed by a dense layer and an output layer, totaling 451,200 parameters. B. Compact CNN model with feature-compression block We opted for retaining the architecture of the baseline CNN while reducing its size by compressing the input dimensionality using a compression factor (CF) CF = 2 × c, c ∈ Z+ , 640 . However, since the CC detection task operates on to 2 × CF frames of dimension 2 × 640, an additional learnable block must be inserted between the frame input and the compressed CNN model to reduce the dimensionality from 2 × 640 to 640 2× CF . This block and the compressed CNN are trained jointly in an end-to-end manner. First, we experimented with max- and average-pooling layers to compress the frame length, but this approach led to a drop in accuracy with respect to the baseline model for any CF value. Next, we considered using an autoencoder, which is commonly employed for feature compression. While it only caused a minor accuracy loss, the autoencoder contains approximately 164,000 parameters, conflicting with our original goal of minimizing model size for efficient on-chip implementation.

TABLE III: Ablation study for finding the optimal CF. Compression Factor (CF )

Input dimensions of CNN model

Average binary-class accuracy drop

Average multi-class accuracy drop

Parameters number

Baseline CF = 2 CF = 3 CF = 4 CF = 5 CF = 6

2x640 2x320 2x213 2x153 2x128 2x106

0.00% -0.25% -0.53% -0.55% -0.62% -0.70%

0.00% -0.30% -1.70% -1.70% -1.76% -2.50%

184,265 92,135 61,323 46,063 36,851 30,519

To address this challenge, we introduce a featurecompression block called Learnable Linear Down-Sample (LLDS), designed to reduce feature dimensionality, while incurring minimal overhead and preserving accuracy. The LLDS block precedes the CNN model, with the complete combined model shown in Fig. 10 for CF = 5, selected as the optimal CF based on an ablation study discussed later. The LLDS block consists of four parallel single-convolution filters at its input (e.g., two per I/Q channel), followed by a down-sampling convolution layer. The parallel input convolutions capture multiple receptive fields, effectively enhancing informative samples while suppressing uninformative ones. The learned filters at this stage have sizes 1 × 3 and 1 × 5 with stride 1, drawing inspiration from the Inception architecture [53]. Zero padding (ZPAD) padding is symmetrically applied to left and right to preserve the input dimension of 640, resulting in an output of two channels with dimensions 2 × 640. The subsequent convolution layer applies two filters of size 1 × 5 across the two channels with stride equal to CF (e.g., CF = 5). This operation efficiently prunes redundant or non-informative features emphasized by the preceding layer. Consequently, the LLDS block outputs a reduced feature representation of 640 . dimension 2 × CF To identify the optimal CF that balances classification accuracy and model size, we conducted an ablation study by varying CF , with the results summarized in Table III. For each CF , the table reports the resulting CNN input dimension, the accuracy degradation relative to the baseline model for both binary and multi-class classification tasks, and the number of parameters in the CNN model which is compacted for CF > 1. Here, we report average accuracies across SNR values. More detailed results will be presented in Section VII-C. Based on the findings in Table III, we selected CF = 5, which yields only a modest accuracy reduction of 0.62% and 1.76% for the binary and multi-class tasks, respectively, while reducing the input dimension to 2 × 128 and the number of parameters from 184,265 to 36,851, corresponding to an 80% model compression. We additionally performed an ablation study to assess the effect of different activation functions within the LLDS block. Although feature-extraction CNN architectures typically use a single activation function throughout all layers, our focus was on varying the activation in the large second convolutional layer of the LLDS block. The results are summarized in Table IV where we report the accuracy drop for the binary and multiclass classification problems relative to the linear case (i.e., no activation) which proved to be the best-performing choice.

9

Fig. 10: Proposed compact CNN model with feature-compression block at input. TABLE IV: Ablation study of different activation functions in downsampling layer in LLDS module. Activation function

Average binary accuracy drop relative to linear activation

Average multi-class accuracy drop relative to linear activation

Linear Tanh Sigmoid ReLU Leaky-ReLU

-0.00% -1.24% -1.87% -3.09% -3.59%

-0.00% -3.35% -4.48% -7.06% -7.10%

Surprisingly, using ReLU, i.e., the activation employed in the main CNN model, resulted in large accuracy degradation. We further evaluated Tanh, Sigmoid, and Leaky ReLU, finding that the linear case consistently delivered the best results. This suggests that preserving linearity during the down-sampling step retains more discriminative information, while nonlinear functions such as ReLU can suppress informative negative values and Sigmoid/Tanh may excessively constrain the feature space. The LLDS block introduces negligible computational overhead, contributing only 3% of the model’s total FLOPs and 0.11% of its overall parameters. VI. CNN H ARDWARE ACCELERATOR A RCHITECTURE The data flow of the proposed CNN hardware accelerator is illustrated in Fig. 11. The LLDS block is designed to keep filter weights stationary while sliding the input data at each clock cycle. This scheduling strategy enables the LLDS to operate at full speed alongside the RF receiver, remaining synchronized with the incoming frame rate. Such synchronization is critical to prevent frame loss, as the CC may be embedded in specific frames and dropping frames could result in the CC going undetected. Consequently, the LLDS block achieves maximum throughput by executing all required Multiply–Accumulate (MAC) operations in parallel, that is, the execution rate, defined as the ratio of executed MACs per clock cycle to the required MACs per clock cycle (E. MACs/R. MACs), is equal to 1. Additionally, this buffering strategy eliminates the need to buffer the large 2 × 640 input frame, significantly reducing

Flip-Flop (FF) utilization on the FPGA by limiting intermediate pipeline stages and minimize amount of data transferred between layers. Overall, since the LLDS module introduces only a limited number of MAC operations, its contribution to FPGA resource utilization remains negligible. In contrast, the CNN dominates the overall MAC count of the model. Therefore, its convolution filters are partitioned across the available multiplier and adder resources to preserve efficiency and minimize power consumption. Specifically, one third of the filters are processed per clock cycle, yielding an execution rate of E. MACs/R. MACs=1/3, as shown in Fig. 11, and resulting in an overall processing latency of three input frame durations. For example, in the first convolution layer, which comprises 45 filters, 15 filters are executed per clock cycle, completing the filter shifts per channel in three clock cycles. With the LLDS module compressing the input dimensionality by CF = 5, buffering requirements at the input of the CNN are significantly relaxed, allowing the LLDS output to be stored efficiently using a FIFO, in order to accommodate the rate transition between the execution rate of the LLDS module (E. MACs/R. MACs=1) and the execution rate of hte CNN (E. MACs/R. MACs=1/3). With each convolution shift being processed over three clock cycles, the incoming compressed frame from the LLDS block is stored entirely in the FIFO to avoid any loss of adjacent samples during the execution of each convolution shift. As a consequence of that, unlike the LLDS stage, convolution layers of the CNN employ an inputstationary data-flow, in which input feature maps are held stationary while filter weights slide over them, as illustrated in Fig. 11. Fig. 12 illustrates the internal layer architecture. Since the dataset consists of real-valued I/Q samples, a 12-bit quantization is applied to reflect the typical resolution of ADCs used in RF receiver front-ends. In addition, post-training quantization of the filter weights to 8 bits is performed. As shown in Section VII-C, these quantizations introduce only a minor accuracy degradation compared to the software model. The control unit manages weight-memory addressing and aligns the input data with the corresponding weights, coordinating with dedicated MAC units. These MAC units execute fixed-point 12-bit × 8bit operations, after which the results are passed through the

10

Fig. 11: CNN accelerator data-flow architecture.

Fig. 12: Layer architecture.

activation function and truncated back to 12 bits.

VII. R ESULTS A. SNR requirements for HT-CC error-free recovery and HTCC detection Before presenting the results, it is important to distinguish the SNR range in which an attacker can achieve error-free recovery of HT-CC data, as this also defines the SNR range in which HT-CC detection is truly necessary. If the attacker cannot reliably decode the leaked information, then HT-CC detection performance in that SNR regime is of limited practical relevance. The dataset spans SNR values from 1 dB to 29 dB. However, robust and reliable Wi-Fi communication typically requires a minimum SNR of 20–25 dB [48]. Table V shows, in its second column, the minimum SNR needed for error-free covert data recovery (without redundancy) for the four HT-CC schemes of the dataset listed in the first column, as reported in their respective publications. These thresholds indicate that an attacker cannot decode the leaked information without errors at low SNR levels. Consequently, HT-CC detection must be highly reliable in high SNR conditions, whereas optimizing detection at low SNR values is less critical, as even the cover communication suffers from high BER in that regime. Although the relevant SNR range for the attacker, where leaked data can be correctly recovered and HT-CC detection is therefore meaningful, lies above 20 dB, we still report results down to 1 dB. This allows us to assess the robustness of HTCC detection under challenging, low-SNR conditions where communication quality is inherently poor.

Fig. 13: Classifier performance comparison as a function of SNR.

B. Results of baseline CNN model and classifier exploration Fig. 13 shows the performance comparison of the 5 classifiers presented in Section V-A, namely one-class SVM [21], [22], multi-class SVM (which is denoted as simply SVM), baseline CNN [26], FCNN, and LSTM, evaluated on the dataset across varying SNR levels. Table VI summarizes, for each classifier, the input dimensionality and number of parameters in the second and third columns, respectively (see Section V-A). The fourth and fifth columns report the average accuracy on the dataset for the binary and multi-class classification tasks, respectively, averaged over all SNR values. As shown in Fig. 13, the trend is that the classification accuracy for both learning problems increases with SNR. This monotonic behavior is explained by the observation that the stronger the signal is, the easier it becomes for the classifier to spot the CC within the signal. The one-class SVM shows the poorest accuracy on the binary classification problem that never exceeds 75% and on average across all SNR values is 66.4%. FCNN outperforms the SVM in the range of SNR>20 dB, which is the range of interest (see Section VII-A). This proves that a deep learning approach is rather needed for detecting a CC within raw transmission data. CNN and LSTM show the

11

TABLE V: Minimum SNR for HT-CC error-free recovery and for HT-CC detection with accuracy > 90% using the CNN model. Attack model

Minimum SNR required for error-free recovery of the covert data

Minimum SNR required for HT-CC detection using the CNN with an accuracy exceeding 90%

HT1-CC [18] HT2-CC [14] HT3-CC [13] HT4-CC [22]

24 dB (without any error correction techniques) 35 dB (for 256-PSK having 0.1% cover channel BER) 24 dB (for 98% packet reception) 30 dB (for a BPSK modulation and a CC rate of 5 bps)

11 dB 1 dB 14 dB 15.5 dB

TABLE VI: Input dimensionality, number of parameters, and average classification accuracy on the dataset over the SNR range for the different classifiers. Model

Input size

Parameters number

Average binary accuracy

Average multi-class accuracy

Baseline CNN LSTM FCNN SVM One-class SVM LLDS+CNN LLDS+CNN (Quantized)

2x640 2x640 1280 320 253 2x640 2x640

184,265 451,200 406,541 36,851 36,851

90.9% 91.10% 88.70% 77.40% 66.40% 90.28% 90.27%

88.26% 88.09% 80.10% 80.93% 86.50% 85.80%

best accuracy outperforming all the other classifiers for both binary and multi-class classification problems. In the SNR range of interest, they show similar excellent accuracy for both classification problems that is over 97% for SNR>20 dB and rises above 99% for SNR>25 dB which is required for practical communication. Even for the lowest SNR of 1 dB, where the CC data cannot be recovered reliably by the attacker, they still perform surprisingly well achieving an accuracy for the binary classification problem of over 81%, with the LSTM performing better than the CNN. For the multi-class classification problem, the curves of the LSTM and CNN are very close throughout the SNR range, while, starting from SNR=13 dB, the curves for both classification problems practically converge to an accuracy of over 85%. For low SNR, the accuracy for the multi-class classification problem drops to around 65% for SNR=1 dB and is over 85% for SNR=10 dB. But this is a secondary issue since the primary goal is to detect the CC, while detecting the underlying HT mechanism within the transmitter is an auxiliary benefit. Furthermore, we observe that the CNN performs better in the range of SNR>20 dB and on average across the complete SNR range it achieves binary and multi-class accuracies very close to those of the LSTM. Therefore, given that the range of interest is SNR>20 dB, and given that the CNN has more than half less parameters than the LSTM as shown from Table VI leading to a more efficient edge computing implementation, we conclude that the CNN is arguably the best choice towards an AI-based defense against HT-CCs. C. Results for compact CNN model with feature-compression block Herein, we report the performance of the compact CNN model, evaluated in both software and on the CNN hardware accelerator, and compare it against the baseline model. Fig. 14 presents the comparison across different SNR values, while the results of the compact model are added in the

Fig. 14: Baseline and compact CNN model performance comparison as a function of SNR.

last two rows of Table VI, where “quantized” refers to the compact model with 8-bit weight precision executed on the hardware accelerator. In software, the compact model achieves average accuracies of 90.28% and 86.5% for the binary and multi-class classification tasks, respectively, compared to 90.9% and 88.26% for the baseline model, representing a small drop of less than 2% for multi-class classification and less than 1% for binary classification. This reduction comes with a substantial decrease in model size, from 184,265 to 36,851, enabled by the LLDS module parameters, corresponding to a 80% reduction, which is crucial for efficient edge deployment. The 8-bit weight quantized compact model with 12-bit quantized I/Q samples running on the FPGA performs closely to its software counterpart for the binary classification task, and shows an average accuracy loss of less than 2% for the multiclass classification task, which disappears in the SNR range of interest above 20 dB, as shown in Fig. 14. Fig. 15 presents the per-class accuracies for the multiclass classification task. In the SNR range of interest above 20 dB, where an attacker can reliably recover the CC data, the compact model preserves the baseline model’s performance, achieving over 92% accuracy for all classes, and over 96% accuracy for the HT2-CC, HT3-CC, and HT4-CC classes. Notably, the accuracy remains high even at lower SNR values, highlighting the robustness of the AI-based detection method under challenging channel conditions. The last column of Table V reports the minimum SNR required to achieve more than 90% accuracy, as determined from Fig. 15. As shown,

12

Fig. 17: Confusion matrix of the compact CNN model for the binary classification task.

Fig. 15: Baseline and compact CNN model performance comparison per class as a function of SNR.

Fig. 18: Confusion matrix of the compact CNN model for the multiclass classification task.

Fig. 16: First 16 real (I) samples of the STSt for the CC-free and for HT1-CC and HT2-CC leaking a random byte.

accuracy stays above 90% down to SNR values at least 10 dB lower that the minimum SNR required by the attacker for error-free CC recovery. At low SNR values, the compact model surpasses the baseline in detecting the HT1-CC and HT3-CC classes, while both models perform similarly for HT2-CC. The largest discrepancy appears in the CC-free class, where the compact model exhibits noticeably lower accuracy. In this case, CC-free samples are misclassified as HTX-CC, resulting in false alarms, an outcome that is arguably less critical than failing to detect an actual CC. One notable observation from Fig. 15 is that HT2-CC is significantly easier to detect than the other classes. The detection accuracy remains at 100% across the entire SNR range, even at the lowest SNR of 1 dB. This distinct behavior stems from the fact that HT2-CC produces a much more pronounced alteration in the “image” of the transmitted frame compared to the other HT-CC variants, which makes it easily detectable by a CNN model. Specifically, HT2-CC applies a phase shift to all STSF symbols, as illustrated in Fig. 3b. After undergoing the IFFT, the phase-shifted STSF transforms into the time domain, modifying both the amplitude and phase of

the resulting STSt . Fig. 16 shows the first 16 I samples of STSt for the CC-free and the HT1-CC and HT2-CC cases when leaking a random byte, where HT2-CC stands out clearly as easily distinguishable. To shed light into the misclassification behavior, Figs. 17 and 18 present the confusion matrices of the compact CNN model for the binary and multi-class classification tasks, respectively. To illustrate performance under varying channel conditions, we include results at two representative SNR levels. The first, 13 dB, is below the reliable Wi-Fi operating range and thus exposes inter-class ambiguity and misclassification patterns. The second, 25 dB, falls within the reliable reception range, where the classifier is expected to produce stable predictions. As seen, the confusion matrices at 25 dB are strongly diagonal, confirming this behavior. Notably, the diagonal structure is largely preserved even at 13 dB. At this lower SNR, the CC-free class exhibits the poorest detection accuracy, as also discussed above, being misclassified as HTCC1 (8.3%), HT-CC3 (11.2%), and HT-CC4 (5.4%). VIII. C OMPARISON WITH OTHER ACCELERATORS As this is the first AI hardware accelerator demonstrated for on-chip AI-based CC detection, Table VII compares our work with previously reported state-of-the-art FPGA-based AI hardware accelerators that explore a range of neural network architectures for RF signal classification tasks, particularly modulation recognition and emitter identification. For each design, we report the weight quantization, FPGA resources,

13

TABLE VII: Comparison of state-of-the-art FPGA implementations of AI hardware accelerators for RF signal classification tasks. [54]

[55]

[56]

[57]

[58]

[59]

Application Modulation Modulation Recognition Recognition

Modulation Recognition

Modulation Modulation Modulation Recognition Recognition Recognition

FPGA

XCZU7EV

XCZU9EG XCZU5EG

XCZU7EV XCZU9EG

Clock (MHz)

70

-

NN

CNN

ANN

Weights (# of Bits)

115

250

Attention + CNN STFT-CNN

[60]

This Work

Specific-Emitter identification

Covert Channel

PYNQ

XC7Z045

XCZU5EG

200

137

-

200

CNN

SNN

Conditional

LLDS

reconfigurable CVNN

+ CNN

16

8

16

-

8

75.36K

97.90K

67.77K

31.73K

-

27.07K

88623

139200

-

50934

-

210

1728

578

131

0

847

1152

1192

10500

858

2167

2150

810

Performance (GOPs)

33

15

61

179

23

79

189

86.5

Efficiency (GOPs/W)

39

13

51

17

27

35

88

107

16

16

8

LUT

74.68K

158.43K

FF

57726

16222

DSP

1116

Power (mW)

power consumption, performance measured as the throughput, and energy efficiency expressed in Giga Operations/s (GOPs) Operating at 200 MHz, the proposed accelerator delivers a throughput of 67 Mega Samples/s, corresponding to 43 Giga MAC/s or 86.5 GOPs (since each MAC consists of two operations), while consuming only 810 mW. This translates to an energy efficiency of 107 GOPs/W, ranking the accelerator as the most efficient design in Table VII. With respect to FPGA resource utilization, the proposed accelerator significantly reduces FF usage, requiring only 8,246 FFs, which is enabled by the weight-stationary data-flow of the LLDS block and the associated feature dimensionality reduction it provides.

IX. C ONCLUSION We proposed a lightweight 810 mW 107 GOPs/W CNN hardware accelerator for on-chip real-time CC detection. The accelerator processes raw I/Q samples directly at the RF receiver ADC output, encoded as images, and operates at speed with the RF receiver. To enable efficient edge deployment, we first compressed the state-of-the-art CNN model in [26] by 80% with only a minor accuracy degradation, still achieving over 96% CC detection accuracy and correct HT type classification within the SNR range of interest. We further justified the choice of a CNN for this task by benchmarking it against alternative classifier architectures, demonstrating a superior trade-off between model size and accuracy. All classifiers were trained using the hardware-generated HT-CC dataset from [26], which encompasses all major CC types, thereby demonstrating that the proposed strategy enables a unified, CC type-independent AI-based detection solution, in contrast to approaches requiring multiple dedicated countermeasures tailored to individual CC types.

8246 1229

R EFERENCES [1] V. Barbaza, A. R. Diaz-Rizo, H. Aboushady, S. Raptis, and H.-G. Stratigopoulos, “Stealing AI model weights through covert communication channels,” arXiv:2510.00151, 2025. [2] M. Tehranipoor and F. Koushanfar, “A survey of hardware trojan taxonomy and detection,” IEEE Des. Test Comput., vol. 27, no. 1, pp. 10–25, Jan./Feb. 2010. [3] R. Karri, J. Rajendran, K. Rosenfeld, and M. Tehranipoor, “Trustworthy hardware: Identifying and classifying hardware trojans,” Computer, vol. 43, no. 10, pp. 39–46, Oct. 2010. [4] S. Bhunia, M. S. Hsiao, M. Banga, and S. Narasimhan, “Hardware trojan attacks: Threat analysis and countermeasures,” Proc. IEEE, vol. 102, no. 8, pp. 1229–1247, Jul. 2014. [5] K. Xiao, D. Forte, Y. Jin, R. Karri, S. Bhunia, and M. Tehranipoor, “Hardware Trojans: lessons learned after one decade of research,” ACM Trans. Des. Autom. Electron. Syst., vol. 22, no. 1, pp. 6:1–6:23, Dec. 2016. [6] S. Bhunia and M. M. Tehranipoor (Eds.), The Hardware Trojan War: Attacks, Myths, and Defenses, Springer International Publishing, 2018. [7] Z. Huang, Q. Wang, Y. Chen, and X. Jiang, “A survey on machine learning against hardware trojan attacks: Recent advances and challenges,” IEEE Access, vol. 8, pp. 10796–10826, Jan 2020. [8] A. Jain, Z. Zhou, and U. Guin, “Survey of recent developments for hardware trojan detection,” in Proc. IEEE Int. Symp. Circuits Syst. (ISCAS), May 2021. [9] M. Elshamy et al., “Digital-to-analog hardware Trojan attacks,” IEEE Trans. Circuits Syst. I, Reg. Papers, vol. 69, no. 2, pp. 573–586, Feb. 2022. [10] M. Portolan, A. Pavlidis, G. Di Natale, E. Faehn, and H.-G. Stratigopoulos, “Circuit-to-circuit attacks in SoCs via trojan-infected IEEE 1687 test infrastructure,” in Proc. IEEE Int. Test Conf. (ITC), 2022, pp. 539–543. [11] A. Pavlidis, E. Faehn, M.-M. M. Louërat, and H.-G. Stratigopoulos, “Run-time hardware trojan detection in analog and mixed-signal ICs,” in Proc. IEEE VLSI Test Symp. (VTS), Apr. 2022. [12] N. Kiyavash, F. Koushanfar, T. P. Coleman, and M. Rodrigues, “A timing channel spyware for the CSMA/CA protocol,” IEEE Trans. Inf. Forensics Security, vol. 8, no. 3, pp. 477–487, Mar. 2013. [13] A. Dutta, D. Saha, D. Grunwald, and D. Sicker, “Secret agent radio: Covert communication through dirty constellations,” in Information Hiding, M. Kirchner and D. Ghosal, Eds., Berlin, Heidelberg, 2013, pp. 160–175, Springer Berlin Heidelberg. [14] J. Classen, M. Schulz, and M. Hollick, “Practical covert channels for WiFi systems,” in Proc. IEEE Conf. Commun. Netw. Secur. (CNS), Sep. 2015, pp. 209–217. [15] Z. Hijaz and V. S. Frost, “Exploiting OFDM systems for covert communication,” in Proc. IEEE Mil. Commun. Conf. (MILCOM), Oct./Nov. 2010, pp. 2149–2155.

14

[16] S. Grabski and K. Szczypiorski, “Steganography in OFDM symbols of fast IEEE 802.11n networks,” in Proc. IEEE Secur. Priv. Workshops, May 2013, pp. 158–164. [17] K. S. Subraman, A. Antonopoulos, A. A. Abotabl, A. Nosratinia, and Y. Makris, “Demonstrating and mitigating the risk of an FEC-based hardware trojan in wireless networks,” IEEE Trans. Inf. Forensics Security, vol. 14, no. 10, pp. 2720–2734, Feb. 2019. [18] A. R. Dı́az-Rizo, H. Aboushady, and H.-G. Stratigopoulos, “Leaking wireless ICs via hardware trojan-infected synchronization,” IEEE Trans. Dependable Secure Comput., vol. 20, no. 5, pp. 3845–3859, Sept. 2023. [19] K. Grzesiak, Z. Piotrowski, and J. Kelner, “A wireless covert channel based on dirty constellation with phase drift,” Electronics, vol. 10, no. 6, 2021. [20] Y. Jin and Y. Makris, “Hardware trojans in wireless cryptographic ICs,” IEEE Design Test Comput., vol. 27, no. 1, pp. 26–35, Jan./Feb. 2010. [21] Y. Liu, Y. Jin, A. Nosratinia, and Y. Makris, “Silicon demonstration of hardware trojan design and detection in wireless cryptographic ICs,” IEEE Trans. Very Large Scale Integr. (VLSI) Syst., vol. 25, no. 4, pp. 1506–1519, Apr. 2017. [22] K. S. Subramani, N. Helal, A. Antonopoulos, A. Nosratinia, and Y. Makris, “Amplitude-modulating analog/RF hardware trojans in wireless networks: Risks and remedies,” IEEE Trans. Inf. Forensics Security, vol. 15, pp. 3497–3510, Apr. 2020. [23] S. Chang, G. Bhat, U. Ogras, B. Bakkaloglu, and S. Ozev, “Detection mechanisms for unauthorized wireless transmissions,” ACM Trans. Des. Autom. Electron. Syst., vol. 23, no. 6, pp. 70:1–70:21, Nov. 2018. [24] K. Sankhe et al., “Impairment shift keying: Covert signaling by deep learning of controlled radio imperfections,” in Proc. IEEE Mil. Commun. Conf. (MILCOM), Nov. 2019, pp. 598–603. [25] R. U. Almada-Prieto, J. C. Núñez-Pérez, and A. R. Dı́az-Rizo, “Chaosbased hardware trojan covert channel for synchronized chaotic cryptosystems,” in Proc. IEEE Lat. Am. Symp. Circuits Syst. (LASCAS), 2026, pp. 1–5. [26] A. R. Dı́az-Rizo, A. Abdelazim, H. Aboushady, and H.-G. Stratigopoulos, “Covert communication channels based on hardware trojans: Opensource dataset and AI-based detection,” in Proc. IEEE Int. Symp. Hardw.-Oriented Secur. Trust (HOST), May 2024, pp. 101–106. [27] C. Kapatsori, Y. Liu, A. Antonopoulos, and Y. Makris, “Hardware dithering: A run-time method for trojan neutralization in wireless cryptographic ICs,” in Proc. IEEE Int. Test Conf. (ITC), Oct./Nov. 2018. [28] Y. Liu, G. Volanis, K. Huang, and Y. Makris, “Concurrent hardware trojan detection in wireless cryptographic ICs,” in Proc. IEEE Int. Test Conf. (ITC), Oct. 2015. [29] L. Lin, T. Güneysu M. Kasper, C. Paar, and W. Burleson, Trojan Side-Channels: Lightweight Hardware Trojans through Side-Channel Engineering, Berlin, Germany: Springer, 2009. [30] J. Chacko et al., “Physical gate based preamble obfuscation for securing wireless communication,” in Proc. Int. Conf. Comput. Netw. Commun. (ICNC), Jan. 2017, pp. 293–297. [31] A. R. Dı́az-Rizo, J. Leonhard, H. Aboushady, and H. Stratigopoulos, “RF transceiver security against piracy attacks,” IEEE Trans. Circuits Syst., II, Exp. Briefs, vol. 69, no. 7, pp. 3169–3173, Jul. 2022. [32] A. R. Dı́az-Rizo, H. Aboushady, and H.-G. Stratigopoulos, “Anti-piracy design of RF transceivers,” IEEE Trans. Circuits Syst. I, Reg. Papers, vol. 70, no. 1, pp. 492–505, Jan. 2023. [33] G. Montoya-Zúñiga, A. R. Dı́az-Rizo, H. Aboushady, R. Parra-Michel, A. Veloz-Guerrero, and H.-G. Stratigopoulos, “Anti-counterfeiting design of bluetooth transceivers through logic locking,” in Proc. IEEE Global Communications Conference (GLOBECOM), Dec. 2025. [34] J. Leonhard, A. Sayed, M.-M. Louërat, H. Aboushady, and H.-G. Stratigopoulos, “Analog and mixed-signal IC security via sizing camouflaging,” IEEE Trans. Comput.-Aided Design Integr. Circuits Syst., vol. 40, no. 5, pp. 822–835, Jul. 2021. [35] X. Zhang and M. Tehranipoor, “Case study: Detecting hardware trojans in third-party digital IP cores,” in IEEE Int. Symp. Hardw.-Oriented Secur. Trust (HOST), Jan. 2011, pp. 67–70. [36] S. K. Haider, C. Jin, M. Ahmad, D. M. Shila, O. Khan, and M. van Dijk, “Advancing the state-of-the-art in hardware trojans detection,” IEEE Trans. Dependable Secure Comput., vol. 16, no. 1, pp. 18–32, Jan./Feb. 2019. [37] V. R. Surabhi, P. Krishnamurthy, H. Amrouch, J. Henkel, R. Karri, and F. Khorrami, “Exposing hardware trojans in embedded platforms via short-term aging,” IEEE Trans. Comput.-Aided Design Integr. Circuits Syst., vol. 39, no. 11, pp. 3519–3530, Nov. 2020. [38] Y. Jin, X. Guo, R. G. Dutta, M.-M. Bidmeshki, and Y. Makris, “Data secrecy protection through information flow tracking in proof-carrying

hardware IP—part I: Framework fundamentals,” IEEE Trans. Inf. Forensics Security, vol. 12, no. 10, pp. 2416–2429, Oct. 2017. [39] X. Guo, R. G. Dutta, Y. Jin, F. Farahmandi, and P. Mishra, “Pre-silicon security verification and validation: A formal perspective,” in Proc. 52nd Design Autom. Conf. (DAC), Jun. 2015. [40] K. Hasegawa, M. Yanagisawa, and N. Togawa, “Hardware trojans classification for gate-level netlists using multi-layer neural networks,” in Proc. IEEE Int. Symp. On-Line Test. Robust Syst. Des. (IOLTS), 2017, pp. 227–232. [41] P. Gaikwad, J. Cruz, P. Chakraborty, S. Bhunia, and T. Hoque, “Hardware IP assurance against trojan attacks with machine learning and postprocessing,” ACM J. Emerg. Technol. Comput. Syst., vol. 19, no. 3, Jun. 2023. [42] T. Sugawara et al., “Reversing stealthy dopant-level circuits,” J. Cryptograph. Eng., vol. 5, no. 2, pp. 85–94, Jun. 2015. [43] D. Agrawal, S. Baktir, D. Karakoyunlu, P. Rohatgi, and B. Sunar, “Trojan detection using IC fingerprinting,” in Proc. IEEE Symp. Secur. Privacy (SP), May 2007, pp. 296–310. [44] S. Narasimhan, W. Yueh, X. Wang, S. Mukhopadhyay, and S. Bhunia, “Improving IC security against trojan attacks through integration of security monitors,” IEEE Design Test Comput., vol. 29, no. 5, pp. 37–46, Sep./Oct. 2012. [45] C. Bao, D. Forte, and A. Srivastava, “Temperature tracking: Toward robust run-time detection of hardware trojans,” IEEE Trans. Comput.Aided Design Integr. Circuits Syst., vol. 34, no. 10, pp. 1577–1585, Apr. 2015. [46] J. He, Y. Zhao, X. Guo, and Y. Jin, “Hardware trojan detection through chip-free electromagnetic side-channel statistical analysis,” IEEE Trans. Very Large Scale Integr. (VLSI) Syst., vol. 25, no. 10, pp. 2939–2948, Oct. 2017. [47] A. Stern, D. Mehta, S. Tajik, U. Guin, F. Farahmandi, and M. Tehranipoor, “SPARTA-COTS: A laser probing approach for sequential trojan detection in COTS integrated circuits,” in IEEE Phys. Assur. Insp. Electron. (PAINE), Dec. 2020. [48] IEEE, “IEEE standard for information technology—telecommunications and information exchange between systems local and metropolitan area networks—specific requirements - part 11: Wireless LAN medium access control (MAC) and physical layer (PHY) specifications,” IEEE Std 802.11-2016 (Revision of IEEE Std 802.11-2012), pp. 1–3534, 2016. [49] Nuand, “SDR bladeRF 2.0 micro xA9,” https://bit.ly/3z2QV1N, Online. [50] S. Jang and R. Morabito, “Edge-first language model inference: Models, metrics, and tradeoffs,” arXiv.2505.16508, 2025. [51] B. Charyyev, E. Arslan, and M. H. Gunes, “Latency comparison of cloud datacenters and edge servers,” in Proc. IEEE Global Communications Conference (GLOBECOM), Dec. 2020. [52] A. Mosenia and N. K. Jha, “A comprehensive study of security of internet-of-things,” IEEE Trans. Emerg. Top. Comput., vol. 5, no. 4, pp. 586–602, Oct.-Dec. 2017. [53] C. Szegedy et al., “Going deeper with convolutions,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2015. [54] A. Emad et al., “Deep learning modulation recognition for RF spectrum monitoring,” in Proc. IEEE Int. Symp. Circuits Syst. (ISCAS), May 2021. [55] S. Soltani, Y. E. Sagduyu, R. Hasan, K. Davaslioglu, H. Deng, and T. Erpek, “Real-time and embedded deep learning on FPGA for RF signal classification,” in Proc. IEEE Mil. Commun. Conf. (MILCOM), Mar 2019. [56] Z. Song, A. E. Abdelazim, P. Bazargan Sabet, F. Wajsbürt, H.-G. Stratigopoulos, and H. Aboushady, “A power-efficient attention-infused CNN hardware accelerator for RF spectrum monitoring,” in Proc. IEEE Int. Symp. Circuits Syst. (ISCAS), May 2025. [57] J. Woo, K. Jung, and S. Mukhopadhyay, “Efficient hardware design of DNN for RF signal modulation recognition employing ternary weights,” IEEE Access, vol. 12, pp. 80165–80175, Jun 2024. [58] K. Zhang et al., “Real-time automatic modulation recognition based on FPGA,” in Proc. IEEE Int. Conf. Comput. Commun. (ICCC), Dec. 2023. [59] W. Guo, K. Yang, H.-G. Stratigopoulos, H. Aboushady, and K. N. Salama, “An end-to-end neuromorphic radio classification system with an efficient sigma-delta-based spike encoding scheme,” IEEE Trans. Artif. Intell., vol. 5, no. 4, pp. 1869–1881, Aug. 2024. [60] J. Gan et al., “A Zynq-based platform with conditional- reconfigurable complex-valued neural network for specific emitter identification,” IEEE Trans. Instrum. Meas., vol. 73, pp. 1–11, Apr. 2024.