⚡ electrical engineering

SNF-PRP: A Covert Integrating Sensing and Communications Framework

This paper introduces SNF-PRP, a covert Integrated Sensing and Communications framework for OFDM systems that utilizes sub-noise-floor pseudo-random probing and spreading gain to achieve undetectable sensing with high accuracy while satisfying strict covertness constraints against energy-detection adversaries.

Original authors: Dhrumil Bhatt, Vidushi Kumar

Published 2026-06-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Dhrumil Bhatt, Vidushi Kumar

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to listen to a secret conversation in a very noisy, crowded room. Usually, to hear the secret, you have to shout, which immediately tells everyone else, "Hey, I'm listening!" or even "I'm spying!"

This paper introduces a new way to "listen" (sense the environment) and "talk" (send data) at the same time without anyone realizing you are doing it. The authors call this SNF-PRP (Sub-Noise-Floor Pseudo-Random Probing).

Here is how it works, broken down into simple concepts and analogies:

1. The Problem: The "Flashlight" Effect

In modern wireless systems (like 5G), devices often send out special signals to "sense" things around them, like detecting a car's speed or distance.

The Issue: These signals are like shining a bright flashlight in a dark room. Even if you are trying to hide, the light itself gives you away. A "passive watcher" (an enemy or eavesdropper) can see the light and know, "Someone is sensing something here," even if they can't hear what is being said.
Current Solutions: Existing methods try to hide the message inside the light, but the light itself is still visible.

2. The Solution: The "Whisper in the Wind"

The authors propose a trick where the sensing signal is so quiet that it is buried below the natural background noise of the room.

The Analogy: Imagine the background noise of the room is the sound of wind blowing through trees. The new method sends a "whisper" that is quieter than the wind. To anyone just listening to the wind, it sounds exactly like the wind. There is no extra "hiss" or "click" to alert them.
The Secret Key: Only the intended receiver (the "good guy") has a special secret code (a cryptographic seed).
- The Good Guy: Knows the code. They can filter out the wind and the regular chatter, leaving only the specific pattern of the whisper. They can then reconstruct the "sensing" information (like how far away an object is).
- The Bad Guy (Willie): Does not have the code. To them, the whisper looks exactly like random static. They cannot tell the difference between the signal and the noise.

3. How It Works: The "Puzzle Piece" Trick

The system uses a technology called OFDM (used in 5G and Wi-Fi), which breaks data into many small frequency channels (subcarriers).

Spreading the Signal: Instead of putting the whole whisper on one channel, the system spreads tiny, tiny fragments of the whisper across hundreds of channels.
The Gain: Think of it like a puzzle. The bad guy sees hundreds of tiny, random puzzle pieces scattered on the floor. They look like trash. The good guy, however, has the picture on the box (the secret seed). They can pick up the pieces, fit them together, and suddenly the picture (the sensing data) becomes clear.
The Result: The more pieces (subcarriers) you use, the harder it is for the bad guy to notice the pattern, but the easier it is for the good guy to solve the puzzle.

4. The Trade-Off: Patience vs. Stealth

The paper highlights a specific trade-off, which they call a "three-way balance":

Going Deeper: If you make the whisper quieter (more hidden), it becomes even harder for the bad guy to detect.
The Cost: Because the signal is so quiet, the good guy needs to listen for a longer time to gather enough pieces to solve the puzzle.
The Magic: The authors prove that even if you wait longer, the quality of the final picture doesn't get worse. You just have to be more patient.
- Example: If you whisper at -12 decibels (very quiet), you might need to listen for about 191 "frames" (a specific time unit in 5G) to get a clear reading. But once you do, the reading is just as accurate as if you had shouted.

5. The Results: Did It Work?

The authors tested this using 5G standards (specifically the n78 band, which is common for 5G).

Stealth: They successfully hid the sensing signal so well that the mathematical "detectability" score was 5.8 times lower than the threshold where a watcher would start to suspect something.
Accuracy: Even with the signal buried deep in the noise, they could measure distance with an accuracy of less than 0.5 meters and speed with an accuracy of less than 0.5 meters per second.
Comparison: Previous methods could hide the message but not the act of sensing. This method hides the act of sensing itself.

Summary

This paper presents a new way to use 5G signals to "see" the world without anyone knowing you are looking. It works by hiding the sensing signal so deep in the background noise that it looks like nothing at all to an outsider, while a trusted receiver uses a secret key to piece the signal back together. The only cost is that the receiver has to wait a bit longer to get a clear picture, but the picture is just as sharp as if the signal were loud.

Technical Summary: SNF-PRP – A Covert Integrating Sensing and Communications Framework

Problem Statement
Integrated Sensing and Communication (ISAC) systems enable simultaneous environmental perception and data transmission but introduce a critical security vulnerability: sensing waveforms are deliberately radiated, exposing both the embedded information and the mere fact that sensing is occurring. Existing Physical Layer Security (PLS) approaches in ISAC primarily focus on protecting data payloads via beamforming, artificial noise, or reconfigurable intelligent surfaces. However, these methods typically operate with probes above the noise floor, leaving the sensing activity itself detectable by a passive warden (Willie) using energy detection. Current literature lacks a formal framework that provides a provable covertness guarantee specifically for the sensing waveform itself, rather than just the communication channel.

Methodology: Sub-Noise-Floor Pseudo-Random Probing (SNF-PRP)
The paper proposes SNF-PRP, a framework designed for OFDM-based ISAC systems (specifically 5G NR) operating in sub-6 GHz bands. The core mechanism involves superimposing a cryptographically seeded pseudo-random noise (PRN) sequence onto a standard downlink waveform at a power level strictly below the instantaneous noise floor.

Signal Model: The transmitted signal is a superposition of the communication data and the probing signal ( $X[m] = X_c[m] + X_p[m]$ ). The probe power $P_p$ is defined as $\Delta_p \sigma^2$ , where $\Delta_p < 1$ , ensuring the probe is buried below the noise floor $\sigma^2$ on each subcarrier.
Legitimate Receiver: A legitimate sensing node shares a pre-distributed cryptographic seed $s$ with the base station. Using this seed, the receiver regenerates the exact PRN template and applies coherent matched filtering and multi-symbol accumulation. This process recovers the sensing parameters (range and velocity) by effectively increasing the Signal-to-Noise Ratio (SNR) through integration, compensating for the initial power deficit.
Adversary Model: A passive warden (Willie), lacking the seed, cannot perform coherent processing. Willie is restricted to incoherent radiometric energy detection (the optimal Neyman-Pearson test for distinguishing complex Gaussians differing only in variance). Under this model, the probe is statistically indistinguishable from thermal noise.
Covertness Metric: Covertness is quantified using the Kullback-Leibler (KL) divergence ( $D_{KL}$ ) between the hypothesis of noise-only ( $H_0$ ) and probe-present ( $H_1$ ). The system aims to satisfy $D_{KL} \leq \epsilon$ .

Key Contributions

First Provable Sensing Covertness: To the authors' knowledge, this is the first framework to apply the KL divergence covertness criterion directly to the sensing probe waveform, establishing a formal guarantee that the act of sensing is undetectable, rather than just the data payload.
$N_{sc}$ -Fold Spreading Gain: The paper identifies a spreading gain of $N_{sc}$ (FFT size) absent in prior wideband analyses. By distributing the probe uniformly across all subcarriers, the KL divergence is suppressed by a factor of $N_{sc}$ , yielding a correction factor exceeding $10^6$ in specific 5G NR configurations.
Closed-Form Trade-off Analysis: The authors derive a closed-form expression for the minimum integration length ( $N^*$ ) required to achieve a target Cramér-Rao Bound (CRB). They establish a three-way trade-off between probing power ( $\Delta_p$ ), integration length ( $N^*$ ), and Doppler resolution ( $\delta_v$ ). Crucially, they prove that the effective sensing SNR at the required integration length is invariant to $\Delta_p$ ; lowering the probing power deepens covertness but requires proportionally longer integration, without degrading the fundamental estimation accuracy.

Simulation Results
Simulations were conducted using 5G NR numerology ( $\mu=0$ , 3.5 GHz band, n78) with a target range accuracy of 0.5 m and velocity accuracy of 0.5 m/s.

Feasibility: The system is jointly feasible (meeting both sensing targets and covertness constraints) at probing powers of $\Delta_p = -12$ dB and $-15$ dB. At these levels, the KL divergence is significantly below the threshold $\epsilon = 0.01$ (e.g., $5.8 \times$ below threshold at $-12$ dB).
Performance: At $\Delta_p = -12$ dB, the required integration length is 191 subframes (191 ms), which is feasible within the coherence time of a pedestrian target. This configuration achieves a range CRB of 0.43 m and a velocity CRB of 0.11 m/s.
Monte Carlo Validation: At a reference operating point ( $\Delta_p = -9$ dB, 16 subframes), the range estimator achieved zero RMSE and zero bias across 500 trials, confirming deterministic locking to the correct delay bin. The velocity estimator showed a minor bias due to fractional-bin rounding, which is correctable via interpolation.
Comparison: Unlike prior works that rely on beam nulling or secrecy rates (which leave the probe detectable in principle), SNF-PRP renders the waveform statistically indistinguishable from ambient noise while achieving comparable or superior sensing accuracy (0.43 m range vs. 2–8 m in prior works).

Significance and Claims
The paper claims that SNF-PRP answers the open question of whether sensing itself can be made provably undetectable at the physical layer. The significance lies in shifting the security paradigm from protecting what is sensed to hiding that sensing is occurring. The authors emphasize that the trade-off for this provable covertness is increased integration latency, not a degradation in sensing quality. The effective SNR remains invariant, meaning that once the necessary integration time is accumulated, the sensing estimate quality is preserved regardless of how deeply the signal is buried. This framework provides a quantified design choice for systems requiring stealthy environmental perception, distinct from existing PLS methods that focus solely on communication secrecy.