Source-linked AI summary
Feasible but Not Safe: Constraint Violations and Report-Channel Attacks in Learned Cell-Free ISAC Association
Mehdi Zafari, Iman Mohammadi, A. Lee Swindlehurst
TL;DR
Learned cell-free ISAC schedulers can have high per-decision accuracy yet produce jointly infeasible plans, while relying on unverified AP reports. This paper audits ASSENT, projection, and false-data attacks, finding that projection can restore feasibility with little utility loss but cannot secure every kind of falsified information.
Problem
Learned schedulers rely on hard constraints enforced only as soft training penalties and on truthful AP reports, leaving joint feasibility and operational trustworthiness uncertain.
Source: §1 · p. 1Method
Results
Approximately 70% to 74% of high-accuracy ASSENT solutions are infeasible, while projection or greedy repair changes the optimization objective by less than 0.1%.
Source: §1 · pp. 1–2Takeaways & Limitations
Constraint-aware feasibility metrics are needed, and projection's protection depends on whether an attack falsifies objective information or the physical constraints themselves.
Source: §5 · p. 4The empirical evaluation uses the released system topology of 8 APs, 10 users, and 4 targets, so scalability to larger networks remains unverified.
Source: §5 · p. 4
Abstract
from arXiv · showhide
Learning-based schedulers have been proposed to provide real-time user, target, and access point (AP) association in distributed cell-free integrated sensing and communication systems. In a typical approach, a graph neural network (GNN), trained on labels from a mixed-integer linear program, maps lightweight per-AP statistics to decisions on AP clustering, user and target scheduling, and mode selection in one forward pass. Such solutions assume that hard constraints, enforced only as soft training penalties, hold at inference, and that the self-reported statistics are truthful. Using our ASSENT algorithm as an example, we find that despite high $F_1$ scores, many solutions violate at least one hard constraint, demonstrating that high prediction accuracy does not ensure joint feasibility. Projecting the GNN output onto a feasible solution restores constraint satisfaction with low utility loss, even with a simple greedy repair procedure. We further show that feasibility alone does not guarantee robustness to false data injection attacks. A single malicious AP that reports false information cannot substantially increase its user associations, but can greatly increase the rate of infeasible solutions. The effect of such attacks depends on the type of information being falsified. Misreporting information that affects the objective can largely be mitigated through feasibility projection, whereas falsifying information that affects the constraints cannot. The latter can, however, be detected using a low-complexity cross-AP consistency check. These results show that learned ISAC schedulers should be evaluated using constraint-aware feasibility metrics in addition to conventional accuracy measures.
1 Introduction
The paper audits learned cell-free ISAC association, where soft constraint penalties and unverified AP reports leave feasibility and trustworthiness uncertain. It finds frequent infeasibility despite high accuracy and examines projection and attacks on reported information.
1 Introduction
- ASSENT uses a heterogeneous GNN to map lightweight per-AP statistics to association decisions, bypassing per-slot MILP solving with one inference pass.The network learns from offline MILP solutions.Source: §1 · p. 1
- Approximately 70% to 74% of high-accuracy learned ASSENT solutions violate at least one hard constraint.The authors argue that per-decision accuracy obscures joint constraint satisfaction.Source: §1 · p. 1
- Projection or greedy repair changes the optimization objective by less than 0.1%, while attack effects depend on whether falsified information affects the objective or constraints.Objective-targeting attacks are neutralized by projection; constraint-targeting attacks require a distributed cross-AP consistency check.Source: §1 · p. 2
- The study empirically audits soft-penalty constraints and post-hoc projection in a practical distributed ISAC scheduler, connecting baseline feasibility with susceptibility to targeted security threats.Its threat vector is reliance on unverified, self-reported channel and sensing statistics from potentially dishonest APs.Source: §1 · p. 2
2 Background and Threat Model
The setup uses a heterogeneous GNN to imitate MILP-optimal association decisions from local AP reports, with feasibility defined by physical and resource constraints. A single malicious AP may falsify its own reports before the central server creates the global plan.
2 Background and Threat Model
- The learned association setup has 8 APs, 10 users, and 4 targets; each AP reports communication, interference, and sensing statistics for GNN prediction of modes and links.The network imitates MILP-optimal labels, with hard constraints included as soft training penalties.Source: §2 · p. 2
- A plan is strictly feasible only if it belongs to the MILP feasible set, which enforces AP mode, RF-chain, interference, and target transmit/receive requirements.Unscheduled targets cannot be illuminated or monitored, and the checker reports zero violations on 1000 MILP-optimal plans.Source: §2 · p. 2
- Figure 1 shows that one excess link can leave F1 at 0.995 while 93% of plans become illegal; projection and greedy repair remain within 0.1% of the MILP optimum.Raw GNN scores are higher only because they include illegal constraint violations.Source: Figure 1 · p. 2
- The threat model allows one AP to alter its own reported gains, correlations, or sensing features, with reports scaled up to 32× as a worst-case baseline.The central server cannot directly audit those reports; impacts are measured on the true, uncorrupted channel.Source: §2 · p. 2
3 Good Scores, Broken Rules
ASSENT can achieve high per-decision F1 while producing globally infeasible associations, because individual predictions do not enforce joint constraints. Projecting or greedily repairing outputs restores feasibility with very small objective loss.
3 Good Scores, Broken Rules
- 73.5% of baseline GATv2 associations violate at least one constraint despite F1 of at least 0.84 across all five outputs.RF-chain budgets are the dominant violation (54% to 58% of plans), followed by co-serving interfering users (20% to 26%) and mode errors (18% to 20%). The checker evaluates constraints (7c) through (7k), excluding optional capacity caps (7l) to (7n).Source: §3 · p. 2
- 99.5% F1 can coexist with 93% illegal plans after adding one random excess link, since one of 156 binary choices can break global legality.The raw GNN's apparent objective advantage over the MILP, 4.293 vs. 4.286, is not a real gain because the higher-scoring plan is illegal.Source: §3 · pp. 2–3
- 0.06% average objective degradation across the communication-sensing Pareto frontier accompanies exact feasibility projection; greedy repair retains 99.91% of the objective.The paired 95% confidence interval for average degradation is [0.04%, 0.11%], and greedy repair performs within 0.03% to 0.10% of exact ILP projection.Source: §3 · p. 3
4 Legal Is Not Safe: Vulnerabilities to FDI
False reports can make associations infeasible even when an attacker cannot substantially increase its user associations. Whether projection helps depends on whether the falsified information affects the objective or the constraints.
4 Legal Is Not Safe: Vulnerabilities to FDI
- 96% of plans become infeasible under falsified sensing strength, while under-reporting interference raises infeasibility from 73% to 84%.Sensing falsification also raises the attacker's average target-illumination links from 0.7 to 1.1; two colluding APs reach 91% infeasibility.Source: §4 · p. 3
- Across all three positions and GNN backbone layers, inflating reported signal up to 32× increased attacker-served users by at most 0.2 (AP0: 1.57 to 1.60).Source: §4 · p. 3
- Projection fully cancels the 96% sensing attack when it changes only objective coefficients, but constraint falsification leaves about 12% of plans physically infeasible.Projection acts after the report has steered the GNN, so it cannot universally neutralize report-channel manipulation.Source: §4 · p. 3
- 99.5% attacker-detection accuracy with about 1% false alarms reduces physically broken plans from 12% to 4% under the cross-AP check.The check flags interference reports more than one median absolute deviation below the group median and lifts flagged values toward the group.Source: Figure 3 · p. 3, §4 · p. 4
5 Discussion and Conclusion
High per-decision accuracy can mask joint infeasibility, and restoring feasibility does not by itself secure the reporting channel. The evaluation is bounded to the released system topology, with scalability left for future work.
5 Discussion and Conclusion
- High per-decision accuracy can mask severe joint infeasibility, while projection restores physical feasibility with near-zero utility loss but does not guarantee security.Projection neutralizes false reports that corrupt the scheduling objective, but lies falsifying physical constraints can weaponize the repair mechanism.Source: §5 · p. 4
- The evaluation covers an 8-AP, 10-user, 4-target topology; scalability remains unverified because larger-network labels require computationally heavy exact solvers.The findings are consistent across multiple GNN backbones.Source: §5 · p. 4
- Future work could use constraint-aware decoding to emit feasible plans and multi-agent verification to harden reporting against sophisticated or colluding attackers.The authors point toward secure PHY-MAC co-design, with a feasibility-aware associator feeding legal, trustworthy schedules to a coordinated PHY-layer allocator.Source: §5 · p. 4