PairWatch: Pair-Aware Anomaly Transformer for Detecting Adversarial Rendezvous in Public Satellite Catalogs

arXiv:2610.39679v1 [cs.CR] 29 Oct 2026

PairWatch: Pair-Aware Anomaly Transformer for Detecting Adversarial Rendezvous in Public Satellite Catalogs Young Eun Kwon

Ji Won Yoon

equation@korea.ac.kr Korea University Seoul, Republic of Korea

jiwon_yoon@korea.ac.kr Korea University Seoul, Republic of Korea

Abstract

1

Documented adversarial rendezvous and proximity operations (RPO) appear in the public TLE catalog, yet existing TLE-based maneuver detectors treat each satellite in isolation—mistaking routine stationkeeping for adversarial behavior and missing RPO entirely when the target stays passive. We argue that the right unit is the satellite pair and the right inductive bias is the kinematic symmetry between approach and recede. We instantiate both with PairWatch, a pairaware AnomalyTransformer whose attention prior is augmented with a sign-symmetric geometric similarity over relative-motion features, and release an open benchmark of 359 windows from public Space-Track data spanning 11 documented RPO events, 100 Clohessy–Wiltshire synthetic adversarial windows, and a five-class hard-negative set culminating in the TerraSAR-X / TanDEM-X helix formation. Under the deployment-relevant criterion of a single threshold separating real RPO from operational negatives—a necessary property for catalog-scale screening—PairWatch is the only model that succeeds, with the property holding in 100% of bootstrap resamples versus 0–19.5% for three neural baselines and under 0.1% for four physics-informed detectors. A per-source analysis exposes a shortcut-learning failure mode of single-number AUROC: simpler baselines attain higher overall AUROC by shortcutting a syntheticvs-formation contrast with no operational meaning; removing this single cell flips the test ranking entirely (LSTM-AD), and these baselines fail the security-relevant task the benchmark was built to measure.

Public Two-Line Element (TLE) catalogs maintained by the US 18th Space Defense Squadron are the only globally observable record of the motion of every active satellite, and one of the few remaining open primary sources of space situational awareness. Mining these streams for security-relevant events—not collision risk alone—has gained urgency as documented adversarial proximity operations enter the open record [4, 12]: Russia’s Cosmos 2542/2543 shadowed the US national-security payload USA 245 in 2019–20, with analogous inspector triplets and the more recent Cosmos 2558 / USA 326 pairing following similar patterns [14, 17]. These events are not anomalies to be discovered after the fact—they are an existing operational reality that public catalogs already record, if a detector knows where to look. Existing TLE-based detection looks in the wrong place. The astrodynamics literature treats each satellite as an independent time series [8] and reduces detection to a single binary outcome— maneuver or no maneuver—on that satellite alone. For rendezvous and proximity operations (RPO), this framing fails by construction. The defining feature is the relative motion between an active attacker and an often-passive target, so a routine station-keeping burn on the target is, in single-satellite view, indistinguishable from no event. A single-satellite Isolation Forest on mean-element residuals [10] confirms this, scoring documented real RPO at AUROC 0.228— well below chance. Generic multivariate anomaly detectors applied to pairwise features [1, 13] do better but on the wrong subset, distinguishing synthetic RPO from synthetic hard negatives—a contrast with no operational meaning—while consistently confusing real RPO with routine station-keeping and constellation co-orbiting. The right unit of analysis is the satellite pair, and the right inductive bias is the kinematic symmetry that defines an RPO trajectory: a deliberate approach followed by a deliberate recede, linked by a closest approach where relative velocity is at its characteristic minimum. We address both points with three contributions. (1) PairWatch, a pair-aware AnomalyTransformer whose temporal prior is augmented with a sign-symmetric geometric similarity over pair-kinematic features; the sign-symmetric design halves the across-seed standard deviation of the naive formulation (0.019 to 0.009) without performance cost. (2) An open RPO benchmark: 359 windows from public Space-Track TLE combining 11 documented real adversarial events, 100 Clohessy–Wiltshire synthetic adversarial windows, and a fiveclass hard-negative set culminating in the TerraSAR-X / TanDEMX helix formation (120-meter closest approach). (3) A per-source analysis revealing a shortcut-learning [5] failure mode of singlenumber AUROC: PairWatch is the only model admitting a single threshold separating real RPO from operational negatives, while

CCS Concepts • Security and privacy → Intrusion/anomaly detection and malware mitigation; • Computing methodologies → Neural networks; Unsupervised learning; • Applied computing → Aerospace.

Keywords Anomaly Detection, Satellite Security, Shortcut Learning, Rendezvous and Proximity Operations, Two-Line Element Catalog ACM Reference Format: Young Eun Kwon and Ji Won Yoon. 2026. PairWatch: Pair-Aware Anomaly Transformer for Detecting Adversarial Rendezvous in Public Satellite Catalogs. In Proceedings of the 35th ACM International Conference on Information and Knowledge Management (CIKM ’26), November 07–11, 2026, Rome, Italy. ACM, New York, NY, USA, 5 pages. https://doi.org/10.1145/3799682.3839977

This work is licensed under a Creative Commons Attribution 4.0 International License. CIKM ’26, Rome, Italy © 2026 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-2539-5/2026/11 https://doi.org/10.1145/3799682.3839977

Introduction

CIKM ’26, November 07–11, 2026, Rome, Italy

Young Eun Kwon & Ji Won Yoon

simpler baselines attain higher overall AUROC by shortcutting a synthetic-vs-formation contrast with no operational meaning—a failure exposed only by per-source breakdown.

2 Methodology 2.1 Threat Model We consider an adversary that operates a maneuverable satellite 𝐴 to achieve sustained close proximity with a target satellite 𝑇 that it does not own, for purposes of signals intelligence or political signaling. The defender observes only public TLE streams; the adversary cannot suppress independent radar tracking that produces these elements. Given the TLE histories T𝐴 and T𝑇 over a fixed analysis window 𝑊 , the detector outputs a score 𝑠 (𝐴,𝑇 ,𝑊 ) ∈ [0, 1] that estimates the probability that 𝐴 is conducting adversarial rendezvous and proximity operations toward 𝑇 within 𝑊 . Catalog-scale scoring follows the standard top-𝑘 reduction 𝑠 (𝑇 ,𝑊 ) = max𝐴∈topk(𝑇 ) 𝑠 (𝐴,𝑇 ,𝑊 ), but in this paper we focus on the single-pair task.

2.2

Pair Feature Vector

For each pair (𝐴,𝑇 ) we propagate both satellites with SGP4 [16] at hourly resolution over a 14-day window (SEQ_LEN = 336), and at each timestep 𝑡 extract a four-channel pair feature vector  ⊤ 𝑔𝑡 = 𝑟 (𝑡), 𝑟¤ (𝑡), ∥® 𝑣 𝐴 − 𝑣®𝑇 ∥, 𝜃 (𝑡) of inertial range, range rate, relative speed, and orbital-plane alignment angle. We report all numbers in a rate-only setting in which absolute range 𝑟 is withheld, leaving the three rate channels. Two reasons motivate this. First, the benchmark itself defeats range as a shortcut: the median real-RPO range in our positives exceeds the TanDEMX closest approach and is comparable to the GRACE-FO geodesy pair [6]. Second, an adversary controls its standoff distance and can dwell at constellation-like separations before closing, so any range-thresholded detector either misses the dwell phase or fires on every close-flying constellation pair. Rate-based detection captures adversarial intent in the kinematic transition, the operationally robust regime our prior targets. Features are z-scored per channel using training-split statistics; SGP4 propagation at uniform hourly timestamps gives consistent A–T epoch alignment without imputation or outlier removal, the 14-day window being short enough that propagation error remains bounded.

2.3

PairWatch Architecture

PairWatch builds on the AnomalyTransformer encoder, which maintains at each token both a series association 𝐴𝑡,𝑡 ′ (learned selfattention) and a prior association 𝑃𝑡,𝑡 ′ , and uses the minimax discrepancy between the two as an anomaly criterion at inference, weighted by the per-token reconstruction error [18]. Vanilla Anoma(vanilla) lyTransformer fixes the prior to a purely temporal Gaussian, 𝑃𝑡,𝑡 ∝ ′ ′ 2 2 exp(−(𝑡 − 𝑡 ) /𝜎𝑡 ), which ignores the kinematic structure that defines RPO. We augment it with a geometric term,   ′ )2 ∥𝑔˜𝑡 −𝑔˜𝑡 ′ ∥ 2 𝑃𝑡,𝑡 ′ ∝ exp − (𝑡 −𝑡 − 𝛼 , (1) 2 2 𝜎 𝛽 𝑡

𝑡

where 𝜎𝑡 is the temporal bandwidth inherited from vanilla AnomalyTransformer, 𝛽𝑡 = softplus(𝑤⊤𝛽 𝑔˜𝑡 ) is a per-token geometric bandwidth from a learned projection 𝑤 𝛽 ∈ R2𝐹 , and 𝛼 ∈ [0, 1] is a learned per-head scalar gate. The geometric term pulls into one attention neighborhood all timesteps with similar pair geometry even when temporally distant, capturing the kinematic symmetry between the approach and recede phases of an RPO event. The naive choice 𝑔˜𝑡 = 𝑔𝑡 would place kinematically symmetric states—e.g., range rates of −5 and +5 km/s—at maximal Euclidean distance. We instead use a mixed representation that concatenates the raw and absolute-value features,   𝑔˜𝑡 = 𝑔𝑡 ∥ |𝑔𝑡 | ∈ R2𝐹 , (2) used only inside the geometric prior. The model input and reconstruction target remain 𝑥𝑡 = 𝑔𝑡 ∈ R𝐹 (with 𝐹 = 3). The raw half preserves directional information; the absolute half merges approach/recede pairs into a single neighborhood. Following the AnomalyTransformer recipe, we train under a reconstruction objective regularized toward the prior, L = ∥𝑥ˆ − 𝑥 ∥ 22 + 𝜆 KL(𝑃 ∥ 𝐴) with 𝜆 = 3, and at inference score each window by the Í softmin-weighted reconstruction error 𝑠 = 𝑡 softmax(−𝐷𝑡 ) ∥𝑥ˆ𝑡 − 𝑥𝑡 ∥ 22 , where 𝐷𝑡 is the layer-averaged symmetric KL between series and prior associations at token 𝑡. The architectural additions are cheap: ∥𝑔˜𝑡 −𝑔˜𝑡 ′ ∥ 2 adds O (𝑇 2 𝐹 ) to attention, and the new parameters total 64 across the 2-layer, 4-head encoder. End-to-end inference costs 5 ms per window, well within real-time catalog monitoring budgets.

2.4

Benchmark Construction

We construct an open RPO benchmark with real and synthetic positives and two negative regimes. As real positives we identify 11 documented close-approach episodes between Russian inspector satellites Cosmos 2542/2543 (2019–20) and Cosmos 2519/2521/2523 (2017–19) [14]. As synthetic positives we sample those kinematics into Clohessy–Wiltshire trajectories [2] around four real targets in two orbital regimes (Cosmos at 97–98◦ , Starlink at 53◦ ), yielding 100 synthetic adversarial windows. The negatives are split across two regimes designed to defeat range-based shortcut detectors. As hard negatives we form clean but close-flying pairs at separations from kilometers to meters: Starlink in-plane neighbors (∼6,900 km), the A-Train Aqua/Aura formation (∼3,200 km), Iridium-110/162 in intersecting planes (∼10,400 km median, ∼30 km crossings), the GRACE-FO 1/2 geodesy pair (∼205 km), and the TerraSAR-X / TanDEM-X helix-formation InSAR pair at ∼120 m closest approach [7]—closer than most real RPO events and, at the level of relative motion alone, kinematically indistinguishable from adversarial proximity. As routine-maneuver negatives we add 54 station-keeping events from semi-major-axis residuals [8], paired with random non-RPO neighbors. All real RPO windows are forced into the test split as held-out evaluation. The full benchmark contains 359 windows; the test split has 186 (66 positive).

3 Evaluation 3.1 Experimental Setup All experiments use the open benchmark (359 windows; test split 186, of which 66 are positive: 11 real RPO and 55 synthetic). On the

PairWatch: Pair-Aware Anomaly Transformer for Satellites

same pair-feature input, we compare PairWatch against two classes of prior detectors, separated by whether the representation they score is learned or specified by hand. The first is the established neural state of the art for multivariate time-series anomaly detection. LSTM-AD [11] is the standard sequence-prediction model, TranAD [15] the current transformer reconstruction SOTA, and Vanilla AnomalyTransformer [18] our direct ablation target. The second comprises what an astrodynamics practitioner would reach for first; none of these has previously been evaluated on pairwise RPO detection. Isolation Forest on single-satellite mean-element residuals [10] is the maneuver-detection standard. A range-rate swing score is the classic operational heuristic, localizing the largest closingthen-receding transition. Clohessy–Wiltshire template matching correlates each window against an analytic bank of bounded relative orbits with V-shaped standoff profiles. DTW 1-NN scores a window by its band-limited multivariate distance to the nearest train-split normal. A one-class SVM fits 11 engineered pair descriptors covering rate excursions, sign changes, closest-approach depth, plane stability, and spectral concentration. The range-rate, template, DTW, and one-class detectors are deterministic and need no seed averaging; the two that are fitted see only the train split, which contains negatives alone. Graph-based catalog detectors and astrodynamics conjunction analyses lie outside this single-pair scope. Neural methods use 𝑑 model = 64, 4 heads, 2 layers, Adam (lr 10−3 ), batch size 8, 30 epochs, and 5 seeds on a single core of an Apple M4 CPU with PyTorch 2.8. We report seed-averaged per-window scores with 95% bootstrap CIs (1,000 resamples) and pairwise DeLong tests [3]. Primary metric is AUROC on test all and test rpo_real; secondary metrics are best-F1 and precision at 1% FPR. Beyond aggregate scores, we evaluate threshold-based separability—whether a single score threshold cleanly separates real-RPO windows from routine close-flying negatives—as the deployment-relevant criterion for catalog-scale screening, where per-pair threshold tuning is infeasible. Benchmark and code are released at https://github.com/ e9uation/PairWatch/ for full reproducibility.

3.2

Results

Table 1 reports three evaluation modes: AUROC over the full test split (test all), AUROC restricted to the 11 real-RPO windows (test rpo_real), and operational metrics that exclude the TanDEM-X formation. Bootstrap CIs span ±0.05 around each AUROC point estimate, and PairWatch’s operational AUROC CI is degenerate at [1.000, 1.000]. Single-satellite Isolation Forest scores documented real RPO well below chance (test rpo_real 0.228, operational 0.175) yet reaches 0.600 on test all—picking up the synthetic-RPO subset where the target itself maneuvers, while missing real RPO where the target is passive. AUROC comparison. Paired DeLong tests show PairWatch significantly outperforms Vanilla AnomalyTransformer (𝑝 = 0.002) and TranAD (𝑝 = 0.008) on the broader test split, and LSTM-AD on both test rpo_real (𝑝 = 0.030) and the operational subset (𝑝 = 0.020). Against TranAD and Vanilla AT on the security-relevant subsets, however, PairWatch is not statistically distinguishable (test rpo_real 𝑝 = 0.369, 0.093; operational 𝑝 = 0.299, 0.131) under the 11-window real-RPO sample. We read this as AUROC alone failing to rank the three transformer detectors at this sample size.

CIKM ’26, November 07–11, 2026, Rome, Italy

AUROC Method

Operational subset

all

rpo_real

AUROC

F1

P@1%FPR

Physics-informed / classical IF (single-sat) 0.600 Range-rate swing 0.529 CW template 0.760 DTW 1-NN 0.812 OC-SVM (pair feats) 0.746

0.228 0.380 0.657 0.693 0.746

0.175 0.286 0.704 0.775 0.793

0.212 0.224 0.706 0.385 0.393

0.000 0.000 0.857 0.667 0.244

Neural LSTM-AD Vanilla AT TranAD PairWatch

0.810 0.848 0.861 0.874

0.906 0.968 0.983 1.000

0.640 0.818 0.909 1.000

0.000 0.875 0.909 0.917

0.957 0.862 0.866 0.885

Table 1: Main results on the rate-only benchmark; the operational subset excludes the TanDEM-X formation negatives. Neural results are means of per-window scores over 5 seeds, with 95% bootstrap CIs.

Threshold-separation comparison. A categorical comparison does separate them. PairWatch is the only neural detector for which every real-RPO score lies above every operational-negative score (separation gap +0.010), while TranAD (−0.005), LSTM-AD (−0.043), and Vanilla AT (−0.112) all leave score overlap. This yields operational AUROC 1.000, best-F1 1.000, and P@1%FPR 0.917, strictly above the next-best baseline (TranAD: 0.983 / 0.909 / 0.909). Bootstrap resampling of the 11 real-RPO positives and 82 operational negatives (1,000 iterations) confirms the property is not a smallsample artifact: PairWatch’s positive gap holds in 100% of resamples, against 19.5% for TranAD, 2.3% for Vanilla AT, and 0% for LSTMAD. PairWatch is thus the only model admitting a single threshold that separates real RPO from operational negatives—a deploymentrelevant property orthogonal to the AUROC comparison. Physics-informed comparison. No classical pairwise detector approaches the neural family in aggregate on this benchmark. The range-rate swing score falls below chance on real RPO (0.380, operational 0.286), and the per-source view shows why: an inspector matches its target’s orbit, so a real RPO window contains a smaller range-rate excursion than almost any negative, and the contrast inverts to 0.00 against routine maneuvers and 0.05 against clean co-orbits. Inverting the sign does not repair it, since the same flip turns the 0.61 against Starlink neighbors—whose in-plane geometry produces excursions as small as an inspector’s—into 0.39. This is the same structural failure that puts single-satellite Isolation Forest at 0.228. CW template matching (0.657) and DTW 1-NN (0.693) recover part of the signal but neither reaches the weakest neural detector on the operational subset, and under the same bootstrap protocol none of the four admits a separating threshold in more than 0.1% of resamples. The one-class SVM is instructive in a different way: it is the only detector whose overall and real-RPO AUROC coincide (0.746 / 0.746), because hand-engineered kinematic descriptors cannot absorb the simulator’s distributional fingerprint. Avoiding the simulator shortcut identified below is therefore achievable with feature engineering, but at the cost of the separation the operational task requires.

CIKM ’26, November 07–11, 2026, Rome, Italy

Young Eun Kwon & Ji Won Yoon

LSTM-AD’s headline lead on test all (0.957) sits alongside its ranklast position on real RPO and zero P@1%FPR on the operational subset—a contradiction the per-source analysis below attributes to a single synthetic-versus-synthetic contrast.

3.3

Per-Source Breakdown

To isolate where the AUROC margin on the broader test split comes from, Table 2 reports binary AUROCs for each (positive source, negative source) pair. LSTM-AD

TranAD

Van. AT

PW

clean routine_man. starlink formation_fly.

0.92 0.82 0.95 0.60

0.99 1.00 0.97 0.60

0.98 1.00 0.94 0.59

1.00 1.00 1.00 0.60

clean routine_man. starlink formation_fly.

1.00 0.96 1.00 0.98

1.00 1.00 1.00 0.58

1.00 1.00 1.00 0.58

1.00 1.00 1.00 0.64

pos

neg

real real real real synth synth synth synth

Table 2: Per-source AUROC breakdown on test (5 seeds, mean scores). Rows within the rpo_real block correspond to the security-relevant question: whether the model can tell a real RPO from this type of routine close-flying.

0.58–0.73, so LSTM-AD’s 0.98 is unique among all nine methods rather than characteristic of learned detectors. The one-class SVM is the limiting case, scoring identically on the real and synthetic rows of every negative source (0.92, 0.98, 0.60, 0.64): hand-engineered kinematic descriptors cannot represent the simulator’s fingerprint at all.

3.4

3.5 PairWatch reaches a perfect 1.00 on every realistic operational contrast—real RPO against clean co-orbits, routine maneuvers, and Starlink neighbors—while TranAD and Vanilla AT lose at most 0.06 and LSTM-AD loses 0.05–0.18; the gap against LSTM-AD on real RPO vs. routine maneuvers (0.82 vs. 1.00) implies roughly one alarm per five station-keeping burns at deployment. All methods score near chance (∼0.60) against TanDEM-X, whose sign-symmetric kinematic signature mirrors an adversarial approach. PairWatch’s 1.00 on operational contrasts and its chance score on TanDEM-X share this same mechanism. The prior amplifies the sign-symmetric signature shared by RPO and helix formations but absent in clean, routine, and constellation pairs—so the 1.00 reflects inductive-bias matching, not a small-sample artifact. LSTM-AD’s apparent test-all lead comes entirely from one auxiliary cell—synthetic RPO vs. synthetic formation-flying (0.98 vs. 0.58 for the AT family)—a contrast between two simulator distributions with no operational meaning. Removing it flips the ranking entirely. LSTM-AD falls from 1st (0.957) to last (0.949), PairWatch becomes 1st (0.972). This is shortcut learning [5]. LSTM-AD learns the simulator’s distributional fingerprint rather than the operational concept of adversarial proximity, losing every contrast in which both sides are real catalog motion. PairWatch, trained on the same simulator-augmented data, transfers to real RPO with perfect operational separation—an inductive-bias rather than data-access distinction. Any benchmark mixing synthetic positives with real negatives admits this shortcut; per-source breakdown is the minimum reporting needed to distinguish solving the operational task from solving the simulator. The same decomposition over the non-neural detectors confirms the diagnosis. On the synthetic-versus-formation cell they score

Cross-Actor Evidence

The 11 real-RPO positives come from a single actor (Russian inspector pairs). As a direct cross-actor probe, we apply the trained PairWatch model—without retraining or threshold recalibration— to the Shijian-21 close-approach with a defunct BeiDou satellite [9, 14], which we identify via Space-Track satcat as the Shijian-21 / BeiDou-2 G2 pair (NORAD 49330 / 34779). SGP4 propagation yields a 0.91 km minimum range at 2022-01-22, consistent with the published docking timeline. Under the same 5-seed protocol, PairWatch ranks the event above 89% of test scores, placing it 8/11 within the Russian real-RPO distribution, above both the operational-negative maximum and the Russian RPO median—the only model in our study to clear both. LSTM-AD does not fire, and TranAD and Vanilla AT rank it 5/11 within their respective RPO distributions. A prior calibrated on Russian inspector pairs in LEO thus transfers, without adaptation, to a Chinese close-proximity operation in GEO. We report this as 𝑛 = 1 evidence rather than a benchmark addition.

Ablation

Table 3 dissects the PairWatch design across five training seeds. Removing the geometric prior (temporal-only, equivalent to Vanilla AnomalyTransformer) drops test AUROC by 0.013 on test all and 0.016 on test rpo_real. Among similarity choices, the proposed mixed variant (𝑔˜ = [𝑔∥|𝑔|]) halves the across-seed standard deviation of raw similarity (0.019 to 0.009) at no measurable performance cost. Channel ablation confirms relative speed as the dominant pair-kinematic signal (drop of ∼0.10 with substantially higher variance), with range rate contributing a small additive signal (drop 0.024) and plane alignment essentially uninformative on the current benchmark. The absolute AUROC changes (0.013–0.024) are small but decisive for the operational separation: removing the geometric prior returns the model to Vanilla AT’s overlap regime (gap −0.112), and no ablated variant preserves the threshold-based separation. Variant PairWatch full (mixed) w/o geom prior (vanilla AT) geom sim = raw geom sim = abs only w/o rel_speed channel w/o range_rate channel w/o plane_angle channel

test all

test rpo_real

0.882±.009 0.869±.002 0.893±.019 0.868±.002 0.787±.080 0.858±.020 0.893±.018

0.888±.016 0.872±.005 0.884±.009 0.866±.004 0.745±.048 0.856±.045 0.889±.015

Table 3: Table 1 averages scores across seeds before computing a single AUROC, whereas values here are AUROCs computed per seed and then averaged. The two orders shift PairWatch from 0.885/0.874 to 0.882/0.888. Comparisons are like-for-like only within each table.

PairWatch: Pair-Aware Anomaly Transformer for Satellites

3.6

CIKM ’26, November 07–11, 2026, Rome, Italy

Acknowledgments

Computational Cost

Table 4 reports parameter counts and wall-clock latencies. PairWatch adds 64 parameters (a softplus projection and a sigmoidgated scalar 𝛼 over four heads and two layers) and ∼80% inference overhead over Vanilla AT in exchange for the AUROC gain above. A catalog-scale scan of ∼6,000 LEO objects against top-10 neighbors completes in ∼5 min per snapshot, within TLE update cadence. Only PairWatch admits a deployment threshold across these 60,000 windows that fires zero false alarms at full real-RPO recall; baseline overlaps (0.005–0.112) translate directly to per-pair analyst review.

Method

Parameters

s/epoch

ms/window

LSTM-AD TranAD Vanilla AT PairWatch

17,859 121,923 122,443 122,507

0.18 0.41 0.69 0.89

2.9 1.3 2.9 5.2

Table 4: Parameters and runtime (mean over 10 epochs after 5-epoch warm-up, single CPU core).

3.7

Limitations

There are three matters for honest interpretation. First, against the TerraSAR-X / TanDEM-X helix formation (∼2 km median range, 0.12 km closest approach), every method we tested degrades to near chance (AUROC ∼0.60). The reason is structural rather than a modeling gap: the helix maintains a quasi-periodic relative orbit where range rate crosses zero twice per orbit with sign-symmetric closing and receding phases—precisely the signature our prior amplifies and the same a deliberate inspection produces. At TLE resolution, the only separating feature would be mission intent, absent from the kinematic stream. Second, the cross-actor probe covers a single Chinese event; benchmark-scale evaluation across additional Chinese (SJ-12 / SJ-06F) and commercial (MEV-1 / Intelsat-901) RPO events remains to be conducted. Third, the Clohessy–Wiltshire trajectories in training cover sustained co-orbiting inspection patterns but not one-shot flybys with sharp closing-then-receding profiles, and the single-simulator reliance calls for cross-simulator evaluation as new events enter the public record.

4

Conclusion

We have shown that adversarial RPO on public TLE data can be detected reliably by modeling the satellite pair and biasing attention toward the kinematic symmetry of an RPO trajectory. PairWatch’s geometric prior with sign-symmetric similarity is the only model that admits a single threshold separating real RPO from operational negatives, with operational AUROC 1.000 against clean co-orbits, routine station-keeping, and constellation operations, and a positive separation gap of +0.010. On the security-relevant subsets the AUROC comparison against the transformer baselines is statistically inconclusive under the 11-window real-RPO sample; the central claim is the categorical separation property, which holds in 100% of bootstrap resamples versus 0–19.5% for the baselines and is unique to PairWatch.

This work was supported by Korea Research Institute for defense Technology planning and advancement(KRIT) grant funded by the Korea government(Defense Acquisition Program Administration), (KRIT-CT-24-001, Defense Space Security Research Lab, 2024).

References [1] Julien Audibert, Pietro Michiardi, Frédéric Guyard, Sébastien Marti, and Maria A Zuluaga. 2020. USAD: Unsupervised anomaly detection on multivariate time series. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining. 3395–3404. [2] WH Clohessy and RS Wiltshire. 1960. Terminal guidance system for satellite rendezvous. Journal of the aerospace sciences 27, 9 (1960), 653–658. [3] Elizabeth R DeLong, David M DeLong, and Daniel L Clarke-Pearson. 1988. Comparing the areas under two or more correlated receiver operating characteristic curves: a nonparametric approach. Biometrics (1988), 837–845. [4] Gregory Falco. 2020. When satellites attack: Satellite-to-satellite cyber attack, defense and resilience. In ASCEND 2020. American Institute of Aeronautics and Astronautics, Inc., 4014. [5] Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann. 2020. Shortcut learning in deep neural networks. Nature Machine Intelligence 2, 11 (2020), 665–673. [6] Richard P Kornfeld, Bradford W Arnold, Michael A Gross, Neil T Dahya, William M Klipstein, Peter F Gath, and Srinivas Bettadpur. 2019. GRACE-FO: the gravity recovery and climate experiment follow-on mission. Journal of spacecraft and rockets 56, 3 (2019), 931–951. [7] Gerhard Krieger, Alberto Moreira, Hauke Fiedler, Irena Hajnsek, Marian Werner, Marwan Younis, and Manfred Zink. 2007. TanDEM-X: A satellite formation for high-resolution SAR interferometry. IEEE transactions on geoscience and remote sensing 45, 11 (2007), 3317–3341. [8] Stijn Lemmens and Holger Krag. 2014. Two-line-elements-based maneuver detection methods for satellites in low earth orbit. Journal of Guidance, Control, and Dynamics 37, 3 (2014), 860–868. [9] HY Lin. 2023. BeiDou-G2: Past and Present. Acta Astronomica Sinica 64 (2023), 1. [10] Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. 2008. Isolation Forest. In 2008 Eighth IEEE International Conference on Data Mining. 413–422. doi:10.1109/ICDM. 2008.17 [11] Pankaj Malhotra, Lovekesh Vig, Gautam Shroff, and Puneet Agarwal. 2015. Long short term memory networks for anomaly detection in time series. In Proceedings of the European Symposium on Artificial Neural Networks, Computational Intelligence and Machine Learning (ESANN), Vol. 89. 94. [12] James Pavur and Ivan Martinovic. 2022. Building a launchpad for satellite cybersecurity research: lessons from 60 years of spaceflight. Journal of Cybersecurity 8, 1 (2022), tyac008. [13] Ya Su, Youjian Zhao, Chenhao Niu, Rong Liu, Wei Sun, and Dan Pei. 2019. Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining. 2828–2837. [14] Clayton Swope, Kari A. Bingen, Makena Young, and Kendra LaFave. 2025. Space Threat Assessment 2025. Technical Report. Center for Strategic and International Studies. https://aerospace.csis.org/space-threat-assessment-2025/ [15] Shreshth Tuli, Giuliano Casale, and Nicholas R. Jennings. 2022. TranAD: deep transformer networks for anomaly detection in multivariate time series data. Proc. VLDB Endow. 15, 6 (Feb. 2022), 1201–1214. doi:10.14778/3514061.3514067 [16] David Vallado, Paul Crawford, Ricahrd Hujsak, and Thomas Sean Kelso. 2006. Revisiting spacetrack report# 3. In AIAA/AAS astrodynamics specialist conference and exhibit. 6753. [17] Brian Weeden and Victoria Samson. 2022. Global Counterspace Capabilities Report. Technical Report. Secure World Foundation. https://swfound.org/counterspace/ [18] Jiehui Xu, Haixu Wu, Jianmin Wang, and Mingsheng Long. 2022. Anomaly Transformer: Time Series Anomaly Detection with Association Discrepancy. arXiv:2110.02642 [cs.LG] https://arxiv.org/abs/2110.02642

Related documents

• PairWatch: Pair-Aware Anomaly Transformer for Detecting Adversarial Rendezvous in Public Satellite Catalogs#1491074
• Adversarial Process Disturbances at a Deployable Alarm Budget: Detector Evaluation on a Simulator and a Real Plant#1489856
• Adversarial Process Disturbances at a Deployable Alarm Budget: Detector Evaluation on a Simulator and a Real Plant#1482930
• Can You Trust the Vectors in Your Vector Database? Black-Hole Attack from Embedding Space Defects#1403072
• Quantifying and Prioritizing Stealthy Source-Manipulation Threats Against Multi-Source Anomaly Detectors#1473539