From Pilot to Precoding Design: Blind Angular Spoofing For Location Privacy in MIMO Systems

1. Problem Statement

The paper addresses the critical issue of location privacy in modern cellular systems, specifically within Uplink MIMO (Multiple-Input Multiple-Output) environments.

• Context: Modern Base Stations (BS) utilize large antenna arrays and wide bandwidths to estimate user positions by extracting geometric channel features, such as Time of Arrival (ToA), Angle of Arrival (AoA), and Angle of Departure (AoD).
• Threat: An unauthorized or malicious BS can infer a User Equipment's (UE) precise location without consent.
• Limitation of Existing Solutions: Previous privacy mechanisms often rely on the UE having partial Channel State Information (CSI) to optimize transmission. However, in adversarial scenarios where the BS is untrusted, the UE cannot obtain accurate CSI. Furthermore, existing "blind" (CSI-free) spoofing methods, such as pilot-based approaches, lack sufficient control over the angular geometry perceived by the receiver, often resulting in an error floor where spoofing accuracy cannot be improved regardless of signal power.
• Goal: The authors aim to design a blind analog precoder that allows a UE to manipulate the perceived AoA/AoD configuration at the BS to a desired "spoofed" location, without knowing the true channel gains, while maintaining communication functionality.

2. Methodology

The proposed solution involves designing time-varying analog precoders that force the received signal to be consistent with a target false angular subspace.

A. System Model

• Setup: A narrowband uplink system with an $N_r$-antenna BS and an $N_t$-antenna UE.
• Channel: Modeled with $L$ paths (1 Line-of-Sight + $L-1$ Non-Line-of-Sight). The channel is frequency-flat.
• Operation: The UE transmits pilot symbols using a precoding sequence ($f_m$) that changes per symbol, while the BS uses a fixed combiner ($w_s$) per measurement block.
• Adversarial Model: The UE replaces the nominal precoder with adaptive precoders ($\tilde{f}_{s,m}$) to make the BS estimate a false set of angles ($\bar{\rho}$) instead of the true angles ($\rho$).

B. Mathematical Formulation

The core objective is to ensure the received signal $y$ induced by the spoofing precoders lies within the observation subspace spanned by the target angles.

• Condition for Perfect Spoofing: The range of the matrix formed by the spoofing precoders and true channel must be a subset of the range of the matrix formed by the nominal precoders and target angles:
  $$\mathcal{R}(Z(\{\tilde{F}_s\}, \rho)) \subseteq \mathcal{R}(Z(F, \bar{\rho}))$$
• Optimization Problem: Since the true channel gain ($\alpha$) is unknown, the problem is formulated as minimizing the distance between the spoofed signal and a target signal generated by an equivalent channel gain ($\lambda$), subject to analog precoding constraints (constant modulus or amplitude limits per antenna element):
  $$\min_{\{\tilde{F}_s\}, d, \lambda} \sum_{s=1}^S \| Z_s(\{\tilde{F}_s\}, \bar{\rho})d - Z_s(F, \bar{\rho})\lambda \|^2$$
  Subject to amplitude constraints $|\tilde{f}_{s,m}(i)| \leq 1/\sqrt{N_t}$.

C. Solution Algorithm: Alternating Optimization

The problem is non-convex. The authors propose an Alternating Optimization (AO) algorithm using Block Coordinate Descent to solve for three variables iteratively:

1. Precoder Update ($\tilde{F}_s$): For fixed $d$ and $\lambda$, the problem separates across measurement indices and symbols. The optimal phase aligns with the target, and the optimal amplitude is found via a bisection method to satisfy the power constraint.
2. Auxiliary Variable Update ($d$): Solved via Least Squares (LS).
3. Equivalent Gain Update ($\lambda$): Solved via LS, with a projection step if the power constraint is violated.

• Convergence: The algorithm is proven to monotonically decrease the objective function, guaranteeing convergence.
• Complexity: The proposed method has a complexity of $O(SMN_t)$, which is computationally efficient compared to pilot-based designs ($O(SML^2 + L^3)$).

3. Key Contributions

1. Blind Angular Spoofing Formulation: The paper formulates the problem of manipulating the perceived angular signature without CSI, specifically targeting the angular component of localization in multipath environments.
2. Analog Precoder Design: Unlike previous pilot-only methods, this approach leverages the spatial degrees of freedom provided by analog precoding to reshape the observation subspace, offering direct control over the spoofed geometry.
3. Efficient Optimization: Development of an alternating optimization algorithm that solves the constrained non-convex problem under practical amplitude constraints (phase shifters and attenuators).
4. Performance Analysis: Numerical demonstration that the proposed method achieves near-perfect spoofing accuracy, significantly outperforming pilot-only blind spoofing which suffers from an error floor.

4. Simulation Results

The authors evaluated the method using Monte Carlo simulations in a multipath scenario (BS and UE with specific orientations and scatterers).

• Spoofing Accuracy:
  • Proposed Method: Achieved near-perfect alignment between the desired spoofed location and the estimated peaks at the BS. The Root Mean Square Error (RMSE) for AoA and AoD decayed toward zero as transmit power increased.
  • Baseline (Pilot-only): Exhibited a significant error floor. The BS failed to resolve the intended spoofed angles correctly, indicating insufficient control over the spatial signature.
• Trade-off (Privacy vs. Communication):
  • The paper highlights a fundamental trade-off between spoofing accuracy and achievable communication rate.
  • When the spoofed location requires a "weak" channel direction (unfavorable geometry), the communication rate drops because spatial degrees of freedom are consumed to enforce the false geometry.
  • However, if the spoofed location aligns with favorable channel conditions, the rate remains close to the "No Spoof" baseline.
  • Pilot-based spoofing is less sensitive to the spoofed location but offers poor privacy protection.

5. Significance and Conclusion

• Privacy Enhancement: The study demonstrates that geometry-aware, CSI-blind precoding is a far superior mechanism for location privacy compared to pilot manipulation. It allows UEs to effectively deceive localization algorithms even when the adversary is untrusted and the UE lacks channel knowledge.
• Practical Implications: The work validates that analog precoding (common in mmWave MIMO) provides the necessary spatial degrees of freedom to manipulate angular signatures.
• Future Directions: The authors suggest extending this design to multicarrier systems, incorporating hardware imperfections, and analyzing robust countermeasures against such blind spoofing in multi-BS localization networks.

In summary, this paper bridges the gap between theoretical privacy mechanisms and practical MIMO constraints, proving that intelligent analog precoding can effectively "hide" a user's true location by fabricating a convincing false angular signature.