Where You Tap Matters: A Probe-and-Model Benchmark for Open-Set RF Fingerprinting Gabriele Oligeri∗ , Savio Sciancalepore† , Ingrid Huso∗ , Fatima Al-Mousawi ∗ † Eindhoven University of Technology, Eindhoven, Netherlands.
[email protected] ∗ College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar.
arXiv:2607.21564v1 [cs.CR] 23 Jul 2026
{goligeri, ihuso, faal30798}@hbku.edu.qa
Abstract—Radio Frequency Fingerprint Identification (RFFI) enables transmitter identification at the physical layer by learning device-specific impairments from received signals, yet the literature is inconsistent about where in the receiver chain those samples should be collected. Since distinct transformations are applied to the signal by the different receiver operations, i.e., carrier recovery, gain normalization, pulse shaping, and timing recovery, they can either tighten within-transmitter variability or suppress the features RFFI requires for classification. We present a systematic real-world evaluation of open-set, reconstruction-error RFFI using data collected at five probe points along a standard BPSK receiver chain. Our results show that RFFI is strongly probe-dependent: timing recovery and, to a lesser extent, carrier recovery enable low false-acceptance operation with limited in-distribution–out-ofdistribution overlap, whereas other stages often require a falseacceptance ratio above 0.1 to achieve a true-acceptance ratio of 0.9. To test the validity of our findings across model selection, we benchmark several LLM-designed autoencoders using a controlled pipeline that holds preprocessing and MSE scoring fixed. These architectures confirm that RFFI is probe-dependent. Moreover, they do not outperform the baseline at the chosen operating point and typically increase training time. Overall, probe selection dominates reconstruction-based open-set RFFI performance, more than the autoencoder complexity. Index Terms—Physical-Layer Security; Wireless Security; Artificial Intelligence for Security.
I. I NTRODUCTION Radio Frequency Fingerprint Identification (RFFI) addresses the problem of transmitter identification by exploiting devicedependent characteristics embedded in received baseband IQ samples [1]. Rather than relying on higher-layer identifiers, RFFI aims to infer which device generated a radio signal, enabling device-level identification even when protocol metadata, e.g., packet headers, are unavailable or untrusted. In securityrelevant settings, this problem naturally maps to detecting whether an incoming waveform, typically collected through a Software Defined Radio (SDR), has a profile consistent with an enrolled device or an unauthorized entity. Thus, RFFI can be formulated as an open-set decision problem driven by how well a learned model reconstructs “known” signals [2]. Many scientific contributions in recent years have focused on RFFI, in the context of several radio communication technologies [3]. The largest corpus of the scientific literature focuses on the design of advanced signal processing techniques to enhance RFFI performance. Pioneer approaches used pure statistical methods [4]. More recently, the domain received significantly
more attention from the community with the increasing diffusion and popularity of Deep Learning (DL) algorithms, particularly Neural Network (NN) classifiers [5] and anomalybased approaches like Autoencoders (AEs) [6]. At the same time, each proposed RFFI solution applies such techniques on Physical (PHY) data collected at various stages of the receiver chain, e.g., immediately after the antenna [7], after the Fast Fourier Transform (FFT) [8], or after timing recovery [9]. Although the literature provides some studies on classifierdriven performance evaluation for RFFI, the impact of the data collection stage has received no attention. Several signal processing operations are executed on a received radio signal, e.g., carrier recovery, gain normalization, pulse shaping, and timing recovery. These operations reshape the structure of the In-Phase Quadrature (IQ) data used for RFFI: they could reduce within-transmitter variability (helping separability) but could also suppress or homogenize device-specific features, negatively affecting Radio Frequency Fingerprinting (RFF). Overall, the “best” input data for RFFI is not guaranteed to be the earliest raw samples, i.e., the immediate output taken from the radio interface, nor the output of the receiver chain. Consequently, the DL-based algorithm used for RFFI should be evaluated in the context of the probe at which it operates. Contribution. In this work, we present a systematic experimental analysis of the impact of the data collection probe on the performance of state-of-the-art open-set RFFI. We collect IQ samples emitted from twelve (12) SDR transmitters at five probes along a representative GNU Radio receiver chain, each implementing a communication-oriented transformation, i.e., carrier recovery, gain normalization, pulse shaping, and timing recovery. Using state-of-the-art image-based Autoencoder-driven RFFI algorithms, we demonstrate quantitatively that RFFI performances change significantly based on the data collection stage. To remove potential biases due to the configuration of the chosen classifier, we also use publiclyavailable Large Language Models (LLMs) to generate several benchmark configurations to be compared with the current state-of-the-art baseline. The LLM-generated designs span different directions: stronger sparsity and smaller bottlenecks (GPT5.2), denoising plus sparsity (Gemini 3.1 Pro), deeper convolutional AEs with normalization/dropout and learning-rate scheduling (GLM5), compact convolutional AEs (SuperGrok),
and convolutional AEs with custom training and an explicit latent-structure regularizer (Claude Sonnet 4.6). All such LLMgenerated networks report similar performance trends to the baseline, demonstrating the robustness of our findings to the configurations of the chosen RFFI technique. Moreover, the generated networks do not improve RFFI performances over the baseline, while introducing additional training overhead. In summary, our paper provides the following contributions: • We deliver a systematic, probe-aware evaluation of imagebased open-set RFFI across five receiver-chain observation points and twelve transmitters, revealing that reliable fingerprinting is strongly probe-dependent. • We show that probe choice can affect the resulting In-Distribution (ID)/Out-Of-Distribution (OOD) reconstruction-error separation: timing recovery and carrier recovery provide substantially better operating points than earlier or intermediate stages in our controlled Binary Phase Shift Keying (BPSK) receiver chain. • To check whether the probe-dependent trend is an artifact of one particular AE implementation, we additionally compare the baseline against a small set of alternative AE designs generated by contemporary LLM tools. We do not claim to evaluate LLM-assisted neural architecture search in general; rather, these designs serve as an architecturaldiversity stress test under a fixed preprocessing and scoring pipeline. • As a secondary robustness check, we compare the baseline AE with several alternative AE designs produced by the LLMs while holding preprocessing and Mean Squared Error (MSE) scoring fixed. These alternatives do not change the main probe-dependent conclusion and generally increase the training cost. Overall, our work demonstrates that the achievement of strong RFFI discrimination in practice depends critically on two coupled design choices: (i) where in the receiver chain the signal is observed, and (ii) how the learned model is constructed. Probe selection dominates performance, while most LLM-driven architectural changes do not remove probe dependence, while providing limited performance benefit at the chosen operating point. We also clarify the practical trade-off that more complex designs increase training costs with little (and often negative) impact on discrimination. Roadmap. The rest of this paper is organized as follows. Section II reviews prior work on RFFI, Section III describes our data collection setup, Section IV formalizes the open-set RFFI problem, Section V defines the evaluation methodology, Section VI introduces our considered AE designs, Section VII reports performance and timing results, Section VIII studies probe-aware enrollment and cross-probe transferability, Section IX discusses implications, trade-offs, and limitations, and finally, Section X concludes the paper. II. R ELATED WORK Radio Frequency Fingerprint Identification has historically investigated transmitter identification [10], [11] by exploiting
hardware-dependent impairments observable in the received signal, including effects such as IQ imbalance [12], [13], [14], phase shift [15], and Carrier Frequency Offset (CFO) [16], often in combination with conventional Machine Learning (ML) models. With the diffusion of DL, many RFFI approaches shifted toward learning directly from raw physical-layer observations, i.e., baseband IQ samples, leveraging the ability of NNs to extract hidden patterns and achieve very strong classification performance [11]. DL models used in this context commonly include Convolutional Neural Networks (CNN)based classifiers [17] and AE-based methods [18] operating on IQ-derived representations such as images. A recurring finding across recent literature is that highperforming deep RFFI models can be unstable under realworld variability [5]. Their outputs may be significantly affected by noise and non-stationarity introduced by practical operating conditions such as radio warm-up [19], hardware resets [5], temperature changes [20], and time-varying channel conditions [21], among others. This sensitivity has motivated a substantial body of work targeting robustness across deployment conditions, including explicit handling of distortions and the evaluation of performance over time. One prominent approach is constituted by image-based RFFI, in which raw IQ samples are converted into image-like representations before learning. Prior work shows that preprocessing IQ into images can yield models that are more robust across disruptive factors and operational changes, e.g., adversarial perturbations [22], radio restarts [5], firmware reloads [23], and similar image-based techniques have also been applied beyond device identification, including channel fingerprinting [24], [25] and jamming detection [26]. Although many prior RFFI works treat transmitter identification as a closed-set classification task [9], security-relevant scenarios naturally motivate open-set decisions: determining whether an incoming signal is consistent with an enrolled transmitter rather than an unauthorized one [27]. A common solution is reconstruction-based identification using an AE: train an AE on ID samples, then use reconstruction error (MSE) as a scalar score to separate ID from OOD samples. Importantly, reconstruction-based RFF introduces a key design issue: architectural changes that improve reconstruction quality “in general” can also improve reconstruction of OOD inputs, potentially shrinking the ID–OOD error gap on which open-set discrimination relies [28], [29]. Another practical aspect, often under-emphasized, is that the received signal undergoes significant reshaping during the receiver’s processing stages. Thus, the stage in the reception process where data is collected is important. In most papers, the data collection sampling point is not reported at all. In other cases, the literature is not aligned. For example, the work in [7] collected IQ samples immediately after baseband conversion, while the authors in [23] collected them after timing recovery. Nonetheless, to our knowledge, no prior work has specifically investigated the extent to which the IQ collection probe can affect RFFI performance.
Given the size and coupling of this design space, i.e., the combination of probes and transmitters, recent works [30], [31] suggest that LLMs can serve as code- and design-generation assistants to improve inference performance. To the best of our knowledge, no prior literature has investigated the extent to which mainstream available LLMs can improve the design and code of RFFI techniques. We address both mentioned gaps throughout this paper.
TABLE I: Summary of our Datasets.
III. DATA C OLLECTION
256, 000 × 60 × 10 ≈ 153 million IQ samples for the radio, costasloop, and agc datasets, where no decimation is applied. For the rrc dataset, a decimation factor of 2 reduces the total to 76 million IQ samples. A further decimation factor of 2 is then applied within the symbsync block to produce the symbsync dataset, yielding 38 million IQ samples. Finally, we verified that the bit error rate at the output of the symbsync block is zero, confirming that all transmitted bits were received correctly. The dataset and the scripts adopted in this paper will be made publicly available upon acceptance.
In this section, we introduce the measurement methodology used to build the Radio Frequency (RF) dataset for our work. Hardware. Our measurement setup consists of thirteen (13) SDRs: twelve USRP B200-mini-i devices used as transmitters and one USRP X410 used as the receiver. Each transmitter is connected to the receiver through a 50 cm RF coaxial cable and a 20 dB attenuator. All experiments are performed over cable rather than over the air to eliminate wireless channel effects, such as multipath and fading, that could otherwise influence our observations. This controlled and isolated setup allows us to focus exclusively on device-level phenomena, without interference from wireless channel artifacts. Software. All radios are controlled through GNU Radio 3.8, while RFF transmitter identification is performed in MATLAB R2023b. We implemented a BPSK standard transmitter/receiver chain without relying on higher-layer protocols. This design choice avoids MAC-layer orchestration effects, such as silences and bit-pattern regularities, thereby maximizing the observability of RFF-related characteristics. At the transmitter, a GNU Radio Vector Source continuously emits a deterministic byte sequence, {0,. . . ,255}, which is mapped into complex BPSK symbols at a rate of 128,000 samples per second (sps). The transmit chain then applies a Root Raised Cosine (RRC) filter with interpolation factor 4, gain 2, roll-off factor 0.35, and 128 taps, before feeding a USRP Sink configured with a sampling rate of 256,000 sps, normalized transmit power of 0.5, and center frequency of 900 MHz. At the receiver, a USRP Source is configured at 900 MHz and 256,000 sps with a normalized gain of 0.5. The received signal is then processed through a Costas Loop and an Automatic Gain Control (AGC) block, followed by a matched RRC filter with the same parameters as the transmitter-side filter and a decimation factor of 2. Finally, symbol timing recovery is performed through a Symbol Sync block using a Mueller and Müller Time Error Detector (TED) operating at 2 sps. The normalized transmitter power (0.5), receiver gain (0.5), and 20 dB attenuation were selected empirically to ensure long-term measurement stability. To inspect the signal evolution across the receiver chain, we placed multiple File Sink blocks, hereafter referred to as probes, at different processing stages, as shown in Fig. 1. Specifically, a File Sink is placed at the output of each processing block. In the following, the resulting IQ datasets are referred to as radio, costasloop, agc, rrc, and symbsync, respectively. Dataset. Table I summarizes the datasets collected for our work. For each transmitter, we acquired 5 measurements, each lasting 10 minutes. This results in a total of approximately
Probe radio costasloop agc rrc symbolsync
IQ samples [M] 153 153 153 76 38
Decimation factor 1 1 1 2 2
IV. T RANSMITTER I DENTIFICATION We formulate the transmitter identification task as an openset classification problem. Let us define as D one of the datasets described in Sec. III, i.e., the output of the five probes placed along the receiver chain, for a total of 60 measurements. In the remainder of this paper, we follow the standard AE trainingreconstruction procedure. The reference dataset D is divided into two subsets, i.e., D = {Da , Db }, where Da corresponds to 70% of the dataset and is used to train the model α, namely α = T (Da ). The trained model α is then used to reconstruct the remaining portion of the dataset, Db , producing Db′ . We highlight that Db might come from the same transmitter, i.e., ID, or from another one, i.e., OOD. Finally, we compute the associated MSE between the original and reconstructed datasets, i.e., between Db and Db′ . Figure 2 shows an example of 1 · 105 IQ samples collected from each of the probes along the receiver chain of Fig. 1. At the radio probe, the samples are distributed in a circular region around the origin, reflecting the combined effects of modulation, the RF cable channel, hardware impairments, and noise. After carrier recovery, i.e., at the costasloop probe, the samples are rotated so that most of the energy lies on the in-phase component I, resulting in a thin horizontal line. This operation can be expressed as xcostas (n) = xradio (n) e−jϕ(n) , where ϕ(n) is iteratively updated to minimize the phase error. Through such a strategy, the loop compensates for carrier phase and frequency offsets by suppressing the Q component, thereby collapsing the original circular structure. At the agc probe, the signal power is normalized over time, which reduces amplitude variability, i.e., fluctuations on the I component, and consequently removes gain-related differences. The RRC filter then processes the signal (generating the signal available at the rrc probe), imposing an ideal pulse shape by linearly filtering the output of the agc probe, smoothing highfrequency and transient components and further regularizing the IQ distribution. Finally, at the symbsync probe, the
RF input (SDR Source) Connected via 50 cm coaxial cable, 20 dB attenuator
SDR
Costas Loop
Sample Rate: 256Msps Center Freq: 900 MHz
Loop Bandwidth: 𝟏𝟎𝟎
AGC
Carrier recovery,
Automatic Gain Control
𝟐𝝅
RRC Filter Decimation: 2
Symbol Sync Timing recovery, samples/symbol: 2
Fig. 1: Schematic representation of the GnuRadio receiver chain and points (probes) where the IQ samples are taken: radio, costasloop, agc, rrc, and symbsync.
(a)
(b)
(c)
(d)
(e)
Fig. 2: IQ samples visualization example. We report 105 IQ samples taken from the probes radio (a), costasloop (b), agc (c), rrc (d), and finally, symbsync (e).
symbol synchronizer samples the symbol centers, projecting the continuous-time waveform onto a set of points that again cluster along a narrow horizontal line, i.e., {−1, 1} according to the adopted BPSK modulation. Overall, Fig. 2 shows that each GNU Radio block in the receiver chain (Fig. 1) fulfills a dedicated communication-oriented objective, namely, phase alignment, power normalization, pulse shaping, and timing recovery. In doing so, each block transforms the signal from the previous probe. As a consequence, the IQ structure (and the fingerprint of the transmitter) observed at one stage is not preserved, but is instead reshaped or partially removed by the subsequent processing stages. Baseline configuration. The objective of this paper is not to maximize absolute RFF accuracy, but to isolate the effect of probe location under a fixed and reproducible reconstructionbased pipeline. Accordingly, we consider a state-of-the-art image-based AE (baseline) used in several recent RFFI works, e.g., [9], [5], [23], [32]. The baseline follows an imagebased RFFI pattern: it converts IQ samples into compact 2D histogram-like representations, trains an unsupervised AE on enrolled-device samples, and uses reconstruction error for openset scoring. We therefore treat the baseline as a controlled reference implementation rather than as a newly proposed RFF architecture. This choice keeps the probe comparison interpretable: changes in performance can be attributed primarily to the probe and not to probe-specific model tuning. Therefore, we adopt a standard pre-processing pipeline aligned with state-
of-the-art image-based RFFI. The baseline configuration implements an unsupervised, per-(TX, probe) shallow autoencoder trained on 32 × 32 RF “images” derived from IQ data (as discussed in Sect. IV). Each image is produced by slicing the IQ stream into chunks of 100, 000 samples, mapping the pair (|I|, Q) into a 2-D histogram (histcounts2) using (consistent) bin edges from the 5th –95th percentiles of the training data, applying log(1 + x) compression, and normalizing to an 8-bit range, i.e., [0, 255]. We highlight the importance of considering the absolute value of the I component. As an example, considering the symbsync probe, Fig. 2(e), the BPSK constellation concentrates into two tight clusters around (I ≈ −1) and (I ≈ +1) with (Q ≈ 0). If we build the 2-D histogram on the whole I-Q plane directly, these two clouds fall at opposite sides of the I-axis range. With a coarse 32 × 32 binning, most bins between the clouds are never populated, producing an almost empty image (all zeros) with only two small “activated” regions. Such sparse, low-occupancy inputs are poorly informative for the AE. During training, all images are loaded, vectorized to a 32×32 grid (1024 pixels), scaled to [0, 1], and concatenated as columns to form the final classifier input. The network is trained with the standard trainAutoencoder function using a 64-unit bottleneck, 300 epochs, L2 weight regularization of 0.001, sparsity regularization of 0.005, and the logsig transfer functions in both the encoder and the decoder. At test time, the same image pipeline (with the same bin edges computed during
4
symbsync
symbsync
1
True Acceptance Rate (TAR)
3
logMSE
2 1 0 -1 -2 -3
0.8
0.6
1 2 3 4 5 6 7 8 9 10 11 12
0.4
0.2
O th 1 er s O th 2 er s O th 3 er s O th 4 er s O th 5 er s O th 6 er s O th 7 er s O th 8 er s O th 9 er s O 1 th 0 er s O 1 th 1 er s O 1 th 2 er s
-4
Fig. 3: ϵ̄ as a function of all the possible pairs (Transmitter ID, Others) when considering the baseline design. Error-bars show the minimum, maximum, and median of the ϵ̄ while considering In-distribution (red) and Out-of-Distribution (black) samples.
training) is used; the model reconstructs using the predict function, and the per-image reconstruction error is computed using the MSE. V. M ETHODOLOGY Our main evaluation is “single-enrolled” and probefixed: one reference entity (T̄ , P̄ ) is enrolled, with T̄ ∈ {1, . . . , 12} representing the transmitter, and P̄ ∈ {radio, costasloop, agc, rrc, symbsync} representing the probe. For each enrolled pair (T̄ , P̄ ), the model is trained only on training samples from transmitter T̄ collected at probe P̄ . At test time, ID samples are held-out samples from the same pair (T̄ , P̄ ), while OOD samples are samples from all other transmitters collected at the same probe, i.e., (T, P̄ ), with T ̸= T̄ . This strategy isolates transmitter discrimination at a fixed receiver-chain observation point. Cross-probe generalization is studied separately in Sect. VIII. Each chunk of IQ samples (105 ) is mapped to a 2D image representation x and fed into the autoencoder AE(◦) to produce a reconstruction x̂. We use the reconstruction MSE as a scalar score, i.e., ϵ̄ = log(MSE(x, x̂)), where x̂ = AE(x). Figure 3 shows ϵ̄ as a function of all the possible comparisons between a reference transmitter T ∈ {1, . . . , 12} and the remainder of the pool (Others), when considering only the symbsync probe. The error bars show the minimum, maximum, and median associated with the reconstructions ϵ̄, while considering the red and black bars for the ID and OOD samples, respectively. We note that there is only minor overlap between the red and black error-bars. Thus, the symbsync probe is a good candidate for RFFI when considering the baseline methodology. In the following, we investigate the performance in more detail using the Receiver Operating Characteristics (ROC) analysis. To this aim, we consider two metrics: True Acceptance Rate (TAR)
0 10-3
10-2
10-1
100
False Acceptance Rate (FAR)
Fig. 4: TAR as a function of the FAR while considering the baseline neural network design.
and False Acceptance Rate (FAR). The TAR, or True Positive Rate (TPR), measures the classifier’s performance to correctly identify the reference entity, while the FAR, or False Positive Rate (FPR), measures the classifier’s performance to wrongly accept the identity of an unauthorized entity. We stress that we use the term open-set in the standard operational sense that the model is trained only on samples from an enrolled transmitter-probe pair and must reject samples from non-enrolled transmitters. This methodology should not be interpreted as an exhaustive open-world deployment with arbitrary numbers of unseen devices, signals, receiver implementations, or channels. Indeed, our dataset contains twelve SDR transmitters and is intended to isolate the effect of receiverchain probe location under controlled conditions. Therefore, the FAR/ TAR values reported below should be read solely as comparative probe-dependent evidence within this measurement campaign, not as a universal deployment-scale false-acceptance estimate. We characterize the one-vs-others classification performance by sweeping the decision threshold τ applied to the ϵ̄. To this aim, we use a lower-is-better criterion, i.e., we ensure that lower reconstruction errors are mapped to higher scores. For each τ , we compute the TAR(τ ) and FAR(τ ), then plot TAR (y-axis) versus FAR (x-axis). Figure 4 shows the results for the symbsync probe. The vast majority of transmitters can be identified (TAR ≈ 1) with FAR = 0. Conversely, only 4 (out of 12) transmitters feature TAR = 0.9 while requiring FAR < 0.09. In the remainder of our analysis, we set TAR = 0.9 as a quality reference for the classifier and compare the FAR required to achieve such a value as a criterion for feasible RFFI. We stress that the adoption of FAR at TAR = 0.9 should be considered as an operating-point summary rather than an universal deployment target. Operationally, TAR = 0.9 means that the system accepts 90% of held-out samples from the
VI. LLM-A SSISTED N EURAL N ETWORK D ESIGN We consider several options to decorrelate our findings and conclusions from the specific configuration of the image-based AE (baseline). To this aim, we investigate the extent to which various publicly available LLMs could design enhanced neural networks suitable for open-set RFFI. We provide a reference implementation, i.e., our baseline, to five selected LLMs, representing diverse commercial players in the LLM ecosystem: (i) GPT5.2, (ii) Claude Sonnet 4.6, (iii) GLM5, (iv) Gemini 3.1 Pro, and (v) SuperGrok. We considered the following prompt: “The enclosed scripts represent a baseline to perform radio frequency fingerprinting on MATLAB 2023b with all the toolboxes installed. Improve the performance of the classifier in terms of discrimination (accuracy). You can arbitrarily change the implementation of LLMTrain(obj, trainSet) by considering (if needed) any type of network structure. The other parts of the code should stay the same.” We arranged the code in order to isolate the definition of the AE structure inside the function LLMTrain(◦), thus enforcing the same data pre-processing and post-processing for all the considered AEs. We stress that our main objective is to investigate the feasibility of using LLM to generate AEs that maximize the accuracy of the RFFI. LLM-assisted design of AE. Table II summarizes the main differences between the suggested LLM-based designs and our provided baseline. In this setting, the reconstruction MSE, computed per sample by averaging over the 1024 pixels, serves directly as the reference metric to check the identity of the transmitter; therefore, any architectural or training change that alters the reconstruction on in-distribution versus out-of-distribution samples is expected to translate into measurable shifts in the MSE separation. The LLM-based AE designs explore three principal directions. First, SuperGrok and GLM5 replace the vector autoencoder with convolutional autoencoders trained via trainNetwork, operating on 4-D tensors (32 × 32 × 1 × N ) and using ReLU-based feature extraction. This approach introduces an explicit spatial inductive bias: local patterns in the IQ-histogram plane can be encoded in a compositional way rather than through dense global connections. GLM5 further increases capacity and stabilizes optimization via batch normalization, dropout, and a scheduled learning rate decay, whereas SuperGrok adopts a compact, symmetric Convolutional Autoencoder (CAE). Second, GPT5.2 and Gemini 3.1 retain the trainAutoencoder interface but reshape the network design via stronger constraints: GPT5.2 enforces a smaller bottleneck (32 vs. 64) with higher sparsity and controlled scaling, while Gemini 3.1 combines sparsity with denoising
Baseline GPT 5.2
Claude Sonnet 4.6 Gemini 3.1 Pro
GLM5 SuperGrok
1
FAR given TAR = 0.9
enrolled transmitter; the reported FAR is then the fraction of non-enrolled transmitter samples that would be incorrectly accepted at that same threshold. Lower values of FAR at this set value of TAR indicate a cleaner separation between enrolled and non-enrolled reconstruction errors. We use this metric primarily for relative comparisons across probes and AE designs. For deployment purposes, specific values of FAR can be set according to operational requirements.
1e-1
1e-2
1e-3
0 radio
costasloop
agc
rrc
symbsync
Probe position
Fig. 5: Performance (FAR given TAR = 0.9) as a function of the RFFI network and the considered probe. Each black marker corresponds to a different transmitter (out of 12), while the bold red marker corresponds to the median value. (Gaussian perturbations during training only) to improve robustness. Third, Claude Sonnet 4.6 moves to a dlnetwork CAE trained with a custom Adam loop, by adding a latent center-loss term to the reconstruction loss, thus penalizing how far each sample’s latent vector deviates from the batch mean, while using gradient clipping, thereby encouraging tightly clustered latent representations for in-distribution training data. The convolutional structure and deeper capacity may reduce in-distribution MSE, at the expense of general reconstruction; conversely, stronger sparsity/denoising and latent structure should increase discrimination by degrading out-of-distribution reconstructions relative to the baseline. VII. P ERFORMANCE EVALUATION Figure 5 summarizes RFFI performance by reporting, for each pair (LLM-design, probe), the FAR required to achieve TAR = 0.9 across all 12 transmitters (black markers), with the median transmitter highlighted in red. Lower values of FAR indicate better separation between ID and OOD reconstructions, and FAR = 0 corresponds to complete separation. The results show that reliable image-based RFFI is highly probe-dependent: only costasloop and symbsync allow low-FAR operation, whereas radio, agc, and rrc generally require FAR > 0.1, indicating substantial overlap between ID and OOD reconstruction-error distributions. A key takeaway from Fig. 5 is that the receiver blocks that are beneficial for communications (carrier recovery and timing alignment) can also be beneficial for RFF in this setting: symbsync and, to a lesser extent, costasloop yield a signal representation where device-specific residuals are more easily captured by reconstruction-based scoring, while agc and rrc filtering tend to reduce or homogenize amplitude/transient peculiarities, and thus, affecting open-set separability. This behavior is consistent with the progressive “regularization” of the IQ structure along the chain observed in Sect. IV.
TABLE II: Comparison of our RFFI baseline with other LLM-driven designs (DL component).
SuperGrok GPT5.2 GLM5 Gemini 3.1 Pro Claude Sonnet 4.6
Core model/training trainAutoencoder, hidden=64, logsig/logsig CAE via trainNetwork (conv/pool + tconv) trainAutoencoder tuned Deeper CAE (trainNetwork) with BN/dropout/LR schedule trainAutoencoder with noise + strong sparsity CAE as dlnetwork + custom loop
Network input 1024×N vectors
Main difference respect to baseline Minimal sparsity (0.005), L2=0.001
32×32×1×N
Spatial convolutions, ReLU stack
1024×N 32×32×1×N 1024×N
Smaller bottleneck + strong sparsity Higher-capacity CAE + explicit regularization (BN/dropout) Noise injection + strong sparsity
32×32×1×N
Reconstruction + latent centre loss, grad clipping
The observed “probe ranking” suggests a tradeoff between signal variance suppression and fingerprint preservation. Receiver processing can help RFFI by removing variations that are not stable transmitter properties (so, not consistent with the radio fingerprint). For example, carrier recovery reduces phase and frequency offsets, and timing recovery aligns samples near symbol centers; both effects can make samples from the same enrolled transmitter more consistent, thereby tightening the ID reconstruction-error distribution. At the same time, some processing stages may also suppress residual hardware-dependent characteristics that are useful for distinguishing transmitters. For example, the agc block can reduce amplitude-related differences, while rrc filtering can smooth high-frequency or transient components that may carry device-specific information. Therefore, a probe is beneficial when it reduces withintransmitter variability more than it removes between-transmitter differences. In our measurements, the probes costasloop and especially symbsync appear to achieve this empirical balance better than radio, agc, or rrc. Finding VII.1. Receiver blocks that reduce impairments for demodulation, e.g., carrier phase/timing uncertainty, can also reduce within-transmitter variability, which in turn can improve ID–OOD separability under reconstruction-error scoring; however, other blocks, e.g., agc/rrc, may also remove device-specific features, and thus, affect RFF. Finally, although LLM-designed networks increase architectural diversity, Fig. 5 indicates that most LLM-driven designs do not improve the performance of the baseline under the same preprocessing and reconstruction-MSE decision rule. A plausible explanation is that higher-capacity or better-regularized models may improve reconstruction not only for ID data but also (to some extent) for OOD data, thereby affecting to a limited extent the ID–OOD score gap. This suggests that increasing model capacity or adding stronger regularization can make reconstructions more accurate for both enrolled (ID) and nonenrolled (OOD) signals, shrinking the separation that openset detection relies on. SuperGrok at the symbsync probe stands out as the only positive case, indicating that a compact convolutional AE can better match the 2D histogram structure without improving (too much) OOD reconstructions.
10
MSE computation mean((recon-x).ˆ2) → per-sample mean over [H,W,C] → per-image same as baseline per-sample after reshape same as baseline per-sample over [H,W,C]
3
Training Testing
102
Time [Seconds]
LLM model Baseline
101 100 10-1 10-2 Ba
se
lin
e
T GP Cla
5.2
ud
e
n So
ne
t4
.6
ni mi Ge
3.1
Pro
M5 GL
p Su
rok erG
AE Model
Fig. 6: Training and testing time (seconds) as a function of the LLM-based design of the neural network. Finding VII.2. Considering the same front-end (IQ-samples → images) pipeline and the reconstruction-error score held fixed, LLM-based designs do not improve the baseline at the chosen operating point (TAR = 0.9) and often require a higher FAR—the only exception being SuperGrok with processing samples taken from symbsync probe. We also analyze training and inference times. Figure 6 shows the time to train and test the same amount of data (70% of the available dataset for each configuration). Indeed, we recall that the train and test sets do not have the same size (70/30), so we scaled the actual test set timings by a factor of 0.7 0.3 . Error-bars show the quantiles 5, 50, and 95 associated with the timings of the training and testing procedures for the baseline design and the different LLM-suggested neural networks. While the differences in inference times are not significant, training is more significantly affected by the neural network design. Indeed, the training time spans between 10 s (median) for the baseline to about 748 s (median) for Claude Sonnet 4.6. VIII. P ROBE -AWARE E NROLLMENT AND C ROSS -P ROBE T RANSFERABILITY Multi-probe enrollment. The methodology discussed so far
1
0.8
0.8
0.6
0.6
AUC
FAR given TAR = 0.9
1
0.4
0.4
0.2
0.2
0 Ba
s
n el i
e GP
.2 T5
Cla
ud
e
n So
n
4 et
.6
ni mi Ge
Pro 3.1
M5 GL
p Su
rok erG
AE model
Fig. 7: Performance (FAR given TAR = 0.9) as a function of the AE network, considering a model trained on all the probes. Each black marker corresponds to a different transmitter (out of 12), while the red marker highlights the median value.
focused on the enrollment (single-TX, probe). However, the information coming from several probes could potentially enhance RFFI performance. Under this assumption, in this section, we examine all probe positions during enrollment. Concretely, for a given enrolled transmitter, i.e., T̄ ∈ {1, . . . , 12}, we train each model (baseline + all LLM-designed AEs) using the union of the available data coming from all probes, i.e., P ∈ {radio, costasloop, agc, rrc, symbsync}. Testing is then performed on the remainder of the transmitters, i.e., T ∈ {1, . . . , 12} \ T̄ , again considering all probes altogether, using the same reconstruction-error scoring rule. Figure 7 shows the FAR at TAR = 0.9 as a function of the considered LLM-based model. The black markers represent the operating point (FAR at TAR = 0.9) for each transmitter, and we highlight the median in red. The outcome is consistently poor: ID and OOD reconstruction-error distributions heavily overlap, producing ROC curves close to a random-guess behavior and operating points that require large FAR to sustain a reasonable TAR = 0.9. This happens across the baseline and all LLM-generated architectures, indicating that the issue primarily stems from the source mismatch introduced by mixing probes rather than from the specific AE design. This behavior can be explained by noting that each probe corresponds to a distinct signal generated by a distinct receiver transformation. Combining the probes makes the ID samples (more) multimodal and dominated by probe-specific structure; i.e., the variability introduced by the processing stages is larger than the device-specific features we want the model to use as a fingerprint. Under a reconstruction objective, i.e., minimization of the MSE, the autoencoder is biased to learn a representation that is probe-robust and that captures shared features; as a side effect, it tends to reconstruct OOD samples better than desired (shrinking the ID–OOD gap), while also increasing the ID errors due to cross-probe heterogeneity.
0 Ba
se
lin
e
T GP Cla
5.2
ud
e
n So
ne
t4
.6
ni mi Ge
3.1
Pro
M5 GL
p Su
rok erG
AE model
Fig. 8: Area Under the Curve (AUC) training on data coming from a specific probe and testing on any other probe, considering the same transmitter as a function of the LLM model.
Overall, our findings reinforce a practical conclusion: multi-probe pooling during enrollment is counterproductive for reconstruction-error open-set RFF: probe-aware strategies, e.g., per-probe enrollment, achieve better performance. Cross-Probe Transferability. Figure 8 reports a cross-probe analysis designed to quantify to what extent the receiver-chain probe reshapes the learned representation for a given transmitter. For each transmitter and enrollment probe, we train an AE using only data from the pair. We then evaluate the same trained model on: (i) (disjoint) data from the same pair transmitterprobe, treated as ID, and (ii) data from the same transmitter but different probes, treated as OOD. This procedure is repeated for all transmitter/probe combinations, and the resulting ROC AUC summarizes how separable the ID vs. cross-probe OOD reconstruction-error distributions are for each model family. An AUC close to 1 indicates that the reconstruction-error score reliably separates samples collected at different probes, even when the transmitter is unchanged. Thus, this entails that the autoencoder trained on a given probe systematically assigns higher reconstruction errors to samples from any other probe. In turn, this result implies that probe-dependent transformations dominate the features seen by the reconstruction model, consistent with the idea that each receiver block reshapes (or partially suppresses) device-dependent structures. The baseline is characterized by AUC≈ 1 almost everywhere, reinforcing the earlier conclusion that probes reshape the fingerprint representation. The same values (with some anomalies) can be seen in GPT5.2, Claude Sonnet 4.6, and Gemini 3.1 Pro. We investigated the cases of GLM5 and SuperGrok in more detail by manually inspecting the AUC values and the pairs of probe-transmitter affected by the anomalies. Our analysis shows that AUC<< 1 is best interpreted as a failure of the reconstruction-error across probes, rather than a metric to prove feature preservation. Indeed, both models, i.e., GLM5 and SuperGrok, are still characterized by high AUC (≈ 1), but
with isolated (non-consistent) anomalies, where OOD samples are easier to reconstruct than ID samples (inversion). Such a behavior (in particular for probes rrc and agc) is consistent and can be explained by recalling Sect. VII, i.e., improving “general” reconstruction can also improve OOD reconstruction. SuperGrok is representative, especially considering rrc and agc, as it tends to homogenize or suppress device-specific artifacts, increasing the overlap between ID and OOD samples. IX. D ISCUSSION This work represents a controlled experimental probesensitivity study. We isolate an under-reported design variable: the receiver-chain point at which IQ samples are collected. The central claim is that this choice substantially alters reconstruction-based open-set RFFI and, therefore, should be explicitly reported, controlled, and evaluated. Accordingly, RFFI solutions should not treat IQ collection location as an incidental logging detail. A pipeline that appears ineffective at one probe may become viable (or a top performer) at another, while pooling probes can degrade performance. Therefore, RFFI works should report probe location alongside model architecture and dataset details. The tap matters more than the AE. Our results show that, for reconstruction-error image-based open-set RFFI, the data source, i.e., where the signal is observed in the receiver chain, matters more than the configuration of the image-based AE. Across five probe positions, we observe that timing recovery (symbsync) and, to a lesser extent, carrier recovery (costasloop),produce representations that enable low-FAR operation at TAR = 0.9, while the other processing stages, i.e., radio, agc, and rrc, tend to exhibit a substantial overlap between ID and OOD reconstruction-error distributions. Thus, processing blocks that reduce phase and timing uncertainty can also reduce within-transmitter variability, thereby tightening the ID error distribution and improving MSE-based discrimination. Not All IQs Are Equal. A second, closely related implication is that the receiver processing chain is not transparent to RFFI. Standard communications-oriented transformations reshape the joint IQ distribution in ways that can either amplify or suppress the features that RFFI relies on. In our setting, symbsync and costasloop appear to be the best data sources: they reduce the variation (timing/phase), yet preserve enough consistent device-dependent features for a reconstruction-based model to treat OOD samples as “harder to reconstruct” than ID samples. LLM-based AE design. Within this probe-aware framing, our LLM-generated image-based AE variants serve primarily as a controlled stress test of the hypothesis that more complex architectures could align performance across probes and possibly improve discrimination. When the front-end IQ-to-image pipeline and the reconstruction-MSE decision rule are held fixed, different AE designs do not improve operating-point performance, and frequently worsen it. SuperGrok at symbsync suggests that some inductive biases—a convolutional structure aligned with the 2D histogram representation—can improve ID
reconstruction without proportionally improving OOD reconstruction, paving the way for future analyses. Takeaway. Our timing results bias the trade-off even further: while inference cost is comparable across designs, the training time increases significantly, without any significant gain in separability (Fig. 6). For an operational RFFI pipeline that must be retrained across devices, time, or environments, this finding suggests a straight priority order: (1) choose the probe/representation that maximizes separability, then (2) keep the AE design as simple as possible unless there is strong evidence that added complexity improves the ID–OOD gap for that specific probe. Limitations. Our evaluation considers a specific measurement configuration (hardware, receiver chain, modulation, dataset scale) and a fixed representation, i.e., 32 × 32 histogram “RF images” with a fixed chunk size and binning policy. Although the probe ranking could change considering different modulations, receiver implementations, quantization, over-theair channels, or front-end impairments, the different shapes characterizing IQ samples collected at different probes (see Fig. 2) are very likely to yield the same main finding, i.e., the dependence of RFFI performance on the specific probe. Moreover, we do not claim that the absolute probe ranking reported in this paper holds unchanged across all modulations, transmitters, receivers, channels, or over-the-air deployments. Future work could investigate how much such ranking holds with more complex high-order modulation schemes. Furthermore, we report performance primarily via FAR at TAR = 0.9. Although this choice does not capture all operating scenarios, it is appropriate for operational comparison at a fixed quality target. Finally, we do not consider physical-layer spoofing attacks, where an adversary intentionally biases the transmitted IQ samples to resemble the enrolled transmitter at a chosen probe. Such attacks are distinct from the non-enrolledtransmitter OOD setting studied here. Our results characterize probe dependence under (non-malicious) transmitter mismatch, rather than robustness against an attacker with knowledge of the receiver chain and the RFFI model. Evaluating whether probe choices that improve separability also increase or decrease spoofing resistance is an important direction for future work. X. C ONCLUSION In this work, we assess how strongly the performance of Physical-layer, open-set, image-based RFFI depends on the receiver-chain probe used for data collection, i.e., the stage at which the IQ samples are acquired. By logging IQ data at five tap points along a GNU Radio BPSK receiver chain, we showed that RFFI performance is strongly probe-dependent. In particular, timing recovery (symbsync)—and, to a lesser extent, carrier recovery (costasloop)—supports low false acceptance at a target operating point, e.g., FAR at TAR = 0.9, while other processing stages often exhibit substantial ID-OOD score overlap. These results indicate that receiver blocks reducing phase/timing uncertainty can tighten within-transmitter variability and improve separability, whereas other blocks may suppress device-specific features. As a secondary contribution,
we benchmarked several LLM-designed image-based AEs for RFFI under a controlled approach that keeps the preprocessing pipeline and MSE scoring rule fixed while changing only the network design. Most LLM-generated architectures did not improve the baseline at the chosen operating point, but just degraded it, with only one notable exception (SuperGrok for the probe symbsync). Overall, the key takeaway is practical: “where you tap” in the receiver chain can matter more than the AE architecture for reconstruction-based open-set RFFI. R EFERENCES [1] A. Jagannath, J. Jagannath, and P. S. P. V. Kumar, “A comprehensive survey on radio frequency (RF) fingerprinting: Traditional approaches, deep learning, and open challenges,” Computer Networks, vol. 219, p. 109455, 2022. [2] J. Smailes, S. Köhler, S. Birnbach, M. Strohmeier, and I. Martinovic, “SatIQ: Extensible and Stable Satellite Authentication using Hardware Fingerprinting,” ACM Transactions on Privacy and Security, vol. 29, no. 1, pp. 1–35, 2025. [3] Q. Xu, R. Zheng, W. Saad, and Z. Han, “Device Fingerprinting in Wireless Networks: Challenges and Opportunities,” IEEE Communications Surveys & Tutorials, vol. 18, no. 1, pp. 94–104, 2016. [4] T. J. Bihl, K. W. Bauer, and M. A. Temple, “Feature Selection for RF Fingerprinting With Multiple Discriminant Analysis and Using ZigBee Device Emissions,” IEEE Transactions on Information Forensics and Security, vol. 11, no. 8, pp. 1862–1874, 2016. [5] S. Alhazbi, S. Sciancalepore, and G. Oligeri, “The Day-After-Tomorrow: On the Performance of Radio Fingerprinting over Time,” in Proc. of the 39th Annual Computer Security Applications Conference, ser. ACSAC ’23, New York, NY, USA, Dec. 2023, pp. 439–450. [6] J. Wigchert, S. Sciancalepore, and G. Oligeri, “Detection of Aerial Spoofing Attacks to LEO Satellite Systems via Deep Learning,” Computer Networks, vol. 269, p. 111408, 2025. [7] J. Smailes, S. Köhler, S. Birnbach, M. Strohmeier, and I. Martinovic, “Watch This Space: Securing Satellite Communication through Resilient Transmitter Fingerprinting,” in Proc. of the 2023 ACM SIGSAC Conf. on Computer and Communications Security. ACM, Nov. 2023, pp. 608–621. [8] A. Al-Shawabka, F. Restuccia, S. D’Oro, T. Jian, B. C. Rendon, N. Soltani, J. Dy, S. Ioannidis, K. Chowdhury, and T. Melodia, “Exposing the Fingerprint: Dissecting the Impact of the Wireless Channel on Radio Fingerprinting,” in IEEE INFOCOM 2020-IEEE Conference on Computer Communications. IEEE, 2020, pp. 646–655. [9] G. Oligeri, S. Sciancalepore, S. Raponi, and R. D. Pietro, “PASTAI: Physical-Layer Authentication of Satellite Transmitters via Deep Learning,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 274–289, 2023. [10] M. Irfan, M. Al-Malki, S. Sciancalepore, and G. Oligeri, “Radio Frequency Fingerprinting: Models, Methodologies and Performance,” in 2025 Int. Wireless Communications and Mobile Computing (IWCMC), May 2025, pp. 61–66. [11] S. Al-Hazbi, A. Hussain, S. Sciancalepore, G. Oligeri, and P. Papadimitratos, “Radio frequency fingerprinting via deep learning: Challenges and opportunities,” Int. Wireless Communications and Mobile Computing (IWCMC), pp. 0824–0829, 2024. [12] M. Aqib Khan and M. Usman Siddiqui, “A Comprehensive Survey on Feature Extraction Techniques Using I/Q Imbalance in RFFI,” Feb. 2025, publication Title: arXiv e-prints ADS Bibcode: 2025arXiv250202782A. [13] Z. Yao, Y. Peng, Y. Wang, C. Xu, J. Wang, Y. Lin, and G. Gui, “A Novel Radio Frequency Fingerprint Concealment Method Based on IQ Imbalance Compensation and Digital Pre-Distortion,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 7349–7361, 2024. [14] Y. Niu, W. Xiong, Z. Li, B. Dong, and X. Fu, “On the Identification Accuracy of the I/Q Imbalance-Based Specific Emitter Identification,” IEEE Access, vol. 11, pp. 75 462–75 473, 2023. [15] T. Yang, S. Liu, Y. Ren, H. Jia, Z. Shao, H. Liu, J. Yu, and H. Li, “Phase-Proof: Robust Mobile Two-Factor Authentication Via Phase Fingerprinting,” IEEE Transactions on Mobile Computing, pp. 1–15, 2025.
[16] C. G. Wheeler and D. R. Reising, “Assessment of the impact of CFO on RF-DNA fingerprint classification performance,” in 2017 Int. Conf. on Computing, Networking and Communications (ICNC). IEEE, 2017, pp. 110–114. [17] G. Yan, X. Fu, Y. Wang, Q. Zhang, and G. Gui, “Radio frequency fingerprint identification towards statistical and deep learning features: Review, recent results and future directions,” Peer-to-Peer Networking and Applications, vol. 18, no. 3, p. 116, Mar. 2025. [18] J. Yu, A. Hu, F. Zhou, Y. Xing, Y. Yu, G. Li, and L. Peng, “Radio Frequency Fingerprint Identification Based on Denoising Autoencoders,” 2019 Int. Conf. on Wireless and Mobile Computing, Networking and Communications (WiMob), pp. 1–6, 2019. [19] A. Elmaghbub and B. Hamdaoui, “No Blind Spots: On the Resiliency of Device Fingerprints to Hardware Warm-Up Through Sequential Transfer Learning,” in Proc. of the 17th ACM Conf. on Security and Privacy in Wireless and Mobile Networks, ser. WiSec ’24. New York, NY, USA: Association for Computing Machinery, May 2024, pp. 134–144. [20] A. Nieves and A. M. Wyglinski, “Measurements and Analysis of Ambient Temperature on RF Fingerprinting Machine Learning Models,” IEEE Transactions on Instrumentation and Measurement, vol. 75, pp. 1–10, 2026. [21] Q. Cai, N. Liu, and Z. Pan, “RFF Identification with CGAN-based Channel Estimation in Time-Varying Channels,” in 2025 6th Int. Conf. on Computing, Networks and Internet of Things (CNIOT), May 2025, pp. 1–6. [22] L. Papangelo, M. Pistilli, S. Sciancalepore, G. Oligeri, G. Piro, and G. Boggia, “Adversarial machine learning for image-based radio frequency fingerprinting: Attacks and defenses,” IEEE Communications Magazine, vol. 62, no. 11, pp. 108–113, 2024. [23] M. Irfan, G. Oligeri, and S. Sciancalepore, “Shifting Signatures: The Ephemeral Nature of the Radio Fingerprint on the USRP X310,” in 2025 IEEE Conf. on Communications and Network Security (CNS), Sep. 2025, pp. 1–6, iSSN: 2994-5895. [24] G. Oligeri, S. Sciancalepore, and A. Sadighian, “SatPrint: Satellite Link Fingerprinting,” in Proc. of the 39th ACM/SIGAPP Symposium on Applied Computing, ser. SAC ’24. New York, NY, USA: Association for Computing Machinery, May 2024, pp. 177–185. [25] ——, “FadePrint - Satellite Spoofing Detection via Fading Fingerprinting,” in 2024 IEEE 21st Consumer Communications & Networking Conf. (CCNC), Jan. 2024, pp. 827–830. [26] S. Alhazbi, S. Sciancalepore, and G. Oligeri, “BloodHound: Early Detection and Identification of Jamming at the PHY-layer,” in 20th Consumer Communications & Networking Conf. (CCNC). IEEE, 2023, pp. 1033– 1041. [27] R. Huang, X. Peng, Z. Chai, M. Li, J. Ren, and X. Yang, “Radio frequency fingerprint extraction and authentication towards open set in noisy channels,” Digital Signal Processing, vol. 146, p. 104363, Mar. 2024. [28] Y. Zhou, “Rethinking reconstruction autoencoder-based out-ofdistribution detection,” in Proc. of the IEEE/CVF Conf. on Computer Vision and Pattern Recognition (CVPR), June 2022, pp. 7379–7387. [29] Z. Xiao, Q. Yan, and Y. Amit, “Likelihood Regret: An Out-of-Distribution Detection Score For Variational Auto-encoder,” in Advances in Neural Information Processing Systems, H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin, Eds., vol. 33. Curran Associates, Inc., 2020, pp. 20 685–20 696. [30] S. Tayebi Arasteh, T. Han, M. Lotfinia, C. Kuhl, J. N. Kather, D. Truhn, and S. Nebelung, “Large language models streamline automated machine learning for clinical studies,” Nature Communications, vol. 15, no. 1, p. 1603, Feb. 2024. [31] M. U. Nasir, S. Earle, J. Togelius, S. James, and C. Cleghorn, “Llmatic: Neural architecture search via large language models and quality diversity optimization,” in Proc. of the Genetic and Evolutionary Computation Conf., ser. GECCO ’24. New York, NY, USA: Association for Computing Machinery, 2024, p. 1110–1118. [32] G. Oligeri and S. Sciancalepore, “Beyond Static Signatures: Statistical Analysis of Radio Fingerprint Mutations,” in Proceedings of the 19th ACM Conference on Security and Privacy in Wireless and Mobile Networks, 2026, pp. 239–249.