Pith. sign in

REVIEW 3 major objections 5 minor 12 references

Analysis of the vulnerability of machine learning regression models to adversarial attacks using data from 5G wireless networks

T0 review · 3 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Tiny FGSM perturbations in nearly all test records raise a 5G pathloss regression model's mean-squared error by about a third, and a gradient-boosted binary classifier flags them with roughly 98% accuracy, restoring the original metrics…

desk verdict The restoration claim is unsupported because the defended model is evaluated on a filtered 5,029-record subset while the baselines run on the full test set, making the central defense result a selection effect. read the letter →

arxiv 2505.00487 v1 pith:4UEGT6JP submitted 2025-05-01 cs.CR cs.AI

Leonid Legashev , Artur Zhigalov , Denis Parfenov This is my paper · ORCID
classification cs.CRcs.AI
keywords adversarialattacksFGSMregressionmodels5GnetworksmassiveMIMOpathlosspredictionanomalydetectionmachinelearningsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tests whether a regression model that predicts wireless signal loss in a 5G massive-MIMO setting can be sabotaged by adversarial poisoning of the data it sees, and whether a second, simpler model can catch the poisoned records. It reports that a Fast Gradient Sign Method (FGSM) attack with a tiny noise step ($\epsilon=10^{-10}$) applied to almost all records raises the linear regression model's mean-squared error by about 33% and lowers its $R^2$ by about 10%. A gradient-boosted binary classifier detects the poisoned records with about 98% accuracy, and removing the flagged records restores the regression metrics to their original values. The study matters because pathloss predictions guide routing and access decisions in next-generation wireless networks, so a cheap, barely visible manipulation of the data could degrade service for many users.

What carries the argument

The attack engine is the Fast Gradient Sign Method (FGSM), which perturbs each input record by $\epsilon$ times the sign of the gradient of the regression loss with respect to the features, so that the model's error grows in the chosen direction. The defense machinery is a gradient-boosted binary classifier trained to separate poisoned from benign records; the paper compares three boosted-tree variants and selects the best by cross-validated hyperparameter tuning. The regression target is the combined pathloss, and the features are user coordinates, arrival and departure angles, phase, power, and line-of-sight status. The vulnerability itself is carried by the linear regression model, which is re-expressed as a one-layer neural network without an activation function, giving a clean gradient for the attack to follow.

What would settle it

Re-run the identical dataset split, FGSM attack, and gradient-boosted filter, then evaluate the regression model on the full test set with only the flagged records removed, and compare against removing the same number of records at random. If the full-test-set MSE and $R^2$ do not return to approximately 38.51 and 0.80, or if random removal improves the metrics by the same amount, the restoration claim is refuted.

Watch

Extended reading notes

Core claim

On a tabular dataset generated by a 3D radio-propagation ray-tracing emulator for a street-level 5G base station, a linear regression model predicts combined signal pathloss with an MSE of 38.51 and an $R^2$ of 0.80. The paper's central claim is that an adversarial FGSM attack that maximizes the gradient sign, using $\epsilon=10^{-10}$ and corrupting 99.999% of the poisoning sample, degrades the model to MSE 51.40 and $R^2$ 0.72 on the same test set, a rise of roughly 33% in error and a drop of 10% in explained variance. A gradient-boosted binary classifier trained on poisoned versus benign records detects the anomalous records with approximately 98% accuracy, and after these flagged records are removed, the remaining 5,029 records give MSE 37.55 and $R^2$ 0.80, matching the undefended values. The paper presents this as evidence that regression models in wireless networks are vulnerable to adversarial poisoning, but that the attack is detectable and its effect can be reversed by filtering the data before evaluation.

Load-bearing premise

The claim that the filter restores the model depends on the assumption that evaluating the regression model on the reduced 5,029-record subset left after removing flagged records is a fair comparison to the full test set; if the removed records are concentrated in hard-to-predict regions, the lower MSE and higher $R^2$ come from the subset itself rather than from any genuine defense.

Editorial extensions

If this is right

  • A near-invisible perturbation (step size $10^{-10}$) applied to almost all records can raise a regression model's prediction error by a third, so even tiny data manipulation is a practical threat to pathloss-based decisions.
  • A gradient-boosted binary classifier can act as a data filter that brings MSE and $R^2$ back to their undefended values after an attack.
  • Because the attack's effect on the model is reversed by filtering alone, the model itself does not need to be retrained after this particular attack.
  • For 5G/6G network operations, monitoring the data entering pathloss predictors is a viable defensive measure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension the paper leaves implicit is what happens when the regression model is retrained on the cleaned training set rather than merely evaluated on a trimmed test set; that would distinguish a true defense from a data-filtering artifact.
  • Because the attack corrupts 99.999% of the poisoning sample, the detector's 98% accuracy may partly reflect how easy near-total corruption is to spot; a sparser attack (e.g., 10-20% poisoned records) would test detection limits more fairly.
  • The reduced 5,029-record subset is about 24% of the test portion, and the paper does not describe how that subset is distributed across feature space; comparing the feature distributions of the removed and remaining records would show whether the recovery is a selection effect.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies adversarial attacks on a linear regression model that predicts pathloss in a simulated 5G/DeepMIMO scenario. The authors generate a dataset with the DeepMIMO emulator, apply a Fast Gradient Sign Method (FGSM) attack with varying perturbation sizes and poisoned fractions, train LightGBM, CatBoost, and XGBoost classifiers to detect poisoned records, and report that filtering detected records with LightGBM restores the regression metrics to their original values. The main claimed results are that an FGSM attack with parameter epsilon = 1e-10 and poisoned fraction 0.99999 increases MSE by about 33% and decreases R2 by about 10%, and that LightGBM detects adversarial anomalies with 98% accuracy, allowing the regression metrics to be restored (MSE 37.55, R2 0.80).

Significance. If the results were supported, the paper would provide a useful empirical data point on the vulnerability of regression models in wireless-network settings and a practical comparison of gradient-boosting detectors for tabular adversarial examples. Credit is due for using a public dataset (DeepMIMO), reporting detector hyperparameters, and comparing three classifiers. However, the central claim of metric restoration is not supported by the experimental protocol, and the internal inconsistency about the most vulnerable epsilon value further weakens confidence. The topic is relevant, but the contribution as presented is primarily an engineering report with a flawed evaluation design.

major comments (3)
  1. [Section VI, Table 2] The Secured Model row in Table 2 is evaluated on a reduced 5,029-record subset, while the Undefended and Attacked rows are evaluated on the full test set. The paper states: 'we will remove detected adversarial examples from the data set and obtain a reduced data set of 5029 records, on which we will re-evaluate the quality of the regression model.' This makes the comparison invalid: lower MSE and higher R2 on a smaller subset can be a pure selection effect, not a property of the defense. The claim that the metrics are 'restored to their original values' is load-bearing and unsupported. All three scenarios must be evaluated on identical data (either the full test set or the same filtered subset) before any restoration claim can be made.
  2. [Section VI, Fig. 3 and Conclusion] There is an internal inconsistency in the epsilon parameter claim. The text says 'a value of ε = 1-7 and higher leads to a sharp increase in the values of the MSE metric and a decrease in the values of the R2 metric, which is inappropriate,' but the conclusion states that the model is 'most vulnerable' to ε = 1-10 (i.e., 1e-10), the smallest perturbation listed. These statements contradict each other. Additionally, the notation '1-10', '1-9', '1-8', '1-7' is ambiguous; it should be expressed as powers of ten (e.g., 10^-10), and the axes of Fig. 3 should be labeled unambiguously.
  3. [Section VI, Scenario 2] The attack is described as 'poisoning source data for training based on generative adversarial networks,' but the actual method is FGSM, and it is unclear whether the poisoned samples are injected into the training set or the test set. If this is a poisoning attack, the Secured Model scenario must retrain the linear regression on cleaned training data and evaluate on an untouched test set. If it is an evasion attack on the test set, then removing flagged records from the test set is not a countermeasure but a redefinition of the evaluation set. The manuscript never states whether the regression model was retrained, which is essential for interpreting the Secured Model result.
minor comments (5)
  1. [Abstract and Section I] The abstract contains the typo 'advertorial attack' instead of 'adversarial attack.'
  2. [Section IV and Section VI] The paper refers to 'the data set obtained in Section 2' and describes the organization as 'second chapter,' 'fourth chapter,' 'sixth chapter,' and 'seven chapter'; these references should use the actual section numbers.
  3. [Table I] The CatBoost hyperparameter row contains the typo "depth'=4"; it should read 'depth=4'.
  4. [Section VI] The paper claims that the trained neural network is 'a neural network with one linear layer and without an activation function,' but it is never explained why this is equivalent to the linear regression beyond the initialization step; the description of steps 1.1–1.4 should be clarified.
  5. [General] The abstract and conclusion state that 'rapid analysis of network traffic' enables detecting malicious activity, but no timing or throughput experiments are reported; this claim goes beyond the presented evidence.

Circularity Check

1 steps flagged · score 6.0 of 10

Restoration claim in Table 2 reduces to re-evaluation on a filtered subset; the Secured Model metrics are not comparable to full-test-set baselines.

  1. fitted input called prediction [Section VI, Secured Model scenario and Table 2]
    "Based on the results of the classifier’s work on the test data, we will remove detected adversarial examples from the data set and obtain a reduced data set of 5029 records, on which we will re-evaluate the quality of the regression model. ... The LightGBM binary classifier ... successfully detects records with adversarial anomalies in tabular data with an accuracy of 98%, the isolation of which allows us to restore the regression model metrics to their original values."

    The Secured Model row (MSE 37.55, R2 0.80) is computed on the 5,029-record subset left after the LightGBM filter, while the Undefended and Attacked rows are computed on the full test split. The classifier was fitted to label normal vs poisoned data, so removing its flagged records leaves exactly the records it considers normal. Re-evaluating the (unretrained) regression model on that subset is a selection effect: any accurate detector will, by construction, leave a subset on which the attack-induced error is largely absent. The claimed 'restoration to original values' is therefore forced by the filtering procedure and the changed evaluation set, not by a demonstrated defense.

full rationale

The FGSM attack construction and classifier training are self-contained against external references and do not rest on self-citation, so the non-defense parts of the paper are not circular. The circularity is concentrated in the defense-evaluation claim: Table 2 compares metrics on different record sets, and the Secured Model numbers are the error of the same regressor on the complement of the detector's flagged set. Because the detector was trained to recognize the very poisoned records introduced by the attack, the remaining subset is, by construction, the low-error part of the data; lower MSE and recovered R2 are a direct consequence of subset selection. This makes the central 'restoration' claim definitionally tied to the filtering step rather than an independent empirical result. Separately, the paper's internal inconsistency about which epsilon is 'most vulnerable' (Fig. 3 text vs. the conclusion) is a correctness concern but not a circularity issue. No self-citation chain is load-bearing.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claims rest on three kinds of imported assumptions: (a) the FGSM equation (Eq. 1) transfers from an evasion recipe to a training-data poisoning effect of the claimed size, (b) the three scenarios in Table 2 are comparable even though the Secured Model is scored on a differently filtered subset, and (c) the DeepMIMO emulator output is treated as representative of 5G network behavior. The free parameters that the headline numbers depend on are the attack settings (epsilon and fract) and the GridSearchCV-selected classifier hyperparameters. No invented entities are introduced.

free parameters (3)
  • FGSM perturbation magnitude epsilon = 1e-10, written '1-10' in the paper
    Chosen as the 'most vulnerable' configuration after scanning [1e-10, 1e-9, 1e-8, 1e-7]; the 33% MSE / 10% R2 headline depends on this value, and the Fig. 3 text contradicts which value is effective.
  • Poisoned fraction fract = 0.99999
    The fraction of the attack sample perturbed in the reported configuration; near-total poisoning is required for the reported effect.
  • LightGBM hyperparameters = max_depth=20, n_estimators=500, num_leaves=20, subsample=0.7
    Selected via GridSearchCV in Section VI; the 98% detection accuracy is reported only for this fitted configuration.
assumptions (4)
  • standard math FGSM perturbation x' = epsilon * sign(gradient of J with respect to x) maximizes the model's loss to first order (Eq. 1).
    Section III-A states Eq. (1) without derivation or citation; this is the standard FGSM result, assumed as background.
  • domain assumption Perturbing training inputs with the clean model's loss gradient produces a poisoned training set that degrades a retrained linear model by the claimed amounts.
    Section VI Scenario 2 treats FGSM, originally an evasion recipe, as a poisoning tool; the transfer and the reported effect size at epsilon=1e-10 are assumed without scale analysis.
  • domain assumption The three scenarios in Table 2 are comparable despite the Secured Model being evaluated on a filtered 5,029-record subset.
    Section VI applies the metrics protocol to a re-evaluation on the reduced set; the comparability premise fails as stated because the subset is not the full test set.
  • domain assumption DeepMIMO ray-tracing output for the Boston5G_28 scenario is representative of real 5G mmWave network behavior.
    Sections IV-V use the emulator as the sole data source, yet the conclusions are phrased for 5G and 6G networks; no real-network validation is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Analysis of the vulnerability of machine learning regression models to adversarial attacks using data from 5G wireless networks." pith.science (2026). https://pith.science/paper/4UEGT6JP

@misc{pith2026250500487,
  author       = {Pith},
  title        = {Pith review of: Analysis of the vulnerability of machine learning regression models to adversarial attacks using data from 5G wireless networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4UEGT6JP}},
  note         = {Machine review of arXiv:2505.00487}
}
read the original abstract

This article describes the process of creating a script and conducting an analytical study of a dataset using the DeepMIMO emulator. An advertorial attack was carried out using the FGSM method to maximize the gradient. A comparison is made of the effectiveness of binary classifiers in the task of detecting distorted data. The dynamics of changes in the quality indicators of the regression model were analyzed in conditions without adversarial attacks, during an adversarial attack and when the distorted data was isolated. It is shown that an adversarial FGSM attack with gradient maximization leads to an increase in the value of the MSE metric by 33% and a decrease in the R2 indicator by 10% on average. The LightGBM binary classifier effectively identifies data with adversarial anomalies with 98% accuracy. Regression machine learning models are susceptible to adversarial attacks, but rapid analysis of network traffic and data transmitted over the network makes it possible to identify malicious activity

Figures

Figures reproduced from arXiv: 2505.00487 by the authors.

Figure 1
Figure 1. Histograms of the distribution of the Pathloss feature depending on the user’s distance to the base station (a) and depending on the signal arrival time (b), fragment of the correlation matrix (c). From Figures 1(a) and 1(b), we can visually identify three peaks of high signal loss depending on the distance of the user to the base station and depending on the signal arrival time [PITH_FULL_IMAGE:figures/full_fig_p0… view at source ↗
Figure 2
Figure 2. Fragment of the test data set in various scenarios: (a) – trained linear regression model, (b) – FGSM attack with gradient sign fluctuation, (c) – FGSM attack with gradient sign maximization, (d) – FGSM attack. The current study examines three main scenarios for investigating adversarial attacks on tabular data: 1. Scenario for training a regression model without third￾party interventions (Undefended Model). Let's t… view at source ↗
Figure 3
Figure 3. shows the dependence of quality metrics on the size ε of the neighborhood for the trained linear regression model. A value of ε = 1-7 and higher leads to a sharp increase in the values of the MSE metric and a decrease in the values of the R2 metric, which is inappropriate when conducting an adversarial attack, because a very strong model deviation will be considered an outlier or an anomaly in the data [PITH_FULL_I… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

12 extracted references · 10 canonical work pages

  1. [1]

    An adversarial attacker for neural networks in regression problems,

    K. Gupta, B. Pesquet -Popescu, F. Kaakai, J.C. Pesquet, and F.D. Malliaros, “An adversarial attacker for neural networks in regression problems,” IJCAI Workshop on Artificial Intelligence Safety (AI Safety), 2021

    work page 2021

  2. [2]

    Overparameterized linear regression under adversarial attacks,

    A.H. Ribeiro and T.B. Schön, “ Overparameterized linear regression under adversarial attacks,” IEEE Transactions on Signal Processing, , vol. 71, pp. 601–614, 2023

    work page 2023

  3. [3]

    On the adversarial robustness of linear regression,

    F. Li, L. Lai and S. Cui, “ On the adversarial robustness of linear regression,” 2020 IEEE 30th International Workshop on Machine Learning for Signal Processing (MLSP), pp. 1-6, 2020

    work page 2020

  4. [4]

    Adversarial examples in deep learning for multivariate time series regression ,

    G.R. Mode and K.A. Hoque , “ Adversarial examples in deep learning for multivariate time series regression ,” 2020 IEEE Applied Imagery Pattern Recognition Workshop (AIPR), pp. 1-10, 2020

    work page 2020

  5. [5]

    Adversarial Attacks on Regression Systems via Gradient Optimization ,

    Kong X. and Ge Z., “ Adversarial Attacks on Regression Systems via Gradient Optimization ,” IEEE Transactions on Systems, Man, and Cybernetics: Systems, 2023

    work page 2023

  6. [6]

    White-box target at tack for EEG -based BCI regression problems ,

    L. Meng, C.T. Lin, T.P. Jung , and D.Wu , “White-box target at tack for EEG -based BCI regression problems ,” Neural Information Processing: 26th International Conference , Part I 26, pp. 476 –488, 2019

    work page 2019

  7. [7]

    Detecting and mitigating adversarial examples in regression tasks: A photovoltaic power generation forecasting case study ,

    E.J. Santana, R. P. Silva, B.B. Zarpelão and S. Barbon Junior, “Detecting and mitigating adversarial examples in regression tasks: A photovoltaic power generation forecasting case study ,” Information, vol. 12, pp 394, 2021

    work page 2021

  8. [8]

    Perturbation analysis of learning algorithms: Generation of adversarial examples from classification to regression,

    E.R. Balda, A. Behboodi and R. Mathar, “ Perturbation analysis of learning algorithms: Generation of adversarial examples from classification to regression,” IEEE Transactions on Signal Processing, vol. 67, pp. 6078–6091, 2019

    work page 2019

Show all 12 references
  1. [9]

    Robust nonparametric regression under poisoning attack,

    P. Zhao and Z.Wan, “ Robust nonparametric regression under poisoning attack,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, pp. 17007–17015, 2024

    2024

  2. [10]

    An analysis of adversarial attacks and defenses on autonomous driving models,

    Y. Deng, X. Zheng, T. Zhang, C. Chen, G. Lou, and M. Kim , “An analysis of adversarial attacks and defenses on autonomous driving models,” 2020 IEEE international conference on pervasive computing and communications (PerCom), pp. 1-10, 2020

    2020

  3. [11]

    Imperceptible adversarial attacks on tabular data,

    V. Ballet, X. Renard, J. Aigrain, T. Laugel, P. Frossard and M. Detyniecki, “Imperceptible adversarial attacks on tabular data,” arXiv preprint arXiv:1911.03274. – 2019. DOI: https://doi.org/ 10.48550/arXiv.1911.03274

    1911 doi arXiv

  4. [12]

    DeepMIMO: A generic deep learning dataset for millimeter wave and massive MIMO applications ,

    A. Alkhateeb , “ DeepMIMO: A generic deep learning dataset for millimeter wave and massive MIMO applications ,” arXiv preprint arXiv:1902.06435. – 2019. DOI: https://doi.org/10.48550/arXiv.1902.06435

    1902 doi arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.