Technical Summary: ORAN-DEFEND

1. Problem Statement

The Open Radio Access Network (O-RAN) architecture delegates near-real-time control to Deep Reinforcement Learning (DRL) xApps, often sourced from third-party vendors. This supply-chain model introduces a critical vulnerability: backdoor policies. A malicious vendor can distribute a DRL agent that behaves optimally under normal conditions but executes harmful control actions (degrading Quality of Service, violating latency budgets, or causing interference) when a covert trigger is injected into the observed Key Performance Indicator (KPI) telemetry.

Existing defense mechanisms are insufficient for this scenario because:

• Black-box Constraints: xApps are often frozen proprietary binaries, preventing white-box access or model retraining.
• Limitations of Supervised Defenses: Techniques like Neural Cleanse or spectral signatures typically require training data or model weights, which are unavailable.
• Nature of DRL Attacks: Unlike static classification, backdoors in DRL manifest through long-horizon cumulative return degradation rather than single-step misclassification, making them harder to detect via standard anomaly detection.

2. Methodology: ORAN-DEFEND

The authors propose ORAN-DEFEND, a retraining-free, telemetry-level wrapper designed to sanitize potentially compromised xApps. The defense operates entirely on the input observations (KPI windows) presented to the frozen policy.

Core Mechanism: Subspace Sanitization

The method relies on the spectral geometry of clean KPI telemetry.

1. Safe Subspace Estimation (Offline): The defender collects a small set of trusted, clean rollout episodes from the xApp in a controlled environment. Using Singular Value Decomposition (SVD) on these clean states, the system estimates a low-dimensional safe subspace ($E_n$) where the majority of nominal KPI variance resides.
2. Orthogonal Trigger Assumption: The defense assumes the adversarial trigger resides in the orthogonal complement ($E^\perp$) of the safe subspace. This is based on the premise that triggers are designed to be covert and thus orthogonal to the natural correlations of the network traffic.
3. Online Sanitization: For every incoming KPI window $s_t$:
   • The observation is centered and projected onto the estimated safe subspace $E_n$.
   • The projected vector $\hat{s}_t = \text{Proj}_{E_n}(s_t)$ is passed to the frozen backdoor policy $\pi^\dagger$.
   • If the trigger lies entirely in $E^\perp$, the projection annihilates the trigger exactly, restoring the input to a state indistinguishable from clean operation.
4. Detection: A residual detector calculates the energy of the component orthogonal to the safe subspace ($\rho(s_t) = \|s_t - \hat{s}_t\|^2$). If this residual exceeds a threshold, a backdoor alert is raised.

Theoretical Guarantees

The paper establishes a precise recovery condition: the defense succeeds if the trigger energy concentrates in $E^\perp$. The performance gap between the optimal clean policy and the sanitized policy is bounded by the approximation error (discarded clean-state energy) and the estimation error (finite sample size), provided the trigger is confined to the orthogonal complement.

3. Key Contributions

1. Formalized Threat Model: The authors define the backdoor-policy threat for KPI-driven xApps in O-RAN, covering both inner-loop (TrojDRL, BadRL) and outer-loop (SleeperNets, Q-Incept) poisoning regimes.
2. Retraining-Free Defense: They present ORAN-DEFEND, the first wrapper that sanitizes frozen DRL policies using only black-box inference and a small number of trusted clean rollouts, without requiring access to model weights or retraining.
3. Geometric Characterization of Defense Boundaries: The paper introduces the $E^\perp$ energy fraction ($\eta_{E^\perp}$) as a single measurable quantity that governs recovery. It demonstrates that linear projection defenses are intrinsically limited: if the trigger colocalizes with the legitimate signal (low $\eta_{E^\perp}$), linear sanitization fails, even if the trigger is nonlinearly detectable.
4. Comprehensive Evaluation: The defense is evaluated against four structurally distinct attack families on the Colosseum COLORAN dataset, spanning different poisoning mechanisms.

4. Experimental Results

The evaluation was conducted on the Colosseum COLORAN dataset using 8 KPI channels over a 20-step horizon ($D=160$).

• Performance under $E^\perp$ Assumption: When the trigger is confined to the orthogonal complement (the standard assumption for the defense):

  • Return Recovery: Achieved 100% across all four attack families (TrojDRL, SleeperNets, BadRL, Q-Incept).
  • Defense Success Rate (DSR): $\ge 99.5\%$.
  • Detection: The residual detector achieved an AUROC between 0.98 and 1.00.
  • Sample Efficiency: The defense remained effective with as few as $n=8$ clean calibration episodes.

• Comparison with Baselines:

  • Contaminated Calibration: If the subspace is estimated from contaminated data (mixed clean/poisoned), recovery drops significantly for certain attacks (e.g., BadRL drops from 99.9% to 0%), highlighting the necessity of the trusted calibration step.
  • Non-Linear vs. Linear: When triggers were injected into the safe subspace (violating the assumption), linear projection failed (recovery dropped to 0–22%). However, a non-linear MLP classifier could still detect these triggers with 100% AUROC, confirming that linear sanitization and detection decouple when the geometric assumption is violated.

• Ablation Studies:

  • Recovery is robust to variations in the number of calibration samples ($n$) and subspace dimension ($d \gtrsim 10$).
  • The defense is insensitive to the severity of the attack (penalty magnitude).

5. Significance and Claims

The paper positions ORAN-DEFEND as a practical, theoretically grounded first line of defense for the O-RAN supply-chain threat model. Its primary significance lies in:

• Operational Feasibility: It requires no retraining and imposes minimal computational overhead ($O(Dd)$ per step), making it compatible with Near-RT RIC latency constraints (10ms – 1s).
• Theoretical Precision: It moves beyond heuristic detection by providing a precise mathematical condition ($\eta_{E^\perp}$) for when linear sanitization succeeds or fails.
• Limitation Awareness: The authors modestly claim that while the defense is highly effective under the subspace assumption, it is not a panacea. The "geometry ablation" reveals an intrinsic limit of any linear projection defense: it cannot sanitize triggers that collocate with legitimate signals. In such cases, the paper suggests that while linear sanitization fails, the trigger may still be detectable via non-linear methods, providing operators with a principled metric to assess defense coverage.

The work concludes that ORAN-DEFEND effectively mitigates backdoor threats where the trigger is orthogonal to the natural data manifold, offering a robust solution for the deployment of third-party DRL xApps in critical telecommunications infrastructure.