SCOUT: Channel-Robust Universal Perturbations for RF Fingerprint Authentication

Abstract

Radio frequency fingerprint identification (RFFI) is increasingly proposed as a lightweight physical-layer authentication primitive for Internet-of-Things and edge devices, but deep RFFI models remain vulnerable to adversarial manipulation. This paper studies a narrow and realistic version of that problem: can a black-box attacker craft a single, low-power, spectrally compliant perturbation that survives channel uncertainty and causes targeted mis-authentication on real over-the-air (OTA) captures? To answer this question, we propose SCOUT, a channel-robust universal perturbation framework against AIbased RF fingerprint authentication. SCOUT learns transferable perturbations on ORACLE OTA measurements using a surrogate ensemble, expectation over transformation, and an explicit outof-band leakage penalty. Across five RFFI backbones and at PSR $=-20 \mathrm{~dB}$, SCOUT achieves 89.8-94.2% targeted attack success rate (ASR) in the digital setting and $79.5-84.6 \%$ after OTA-style channelisation. Spectral regularisation improves outof-band leakage from -14.1 dBc to -38.5 dBc with only a modest ASR drop. In contrast, channel-augmented adversarial training with spectral smoothing reduces transfer-based SCOUT ASR from 83.7% to 18.4% and adaptive white-box ASR from 91.5% to 32.7% on the ResNet victim. The results show that modern RFFI backbones remain highly exposed to channel-aware universal perturbations, and that practical robustness requires both attack-aware training and front-end sanitisation.