Local Intrinsic Dimensionality (LID)

Local Intrinsic Dimensionality (LID) measures the rate of growth in the number of data points encountered as the distance from a reference sample expands. In adversarial detection, LID assesses the dimensional properties of the local subspace surrounding a feature vector. Legitimate samples tend to lie in low-dimensional, tightly clustered manifolds. Adversarial examples, generated by perturbation, are often pushed into higher-dimensional, off-manifold regions. The LID score quantifies this dimensional discrepancy, providing a powerful statistical test to discriminate between clean and spoofed inputs.

LID is formally defined using the theory of extreme value distributions. For a sample point, the distribution of distances to its nearest neighbors is modeled as a Generalized Pareto Distribution. The LID estimate is derived from the scaling exponent of this distribution. A high LID value indicates that the probability mass around the point is concentrated in many directions, characteristic of a high-dimensional subspace. The Maximum Likelihood Estimator (MLE) is the standard algorithm for computing LID, using only the distances to the k-nearest neighbors, making it computationally tractable for real-time detection pipelines.

In a spoofing detection system, LID acts as a post-hoc detector attached to a pre-trained classifier. The workflow is:

• Extract feature vectors from the penultimate layer of the neural network.
• Compute the LID score for each input's feature vector relative to a clean baseline set.
• Flag inputs with anomalously high LID scores as potential adversarial spoofing attempts. This method is attack-agnostic, meaning it does not require prior knowledge of the specific algorithm used to generate the spoofed signal, making it effective against zero-day evasion attacks.

While both are used for out-of-distribution detection, they measure fundamentally different properties:

• Mahalanobis Distance: Measures the distance from a class centroid, normalized by the covariance. It assumes a Gaussian distribution and detects samples far from the mean.
• Local Intrinsic Dimensionality: Measures the local subspace expansion rate. It detects samples in anomalously high-dimensional regions, even if they are close to the centroid. LID is often more robust for detecting feature space poisoning and subtle perturbations that do not shift a sample far in Euclidean distance but push it off the data manifold.

LID-based detectors face specific challenges in RF fingerprinting contexts:

• Channel Variability: Multipath and fading can artificially inflate the local dimensionality of a legitimate signal, causing false positives. Domain adversarial training is required to learn channel-invariant features before LID computation.
• Curse of Dimensionality: In very high-dimensional feature spaces, the MLE estimator can become unstable. Dimensionality reduction via t-SNE or UMAP is often applied as a preprocessing step.
• Computational Overhead: Nearest-neighbor searches must be optimized using approximate nearest neighbor (ANN) libraries like FAISS for real-time, low-latency authentication.

LID is a foundational component of modern open set recognition systems for emitter identification. In a closed-set classifier, any input is forced into a known class. By adding a LID-based rejection layer, the system can:

• Classify known emitters with high confidence.
• Reject unknown or spoofed devices whose feature vectors exhibit high LID scores. This creates a robust open-world authentication framework that simultaneously handles known device identification and unknown threat detection, aligning with zero-trust security architectures.

The minimum number of variables required to represent the underlying structure of a dataset without significant information loss. Unlike the ambient dimension (the raw feature count), intrinsic dimensionality captures the true degrees of freedom in the data manifold.

• A 784-pixel MNIST digit has an ambient dimension of 784 but an intrinsic dimension closer to 10-15
• LID estimates this locally around a specific sample, revealing how the manifold expands in that neighborhood
• Adversarial samples often exhibit higher LID scores than normal samples, indicating they lie off the data manifold

The standard computational approach for estimating LID uses extreme value theory applied to the distribution of distances to nearest neighbors. The MLE estimator models the tail of the distance distribution as a Generalized Pareto Distribution.

• Given a sample and its k nearest neighbors, LID is computed from the ratio of distances
• A high LID indicates the sample sits in a region where the manifold expands rapidly in many directions
• This estimator is computationally efficient and requires only the neighbor distances, not the full dataset geometry

LID is used as a detection statistic to separate legitimate inputs from adversarial perturbations. The core insight: normal data lies on or near a low-dimensional manifold, while adversarial examples are pushed into higher-dimensional off-manifold regions.

• Classifiers are trained on LID scores from multiple layers of a neural network
• Cross-layer LID captures how dimensionality evolves through the network's internal representations
• Effective against FGSM, PGD, and C&W attacks without requiring knowledge of the attack method

LID is a powerful tool for open set recognition, where a classifier must reject inputs from unknown classes not seen during training. Unknown or adversarial samples typically exhibit anomalous LID characteristics.

• Combines traditional softmax probability with a LID-based anomaly score
• Extreme Value Machines (EVM) use Weibull distributions fitted to LID scores for calibrated open-set rejection
• Critical for RF fingerprinting systems that must reject previously unseen spoofing devices

The broader mathematical framework that LID operates within. Manifold learning assumes high-dimensional data concentrates near a low-dimensional manifold embedded in the ambient space.

• Techniques like t-SNE, UMAP, and autoencoders learn this manifold structure
• LID provides a local geometric measurement of how the manifold behaves at a specific point
• Adversarial training can be viewed as enforcing that perturbed samples remain on the data manifold

A closely related paradigm where LID serves as a distributional shift indicator. Samples drawn from a different distribution than the training data often have measurably different LID profiles.

• LID-based OOD detectors are attack-agnostic—they don't need examples of the specific attack
• Combined with Mahalanobis distance for state-of-the-art detection
• In RF fingerprinting, LID flags spoofed signals whose impairment signatures deviate from the learned transmitter manifold