Hongyi Luo, Qing Cheng, Daniel Matos, Hari Krishna Gadi, Yanfeng Zhang, Lu Liu, Yongliang Wang, Niclas Zeller, Daniel Cremers, Liqiu Meng. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 2025.

With the explosive growth of data traffic and the ubiquitous connectivity of wireless devices, the energy demands of wireless networks have inevitably escalated. Reconfigurable intelligent surfaces (RIS) have emerged as a promising solution for 6G networks due to their energy efficiency (EE) and low cost, while cell-free massive multiple-input multiple-output (CF mMIMO) has been proposed as an innovative network architecture without fixed cell boundaries to enhance these measures even further. However, existing studies often assume consistently high traffic loads, neglecting the dynamic nature of user demand. This can result in underutilized access points (APs) and unnecessary energy expenditure during low-demand periods. To tackle the challenge of EE in CF mMIMO systems under low-load conditions, this paper proposes a novel energy-efficient transmission scheme that jointly coordinates active APs and multiple passive RISs. Specifically, a dynamic AP sleep-mode strategy is designed, where certain APs are selectively deactivated while nearby RISs assist in maintaining coverage. To maximize EE, we formulate the EE maximization as a fractional programming problem and adopt the Dinkelbach method in conjunction with alternating optimization (AO) to iteratively solve the coupled subproblems: (i) AP selection via a hybrid branch-and-bound (BnB) and greedy algorithm, and (ii) RIS phase-shift optimization using gradient projection. Additionally, transmit power is allocated to users through a heuristic zero-forcing strategy. Simulation results show that the proposed scheme achieves significantly higher EE than existing methods in both low and moderate user scenarios.

Radio frequency fingerprint (RFF) is a promising solution for realizing secure and efficient device identification. However, the accuracy of currently existing solutions suffer from multipath effects in practical scenarios. In this paper, we provide a robust RFF identification method that leverages channel state information (CSI) feedback to counteract the effect of the channel on the extracted RFF features. A straightforward zero-forcing (ZF) equalization fails to fully decouple RF impairments from the channel, making conventional approaches ineffective. To overcome this challenge, we utilize the potential of multi-antenna and introduce a new device-specific feature called Relative-RFF (R-RFF), which represents the relation between different RF chains in a multi-antenna transmitter. We propose an enhanced ZF post-equalization algorithm to eliminate the multipath channels and preserve the users’ R-RFF to the greatest extent. We evaluate the robustness of R-RFF under various channel conditions and noise levels and the performance of R-RFF in terms of identification accuracy under different channel scenarios. The results show that the proposed R-RFF method can achieve an identification accuracy of 91.2% for 70 devices in tapped delay line channel with a signal-to-noise ratio (SNR) of 30 dB.

Fingerprint authentication has become a staple in securing access to personal devices and sensitive information in our daily lives, with the security level of such systems being paramount. Recent attention has been drawn to the puppet attack, a forced fingerprint unlocking scenario that exploits legitimate user fingerprints for unauthorized access. Traditional authentication methods are constrained by their reliance on additional sensors and are typically limited to static authentication scenarios, lacking versatility in dynamic or mobile contexts. In this study, we employ physical modeling to elucidate puppet attack, unraveling the distinctive stress patterns, and points of application associated with forced interactions. By scrutinizing the physical alterations induced during such attacks, our investigation unveils discernible changes in the texture of fingerprints, specifically reflecting variations linked to different force patterns. Consequently, we introduce a detection system that operates without the need for external sensors, solely utilizing fingerprint images to extract texture features, thereby offering a broadly applicable solution. To address the challenge posed by the absence of puppet attack samples in existing data sets, we constructed a comprehensive database, incorporating a substantial number of puppet attack fingerprints collected from 70 volunteers aged between 20 and 75. This database facilitates a more robust detection of puppet attack. Our system demonstrates accuracy rates of 85.5%, 97.2%, 86.5%, and 78.1% across four distinct scenarios within our puppet attack database.

Radio frequency fingerprinting (RFF) is a promising solution for realizing secure and efficient device authentication. The multipath channel overshadows and disrupts the RFF extraction, which causes difficulties in training new models in the presence of fading. Existing approaches attempt to deal with this challenge by traversing channels through simulated channel models. However, this solution requires a large amount of data for training and it is difficult to guarantee that the training covers all possible channels. To mitigate the multipath channel effect on RFF with less training data, we propose a new method in a multi-antenna system, named Relative-RFF (R-RFF), which utilizes channel state information (CSI) feedback to counteract the multipath channel. The RFF imperfection relation between the different antenna chains of the device is proved to be retained after the counteraction of the multipath channel. Numerical results demonstrate that the proposed R-RFF can achieve an identification accuracy of 95.9% for 30 UEs in Tapped Delay Line channel with a signal-to-noise ratio of 20 dB.

Reconfigurable Intelligent Surface (RIS) is a new paradigm that enables the reconfiguration of the wireless environment. Based on this feature, RIS can be employed to facilitate Physical-layer Key Generation (PKG). However, this technique could also be exploited by the attacker to destroy the key generation process via manipulating the channel features at the legitimate user side. Specifically, this paper proposes a new RIS-assisted Manipulating attack (RISM) that reduces the wireless channel reciprocity by rapidly changing the RIS reflection coefficient in the uplink and downlink channel probing step in orthogonal frequency division multiplexing (OFDM) systems. The vulnerability of traditional key generation technology based on channel frequency response (CFR) under this attack is analyzed. Then, we propose a slewing rate detection method based on path separation. The attacked path is removed from the time domain and a flexible quantization method is employed to maximize the Key Generation Rate (KGR). The simulation results show that under RISM attack, when the ratio of the attack path variance to the total path variance is 0.17, the Bit Disagreement Rate (BDR) of the CFR-based method is greater than 0.25, and the KGR is close to zero. In addition, the proposed detection method can successfully detect the attacked path for SNR above 0 dB in the case of 16 rounds of probing and the KGR is 35 bits/channel use at 23.04MHz bandwidth.

With the rapid development of wireless communication, the traditional communication encryption method is not adequate for our needs of high-speed and low latency. As a consequence, Physical Layer-Key Generation (PKG) and Reconfigurable Intelligent Surface (RIS) emerged. The existing researches on the combination of PKG and RIS mainly focus on the randomness increase of the communication environment and the key generation rate under a quasi-static environment. On the other hand, there is little research on the active attack of RIS by eavesdroppers. In this paper, the attack and defense method based on the combination of RIS and PKG is discussed. We propose a random phase attack method derived from the multiple-input single-output (MISO) model and analyze the effectiveness of the attack. To resist the random phase attack under a hypothetical scenario in which RIS is under the control of the attacker, we propose a path separation and path detection defense method according to the Multiple Signal Classification (MUSIC) algorithm. Simulation results show that the Bit Disagreement Rate (BDR) achieves a significant reduction, which proves the effectiveness of the proposed defense method based on path detection and path separation.