Out-of-Distribution Detection

The simplest baseline method that uses the maximum predicted probability from a classifier's softmax layer as a proxy for familiarity. A sample is flagged as OOD if its highest class probability falls below a calibrated threshold. Key limitation: Modern neural networks often produce overconfident predictions on far-from-distribution inputs, making raw softmax scores unreliable for detecting sophisticated adversarial spoofing devices. Temperature scaling and energy-based modifications can partially mitigate this miscalibration.

A parametric method that models the training data distribution for each class as a multivariate Gaussian in the feature space. The Mahalanobis distance—which accounts for feature covariance—is computed between a test sample and the closest class-conditional distribution. Samples with distances exceeding a chi-squared threshold are rejected. This approach provides calibrated confidence scores and is computationally efficient, but assumes the feature representations follow a Gaussian distribution, which may not hold for complex RF impairment signatures.

Uses the Helmholtz free energy formulation of a discriminative classifier to derive an OOD score that is theoretically aligned with the input's probability density. Unlike softmax, the energy score is not bounded and tends to be lower for in-distribution samples and higher for OOD inputs. This method requires no architectural changes and can be applied directly to pre-trained networks. It is particularly effective when combined with fine-tuning using an energy-regularized loss that explicitly shapes the energy landscape to separate known and unknown distributions.

Employs models like Variational Autoencoders (VAEs) or Normalizing Flows to explicitly learn the probability density of the training data. OOD detection is performed by evaluating the likelihood of a test sample under the learned distribution. However, counterintuitively, flow-based models can assign high likelihood to OOD inputs from simpler datasets. Recent advances use likelihood ratio methods that compare a model trained on the target distribution against a background model to correct for this anomaly, improving robustness for RF fingerprinting applications.

Non-parametric methods that operate on the learned embeddings of a pre-trained neural network. Techniques include:

• K-Nearest Neighbors (KNN): Flags samples whose average distance to the k closest training embeddings exceeds a threshold.
• Local Outlier Factor (LOF): Compares the local density around a sample to that of its neighbors.
• Isolation Forest: Exploits the property that OOD samples require fewer random splits to be isolated. These methods are model-agnostic and effective for detecting novel spoofing devices that map to sparse regions of the embedding space.

Leverages the magnitude and direction of gradients produced when a sample is backpropagated through a trained network. The core insight is that in-distribution samples produce smaller, more uniform gradient updates compared to OOD samples, which induce larger, more erratic gradients. GradNorm computes the L1 norm of gradients with respect to the final layer weights, while ODIN uses gradient-based input perturbations to amplify the separability between in-distribution and OOD softmax scores before applying temperature scaling.

The overarching classification paradigm that formalizes the OOD problem. Unlike closed-set classifiers that forcibly map every input to a known class, open set recognition explicitly models the unknown universe.

• Known Knowns: Correctly classified authorized devices
• Known Unknowns: Adversarial spoofing attempts flagged as 'unknown'
• Unknown Unknowns: Truly novel emitters never seen during training

The key metric is open space risk—the volume of feature space labeled as 'known' relative to the total space. Minimizing this risk is the core objective.

A geometric metric that characterizes the dimensional properties of the data subspace surrounding a sample point. Adversarial and OOD samples often reside in regions of anomalously high local dimensionality.

• Calculates the rate of growth in the number of neighbors as the radius expands
• In-distribution samples exhibit consistent, lower LID scores
• Spoofed or OOD samples produce sharply higher LID values

LID acts as an unsupervised signal that a sample lies off the training manifold, making it a powerful, attack-agnostic detection statistic.

A training-time regularization technique that forces the model to learn conservative decision boundaries by exposing it to auxiliary outlier datasets during training.

• An auxiliary dataset of diverse, irrelevant signals is curated
• The model is penalized for high confidence on these outliers
• The network learns to push OOD samples toward a uniform posterior distribution

This effectively teaches the model 'what it doesn't know' before deployment, dramatically improving its ability to flag unknown spoofing devices without sacrificing accuracy on known classes.

A defensive strategy that reduces the complexity of the input feature space to limit an adversary's degrees of freedom for constructing evasion attacks.

• Bit-depth reduction: Quantizing signal samples to fewer bits
• Spatial smoothing: Applying median or Gaussian filters to IQ representations
• Compares model predictions on original vs. squeezed inputs

If the prediction divergence exceeds a threshold, the sample is flagged as adversarial or OOD. Feature squeezing is computationally lightweight and compatible with existing fingerprinting models.

A self-supervised methodology that learns robust, discriminative feature representations without requiring explicit OOD labels during training.

• Positive pairs: Augmented views of the same legitimate device signal
• Negative pairs: Signals from different devices or noise
• The loss function pulls positives together and pushes negatives apart in embedding space

This pretraining creates a representation where in-distribution samples form tight clusters, and OOD samples naturally fall into the low-density regions between clusters, enabling simple distance-based detection.

A technique that uses a gradient reversal layer to force the neural network to learn channel-invariant features, ensuring OOD detection remains robust across diverse environmental conditions.

• A domain classifier tries to identify the channel condition
• The feature extractor is trained to fool the domain classifier
• The resulting features are stripped of channel-specific artifacts

This prevents the model from falsely flagging a legitimate device as OOD simply because it is operating in a new multipath environment, reducing false positives in dynamic deployments.