Hardware-in-the-Loop (HIL)

HIL simulation executes with strict deterministic latency, typically on the order of microseconds, to faithfully replicate the bidirectional interaction between a device under test and its emulated environment. The loop must process incoming signals, apply channel effects, and return a response within a single sample period to avoid breaking the causality of the physical layer. This is achieved using FPGA-based channel emulators and real-time operating systems that bypass non-deterministic software stacks. Without hard real-time guarantees, the simulation fails to represent actual over-the-air behavior, rendering fingerprinting model validation invalid.

Unlike pure software simulation, HIL incorporates real RF hardware directly into the test loop. A vector signal generator (VSG) converts synthetic I/Q waveforms into actual analog signals, which are then passed through physical impairments like cables, filters, or amplifiers before being captured by a vector signal analyzer (VSA). This exposes the fingerprinting model to real-world analog imperfections—such as local oscillator leakage, I/Q imbalance, and phase noise—that are difficult to model perfectly in software. The result is a validation environment that captures the non-ideal behavior of actual silicon.

HIL systems inject real RF signals into a programmable channel emulator that applies time-varying multipath fading, Doppler shift, and path loss in real time. This allows engineers to test fingerprinting models against standardized channel models such as:

• Tapped Delay Line (TDL) models for urban and indoor scenarios
• Clustered Delay Line (CDL) models for MIMO systems
• Custom power delay profiles derived from field measurements The emulator preserves the subtle hardware impairments of the transmitter while subjecting them to realistic propagation effects, enabling robust evaluation of channel-robust feature learning algorithms.

HIL enables controlled, repeatable injection of specific hardware impairments into the signal path. Engineers can systematically vary parameters such as:

• Carrier Frequency Offset (CFO) in precise Hz increments
• Phase noise masks with defined dBc/Hz profiles at specific offsets
• I/Q gain imbalance in dB and quadrature skew in degrees This deterministic control allows for ablation studies that isolate which impairments contribute most to a device's unique fingerprint. The repeatability ensures that model performance metrics are statistically valid and not artifacts of random environmental variation.

The primary purpose of HIL in RF fingerprinting is to validate that a model trained on synthetic or recorded data generalizes to live, previously unseen transmitters. The workflow typically involves:

• Training a deep learning classifier on a synthetic dataset generated by a digital twin
• Connecting a physical transmitter of the same model to the HIL loop
• Evaluating the model's classification accuracy and open-set rejection on the live signal This process exposes sim-to-real transfer gaps where synthetic impairments fail to capture the full complexity of analog hardware, guiding iterative refinement of the digital twin.

Modern HIL testbeds are integrated with automated test executive software that orchestrates complex validation campaigns without manual intervention. These frameworks can:

• Sweep through hundreds of signal-to-noise ratio (SNR) levels
• Cycle through multiple channel models and impairment combinations
• Log results to structured databases for statistical analysis
• Trigger model retraining pipelines when performance degrades This automation is essential for continuous integration/continuous deployment (CI/CD) of fingerprinting models, ensuring that updates to the neural network architecture or training dataset do not regress real-world performance.

The physical transmission engine of a HIL setup. A VSG converts digitally synthesized, impairment-laden I/Q waveforms into analog RF signals. It precisely injects phase noise, I/Q imbalance, and carrier frequency offset as defined by the digital twin model. This allows the fingerprinting AI to be tested against a repeatable, hardware-generated signal that carries the exact statistical imperfections of a target device.

A dedicated hardware or FPGA-based instrument that applies a time-varying Channel Impulse Response (CIR) to the VSG's output. It convolves the static impairment signal with dynamic multipath fading, Doppler shift, and AWGN in real-time. This closes the loop between the simulated environment and the physical receiver, forcing the fingerprinting model to learn features robust to propagation artifacts.

The process of creating a high-fidelity virtual replica of a specific physical transmitter for HIL validation. The digital twin models the device's unique power amplifier non-linearity (AM-AM/AM-PM curves) and local oscillator leakage. In a HIL context, this twin drives the VSG to generate a 'golden reference' signal that is indistinguishable from the real device, enabling secure enrollment without the physical asset being present.

A software controller that systematically varies HIL simulation parameters during training runs. It randomizes Signal-to-Noise Ratio (SNR), Rician K-factor, and Doppler spread across thousands of iterations. By exposing the model to extreme hardware and channel conditions in the loop, the engine forces the extraction of channel-robust features that are invariant to environmental changes.

The primary quantitative bridge between simulation and hardware. The HIL system measures the EVM of the physical signal at the receiver and compares it to the synthetic model's prediction. A tight correlation (low EVM delta) validates that the DAC quantization error, phase noise injection, and I/Q imbalance models are physically accurate, certifying the synthetic data's realism.

A HIL methodology that introduces intentional spoofing attacks through the VSG. A rogue digital twin attempts to mimic a legitimate device's fingerprint by replicating its power amplifier non-linearity and carrier frequency offset. The HIL loop validates whether the AI model can detect subtle, unclonable artifacts—like DPD residuals—that a software-only replay attack cannot physically reproduce.