Rigid-Covert GNSS Spoofing of UAV Swarms: A Structural Blind Spot, Its Detection Limit, and Absolute-Anchor Defenses

Rigid-Covert GNSS Spoofing of UAV Swarms: A Structural Blind Spot, Its Detection Limit, and Absolute-Anchor Defenses Minseok Park

Joon Soo Yoo∗

Jeonbuk National University Dept. of Electronic Engineering Jeonju, Republic of Korea yp1278kr@jbnu.ac.kr

Jeonbuk National University Dept. of Advanced Defense Technology and Industry Jeonju, Republic of Korea joonsooyoo@jbnu.ac.kr

arXiv:2608.06885v1 [cs.CR] 7 Aug 2026

Abstract Cooperative UAV-swarm defenses commonly cross-check GNSS positions against measured inter-drone geometry. We show that this relative-geometry channel has a structural blind spot: a common, slowly varying translation (a rigid-covert shift, RigidShift) preserves all pairwise distances and is therefore unobservable to any relative-only detector (a gauge-freedom argument). We validate this blindness on distance-verification and semidefinite-feasibility baselines, while explicitly distinguishing it from onboard inertial/GNSS monitors that can raise a bare alarm but cannot recover the swarm’s true position. To quantify when an external reference restores observability, we derive the drift-dependent detection floor 2𝛾/(1 − 𝑡𝑠 /𝑇 ) for a calibrated anchor-residual detector and empirically identify an additional detector-specific noise floor (measured slope 2.66 vs. predicted 2.67). We then present a centralized anchor-rooted recovery pipeline that reconstructs swarm geometry from inter-drone ranges, aligns it to a trusted-anchor subset with Byzantine-robust fitting, and recovers the absolute positions of non-anchored drones. A segmented estimator jointly estimates anchor drift, attack rate, and onset when no clean-epoch label is available. Across statistical simulations, ArduPilot software-in-the-loop experiments, and Gazebo experiments with rendered vision anchors, the method recovers the positions of non-anchored drones to a median error of 0.39 m (20 seeds) under approximately 10.1 m of GNSS drift, and to 7.1 cm (5 seeds) in the rendered-vision multi-SITL setting. We also characterize the explicit limits imposed by noncollinear anchor geometry, anchor coverage, 𝜏 → 0 drift–attack aliasing, and majority anchor compromise. All evaluations are simulation-based and use no RF spoofing hardware or physical swarm.

CCS Concepts • Security and privacy → Mobile and wireless security; Embedded systems security; • Computer systems organization → Robotic autonomy.

Keywords GNSS spoofing; UAV swarm; cyber-physical security; sensor attack detection; gauge freedom; cooperative localization

1

Introduction

Autonomous UAV swarms are being deployed for delivery, inspection, agriculture, and surveillance, and they depend on the Global ∗ Corresponding author.

Navigation Satellite System (GNSS) for absolute positioning. GNSS is also vulnerable to spoofing—civilian signals carry no source authentication: a software-defined radio can synthesize counterfeit signals that override the genuine ones [17, 33, 39], and full capture-and-control of an airborne vehicle by GPS spoofing has been demonstrated in the field [19, 29]. Because a single spoofed drone is a localized fault, the swarm-security literature answers with cooperative defenses: each drone compares its GNSS-reported position against a feasible region built from its neighbors’ reported positions and measured inter-drone ranges (UWB, RSSI, or optical flow), flags the inconsistent minority, and reaches Byzantine consensus on the “genuine” positions [4, 13, 25, 46]. The threat. We study an attack that the relative-geometry channel misses. A single or coordinated attacker drives the GNSS of the entire formation with an offset 𝑏 (𝑡) that is (i) common-mode— nearly the same for all drones; (ii) gradual—a slow ramp that stays within onboard innovation gates; and (iii) geometry-preserving— all pairwise distances are unchanged. We call this rigid-covert spoofing (RigidShift; Fig. 1). The underlying capability is not merely hypothetical: wide-area, approximately formation-preserving spoofing has been demonstrated on SDR hardware [38], and a formal analysis proves a coordinated spoofer can exactly rigid-shift up to nine receivers, with bounded residual error beyond [6]; the exact common shift at larger swarm scale is an idealized distributedspoofer oracle we use to probe defense scalability, not a validated wide-area attack (§8). Why cooperative defenses miss it. A detector that keys on the inconsistency between GNSS-reported positions and measured geometry is a function of relative quantities only. Such a function is invariant under a common translation of all reported positions: the feasible region shifts by the same 𝑏, the ranges are unchanged, and the residual stays ≈ 0 (Section 2, Prop. 1). This is the same gauge freedom that makes anchor-free network localization observable only up to a global rigid transform [2]. We confirm the blindness both across the literature (Table 2) and empirically: our reproduction of a cooperative semidefinite-feasibility detector [4] flags a common-mode ramp at only 1.7%—below its 5% false-alarm floor. What we do not claim. Recent multimodal swarm detectors [36, 37] add a per-drone inertial/GNSS Kalman-residual and signalquality channel. That channel is not gauge-blind, and it can catch a covert ramp—but only above a sensitivity floor, and it yields a bare alarm: the swarm learns that it is being spoofed, but not where it actually is. Our own experiments confirm that a purpose-built offline monitor over the per-drone EKF raw-innovation sequence— an onboard, non-geometric detector in the spirit of [14]—detects

Park and Yoo

Figure 1: RigidShift threat. A coordinated GNSS spoofer adds a slow, common offset 𝑏 (𝑡) to every drone, so the whole formation drifts together as a rigid body—shown solid at its actual drifted position, with the vacated intended position as the faded ghost. Because every pairwise distance 𝑑𝑖 𝑗 is preserved, a cooperative defense, which sees only relative quantities, finds no inconsistency; being gradual, the shift also stays under each drone’s built-in glitch/failsafe gate. This is a structural blind spot. the covert ramp on 20/20 Tier-2 attack runs at each tested rate (2– 20 cm/s) (its held-out no-attack false alarm was 1/10 runs, a wide finite-sample estimate; App. B)—even though the autopilot’s own built-in glitch/failsafe gate stays silent throughout (RQ3). Hence detection is possible in principle; we do not claim “only we can detect.” The blind spot is specifically in the relative-geometry channel; and even a detection-only alarm is insufficient for restoring safe navigation, since it provides no corrected absolute state—the swarm still does not know where it actually is. Our contribution is the layer beyond a blind alarm: recovery of the true positions of the whole swarm, the detection limit of that ability, and the failure envelope of the anchor that provides it (and, as a by-product, per-drone attribution under the distinct partial-spoof variant). Contributions. • Structural blind spot and quantitative boundary (§2– §4). We formalize a rigid common-mode GNSS shift that is unobservable to relative-geometry channels—an instantiation of network localization [2] and CPS attack identification [32]—validate the blind spot on representative cooperative baselines, and derive the drift-dependent detection floor 2𝛾/(1 − 𝑡𝑠 /𝑇 ) for a calibrated anchor-residual detector, with an empirically measured detector-specific noise floor (slope 2.66 vs. predicted 2.67). • Anchor-rooted whole-swarm recovery (§5–§6). We reconstruct the swarm geometry from inter-drone ranges, align it to a trusted-anchor subset with Byzantine-robust fitting, and recover the absolute positions of both anchored

and non-anchored drones. A segmented estimator jointly estimates anchor drift, attack rate, and onset when no cleanepoch label is available. • Multi-tier validation and explicit limits (§7–§8). Across statistical simulation, ArduPilot software-in-the-loop, and Gazebo-rendered vision anchors, we evaluate detection, recovery, Byzantine robustness, and non-anchor trust propagation, and identify the limits imposed by anchor geometry, coverage, 𝜏 → 0 drift–attack aliasing, and majority anchor compromise. Scope. Every result is in simulation across three tiers: a seed-fixed Python kinematic swarm (Tier-1), ArduPilot software-in-the-loop with its EKF and controller in the loop (Tier-2) [1], and Gazebo with a rendered camera [21]. We use no RF hardware and no physical swarm; we treat the vision renders and the ArduPilot-in-the-loop flights as realism evidence for an otherwise abstracted anchor channel, not as field validation (§10).

2 Background and Threat Model 2.1 System model A swarm of 𝑁 drones has (unknown) true horizontal positions 𝑥𝑖 (𝑡) ∈ R2 . Each drone reports a GNSS position 𝑧𝑖 (𝑡) = 𝑥𝑖 (𝑡) + 𝑏𝑖 (𝑡) + 𝑛𝑖 (𝑡), where 𝑏𝑖 is an attacker-injected offset and 𝑛𝑖 ∼ N (0, 𝜎𝑔2 𝐼 ) is receiver noise. Drones measure noisy pairwise ranges 𝑑𝑖 𝑗 (𝑡) = ∥𝑥𝑖 − 𝑥 𝑗 ∥ + 𝜀𝑖 𝑗 , with 𝜀𝑖 𝑗 ∼ N (0, 𝜎𝑟2 ), over an independent channel (UWB) that the attacker cannot forge through GNSS. Each drone in a subset A of size 𝜌𝑁 carries an

Rigid-Covert GNSS Spoofing of UAV Swarms: A Structural Blind Spot, Its Detection Limit, and Absolute-Anchor Defenses

Table 1: Notation. 𝑁, 𝜌 𝑥 𝑖 , 𝑧𝑖 , 𝑎𝑖 𝑏 (𝑡 ), 𝑣 𝑑𝑖 𝑗 𝑒𝑖 (𝑡 ), 𝑔𝑖 (𝑡 ) 𝜎𝑎 , 𝛾 𝑡𝑠 , 𝑡𝑑 , 𝑇 𝜏 =𝑡𝑠 −𝑡𝑑 𝑣∗ 𝑓 𝜀

swarm size; fraction carrying an absolute anchor true / GNSS-reported / anchor position of drone 𝑖 common-mode attack offset; ramp rate ∥𝑏¤ ∥ measured inter-drone range anchor total error; estimated drift (§6.2) anchor per-frame noise (m); worst-case drift rate (cm/s) attack onset; anchor-drift onset; horizon attack onset relative to drift (used in the 𝜏 → 0 barrier) minimum detectable covert ramp rate (security index) number of Byzantine (actively compromised) anchors radial formation-deformation rate (1/s); 𝜀=0 is perfectly rigid

absolute anchor: a GNSS-independent horizontal position estimate 𝑎𝑖 (𝑡) = 𝑥𝑖 (𝑡) + 𝑒𝑖 (𝑡), where 𝑒𝑖 is the anchor’s own error—per-frame position noise of scale 𝜎𝑎 plus a slow registration drift of rate 𝛾. Table 1 summarizes the notation.

2.2

Attacker model

The attacker controls the GNSS signal reaching every drone and imposes a coherent, slowly growing common offset 𝑏 (𝑡) that preserves geometry. A single spoofer can preserve the formation exactly for 𝑁 ≤ 9 [6], whereas preserving it at larger scale requires a wide-area multi-transmitter spoofer [38]; a single spoofer beyond 𝑁 ≤ 9 instead deforms the formation, which the relative channel detects (§8). Direction is the attacker’s choice; magnitude ramps from onset 𝑡𝑠 at rate 𝑣. The attacker may additionally compromise up to 𝑓 anchors, either by echoing the spoof into the anchor channel or by physically corrupting the reference. The attacker does not control the honest anchors, the UWB ranging channel, or the communication/aggregation infrastructure; these constitute the trusted computing base. The attacker knows the defense and may adapt (e.g., ramp just below 𝑣 ∗ , or align the attack with a drifting anchor)—adaptive strategies we evaluate in §8.

2.3

Observability structure

Two propositions organize what is and is not possible, followed by two conditional caveats. They are instantiations of standard theory, cited accordingly: the propositions themselves are not new theorems. Our contributions are the quantitative detector-specific limit (§4), the joint drift/attack estimator (§6.2), and the multi-tier system evaluation (§5–8). Prop. 1 (gauge freedom). Any detector that is a function only of the relative quantities {𝑧𝑖 −𝑧 𝑗 } and {𝑑𝑖 𝑗 } is invariant under 𝑧𝑖 ↦→ 𝑧𝑖 + 𝑐 for a common 𝑐 ∈ R2 . Hence a commonmode 𝑏 (𝑡) is unobservable from relative channels alone. (Anchor-free localization is observable only up to a global rigid transform [2].) Prop. 2 (anchor observability). With at least one absolute anchor a common translation becomes observable; recovering a general rigid motion that includes rotation requires at least two. Two identifiability caveats. Beyond these two propositions, the trusted-anchor assumption rests on two conditional facts, which we treat as limitations and as motivation for the temporal estimator

rather than as theorems. Caveat 1 (conditional attack/fault separation): an attack and an anchor fault are distinguishable only when their measurement signatures are linearly independent—a homogeneous common-mode anchor fault is indistinguishable from a common-mode GNSS shift, and separating them needs a heterogeneous absolute modality (§8), a conditional instance of CPS attack identification [32]. Caveat 2 (memoryless-only aliasing): a drifting anchor can alias a covert attack so that a memoryless anchor residual stays flat, but the onset kink at 𝑡𝑠 is a change point that a sequential statistic (CUSUM [30], GLR) still detects; true inseparability holds only when the attack is simultaneous and isomorphic to the drift (𝜏 → 0). This motivates the temporal estimator of §6.2 for attacks with a resolvable change point (𝜏 > 0) and defines its fundamental 𝜏 → 0 limit.

3

Why Cooperative Defenses Fail

Table 2 surveys representative swarm GNSS-spoofing defenses. The relative-geometry components of the examined cooperative defenses lack an independent absolute horizontal reference; by Prop. 1 that channel is blind to a common-mode geometry-preserving shift (the added inertial/signal channel of the multimodal detectors is not gauge-blind—see below). Distance verification [27] tests | ∥𝑧𝑖 − 𝑧 𝑗 ∥ − 𝑑𝑖 𝑗 | > 𝜃 , which is invariant under a common shift. SwarmRaft [13] re-localizes flagged drones from neighbor positions and ranges alone, with no fixed ground infrastructure or absolute reference. BDGD [46] fuses RSSI distance checks with a reputation vote that requires an honest majority. Bi et al. [4] solve a semidefinite feasibility problem tied to self-reported positions, so a uniform offset gives 𝑋 = 𝑋ˆ , trivially feasible. The two 2026 multimodal detectors, OrbitGuardNet [37] and the tri-stream network [36], add a per-drone inertial/signal-quality channel that is not gauge-blind. Like any covert-ramp detector such a channel will have its own sensitivity floor (its observations, noise, and statistic differ from ours, so the specific law of §4 does not transfer to it), but— and this is our point—it still performs no true-position recovery. Notably, the method of Michieletto et al. [25] uses no independent absolute reference (RSS + GNSS/IMU only, Table 2) and may therefore remain vulnerable to a sufficiently slow common-mode shift (stealthy slow attacks provably evade any such model-based anomaly detector [20]); and ASD/RSOM [24] explicitly leaves visual ranging to recover the true location of spoofed drones to future work—the recovery problem we solve. Appendix Fig. 7 makes the point quantitatively: both existing relative detectors remain near chance across the sweep—distance verification peaks at only 0.56 AUC at 2 cm/s and both fall to ≈ 0.48–0.49 at 5–20 cm/s (bootstrap 95% CIs otherwise include 0.5)—while our over-determined-geometry and absolute-anchor detectors reach 1.0 above the detection limit.

4

The Detection-Limit Law

Within our recovery schema, the independent anchor is the absolute reference outside the relative gauge, so an anchor-referenced detector bounds what a relative-blind defense can add. We derive the floor for a worst-case covert attacker against a single anchor modality whose registration slowly drifts. The attacker ramps the

Park and Yoo

Table 2: Representative swarm GNSS-spoofing defenses and onboard detectors vs. the rigid-covert threat. “Abs. ref.”: independent absolute horizontal reference; “Blind”: blind to the rigid-covert threat; “Recovery”: recovers true positions rather than only raising an alarm. Detection is not unique to us—a non-geometric monitor also detects—but only anchorrooted geometry recovers the swarm. Defense

Detection signal

Abs. ref.

Blind

Recovery

GNSS vs. UWB range Byz. dist. consensus [46] RSSI + reputation SDP feasibility [4] reported pos. + range Consensus reloc. [13] peer pos. + range + inertial/signal Multimodal [36, 37] Formation loc. [25] RSS + GNSS/IMU Offline EKF-innov. onboard EKF monitor (ours, cf. [14]; innov. App. B)

no

yes

no

no

yes

no

no

yes

no

no

yes

no

no no

geom. only likely (rig.)

no no

no

no

no

This work

yes

no

yes

Distance verif. [27]

abs. anchor + ranges

Figure 2: Detection-limit law validation: the measured floor tracks the derived slope of Eq. (1) (measured 2.66 vs. predicted 2.67; fit 𝑅 2 =0.99, slope 95% CI [2.09, 3.23] over 𝑛=5 drift levels, containing the predicted slope), with a positive intercept (≈ 1.3 cm/s) consistent with a per-frame-noise floor 𝑣 noise (at 𝜎𝑎 =0.5 m) that the idealized law omits. 𝛾 is the worst-case anchor-drift rate.

GNSS offset at rate 𝑣 from onset 𝑡𝑠 ; independently, the honest anchor’s registration drifts at rate 𝛾 (the modality’s worst-case drift capability, in cm/s), and in the worst case this drift is aligned with the attack direction. The attacker anticipates or observes the drift but does not control the honest anchor—an attacker-controlled anchor is the separate Byzantine case of §6. The median anchor residual is then 𝑟 (𝑡) = |𝑣 (𝑡 − 𝑡𝑠 )+ − 𝛾 𝑡 |, and a detector calibrated at the false-alarm quantile of the drift-only run (end-of-horizon peak ∼ 𝛾𝑇 ) fires only when the attack’s residual peak clears that band, (𝑣 − 𝛾)𝑇 − 𝑣 𝑡𝑠 > 𝛾𝑇 , giving the ideal detection floor ∗ 𝑣 ideal =

2𝛾 . 1 − 𝑡𝑠 /𝑇

(1)

Both sides are rates. A realistic detector also faces the anchor’s perframe position noise 𝜎𝑎 , which imposes a noise floor 𝑣 noise (𝜎𝑎 ,𝑇 , 𝛼) at operating point 𝛼 that persists even for a non-drifting modality, so the operational security index is 𝑣∗ =

2𝛾 + 𝑣 noise (𝜎𝑎 ,𝑇 , 𝛼). 1 − 𝑡𝑠 /𝑇

(2)

Sweeping 𝛾 at fixed 𝜎𝑎 =0.5 m, the measured floor is 𝑣 ∗ ≈ 2.66 𝛾 + 1.3 (cm/s): the slope matches the derived 2/(1 − 𝑡𝑠 /𝑇 ) = 2.667 (𝑡𝑠 /𝑇 =0.25; fit 𝑅 2 =0.99, slope 95% CI [2.09, 3.23] contains it), and the 1.3 cm/s intercept is consistent with a per-frame-noise floor 𝑣 noise at these settings (Figure 2). Eq. (2) is therefore an operational (empirical) decomposition: we verify the 𝛾-linear term and an additive floor at 𝜎𝑎 =0.5 m, 𝑡𝑠 /𝑇 =0.25; the dependence of 𝑣 noise on 𝜎𝑎 , 𝑇 , and the false-alarm point 𝛼—and the linearity of the split under correlated or heavy-tailed noise—are not separately derived. A drift-free modality (𝛾 → 0, e.g. a fixed UWB beacon) drives the floor down to 𝑣 noise , not to zero, while a drift-prone modality (vision)

raises it with 𝛾. We present it as a calibrated-detector security index for this threat model, not a bound over every conceivable detector. Adaptive attacker / security index. An attacker who ramps at a constant rate just below 𝑣 ∗ accumulates a covert displacement budget 𝑣 ∗ · (𝑇 − 𝑡𝑠 ); thus 𝑣 ∗ is a security index for the constant-rate ramp family. Nonlinear profiles evade the same detector longer—a back-loaded polynomial delays time-to-detect 5.7× (§8)—and need a separate displacement- or energy-constrained analysis, so we do not claim 𝑣 ∗ (𝑇 −𝑡𝑠 ) as a budget for arbitrary profiles. With 𝐾 independent modalities of drift 𝛾 𝑗 and noise floor 𝑣 noise,𝑗 , a typeaware detector keying off themost favorable modality gives 𝑣 ∗ (𝐾) = min 𝑗 2𝛾 𝑗 /(1−𝑡𝑠 /𝑇 ) +𝑣 noise,𝑗 . Appendix Fig. 8 bears the trend out— adding clean references drives 𝑣 ∗ down (10 → 6 cm/s realistic, to 2 for an oracle)—though the realistic detector needs a clean majority to trust the clean modality, and fusing several clean references lowers the floor beyond the single-modality min (oracle 3 → 2); the exact multi-modality relationship is empirical. Relation to prior limits. Khazraei et al. [20] prove that a stealthy GPS attack can cause unbounded deviation on a single vehicle, and Murguia & Ruths [26] bound the state degradation an undetected attacker can induce on an LTI CPS. Both are existence/impact statements, not a drift-proportional ramp-rate threshold against an external absolute anchor in a swarm. The closest analog, Baweja [3], proves a structurally similar slow-ramp impossibility in the singlereceiver timing/clock domain; Eq. (1) is position/swarm/anchorspecific and we distinguish it explicitly.

Rigid-Covert GNSS Spoofing of UAV Swarms: A Structural Blind Spot, Its Detection Limit, and Absolute-Anchor Defenses

Table 3: Anchor failure modes (rigid-covert swarm; detailed sweeps in Appendix C). Mode

Observed effect

Design implication

Aligned drift

Memoryless residual masked (1.0 → 0.0 at aligned drift ≈ 𝑣/2); sequential CUSUM/GLR still catch the onset (AUC 1.0) Vision tracking ≈ 6 cm within a ≈ 4 m envelope, then diverges Common-mode anchor errors collapse detection (1.0 → 0.17 at 10% cofailure) Fixed anchor count: farnode error grows with 𝑁 (14.5 → 37.2 m, 𝑁 =16 → 128, 3 anchors)

Temporal drift/attack separation (§6.2)

Coverage loss

Correlated failure

Dilution

5

Coverage is a deployment constraint

Anchor ratio and placement govern recovery

Anchor Failure Modes

Defenses

The defense has three components: the anchor-rooted recovery architecture with optional attribution (§6.1; Fig. 3) and the two temporal estimators (bootstrap and joint) that keep it working when the anchor itself drifts (§6.2). All three consume a common schema (position, range, anchor, timestamp), so identical code runs on synthetic and simulator data (§7).

6.1

𝑌 = ClassicalMDS(𝐷), ˆ 𝑡ˆ) = RANSACAlign(𝑌A , {𝑎𝑖 } A ), (𝑅,

Heterogeneous independent modalities

The absolute anchor is necessary but not automatic: it introduces its own failure envelope. Table 3 summarizes four modes we characterize empirically in the rigid-covert swarm setting; the detailed sweeps are in Appendix C. Absolute anchors break the relative gauge but introduce their own failure envelope. Aligned anchor drift can mask a memoryless residual (detection 1.0 → 0.0 at an aligned drift ≈ 𝑣/2; App. Fig. 9), but a 320-configuration enumeration confirms that only memoryless/peak detectors are masked—sequential CUSUM/GLR still catch the onset kink—so aliasing motivates the temporal estimator of §6.2 for recovering attacks with a resolvable change point (𝜏 > 0) rather than for detection; the simultaneous isomorphic case 𝜏 → 0 remains unidentifiable (§6.3). Landmark coverage limits vision-based anchors (Figure 6b); correlated common-mode anchor errors defeat redundancy (App. Fig. 14a); and a fixed anchor count produces geometric dilution as the swarm grows (App. Fig. 14b), so both the anchor ratio and the non-collinear placement (§6.1) govern recovery. We treat these as deployment and identifiability conditions rather than separate contributions.

6

anchored frame to every non-anchor drone. Recovery is thus a single centralized global estimate; robustness to Byzantine anchors comes from the RANSAC alignment, not from a distributed consensus (a fully distributed realization would replace this with an iterated W-MSR protocol [23], which we do not implement or evaluate). Attribution flags drone 𝑖 as spoofed when its GNSS report disagrees with its recovered position, ∥𝑧𝑖 − 𝑥ˆ𝑖 ∥ > 𝜃 . The recovery is three standard steps on the per-frame ranges 𝐷={𝑑𝑖 𝑗 } and trusted anchors {𝑎𝑖 }𝑖 ∈ A :

Anchor-rooted whole-swarm recovery

A subset A (𝜌𝑁 drones) carries an absolute anchor. The recovery reconstructs the swarm shape from the over-determined ranges by classical multidimensional scaling (MDS), robustly fits the alignment onto the trusted anchors under the evaluated Byzantineminority conditions (RANSAC [15]), and propagates the single

(3)

𝑋ˆ = 𝑅ˆ 𝑌 + 𝑡ˆ. The first step reconstructs the swarm shape up to a rigid transform; the second aligns it to the trusted anchors while rejecting a Byzantine minority of ≤ 𝑓 anchors; the final transform recovers all 𝑁 absolute positions 𝑋ˆ , including drones with no anchor of their own. Assumptions and minimum conditions. Classical MDS requires a complete distance matrix; our large-𝑁 sweeps supply it with allpairs UWB, and a geodesic range-graph-completion step (which needs a connected graph) extends recovery to a sparse graph—robust down to ≈ 35% density before connectivity fails (§8, App. Fig. 15)— and heavy non-line-of-sight tails are handled robustly (evaluated on a real UWB dataset, §8). We model the horizontal plane only (the covert offset is horizontal; altitude is barometric and outside the threat model). The anchor counts separate cleanly: detecting a common translation needs one trusted anchor (Prop. 2); fixing the orientation (a rotation 𝑅 ∈ 𝑆𝑂 (2)) needs two; and removing the MDS reflection ambiguity for full absolute recovery needs three trusted anchors whose true coordinates are non-collinear (two points always lie on a line and cannot resolve the reflection about it; we therefore use non-collinear anchors in the multi-SITL capstone, §8). Rejecting 𝑓 Byzantine anchors by RANSAC therefore needs both a trusted majority and three non-collinear honest inliers, i.e. 𝑚 ≥ max(2𝑓 +1, 𝑓 +3) present anchors, where 𝑚 denotes the number of available anchors. Our recovery is centralized (a single MDS + RANSAC estimate), which we implement and evaluate; a fully distributed realization would add an iterated W-MSR consensus over a (2𝑓 +1)-robust communication graph against an 𝑓 -local adversary [23], which we leave as a deployment extension rather than claim as evaluated.

6.2

Drift-learning estimators

When the anchor drifts, a covert ramp aligned to the drift can pass the anchor residual (Caveat 2). Both estimators exploit time: a benign drift is a smooth process, whereas an attack is a changepoint ramp. Bootstrap drift-correction. Given a clean (no-attack) epoch, fit each anchor’s drift model 𝑔ˆ𝑖 (𝑡), extrapolate it forward, and subtract it from the anchor residual; what remains is the attack. An attack that aliases against the raw anchor is exposed against the driftcorrected anchor. Joint estimator. The clean-epoch label is itself an assumption. The joint estimator (Algorithm 1) drops it: by segmented (changepoint) regression it fits, over the whole record and per axis, a model in which the signal is a continuous anchor drift 𝑔 plus an attack

Park and Yoo

Figure 3: Anchor-rooted recovery. A few drones carry an anchor (green): they see a fixed ground landmark, giving them a GNSS-independent estimate of their true position that a GNSS spoof cannot alter. The inter-drone ranges 𝑑𝑖 𝑗 fix the swarm’s shape but not its absolute placement (the gauge freedom of Fig. 1); aligning that shape to the trusted anchors (classical MDS, then RANSAC) estimates the absolute position of every drone, including the GPS-only ones. Algorithm 1 Joint drift/attack estimator over the aggregated anchor residual Require: per-axis residual 𝑟𝑐 (𝑡) (coordinate-wise median over usable anchors), 𝑐 ∈ {𝑥, 𝑦}; drift basis Φ(𝑡) = [1, 𝑡]; onset grid 𝑡𝑠 ∈ {5, 6, . . . , 59} s 1: for each candidate onset 𝑡𝑠 in the grid do 2: per axis 𝑐: fit 𝑟𝑐 (𝑡) ≈ Φ(𝑡)𝛽𝑐 + 𝑣𝑐 (𝑡 − 𝑡𝑠 )+ (LS) Í 3: RSS(𝑡𝑠 ) ← 𝑐 residual sum of squares 4: end for 5: 𝑡ˆ𝑠 ← arg min𝑡𝑠 RSS(𝑡𝑠 ); ( 𝛽ˆ𝑐 , 𝑣ˆ𝑐 ) ← fit at 𝑡ˆ𝑠 6: 𝑣ˆ ← ∥ (𝑣ˆ𝑥 , 𝑣ˆ𝑦 ) ∥ ⊲ magnitude; direction = ∠(𝑣ˆ𝑥 , 𝑣ˆ𝑦 ) ˆ 𝑣, ˆ 𝑡ˆ𝑠 7: return 𝑔ˆ = Φ𝛽,

ˆ 𝑡ˆ𝑠 ). ramp of rate 𝑣 starting at an unknown onset 𝑡𝑠 , and returns (𝑔,ˆ 𝑣, This resolves the instantaneous drift–attack aliasing by using the temporal signature of the change point—it does not lift the 50% Byzantine barrier (§6)—and it is well-posed only when the preonset window is long enough to fit the drift (§8); with too little clean history the drift and attack are collinear and the estimate degrades. Details. The residual is 𝑟𝑐 (𝑡) = median𝑖 (𝑧𝑖,𝑐 − 𝑎𝑖,𝑐 ) over usable anchors, per axis; the two axes are fit independently, so the attack direction is recovered as ∠(𝑣ˆ𝑥 , 𝑣ˆ𝑦 ), not assumed. The drift basis is affine ([1, 𝑡]), matching a slowly-registering anchor; the onset grid is 1 s. The fit is 𝑂 (|grid|·𝑇 ) for the single aggregated residual stream. We report accuracy as the mean absolute error over 40 seeds per condition; the ranges in Table 7 are over drift rate 𝛾 ∈ [0, 3] cm/s and

onset 𝑡𝑠 ∈ [20, 40] s (accuracy holds for pre-onset windows ≳ 10 s and degrades below, as drift and attack become collinear).

6.3

Fundamental barriers

Two independent barriers remain; either alone defeats this defense family, and neither estimator beats them. First (Byzantine majority): active compromise of an anchor majority (𝑓 ≥ 𝑚/2) makes the trusted transform ambiguous—the trusted set no longer out-votes the compromised set. Second (temporal identifiability): even with fully honest anchors, an attack that is simultaneous and isomorphic to the anchor drift (𝜏 → 0) is unidentifiable under our measurement model, because it leaves no change point for the temporal estimator to key on. Robustness degrades gracefully toward each wall (§8); we state them as limits, not gaps.

7

Implementation and Setup

We use three tiers with a shared detector schema so identical detector code runs on all of them. Tier-1 is a seed-fixed numpy/scipy kinematic swarm (seed-fixed, dependency-pinned reproduction), used for statistical sweeps. Tier-2 is ArduPilot software-in-theloop (SITL) [1] with its EKF3 and flight controller in the loop; the covert ramp is injected through the simulator GPS glitch parameter SIM_GPS1_GLTCH, an L1-sensor injection point upstream of the EKF. Gazebo [21] renders a downward camera over five knownposition coloured landmarks; the vision anchor recovers absolute position by HSV colour segmentation and solvePnP. Experiment configurations are declarative and versioned; the artifact (detector

Rigid-Covert GNSS Spoofing of UAV Swarms: A Structural Blind Spot, Its Detection Limit, and Absolute-Anchor Defenses

Table 4: Default simulation parameters (Tier-1 unless noted). Sweeps vary one axis around these defaults. Parameter

Value

Parameter

Value

Swarm size 𝑁 Formation / spacing Horizon 𝑇 / step Cruise speed Onset 𝑡𝑠 /𝑇 Seeds / condition

8 (4–128) grid / 5 m 80 s / 0.1 s 3 m/s 0.25 200 (AUC)

GNSS noise 𝜎𝑔 Range noise 𝜎𝑟 Anchor noise 𝜎𝑎 Anchor ratio 𝜌 Covert ramp 𝑣 Attribution thr. 𝜃

0.50 m 0.10 m 0.50 m 0.5 (0–0.5) 2/5/20 cm/s 1m

Table 5: What is a genuine simulator output vs. a modeled channel, per tier. No tier transmits or receives an RF signal. Component Vehicle controller GNSS attack

/

Inter-drone ranges Absolute anchor RF signal

Tier-1

Tier-2

Vision capstone

kinematic

ArduPilot SITL

software inject synthetic

sim. GPS-glitch

ArduPilot + Gazebo sim. GPS-glitch

synthetic

truth-derived + noise synthetic / noisy

none

none

truth-derived + noise rendered image pipeline none

code, configs, and the swarm harness) is publicly available (Appendix A). Threat-model contract: detectors read only GNSS positions, ranges, and anchor positions; ranges and anchors come from an independent channel the attacker cannot forge through GNSS. Table 5 delineates which signals are genuine simulator outputs versus modeled channels per tier, and Table 4 lists the default parameters; sweeps vary one axis at a time around them. Statistics. Unless noted, the bootstrap resampling unit is one independent run: for Tier-1, a fresh seed drives the whole kinematic sim (trajectory, GNSS, range, and anchor noise); for Tier-2, one SITL flight plus an independently drawn range/anchor-noise realization. Some Tier-2 CIs are narrow because recovery error is a geometrydominated statistic averaged over the swarm and horizon, so its run-to-run spread is genuinely small—we confirmed this is not a fixed-noise artifact by re-drawing the per-run noise seed, which left the means and CIs essentially unchanged. Where a mechanism is discrete (e.g. RANSAC inlier-selection failure at the 50% Byzantine boundary) the CI is correspondingly wider. Detector definitions. Every detector reduces each frame to a scalar score, gates it (fires only after ≥ 3 consecutive frames—0.3 s at 𝑑𝑡=0.1—above threshold), and calibrates the threshold at the 𝛼=5% false-alarm quantile of 120 no-attack runs; the ROC/AUC score is the gated run-peak. The two relative baselines score geometry inconsistency: distance verification [27] on max𝑖 𝑗 |∥𝑧𝑖 − 𝑧 𝑗 ∥ − 𝑑𝑖 𝑗 |, and the cooperative SDP on the reported-position/range feasibility residual. Our absolute anchor detector scores the median over anchored drones of ∥𝑧𝑖 − 𝑎𝑖 ∥; our over-determined geometry detector scores the median over all drones of ∥𝑧𝑖 − 𝑥ˆ𝑖 ∥, where 𝑋ˆ = MDS({𝑑𝑖 𝑗 }) rigidly aligned to the anchors (Eq. (3)), falling back to the anchoronly residual when fewer than three anchors are present. The two

differ only in whether trust is propagated to non-anchored drones through the range geometry. Robust RANSAC alignment. The anchor alignment (RANSACAlign, Eq. (3)) fits a rigid transform from a minimal 3-anchor sample and, rather than sampling randomly, exhaustively enumerates all 𝑚
anchor triples (so the estimate is deterministic— there is no 3 iteration count or success-probability trade-off). Each candidate is scored by its inlier set with an inlier threshold of 1.5 m; ties on inlier count are broken by the smallest total inlier residual (an MSACstyle rule that avoids a triple containing a Byzantine anchor); the winning transform is then re-fit (least-squares Procrustes) on its full inlier set. With fewer than four anchors, or if no triple yields ≥ 3 inliers, it falls back to plain Procrustes. The exhaustive 𝑂 (𝑚 3 ) enumeration is the source of the large-𝑁 recovery cost in Appendix Table 9. All parameters and the code are in the artifact.

8

Evaluation

We organize the evaluation around three questions. RQ1 asks whether representative relative-geometry defenses are blind to the rigid common shift and whether the measured anchor detection floor follows the derived law. RQ2 asks whether anchor-rooted recovery reconstructs both anchored and non-anchored drones under drift, sparse ranging, and Byzantine anchors. RQ3 asks whether the complete defense loop holds in multi-vehicle ArduPilot SITL with Gazebo-rendered vision anchors, and where its explicit limits appear. Detailed curves and secondary experiments are in Appendix C.

8.1

RQ1: Structural blindness and detection boundary

Blindness and detection. Table 6 reports detection AUC under the common-mode attack over 200 seeds/condition. Both existing relative detectors stay at chance (bootstrap 95% CIs include 0.5); our detectors saturate at 1.0 once the ramp exceeds 𝑣 ∗ (App. Fig. 7). We reproduce the cooperative SDP-feasibility class [4] both as a dependency-free MDS+Procrustes proxy and as a true cvxpy semidefinite program; both are relative-only, hence gauge-blind. At the covert rates (5–20 cm/s) the exact cvxpy SDP flags only 1/60 attack runs (1.7%), at the 5%-false-alarm operating point. Because the exact SDP is a per-frame binary feasibility test rather than a graded score, Table 6 reports the cheaper proxy for the full multirate AUC sweep; the two agree qualitatively (both at chance). The EKF-innovation monitor is excluded from this Tier-1 table because it keys on per-drone EKF innovations available only in the Tier-2 SITL runs; its quantitative detection results appear in App. B. Detection floor and scaling. The measured detection floor tracks Eq. (1) at slope 2.660 vs. predicted 2.667 (Figure 2). Dense (𝜌, 𝑁 ) sweeps confirm 𝑣 ∗ falls as 𝜌 grows: a 2-anchor/𝜌=0.25 configuration reaches detection AUC 0.999, and the anchor channel does not dilute out even at 𝑁 =128 (AUC 1.0), given a connected range graph. Increasing 𝜌 does not change the derived drift term of Eq. (1); it lowers the empirical noise floor by aggregating multiple anchors through the median. (These are detection results; full whole-swarm recovery additionally requires three non-collinear trusted anchors,

Park and Yoo

Table 6: Detection AUC under the common-mode covert attack (Tier-1, 200 seeds/condition). Both existing detectors stay near chance (bootstrap 95% CIs include 0.5, except distance verification at 2 cm/s, 0.56; App. Fig. 7); the exact cvxpy SDP independently confirms this blindness, flagging the covert ramp on only 1.7% of runs. Detector

2 cm/s

5 cm/s

20 cm/s

Distance verification [27] (existing) Cooperative SDP [4] (proxy) Over-determined geometry (ours) Absolute anchor (ours)

0.56 0.54 0.84 0.73

0.49 0.49 1.00 1.00

0.48 0.48 1.00 1.00

§6.1.) We are precise about which attacker makes an exact commonmode shift feasible at scale. Exact covert blindness is structural only to 𝜀=0 (Prop. 1); any deformation 𝜀 ≥ 0.002 self-reveals through the relative channel, a practical threshold that tightens with 𝑁 (App. Fig. 11). Is a near-exact shift a realistic strawman? We ground the attack’s imperfection in GNSS-WASP’s own hardware measurement—a 0.97 m average relative-distance error at ≈ 1000 m from the spoofer reference [38]—and inject that same distance-proportional residual at swarm scale (5 m spacing). At the real measured ratio, and up to ≈ 100× it, the relative distance-check baseline stays at its false-alarm floor (detection 0.07 at the measured level), because at metre-scale spacing the induced differential displacement is millimetric; our anchor detector flags it throughout (1.0), and the relative channel begins to see the residual only near ≈ 500× the measured ratio (App. Table 8). So the covert-blind regime is not an artifact of exact 𝜀=0: under this distance-proportional extrapolation of the GNSS-WASP measurement, the resulting swarm-scale residual is far below what the relative channel can exploit. A single-antenna spoofer can preserve a formation exactly only for 𝑁 ≤ 9 [6] (the multi-receiver countermeasure of [18] exploits exactly this single-transmitter collapse [5]), so preserving a formation across a large swarm requires a wide-area, multi-transmitter spoofer. The 𝑁 =128 case evaluates defense scalability under an ideal distributed-spoofer oracle—a perfectly common offset injected in software. GNSS-WASP [38] establishes wide-area formationpreserving feasibility, but we do not reproduce its transmitter geometry, inter-transmitter synchronization, or receiver-level residuals at 𝑁 =128, and do not claim those residuals stay below our detection threshold there.

8.2

RQ2: Whole-swarm recovery and robustness

Recovery and cooperation gain. Recovery is the core capability a detection-only alarm lacks, and it propagates trust beyond the anchored drones. Figure 4 sweeps the covert ramp over a low-rate (0–1.0 cm/s), long-horizon (400 s) Tier-2 SITL harvest (ArduPilot EKF/controller-in-the-loop; median over 10 seeds/rate)—a deliberately slower, longer regime than the 2–20 cm/s, 90 s harvest used for the onboard monitor (App. B). The reported-vs-true position error grows with the attack—reaching 3.6 m at the top swept rate (1.0 cm/s over the 400 s horizon)—while anchor-rooted recovery holds every drone near the anchor-noise-limited floor (≈ 0.5 m)

Figure 4: Recovery and cooperation gain (low-rate 0–1.0 cm/s, 400 s Tier-2 SITL harvest, ArduPilot EKF-in-the-loop; 10 seeds/rate). Reported-vs-true error ramps with the covert attack, while anchor-rooted recovery holds both anchored (0.45 m) and non-anchored (0.56 m) drones near the anchornoise-limited floor (≈ 0.5 m)—trust propagates from the anchor subset to drones with no reference of their own.

regardless of rate: anchored drones to 0.45 m and, crucially, the non-anchored drones, which carry no absolute reference of their own, to 0.56 m via range-based trust propagation. (These harvest flights run longer than the Tier-1 horizon of Table 4, so the absolute drift exceeds 𝑣 (𝑇 − 𝑡𝑠 ) under those defaults; the scientific point is the flat recovery curve, not the absolute magnitude.) Recovery overtakes the raw report once the drift clears its floor and stays flat thereafter. Table 7 summarizes the remaining defenses. Against an aliased attack, the bootstrap separates a null from the attack residual on the rendered-vision anchor (0.23 vs. 2.22 m; single Gazebo run); the joint estimator, with no clean-epoch label, recovers the onset to a mean absolute error of 0.4–3.4 s and the ramp rate to 0.2– 0.5 cm/s, and lifts change-point detection AUC from 0.00 (naive) to 1.00—provided the pre-onset window is ≳ 10 s; below that the drift/attack collinearity inflates the ramp error to ∼ 10 cm/s. Under simulator-injected Byzantine anchors (Tier-2, ArduPilot with a lying second GNSS; 20 runs/level, bootstrap over independent runs), robust recovery holds at 25% compromise (0.31 m) and collapses at 50% (2.27 m), matching the barrier of §6 and the Tier-1 ablation below. Component ablation. To separate what each stage buys, we ablate on the same Tier-1 rigid-covert scenario with 95% CIs over 60 seeds (Figure 5). (A) Recovery: with no liars, MDS shape + anchor alignment already cuts the median error from the 11.7 m GPS drift to 0.37 m, and RANSAC adds nothing yet. Its value is specific to a Byzantine minority—at 25% Byzantine anchors, plain least-squares alignment is dragged to 5.4 m while RANSAC holds at 0.76 m—and vanishes at 50%, where no majority exists and RANSAC is no better than (indeed slightly worse than) plain alignment: the barrier of §6 made concrete. (B) Drift-correction: when all anchors drift aligned with the attack, the naive median residual is masked (detection 0.12), while the clean-epoch bootstrap restores it to 0.97. Each component’s benefit is thus localized to the regime it targets, not an

Rigid-Covert GNSS Spoofing of UAV Swarms: A Structural Blind Spot, Its Detection Limit, and Absolute-Anchor Defenses

Table 7: Defense results across mechanisms (all simulation); the evaluation metric differs per row (second column). Mechanism ting)

(set-

Bootstrap drift-corr. (aliased, Gazebo) Joint est. (Tier-1) Joint est. (Tier-1) Byzantine recovery (SITL) 8-vehicle SITL swarm Rendered-vision multi-SITL Vision tracking (in coverage)

Metric

Result

𝑛

residual, null/attack onset MAE ramp-rate MAE recovery err., 25/50% recovery / GPS drift recovery / GPS drift track err.; envelope

0.23/2.22 m

1 run

0.4–3.4 s 0.2–0.5 cm/s 0.31/2.27 m

40/cond. 40/cond. 20/lvl

0.39/10.1 m

20

0.071/3.2 m

5

≈ 6 cm; ≈ 4 m

8/pt

undifferentiated stack. The simulator-injected Tier-2 run (20 seeds) reproduces the same qualitative boundary as panel (A)—RANSAC robust recovery 0.31 m under 25% Byzantine anchors but 2.27 m at 50%—so the component boundary is not a Tier-1 artifact. Additional threat and sensing conditions. Appendix C evaluates the defense under further conditions. As a by-product, per-drone attribution of a partial (subset) spoof—a distinct, geometry-breaking attack—becomes reliable above a ≈ 1.5 m offset (App. Fig. 10). A single heterogeneous modality resolves the otherwise-ambiguous common-mode attack-vs-anchor-fault case (40/40; Caveat 1, App. Fig. 12). Non-anchored recovery stays ≤ 0.5 m under the evaluated heavy-tailed real-UWB errors (IDLab Ghent [16]; 0.34 → 0.39 m, detection still 1.0) and sparse range graphs (down to ≈ 35% density; App. Fig. 15). Against an adaptive attacker, a back-loaded ramp only delays time-to-detect (5.7×) and the minimax bootstrap cuts undetected drift from 4.80 to 0.36 m, raising the attacker’s required capability to active-majority anchor compromise or the simultaneous-isomorphic 𝜏 → 0 aliasing barrier (§6.3). Runtime (perframe detection flat in 𝑁 ; Byzantine-robust recovery is the scaling cost, App. Table 9) and a distribution-free detection certificate are also reported there.

8.3

RQ3: Closed-loop multi-SITL validation

Closed-loop single-drone case study. As an illustrative closed loop (ArduPilot coupled to Gazebo physics), a covert GNSS ramp drives one drone −1.10/−3.38/−5.62 m of simulated displacement (slope 1.01 vs. injection) while GNSS/telemetry reports 0 m with no builtin glitch/failsafe alarm; the Gazebo vision anchor (HSV+solvePnP, an actual image pipeline with non-Gaussian failure modes, not “true value + Gaussian noise”) tracks the drift to 4–7 cm within its coverage envelope (Figure 6b) and degrades sharply beyond it, and an abrupt spoof removal trips the built-in glitch gate while the gradual ramp evades it (consistent with Caveat 2; App. Fig. 13). The seeded, quantitative version is the eight-vehicle swarm. Eight-vehicle SITL swarm. Scaling to eight ArduPilot SITL vehicles (the ArduPilot EKF3 + controller; 20 seeds, 4 non-collinear anchors, 𝜌=0.5), a common-mode covert ramp (20 cm/s) drifts all

eight drones ≈ 10.1 m while zero built-in onboard glitch/failsafe alarms fire on any vehicle in any run (the offline raw-innovation monitor of §1 would fire, but it is not part of the deployed autopilot). The relative channel stays blind (baseline score 0.13 → 0.19), the anchor detector fires (0.62 → 11.9), and anchor-rooted recovery reconstructs absolute-position estimates for all eight drones—the four anchored drones to 0.33 m and, crucially, the four non-anchored drones (with no absolute reference of their own) to 0.39 m against the 10.1 m GPS drift (Figure 6a). Bootstrapping over the 20 independent runs (unit = one run, each with its own SITL trajectory and sensor-noise draw; §7), the recovery is run-to-run stable—not a single lucky run. Coverage envelope and rendered-vision capstone. The renderedvision anchor is accurate only within its measured visual coverage envelope: Figure 6(b) shows ≈ 6 cm tracking error below the ≈ 4 m boundary, rising sharply beyond it as landmarks leave the field of view. We therefore evaluate the multi-SITL capstone only within this operating envelope, rather than assuming an unlimited synthetic anchor. Under that condition—rendering the SITL swarm’s anchor drones through the vision pipeline over 5 independent seeds, using the ArduPilot EKFs and Gazebo renders with no synthetic anchor channel—the vision-pipeline anchors recover their own absolute positions to ≈ 5 cm (median per seed, sd 1.2 cm) and anchor-rooted recovery reconstructs the four non-anchored drones to 7.1 cm (sd 1.2 cm) against a 3.2 m GPS drift. (This capstone and the eight-vehicle result of Figure 6(a) are distinct settings—5 vs. 20 seeds, 3.2 vs. 10.1 m of drift—not a single run.) The four trusted anchors are non-collinear by design: a 3-anchor set placed on the formation’s collinear first row leaves the MDS reflection unresolved (§6.1) and can flip the non-anchored recovery, whereas 4 non-collinear anchors (𝜌=0.5) resolve it—the configuration we report.

9

Related Work

GNSS spoofing attacks. Portable civilian spoofers [17], the requirements for successful spoofing [39], and field captureand-control of UAVs [19, 29] establish the single-receiver threat; surveys cover detection broadly [33]. For swarms, GNSS-WASP [38] demonstrates wide-area formation-preserving spoofing on SDR hardware; the countermeasures it bypasses—multi-receiver checks with known inter-receiver distances, and unpredictablemovement/inertial consistency checks—key on the residual an imperfect wide-area spoof leaves across separated receivers, so they do not address the idealized perfectly common translation we study, which leaves no such per-receiver bias. Formal analyses bound a coordinated single spoofer to ≤ 9 formation-preserving receivers with bounded residual beyond [6] and propose no defense; SwarmFuzz [43] finds propagation vulnerabilities but breaks geometry, the opposite of RigidShift. Single-vehicle sensor attacks, detection, and recovery. Sensor attacks span acoustic gyroscope injection [35], IMU spoofing [40], GPS input spoofing [12], and Kalman-defeating multi-sensor signal injection [28]. Control- and invariant-based detectors [8, 34] and their stealthy-attack limitations [9, 20] are well studied, as is attack recovery [7, 10, 22, 44, 45] and, recently, diagnosis-guided recovery

Park and Yoo

Figure 5: Component ablation (Tier-1, 60 seeds, 95% CIs). (A) MDS+align provides recovery (11.7 → 0.37 m); RANSAC’s benefit is specific to a Byzantine minority (25%: 5.4 → 0.76 m) and disappears at the 50% barrier. (B) Bootstrap drift-correction restores detection (0.12 → 0.97) when all anchors drift aligned with the attack. from multi-sensor deception in RVs [11]. Vision/imagery anchors for single-UAV spoofing detection include DeepSIM [42]. All of these are single-vehicle: they neither model a swarm’s gauge freedom nor recover a whole formation’s true positions from a trusted subset. Cooperative swarm defenses. The defenses of Table 2 [4, 13, 24, 25, 36, 37, 46] key on relative geometry and carry no absolute reference; several explicitly leave the rigid or recovery case open. Pure multi-receiver relative verification [18] likewise collapses a single-transmitter attacker to one point and detects the resulting baseline break, but is blind to a formation-preserving common offset. Byzantine-resilient consensus [23], RANSAC [15], MDS, and CUSUM [30] are standard mechanisms we build on, not contributions. Detection limits and drift learning. CPS attack identification [32] and impact bounds [26] give the general theory; Khazraei et al. [20] prove single-vehicle stealthy-attack existence; and the closest analog to our law, Baweja [3], proves a timing-domain slow-ramp impossibility. On the estimator side, blind drift calibration [41] removes benign drift (the inverse of our goal) and a single-UAV change-point detector over an internal RL signal [31] is the closest adjacency; neither performs joint (𝑔, 𝑣, 𝑡𝑠 ) estimation across a swarm of simultaneously-drifting absolute anchors. Delta. The observability propositions and the mechanisms are prior art and cited as such. Our original elements are the empirical anchor failure-mode characterization (§5), the drift-proportional detection-limit law in the swarm/anchor/position setting (§4), the joint change-point estimator over the aggregated drifting-anchor residual (§6.2), and the rendered-vision multi-SITL instantiation (§8).

10

Discussion, Limitations, and Ethics

Limitations. All results are in simulation; there is no RF spoofing hardware and no physical swarm, and the vision anchor and

flights are Gazebo-rendered (the flights use the ArduPilot EKF and controller). Beyond that, the results rest on assumptions we make explicit. Modeling: a 2D horizontal plane; recovery assumes an independent, honest absolute-anchor channel and a UWB ranging channel the attacker cannot forge, with sufficiently accurate time synchronization. Recovery geometry: classical MDS needs a connected range graph, at least three non-collinear honest anchors to remove the reflection ambiguity (§6.1), and 𝑚 ≥ max(2𝑓 +1, 𝑓 +3) under 𝑓 Byzantine anchors; sparse graphs are handled by geodesic completion, which introduces distance distortion and fails once the graph disconnects (§8). Attack model: the detection-limit law is derived for a constant-rate ramp (nonlinear profiles need a separate analysis); the 𝑁 =128 result is defense scalability under an ideal distributed-spoofer oracle, not a validated wide-area attack; and a homogeneous common-mode anchor fault is attributable only with a heterogeneous modality (Caveat 1). Estimator scope: the joint estimator assumes the aggregated honest-anchor drift is well approximated by an affine trend and that the attack introduces a single resolvable change point; heterogeneous nonlinear drifts and multiple change points are not evaluated. Anchor: vision recovery is bounded by landmark coverage and visibility. Two barriers are fundamental: an attack simultaneous and isomorphic to the drift (𝜏 → 0), and active compromise of a majority of anchors. The observability propositions are prior-theory instantiations, not new theorems; our contributions are the quantitative detector-specific limit, the joint estimator, and the system evaluation. Deployment. The defense needs a trusted absolute-reference modality on a subset of drones; vision or terrain matching is one realization; fixed beacons or a separately authenticated navigation source whose signal path lies outside the attacker’s control are others. Coverage (§5; Fig. 6b) and anchor ratio 𝜌 (§4) are the key design parameters. Runtime: detection stays real-time at all evaluated sizes, but the current single-core exhaustive-RANSAC recovery does not sustain the 10 Hz update rate at 𝑁 =64 (139 ms/frame, App. Table 9); Byzantine-robust recovery at that scale needs optimization, parallelization, or a lower update frequency, and the 𝑁 =128 result

Rigid-Covert GNSS Spoofing of UAV Swarms: A Structural Blind Spot, Its Detection Limit, and Absolute-Anchor Defenses

reduces approximately 10.1 m of GNSS error to 0.39 m for nonanchored drones, and the rendered-vision multi-SITL experiment achieves a median recovery error of 7.1 cm under 3.2 m of drift. The remaining limits—non-collinear anchor geometry, anchor coverage, 𝜏 → 0 aliasing, and majority anchor compromise—are explicit rather than hidden assumptions.

References

(a) Eight-vehicle whole-swarm recovery (20 seeds)

(b) Vision-anchor coverage envelope (8 directions/point)

Figure 6: Closed-loop multi-SITL validation. (a) Under a common-mode covert spoof, GNSS drifts by ≈ 10.1 m while anchor-rooted recovery reconstructs all eight positions, including the four non-anchored drones, to a median error of at most 0.39 m (20 seeds, 4 anchors). (b) The Gazebo-rendered vision anchor maintains ≈ 6 cm tracking error within the fully covered region (below the ≈ 4 m boundary) and degrades sharply beyond it, as landmarks leave the field of view. The rendered-vision multi-SITL capstone (5 seeds) is evaluated within this measured operating envelope.

demonstrates detection scalability, not Byzantine-robust recovery throughput. Ethical considerations. This work is defense-oriented and introduces no offensive capability beyond publicly established results [6, 20, 38]. All experiments are simulated: no real GNSS signals are transmitted and no physical aircraft are flown, so there is no spectrum interference or flight-safety risk. We see no humansubjects concern.

11

Conclusion

Rigid common-mode GNSS spoofing exposes a structural blind spot in the relative-geometry channel used by the cooperative defenses we examine (Prop. 1). An independent absolute reference breaks this gauge freedom, and our anchor-rooted pipeline uses a trusted subset to recover the positions of the entire swarm, including nonanchored drones. We quantify the detector’s drift-dependent floor and use temporal estimation to separate anchor drift from a later change-point attack. In eight-vehicle ArduPilot SITL, the method

[1] ArduPilot Development Team. 2024. ArduPilot: Open Source Autopilot / Software-in-the-Loop (SITL). https://ardupilot.org. [2] James Aspnes, Tolga Eren, David K. Goldenberg, A. Stephen Morse, Walter Whiteley, Yang Richard Yang, Brian D. O. Anderson, and Peter N. Belhumeur. 2006. A Theory of Network Localization. IEEE Transactions on Mobile Computing 5, 12 (2006), 1663–1678. [3] Chakshu Baweja. 2026. A Conditional Timing Protection Level: Holdover-Limited Undetected Time Error Under GNSS Spoofing. arXiv:2606.24210 (2026). [4] Siguo Bi, Kai Li, Shuyan Hu, Wei Ni, Cong Wang, and Xin Wang. 2024. Detection and Mitigation of Position Spoofing Attacks on Cooperative UAV Swarm Formations. IEEE Transactions on Information Forensics and Security 19 (2024). arXiv:2312.03787. [5] Wenxin Chen, Yingfei Dong, and Zhenhai Duan. 2024. Impacts of a Single GPS Spoofer on Multiple Receivers: Formal Analysis and Experimental Evaluation. In Proc. IEEE Consumer Communications & Networking Conf. (CCNC). [6] Wenxin Chen, Yingfei Dong, and Zhenhai Duan. 2025. GPS Swarm Spoofing: Theoretical Analysis and Practical Solutions. In Proc. IEEE International Conference on Communications (ICC). Montreal, Canada. [7] Hongjun Choi, Sayali Kate, Yousra Aafer, Xiangyu Zhang, and Dongyan Xu. 2020. Software-based Realtime Recovery from Sensor Attacks on Robotic Vehicles. In Proc. RAID. 349–364. [8] Hongjun Choi, Wen-Chuan Lee, Yousra Aafer, Fan Fei, Zhan Tu, Xiangyu Zhang, Dongyan Xu, and Xinyan Deng. 2018. Detecting Attacks Against Robotic Vehicles: A Control Invariant Approach. In Proc. ACM CCS. 801–816. [9] Pritam Dash, Mehdi Karimibiuki, and Karthik Pattabiraman. 2019. Out of Control: Stealthy Attacks Against Robotic Vehicles Protected by Control-based Techniques. In Proc. ACSAC. 660–672. [10] Pritam Dash, Guanpeng Li, Zitao Chen, Mehdi Karimibiuki, and Karthik Pattabiraman. 2021. PID-Piper: Recovering Robotic Vehicles from Physical Attacks. In Proc. IEEE/IFIP DSN. 26–38. [11] Pritam Dash, Guanpeng Li, Mehdi Karimibiuki, and Karthik Pattabiraman. 2024. Diagnosis-guided Attack Recovery for Securing Robotic Vehicles from Sensor Deception Attacks. In Proc. ACM AsiaCCS. [12] Drew Davidson, Hao Wu, Rob Jellinek, Vikas Singh, and Thomas Ristenpart. 2016. Controlling UAVs with Sensor Input Spoofing Attacks. In USENIX WOOT. [13] Kapel Dev, Yash Madhwal, Sofia Shevelo, Pavel Osinenko, and Yury Yanovich. 2025. SwarmRaft: Leveraging Consensus for Robust Drone Swarm Coordination in GNSS-Degraded Environments. arXiv:2508.00622 (2025). [14] Anthony Finn, Mengjie Jia, Yanyan Li, and Jiawei Yuan. 2024. Detecting Stealthy GPS Spoofing Attack Against UAVs Using Onboard Sensors. In Proc. IEEE INFOCOM Workshops. [15] Martin A. Fischler and Robert C. Bolles. 1981. Random Sample Consensus: A Paradigm for Model Fitting with Applications to Image Analysis and Automated Cartography. Commun. ACM 24, 6 (1981), 381–395. [16] Jaron Fontaine et al. 2020. UWB Dataset from an Office, Industrial and University Environment. https://github.com/JaronFontaine/UWB-dataset-from-an-officeindustrial-and-university-environment. IDLab, Ghent University – imec. [17] Todd E. Humphreys, Brent M. Ledvina, Mark L. Psiaki, Brady W. O’Hanlon, and Paul M. Kintner. 2008. Assessing the Spoofing Threat: Development of a Portable GPS Civilian Spoofer. In Proc. ION GNSS. [18] Kai Jansen, Nils Ole Tippenhauer, and Christina Pöpper. 2016. Multi-Receiver GPS Spoofing Detection: Error Models and Realization. In Proc. Annual Computer Security Applications Conf. (ACSAC). 237–250. [19] Andrew J. Kerns, Daniel P. Shepard, Jahshan A. Bhatti, and Todd E. Humphreys. 2014. Unmanned Aircraft Capture and Control via GPS Spoofing. Journal of Field Robotics 31, 4 (2014), 617–636. [20] Amir Khazraei, Henry Meng, and Miroslav Pajic. 2024. Black-box Stealthy GPS Attacks on Unmanned Aerial Vehicles. In Proc. IEEE Conference on Decision and Control (CDC). arXiv:2409.11405. [21] Nathan Koenig and Andrew Howard. 2004. Design and Use Paradigms for Gazebo, an Open-Source Multi-Robot Simulator. In Proc. IEEE/RSJ IROS. 2149–2154. [22] Fanxin Kong, Meng Xu, James Weimer, Oleg Sokolsky, and Insup Lee. 2018. Cyber-Physical System Checkpointing and Recovery. In Proc. ACM/IEEE ICCPS. 22–31. [23] Heath J. LeBlanc, Haotian Zhang, Xenofon Koutsoukos, and Shreyas Sundaram. 2013. Resilient Asymptotic Consensus in Robust Networks. IEEE Journal on Selected Areas in Communications 31, 4 (2013), 766–781.

Park and Yoo

[24] Lifen Meng, Liang Zhang, Le Yang, and Wei Yang. 2023. A GPS-Adaptive Spoofing Detection Method for the Small UAV Cluster. Drones 7, 7 (2023), 461. [25] Giulia Michieletto, Francesco Formaggio, Angelo Cenedese, and Stefano Tomasin. 2023. Robust Localization for Secure Navigation of UAV Formations Under GNSS Spoofing Attack. IEEE Transactions on Automation Science and Engineering 20, 4 (2023), 2383–2396. [26] Carlos Murguia and Justin Ruths. 2016. Characterization of a CUSUM ModelBased Sensor Attack Detector. In Proc. IEEE 55th Conf. on Decision and Control (CDC). 1303–1309. [27] Pavlo Mykytyn, Marcin Brzozowski, Zoya Dyka, and Peter Langendoerfer. 2023. GPS-Spoofing Attack Detection Mechanism for UAV Swarms. arXiv:2301.12766 (2023). [28] Shoei Nashimoto, Daisuke Suzuki, Takeshi Sugawara, and Kazuo Sakiyama. 2018. Sensor CON-Fusion: Defeating Kalman Filter in Signal Injection Attack. In Proc. ACM AsiaCCS. 511–524. [29] Juhwan Noh, Yujin Kwon, Yunmok Son, Hocheol Shin, Dohyun Kim, Jaeyeong Choi, and Yongdae Kim. 2019. Tractor Beam: Safe-hijacking of Consumer Drones with Adaptive GPS Spoofing. ACM Transactions on Privacy and Security 22, 2 (2019), 1–26. [30] E. S. Page. 1954. Continuous Inspection Schemes. Biometrika 41, 1/2 (1954), 100–115. [31] Deepak Kumar Panda and Weisi Guo. 2025. Real-Time Bayesian Detection of Drift-Evasive GNSS Spoofing in Reinforcement-Learning-Based UAV Deconfliction. arXiv:2507.11173 (2025). [32] Fabio Pasqualetti, Florian Dörfler, and Francesco Bullo. 2013. Attack Detection and Identification in Cyber-Physical Systems. IEEE Trans. Automat. Control 58, 11 (2013), 2715–2729. [33] Mark L. Psiaki and Todd E. Humphreys. 2016. GNSS Spoofing and Detection. Proc. IEEE 104, 6 (2016), 1258–1270. [34] Raul Quiñonez, Jairo Giraldo, Luis Salazar, Erick Bauman, Alvaro Cárdenas, and Zhiqiang Lin. 2020. SAVIOR: Securing Autonomous Vehicles with Robust Physical Invariants. In Proc. USENIX Security Symposium. [35] Yunmok Son, Hocheol Shin, Dongkwan Kim, Youngseok Park, Juhwan Noh, Kibum Choi, Jungwoo Choi, and Yongdae Kim. 2015. Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors. In Proc. USENIX Security Symposium. 881–896. [36] Usman Tariq, Tariq Ahamed Ahanger, and Kamran Shaukat. 2026. Tri-stream Multi-model Architecture for Real-time Detection of BeiDou Signal Manipulation in UAV Swarms. Scientific Reports 16 (2026), 15802. doi:10.1038/s41598-026-46655y [37] Usman Tariq and Kamran Shaukat. 2026. Mission-aware BeiDou Spoofing Defense in UAV Swarms with LLM-assisted Context Validation. Frontiers in Communications and Networks 7 (2026), 1760543. doi:10.3389/frcmn.2026.1760543 [38] Christopher Tibaldo, Harshad Sathaye, Giovanni Camurati, and Srdjan Čapkun. 2025. GNSS-WASP: GNSS Wide Area SPoofing. In Proc. USENIX Security Symposium. [39] Nils Ole Tippenhauer, Christina Pöpper, Kasper B. Rasmussen, and Srdjan Čapkun. 2011. On the Requirements for Successful GPS Spoofing Attacks. In Proc. ACM CCS. 75–86. [40] Yazhou Tu, Zhiqiang Lin, Insup Lee, and Xiali Hei. 2018. Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors. In Proc. USENIX Security Symposium. 1545–1562. [41] Yuzhi Wang, Anqi Yang, Xiaoming Chen, Pengjun Wang, Yu Wang, and Huazhong Yang. 2017. A Deep Learning Approach for Blind Drift Calibration of Sensor Networks. IEEE Sensors Journal 17, 13 (2017), 4158–4171. arXiv:1707.03682. [42] Nian Xue, Liang Niu, Xianbin Hong, Zhen Li, Larissa Hoffaeller, and Christina Pöpper. 2020. DeepSIM: GPS Spoofing Detection on UAVs Using Satellite Imagery Matching. In Proc. ACSAC. 304–319. [43] Yingao Elaine Yao, Pritam Dash, and Karthik Pattabiraman. 2026. Framework for Discovering GPS Spoofing Attacks in Drone Swarms. arXiv:2606.00904 (2026). [44] Lin Zhang, Xin Chen, Fanxin Kong, and Alvaro A. Cárdenas. 2020. Real-time Attack-Recovery for Cyber-Physical Systems Using Linear Approximations. In Proc. IEEE RTSS. 205–217. [45] Lin Zhang, Pengyuan Lu, Fanxin Kong, Xin Chen, Oleg Sokolsky, and Insup Lee. 2021. Real-Time Attack-Recovery for Cyber-Physical Systems Using LinearQuadratic Regulator. ACM Transactions on Embedded Computing Systems 20, 5s (2021), 1–24. [46] Linfeng Zhong, T. Tang, R. Li, Z. Xia, and M. Tang. 2026. Enhancing the Resilience of UAV Networks against GPS Spoofing Attacks via Byzantine Distributed Detection Algorithm. Reliability Engineering & System Safety 269 (2026), 112101. doi:10.1016/j.ress.2025.112101

A

Open Science

In keeping with the ACM open-science policy, all code, configurations, summary data, and figure-generation scripts are released;

the artifact is publicly available at https://github.com/rokyp1278/ RigidShift. Tier-1 results are seed-fixed and byte-identical on a fixed dependency set, and reproducible to floating-point tolerance (≤ 10−13 relative) across NumPy/BLAS versions. Configurations, summary metrics, and figures are versioned and regenerated from committed result files by a single script; the ArduPilot/Gazebo recipe, the multi-vehicle harvest harness, and the closed-loop and multi-SITL walkthroughs are provided with the artifact. Detector code is shared across tiers via a common schema so synthetic and simulator data exercise identical logic.

B

Offline EKF-Innovation Monitor

The §1 claim that a non-geometric onboard channel can catch the covert ramp is supported by a purpose-built offline monitor over the per-drone EKF position-innovation sequence—an onboard-sensor detector in the spirit of [14], distinct from the autopilot’s built-in glitch/failsafe gate. The statistic is the gated peak of the smoothed absolute innovation; the threshold is calibrated at the 5% falsealarm quantile of the no-attack runs. On the Tier-2 ArduPilot SITL harvest it detects the common-mode covert ramp on 20/20 attack runs at every tested rate (2, 5, 10, 20 cm/s; Clopper–Pearson 95% CI [0.84, 1.0]). The corresponding held-out (leave-one-out) false alarm was 1/10 no-attack runs (10%, roughly double the 5% target)— a small-sample estimate with a wide finite-sample interval, and precisely the kind of unverifiable false-alarm burden a lone drone cannot escape. This is in any case a bare alarm: it recovers no true positions, which is the gap our anchor-rooted recovery fills. (A finer rate sweep down to 0.25 cm/s shows the monitor sits near its floor— 1/10 at 0.25 cm/s, 1/10 at 0.5 cm/s, 10/10 at 1.0 cm/s—whereas the anchor detector stays at 1.0 throughout.)

C

Supporting Figures and Analyses

For readability the main text keeps one representative number per result; the detailed curves, sweeps, and secondary experiments live here. All are produced using the same code and configurations as the main-text results and do not change any of the conclusions. Table 8 collects the secondary numbers the main text quotes once, each tagged with the experiment that produces it (standalone plots are in the artifact). Table 8: Secondary results quoted once in the main text, each with the experiment identifier that produces it in the artifact. Result

Value

Exp.

Heavy-tailed real-UWB recovery Back-loaded ramp time-to-detect Minimax bootstrap undetected drift Distribution-free certified floor 𝑣cert Realistic GNSS-WASP residual, rel.-channel det.

0.34 → 0.39 m, det. 1.0 5.9 → 33.4 s (5.7×) 4.80 → 0.36 m

e65 e32 e47

naive 4.0–10.0; bootstrap 5.0 cm/s 0.07 (1×) → 1.0 (500×)

e46 e9

Distribution-free detection certificate. For a calibrated anchor detector whose per-run score has mean 𝜇 (𝑣) and variance 𝜎 2 at threshold thr, a one-sided Cantelli (Chebyshev) inequality gives

Rigid-Covert GNSS Spoofing of UAV Swarms: A Structural Blind Spot, Its Detection Limit, and Absolute-Anchor Defenses

the distribution-free guarantee Pr[detect | 𝑣] ≥ 𝑎 2 /(𝜎 2 + 𝑎 2 ) with 𝑎 = 𝜇 (𝑣) − thr. Using conservative moment estimates (a mean lower and a variance upper confidence bound) yields a certified minimum detectable rate 𝑣 cert (Table 8); on disjoint held-out runs the certified bound was never violated.

Figure 9: Drift aliasing (attack 2 cm/s). Only anchor drift aligned with the attack (≈ 𝑣/2) masks a memoryless detector; anti-aligned drift does not, and orthogonal drift only partially.

Table 9: Per-frame runtime (ms, single core). Detection is flat in 𝑁 ; RANSAC robust recovery is the scaling cost. Figure 7: Combined ROC under the common-mode covert attack (20 cm/s, 𝑁 =8, 𝜌=0.5, 200 seeds/condition, bootstrap 95% CIs). Both existing relative detectors sit at chance (CI includes 0.5); our over-determined geometry and absolute anchor reach AUC 1.0 above 𝑣 ∗ .

Figure 8: Security index: the attacker’s undetectable ramp rate 𝑣 ∗ shrinks as the defender adds clean absolute references (10 → 6 cm/s realistic, down to 2 cm/s for an oracle); the oracle is a lower bound.

Stage

𝑁 =4

8

16

32

64

Detection (anchor score) Recovery (MDS, non-robust) Recovery (RANSAC robust)

0.013 0.003 0.002

0.016 0.043 0.15

0.013 0.063 1.61

0.019 0.47 15.3

0.018 0.94 139

Figure 10: Per-drone attribution AUC vs. attack magnitude, for 1–3 simultaneously spoofed drones (Tier-1). Attribution saturates at 1.0 only past an offset of ≈ 1.5 m and degrades toward chance for small offsets or more spoofed drones.

Park and Yoo

Figure 11: The covert-blind region is a single corner. (A) With no anchor (𝜌=0), any deformation 𝜀 ≥ 0.002 self-reveals through the relative channel, and the threshold tightens as the swarm grows (𝜀 ≥ 0.002 at 𝑁 =8, ≥ 0.001 at 𝑁 =16, ≥ 0.0005 at 𝑁 =32; 40 seeds, Wilson CIs). (B) Over the (𝜌, 𝜀) grid, detection is blind only at the exact corner (𝜌=0, 𝜀=0); a single anchor (𝜌=0.125) closes it across all 𝜀.

Figure 12: Attack vs. anchor-fault attribution (Caveat 1, predicted cause, 40 trials/row). (A) Homogeneous anchors leave a common-mode case ambiguous; (B) one heterogeneous modality attributes the common-mode GPS attack and anchor fault correctly. Figure 13: Closed-loop SITL flight (ArduPilot + Gazebo): GNSS-reported displacement stays at 0 while the drone’s simulated position drifts; the vision anchor tracks the true drift until its coverage is exceeded.

Rigid-Covert GNSS Spoofing of UAV Swarms: A Structural Blind Spot, Its Detection Limit, and Absolute-Anchor Defenses

Figure 14: Two anchor-failure modes. (a) Correlated (common-mode) anchor failure collapses detection from 1.0 to 0.17–0.36 as anchors increasingly fail together (0.17 at 10% co-failure), far sharper than independent dropout. (b) With a fixed anchor count, far-from-anchor recovery error grows with swarm size (dilution); adding a fourth anchor barely helps, so the anchor ratio governs recovery.

Figure 15: Range-graph sparsity (𝑁 =16, geodesic completion, 95% CIs). (A) Random ranging packet loss degrades recovery and eventually disconnects the graph. (B) Under a communication radius, recovery holds ≤ 0.5 m down to ≈ 35% range-graph density. All-pairs ranging is not required.

Related documents

• Evaluation and telemetry-based detection of GPS spoofing effects on UAV navigation using software-defined radio.#439269
• A Conditional Timing Protection Level: Holdover-Limited Undetected Time Error Under GNSS Spoofing#303157
• Spoofing Missed-Detection Bounds for PRF GNSS Ranging Authentication Under AWGN Models#1036582
• GNSS Spoofing Detection in TDD Networks: A 3GPP Standards-Based Security Framework#363169
• IriSig-Spoof: A Real-World Benchmark for Time-Robust Satellite RF Fingerprinting and Spoofing Detection#467081