# Watermarking and Anomaly Detection in Machine Learning Models for LORA RF Fingerprinting

arXiv: https://arxiv.org/abs/2509.15170 · HTML: https://mlsanity.com/paper/2509.15170/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 4 of its 15 references that are in the map.
- First posted on arXiv 18 Sep 2025.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 4 of 4)

- [Towards Scalable and Channel-Robust Radio Frequency Fingerprint Identification for LoRa](https://mlsanity.com/paper/2107.02867/) (2021)
- [Radio Frequency Fingerprint Identification for LoRa Using Spectrogram and CNN](https://mlsanity.com/paper/2101.01668/) (2020)
- [Autoencoder-based Radio Frequency Interference Mitigation For SMAP Passive Radiometer](https://mlsanity.com/paper/2304.13158/) (2023)
- [ED-VAE: Entropy Decomposition of ELBO in Variational Autoencoders](https://mlsanity.com/paper/2407.06797/) (2024)

## Built on by (most cited first, 1 of 1)

- [Model Forensics in AI-Native Wireless Networks: Taxonomy, Applications, and Case Study](https://mlsanity.com/paper/2605.14387/) (2026)

## Abstract (arXiv)

Radio frequency fingerprint identification (RFFI) distinguishes wireless devices by the small variations in their analog circuits, avoiding heavy cryptographic authentication. While deep learning on spectrograms improves accuracy, models remain vulnerable to copying, tampering, and evasion. We present a stronger RFFI system combining watermarking for ownership proof and anomaly detection for spotting suspicious inputs. Using a ResNet-34 on log-Mel spectrograms, we embed three watermarks: a simple trigger, an adversarially trained trigger robust to noise and filtering, and a hidden gradient/weight signature. A convolutional Variational Autoencoders (VAE) with Kullback-Leibler (KL) warm-up and free-bits flags off-distribution queries. On the LoRa dataset, our system achieves 94.6% accuracy, 98% watermark success, and 0.94 AUROC, offering verifiable, tamper-resistant authentication.