{"id":"e784d7e6-e6f0-44f7-94e7-b698cf652021","arxiv_id":"2505.12555","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A PUSCH-based bistatic 5G NR ISaC receiver with ML delay/Doppler estimation and CRLB analysis shows a tradeoff between sensing accuracy, DMRS count, and throughput.","lead":"This paper proposes a 5G New Radio bistatic sensing system that uses both data and pilot symbols from the uplink PUSCH channel to estimate a target's delay and Doppler. The idea matters because it could let cellular base stations sense objects without dedicated radar hardware or major transceiver changes.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"LoS removal is the load-bearing assumption: all sensing RMSE and CRLB results assume perfect cancellation of a LoS path about 9.5 dB stronger than the target, with no robustness analysis.","rationale":"The reader's weakest_assumption identifies the same load-bearing condition: perfect LoS removal. My reading of the full text supports this, and the numerical setup makes the concern concrete because the LoS is about 9.5 dB stronger than the target, so even -20 dB residual cancellation leaves an interferer comparable to the target. The paper explicitly scopes this out in Section IV.B and defers joint positioning and LoS-robust sensing to an extended version, but the claim that existing PUSCH can be used for sensing without dedicated waveforms is conditional on this unresolved step. I do not think this requires rejection: the assumption is stated plainly, the ML/FIM machinery is standard, the simulations are reproducible in principle, and a sensitivity study could resolve the concern. A secondary, more internal issue is the HARQ-aware combination in Proposition 1: as written, rho appears to be 1 - prod(P_i)/E[X], whereas the proof's own algebra gives rho = (1 - prod(P_i))/E[X]; this affects the analytical lower bound in Figure 6 but not the direct simulation RMSE curves. Since the reader already issued CONDITIONAL, my stress-test leaves the verdict unchanged and agrees with the reader's weakest-assumption identification.","tokens_in":8477,"tokens_out":11155,"duration_ms":117817,"concrete_test":"Re-run the link-level simulations behind Figures 3-6 with an imperfect LoS cancellation stage modeled as a residual LoS path with complex gain beta * alpha0, for beta in {0, 0.1, 0.01, 0.001} (i.e., 0, -20, -40, -60 dB suppression), and compare the resulting range and Doppler RMSE against the current perfect-removal curves at SNR1 = -20 dB. If beta = 0.1 shifts the RMSE by more than a factor of about 2, the headline claim holds only under near-perfect cancellation and should be stated as such.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that existing 5G NR PUSCH can support accurate bistatic sensing without dedicated waveforms depends on the gNB being able to remove the LoS component from the uplink CIR before sensing. Section IV.B asserts this as an assumption: 'the gNB can successfully remove the LoS path from the UL CIR for sensing.' The simulation setup uses SNR_c = SNR0 + SNR1 = 10 SNR1, so the LoS path is roughly 9.5 dB stronger than the target reflection. Equation (12), the FIM in (16), the CRLB in (18), and every simulated RMSE curve are generated under the condition that the residual LoS is exactly zero. If cancellation is imperfect, the residual LoS acts as a strong deterministic interferer with delay tau0 and Doppler 0, the single-target likelihood in (13)-(14) is misspecified, and the periodogram peak for the target sits on an elevated noise/interference floor. The CRLB derived from (16), which assumes only white noise, is then no longer a valid bound on the actual estimator MSE. The paper provides no cancellation algorithm, no residual-error model, and no sensitivity analysis, so the practical regime in which the headline result holds is left unspecified. This is not an internal inconsistency, but it is the least secure condition the central claim rests on, and it is stated rather than demonstrated.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript considers a bistatic 5G NR integrated sensing and communication (ISaC) system in which the gNB performs sensing on the uplink PUSCH. The gNB first decodes the transport block; if decoding succeeds, it reconstructs the data symbols and uses both DMRS and data REs for delay-Doppler estimation, whereas in case of CRC failure it uses only DMRS. The paper derives the maximum likelihood estimator for the delay and Doppler of a single point target, presents the Fisher information matrix and Cramér-Rao lower bound, and combines the two sensing modes with a HARQ-aware mixture formula in Proposition 1. Numerical results with the MATLAB 5G Toolbox show range and Doppler RMSE versus SNR as well as throughput, comparing different DMRS configurations and MCS indices.","tokens_in":8708,"tokens_out":16211,"duration_ms":152762,"significance":"The contribution is useful and timely: it shows that existing PUSCH transmissions, without a dedicated sensing waveform, can in principle provide bistatic sensing, and it quantifies the throughput-sensing tradeoff. The signal model, FIM, and CRLB are standard and, apart from the issues below, correctly applied. The paper gives a clear simulation setup and compares against a 3GPP-compliant PUSCH chain, which strengthens the relevance of the numerical results. The HARQ-aware weighting of the two sensing modes is an interesting idea. However, the headline claim depends critically on an unexamined assumption of perfect LoS removal, and Proposition 1 needs to be stated and proved more carefully; these points currently prevent the paper from supporting its central practical claim.","major_comments":[{"comment":"The assumption that the gNB can successfully remove the LoS path from the UL CIR for sensing is load-bearing for every sensing result in the paper. Under this assumption, Eq. (12), the likelihoods (13)-(14), the FIM (16), and the CRLB (18) are derived for a single target in white noise only. However, in the simulations the LoS path is roughly 10 times (10 dB) stronger than the target, and the text states 'we assume that the LoS path has been successfully removed' with no cancellation algorithm, no residual-error model, and no sensitivity analysis. If LoS removal is imperfect, the residual LoS acts as a strong deterministic interferer with delay tau0 and Doppler 0, the single-target likelihood is misspecified, and the CRLB in (18) is no longer a valid bound on the actual estimator MSE. This is a correctness-risk concern rather than an internal inconsistency, but it directly affects the central claim that existing PUSCH can support accurate bistatic sensing. The authors should either include a LoS cancellation procedure with a residual-error characterization, provide a robustness study showing how the RMSE and the CRLB comparison behave as the residual LoS strength increases, or explicitly restrict the claims to a system where LoS removal is guaranteed externally.","section":"Section IV.B and Section V (Figs. 3-6)"},{"comment":"The displayed definition of rho is ambiguous and inconsistent with the proof. The text prints 'rho = 1 - prod_{i=1}^4 P_i / E[X]' without parentheses; the proof and the surrounding algebra require rho = (1 - prod_{i=1}^4 P_i)/E[X]. As printed, the formula would read as 1 - (prod P_i)/E[X], which is not the coefficient used in the proof. In addition, the proof's intermediate statement that the average MSE in the complementary case is (1 - 1/E[X]) MSE1 + MSE2/E[X] is not justified as a conditional average: for TBs that are eventually decoded, the slot-level average is E[(X-1)/X | success] MSE1 + E[1/X | success] MSE2, which involves E[1/X]. The final per-slot formula can be derived exactly by counting scenario-1 and scenario-2 slots over all TBs and yields rho = (1 - prod P_i)/E[X]; the proof should be rewritten to show this explicitly rather than relying on an unstated approximation.","section":"Section IV.D, Eq. (17) and its proof"},{"comment":"The (1,1) entry of the FIM in Eq. (16) is written as KL, but for scenario 1 the active RE set is only the DMRS REs. The accompanying sentence says the summations are restricted to DMRS REs in scenario 1, but the top-left entry is not written as a summation and therefore appears to use KL even when only Np = |DMRS| REs are available. Since the CRLB for delay and Doppler, and hence the weighted lower bound in Proposition 1, depend on the full FIM through the Schur complement, the top-left entry should be replaced by Np (or by an explicit sum over the active RE set) for scenario 1.","section":"Section IV.C, Eq. (16)"}],"minor_comments":[{"comment":"The text states that the error probabilities satisfy 'P4 i=1 Pi = 1', which is inconsistent with the use of products in Eqs. (10) and (17). The intended condition is presumably 0 <= P_i <= 1 with the overall failure probability given by prod_{i=1}^4 P_i; this should be corrected.","section":"Section IV.A"},{"comment":"After 'undoing the phase' of the symbol, the measurement should be written as x_{k,l}^* y_{k,l}; the current notation z_{k,l} = |x_{k,l}| alpha_1 e^{-j2 pi f_k tau_1} e^{j2 pi l T_s nu_1} + w~ is only valid for |x_{k,l}| = 1, which the text states, but an explicit conjugation would improve clarity.","section":"Section IV.B, Eq. (12)"},{"comment":"There is a typo 'Fig, 3' in the main text; in addition, the legends in Figs. 3 and 4 are difficult to parse because the curve labels are not clearly separated from the 'DMRS = 2' and 'DMRS = 4' annotations.","section":"Section V, Fig. 3"},{"comment":"The acronym 'AGWN' should be 'AWGN' (additive white Gaussian noise).","section":"Section II.C"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is within the scope of the journal and the core model/CRLB analysis is sound. The main risk is the unexamined LoS-removal assumption, which should be the focus of the revision; a robustness study with a residual LoS model would be the most informative addition. I do not see any circularity or parameter tuning in the comparison; the lower-bound match in Fig. 6 is a standard sanity check. The Proposition 1 issues are fixable with a clearer statement and proof."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nMy take on Gangula et al.: the paper proposes using decoded PUSCH data, together with DMRS, for bistatic sensing in 5G NR, and combines the two sensing modes via a HARQ-aware MSE expression. The practical angle—reconstructing data symbols after successful TB decoding and using them as radar waveforms—is a real step beyond pilot-only schemes, and the evaluation with MATLAB 5G Toolbox (actual PUSCH chains, coding, rate matching) is more grounded than most ISAC papers. The ML estimator and CRLB are standard OFDM radar results, correctly derived. The DMRS overhead versus throughput tradeoff is clearly demonstrated. That part is solid.\n\nThe soft spots, in order.\n\nFirst, Proposition 1 as written looks wrong. The proof averages over HARQ rounds and yields a coefficient of (1−Π P_i)/E[X] on MSE2, but the stated ρ is 1 − Π P_i/E[X]. These differ. The proof also silently uses E[1/X] ≈ 1/E[X]. Since the lower bound in Fig. 6 depends on this formula, the authors need to fix it, or explicitly say they used something else.\n\nSecond, the headline claim is conditional on perfect LoS cancellation. Section IV.B assumes the gNB knows the UE position and can remove the LoS path from the UL CIR; Section V says measurements are generated after successful removal. The LoS is about 9.5 dB stronger than the target reflection. If cancellation is imperfect, the residual acts as a strong interferer at (τ0, 0), the single-target likelihood is misspecified, and the CRLB derived from white noise is not a valid bound on actual estimator MSE. The paper gives no cancellation algorithm, no residual-error model, no sensitivity analysis. That is a real gap. It doesn't sink the concept, but the abstract's claim that \"significant throughput while accurately estimating sensing parameters\" should be tempered until this is addressed.\n\nThird, the novelty relative to [14] (Tapio et al., also PUSCH-based bistatic sensing) is not clearly argued. The paper distinguishes itself by including channel coding and HARQ, but I had to guess what [14] lacks. A direct comparison would help.\n\nMinor: there's an obvious typo \"P4 i=1Pi = 1\" that should be corrected.\n\nOverall, the core idea is sound and the simulations seem honest. The two issues above are fixable. I'd send this to peer review; the HARQ-aware formulation is a legitimate contribution, and LoS robustness can be handled in revision with at least a discussion or a residual-error bound. Worth a serious referee, though not a clean accept.","headline":"A practical PUSCH-based bistatic ISAC paper with a correct, if standard, ML/CRLB core, but the HARQ-aware MSE formula in Proposition 1 appears wrong as written and the headline result rests on perfect LoS cancellation with no robustness analysis.","tokens_in":9271,"tokens_out":6787,"would_cite":true,"duration_ms":66769,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A bistatic 5G ISaC receiver estimates target delay and Doppler from decoded PUSCH data and DMRS, with a HARQ-aware MSE near the Cramér–Rao lower bound.","keywords":["integrated sensing and communication","bistatic sensing","5G NR","PUSCH","DMRS","maximum likelihood estimation","Cramér-Rao lower bound","HARQ"],"falsifier":"Inject a known residual line-of-sight component of increasing strength into the received uplink channel after cancellation and compare the simulated delay and Doppler RMSE against the paper's Cramér–Rao lower bound; the claim fails if the RMSE departs from the bound once the residual exceeds a small fraction of the reflected path power.","tokens_in":8255,"feed_emoji":"📡","tokens_out":7481,"duration_ms":64337,"temperature":0.7,"pith_summary":"This paper proposes treating an ordinary 5G uplink PUSCH transmission as a bistatic sensing signal: once a base station decodes a user's data block, it can reconstruct the transmitted symbols and use every resource element, not just reference symbols, to estimate the delay and Doppler shift of a reflected target. The central claim is that this yields sensing accuracy close to the Cramér–Rao lower bound while the link still delivers high throughput, and that the tradeoff between pilot count, coding rate, and sensing error can be quantified. A maximum-likelihood estimator for delay and Doppler is derived, and a HARQ-aware formula combines the error in slots where decoding fails (DMRS only) with the error in slots where the full PUSCH is available. Link-level simulations for QPSK show range and Doppler RMSE curves near the bound across SNR.","feed_headline":"Decoded 5G uplink data can sense targets while carrying traffic","feed_subtitle":"A bistatic receiver using decoded uplink data and pilots keeps sensing error near the Cramér-Rao bound at useful throughput.","key_machinery":"The load-bearing identity is Proposition 1, which writes the average sensing MSE as $$\\text{MSE}(\\lambda_n) = (1-\\rho)\\text{MSE}_1(\\lambda_n) + \\rho\\,\\text{MSE}_2(\\lambda_n),$$ where $\\rho = (1-\\prod_{i=1}^4 P_i)/\\mathbb{E}[X]$ is formed from the HARQ round error probabilities $P_i$ and the expected number of rounds $\\mathbb{E}[X]$. Scenario 1 (CRC failure) uses only DMRS resource elements, while scenario 2 (successful decode) uses all resource elements after data reconstruction. The estimator itself is a two-dimensional periodogram over delay and Doppler, and the CRLB comes from the Fisher information matrix (16), which switches its summation domain between DMRS-only and all-RE sets. The NR standard's MCS table supplies the code rate and modulation order that connect sensing performance to throughput.","core_discovery":"The paper establishes that a 5G NR bistatic integrated sensing and communication receiver can use decoded PUSCH data as a sensing waveform without dedicated radar resources, provided the user position is known and the line-of-sight path is removed. The single-target delay and Doppler estimates come from a maximum-likelihood periodogram, and the Fisher information matrix gives a Cramér–Rao lower bound for both the DMRS-only case and the full-PUSCH case. Proposition 1 weights these two cases by the HARQ decoding probabilities, producing an average sensing MSE for the actual transmission process. Numerical results with QPSK show range RMSE scaling down to meter scale and Doppler RMSE decreasing with SNR, close to the lower bound, while throughput remains several megabits per second.","pith_inferences":["If the line-of-sight removal assumption holds, the same receiver logic extends to downlink PDSCH and to multi-antenna base stations for angle-of-arrival, turning the delay-Doppler estimates into full target localization.","The HARQ-aware MSE formula implies that retransmissions, normally a throughput cost, also act as sensing diversity; a scheduler could trade redundancy rounds for sensing accuracy at low SNR.","With higher-order modulation, data symbols are no longer unit-magnitude; a testable extension would divide out estimated QAM magnitudes and track how amplitude estimation error propagates into the delay-Doppler periodogram.","The line-of-sight residual is the main risk to the claim; an experiment that injects imperfect cancellation would map how much residual power is needed to push the RMSE away from the CRLB."],"forward_implications":["Existing 5G NR uplink deployments can provide bistatic sensing without new waveforms or full-duplex hardware, as long as transport blocks decode successfully often enough.","Increasing DMRS density improves sensing RMSE but lowers throughput; the paper's MSE formula quantifies this tradeoff, so pilot configurations can be chosen by sensing requirement.","At low SNR where decoding fails, sensing degrades to DMRS-only performance, and the HARQ-aware formula predicts how retransmissions partially recover sensing accuracy.","The CRLB for the full-PUSCH case is a floor for any estimator that uses all resource elements after decoding, giving a benchmark for future joint estimators."],"supporting_citations":[{"why":"Supplies the OFDM log-likelihood and Fisher-information derivation that the ML estimator and CRLB are built on.","marker":"[18]"},{"why":"Establishes the line-of-sight removal premise for uplink joint communication and sensing that the paper adopts.","marker":"[19]"},{"why":"Defines the MCS table and modulation parameters used to compute code rate, throughput, and the QPSK constraint.","marker":"[23]"},{"why":"Gives the HARQ average-throughput model used in the throughput expression and in Proposition 1.","marker":"[24]"},{"why":"Provides the two-dimensional periodogram algorithm used for joint delay-Doppler maximum-likelihood estimation.","marker":"[16]"},{"why":"Supplies the bistatic geometry equations that convert estimated delay and Doppler to target range and velocity.","marker":"[21]"}],"fun_headline_variants":["5G uplink data doubles as bistatic radar for target sensing","PUSCH-based bistatic sensing approaches Cramér-Rao bound","Data-carrying 5G signals also deliver precise delay-Doppler estimates","Bistatic 5G sensing from uplink traffic, no dedicated radar"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The analysis assumes the base station already knows the user's position and can completely remove the direct line-of-sight path from the received signal before sensing; if any residual line-of-sight energy remains, the single-target error bounds no longer hold.","fun_headline_variants_meta":{"raw":{"variants":["5G uplink data doubles as bistatic radar for target sensing","PUSCH-based bistatic sensing approaches Cramér-Rao bound","Data-carrying 5G signals also deliver precise delay-Doppler estimates","Bistatic 5G sensing from uplink traffic, no dedicated radar"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000824,"raw_usage":{"total_tokens":3558,"prompt_tokens":857,"completion_tokens":2701,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":473,"completion_tokens_details":{"reasoning_tokens":2620}},"tokens_in":473,"tokens_out":2701,"duration_ms":20841,"temperature":1.0,"reasoning_tokens":2620,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:31:29.848533+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Inject a known residual line-of-sight component of increasing strength into the received uplink channel after cancellation and compare the simulated delay and Doppler RMSE against the paper's Cramér–Rao lower bound; the claim fails if the RMSE departs from the bound once the residual exceeds a small fraction of the reflected path power.","supporting_citations":[{"cited_title":"Performance analysis of joint radar and communication using OFDM and OTFS,","cited_arxiv_id":null,"evidence_quote":"Supplies the OFDM log-likelihood and Fisher-information derivation that the ML estimator and CRLB are built on."},{"cited_title":"Performance analysis of uplink joint communication and sensing system,","cited_arxiv_id":null,"evidence_quote":"Establishes the line-of-sight removal premise for uplink joint communication and sensing that the paper adopts."},{"cited_title":"Physical layer procedures for data,","cited_arxiv_id":null,"evidence_quote":"Defines the MCS table and modulation parameters used to compute code rate, throughput, and the QPSK constraint."},{"cited_title":"Performance of hybrid-ARQ in block-fading channels: A fixed outage probability analysis,","cited_arxiv_id":null,"evidence_quote":"Gives the HARQ average-throughput model used in the throughput expression and in Proposition 1."},{"cited_title":"OFDM radar algorithms in mobile communication net- works,","cited_arxiv_id":null,"evidence_quote":"Provides the two-dimensional periodogram algorithm used for joint delay-Doppler maximum-likelihood estimation."},{"cited_title":"Cramer-Rao bounds and selection of bistatic channels for multistatic radar systems,","cited_arxiv_id":null,"evidence_quote":"Supplies the bistatic geometry equations that convert estimated delay and Doppler to target range and velocity."}],"review_version":1}