{"id":"7bb9eb9e-22a1-43ee-a019-b77d2555b68c","arxiv_id":"2505.01816","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A malicious cell in a multi-operator O-RAN can inflate its reported KPIs to obtain 248.5% more user allocations, and a context-aware LSTM autoencoder detector flags such spoofed reports with 99.2% accuracy.","lead":"A cell operated by a malicious operator can inflate the KPIs it reports to an O-RAN network and trick the traffic steering xApp into assigning it far more users than it should get. The paper also introduces a contextual LSTM-autoencoder detector and demonstrates both the attack and the defense in a live testbed.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attack feasibility depends on substitute QP training access that the paper never specifies and the testbed implicitly grants.","rationale":"The reader's weakest assumption is exactly the substitute QP training premise: the paper never specifies how the substitute model is trained, how many queries are needed, or whether the cell can observe QP outputs. This is the most load-bearing concern because the attack's entire mechanism -- crafting adversarial KPI perturbations to mislead the QP -- collapses if the attacker cannot learn a usable substitute. The testbed effectively grants this access by construction: the authors control both the simulator and the RIC, so the attacker can be given ground truth that a real multi-operator cell would not have. A constrained-access ablation is the direct, decisive check. The paper deserves credit for building a closed-loop OSC RIC testbed and for proposing a novel cell-as-attacker threat model, and the detector's contextual LSTM-AE architecture is a reasonable mitigation. However, the central quantitative claim of a 248.5% UE allocation increase is only as strong as the attacker access model, and that model is currently underspecified. Because this is a fixable experimental gap rather than an internal contradiction, the appropriate verdict remains CONDITIONAL, matching the reader's verdict; I recommend no change to that verdict.","tokens_in":20585,"tokens_out":3332,"duration_ms":37505,"concrete_test":"Implement a constrained-attacker ablation in the same testbed: give the malicious cell only its own KPI history, the handover decisions returned to it by the TS xApp, and the public TS-flow description; prohibit direct QP outputs and ground-truth QoE. Train the substitute by fitting a VAR on the KPI features used by the QP, with QoE labels inferred only from observable handover outcomes or from the malicious cell's own served UEs' throughput/RSRP readings. Then rerun the SAS and MAS experiments, reporting the mean UE allocation gain and the number of HopSkipJump target queries actually required versus an available query budget. If the UE gain remains above a meaningful threshold (e.g., >10%) under this access model, the premise holds; if the gain collapses, the central attack claim is conditional on an unrealistically strong attacker.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing premise is that a malicious cell operator can train an accurate substitute of the QP model using data and query access realistically available in a multi-operator O-RAN, then use that substitute to craft effective perturbations. Section 4 lists only two adversarial capabilities: the ability to manipulate the cell's reported KPIs and knowledge of the TS flow. Section 5 stage 1 asserts that 'the attacker begins by training a substitute QP model,' but it never specifies the dataset, feature set, label source, number of queries, or whether the cell can observe the QP's QoE outputs. The attack uses HopSkipJump (Section 8.1.1), a decision-based attack that requires many hard-label queries to the target model. In the testbed, the attacker is part of a closed loop controlled by the authors, so substitute training can silently rely on white-box access, simulator ground truth, or direct QP outputs. In a real multi-operator deployment, a cell sees its own KPI reports and the traffic-steering handover decisions addressed to it, but not the QP's QoE forecasts or the RIC's training data. If QP outputs are not observable, stages 1 and 2 cannot be executed as described, and the 248.5% UE gain in Table 3 becomes an artifact of granted access rather than an achievable attack. This concern directly controls whether the central claim survives; the single-run, no-variance reporting and test-set-tuned detection threshold are secondary compared with this missing attacker model.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper claims to be the first to study security challenges introduced by multi-operator O-RAN deployments, in which a cell operator is treated as an untrusted actor. The authors propose APATE, an evasion attack in which a malicious cell perturbs its reported KPIs to fool the QoE predictor (QP) in the O-RAN traffic-steering flow, thereby obtaining an unfair share of UEs. They also propose MARRS, a context-aware LSTM-autoencoder detector that classifies cell telemetry as trusted or untrusted, with an extension S-MARRS for sequence-level detection. The evaluation is performed in a closed-loop testbed that couples a wireless network simulator with an OSC near-RT RIC cluster. The headline results are a 248.5% increase in the malicious cell's average UE allocation in the single-attack scenario and a MARRS accuracy of 99.2% with F1 of 0.978 on the test set.","tokens_in":20815,"tokens_out":4372,"duration_ms":45461,"significance":"If the central claims hold, the paper makes a useful contribution: it identifies a new threat actor (the cell itself) in multi-operator O-RAN, demonstrates a concrete attack path through the QP model, and proposes a contextual detection method that outperforms standard baselines in the testbed. The open-access testbed integrating a simulator with the official OSC RIC cluster is a practical resource for the community. The novelty relative to prior work on O-RAN attacks is real. However, the strength of the empirical evidence is currently limited by an underspecified attacker model, a single simulation run per scenario, and post-hoc threshold selection for the detector; these gaps must be closed before the quantitative claims can be accepted at face value.","major_comments":[{"comment":"The substitute QP training procedure is not specified. Section 5 states that 'the attacker begins by training a substitute QP model,' but the paper never describes the dataset, feature set, label source, number of queries, or whether the cell can observe the QP's QoE outputs in a real multi-operator deployment. The adversarial capabilities in Section 4 list only KPI manipulation and knowledge of the TS flow. In the testbed, the attacker is part of the closed loop controlled by the authors, so substitute training could silently rely on access that a real cell operator would not have. Because HopSkipJump (Section 8.1.1) is a decision-based attack requiring many hard-label queries, it is also unclear whether the attacker queries the target QP or only the substitute. This is a load-bearing gap: if the attacker cannot obtain accurate QP predictions or labels in practice, the 248.5% UE gain in Table 3 does not materialize. Please specify the substitute training protocol and demonstrate the attack under realistic observability assumptions, e.g., where the cell observes only its own KPI reports and the handover decisions addressed to it, with a bounded query budget.","section":"Section 5, Section 4"},{"comment":"The headline result is based on a single simulation run per scenario with no variance reporting. Table 3 reports mean, min, and max UE counts for one benign and one malicious run in SAS and MAS, but there are no confidence intervals, standard deviations across seeds, or statistical tests. It is therefore impossible to assess whether the observed differences are stable or could be artifacts of one random trajectory. Please provide multiple independent runs with different random seeds for both benign and attack scenarios, and report the distribution of the attack's impact (e.g., mean and 95% CI of the UE-allocation ratio).","section":"Section 8.2.1, Table 3"},{"comment":"The MARRS detection threshold T is selected post-hoc on the test set. Section 8.1.2 states 'we set the threshold policy T to maximize the F1 score in the classification processes,' and Table 5 reports metrics on the test set. This is a form of test-set tuning: the threshold is chosen to optimize the very metric later reported, which inflates the accuracy and F1 figures. The threshold should instead be selected on a validation set or by cross-validation, and only then evaluated on a held-out test set. This is a central methodological point for the detection claim, since the entire benefit of MARRS over the baselines is quantified with these numbers.","section":"Section 8.1.2, Section 8.2.2, Table 5"},{"comment":"The reported percentage difference is mathematically overstated. In Table 3, BS5's mean UE count in the benign SAS is 4.27 and in the malicious SAS is 10.61; the ratio is 10.61/4.27 = 2.485, i.e., the malicious cell receives 248.5% of the benign allocation, which is a 148.5% increase, not a 248.5% increase. The same mislabeling appears in the MAS rows (e.g., 11.21/4.56 = 2.458, i.e., 145.8% greater, not 245.68%). The abstract's claim of '248.5% greater UE allocation' is therefore incorrect. Please correct the wording throughout, or change the calculation to (malicious - benign) / benign.","section":"Abstract, Section 8.2.1, Table 3"}],"minor_comments":[{"comment":"Equation (2) contains stray commas and the surrounding text is inconsistent: the sentence before the equation says a loss higher than T is classified as trusted, while the subsequent text and the equation itself say the opposite. Please unify the description and the equation.","section":"Section 6, Eq. (2)"},{"comment":"The acronym MARRS is misspelled as 'MARSS' in the sentence 'Deploying MARSS on the near-RT RIC'.","section":"Section 9, Discussion"},{"comment":"The training-set subsets x1, x2, x3, x4 are not defined in the text. Please specify what portion of the collected time series each subset corresponds to, so the reader can interpret the 'more data over time' claim.","section":"Section 8.2.2, Table 4"},{"comment":"The feature table uses the abbreviation 'RSSNIR' for what appears to be signal-to-noise ratio, while the text and simulator description mention RSRQ and SNIR separately. Please align the terminology and units.","section":"Section 6.1.1, Table 2"},{"comment":"The sentence 'To accurately model real-world attack progression, we initialize both attack scenarios using identical conditions to their benign baseline scenarios, while the benign scenarios initialized randomly' is ambiguous. Please clarify whether the benign runs use a single random seed or multiple seeds, and whether the attack runs reuse the same trajectories as the benign runs.","section":"Section 8.1.1"}],"recommendation":"major_revision","confidential_remarks":"The paper has a strong central idea and a reproducible testbed, but the empirical evidence needs substantial strengthening. The missing substitute-model specification is the most serious issue because it directly affects whether the attack is a real threat or an artifact of the experimental setup. In addition, the single-run evaluation and test-set threshold selection would need to be addressed even for a workshop-level empirical claim. I believe the paper is within scope for the journal and the issues are fixable, so major revision, rather than rejection, is appropriate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThis is the first paper I've seen that puts the cell operator itself on the adversarial side of O-RAN traffic steering, rather than the UE, the xApp, or the E2 interface. The multi-operator trust boundary is real, and the financial motive (more served UEs, more revenue) is plausible for that setting. The testbed is the strongest part: they wired a wireless simulator to an actual OSC RIC cluster and demonstrated a closed-loop attack and a matching detector. That is a serious engineering contribution, and the reported 248.5% UE gain for the malicious cell in the single-attack scenario is large enough to warrant attention.\n\nNow the soft spots, in order of size. The attack's stage one trains a substitute QP model, but the paper never says what the attacker observes. Does the cell see the QP's QoE forecasts, or only the handover decisions sent to it? In the testbed the authors control both sides, so the substitute can silently be trained with white-box access. In a real multi-operator deployment, a cell reports its own KPIs and receives handover commands; it does not see the RIC's internal QoE predictions. HopSkipJump is a decision-based attack that needs many hard-label queries, and it is unclear where those labels come from. This is the load-bearing gap: the 248.5% number may be real in the testbed, but as reported it does not show an achievable attack under realistic access. Secondary but real issues: each scenario appears to be one simulation run with no variance reporting; the MARRS threshold T was chosen to maximize F1 on the test set, which inflates the 0.978 F1; and the paper promises an open-source testbed but provides no link or artifact. The detector itself, a two-stage contextual LSTM autoencoder, is a modest but sound architectural extension, and the ablation and benchmarks give it some support.\n\nNone of this kills the central idea. The threat model is new, the testbed is useful, and the detection approach is worth exploring. But the paper needs a specified attacker query model, multiple seeded runs, and a threshold chosen on a held-out split before the quantitative claims should be taken at face value.\n\nI'd send this to peer review. It will likely come back substantially revised, but with the query model made explicit and the evaluation tightened, it could be a solid contribution. A serious referee should focus on Section 5 and on the single-run, test-set-tuned evaluation.","headline":"New cell-as-attacker threat model and a useful closed-loop testbed, but the attack's feasibility rests on an underspecified substitute-model query step that the testbed silently grants.","tokens_in":21430,"tokens_out":3796,"would_cite":true,"duration_ms":39428,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A malicious cell in a multi-operator O-RAN can trick traffic steering into over-allocating user equipment by 248.5 percent, and a contextual LSTM-autoencoder detector catches the tampering.","keywords":["O-RAN security","adversarial machine learning","traffic steering","multi-operator RAN","KPI manipulation","LSTM autoencoder","evasion attack","xApp security"],"falsifier":"Run the APATE recipe against a production-like QoE predictor where the attacker can only observe the traffic steering handover decisions (not the QP's internal scores) and must train its substitute from those observable outcomes; if the substitute's predictions do not transfer to the target model, the crafted perturbations will not raise the QoE forecast and the UE allocation gain will not materialize. A simpler check: measure the substitute model's agreement with the target QP on a held-out set of benign KPI reports; if agreement is near chance, the attack fails before it starts.","tokens_in":20322,"feed_emoji":"📡","tokens_out":6400,"duration_ms":57209,"temperature":0.7,"pith_summary":"This paper claims that the shift to multi-operator open radio access networks (O-RAN) creates a new attack surface: an untrusted cell operator can manipulate the key performance indicators it reports and deceive the traffic steering loop into handing over far more user equipment than the cell should receive. The authors build a testbed combining a wireless network simulator with an official O-RAN RIC platform and demonstrate APATE, an evasion attack in which a malicious cell queries a substitute QoE predictor to craft adversarial KPI reports. In their experiments, the attacked cell serves 248.5% more UEs on average than in the benign baseline, while neighboring cells lose users. To counter this, they propose MARRS, a two-stage LSTM-autoencoder detector that learns each cell's normal telemetry together with network-wide context and flags tampered reports with 99.2% accuracy and an F1 score of 0.978. A sympathetic reader would take the paper as establishing that self-reported cell telemetry is a credible attack vector in multi-operator O-RAN, and that contextual reconstruction-based detection is a viable defense.","feed_headline":"Rogue cell tricks O-RAN, gains 248.5% more users","feed_subtitle":"New LSTM-autoencoder detector catches the tampered telemetry with 99.2% accuracy in a live testbed.","key_machinery":"The load-bearing object is the QoE predictor (QP) in the traffic steering loop, together with the attack's substitute-model pipeline and MARRS's two-layer contextual autoencoder. APATE's machinery is Eq. (1): the attacker adds an optimal perturbation $\\delta^*$ to its KPI report $R$ so that the QP's prediction $Q(R+\\delta^*)$ is pushed toward a higher QoE class, with $\\delta^*$ found by querying a locally trained substitute QP using the HopSkipJump decision-based attack. MARRS's machinery is Eq. (3): each cell's latent embedding $\\mathrm{emb}_{c_i}$ from a first LSTM autoencoder is concatenated with the average embedding of all other cells to form an enriched feature vector $X^{(2)}_{c_i}$, which a second autoencoder must decode back into the original features; the reconstruction loss $\\ell(F(R),R)$ compared to a threshold $T$ decides trusted versus untrusted. The contextual second stage is what lets MARRS spot tampering that a per-cell autoencoder alone would tolerate.","core_discovery":"The central discovery is a concrete attack-defense pair for the traffic steering (TS) flow of an O-RAN near-real-time RIC. Under the threat model where a cell is operated by an untrusted third-party operator with a financial incentive to serve more users, APATE works by training a substitute of the QoE predictor (QP) xApp, using a decision-based adversarial attack (HopSkipJump) to compute minimal perturbations to the cell's reported KPIs, and then reporting those perturbed KPIs to the RIC; the QP then forecasts an artificially high QoE for that cell, and the TS xApp allocates additional UEs to it. In the testbed, this yields a 248.5% average increase in UEs served by the malicious cell in the single-attacker scenario and similar gains (154.16% and 245.68%) for two simultaneous attackers, at the expense of neighboring cells. The companion result is MARRS, which trains a per-cell LSTM autoencoder, enriches each cell's latent embedding with the aggregated embeddings of all other cells, and trains a second autoencoder to reconstruct the original features; reconstruction loss above a threshold marks the report as untrusted. On the same testbed data, MARRS reaches 99.2% accuracy and 0.978 F1, beating isolation forest, one-class SVM, and a plain linear autoencoder, and a sequence-based variant eliminates false positives entirely.","pith_inferences":["The paper's testbed grants the attacker the ability to train a substitute QP by construction; a real multi-operator attacker may only observe handover decisions, not QP scores, so the practical gain depends on whether a substitute trained on observable outcomes transfers to the target model.","If the attack transfers, the same mechanism should generalize to any RIC use case that acts on self-reported cell KPIs, such as slicing or load balancing; MARRS's context-enriched reconstruction is a template for defending those flows too.","An adaptive attacker aware of MARRS could try to craft perturbations that stay within the benign reconstruction-loss manifold; testing MARRS against such an adversary would be a natural next experiment.","The financial incentive structure (operators paid per served UE) means the attack's real-world impact scales with how directly UE counts map to revenue; quantifying that mapping in actual roaming agreements would sharpen the risk assessment."],"forward_implications":["In a single-attacker scenario, the malicious cell's average UE count rises from 4.27 to 10.61, a 248.5% gain, while the neighboring cell BS6 drops to 57.27% of its benign allocation.","With two simultaneous attackers, both malicious cells gain (154.16% and 245.68%) and the neighboring cell BS6 loses about half its users, showing the attack redistributes load network-wide, not just to the attacker.","The same threat model covers a supply-chain-compromised cell in a single-operator network, so the defense is relevant beyond multi-operator settings.","Deploying MARRS as an xApp on the near-RT RIC detects the tampered telemetry in real time, with accuracy improving as more training data accumulates over time.","The sequence-based S-MARRS variant removes false positives entirely (precision 1.0) while preserving detection, at the cost of requiring several consecutive windows before flagging."],"supporting_citations":[{"why":"Supplies the closed-loop wireless network simulator that feeds realistic KPI telemetry into the RIC for both attack and detection experiments.","marker":"[17]"},{"why":"Provides the official O-RAN RIC platform that hosts the KPIMON, AD, QP, and TS xApps forming the traffic steering flow under attack.","marker":"[11]"},{"why":"Defines the QoE-prediction-based traffic steering approach that the paper follows as the target use case.","marker":"[19]"},{"why":"Supplies the HopSkipJump decision-based attack used to craft the adversarial KPI perturbations.","marker":"[16]"},{"why":"Implements the adversarial attack in the toolbox used to generate APATE's samples.","marker":"[47]"},{"why":"Motivates the attacker's capability to know the TS task flow, grounding the threat model in prior O-RAN adversarial-machine-learning analysis.","marker":"[29]"},{"why":"Provides the LSTM-autoencoder architecture on which MARRS's two-stage reconstruction detector is built.","marker":"[34]"}],"fun_headline_variants":["Fake KPIs hijack O-RAN users: 248% jump","O-RAN attack inflates KPI, steals user allocation","Defense vs rogue cells: LSTM autoencoder hits 99%","Multi-operator O-RAN: untrusted cells can skew traffic","Adversarial KPI attack gains 248% users in O-RAN"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack depends on the premise that a malicious cell operator can train an accurate substitute of the QoE predictor using data and query access that a real operator would actually have in a multi-operator deployment; in the testbed this access is granted by construction, and the paper does not specify how the substitute is trained, how many queries are needed, or whether the attacker only observes handover decisions rather than QP outputs.","fun_headline_variants_meta":{"raw":{"variants":["Fake KPIs hijack O-RAN users: 248% jump","O-RAN attack inflates KPI, steals user allocation","Defense vs rogue cells: LSTM autoencoder hits 99%","Multi-operator O-RAN: untrusted cells can skew traffic","Adversarial KPI attack gains 248% users in O-RAN"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000929,"raw_usage":{"total_tokens":4096,"prompt_tokens":1179,"completion_tokens":2917,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":795,"completion_tokens_details":{"reasoning_tokens":2822}},"tokens_in":795,"tokens_out":2917,"duration_ms":21018,"temperature":1.0,"reasoning_tokens":2822,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T04:09:27.711694+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the APATE recipe against a production-like QoE predictor where the attacker can only observe the traffic steering handover decisions (not the QP's internal scores) and must train its substitute from those observable outcomes; if the substitute's predictions do not transfer to the target model, the crafted perturbations will not raise the QoE forecast and the UE allocation gain will not materialize. A simpler check: measure the substitute model's agreement with the target QP on a held-out set of benign KPI reports; if agreement is near chance, the attack fails before it starts.","supporting_citations":[{"cited_title":"Satellite integration into 5g: deep re- inforcement learning for network selection.Machine Intelligence Research, 19(2):127–137, 2022","cited_arxiv_id":null,"evidence_quote":"Supplies the closed-loop wireless network simulator that feeds realistic KPI telemetry into the RIC for both attack and detection experiments."},{"cited_title":"Osc community lab: The integration test bed for o-ran soft- ware community","cited_arxiv_id":null,"evidence_quote":"Provides the official O-RAN RIC platform that hosts the KPIMON, AD, QP, and TS xApps forming the traffic steering flow under attack."},{"cited_title":"Toward modular and flexible open ran implementations in 6g networks: Traffic steering use case and o-ran xapps.Sensors, 21(24):8173, 2021","cited_arxiv_id":null,"evidence_quote":"Defines the QoE-prediction-based traffic steering approach that the paper follows as the target use case."},{"cited_title":"Hopskipjumpattack: A query-efficient 14 decision-based attack","cited_arxiv_id":null,"evidence_quote":"Supplies the HopSkipJump decision-based attack used to craft the adversarial KPI perturbations."},{"cited_title":"Lstm-autoencoder based anomaly detection using vibration data of wind turbines.Sen- sors, 24(9):2833, 2024","cited_arxiv_id":null,"evidence_quote":"Provides the LSTM-autoencoder architecture on which MARRS's two-stage reconstruction detector is built."}],"review_version":1}