{"id":"62b18134-3ad7-4d1f-89f3-8b28a59c04e5","arxiv_id":"2511.13171","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A non-serving UAV can autonomously synchronize to 5G uplink SRS, separate multiple users by cyclic shift, and localize them via a trajectory-based weighted mean-shift, achieving meter-level errors in tests.","lead":"A drone that is not part of the cellular network can identify and locate several 5G phones by passively listening to their uplink sounding signals, then adjust its own flight to refine the estimates. The paper shows this in simulation and outdoor tests, with errors down to a few meters for line-of-sight users.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The localization stage assumes the SRS metric's mode is at the UE; the paper's own NLoS data contradict this, and the experiment never places UEs at separate positions.","rationale":"The reader's weakest assumption is exactly the load-bearing one: Eq. (29) turns a correlation metric into a spatial density without justification. The paper's own NLoS experiment (Sec. VI-B, Fig. 12b) is direct evidence that the mode can sit at a reflection point. The simulated urban claim inherits this risk because QUADRIGA/ray-tracing includes NLoS. The experimental campaign, while genuinely using OAI waveforms and a real UAV, replays three signals from two co-located positions, so it does not test multi-UE localization of spatially separated users. These are not ad hominem or stylistic complaints; they are gaps between the claim and the evidence. The concrete test would settle whether the gap is real: if deep-NLoS simulated UEs still localize within 8 m, the concern is resolved and the conditional verdict can become accept; if the estimates track reflections, the central claim fails. I do not move the verdict because the existing evidence is suggestive but not decisive, and the reader's conditional framing already captures the appropriate uncertainty.","tokens_in":19015,"tokens_out":9369,"duration_ms":99609,"concrete_test":"In the Section V ray-tracing/QUADRIGA urban setup, place K=50 UEs in deep-NLoS positions (behind buildings or inside vehicles) with no LoS from the planned trajectory. Simulate the full flight and run Alg. 2 with the paper's thresholds and kernel bandwidths. For each UE, record the LE and the ground projection of the metric's argmax. If median LE over NLoS UEs exceeds 8 m, or if estimates cluster at ray-traced reflection points instead of true UEs, the spatial-mode assumption fails and the urban accuracy claim is unsupported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The accuracy claim rests on Alg. 2 / Eq. (29), where normalized SRS metric γ̃_SRS is used as a spatial weight and mean-shifted to a mode. This is valid only if the metric is approximately unimodal and centered on the UE. No derivation supports this: Appendix A characterizes M[n0] as a timing metric, not a spatial likelihood. The paper's own Sec. VI-B in-vehicle data show received-power maxima displaced toward reflection points near the vehicle, i.e., the mode is not at the UE. Since the urban simulations contain NLoS, the <8 m urban claim depends on an unproven bias assumption. Additionally, the experimental six UEs are not spatially separated: Sec. VI-B generates six labels from three recorded OAI SRS waveforms replayed from two co-located physical positions, so no experiment actually validates multi-UE localization of distinct locations.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a full onboard processing chain that enables a non-serving UAV to identify and localize multiple 5G UEs from uplink Sounding Reference Signals (SRS). The chain includes coarse/fine time synchronization, matching-pursuit-based separation and identification of UEs sharing the same SRS band, and a weighted mean-shift localization algorithm that uses the SRS correlation metric collected along the UAV trajectory. Validation is carried out through ray-traced simulations in urban and rural environments and through a field experiment with an F450 drone carrying an ADALM-Pluto SDR, a Pixhawk flight controller, and a Jetson Orin NX. The paper reports localization errors below 8 m in urban simulations and below 3 m in rural LoS field tests, and claims the first practical demonstration of multi-user identification and localization from real 5G UL signals captured by a non-serving UAV.","tokens_in":19188,"tokens_out":5728,"duration_ms":57507,"significance":"If the claims hold, the work is a valuable contribution to passive UAV-based sensing for emergency and low-altitude-economy applications. The paper's strengths include: a complete, experimentally implemented system; complexity analysis of the signal processing chain; use of 3GPP-compliant SRS waveforms (via OAI recordings); and a comparison with AoA- and TDoA-based benchmarks. The main significance is the demonstration that lightweight, non-serving UAVs can potentially perform multi-UE identification and localization using narrowband uplink reference signals without mission-time network control. However, the significance is tempered by two load-bearing gaps: the localization method's statistical model is not justified, and the experimental campaign does not actually place six UEs at six distinct physical locations. These issues must be addressed before the central claims can be considered fully supported.","major_comments":[{"comment":"The localization algorithm treats the normalized SRS correlation metric γ̃_SRS[r] as a spatial density whose mode coincides with the UE position, then applies weighted mean-shift to find that mode. No derivation supports this assumption. Appendix A characterizes M[n0] as a timing synchronization metric, not as a spatial likelihood. The paper's own experimental result in Fig. 12b and Sec. VI-B states that for in-vehicle UEs the received power maxima originate from reflection points near the vehicle, i.e., the metric's mode is not at the UE in NLoS. This directly contradicts the unimodality/centering assumption and means the reported urban NLoS accuracy (<8 m) relies on an unquantified bias. Please provide a theoretical or simulation-based analysis of the metric's spatial distribution under multipath, or revise the localization stage to account for the bias; otherwise the central accuracy","section":"§IV-D, Eq. (29), Alg. 2"},{"comment":"The experimental campaign does not validate multi-UE localization of six spatially separated users. As described, three recorded OAI SRS waveforms with different cyclic shifts are superimposed into one composite signal, and a duplicate is placed on adjacent subcarriers to form a second subband. UEs 1–3 therefore share one physical transmit location (outdoor chair) and UEs 4–6 share another (inside the car). The UAV treats the composite signals as six independent targets, but the localization accuracy for each group is effectively a single-location measurement. Consequently, the claimed demonstration of 'multi-UE identification and localization' of spatially separated users is not supported. The identification of overlapping SRS with different cyclic shifts is validated, but multi-UE localization requires physically separated transmitters or a clearly framed single-location-per-subband cl","section":"§VI-B, Table II"},{"comment":"The field experiment does not operate against a live 5G network. The paper states that B_SRS > 0 was not supported by the OAI network, so a 'realistic dataset was generated offline' by superimposing pre-recorded OAI SRS signals with added CFO and timing offsets, then replaying them. Thus the claim in the Abstract and Introduction of 'real 5G UL signals captured by a UAV' overstates the evidence: the signals are OAI-generated and replayed from a test transmitter, not captured from actual UEs connected to a live network. Please clarify which aspects of live operation (scheduler dynamics, timing advance, actual multipath propagation, etc.) are not exercised, and temper the 'first practical demonstration' claim accordingly.","section":"§VI-B, opening paragraph"}],"minor_comments":[{"comment":"The symbol U is used both for the set of UEs in Sec. III-A and for the total number of cyclic shifts in Eq. (22). Please disambiguate (e.g., use U_shift or C).","section":"§IV-B3, Eq. (22)"},{"comment":"In Fig. 12, the markers for true and estimated UE positions are difficult to distinguish, especially in grayscale printing. Please increase marker size or use different shapes.","section":"§VI-B, Fig. 12"},{"comment":"The table reports 'Initial' and 'Refined' accuracy with mean ± std. It would be helpful to also report the number of flight repetitions per UE and the distribution across repetitions, since the text refers to 'multiple flight repetitions' but the table does not quantify them.","section":"§VI-B, Table II"},{"comment":"The SNR estimator in Eq. (14) is stated without derivation. A short derivation or a reference to [22] beyond the threshold selection would improve reproducibility.","section":"§IV-A, Eq. (14)"},{"comment":"The phrase 'no mission-time control-plane interaction' is slightly misleading because the UAV maintains a telemetry link to the GCS. Please specify that the GCS is monitoring only and does not send mission-time control commands, or soften the wording.","section":"§I, Abstract"}],"recommendation":"major_revision","confidential_remarks":"The paper has merit in system integration and in the identification pipeline, but the localization theory and the experimental multi-UE validation need substantial work. The experimental limitation—six UEs generated from three waveforms at two physical positions—and the unproven spatial-mode assumption are not cosmetic; they directly affect the paper's headline claims. I recommend a major revision that either strengthens the theory or reframes the claims to match the evidence."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the synchronization and user-identification work is real, carefully derived, and well integrated on lightweight hardware. The localization claims, though, are not supported by the field experiment as designed, and the mean-shift stage has a load-bearing assumption the paper never justifies.\n\nWhat's genuinely new: taking standard 3GPP SRS, exploiting the K_TC=2 repetition and CAZAC cyclic-shift separation, and running coarse/fine sync plus matching pursuit to identify multiple users from a non-serving UAV. That part is solid. The complexity analysis is explicit, the false-positive handling is plausible, and the onboard Jetson/Pluto/Pixhawk chain is a concrete engineering contribution. The paper is also honest about the OAI limitation: it tells you the network did not support the needed frequency multiplexing and explains the workaround.\n\nThe soft spot is localization. Equation (29) and Algorithm 2 treat the normalized gamma_SRS as a spatial density and mean-shift to its mode, but there is no argument that the metric is unimodal or centered on the UE. Appendix A only characterizes the timing metric M[n0], not a spatial likelihood. The paper's own in-vehicle NLoS result (Fig. 12b) shows received power maxima at reflection points near the vehicle, not at the UE. That directly contradicts the core assumption. So the urban <8 m and rural <3 m claims are not established for NLoS conditions. Also, the experiment labels six UEs from three recorded OAI waveforms replayed from only two physical locations, so multi-UE localization of spatially separated users is never actually demonstrated. The 5–6 m gains over AoA/TDoA benchmarks come only from simulation, and those benchmarks were given 40 MHz while the proposed method used 20 MHz total—the paper explains why, but it is not a clean comparison.\n\nThe fix is straightforward: run a field test with real separate UEs at distinct positions, and either prove the mode-bias property or reframe the localization as a heuristic with sensitivity analysis over thresholds and kernel bandwidths. As it stands, I would send this to peer review with major revision requested, because the underlying idea is worth engaging and the sync/ID contribution is reproducible and useful.\n\nI would cite the synchronization and identification parts in my own work, but would not yet cite the localization results as ground truth. Worth a reading-group discussion.","headline":"A genuinely novel passive-UAV SRS synchronization and identification chain, but the localization validation is weaker than the abstract claims—the field experiment never places multiple UEs at separate positions, and the weighted mean-shift core rests on an untested unimodality assumption.","tokens_in":19721,"tokens_out":1981,"would_cite":true,"duration_ms":20730,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A single non-serving UAV, running a complete onboard chain, can identify and localize multiple 5G users from uplink SRS alone—sub-8 m in urban, sub-3 m in rural.","keywords":["5G SRS","UAV passive sensing","multi-UE localization","weighted mean-shift","matching pursuit","non-serving UAV","emergency situational awareness","low-altitude wireless networks"],"falsifier":"Put one UE in a scene with a large metal reflector, fly the drone along the same perimeter-plus-hexagonal-refinement path, and check whether the estimated position lands on the UE or on the reflector. The accuracy claim also needs a run with several physically separated UEs transmitting independent SRS waveforms—not three recorded signals replayed from co-located transmitters—to confirm multi-user localization in space.","tokens_in":18874,"feed_emoji":"📡","tokens_out":6640,"duration_ms":56747,"temperature":0.7,"pith_summary":"The paper sets out to show that one drone, flying as a passive receiver outside the cellular network, can locate several 5G phones at once by listening to their periodic uplink sounding reference signals (SRS). It builds a complete onboard chain—coarse and fine synchronization, per-user identification, and trajectory-based localization—so the drone never needs control-plane access during the mission, only an initial SRS configuration. The authors report average localization errors below 3 m in rural field tests and below 8 m in urban simulations, and say their method beats angle-of-arrival and time-difference baselines by about 5–6 m while using only 1.4 MHz per SRS band. A sympathetic reader would care because this points to a cheap, infrastructure-independent way to get situational awareness in emergencies: fewer antennas, narrower bandwidth, and no serving-node role for the drone.","feed_headline":"Drone finds 5G phones from their uplink pilots to under 3 m","feed_subtitle":"Reading only standard 5G uplink pilots, a passive drone maps many users without touching the network.","key_machinery":"The engine is the normalized correlation metric M[n] computed between the two repeated halves of each SRS symbol—it provides timing, user separation (through cyclic shifts), and an antenna-selected signal-strength-like measurement whose variation along the flight path is treated as a spatial density. That density is fed into a weighted mean-shift estimator that iterates to a position estimate. A matching-pursuit stage over a DFT dictionary separates users sharing a band, and the periodic SRS structure lets synchronization be maintained with an O(1) recursive update.","core_discovery":"The paper's central claim is that a passive, non-serving UAV is sufficient for multi-user 5G localization, and that the SRS waveform itself can carry the whole pipeline. Exploiting the SRS's two identical halves and cyclic-shift multiplexing, the paper derives a normalized correlation metric that supplies coarse timing, user separation via matching pursuit over a DFT dictionary, and a signal-quality measurement whose spatial profile serves as the input to a weighted mean-shift position estimator. The result, as reported, is localization error below 8 m in urban and below 3 m in rural conditions, an improvement of 5–6 m over AoA and TDoA baselines, achieved with narrowband (1.4 MHz) SRS and l","pith_inferences":["Beyond the paper: the method's accuracy pivots on the assumption that the SRS correlation metric's peak coincides with the UE; the in-vehicle field data already show the metric peaking near reflection points, so the same experiment with truly separated UEs and strong reflectors would test whether mean-shift homes in on ghosts.","Beyond the paper: because the localization metric is essentially a radio-frequency map over the flight path, it could be fused with the drone's own inertial navigation to estimate both UE positions and drone trajectory errors jointly.","Beyond the paper: the framework presumes the network shares SRS configuration in advance; a future blind version that detects the comb structure and cyclic shifts without prior knowledge would extend the concept to non-cooperative users."],"forward_implications":["If the claim is right, emergency localization no longer requires deploying an aerial base station; a passive drone that just listens can map multiple phones from standard uplink pilots.","Narrowband SRS (1.4 MHz) is enough for meter-level accuracy, which lowers UE power consumption and lets a small drone carry low-cost receivers.","Because no control-plane interaction is needed during the mission, the same drone could fly into coverage-limited or disaster areas with only a one-time configuration from the network.","The SRS-derived correlation metric unifies synchronization, identification, and localization, so other periodic uplink pilots with similar structure could reuse the same chain.","The reported 5–6 m gain over angle- and time-difference baselines suggests trajectory-integrated consistency metrics are a competitive alternative in low-altitude NLoS conditions."],"fun_headline_variants":["Passive drone locates 5G users via uplink pilots","UAV maps many 5G phones just by listening","Drone uses 5G pilots to pinpoint users under 3m","Non-serving drone localizes multiple UEs from SRS","UAV tracks 5G users without network help"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The localization step assumes the normalized SRS correlation metric is a spatial density whose single peak sits at the UE position, so weighted mean-shift converges there; the paper offers no model or proof for that unimodality, and its own in-vehicle experiment shows the metric can peak at reflection points instead.","fun_headline_variants_meta":{"raw":{"variants":["Passive drone locates 5G users via uplink pilots","UAV maps many 5G phones just by listening","Drone uses 5G pilots to pinpoint users under 3m","Non-serving drone localizes multiple UEs from SRS","UAV tracks 5G users without network help"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000185,"raw_usage":{"total_tokens":1210,"prompt_tokens":846,"completion_tokens":364,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":590,"completion_tokens_details":{"reasoning_tokens":279}},"tokens_in":590,"tokens_out":364,"duration_ms":3466,"temperature":1.0,"reasoning_tokens":279,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T21:53:19.360863+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Put one UE in a scene with a large metal reflector, fly the drone along the same perimeter-plus-hexagonal-refinement path, and check whether the estimated position lands on the UE or on the reflector. The accuracy claim also needs a run with several physically separated UEs transmitting independent SRS waveforms—not three recorded signals replayed from co-located transmitters—to confirm multi-user localization in space.","supporting_citations":[],"review_version":1}