Carrier Frequency Offset (CFO)

CFO arises from the physical inability of a transmitter's local oscillator (LO) to generate a carrier frequency exactly matching its design specification. This offset is caused by manufacturing process variations in quartz crystal resonators, thermal drift, and component aging. Unlike intentional modulation, this impairment is an unintentional, analog artifact unique to each silicon instance.

A device's CFO is not a static constant but exhibits a quasi-stationary behavior. Short-term stability is high, making it viable for authentication within a single session. Long-term drift, however, is influenced by:

• Ambient temperature fluctuations causing frequency pulling
• Supply voltage variations
• Aging of the crystal oscillator Effective fingerprinting systems must implement drift compensation algorithms to update the enrolled CFO profile over time.

A critical challenge in CFO-based fingerprinting is disambiguating the hardware-induced offset from the channel-induced Doppler shift. A receiver observes the sum of both effects. Separation is achieved through:

• Geometric analysis: Doppler is proportional to relative velocity and carrier frequency.
• Multi-antenna estimation: Spatial diversity helps isolate the common transmitter CFO from angle-dependent Doppler.
• Temporal filtering: Doppler varies rapidly with motion, while the hardware CFO component remains relatively stable.

CFO is estimated at the receiver using preamble sequences or pilot tones known a priori. Common algorithms include:

• Moose algorithm: Uses two identical training symbols in the time domain to compute phase rotation.
• Schmidl-Cox algorithm: Employs a specially designed training symbol with two identical halves for robust timing and frequency synchronization.
• Cyclic Prefix correlation: Exploits the redundancy in OFDM symbols to estimate the fractional frequency offset.

In modern deep learning-based SEI systems, raw CFO is often not used as an explicit, hand-crafted feature. Instead, the neural network learns to extract CFO-induced phase rotation patterns directly from the complex baseband IQ samples. The CFO manifests as a linear phase ramp across time-domain samples or as inter-carrier interference (ICI) in OFDM systems. Contrastive learning frameworks are particularly effective at learning CFO-invariant embeddings that still capture other hardware-specific impairments.

CFO as a standalone fingerprint is vulnerable to impersonation attacks. A sophisticated adversary with a high-quality software-defined radio (SDR) can measure a target's CFO and precisely replicate the offset in its own transmission. Therefore, robust authentication systems never rely on CFO alone but combine it with non-linear impairments like I/Q imbalance and power amplifier non-linearity, which are significantly harder to clone.