{"id":"5ddf7893-1281-48fd-9c24-ac57c9df0c5c","arxiv_id":"2608.00080","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Passive angle-of-arrival estimation of unmodified commercial 5G handsets from native uplink SRS is feasible with a two-element USRP B210 and a stock srsRAN gNB; accuracy is gated by SINR and multipath rather than range.","lead":"This paper shows that a standard open-source 5G base station and a two-antenna USRP radio can estimate the direction of commercial phones by passively reading channel estimates from their normal sounding signals. Indoor tests reach about 1.5° RMS error on n40; outdoor tests track up to four phones at once and show accuracy is limited by signal quality and multipath, not distance.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Unverified assumption that srsRAN debug log preserves true inter-antenna phase (H=ρ[h_rx0;h_rx1]) is the load-bearing point; a wired phase-injection test should settle it.","rationale":"The reader's weakest_assumption identifies exactly this: the native SRS channel estimates must preserve true inter-antenna phase via a real global ρ, and φ_hw stability is required. I focused on the H=ρ fidelity because it is more fundamental—if the log corrupts the inter-antenna phase, no amount of calibration can recover it. The paper provides no direct verification of this assumption; the OTA broadside calibration only removes a constant phase offset and cannot detect per-chain scaling, reordering, or time-varying phase. The paper's own disclosure that n78 is qualitative because it inherits n40 calibration reinforces that the phase model is not frequency-validated. However, the paper is honest about its limitations and the central feasibility claim might still hold if the logging assumption is verified. The reader's CONDITIONAL verdict already reflects this uncertainty, so my concern does not move the verdict; it strengthens the condition. A wired injection test is a concrete, low-cost way to settle the question definitively, either validating the method or exposing a fatal flaw. I agree with the reader's assessment and recommend no change to the verdict.","tokens_in":19925,"tokens_out":4397,"duration_ms":53184,"concrete_test":"Conducted phase-injection test: connect a common RF source through a calibrated phase shifter (e.g., 90° at the band center) split to both USRP B210 RX2 ports. Run the exact srsRAN gNB configuration with phy_level=debug, then parse the logged H to compute the inter-antenna phase difference over SRS resource elements. Compare against the injected phase offset, repeating at n40 and n78 and after power cycling. If the logged phase deviates from the injected value by more than the thermal noise bound (≈2° for the stated averaging), the H=ρ assumption is falsified. Additionally, inspect the srsRAN v25.10 source at the debug-log print statement to check whether channel estimates are normalized or reordered before printing.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on a single unverified software assumption: that the srsRAN PHY debug log H = ρ[h_rx0; h_rx1] preserves the true inter-antenna phase with a real scalar ρ, as asserted in Section III-B6. No evidence supports this: there is no wired back-to-back test with a known injected phase, no independent verification against a calibrated signal, and no audit of the srsRAN v25.10 logging code path. If the log applies per-chain normalization (e.g., AGC, channel-estimator scaling), reorders the antennas, or introduces a time-varying phase that ρ cannot absorb, then the calibration in Eq. (10) tares only a constant offset and every AoA estimate, including the 1.5° RMS headline and all outdoor multi-UE bearings, is corrupted. The paper's own Sec. IV-B shows φ_hw is frequency-dependent (+16.91° at n40 vs +29.38° at n78), yet the same OTA value +14.5° is applied to n78; Sec. VII correctly downgrades n78 to 'qualitative only,' which is an admission that the phase model is untested across bands. For n40, the logging assumption remains the weakest link because no calibration can compensate for per-occasion phase distortion introduced before the log is emitted.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a passive network-side uplink angle-of-arrival (AoA) estimator for COTS 5G handsets. It uses an unmodified srsRAN Project gNB with a single two-element USRP B210, extracts the native per-antenna SRS channel estimates from PHY debug logs, applies a one-time hardware phase-offset calibration plus a two-element MUSIC/phase-interferometer estimator, and validates the method through indoor n40/n78 and outdoor n40 multi-UE measurement campaigns. The main reported results are a 1.5° RMS indoor n40 error over a ±30° broadside sector, simultaneous AoA estimation for up to four handsets, and outdoor accuracy that tracks SRS SINR and multipath conditions rather than transmitter distance.","tokens_in":20224,"tokens_out":5096,"duration_ms":59270,"significance":"If the central logging assumption holds, the work is a useful practical demonstration: passive AoA from unmodified commercial handsets using a stock open-source gNB and a low-cost two-element SDR is a meaningful step beyond dedicated transmitters or modified RAN stacks. The paper is statistically careful in treating set-points rather than SRS occasions as the unit of replication, provides an explicit uncertainty budget, and is unusually honest about its limitations (e.g., n78 is downgraded to qualitative, the 42-m outdoor failure is a single-pass observation, and small-N rows are flagged as indicative). The multi-UE comb-4 separation and the theoretical Gaussian-noise baseline are also strengths. However, the unverified assumption about the srsRAN debug-log channel matrix is load-bearing, and the n78 results do not support quantitative claims as presented.","major_comments":[{"comment":"The entire framework depends on the assertion that the phy_level=debug log records H = rho[h_rx0; h_rx1] with a real scalar rho and no per-occasion phase transformation. The paper provides no evidence for this: there is no wired back-to-back test with a known injected phase, no comparison against a calibrated reference capture, and no audit of the srsRAN v25.10 logging code path. Because Eq. (10) subtracts only a constant phase offset, any per-chain normalization, antenna reordering, or time-varying phase in the logging pipeline would corrupt every bearing estimate in a way that calibration cannot fix. This is the central load-bearing point and must be validated before the quantitative claims can be accepted.","section":"III-B6, IV-A (Eq. 10)"},{"comment":"The conducted calibration shows that phi_hw is frequency-dependent: +16.91° at n40 versus +29.38° at n78. The OTA-calibrated +14.5° value from n40 is then applied to n78, and Section VII concedes that n78 is 'qualitative only.' This is internally honest, but the abstract states that indoor measurements on 'bands n40 and n78' achieve the 1.5° RMS result, which could mislead readers into thinking n78 is quantitatively validated. Either perform band-specific OTA calibration and report n78 errors, or state explicitly in the abstract that n78 results are qualitative only.","section":"IV-B/C and VII"},{"comment":"The headline 1.5° RMS indoor n40 result rests on N=5 set-points from a single UE in one room, with no confidence interval for the RMS itself; the approximate 95% CI for the bias would be wide. The paper does disclose the effective sample size, which is good, but the abstract's unqualified 1.5° figure overstates the strength of the evidence. The claim should be rephrased as indicative, with a confidence interval reported, or the headline should pool the available set-points with an explicit uncertainty estimate.","section":"Table VII, V-A2"},{"comment":"The abstract concludes that outdoor accuracy is 'primarily governed by propagation conditions and received SINR rather than transmitter distance.' This is supported mainly by one non-monotonic UE4 trajectory (2/4/27/42/61 m) and an indoor distance sweep with N=3 set-points. The paper appropriately calls the 42-m failure a single-pass observation and admits missing PHR and delay-spread measurements, but the abstract states the conclusion without these caveats. The causal claim should be softened or accompanied by the single-pass caveat in the abstract.","section":"VI-B and abstract"}],"minor_comments":[{"comment":"Typo: 'Table VI ummarizes' should be 'summarizes.'","section":"V-A5"},{"comment":"The angle convention is clear (theta_axis measured from array axis, broadside 90°), but the steering vector in Eq. (3) uses sin(theta) while Eq. (1) uses cos(theta_axis). It would help to state explicitly how the two are related in the text or figure captions.","section":"III-A and III-B9"},{"comment":"Minor wording issue: 'measured, UE1 UE3' should be 'measured, UE1-UE3' or 'UE1/UE3.'","section":"Figure 4 caption"},{"comment":"The phrase '2πphase-wrap' should be '2π phase-wrap' for readability.","section":"VI-B"},{"comment":"The sentence 'the empirical CDF of Figure 10 presents...' is grammatically awkward; consider rewriting.","section":"V-B3"}],"recommendation":"major_revision","confidential_remarks":"The paper is technically careful and unusually transparent about its limitations. The decisive issue is the unverified srsRAN debug-log phase assumption; a wired phase-injection test would settle it and is within the scope of a revision. If the authors add such a test and adjust the abstract's n78 and 1.5° claims, I would be willing to reconsider. I do not see a fundamental theoretical error in the estimator or statistics as presented."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague, my take: the genuinely new thing here is the integration path — pulling per-antenna SRS channel estimates out of an unmodified srsRAN gNB debug log and turning them into bearings for unmodified COTS handsets on a two-element B210. If that pipeline works, it gives you cheap passive uplink AoA for ISAC and positioning testbeds. That is worth knowing.\n\nThe paper does several things well. The statistics are unusually careful for a testbed paper: they treat set-points, not millions of SRS occasions, as independent replications; they provide an explicit uncertainty budget; they downgrade n78 to qualitative because it inherits the n40 calibration; they flag the 42 m failure as single-pass and not a proven mechanism. The noise baseline derivation is standard but correct, and the empirical SINR gate is a concrete, useful finding.\n\nThe soft spot is the one the stress-test flags, and it is real. The assumption that the srsRAN debug log H = ρ[h_rx0; h_rx1] preserves the true inter-antenna phase with a real common scalar is asserted in Section III-B6 but never directly verified. No wired injection of a known phase difference, no audit of the logging code path. If the log applies per-chain normalization or introduces a time-varying phase, all bearings are corrupted. The internal consistency — bearings tracking the goniometer across dozens of set-points, bias flipping sign between open and glass-facade geometries — makes me lean toward the phase being preserved in practice, but 'lean' is not evidence. This is fixable: a back-to-back phase-injection test or a code-level trace would settle it.\n\nOther soft spots are proportionate. The headline 1.5° RMS sits on N=5 set-points; n78 is qualitative only; the 42 m failure is a single pass; no data or code are released. None of these are fatal, because the paper is transparent about them.\n\nWho is this for? People building SDR-based 5G positioning or ISAC testbeds, and anyone wanting a concrete reference on what a two-element B210 can do with native SRS. I'd bring it to a reading group and would consider citing the integration approach. It deserves a serious referee: the premise matters, the execution is honest, and the load-bearing assumption is testable. I'd send it out, with the main request being a verification of the logging phase preservation and, ideally, a data/code release.","headline":"Honest, well-structured feasibility study of passive SRS AoA with a two-element B210; the load-bearing unverified assumption is that the srsRAN debug log preserves true inter-antenna phase.","tokens_in":20752,"tokens_out":3276,"would_cite":true,"duration_ms":38389,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper shows that a two-antenna receiver can passively estimate the direction of unmodified 5G phones from the base station's own sounding-reference-signal channel estimates.","keywords":["angle of arrival","5G NR","SRS","MUSIC","software-defined radio","USRP B210","passive sensing","uplink positioning"],"falsifier":"Compare the logged channel vector H for a fixed broadside source before and after rotating the array or changing band: if per-chain normalization, reordering, or a time-varying phase appears that a real ρ cannot absorb, the bearing estimates are invalid. More directly, repeat the n78 measurements after calibrating φ_hw at n78; if the errors do not fall to the n40 level, the inherited n40 calibration is not the limiting factor and the paper's frequency-stability assumption fails.","tokens_in":19788,"feed_emoji":"📡","tokens_out":9075,"duration_ms":84789,"temperature":0.7,"pith_summary":"This paper tries to show that a cellular base station can determine the direction a commercial 5G phone is transmitting from without modifying the phone, the protocol, or adding a dedicated positioning function. The key move is to read the angle from the per-antenna channel estimates of the uplink sounding reference signal (SRS) that the gNB already computes for normal communication, using a single two-antenna software-defined radio and a MUSIC estimator. Indoor measurements on band n40 report a root-mean-square bearing error of 1.5° over a ±30° sector around broadside, and outdoor tests on a live standalone network produce simultaneous bearings for up to four handsets. The paper argues that accuracy is driven by signal-to-interference-plus-noise ratio and local multipath rather than by transmitter distance, which would make passive network-side positioning cheaper and more scalable than dedicated positioning signals.","feed_headline":"Passive 5G handset direction finding hits 1.5° indoors","feed_subtitle":"A stock open-source gNB plus a two-antenna radio reads angles from native uplink SRS, no phone changes.","key_machinery":"The load-bearing object is the native per-antenna SRS channel estimate H = ρ[h_rx0; h_rx1] that the gNB PHY logs at debug level: the paper's premise is that this vector preserves the true inter-antenna phase up to a real scalar ρ, so the phase difference ∠⟨c0 c1*⟩ carries the bearing. A single two-channel software-defined radio provides the coherent pair (shared local oscillator), and a one-time calibration φ_hw = +14.5° at n40 broadside removes the fixed hardware offset. MUSIC with two elements degenerates to classical phase interferometry; the closed-form arcsin estimate initializes a ±15° search over the MUSIC pseudospectrum. Comb-4 frequency-domain SRS offsets plus RNTI tags separate up","core_discovery":"On the paper's own terms, the discovery is that native uplink SRS channel estimates from an unmodified open-source gNB carry enough spatial phase information for a calibrated two-element array to recover the bearing of commercial handsets. For each SRS occasion, the gNB logs the complex per-antenna channel vector H = ρ[h_rx0; h_rx1]; treating ρ as a real scalar and subtracting a one-time hardware phase offset φ_hw measured at broadside yields the inter-antenna phase that MUSIC converts to an angle. The indoor n40 campaign reaches 1.5° RMS error over a ±30° broadside sector; the outdoor campaign simultaneously tracks up to four handsets separated by comb-4 SRS interleaving and RNTI (radio-net","pith_inferences":["Editorial inference: the single-LO, single-calibration design is the reason the two-antenna setup works at all; scaling to more antennas would require either one multi-channel SDR with a shared LO or external synchronization, which the paper's own comparison suggests reintroduces drift.","Editorial inference: the n78 data provide a natural falsification experiment — if a band-specific φ_hw measurement at n78 (the conducted offset differs by ~12.5° from the n40 value) does not bring n78 errors near the n40 level, then the inherited calibration is not the main n78 penalty.","Editorial inference: the scene-dependent sign flip of the outdoor bias (open park positive, glass facade negative) suggests a calibration step conditioned on local scattering, e.g., per-sector multipath fingerprints, could extend the usable sector beyond ±30° and reduce the systematic bias.","Editorial inference: since the estimator cannot separate front from back, real deployments must either place users in the forward half-plane (as done here) or add a second baseline; a two-element interferometer alone cannot disambiguate a 30° target from its 150° mirror."],"forward_implications":["A base station can offer per-UE uplink bearing estimates as a passive network service, with no phone-side changes and no extra radio hardware beyond a second receive chain.","Two antennas can be enough for meaningful indoor accuracy (~1.5° RMS over a ±30° broadside sector), but performance degrades toward endfire and under multipath because the estimator has a single spatial baseline.","Simultaneous multi-user operation scales with SRS multiplexing resources: the paper demonstrates four handsets and notes comb-8, cyclic shifts, and time multiplexing as standard ways to go beyond.","AoA reliability is gated by SRS SINR rather than range: above roughly 5 dB in this deployment errors stay near 3°, below it they grow to 14–32°, so link-quality monitoring could serve as a validity flag for each bearing.","Uplink communication and sensing can coexist without mutual degradation: throughput stayed near the practical limit while bearings were produced, since throughput needs post-combining SINR whereas AoA needs a clean spatial phase."],"fun_headline_variants":["5G handset bearings from native uplink SRS, no phone mods","Passive AoA of 5G phones via SRS on a two-antenna USRP","Indoor 5G AoA hits 1.5° RMS using unmodified handsets","Track four 5G phones' angles from one gNB's SRS logs","COTS 5G handsets located passively via SRS phase, 1.5° error"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"Everything rests on the native SRS channel estimates logged by the gNB PHY preserving the true inter-antenna phase up to a real scalar ρ, and on the one-time hardware phase offset measured at n40 broadside staying constant across bands, geometries, and time.","fun_headline_variants_meta":{"raw":{"variants":["5G handset bearings from native uplink SRS, no phone mods","Passive AoA of 5G phones via SRS on a two-antenna USRP","Indoor 5G AoA hits 1.5° RMS using unmodified handsets","Track four 5G phones' angles from one gNB's SRS logs","COTS 5G handsets located passively via SRS phase, 1.5° error"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000476,"raw_usage":{"total_tokens":2216,"prompt_tokens":781,"completion_tokens":1435,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":525,"completion_tokens_details":{"reasoning_tokens":1318}},"tokens_in":525,"tokens_out":1435,"duration_ms":11275,"temperature":1.0,"reasoning_tokens":1318,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T01:20:52.515931+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compare the logged channel vector H for a fixed broadside source before and after rotating the array or changing band: if per-chain normalization, reordering, or a time-varying phase appears that a real ρ cannot absorb, the bearing estimates are invalid. More directly, repeat the n78 measurements after calibrating φ_hw at n78; if the errors do not fall to the n40 level, the inherited n40 calibration is not the limiting factor and the paper's frequency-stability assumption fails.","supporting_citations":[],"review_version":1}