PaperlayerView exact revision on arXiv

Source-linked AI summary

GhostLock: Learning-Assisted Blind GPS Signal Nullification Without Victim-Side Information

Khalil Ahmad, Omar Ansari, Mohsin Kamal, Asif Iqbal, Muhammad Naveed Aman

arXiv:2610.20831v1cs.CR

TL;DR

During online operation, an attacker cannot know the victim’s exact instantaneous waveform. GhostLock combines blind adaptive filtering with learned synchronization to form a coherent anti-signal from the attacker’s local GPS observations and an approximate victim location. GhostLock disrupted GPS signal acquisition in simulation and over-the-air experiments; average attenuation was 31.4 dB at 5 m with 10 ms windows.

  • Problem

    During online operation, an attacker cannot know the victim’s exact instantaneous waveform.

    Source: C. Attacker Limitations · p. 4

  • Method

    GhostLock combines blind adaptive filtering with learned synchronization to form a coherent anti-signal from the attacker’s local GPS observations and an approximate victim location.

    Source: §I · p. 2, B. Blind Adaptive Reconstruction at… · p. 5

  • Results

    GhostLock disrupted GPS signal acquisition in simulation and over-the-air experiments; average attenuation was 31.4 dB at 5 m with 10 ms windows.

    Source: 1) Simulation Experiment · p. 8, §VI · pp. 9–10

  • Takeaways & Limitations

    The experiments demonstrate blind GPS signal nullification under realistic attacker constraints and motivate acquisition-stage detection and mitigation mechanisms.

    Source: §VI · pp. 9–10

    The attacker cannot observe victim-side residuals, I/Q samples, RF channel, acquisition or correlator outputs, or cancellation feedback; GhostLock instead adapts using a locally measurable reconstruction error.

    Source: C. Attacker Limitations · p. 4

Abstract

from arXiv · show

The Global Positioning System (GPS) provides critical positioning, navigation, and timing (PNT) services for numerous safety- and mission-critical applications, making it an attractive target for physical-layer attacks. While GPS spoofing and jamming have been extensively studied, GPS Signal Nullification (GSN)-a physical-layer attack that suppresses authentic satellite signals through destructive interference prior to acquisition-remains largely unexplored. Existing wireless signal nullification techniques target conventional communication systems and typically require victim-side information, such as channel estimates or synchronization parameters, making them impractical for GPS. Furthermore, many GPS spoofing defenses assume authentic satellite signals remain available as trusted references, an assumption invalidated by GSN. To address this gap, we present GhostLock, a learning-assisted blind GSN framework requiring only an approximate target location estimate. GhostLock integrates a Blind Adaptive Filter (BAF) with a deep learning-based synchronization module to generate and align an anti-signal using only the attacker's locally received GPS signal, eliminating the need for victim-side observations. We implement GhostLock on a real-time software-defined radio (SDR) platform using GPS-SDR-SIM and GNU Radio. Experimental results demonstrate successful suppression of GPS signal acquisition, establishing the feasibility of blind GSN and motivating new detection and mitigation techniques for this emerging GPS threat model.

I. INTRODUCTION

GPS interference threatens critical infrastructure, while blind GPS signal nullification remains underexplored because existing approaches commonly rely on victim-side observations or synchronization. GhostLock uses attacker-side GPS observations and a coarse victim-location estimate to generate cancellation signals before acquisition.

I. INTRODUCTION

  • GPS interference affects critical infrastructure; reported impacts included about 1,500 flights per day by August 2024 and more than 24,000 vessels during the first three quarters of 2025.Source: §I · p. 1
  • Existing work largely detects spoofing or assumes synchronization and receiver-side information, leaving blind GPS nullification with minimal attacker knowledge an open problem.The gap is coherent cancellation that prevents GPS signal acquisition.Source: §I · pp. 1–2
  • GhostLock combines machine-learning synchronization with blind adaptive filtering to generate coherent anti-signals using attacker-side observations and only a coarse victim-location estimate.The framework targets authentic signals before successful acquisition.Source: §I · p. 2
  • GhostLock was implemented on an SDR-based experimental platform and evaluated against existing GPS nullification approaches under realistic attacker constraints.Source: §I · p. 2

II. SYSTEM MODEL AND ASSUMPTIONS

  • The attacker receives local GPS signals, reconstructs an inverted-phase waveform with a blind adaptive filter, predicts location-specific carrier-phase corrections, and transmits the corrected anti-signal.Cancellation occurs over the air at the victim antenna, before the victim RF front end; it is not performed digitally inside the receiver.Source: §II · pp. 2–3

A. Authentic GPS RF Signal Model

The model describes visible satellites’ authentic GPS signals at the attacker and victim locations, then accounts for their spatial differences through learned phase corrections.

A. Authentic GPS RF Signal Model

  • The authentic-signal model represents each visible satellite’s received signal using amplitude, spreading code, navigation data, delay, carrier frequency, Doppler shift, and carrier phase.Source: A. Authentic GPS RF Signal Model · p. 3
  • Equation (2) represents the physical RF waveform, not cancellation inside the victim’s digital receiver; the attacker samples its local complex envelope with receiver noise and distortion included.Source: A. Authentic GPS RF Signal Model · p. 3

B. Spatial Difference Between Attacker and Victim Signals

  • Attacker and victim signals can differ because their antennas occupy different locations, and GhostLock learns phase corrections from paired measurements rather than calculating transformations with an analytical distance model.Source: B. Spatial Difference Between Attacker… · p. 3

C. Attacker-to-Victim RF Transmission

GhostLock models the attacker-to-victim RF path as propagation and hardware effects that must be accounted for in learned synchronization corrections. The transmitted cancellation waveform combines with authentic signals at the victim antenna, where destructive interference creates the analog residual.

C. Attacker-to-Victim RF Transmission

  • Propagation delay, attenuation, carrier-phase rotation, and RF hardware distortion transform the transmitted cancellation waveform before it reaches the victim.The model represents these combined effects with an effective attacker-to-victim RF operator; learned synchronization corrections incorporate their effects without direct victim feedback.Source: C. Attacker-to-Victim RF Transmission · p. 3

D. Analog RF Residual at the Victim

  • The victim antenna receives an analog residual formed by destructive interference between the propagated cancellation signal and authentic satellite signals.The physical residual is present at the antenna and RF front end, before victim-side signal processing.Source: D. Analog RF Residual at the Victim · pp. 3–4
  • Ideal cancellation requires alignment in amplitude, delay, frequency, data bits, and carrier phase, while RF anti-signal generation applies a physical π inversion.The analysis uses a subtractive form and inserts the inversion once during RF anti-signal generation.Source: D. Analog RF Residual at the Victim · p. 4

E. System Assumptions

The system assumptions bound GhostLock to a passive, stationary victim with an approximately known location and no online victim-side feedback. The attacker uses local GPS measurements, offline paired data, learned synchronization, adaptive reconstruction, and controlled RF transmission to suppress authentic signals before acquisition.

1) Passive and Stationary Victim:

  • The victim is modeled as a conventional passive GPS receiver that remains stationary during one observation, keeping the attacker-victim channel quasi-static over the adaptation window.The text identifies fixed infrastructure, timing receivers, and parked vehicles as applications suited to this assumption.Source: 1) Passive and Stationary Victim · p. 4

2) Approximate Victim Location:

  • The attacker needs only an approximate victim-location estimate, not exact localization or sub-wavelength position estimation.The paper considers coarse location knowledge available through prior observation reasonable in many practical scenarios.Source: 2) Approximate Victim Location · p. 4

3) No Online Victim-Side Feedback:

  • Online adaptation uses attacker-side GPS measurements and synchronization modeling because the attacker receives no victim-side waveform, residual, correlator output, or feedback.This distinguishes the attack from closed-loop spoofing approaches that require victim-side observations or feedback.Source: 3) No Online Victim-Side Feedback · p. 4

A. Adversarial Objective

  • The attack targets analog RF suppression of authentic GPS signals before reliable victim acquisition, with spoofing only a possible subsequent stage.The present work focuses on nullification rather than the later spoofing stage.Source: A. Adversarial Objective · p. 4

B. Attacker Capabilities

  • The attacker can receive and estimate local GPS parameters, collect paired attacker-target measurements offline, predict phase corrections, reconstruct waveforms adaptively, and transmit controlled RF anti-signals.Victim-side measurements are used only during offline training and evaluation, not during the online attack.Source: B. Attacker Capabilities · p. 4

C. Attacker Limitations

GhostLock replaces unavailable victim-side residual feedback with attacker-side reconstruction and learned victim-specific phase correction. Its blind adaptive filter reconstructs the locally observed waveform using a selected reference space, but that reconstruction does not establish victim-side cancellation performance.

C. Attacker Limitations

  • The attacker cannot observe the victim’s instantaneous waveform, analog residual, channel, acquisition outputs, or cancellation-success feedback.The standard BAF update based on victim-side residual is infeasible, so GhostLock instead adapts using a locally measurable attacker-side reconstruction error.Source: C. Attacker Limitations · p. 4

IV. PROPOSED TECHNIQUE: GHOSTLOCK

  • GhostLock combines attacker-side GPS observation, local BAF waveform reconstruction, learned victim-specific phase correction, anti-signal generation, and analog destructive superposition at the victim antenna.The BAF reconstructs the waveform available to the attacker; the learning module predicts its phase shift for destructive alignment after propagation.Source: §IV · pp. 4–5

A. Attacker-Side GPS Observation and Reference Construction

  • The attacker records complex GPS samples and constructs a reference vector from locally available observations, including delayed reference samples.A tapped-delay-line reference is one stated construction, and satellite components may alternatively be reconstructed separately.Source: A. Attacker-Side GPS Observation and… · p. 5

B. Blind Adaptive Reconstruction at the Attacker

  • The BAF uses its complex adaptive-weight vector and reference vector to reconstruct the attacker-observed signal, minimizing attacker-side mean-square reconstruction error.Equation (31) gives the best linear reconstruction available in the selected reference space, not the minimum residual power at the victim, where synchronization and RF transmission errors remain.Source: B. Blind Adaptive Reconstruction at… · p. 5

C. Two-Stage Learning-Based Delay Prediction

GhostLock estimates the effective relative delay from attacker-side I/Q samples in two stages, combining a coarse integer estimate with a fractional refinement for sub-sample alignment.

C. Two-Stage Learning-Based Delay Prediction

  • The two-stage 1-D CNN estimates effective relative delay from complex baseband I/Q samples, first predicting the integer component and then the fractional component.The estimates are combined into a final sub-sample delay; the pipeline also takes attacker–victim separation distance d as input.Source: C. Two-Stage Learning-Based Delay… · p. 5, Figure 5 · p. 6
  • The predictor operates directly on a fixed-length window of complex baseband samples rather than hand-crafted spatial or satellite-specific features.The input matrix’s rows contain the in-phase and quadrature components, and its window length is Nw.Source: C. Two-Stage Learning-Based Delay… · p. 5
  • Each input matrix is paired with a supervised delay label in samples, representing the effective temporal offset between attacker-side and calibration-receiver waveforms.Source: C. Two-Stage Learning-Based Delay… · p. 5

D. Delay-Label Decomposition

The delay target is split into a nearest-integer component and a residual fractional component, allowing the networks to estimate coarse alignment and then refine it.

D. Delay-Label Decomposition

  • The nearest-integer delay and residual fractional offset decompose the target into coarse alignment and fine refinement, with the fractional component in [−0.5, 0.5].The combined estimates reconstruct the final sub-sample delay.Source: D. Delay-Label Decomposition · p. 6
  • Stage 1 maps the normalized I/Q observation window to a full-delay estimate, which is transformed back to sample units before integer rounding.The I/Q channels are standardized using training-set statistics.Source: 1) Stage 1: Full-Delay Regression · p. 6
  • Stage 2 predicts the fractional correction relative to the rounded Stage-1 estimate; examples outside [−0.5, 0.5] indicate an incorrect integer estimate and are invalid for refinement.Source: 2) Stage 2: Fractional-Delay Refinement · p. 6, 1) Stage 1: Full-Delay Regression · p. 6
  • Stage 2 combines a residual downsampling trunk with a fine-resolution branch before a regression head constrains the fractional output.The trunk uses convolutional and residual downsampling blocks with attention pooling; the second path uses dilated convolutions.Source: 2) Stage 2: Fractional-Delay Refinement · pp. 6–7

3) Cancellation-Aware Training Objective:

Stage 2 combines supervised delay regression with a physical cancellation objective computed using a calibration receiver during offline training.

3) Cancellation-Aware Training Objective:

  • Stage 2 uses a composite objective that combines supervised regression losses on fractional and total delay with a cancellation loss.Source: 3) Cancellation-Aware Training Objective · p. 7
  • The cancellation loss measures normalized residual power after optimal cancellation, using the calibration receiver’s target waveform and a differentiable fractional-delay operation.Calibration-receiver data are available only during offline training, not online inference.Source: 3) Cancellation-Aware Training Objective · p. 7

4) Delay-Derived Carrier-Phase Correction:

GhostLock converts its learned delay estimate into a carrier-phase correction analytically, then applies the delay and phase adjustments before transmitting the inverted anti-signal.

4) Delay-Derived Carrier-Phase Correction:

  • The estimated delay in samples is converted to seconds and used to derive the corresponding carrier-phase correction, including an initial calibrated RF-chain phase offset.Source: 4) Delay-Derived Carrier-Phase… · p. 7
  • Figure 6 identifies the experimental setup, while Figure 7 summarizes average attenuation across different attacker–victim distances.Source: Figure 6 · p. 7, Figure 7 · p. 7
  • During online operation, the waveform is fractionally shifted and phase-rotated before polarity inversion and transmission, without calibration-receiver data.Source: 4) Delay-Derived Carrier-Phase… · p. 7

5) Network and Training Configuration:

GhostLock uses a coarse-to-fine delay estimator and attacker-side I/Q observations for online inference, with calibration waveforms used only offline. The evaluation moves from ideal simulated signals to over-the-air SDR measurements.

5) Network and Training Configuration:

  • The estimator first predicts and rounds a full delay, then estimates fractional delay and reconstructs the final delay for waveform alignment and carrier-phase correction.Stage 1 yields the integer component; Stage 2 uses the same normalized I/Q window and that component to estimate the residual fractional delay.Source: 5) Network and Training Configuration · p. 7
  • Calibration-receiver waveforms contribute only to the offline cancellation-aware objective; online inference uses only the attacker-side I/Q window.Source: 5) Network and Training Configuration · p. 7

A. Implementation System

  • The implementation uses three USRP B205mini devices, with one transmitting GPS L1 signals and two serving as attacker and victim receivers.Signals are transmitted at 1575.42 MHz with 2.1 MS/s sampling and 8-bit I/Q quantization.Source: A. Implementation System · p. 8

B. Experimental Analysis

  • Evaluation uses gps-sdr-sim waveforms and proceeds from ideal simulation to over-the-air USRP measurements.Under the ideal-channel assumption, relative sample delay is the parameter estimated to align anti-signal and victim signal for destructive interference.Source: B. Experimental Analysis · p. 8

1) Simulation Experiment:

The simulation and over-the-air experiments evaluate GhostLock’s nullification and delay estimation. Real-data results show close agreement with numerical reference delays, while the conclusion reports disruption of GPS acquisition under realistic attacker constraints.

1) Simulation Experiment:

  • 31.4 dB average attenuation at 5 m with 10 ms windows decreased to approximately 22 dB at 25 m; the 20 ms result at 25 m was 20.7 dB.Attenuation degraded more steeply with distance for 20 ms windows; Figure 8 shows residual-spectrum attenuation at 5 m and 25 m under ideal operating conditions.Source: 1) Simulation Experiment · p. 8

2) Real Data Experiment:

  • Over the real-data test bandwidth, attenuation was significant across most of 2.1 MHz, especially near the center frequency, but weaker near the band edges.The paper attributes the weaker edge attenuation to frequency-dependent phase and amplitude distortions in practical wireless channels; Figures 9 and 10 show representative 10 ms and 20 ms examples.Source: 2) Real Data Experiment · p. 9, Figure 9 · p. 9, Figure 10 · p. 9
  • MAEs were 0.003599 and 0.006184 samples, and RMSEs were 0.003902 and 0.006365 samples, for 10 ms and 20 ms windows, respectively.Figure 11 compares attenuation from predicted and numerical reference delays across the test set; the profiles closely agree.Source: 2) Real Data Experiment · p. 9, Figure 11 · p. 9

VI. CONCLUSION:

  • GhostLock uses attacker-local observations and an approximate victim-location estimate, and the conclusion reports disruption of GPS signal acquisition under realistic attacker constraints.The paper identifies acquisition-stage detection and mitigation as a future need for this blind-nullification threat model.Source: §VI · pp. 9–10
Loading 2610.20831v1…