{"id":"e5ec60ec-948d-406a-afd0-b18c638c4c98","arxiv_id":"2507.11173","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A Bayesian change point detector run on RL critic value estimates detects gradual GNSS spoofing of a simulated UAV with higher reported accuracy and fewer false alarms than Page-Hinkley, an LSTM autoencoder, and signal-level detectors.","lead":"This paper tests whether a drone can catch a slow GPS spoofing attack by watching the confidence scores its own navigation brain produces, instead of watching the GPS signals. In a simulated 3D obstacle-avoidance task, this approach beats three baseline detectors on accuracy and false alarm rates.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The paper's central claim rests on an unverified empirical premise: spoof-induced Q-value shifts reliably separate from an unstable nominal Q-stream, and the manuscript reports no numerical metrics or BOCPD parameters to test this.","rationale":"The reader's weakest assumption is that a spoofed state reliably shifts Q-values and that the nominal distribution is a stable Gaussian. I partially agree, but the more precise problem is that the paper uses an adaptive segment mean in Eq. (17), so slow drifts are partly absorbed, while the nominal stream itself trends toward zero. Either effect can decouple the run-length signal from the actual attack. The absence of numeric results and unreported H, tau, sigma0 means the claimed near-perfect accuracy in Figure 5 cannot be independently checked. This does not make the central idea self-contradictory; it makes the empirical claim contingent. A re-run on nominal-only episodes plus a reported parameter table would settle it. Since the reader already set CONDITIONAL, I recommend no change to the verdict.","tokens_in":8329,"tokens_out":4573,"duration_ms":65476,"concrete_test":"Run Algorithm 1 with the exact hazard, threshold, and prior statistics used for Figure 5 on a set of at least 20 attack-free nominal episodes, and record the false-positive rate as a function of episode time. If the detector flags change points during the mission-success convergence of Q-values (the trend visible in Figure 4), the fixed-Gaussian/nonstationarity premise fails; if it does not, the concern is settled.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that BOCPD on critic Q-values detects drift-evasive GNSS spoofing with higher accuracy and lower error rates than baselines. This requires two conditions: (i) a spoofed state reliably moves Q-values outside the nominal distribution, and (ii) the nominal Q-stream is stable enough for the assumed Gaussian model. Neither is established. Figure 4 shows nominal Q-values converging toward zero as the mission succeeds, so the nominal stream has a systematic trend; a fixed-mean, fixed-variance Gaussian with a constant hazard will tend to flag that trend as a change point unless the threshold is tuned to ignore it. Moreover, Algorithm 1 updates the segment mean through Eq. (17), so during the 50-step drift the model partially absorbs the spoof-induced shift into the within-run mean, weakening the run-length evidence and making detection delay depend on unstated parameters (hazard H, threshold tau, variance sigma0). The paper reports only qualitative descriptions of Figure 5; no confusion matrices, detection delays, parameter values, or sensitivity analyses are given. The BOCPD recursions themselves are standard, but the load-bearing assumption that Q-values are a reliable, promptly separable change-point signal is unverified, and the comparison with baselines may additionally confound detector choice with input-signal choice.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes using Bayesian online change point detection (BOCPD) on the temporal sequence of critic Q-values from a DDPG agent to detect drift-evasive GNSS spoofing in UAV navigation. It reproduces iterative least-squares GNSS position estimation, defines a smooth drift attack that gradually displaces the estimated position, and applies the standard BOCPD recursion to the Q-value stream. The reported experimental claim is that BOCPD on Q-values outperforms semi-supervised LSTM, Page-Hinkley, and signal-thresholding baselines in accuracy, false-positive rate, and false-negative rate, with near-perfect detection. The manuscript currently supports this claim only with qualitative descriptions of Figure 5 and omits the key detector parameters and numerical results.","tokens_in":8442,"tokens_out":4025,"duration_ms":49218,"significance":"If validated, the central idea is interesting and timely: an RL critic's Q-values can serve as an online integrity monitor for its own state inputs, providing a temporal detection signal that does not require labeled attack data. The GNSS least-squares equations and the BOCPD recursion are standard and appear correctly reproduced, and the threat model of drift-evasive spoofing is realistic and relevant. However, the empirical claim is not yet supported by reported numbers, the stability of nominal Q-values is questionable, and the comparison with baselines is not described in enough detail to judge fairness. The paper has a defensible premise but needs substantial additional evidence and parameter reporting before its central claim can be accepted.","major_comments":[{"comment":"The central claim of superior detection accuracy, false-positive rates, and false-negative rates rests entirely on a qualitative description of Figure 5; no numerical values, per-episode statistics, or standard deviations are reported in the text. Without the actual accuracy and error-rate numbers, the claimed near-perfect performance of BOCPD and its superiority over the Page-Hinkley test, the LSTM autoencoder, and signal thresholding cannot be assessed or reproduced.","section":"§V-C, Fig. 5"},{"comment":"The detector's behavior is controlled by the hazard rate H and the run-length threshold τ in Algorithm 1, as well as by μ0 and σ0 computed from nominal trajectories, but none of these values are reported anywhere in the paper. In addition, no sensitivity analysis is provided for H, τ, or σ0, so the near-perfect detection rates could be the result of favorable parameter choices rather than a property of the method. The update of the segment mean in Eq. (17) also means that during the 50-step drift the model partially absorbs the spoof-induced shift, so detection delay and accuracy depend on these unreported parameters in a way that must be quantified.","section":"Algorithm 1, §IV"},{"comment":"The Gaussian predictive model assumes qt ~ N(μt, σ²) with μ0 and σ0 fixed from nominal data, but Figure 4 shows nominal Q-values systematically converging toward zero as the mission succeeds. A constant-mean, constant-variance Gaussian model with a constant hazard will tend to flag that natural convergence as a change point; the paper does not explain how the threshold τ separates benign mission-end convergence from attack-induced shifts, nor does it provide evidence that the nominal Q-stream is stable enough for the assumed model.","section":"§IV, Fig. 4"},{"comment":"The comparison confounds detector choice with input-signal choice: BOCPD is applied to critic Q-values, while the baselines (signal thresholding, Page-Hinkley, and the semi-supervised LSTM) appear to be applied to raw GNSS or position information, but the manuscript never states what inputs each baseline received or how they were configured. To support the claim that BOCPD is a better detector, the baselines should either be run on the same Q-value stream or the comparison should be explicitly framed as an end-to-end system comparison with matched information sources and training procedures.","section":"§V-C"}],"minor_comments":[{"comment":"The state vector Φt is declared to be in R3, but the expression contains two R3 relative-position terms and an R3 velocity term, giving nine components; please correct the dimension or the definition.","section":"§II-C, Eq. (9)"},{"comment":"The goal-seeking reward has a stray period after the fraction, and the indicator bonus Igoal is not clearly defined (e.g., whether Igoal=1 also applies at the success threshold state); please clean up the equation and its accompanying text.","section":"§II-E, Eq. (12)"},{"comment":"The experimental section reports results over 20 test episodes but does not describe how test episodes were generated, how many are attacked versus nominal, or whether the same start and obstacle configurations are used across detectors; please add this information.","section":"§V-A, Fig. 5"},{"comment":"The Page-Hinkley baseline is cited to a general streaming-framework reference [19], and the signal-level baselines are cited only to a vulnerability survey [5]; please provide implementation details or specific references for the exact detectors used in the comparison.","section":"§V-C, references"},{"comment":"The text mentions a Normal-inverse-gamma prior for conjugacy, but Eq. (18) uses only a Gaussian likelihood with fixed variance; please clarify the prior specification and state how σ0 is estimated from nominal data.","section":"§IV, Eq. (18)"}],"recommendation":"major_revision","confidential_remarks":"The idea has merit and the paper addresses a realistic problem, but the missing numerical results, unreported BOCPD hyperparameters, and the confounded baseline comparison are serious gaps for a journal submission. I would encourage the editor to request a revised version with full experimental tables, parameter values, a sensitivity analysis, and a matched-feature baseline comparison before considering it for publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the idea is real and cheap — monitor the critic's Q-values with BOCPD as an integrity monitor for GNSS spoofing — but the paper as written doesn't give us the numbers to know whether it works. The novel bit is the signal choice, and that's a genuine, modest contribution. The GNSS least-squares and BOCPD recursions are standard and correctly reproduced. The empirical premise, that a drift-evasive spoof depresses critic values relative to nominal, is plausible and qualitatively shown in Figures 3–4. I buy it as a reasonable hypothesis.\n\nThe soft spots are load-bearing. No numerical results are reported anywhere: Figure 5 is described in words, and the accuracy, false-positive, and false-negative values are not in the text. The BOCPD hazard H and threshold tau are unreported, and the Gaussian nominal model is anchored to mu0/sigma0 from nominal trajectories. Figure 4 shows the nominal Q-stream trending toward zero as the mission succeeds, so a fixed-mean, fixed-variance Gaussian will flag that trend unless tau is tuned. That's a testable concern, not a fatal one, but the manuscript doesn't address it. Section IV's Eq. (17) updates the segment mean, so the detector partially absorbs the spoof-induced shift during the 50-step drift; detection delay depends on H, tau, and sigma0, none of which are reported. The baseline comparison also likely confounds detector choice with signal choice: BOCPD sees critic values, while PH and signal-threshold methods see raw signals. To claim superiority, you'd need all detectors on the same input.\n\nThe stress-test note is on target, and the reader's CONDITIONAL verdict is fair. That said, this is not a deeply flawed paper; it's an under-reported one. The central claim is plausible, and the method is simple enough that a careful re-run with numbers, parameters, and a matched baseline comparison would either confirm it or kill it. The authors should also address the non-stationary nominal distribution, either by using a more flexible predictive model or by reporting sensitivity to mu0/sigma0.\n\nWho's this for? People working on RL robustness under observation-space attacks and GNSS anti-spoofing. A serious referee should engage, with the expectation of heavy revision. I'd want the numbers before citing it.","headline":"A genuinely useful but under-reported idea: monitoring an RL critic's Q-values with BOCPD for GNSS spoofing, currently short on numbers and parameter reporting.","tokens_in":9131,"tokens_out":1907,"would_cite":false,"duration_ms":21488,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Monitoring the temporal sequence of Q-values from an RL critic with Bayesian online change point detection detects drift-evasive GNSS spoofing attacks more accurately and with fewer false alarms than conventional signal-level…","keywords":["GNSS spoofing detection","Bayesian online change point detection","reinforcement learning critic","Q-values","UAV navigation","drift-evasive attack","temporal anomaly detection"],"falsifier":"Run the detector on attack-free missions that include a late, difficult obstacle encounter so the Q-values naturally drop; if the detector raises false alarms at that encounter, the fixed-mean Gaussian model is conflating natural value decay with an attack. Alternatively, start a drift-evasive attack after the Q-values have already converged to zero and measure whether the detector can still see it.","tokens_in":7978,"feed_emoji":"🛰️","tokens_out":5216,"duration_ms":54582,"temperature":0.7,"pith_summary":"Drift-evasive GNSS spoofing attacks push a UAV's estimated position gradually toward a target, so no single signal measurement looks wrong. This paper argues that the gradual corruption nevertheless shows up in the reinforcement learning critic's state-action value estimates, which drop and stay low when the agent's observations are being manipulated. The authors attach a Bayesian online change point detector to that Q-value stream, and report that it flags the attack onset faster and with lower false-positive and false-negative rates than signal thresholding, the Page-Hinkley test, and a semi-supervised LSTM autoencoder. If the effect is real, any RL value function can double as an integrity monitor for its own inputs, giving a warning that lets the UAV switch to alternative sensing before the mission is lost.","feed_headline":"RL critic's Q-values catch stealthy GNSS spoofing","feed_subtitle":"Bayesian online change point detection on the critic stream beats signal-level and LSTM baselines in tests.","key_machinery":"The central object is the run-length posterior of BOCPD applied to the temporal sequence of critic values $q_t = Q(\\Phi_t, a_t)$. BOCPD treats the sequence as piecewise stationary, with a change point at time $t$ resetting the run length $l_t$ to zero; a Gaussian predictive model $q_t \\sim N(\\mu_t, \\sigma^2)$ with a Normal-inverse-gamma prior gives the likelihood of each new value under each candidate run length. The most probable run length $\\hat{l}_t$ serves as the detection statistic, and a value below the threshold $\\tau$ flags the spoofing attack. The mechanism works because the critic encodes the agent's confidence in its own state observations, so a corrupted state produces consistently low Q-values rather than an isolated outlier.","core_discovery":"The paper's central discovery is that a latent quantity inside an RL agent—the critic's Q-value—carries a detectable signature of a spoofing attack that is invisible at the signal level. Under nominal conditions the Q-values follow a distribution that can be summarized by a mean and variance learned from attack-free trajectories. When a drift-evasive attack smoothly bends the estimated position, the Q-values shift downward and cease to converge toward zero, and BOCPD on this sequence separates that shift from ordinary fluctuation. In comparisons over 20 test episodes, the Q-value BOCPD detector achieves near-perfect accuracy and the lowest false-positive and false-negative rates among the tested methods.","pith_inferences":["The fixed-mean Gaussian prior is a weak point: nominal Q-values naturally decay toward zero as a mission succeeds, so a late-stage attack could be masked by that decay. A non-stationary prior or a baseline that adapts to mission progress would be a natural extension.","An adversary who knows the critic could in principle construct spoofed states that keep Q-values high, defeating the detector; testing adversarial counter-examples on the same simulator would bound the method's robustness.","The approach could be transferred to other RL-based cyber-physical systems, such as automated vehicles or robotic manipulators, wherever a critic value stream is already being computed for control.","BOCPD's hazard rate and threshold $\\tau$ are hyperparameters; a sensitivity study across obstacle densities and attack speeds would show where the near-perfect accuracy degrades."],"forward_implications":["An RL agent's critic network can serve as a built-in integrity monitor, so detection requires no extra sensors or labelled attack data.","Because BOCPD operates online with a recursive update, the alert can be raised within a few time steps of the attack onset, enabling a timely switch to alternate sensing.","The same principle should apply to any spoofed observation channel that feeds an RL value function, not only GNSS pseudoranges.","Detectors that watch raw signals alone will continue to miss this class of attacks; value-based temporal monitoring is a complementary layer."],"supporting_citations":[{"why":"Supplies the BOCPD algorithm, including the run-length recursion and hazard function.","marker":"[17]"},{"why":"Defines the GNSS spoofing threat model and the conventional signal-level mitigations the detector must beat.","marker":"[5]"},{"why":"Provides the UAV transition model and curriculum training setup used to train the DDPG agent.","marker":"[21]"},{"why":"Underlies the iterative least-squares pseudorange position estimation that the spoofing attack corrupts.","marker":"[20]"},{"why":"Provides the semi-supervised LSTM autoencoder baseline for temporal anomaly detection.","marker":"[18]"},{"why":"Provides the Page-Hinkley test baseline for sequential change point detection.","marker":"[19]"}],"fun_headline_variants":["Q-value shifts reveal stealthy GNSS spoofing","RL critic spots drift-evasive spoofing","Bayesian change point on Q-values catches spoofing","Critic's Q-values expose GNSS spoofing"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The detector assumes the critic's ordinary Q-values stay close to a fixed Gaussian baseline, but in a successful mission those values naturally drift toward zero, so an attack that coincides with that natural drift could be missed or falsely flagged.","fun_headline_variants_meta":{"raw":{"variants":["Q-value shifts reveal stealthy GNSS spoofing","RL critic spots drift-evasive spoofing","Bayesian change point on Q-values catches spoofing","Critic's Q-values expose GNSS spoofing"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00018,"raw_usage":{"total_tokens":1277,"prompt_tokens":893,"completion_tokens":384,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":509,"completion_tokens_details":{"reasoning_tokens":319}},"tokens_in":509,"tokens_out":384,"duration_ms":4512,"temperature":1.0,"reasoning_tokens":319,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T17:15:26.188772+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the detector on attack-free missions that include a late, difficult obstacle encounter so the Q-values naturally drop; if the detector raises false alarms at that encounter, the fixed-mean Gaussian model is conflating natural value decay with an attack. Alternatively, start a drift-evasive attack after the Q-values have already converged to zero and measure whether the detector can still see it.","supporting_citations":[{"cited_title":"Known vulner- abilities of global navigation satellite systems, status, and potential mitigation techniques,","cited_arxiv_id":null,"evidence_quote":"Defines the GNSS spoofing threat model and the conventional signal-level mitigations the detector must beat."},{"cited_title":"Curriculum-Adapted Robust Reinforcement Learning for UAV Deconfliction in Adversarial Environments","cited_arxiv_id":"2506.21129","evidence_quote":"Provides the UAV transition model and curriculum training setup used to train the DDPG agent."},{"cited_title":"Gnss spoofing and de- tection,","cited_arxiv_id":null,"evidence_quote":"Underlies the iterative least-squares pseudorange position estimation that the spoofing attack corrupts."},{"cited_title":"Long short term memory networks for anomaly detection in time series,","cited_arxiv_id":null,"evidence_quote":"Provides the semi-supervised LSTM autoencoder baseline for temporal anomaly detection."},{"cited_title":"Sciki t- multiflow: A multi-output streaming framework,","cited_arxiv_id":null,"evidence_quote":"Provides the Page-Hinkley test baseline for sequential change point detection."}],"review_version":1}