Privacy-Preserving Intent Fulfilment and Assurance for 6G RAN

1 Introduction

• Existing fulfilment approaches use per-flow telemetry, traffic classification, or packet inspection, creating conflicts with privacy requirements and heterogeneous O-RAN telemetry access.The paper identifies encrypted traffic as an additional reason content-based fulfilment is impractical, while noting that side channels remain outside the architecture.Source: §1 · p. 2
• MISES provisions from a finite declared intent category and verifies using cell-level PM counters, without accessing payloads, per-agent traces, or vendor-internal state.The paper builds on prior formal results for welfare loss, aggregate verification, and feasible category refinements [10].Source: §1 · pp. 2–3
• The paper's contributions include a category-based leakage bound, two architectural privacy properties, a 3GPP and O-RAN deployment mapping, and evaluation on four operator networks.The empirical study compares per-cell and category-mean verification and examines counter-level degradation scenarios.Source: §1 · p. 3

2.1 Intent-Based Network Management

• The 3GPP intent lifecycle translates declarative service objectives into configuration and monitors fulfilment; surveyed 6G approaches commonly use per-flow or per-session telemetry.GenAI-IDN processes per-flow session data for translation and assurance, while surveys identify granular telemetry as a standard assumption [4, 14].Source: §2.1 · pp. 3–4

2.2 Privacy in Network Management

• Unlike privacy methods that protect data during or after collection, this architecture restricts information flow so sensitive traffic data is never collected by the coordinator.Its category signal is the only link between the agent and resource decision, making the unlinkability bound architectural rather than computational.Source: §2.2 · p. 4

2.3 Aggregate Monitoring and O-RAN

• O-RAN exposes cell-level aggregate performance data through O1, whereas E2 provides per-UE data with vendor-dependent availability; the architecture uses O1 data exclusively.This contrasts the management interfaces described in the O-RAN survey.Source: §2.3 · pp. 4–5

3 System Model

• A coordinator allocates resources from declared intent categories and verifies fulfilment from cell-level PM counters, without observing demand type or traffic content.The coordinator manages a shared pool for M agents; cells are the reporting units for PM counters.Source: §3 · p. 5

3.1 Reporting and Aggregation Semantics

• Cell-level aggregates are O1 counters indexed by cell and reporting period; category-level aggregates further reduce those counters across cells in one category and period.The empirical population count M denotes cells because the operator datasets provide no per-user attribution.Source: §3.1 · p. 5

3.2 Welfare Model

• Finer nested categories improve provisioning when categories receive their mean profiles, because refinement cannot increase within-category variation or the corresponding welfare gap.The welfare bounds rely on bounded utility curvature; under common quadratic utility, the gap is proportional to within-category variation.Source: §3.2 · p. 6

3.3 Detection Model

• Fulfilment is tested per category using cell-level counters; the category sample mean and per-cell distance to a trained centroid are alternative detection statistics.The model contrasts fulfilled and degraded service through the counter distribution and its mean.Source: §3.3 · p. 6
• Aggregate verification is at least as powerful as individual-record testing under state-independent observation, when the aggregate can reproduce individual-record distributions in both service states.An additive model with state-independent noise is one example; the leakage result requires only the stated Markov chain.Source: §3.3 · p. 6

3.4 Threat Model

• The threat model covers an honest-but-curious coordinator following the protocol, not a malicious coordinator that bypasses it, such as by deploying DPI outside the mechanism.The bounds characterize information revealed when the architecture is followed as designed.Source: §3.4 · p. 6

4.1 Leakage Bound

• Under the Markov chain T → C → R, the resource allocation reveals at most log2 K bits about traffic content when the category prior is uniform over K categories.The data-processing inequality bounds information in R by that in C; the ceiling depends on the category prior and can be lower than log2 K.Source: §4.1 · p. 7
• The leakage bound is a ceiling, not a claim of minimum leakage; adding noise to allocations or using fewer effective categories could produce a tighter bound.The bound follows from the architecture rather than an added privacy mechanism.Source: §4.1 · p. 7

4.2 Privacy Definitions

• Intent-traffic unlinkability limits what resource decisions reveal to information already in the category signal, while node-opaque verification uses standard O1 counters instead of per-flow or vendor-internal data.Node-opacity constrains the verification interface, not all data elsewhere in the system; a category-mean variant exposes K scalar statistics per period.Source: §4.2 · pp. 7–8
• With state-independent observation, a category-mean verifier is at least as powerful as any per-agent verifier, but sparse degradation can violate that premise and favor per-cell screening.Category-mean signals can shrink through displacement cancellation and within-period cell co-movement.Source: §4.2 · pp. 8–9

4.3 Structural Alignment of Privacy and Detection

• Provisioning favors finer categories, while verification favors coarser ones; for nested categories, designs meeting both a welfare tolerance and power target form a contiguous feasible interval.The ordering concerns category-aggregate tests; per-cell centroid screening can gain from tighter centroids as K grows.Source: §4.3 · p. 9
• If each category needs at least q cells for verification among M cells, then K ≤ floor(M/q), yielding a leakage ceiling of log2 floor(M/q) bits.The verification requirement fixes the category-channel ceiling without a separate privacy parameter.Source: §4.3 · pp. 9–10

Merging and splitting under load.

• As the available cell population changes, categories may merge or split; fixed public merging is post-processing, while new declarations after splits add information across periods.A single lifetime ceiling applies when later disclosures only repeat or post-process the original category value through fixed public maps.Source: Merging and splitting under load · p. 10
• The formal trade-off does not determine the operator's position within the feasible band; choosing it reflects priorities rather than a uniquely determined optimum.Finer categories favor provisioning, while coarser categories favor verification, power, and lower leakage.Source: Merging and splitting under load · p. 10

5.1 Intent Lifecycle Mapping

• Intent translation assigns categories from declared resource requirements, then provisions each category’s resource profile without inspecting traffic or tracking individual users.The category count must meet welfare tolerance while keeping at least q cells per category, so K ≤ floor(M/q).Source: §5.1 · p. 11
• Assurance screens cell-level PM counters against category centroids, then alarms on each category’s flagged fraction; strict category means suit category-wide degradation but are weaker for sparse faults.Per-cell thresholds are pooled at network level; strict category-mean statistics require per-category calibration.Source: §5.1 · pp. 11–12

5.2 O-RAN Deployment Architecture

• The Non-RT RIC rApp uses O1 PM counters for assurance and A1 policies for category-to-resource mappings, without depending on E2 telemetry.O1 carries standardised cell-level counters; E2 availability varies across vendors.Source: §5.2 · p. 12

5.3 Multi-Vendor and Multi-Tenant Considerations

• Because assurance uses standardised O1 cell-level counters rather than vendor-internal state, it can operate across heterogeneous vendors without vendor-specific integration.The architecture supports data minimisation, but does not itself determine whether a deployment meets its legal obligations.Source: §5.2 · p. 12, §5.3 · pp. 12–13
• Tenant intents map to separate categories and are monitored independently; the per-tenant resource-allocation leakage ceiling is log2 K_A bits, not a bound on inference from assurance counters.Here K_A is the number of intent categories allocated to that tenant.Source: §5.3 · p. 13

5.4 Implementation Considerations

• Categories are periodically clustered from historical declared intent parameters, with K chosen between the welfare-tolerance minimum and the occupancy ceiling floor(M/q).Thresholds are calibrated from known-good cell-level PM data; a category-level statistic such as the strict mean must be calibrated per category.Source: §5.4 · p. 13
• The assurance loop runs at the O1 PM reporting period, and detected degradation triggers category-level rather than per-user remediation.The stated reporting cadence is typically 15 minutes for bulk PM files or sub-minute with O1 streaming PM.Source: §5.4 · pp. 13–14

6.1 Instantiation and Ground Truth

• The test uses injected cross-cluster replacements for 30% of test cell-hours, with thresholds calibrated on held-out validation data and ground-truth labels set before detection.The authors note this regime can violate the observation premise of Proposition 5.Source: §6.1 · p. 14

6.2 Detection Plateau

• At K=8, Net-C reaches 0.85 recall; across four networks, recall plateaus for K≥10 while leakage rises from 3.0 bits at K=8 to 4.9 at K=30.Figure 1 reports recall at FPR = 0.20; the plateau means larger K brings no further detection benefit in these networks.Source: Figure 1 · p. 15, §6.2 · p. 15

6.3 Detection Scaling with Network Size

• Across networks of 537 to 12,861 cells, the plateau recurs; at K=10, Net-C reaches 0.85 recall and Net-A 0.53, while category size alone does not determine recall.Net-B exceeds Net-D at every K in the Figure 1 sweep despite having fewer cells per category.Source: §6.3 · p. 15
• With q=30, enforcing minimum occupancy lowers recall by 0.04–0.05 on three large networks and from 0.54 to 0.36 on Net-A.The occupancy ceiling bounds category entropy; within-category dependence also matters when calibrating q to a detection-power target.Source: §6.3 · p. 16

6.4 Category Construction Cost

• The k-means fit takes under 2.5 seconds for the largest network of 12,861 cells at K = 30, while raw-data aggregation dominates measured construction time.In production, incremental O1 PM reduction eliminates the database-query cost; the fit itself is negligible for hourly or daily recomputation.Source: §6.4 · pp. 16–17

6.5 Temporal Robustness

• The temporal evaluation trains categories on week 1 (2025-W45) and measures recall and centroid drift in later weeks without retraining.Schedule projections assume retraining restores initial recall; the no-recompute row is the observed five-week mean.Source: §6.5 · p. 17, Table 4 · p. 17
• On Net-A, Net-C, and Net-D, the projected biweekly retention is 0.490 / 0.826 / 0.618 against the weekly reference of 0.506 / 0.831 / 0.631; Net-B degrades more sharply.The projections assume each retraining restores initial recall; the observed no-recompute mean on Net-B is 0.088 below its weekly projection.Source: §6.5 · p. 17
• A PM-side centroid-drift trigger can detect category shifts that the administrativeState lock-event stream does not reveal.Subject to restoring baseline recall, the projections support biweekly retraining on Net-A, Net-C, and Net-D and weekly retraining on Net-B, augmented with the drift trigger.Source: §6.5 · p. 18

6.6 Sensitivity to α0 and the Exceedance Alarm

• Empirical per-cell FPR stays within 0.02 of target across the grid on Net-A, Net-C, and Net-D, while Net-B overshoots at every tested setting.At α0 = 0.20 and K = 15, Net-B's empirical FPR is 0.284 against 0.20; the paper reports raw FPR without post-hoc correction.Source: §6.6 · pp. 18–19
• At K = 15, category-level mean flagged-fraction shifts by a factor of 1.24–1.48 from null to test, while tail-quantile alarms saturate on three networks.The paper leaves operationalising the mean flagged-fraction discriminant as a sequential decision rule to deployment work.Source: §6.6 · p. 19

6.7 Per-Cell and Category-Mean Verification

• Under category-wide replacement, the category-mean score has higher AUC on Net-B, Net-C, and Net-D and comparable AUC on Net-A.The comparison uses one category-hour decision unit at K = 15, with AUC after per-category standardisation over 10 paired seeds; experiments do not establish the theorem's observation premise.Source: §6.7 · p. 19, Table 6 · p. 20
• Under sparse degradation, per-cell exceedance performs better on Net-A (0.710 against 0.504) and Net-D (0.811 against 0.651), while the category mean performs better on Net-B (0.750 against 0.715) and narrowly on Net-C (0.782 against 0.776).The sparse regime replaces 30% of cells, each toward an independently drawn category.Source: §6.7 · p. 19
• Per-category standardisation raises category-mean AUC to 0.889 and 0.971 on Net-B and Net-C, but their realised false-alarm rates exceed the 0.20 target.The pooled threshold leaves category-mean recall at chance on those networks; rolling recalibration is proposed to address nonstationarity.Source: §6.7 · p. 20
• Within-period co-movement inflates category-mean variance 4 to 26 times, so categories of 29 to 871 cells behave like only 6 to 14 independent cells.The practical guidance is to use category means for category-wide degradation, per-cell exceedance for faults affecting some cells, and calibrate each per category.Source: §6.7 · pp. 20–21
• Randomized response scales the detector margin J by 0.46 at ε = 1, 0.76 at ε = 2, and 0.99 at ε = 5, moving recall and FPR toward 0.5.Where the unprivatized margin is near zero, the paper recommends changing the verifier rather than privatizing one that does not discriminate.Source: Table 8 · p. 21, §6.7 · p. 22

6.8 Structured Degradation Scenarios

• Outage, interference, and surge perturbations use counter-specific changes at magnitudes f = 1.5 and 3.Outages reduce selected volume and activity counters; interference changes radio-quality and delay counters; surges raise activity and volume counters.Source: §6.8 · p. 22
• Category-mean AUC (0.68 to 0.80) beats per-cell exceedance AUC (0.67 to 0.73) in six of eight network-scenario cases and ties in a seventh for category-wide interference or surge.For category-wide outages at f = 3, category-mean AUC is 0.75 to 0.78.Source: §6.8 · p. 22, Table 9 · p. 23
• At f = 3, per-cell recall for outages stays within 0.06 of FPR on Net-A, Net-C, and Net-D, while sparse outages are not caught by the category mean.Quiet-hour traffic loss can resemble the same cell in the null distribution; a direction-free, two-sided centroid distance is poorly matched to traffic loss.Source: §6.8 · p. 22

6.9 Real-Label Category Validation

• The lock stream was not used among the eleven clustering features, making this a feature-disjoint real-label check rather than a test of real-event detection recall.The standing locked population is not an event stream.Source: §6.9 · p. 23
• On Net-C, one cluster in the K = 15 partition contains 92.3% of locked cell-hours, and 65.1% of that cluster’s cell-hours are locked.The other fourteen clusters each have at most 1.72% of their own cell-hours locked.Source: §6.9 · p. 23
• The partition has 0.261 bits of mutual information with the lock label, 60.3% of the label’s 0.433-bit entropy, and NMI of 0.14.These measures reflect one strongly aligned cluster among fifteen, with no dependence on the labels for the other fourteen.Source: §6.9 · p. 23

6.10 Data Footprint Comparison

• MISES requires three orders of magnitude less data per cell per reporting period than GenAI-IDN and two orders less than E2-based assurance.The comparison is against per-flow session records for GenAI-IDN and per-UE near-real-time RIC telemetry for the E2-based approach.Source: §6.10 · p. 23
• The reduction comes from not collecting per-flow or per-UE data, rather than compressing or approximating it.The paper links this elimination of data collection to its privacy guarantee; whether a DPIA is required remains controller-specific.Source: §6.10 · pp. 23–24
• The architecture depends on O1 and is deployable in O-RAN-compliant networks regardless of vendor-specific E2 exposure.The compared alternatives depend on custom flow export or per-UE indications whose availability and schema vary across vendors.Source: §6.10 · p. 24

6.11 Implications for Intent Category Design

• Category design first calibrates the minimum cell count q to a power target, then checks welfare and detection curves before choosing K within the feasible band.The procedure assumes both orderings hold along the nested partition family.Source: §6.11 · p. 24
• On the four tested networks, K = 5 to 8 begins the detection plateau; beyond K = 8, provisioning improves while detection gains nothing and the leakage ceiling grows.This is an observation on these networks, not a certified range.Source: §6.11 · p. 24

7.1 Architectural Privacy vs. Mechanism Privacy

• MISES derives privacy from not collecting data, unlike mechanisms that protect data after a full-information pipeline exists.Once the information flow is fixed, this approach needs no ongoing noise calibration, gradient clipping, or key management, but requires assurance against bypass.Source: §7.1 · p. 25

7.2.1 Formal threat model.

• The leakage bound applies to the category/resource channel, not total inference from cell-level PM counters.The honest-but-curious coordinator follows the protocol; malicious or active coordinators and side-channel and auxiliary-data adversaries are outside the model.Source: §7.2.1 · p. 25

7.2.2 Residual risk in cloud-hosted and multi-tenant deployments.

• A third-party cloud infrastructure provider is outside the coordinator model, and the architecture cannot prove internally that it has not been bypassed.Auditing and remote attestation make the assumption checkable, but are not a cryptographic proof against a malicious coordinator.Source: §7.2.2 · p. 26
• Real-event recall claims lie outside the evaluation evidence because the datasets lack fault or alarm labels and the structured degradations are synthetic.The administrativeState lock stream is unsuitable for hourly detection; its Net-C locked population is standing rather than event-based.Source: §7.2.2 · pp. 26–27

7.2.3 Empirical H(C) tightens the leakage bound.

• At K = 15, empirical category entropies are 3.56, 3.16, 3.24, and 3.22 bits for Net-A, Net-B, Net-C, and Net-D, respectively, below the uniform ceiling of 3.91 bits.These entropy measurements upper-bound category-channel leakage; they do not estimate the leakage itself.Source: §7.2.3 · p. 27

7.2.4 Detection-side qualifications.

• Category-mean AUC is higher on three networks and comparable on the fourth under category-wide replacement, but that experiment does not establish the theorem’s state-independent observation premise.Within-period cell co-movement limits the category mean to evidence from roughly 6 to 14 independent cells, and sparse-degradation ordering varies by network.Source: §7.2.4 · p. 27
• Distance to a category centroid misses outages affecting only some cells.This limits the detection-side case for category means under sparse degradation.Source: §7.2.4 · p. 27

• The architecture provisions from declared intent categories and assures service with standardised cell-level O1 PM counters.Source: §8 · p. 27
• The category/resource channel leaks at most log2 K bits, while intent-traffic unlinkability and node-opaque verification hold by construction.Source: §8 · p. 27
• The minimum verification category size q caps entropy at log2 floor(M/q), aligning detection and privacy while provisioning quality opposes both.Source: §8 · p. 27
• Production data from four operator networks show provisioning improving while detection plateaus beyond moderate category granularity; category means suit broad degradation, while per-cell screening suits sparse faults.Both approaches need per-category calibration.Source: §8 · p. 28
• The deployment mapping identifies interfaces and data objects for the 3GPP intent lifecycle and O-RAN Non-RT RIC, using O1 PM data regardless of vendor-specific E2 exposure.Full regulatory compliance remains a controller-specific assessment.Source: §8 · p. 28