CUSUM Drift Detection

CUSUM operates by accumulating deviations from a target reference value over time. Unlike Shewhart charts that only react to the last data point, CUSUM integrates the sequential history of a feature.

• Upper CUSUM (C⁺): Accumulates positive deviations above the target mean
• Lower CUSUM (C⁻): Accumulates negative deviations below the target mean
• Reset Mechanism: The statistic resets to zero when it crosses back over the target, preventing old history from masking new behavior

The core formula is C⁺ₜ = max(0, C⁺ₜ₋₁ + (xₜ - μ₀) - K), where K is a slack parameter (typically half the shift magnitude to detect) and μ₀ is the baseline mean.

The decision interval H defines the control limit. When the cumulative sum exceeds H, the algorithm signals a detected drift. The performance is measured by Average Run Length (ARL).

• ARL₀: Expected number of samples before a false alarm when no drift exists. A well-tuned CUSUM has an ARL₀ of 370 or higher
• ARL₁: Expected number of samples to detect a real shift of a given magnitude. CUSUM minimizes ARL₁ for a fixed ARL₀
• H and K Tuning: These parameters are selected based on acceptable false alarm rates and the minimum shift magnitude considered operationally significant

For fingerprinting, a shift of 0.5 to 1.0 standard deviations in a feature like carrier frequency offset is a typical detection target.

CUSUM is applied independently to each drift-sensitive impairment feature extracted from authenticated transmissions. Monitored features include:

• Carrier Frequency Offset (CFO): Tracks oscillator aging drift in parts-per-million
• IQ Gain Imbalance: Detects slow warping of the modulator's constellation
• DC Offset Magnitude: Monitors wander in the carrier leakage component
• Phase Noise Variance: Identifies degradation in local oscillator stability

Each feature has its own CUSUM instance with parameters tuned to its known temperature coefficient and aging rate. A drift alert is raised when any single feature or a weighted combination exceeds its threshold.

CUSUM can be configured for directional awareness, which is critical because hardware aging typically produces monotonic drift in a specific direction.

• One-Sided CUSUM: Monitors for shifts in only one direction (e.g., CFO only increasing). This is more sensitive for known aging trajectories
• Two-Sided CUSUM: Runs both upper and lower CUSUMs simultaneously to detect bidirectional shifts. Useful for features like I/Q phase imbalance that can drift in either direction depending on component stress
• Firmware Change Detection: A sudden bidirectional shift may indicate a firmware update rather than aging, triggering a different workflow

Directional monitoring reduces false alarms by ignoring deviations opposite to the expected aging vector.

A CUSUM alarm does not immediately revoke device trust. It triggers a graded response protocol within the drift compensation framework:

• Stage 1 - Elevated Logging: Increase sampling rate for the drifting feature to confirm persistence
• Stage 2 - Adaptive Reference Update: If authentication still succeeds, incrementally update the Exponential Moving Average (EMA) baseline to track the new mean
• Stage 3 - Full Re-enrollment: If the shift exceeds a secondary, wider threshold, initiate a secure challenge-response to re-establish the baseline signature
• Stage 4 - Security Flag: If re-enrollment fails or the drift rate exceeds the known aging profile, flag the device for potential spoofing or hardware failure

This staged approach balances security against the operational cost of unnecessary re-enrollment.

CUSUM offers distinct operational advantages for real-time, streaming fingerprint authentication compared to batch drift detection methods:

• Minimal Memory Footprint: Only the current cumulative sum and the last sample are required, making it ideal for edge AI deployments on FPGAs and embedded SDRs
• Low Latency: Detection decisions are made per-sample with O(1) complexity, avoiding the delay of window-based statistical tests
• Early Sensitivity: CUSUM detects small shifts faster than Student's t-test or Mann-Whitney U test applied to fixed windows, as it integrates evidence sequentially
• Natural Integration: Pairs seamlessly with Kalman Filter Tracking, where the CUSUM monitors the filter's innovation sequence for model validity

A specific type of distribution shift where the underlying relationship between extracted signal features and true device identity changes due to hardware aging or environmental factors. This violates the i.i.d. assumption of standard machine learning models.

• Virtual drift: Change in the feature distribution P(X) without affecting the decision boundary
• Real drift: Change in the posterior probability P(y|X) requiring model adaptation
• CUSUM detects the onset of real drift before it causes authentication failures

A recursive Bayesian algorithm that estimates the true state of a drifting RF fingerprint by optimally combining a predictive aging model with noisy, real-time measurements. The filter maintains both a state estimate and an uncertainty covariance.

• Prediction step: Projects the fingerprint forward using a physics-based aging model
• Update step: Corrects the prediction using new signal measurements weighted by their noise variance
• Provides the optimal estimate under Gaussian noise assumptions, making it complementary to CUSUM's change-point detection

A statistical method for maintaining a device's reference fingerprint by applying a weighted average that gives higher importance to recent, authenticated transmissions while slowly forgetting older ones.

• Controlled by a smoothing factor α where higher values respond faster to drift
• Acts as a simple drift compensation mechanism when paired with CUSUM triggering
• Formula: EMA_t = α · x_t + (1-α) · EMA_{t-1}
• CUSUM can trigger a reduction in α to accelerate adaptation when persistent shift is detected

A predefined tolerance threshold for the total allowable deviation of a fingerprint from its baseline before a device is flagged for re-calibration or identified as a potential security risk.

• Expressed as a cumulative distance in the feature embedding space
• CUSUM provides the running sum that is compared against this budget
• Hard budget: Fixed threshold triggering immediate re-enrollment
• Soft budget: Graduated response with increasing scrutiny levels
• Prevents both false rejections from normal aging and missed detections of anomalous drift

A non-parametric Bayesian method that models the temporal evolution of a fingerprint feature, providing both a mean prediction of the drift trajectory and a quantified uncertainty estimate.

• Uses a kernel function (e.g., RBF, Matérn) to encode smoothness assumptions about hardware aging
• Uncertainty bounds widen during periods without authenticated transmissions
• CUSUM can operate on the GP residuals to detect when observed drift deviates from the predicted aging model
• Particularly valuable for prognostics and health management of critical devices

A quantitative metric indicating the current reliability and distinctiveness of a device's stored fingerprint, often derived from classifier confidence or feature variance.

• High health: Tight feature clusters, high authentication confidence, low drift rate
• Low health: Dispersed features, borderline confidence, accelerating drift detected by CUSUM
• Triggers proactive re-enrollment before authentication failures occur
• Combines CUSUM's cumulative sum with other indicators like Fisher discriminant ratio and silhouette score