LO Leakage

LO leakage originates from finite isolation in the mixer stage, where the local oscillator signal couples directly to the RF output port. This occurs due to DC offsets in the baseband I/Q paths and parasitic capacitive coupling between the LO and RF ports. The result is an unmodulated tone at the exact carrier frequency, independent of the transmitted data. The amplitude of this tone is proportional to the DC offset magnitude and inversely proportional to mixer isolation, typically ranging from -20 dBm to -40 dBm relative to the main signal.

The LO leakage power level is a manufacturing-dependent parameter that varies between otherwise identical devices. Key contributors include:

• Transistor threshold voltage mismatches in the mixer core
• Resistor tolerance variations in bias networks
• Layout-induced asymmetries in the I/Q paths
• Bond wire length differences affecting parasitic inductance

These variations produce a leakage amplitude that is statistically unique, with measured standard deviations of 2-5 dB across batches of the same radio model.

LO leakage exhibits slow temporal drift rather than rapid fluctuation, making it suitable for long-term identity tracking. The leakage power varies with temperature at approximately 0.01-0.05 dB/°C due to bandgap reference shifts. Over multi-year aging periods, hot-carrier injection and negative-bias temperature instability in CMOS mixers cause gradual DC offset changes, producing a monotonic drift of 0.5-2 dB per year. Compensation algorithms using Kalman filtering can track this drift to maintain fingerprint validity.

Unlike constellation-based impairments such as I/Q imbalance, LO leakage is independent of the modulation format and symbol rate. The carrier tone persists whether the transmitter is sending QPSK, 64-QAM, or OFDM waveforms. This property enables cross-protocol fingerprinting, where a device can be identified even when switching between Wi-Fi, Bluetooth, and proprietary waveforms. The leakage remains detectable during guard intervals and preamble sequences, providing identification opportunities before demodulation.

Extracting LO leakage requires narrowband spectral analysis centered on the carrier frequency. The standard processing chain includes:

• DC-centered FFT with 10-100 Hz resolution bandwidth
• Averaging over multiple frames to suppress modulation noise
• Background subtraction to remove receiver LO leakage
• Peak search within ±1 kHz of the expected carrier

The leakage-to-signal ratio (LSR) is computed as the power ratio between the carrier peak and the integrated signal power, providing a normalized metric robust to path loss variations.

LO leakage is inherently difficult to counterfeit because it requires precise control over analog hardware parameters. An attacker attempting to replicate a target's leakage signature must:

• Match the exact DC offset in both I and Q paths
• Replicate the mixer isolation characteristics
• Compensate for temperature-dependent variations in real-time

Unlike digital identifiers that can be cloned through firmware extraction, LO leakage is an unclonable physical function rooted in the analog domain, providing a robust anchor for hardware authentication.

A constant voltage bias in the in-phase or quadrature baseband path that causes carrier feedthrough, producing a distinct spike at the center frequency. While LO Leakage originates in the mixer, I/Q DC Offset arises earlier in the baseband chain. Both impairments create a spectral line at the carrier frequency, but their root causes differ:

• LO Leakage: Poor mixer isolation allowing oscillator signal to radiate directly
• I/Q DC Offset: Bias voltage in baseband amplifiers or DACs
• Combined Effect: Both contribute to the Origin Offset vector in the I/Q constellation, shifting the entire symbol cloud from the zero-point origin

The deviation between a transmitter's actual center frequency and its assigned channel frequency, caused by oscillator manufacturing tolerance. Unlike LO Leakage, which manifests as an unwanted tone at the carrier, CFO represents a shift of the entire transmission. Both derive from the same local oscillator subsystem:

• CFO: Frequency inaccuracy of the LO itself, typically measured in parts-per-million
• LO Leakage: Unintended radiation of the LO signal through the mixer output
• Fingerprinting Value: CFO provides a stable, long-term identifier; LO Leakage amplitude adds a second independent dimension for device discrimination

The displacement of the entire transmitted I/Q constellation from the zero-point origin. This composite impairment results from the additive effects of LO Leakage and I/Q DC Offset working together. The origin offset vector is a powerful fingerprinting feature because:

• It represents the vector sum of carrier feedthrough from multiple sources
• Each device exhibits a unique magnitude and phase angle for this offset
• The offset remains remarkably stable over time, as it depends on fixed circuit biases
• Measurement requires only capturing the transmitted constellation, making it computationally inexpensive to extract

The fundamental design parameter that determines LO Leakage magnitude. Mixer isolation quantifies how effectively the mixer prevents the local oscillator signal from appearing at the RF output port. Key engineering considerations:

• LO-to-RF Isolation: Typically 20-40 dB in integrated mixers, varying per device
• Manufacturing Variance: Sub-micron lithography variations create unique isolation characteristics
• Temperature Dependence: Isolation degrades predictably with temperature, creating a measurable thermal signature
• Device Aging: Gradual isolation changes over years provide a slow-drift fingerprint component that must be tracked by compensation algorithms

The frequency-domain envelope describing a local oscillator's phase noise power distribution across offset frequencies. While LO Leakage produces a discrete tone at the carrier, phase noise creates a characteristic spectral spreading around that tone. Together they form a rich fingerprint:

• Close-in Phase Noise: Dominated by PLL reference and loop filter characteristics
• Far-out Phase Noise: Reflects VCO intrinsic noise floor
• LO Leakage Interaction: The leaked carrier tone carries the same phase noise signature as the LO, making it a convenient measurement point for oscillator characterization without demodulating the full signal

A discrete spectral tone appearing at an offset equal to the reference oscillator frequency from the carrier, caused by imperfect filtering in the phase-locked loop. This impairment creates a distinctive sideband pair around the LO Leakage tone:

• Spur Offset: Typically 10-40 MHz from carrier, depending on reference crystal frequency
• Amplitude Variation: Spur power relative to carrier varies 5-15 dB between devices
• Fingerprinting Utility: The combination of LO Leakage amplitude and reference spur amplitude creates a two-dimensional feature space that dramatically improves device separability
• Stability: Reference spurs are highly stable as they derive from fixed PLL loop dynamics