{"id":"36db1d33-8518-4664-a6dc-e4799c8b8aab","arxiv_id":"2606.24210","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A conditional Timing Protection Level bounds undetected GNSS-spoof time error to a model-free monitor floor plus oscillator coast, calibrated to 114 ns at 1 s on a recorded attack.","lead":"The paper reports a field measurement showing a GNSS spoof pulled a receiver clock by 1.01 ms while the receiver reported at most 51 ns error. It derives a conditional Timing Protection Level that bounds undetected time error given an independent cross-satellite check plus oscillator holdover.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"TPL bound relies on independent cross-satellite check detecting spoof without spoofer driving it in lock-step; no demonstration that this condition cannot be evaded","rationale":"The reader's weakest_assumption directly isolates the same conditional premise that the third contribution requires. Because the paper presents the bound explicitly as conditional and supplies no additional evidence resolving the independence question, the load-bearing concern remains exactly as identified from the abstract; full-text access does not remove it.","tokens_in":1888,"tokens_out":371,"duration_ms":19854,"concrete_test":"In the open Kshana simulator, instantiate the cross-satellite consistency monitor, apply a coherent spoofer with common-mode ramp rate < 1 ms / 60 s to all visible satellites, and record whether the consistency statistic exceeds its threshold during the ramp; if it remains below threshold for the full attack duration, the detection precondition fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that TPL = (model-free monitor static floor) + (oscillator coast over detection latency) holds given detection by an independent cross-satellite consistency check that a coherent spoofer does not drive in lock-step. This condition is load-bearing: the impossibility result already shows that any self-referential clock-aided monitor alone permits unbounded error under sufficiently slow ramps. If a coherent spoofer can be constructed that applies a common-mode time ramp while preserving the cross-satellite residuals (i.e., drives the consistency check in lock-step), then the independent detector never triggers, the latency term is undefined, and the conditional bound collapses. The abstract states the condition but supplies no analysis of the check's measurement model, no proof that coherence precludes lock-step driving, and no counter-example search in the Kshana simulator.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript reports a field measurement from the JammerTest 2024 campaign in which a u-blox ZED-F9P receiver experienced a 1.01 ms served-time error under spoofing while its internal accuracy flag reported at most 51 ns. It proves that no finite unconditional bound on undetected time error exists under any single self-referential clock-aided monitor, because an adversary can always choose a sufficiently slow ramp that keeps the disciplined reference in lock-step. It then defines a conditional Timing Protection Level (TPL) as the sum of a model-free monitor's static detectability floor plus the oscillator coast over detection latency, conditioned on detection by an independent cross-satellite consistency check that a coherent spoofer does not drive in lock-step. Each term is given in closed form over primitives verified in the open Kshana simulator; when calibrated on the recorded attack the TPL evaluates to 114 ns at 1 s recovery and 458 ns at 60 s coast. The simulator, expressions, and calibration are released under AGPL-3.0.","tokens_in":2081,"tokens_out":546,"duration_ms":24621,"significance":"If the conditioning assumption holds, the TPL supplies a reproducible, hand-verifiable bound on undetected time error that is thousands of times tighter than the observed attack error and directly addresses the failure of position-domain RAIM against common-mode time pulls. The explicit open-source release of the simulator, the closed-form expressions, and the calibration example constitutes a verifiable and extensible contribution to GNSS timing integrity.","major_comments":[{"comment":"Abstract, third contribution: the claim that the TPL holds given detection by an independent cross-satellite consistency check that a coherent spoofer does not drive in lock-step is load-bearing for the entire conditional result. The manuscript supplies no measurement model for the check, no demonstration that coherence precludes lock-step driving of the residuals, and no counter-example search within the Kshana simulator, leaving the robustness of the conditioning assumption unverified.","section":"Abstract, third contribution"}],"minor_comments":[{"comment":"The abstract correctly states that the bound is calibrated rather than field-validated and carries no integrity-risk budget; repeating this disclaimer in the conclusions would improve clarity for readers who reach only the final section.","section":null},{"comment":"Notation for the model-free monitor's static detectability floor and the oscillator coast parameters should be introduced with explicit symbols in the main text before the closed-form expressions are presented.","section":null}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive review and for highlighting the centrality of the conditioning assumption. We address the single major comment below.","responses":[{"response":"We agree that the conditioning assumption is load-bearing and that the manuscript would be strengthened by additional substantiation. The cross-satellite consistency check is defined as independent of the self-referential clock-aided monitor; under a coherent spoofer the common-mode time pull leaves the differential residuals (and thus the check) unaffected, so the check cannot be driven in lock-step. However, the current text provides no explicit measurement model, derivation, or simulator counter-example search. We will revise to add a short dedicated paragraph supplying the measurement model for the check, showing why coherence precludes lock-step driving of its residuals, and stating the assumption explicitly as a prerequisite (with the associated limitation).","revision_made":"yes","referee_comment":"[Abstract, third contribution] Abstract, third contribution: the claim that the TPL holds given detection by an independent cross-satellite consistency check that a coherent spoofer does not drive in lock-step is load-bearing for the entire conditional result. The manuscript supplies no measurement model for the check, no demonstration that coherence precludes lock-step driving of the residuals, and no counter-example search within the Kshana simulator, leaving the robustness of the conditioning assumption unverified."}],"tokens_in":1611,"tokens_out":299,"duration_ms":20387,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The paper's core result is that any finite unconditional bound on undetected time error fails against a slow ramp when the only monitor is clock-aided and self-referential. A ramp slow enough to stay inside the disciplined oscillator's lock never triggers, so error can grow without limit. That impossibility is stated cleanly.\n\nWhat is new is the explicit impossibility argument plus the conditional Timing Protection Level expressed as the model-free monitor's static detectability floor plus the oscillator coast time over detection latency. Both terms are closed-form and tied to primitives verified in the open Kshana simulator. The field measurement from the JammerTest 2024 campaign is also useful: it shows a real spoof pulling served time by 1.01 ms while the receiver reported at most 51 ns.\n\nThe work is transparent about its limits. It calibrates the numbers (114 ns at 1 s, 458 ns at 60 s) on the recorded attack rather than deriving them from first principles independent of that data set. It carries no integrity-risk allocation and is presented only as a band at long coast.\n\nThe load-bearing assumption is that an independent cross-satellite consistency check will detect the attack and that a coherent spoofer cannot drive that check in lock-step. The abstract states the condition but supplies no measurement model for the check, no proof that coherence prevents lock-step driving, and no search for counter-examples. If that assumption does not hold, the conditional bound collapses exactly as the impossibility result predicts.\n\nThis paper is for people who design or certify timing receivers for critical infrastructure. Readers who need concrete numbers and open code for a conditional monitor will find it directly usable. It deserves a serious referee because the impossibility claim is straightforward and the conditional construction is a practical step even if the independence assumption requires more scrutiny in review.","headline":"No unconditional undetected time error bound exists under a single self-referential monitor, but the paper supplies a workable conditional TPL once an independent cross-satellite check is assumed to trigger.","tokens_in":2535,"tokens_out":448,"would_cite":false,"duration_ms":16037,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"A Timing Protection Level conditionally bounds undetected time error to oscillator holdover plus a model-free monitor floor under GNSS spoofing, if an independent check detects the attack.","keywords":["GNSS spoofing","timing protection level","holdover","undetected time error","model-free monitor","cross-satellite consistency","oscillator coast"],"falsifier":"A field recording of a coherent spoof in which the cross-satellite consistency check fails to alarm before the served-time error exceeds the calculated TPL value.","tokens_in":2778,"feed_emoji":"🛰","tokens_out":826,"duration_ms":16193,"temperature":0.7,"pith_summary":"The paper demonstrates that a GNSS timing receiver can be pulled by over a millisecond of served time during a recorded spoof while its own accuracy flag reports only 51 ns. It shows that no finite unconditional bound on undetected error is possible against an adversary who chooses an arbitrarily slow ramp, because a self-referential clock-aided monitor will stay locked and never alarm. The paper therefore defines a conditional Timing Protection Level as the sum of a model-free monitor's static detectability floor and the oscillator coast during the time to detection. This sum is expressed in closed form from simulator-verified primitives and yields 114 ns at one-second recovery or 458 ns at a 60-second coast when calibrated on the public JammerTest 2024 attack data. The bound is presented as calibrated rather than field-validated and carries no integrity-risk allocation.","feed_headline":"Conditional bound limits GNSS spoof time error to 458 ns at 60 s coast","feed_subtitle":"Timing Protection Level adds oscillator holdover to model-free monitor floor only when an independent check catches the attack","key_machinery":"The Timing Protection Level (TPL), formed as the sum of a model-free monitor's static detectability floor and the oscillator coast during detection latency, conditional on an independent cross-satellite consistency check detecting the attack.","core_discovery":"Against an adversary free to choose ramp rate, no finite unconditional bound on undetected time error exists under a single self-referential clock-aided monitor, because a ramp slow enough to keep the disciplined reference in lock-step is never alarmed while the error grows without limit. The Timing Protection Level (TPL) is therefore defined as a model-free monitor's static detectability floor plus the oscillator's coast over the detection latency; this bound holds given detection by an independent cross-satellite consistency check that a coherent spoofer does not drive in lock-step. Each term is closed-form over primitives verified in the open Kshana simulator, and calibration on the recor","pith_inferences":["If receivers routinely run both the model-free monitor and an independent consistency check, served-time error could be kept to sub-microsecond levels even under slow coherent spoofing.","The open-source simulator and closed-form expressions allow direct substitution of different oscillator specifications or monitor thresholds without re-deriving the entire bound.","The same conditional structure could be examined for other common-mode threats, such as ionospheric or ephemeris manipulation, provided an independent detector exists."],"forward_implications":["A clock-aided sequential test alone alarms only near the ~1 ms capture and therefore supplies essentially no protection against the slow ramp.","The model-free monitor alarms during the ramp itself, supplying the detectability floor that enters the TPL.","The resulting TPL is thousands of times smaller than the 1.01 ms error accepted by the receiver in the recorded attack.","The bound is reported as a band at long coast and carries no integrity-risk budget."],"fun_headline_variants":["TPL caps spoof time error at 458 ns for 60s coast","Conditional TPL limits undetected GNSS time error to 458 ns at 60s","TPL adds holdover to model-free floor for 458 ns bound at 60s coast","No unconditional bound: TPL holds spoof time error at 458 ns in 60s"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"An independent cross-satellite consistency check will detect the spoof attack and the spoofer will not drive that check in lock-step with the timing receiver.","fun_headline_variants_meta":{"raw":{"variants":["TPL caps spoof time error at 458 ns for 60s coast","Conditional TPL limits undetected GNSS time error to 458 ns at 60s","TPL adds holdover to model-free floor for 458 ns bound at 60s coast","No unconditional bound: TPL holds spoof time error at 458 ns in 60s"]},"model":"grok-4.3","cost_usd":0.006006,"raw_usage":{"total_tokens":2955,"prompt_tokens":890,"num_sources_used":0,"completion_tokens":89,"cost_in_usd_ticks":60062000,"prompt_tokens_details":{"text_tokens":890,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1976,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":890,"tokens_out":89,"duration_ms":13429,"temperature":1.0,"reasoning_tokens":1976,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-25T22:52:02.145820+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A field recording of a coherent spoof in which the cross-satellite consistency check fails to alarm before the served-time error exceeds the calculated TPL value.","supporting_citations":[],"review_version":1}