Feasible but Not Safe: Constraint Violations and Report-Channel Attacks in Learned Cell-Free ISAC Association

Feasible but Not Safe: Constraint Violations and Report-Channel Attacks in Learned Cell-Free ISAC Association Mehdi Zafari

arXiv:2609.03147v1 [cs.NI] 2 Sep 2026

University of California Irvine Irvine, CA, USA

Iman Mohammadi

University of California Irvine Irvine, CA, USA

A. Lee Swindlehurst

University of California Irvine Irvine, CA, USA

Abstract

1

Learning-based schedulers have been proposed to provide real-time user, target, and access point (AP) association in distributed cell-free integrated sensing and communication systems. In a typical approach, a graph neural network (GNN), trained on labels from a mixed-integer linear program, maps lightweight per-AP statistics to decisions on AP clustering, user and target scheduling, and mode selection in one forward pass. Such solutions assume that hard constraints, enforced only as soft training penalties, hold at inference, and that the self-reported statistics are truthful. Using our ASSENT algorithm as an example, we find that despite high 𝐹 1 scores, many solutions violate at least one hard constraint, demonstrating that high prediction accuracy does not ensure joint feasibility. Projecting the GNN output onto a feasible solution restores constraint satisfaction with low utility loss, even with a simple greedy repair procedure. We further show that feasibility alone does not guarantee robustness to false data injection attacks. A single malicious AP that reports false information cannot substantially increase its user associations, but can greatly increase the rate of infeasible solutions. The effect of such attacks depends on the type of information being falsified. Misreporting information that affects the objective can largely be mitigated through feasibility projection, whereas falsifying information that affects the constraints cannot. The latter can, however, be detected using a low-complexity cross-AP consistency check. These results show that learned ISAC schedulers should be evaluated using constraint-aware feasibility metrics in addition to conventional accuracy measures.

Cell-free architectures, introduced to manage interference and increase spectral efficiency for wireless communications [11], are being considered for integrated sensing and communication (ISAC) [3, 8], where a large number of access points (APs) cooperate to serve users and to illuminate and sense targets. A core control task is association: deciding, per resource block, which APs serve which users, which APs illuminate or receive echoes from which targets, and in which mode each AP operates, subject to radio frequency (RF) chain budgets, interference limits, and fronthaul constraints. The association optimization task can be formulated as a mixed-integer linear program (MILP) [1, 10, 16], which is prohibitive to solve per slot at scale. To overcome this computational bottleneck, we adopt a learning-to-optimize framework in which a graph neural network (GNN) learns from offline MILP solutions, allowing the system to bypass the exact solver using a single forward pass during inference [5, 14]. The ASSENT scheduler [16] is a representative example of such a solution, where each AP reports only low-dimensional statistics (average channel gains, inter-user correlations, sensing features) and a heterogeneous GNN maps them to the optimal association. This design is lightweight, but its efficiency rests on two fragile assumptions. First, hard constraints (e.g., RF budgets, half-duplex limits, etc.) act only as soft training penalties; at inference, the GNN thresholds continuous probabilities into discrete binary decisions on a per-variable basis, bypassing any explicit verification of joint feasibility. Second, the central server (CS) cannot audit the statistics each AP reports, enabling malicious false data injection (FDI). Thus, the inferred association decisions may lack both physical feasibility and operational trustworthiness. Using the ASSENT approach in [16], we show these vulnerabilities are inextricably linked. Rather than proposing a new architecture, we present the following empirical study:

Keywords cell-free ISAC, graph neural networks, learning to optimize, feasibility, false data injection, 6G, wireless security

©2026 Copyright held by the author(s). This is the author’s version of the work. It is posted here for your personal use. Not for redistribution. The definitive Version of Record was published in ACM S3 ’26, https://doi.org/ 10.1145/3842433.3843753.

Introduction

• The high-accuracy learned ASSENT ISAC scheduler produces infeasible plans for approximately 70% to 74% of its solutions. We explain why per-decision metrics obscure this and why constraint satisfaction is a necessary evaluation metric (Sec. 3).

Although using soft-penalty constraints and post-hoc projection mechanisms to enforce rule compliance is standard practice in the machine learning optimization literature [4, 7], our primary contribution is conducting an empirical audit of these techniques on a practical, distributed ISAC scheduler. Importantly, we move beyond benign operational errors to establish a connection between a system’s baseline feasibility and its susceptibility to targeted security threats. Furthermore, while existing literature extensively covers traditional adversarial attacks against wireless models [6, 9, 13] and robust training defenses [2, 17], we investigate a fundamentally different threat vector. Specifically, we expose the distinct runtime vulnerabilities that emerge when a central server must rely on unverified, self-reported channel and sensing statistics from potentially dishonest access points.

2

Background and Threat Model

Learned association. We adopt the configuration assumed in ASSENT [16]: 8 APs (4 RF chains each), 10 users, and 4 targets. Each AP reports local statistics, including communication gains, a user-to-user interference table, and sensing channel estimates. A heterogeneous GNN processes these reports to output the AP mode 𝜏, AP-user association 𝑥, target scheduling 𝑠, and transmit/receive AP-target links 𝑦 tx, 𝑦 rx . This network is trained to imitate MILP-optimal labels, including the hard constraints as soft penalties during training. Hard rules. Formally, a generated association plan is strictly feasible if and only if it resides within the feasible set F defined by the MILP formulation. Specifically, we evaluate the association for satisfying the following physical constraints: APs may serve users or illuminate targets only in transmit mode, and receive echoes only in receive mode; the sum of served users and transmit targets at an AP cannot exceed its number of RF chains; no user pair with a reported correlation exceeding 𝜌 th is co-served; each scheduled target is assigned at least one transmitting and one receiving AP;

1 Source code, evaluation scripts, and replication data are publicly available

at https://github.com/LS-Wireless/ASSENT-Security-Analysis.

1.00

100

0.95

50

per-decision F1 plans illegal 0.90

0

1

2

3

5

extra links added to the optimal plan

8

0

% of plans illegal mean objective value

• Restoring feasibility is nearly free in terms of utility. A nearest-feasible projection, or even a greedy repair, changes the optimization objective by less than 0.1% across the communication-sensing trade-off (Sec. 3). • The impact of a false data injection (FDI) attack depends fundamentally on the manipulated parameters. We demonstrate that projection mechanisms naturally neutralize attacks targeting the scheduling objective, whereas attacks falsifying physical constraints require a distributed cross-AP consistency check (Sec. 4).1

mean per-decision F1

Mehdi Zafari, Iman Mohammadi, and A. Lee Swindlehurst

4.30 4.29

4.286 100%

4.293 INVALID

4.284 99.95%

4.282 99.91%

ILP projection

greedy repair

4.28 4.27 4.26

MILP (optimum)

raw GNN

Figure 1: Feasibility of the learned scheduler (GATv2). Left: 𝐹 1 is blind to joint legality; adding one excess link keeps 𝐹 1 = 0.995 while 93% of plans become illegal. Right: Exact ILP projection and greedy repair remain within 0.1% of the MILP optimum; raw GNN scores are higher only due to illegal constraint violations. and conversely, if a target is not scheduled, no AP may illuminate or listen for its echo.2 Validating this exact checker on 1000 MILP-optimal plans, it correctly reports zero violations. Threat model. The CS cannot directly audit per-AP reports. A single malicious AP 𝑎★ can alter only its own reported statistics (gains, correlations, and sensing features) prior to processing. The CS constructs the global plan based on these potentially falsified reports, and we measure the downstream impact on the true, uncorrupted channel. We sweep the attacker position across 𝑎★ ∈ {0, 3, 6} since the resources an AP can acquire depend heavily on the network geometry. To establish a worst-case baseline, we allow the attacker to scale its reported values up to 32×, acknowledging that while this demonstrates vulnerability, such unclipped extremes might be readily filtered as out-of-distribution anomalies in practical deployments.

3

Good Scores, Broken Rules

High accuracy hides infeasibility. ASSENT’s per-decision 𝐹 1 is high (at least 0.84 across all five outputs). Yet, 73.5% of the association results generated by the baseline Graph Attention Network (GATv2) violate at least one constraint (69.2% and 72.8% for the alternative NNConv and TransformerConv graph layers, respectively). The dominant violation is the RF-chain budget (54% to 58% of plans, since nothing counts the number of AP RF chains at inference), followed by co-serving interfering users (20% to 26%) and mode errors (18% to 20%). Why 𝐹 1 is blind. Standard classification metrics such as the 𝐹 1 score evaluate individual assignments independently, whereas system feasibility is a joint property of the global resource allocation. From the optimal plans (𝐹 1 =1, all legal), adding one random excess link keeps 𝐹 1 at 0.995 yet makes 93% of plans illegal (Fig. 1, left). With exactly 𝐷 = 156 binary choices per plan in this setup, flipping one moves the score 2 Specifically, we strictly evaluate constraints (7c) through (7k) from the ASSENT MILP [16]. Optional capacity caps (7l) to (7n) are excluded.

2

attacker = AP 0 attacker = AP 3 attacker = AP 6

1

0

20

21

22

23

24

25

4.0

3.5

3.0

lie size k

20

21

22

23

25

24

lie size k

90

80

interference lie (1 AP) sensing lie (1 AP) interference lie (2 APs)

70 20

21

22

23

lie size k

24

25

% still illegal (or caught)

3

100 RF-chain budget = 4

% of plans broken (illegal)

users the attacker serves

4

radio chains the attacker uses

Feasible but Not Safe: Constraint Violations and Report-Channel Attacks in Learned Cell-Free ISAC Association 100

75

rule fix only + cross-AP check cheater caught (%)

50

25

0 20

21

22

23

24

25

lie size k

Figure 2: Signal FDI attack (steal variant) across three AP positions over the test set. Left: served users increase by at most 0.2 even at 32× inflation. Right: the attacker acquires minimal extra radios (budget 4). Position variances stem from the symmetric deployment geometry relative to random users, not the GNN.

Figure 3: Left: Report manipulations severely degrade system feasibility; sensing inflation and two-AP collusions are most disruptive. Right: Against the interference attack, projection leaves 12% of plans physically infeasible; the cross-AP check detects the attacker (99.5% accuracy) and reduces the residual error to 4%.

by only 1/𝐷 but can break legality outright; with 𝐷 in the hundreds, the metrics decouple. A symptom appears in the baseline’s performance results, where the raw GNN appears to beat the MILP optimum (4.293 vs. 4.286).3 This is not a real gain, since an illegal plan scores higher only by ignoring the rules it breaks, and the phantom gain vanishes once the plan is made legal. Restoring feasibility has negligible utility loss. Treating the network outputs as confidences 𝑝 𝑣 , we formulate the 𝐿1 -nearest feasible plan as: ∑︁ max (2𝑝 𝑣 − 1) 𝑣 tx rx

FDI attack has already steered the GNN, meaning it cannot universally neutralize report-channel manipulations. Stealing is hard, breaking is easy. Inflating the reported signal by attacker to acquire resources is ineffective (Fig. 2): across all three positions, all GNN backbone layers, and scaling up to 32×, the attacker’s served users increase by at most 0.2 (e.g., AP0 from 1.57 to 1.60). A greedy user-targeting heuristic performs no better, likely because gains are normalized relative to each AP’s local range, making the assignment a joint choice over all nodes. Conversely, sabotage is highly effective. Under-reporting interference, falsely indicating to the CS that it is safe to co-serve mutually interfering users, pushes the proportion of infeasible associations from 73% to 84%. Falsifying sensing strength drives infeasibility to 96% while enabling the attacker to monopolize target illumination links (averaging an increase from 0.7 to 1.1 allocated links), and two colluding APs reach 91%. At 96% illegal, almost every inference requires an operational fallback, creating a substantial reliability risk [16]. What an attack corrupts dictates the defense. Let Π F (𝑝) denote the projection (1). If an FDI attack corrupts only objective coefficients (e.g., sensing gains), F remains unchanged and Π F restores legality against the true physical rules: even the 96% sensing attack is fully canceled (0% of corrected plans break a rule) because the constraints never read the falsified quantity. If the attack corrupts a quantity that defines a constraint (e.g., interference values in the noclash rule), F itself is falsified. Consequently, Π F enforces the wrong feasible set: about 12% of the mathematically "legal" plans still violate a rule in physical reality, and the attacker (e.g., AP 0 under GATv2) is pushed back only from 1.5 to 1.3 users. Thus, projection fully neutralizes an attack that cannot alter the feasible set, but only partially mitigates one that falsifies the constraints. A cross-AP consistency check. Assuming a symmetric AP topology [16], AP reports contain inherent redundancy: every AP reports interference for the same user pairs, and a genuinely clashing pair appears correlated to many APs.

𝑥,𝜏,𝑠,𝑦 ,𝑦 ∈ {0,1}

s.t.

𝑣

(𝑥, 𝜏, 𝑠, 𝑦 tx, 𝑦 rx ) ∈ F ,

(1)

which is an exact integer linear program (ILP) with F representing the feasible set defined in Sec. 2. This is legal by construction, so the headline is the utility cost, which is small and steady (Fig. 1, right). The projection retains 99.95% of the true MILP scheduling objective for GATv2 (99.98% for the others), with the objective degradation averaging 0.06% across the entire communication-sensing Pareto frontier (per-instance paired 95% CI: [0.04%, 0.11%]). The network’s mistakes are small, i.e., an invalid plan results in only 1.17 excess links on average. Thus, a trivial greedy repair, which iteratively deletes the lowest-confidence offending choices to resolve capacity/clash violations and greedily adds the highest-confidence links to resolve target-coverage gaps, retains 99.91% of the objective, performing within 0.03% to 0.10% of the exact ILP projection. The diagnosis of the gap, rather than the repair itself, is the primary contribution.

4

Legal Is Not Safe: Vulnerabilities to FDI

A feasible association is not inherently secure: the nearestfeasible projection introduced in Sec. 3 operates after an 3 Our raw GNN objective of 4.293 differs slightly from the 4.311 reported

in [16] because we evaluate on a fresh test seed to obtain paired confidence instances, holding the MILP baseline constant.

Mehdi Zafari, Iman Mohammadi, and A. Lee Swindlehurst

The server can flag any AP whose interference falls more than one median absolute deviation (MAD) below the group median, lifting the flagged values toward the group utilizing only reported data. With a fixed threshold, this catches the attacker ∼ 99.5% of the time (99% to 100% range) with ∼ 1% false alarms, cutting the residual broken share from 12% to 4% (Fig. 3). It effectively bounds the attacker: a large lie is almost always caught, while a small lie evades detection but barely perturbs the system.

5

Discussion and Conclusion

Conclusion. Evaluating learned cell-free ISAC schedulers requires constraint-aware metrics, as high per-decision accuracy often masks severe joint infeasibility. While posthoc projection efficiently restores physical feasibility with near-zero utility loss, enforcing legality does not inherently guarantee security. Crucially, the effectiveness of projection against false data injection (FDI) depends entirely on the attacker’s target: lies that corrupt the scheduling objective are neutralized, whereas lies that falsify the underlying physical constraints weaponize the repair mechanism itself. Scope and Limitations. While these findings are consistent across multiple GNN backbones, our empirical evaluation is bounded by the topology of the released system (8 APs, 10 users, 4 targets). Evaluating larger networks requires computationally heavy exact solvers to generate new training labels, so verifying scalability remains future work. Toward Feasible and Trustworthy Association. Resolving these vulnerabilities requires moving beyond posthoc repairs. At the model level, constraint-aware decoding [4, 12] could force the GNN to emit inherently feasible plans, eliminating baseline violations at their source. At the system level, implementing robust, multi-agent verification checks [2, 17] is necessary to harden the reporting channel against sophisticated or colluding attackers. Ultimately, these MAC-layer insights motivate a secure PHY-MAC co-design, where a robust, feasibility-aware associator reliably feeds legal, trustworthy schedules to a coordinated PHY-layer resource allocator [15].

References [1] Luis F. Abanto-Leon and Setareh Maghsudi. 2025. Optimal User and Target Scheduling, User-Target Pairing, and Low-Resolution PhaseOnly Beamforming for ISAC Systems. IEEE Transactions on Vehicular Technology 74, 6 (2025), 9888–9893. doi:10.1109/TVT.2025.3532915 [2] Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. 2017. Machine learning with adversaries: byzantine tolerant gradient descent. In Proceedings of the 31st International Conference on Neural Information Processing Systems (Long Beach, California, USA) (NIPS’17). Curran Associates Inc., Red Hook, NY, USA, 118–128. [3] Umut Demirhan and Ahmed Alkhateeb. 2025. Cell-Free ISAC MIMO Systems: Joint Sensing and Communication Beamforming. IEEE Transactions on Communications 73, 6 (2025), 4454–4468. doi:10.1109/

TCOMM.2024.3490740 [4] Priya L. Donti, David Rolnick, and J Zico Kolter. 2021. DC3: A learning method for optimization with hard constraints. In International Conference on Learning Representations. https://openreview.net/forum? id=V1ZHVxJ6dSS [5] Peng Jiang, Ming Li, Rang Liu, and Qian Liu. 2026. Graph Learning for Cooperative Cell-Free ISAC Systems: From Optimization to Estimation. IEEE Transactions on Wireless Communications 25 (2026), 13992–14008. doi:10.1109/TWC.2026.3674789 [6] Thanh Le, Hai Duong, Yusheng Ji, ThanhVu Nguyen, and John C. S. Lui. 2026. FGGM: Formal Grey-box Gradient Method for Attacking DRL-based MU-MIMO Scheduler. arXiv:2510.26075 [cs.NI] https: //arxiv.org/abs/2510.26075 [7] Enming Liang, Minghua Chen, and Steven H. Low. 2024. Homeomorphic Projection to Ensure Neural-Network Solution Feasibility for Constrained Optimization. Journal of Machine Learning Research 25, 329 (2024), 1–55. http://jmlr.org/papers/v25/23-1577.html [8] Fan Liu, Yuanhao Cui, Christos Masouros, Jie Xu, Tony Xiao Han, Yonina C. Eldar, and Stefano Buzzi. 2022. Integrated Sensing and Communications: Toward Dual-Functional Wireless Networks for 6G and Beyond. IEEE Journal on Selected Areas in Communications 40, 6 (2022), 1728–1767. doi:10.1109/JSAC.2022.3156632 [9] B. R. Manoj, Meysam Sadeghi, and Erik G. Larsson. 2021. Adversarial Attacks on Deep Learning Based Power Allocation in a Massive MIMO Network. In ICC 2021 - IEEE International Conference on Communications. 1–6. doi:10.1109/ICC42927.2021.9500424 [10] Ebubekir Memisoglu, Muhammad Bilal Janjua, and Hüseyin Arslan. 2024. Power-Efficient Time-Domain Scheduling for ISAC Beamforming. IEEE Wireless Communications Letters 13, 10 (2024), 2837–2841. doi:10.1109/LWC.2024.3448528 [11] Hien Quoc Ngo, Alexei Ashikhmin, Hong Yang, Erik G. Larsson, and Thomas L. Marzetta. 2017. Cell-Free Massive MIMO Versus Small Cells. IEEE Transactions on Wireless Communications 16, 3 (2017), 1834–1850. doi:10.1109/TWC.2017.2655515 [12] Bo Tang, Elias B. Khalil, and Jan Drgona. 2025. Learning to Optimize for Mixed-Integer Non-linear Programming with Feasibility Guarantees. arXiv:2410.11061 [cs.LG] https://arxiv.org/abs/2410.11061 [13] Shuchang Tao, Qi Cao, Huawei Shen, Junjie Huang, Yunfan Wu, and Xueqi Cheng. 2021. Single Node Injection Attack against Graph Neural Networks. In Proceedings of the 30th ACM International Conference on Information & Knowledge Management (Virtual Event, Queensland, Australia) (CIKM ’21). Association for Computing Machinery, New York, NY, USA, 1794–1803. doi:10.1145/3459637.3482393 [14] Zihuan Wang and Vincent Wong. 2024. Heterogeneous Graph Neural Network for Cooperative ISAC Beamforming in Cell-Free MIMO Systems. In Proceedings of the 30th Annual International Conference on Mobile Computing and Networking (Washington D.C., DC, USA) (ACM MobiCom ’24). Association for Computing Machinery, New York, NY, USA, 2161–2172. doi:10.1145/3636534.3698223 [15] Mehdi Zafari, Rang Liu, and A. Lee Swindlehurst. 2025. Coordinated Decentralized Resource Optimization for Cell-Free ISAC Systems. In 2025 59th Asilomar Conference on Signals, Systems, and Computers. 912–917. doi:10.1109/IEEECONF67917.2025.11443385 [16] Mehdi Zafari and A. Lee Swindlehurst. 2026. ASSENT: LearningBased Association Optimization for Distributed Cell-Free ISAC. In ICC 2026 - IEEE International Conference on Communications. 1–6. doi:10.1109/ICC59461.2026.11588026 [17] Xiang Zhang and Marinka Zitnik. 2020. GNNGUARD: defending graph neural networks against adversarial attacks. In Proceedings of the 34th International Conference on Neural Information Processing Systems (Vancouver, BC, Canada) (NIPS ’20). Curran Associates Inc., Red Hook, NY, USA, Article 777, 13 pages.

Related documents

• 15 U.S.C. § 78o-3 — Registered securities associations#567594
• Geometric Data Perturbation with Noisy-Anchor Alignment for Privacy-Preserving Collaborative Learning#1156448
• CVE-2026-82761 — CRITICAL 9.1#1001399
• AIM: Anchor Identity Features, Then Match for Multimodal Large Language Model Unlearning#792325
• AIM: Anchor Identity Features, Then Match for Multimodal Large Language Model Unlearning#788325