Transient Injection Locking

The victim oscillator's instantaneous frequency is drawn toward the aggressor's frequency during the transient burst. The pulling trajectory—the path the frequency takes as it deviates from its free-running value—is governed by the Adler equation and depends on the injection strength, frequency offset, and resonator quality factor (Q). A high-Q oscillator resists pulling, exhibiting a slower, smaller deviation, while a low-Q oscillator is easily captured. This trajectory is a direct fingerprint of the victim's tank circuit impedance.

As injection locking occurs, a fixed phase relationship is established between the aggressor and victim signals. The phase coherence onset is not instantaneous; it involves a transient period where the relative phase converges to a steady-state offset. This offset, φ = arcsin((ω₀ - ω_inj) / Δω_L), where Δω_L is the locking range, reveals the initial detuning. The rate of phase convergence is a signature of the injection coupling coefficient and the oscillator's restoring force.

The injection locking transient is accompanied by a characteristic amplitude modulation (AM) envelope on the victim's output. As the injected signal forces the oscillator, the amplitude typically dips before recovering to a new steady state. This AM signature is caused by the momentary disruption of the Barkhausen criterion—the loop gain and phase conditions required for sustained oscillation. The depth and duration of this amplitude perturbation are unique to the victim's active device non-linearity and bias network.

The locking range—the frequency interval over which injection locking can occur—is often asymmetric around the victim's free-running frequency. This asymmetry arises from the non-linear reactance of the active device and the frequency-dependent phase response of the resonator. The upper and lower locking limits are not equidistant, and this skew is a robust hardware signature. Measuring the asymmetric locking bandwidth provides insight into the varactor non-linearity and the oscillator's large-signal impedance characteristics.

Injection locking is not limited to the fundamental frequency. A strong transient can induce subharmonic locking (locking at f_inj / N) or superharmonic locking (locking at N × f_inj) in the victim oscillator. These phenomena occur when the aggressor's harmonics or the victim's internal non-linear mixing products fall within the locking range. The presence and strength of subharmonic locking signatures are highly dependent on the specific transistor transfer function and the harmonic termination impedances within the circuit.

Prior to locking, the victim oscillator exhibits its intrinsic phase noise spectrum. As injection locking takes hold, the phase noise is suppressed, and the spectral linewidth collapses toward that of the cleaner aggressor signal. The transient period reveals a dynamic narrowing of the linewidth. The rate of this spectral collapse and the residual phase noise pedestal after locking are direct indicators of the injection ratio (P_inj / P_osc) and the oscillator's internal noise sources, such as flicker noise and thermal noise in the resonator.

The general phenomenon where an oscillator's frequency deviates from its nominal value due to an external signal injected at a nearby frequency. In the transient context, this occurs when a power amplifier's sudden turn-on creates a strong electromagnetic field that couples back to the voltage-controlled oscillator (VCO). The resulting frequency shift is proportional to the injected signal strength and inversely proportional to the oscillator's loaded Q factor. This effect creates a correlated signature between the aggressor and victim circuits, revealing their physical proximity and coupling path characteristics.

The frequency range over which an external signal can successfully capture and synchronize an oscillator. Defined by the Adler equation, the locking bandwidth depends on:

• Injection signal amplitude relative to the oscillator's natural output
• Quality factor (Q) of the resonator tank circuit
• Impedance matching between the injection source and the oscillator core During transient events, the locking bandwidth momentarily widens due to the high instantaneous power of the aggressor signal, making the victim oscillator susceptible to capture even at larger frequency offsets.

The physical mechanism by which the transient energy transfers from the aggressor to the victim oscillator. Common paths include:

• Substrate coupling through the shared silicon die in integrated transceivers
• Power supply rail modulation where inrush current creates voltage fluctuations
• Radiated near-field coupling between bond wires or package pins
• Ground bounce propagating through shared return paths Each path imprints a distinct delay and attenuation profile on the injected signal, creating a unique spatial signature that can fingerprint the physical layout of the hardware.

When injection locking occurs during a transient, the victim oscillator's phase becomes deterministically related to the aggressor's phase for a brief period. This creates a measurable phase coherence spike in the cross-correlation between the two signals. After the transient subsides, the oscillators drift back to independent operation. The duration and strength of this phase coherence reveal the locking time constant and coupling strength, providing a unique hardware signature that cannot be easily masked or cloned.

Transient injection locking creates an unintended information leakage channel where characteristics of one circuit become observable through another. In secure systems, this poses a risk where:

• A cryptographic processor's activity modulates a nearby oscillator
• The modulated signal radiates through the antenna or power lines
• An attacker extracts the envelope to recover sensitive data Conversely, for fingerprinting, this leakage provides a rich, multi-dimensional feature space that captures interactions between multiple hardware subsystems simultaneously.

The time-domain amplitude profile of the victim oscillator as it transitions from free-running to injection-locked and back. Key features include:

• Capture time: the delay before phase synchronization begins
• Locking plateau: the duration of stable frequency entrainment
• Release ringing: damped oscillation as the oscillator returns to its natural frequency This envelope is shaped by the aggressor's ramp profile and the victim's loop dynamics, creating a composite signature that reflects the interaction of both circuits.