Feasible but Not Safe: Constraint Violations and Report-Channel Attacks in Learned Cell-Free ISAC Association
Mehdi Zafari, Iman Mohammadi, A. Lee Swindlehurst
cs.NI · cs.LG · eess.SP
Quick verdict
Learned ISAC schedulers hit high F1 yet ~70-74% plans infeasible; projection repairs cheaply, constraint FDI survives it. Sound audit, small topology.
Summary
This workshop paper (ACM S3 '26) audits the feasibility and security of learned resource association in cell-free ISAC, using the authors' own ASSENT scheduler — a heterogeneous GNN trained on MILP labels with hard constraints as soft penalties — as the test system. In an 8-AP, 10-user, 4-target topology with 156 binary decisions, despite per-decision F1 of at least 0.84, 73.5% of GATv2 plans (69.2% NNConv, 72.8% TransformerConv) violate at least one hard constraint, dominated by RF-chain budget breaches (54-58%). An L1-nearest-feasible projection formulated as an exact ILP restores legality while retaining 99.95% of the MILP objective (paired 95% CI on degradation [0.04%, 0.11%]); a greedy repair retains 99.91%. On security, a single malicious AP inflating its own reports up to 32× gains almost nothing (at most 0.2 extra served users), but sabotage is easy: under-reporting interference raises infeasibility from 73% to 84% and falsified sensing strength to 96%. Projection fully neutralizes objective-corrupting lies but leaves 12% of plans physically infeasible when constraint-defining quantities are falsified; a MAD-based cross-AP consistency check detects the attacker about 99.5% of the time (~1% false alarms), cutting residual breakage to 4%. Main limitations: a single small topology, a non-adaptive attacker, and evaluation only on the authors' own scheduler; code is publicly released.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
4 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Despite per-decision F1 of at least 0.84 across all five outputs, the learned ASSENT scheduler produces plans violating at least one hard constraint in 69.2-73.5% of cases (73.5% for GATv2).
- Nearest-feasible projection (exact ILP) or even greedy repair restores constraint satisfaction at almost no cost: 99.95% / 99.91% of the MILP objective retained, degradation CI [0.04%, 0.11%].
- FDI attacks that corrupt only objective coefficients are fully neutralized by feasibility projection, whereas attacks falsifying constraint-defining quantities are not — projection then enforces a wrong feasible set, leaving 12% of plans physically infeasible.
- A single malicious AP cannot meaningfully steal resources (at most 0.2 extra served users even with 32x report inflation) but can raise plan infeasibility to 84-96% through sabotage.
- A low-complexity MAD-based cross-AP consistency check detects the interference-lie attacker ~99.5% of the time (~1% false alarms), reducing residual breakage from 12% to 4%.
Strengths
Quantified feasibility audit with a crisp metric-decoupling argument
Sec. 3 shows 73.5% of GATv2 plans violate at least one hard constraint despite per-decision F1 >= 0.84, and the 1/156-flip demonstration (adding one excess link keeps F1 at 0.995 while 93% of plans become illegal) precisely explains why per-decision metrics hide joint infeasibility.
Principled attack taxonomy matched to defenses
Sec. 4 splits FDI attacks by what they corrupt: projection fully cancels the 96% sensing attack (0% of corrected plans illegal) because constraints never read the falsified quantity, but leaves 12% physically infeasible under interference lies — an actionable design rule, not just an attack demo.
Low-cost defenses validated with concrete numbers
Transparency and reproducibility
Weaknesses
Single tiny topology
Non-adaptive attacker
Detector evaluated under favorable assumptions
Generality beyond the authors' own system
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This is a short empirical audit (ACM S3 '26 workshop; arXiv 2609.03147) of learned association scheduling in cell-free integrated sensing and communication (ISAC). The system under test is ASSENT [16], the authors' own ICC 2026 scheduler: a heterogeneous GNN (GATv2 / NNConv / TransformerConv) trained on MILP labels where hard constraints act only as soft penalties, and each of 8 APs self-reports low-dimensional statistics to a central server. The paper makes two linked claims: (1) high per-decision accuracy (F1 at least 0.84 across all five outputs) coexists with joint infeasibility in 69.2-73.5% of plans; (2) feasibility repair does not imply robustness to false data injection (FDI) through the self-reporting channel. The framing is appropriately modest — an empirical audit of standard techniques (soft-penalty training, post-hoc projection), not a new architecture.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 4 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What does the paper Feasible but Not Safe show about GNN-based ISAC schedulers?
It shows that a graph neural network scheduler for cell-free ISAC (the ASSENT system) can score very high per-decision accuracy (F1 of at least 0.84) while still producing resource-allocation plans that violate hard physical constraints in about 69-74% of cases, mainly by exceeding RF-chain budgets. Projecting the network output onto the nearest feasible plan fixes this at a cost of under 0.1% in objective value.
Can a malicious access point attack a learned ISAC scheduler by lying in its reports?
Yes, but mainly by sabotage rather than theft. Inflating its own reported channel gains up to 32 times gains the attacker almost nothing (at most 0.2 extra served users). Under-reporting interference or faking sensing strength, however, raises the share of infeasible plans from 73% to 84-96%. Lies that corrupt objective-related data are canceled by feasibility projection; lies that corrupt constraint-defining data are only partially mitigable and need a cross-AP consistency check.
How does the paper detect false reports from access points?
It exploits redundancy: in the assumed symmetric AP topology, many APs report interference for the same user pairs, and a genuinely clashing pair looks correlated to many of them. Any AP whose value falls more than one median absolute deviation below the group median is flagged. This catches a single lying AP about 99.5% of the time with about 1% false alarms, cutting residual infeasibility from 12% to 4%.
Is the code for the ASSENT security analysis available?
Yes. The authors state that source code, evaluation scripts, and replication data are publicly available at github.com/LS-Wireless/ASSENT-Security-Analysis (linked in footnote 1 of the paper).
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure images were not available in the extraction; numeric values cited from Figs. 1-3 rely on their embedded captions and in-text discussion.
- The lie-size axis labeled k (Figs. 2-3) has units not defined in the extracted text; superscripts were likely lost in PDF extraction — the sweep is unambiguously described in prose only as scaling up to 32x.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.