REVIEW 4 major objections 7 minor 21 references
Hierarchical Game Theory Catches 6G Beam-Hijacking Attackers
Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →
T0 review · glm-5.2
2026-07-08 16:01 UTC pith:YPUH3Y3T
load-bearing objection Reasonable architecture for 6G ISAC attacker detection, but the core Bayesian update mechanism is never specified mathematically — the central claim cannot be independently verified. the 4 major comments →
6G Sensing Security: Distributed Game-Theoretic RL for Urban Beamforming and Attacker Detection
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The paper's central object is a composite mechanism: a Stackelberg-Bayesian game whose utility function U = sum_j [(1-P_j)C_j - beta_risk * P_j * C_j] embeds per-user attacker probabilities directly into the strategic payoff, coupled with a Q-learning agent whose state space is a discretized (node ID, confidence level) tuple derived from the Bayesian belief vector. The discovery is that hierarchical decision-making between transmitters is not merely a coordination improvement but a prerequisite for effective Bayesian attacker detection: under the Nash model, simultaneous transmitter decisions create interference that contaminates the capacity-deviation signal the Bayesian update relies on, c
What carries the argument
Stackelberg-Bayesian game with Q-learning
Load-bearing premise
The entire detection mechanism rests on a Bayesian belief update whose likelihood function — described as an exponential derived from an anomaly score based on capacity deviation — is never formally specified. If this likelihood does not cleanly separate attacker-induced capacity drops from normal channel fading and interference, the belief values could converge to the wrong user, and the reported 0.9+ confidence would be a false certainty rather than a true detection.
What would settle it
If one replaced the Stackelberg structure with a Nash model but used a richer observation vector for the Bayesian update (e.g., per-user SINR trajectories rather than aggregate capacity), and detection accuracy matched or exceeded the Stackelberg result, then the paper's claim that hierarchical coordination is the key enabler of detection would be undermined.
If this is right
- If the Stackelberg structure genuinely cleans the Bayesian signal by reducing inter-transmitter interference, then any multi-cell ISAC deployment with overlapping coverage could benefit from hierarchical coordination before applying anomaly detection.
- The integration of attacker probabilities into utility functions suggests that physical-layer security in ISAC can be treated as a belief-driven resource allocation problem rather than a separate detection module.
- The 11% capacity gain from experience replay implies that attacker behavior has temporal structure worth modeling, which could motivate learned attacker models rather than purely reactive Bayesian updates.
- The discretization of continuous belief into five confidence levels for Q-learning state space suggests a general design pattern for injecting probabilistic security estimates into tabular RL without exploding the state space.
Where Pith is reading between the lines
- The Nash model's poor performance (38% accuracy) may not reflect a fundamental limitation of simultaneous games but rather the sensitivity of the unspecified Bayesian likelihood function to interference statistics. A different likelihood formulation or a feature vector beyond aggregate capacity deviation could potentially rescue simultaneous-decision detection.
- The single-attacker, four-receiver scenario is narrow. If multiple attackers coordinate, the Bayesian belief vector's normalization would dilute individual attacker probabilities, and the Stackelberg leader's utility function would need a combinatorial attacker-set formulation.
- The 2500 Mbps achieved capacity versus the 8.6 Gbps exhaustive-search maximum suggests the attacker still inflicts substantial damage; the framework detects and partially mitigates but does not neutralize the attacker. The residual gap quantifies the cost of operating under adversarial uncertainty.
- The reliance on aggregate network capacity as the sole Bayesian observation signal means the framework cannot distinguish between a subtle attacker and a user experiencing deep shadow fading — both manifest as capacity deviation. Richer per-user features (beam quality feedback patterns, temporal correlation of deviations) would likely improve the detection floor.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This paper proposes a hybrid framework combining Bayesian inference, game theory (Nash and Stackelberg), and Q-learning for attacker detection and beamforming optimization in a 6G ISAC urban scenario. The system model uses 3GPP TR 38.901 channel models with ray-tracing simulation in a Dortmund downtown environment. The Bayesian belief update identifies suspicious nodes based on capacity deviations, the game-theoretic model determines beamforming strategies, and Q-learning optimizes long-term decisions. The Stackelberg model achieves 69.41% detection accuracy versus 38.38% for Nash, and memory-based Q-learning improves capacity to approximately 934 Mbps with 75.46% detection accuracy. The central claim is that the Stackelberg-Bayesian approach with memory-based RL effectively detects an active attacker while maintaining system throughput.
Significance. The paper addresses a timely problem at the intersection of ISAC security, game theory, and reinforcement learning. The use of a realistic 3GPP-based ray-tracing urban scenario with specific antenna configurations and channel models is a strength, as is the comparison between Nash and Stackelberg game structures. The framework produces falsifiable detection accuracy numbers and throughput figures. However, the significance is substantially limited by the absence of mathematical specification for the core detection mechanism (the Bayesian belief update), which prevents independent verification of the reported results.
major comments (4)
- Section III: The Bayesian belief update is the core detection mechanism of the paper, yet it is described only qualitatively as 'based on the deviation between predicted and observed capacity, with an exponential likelihood derived from the anomaly score... obtained through normalization and recursive smoothing over iterations.' No equation for the likelihood function, no definition of the anomaly score, no recursive smoothing formula, and no specification of how 'predicted capacity' is generated are provided. Since the entire detection claim (belief values exceeding 0.9, 69.41%/75.46% detection accuracy) depends on this update rule, it must be mathematically specified. Without it, the results cannot be independently verified or reproduced. This must be addressed.
- Section IV: 'Detection accuracy' is reported as 69.41% (Stackelberg) and 38.38% (Nash), and 75.46% (memory) vs 70.13% (memoryless), but the metric is never defined. Is it per-iteration classification accuracy, final-state accuracy, or an average over iterations? How is a 'detection' counted — when maxbelief exceeds a threshold, or when the suspected node matches the true attacker? The definition must be provided, and confidence intervals or standard deviations across multiple runs should be reported, since the attacker is stated to be 'randomly selected in each run' but only two specific runs (RX3, then RX1) are shown.
- Section IV: There is an apparent inconsistency in the capacity numbers. The system model section states 'the maximum total channel capacity in the best case in this condition is 264.92 Mbps' for the 5G NR mmWave system, while the ray-tracing urban scenario reports 'the maximum total channel capacity is 8.60 Gbps' via exhaustive search. Then Fig. 5 shows convergence to approximately 2500 Mbps. The relationship between these three numbers (264.92 Mbps, 8.60 Gbps, 2500 Mbps) is unclear and should be clarified — particularly whether the 264.92 Mbps figure refers to a single-link scenario and how the 2500 Mbps result relates to the 8.60 Gbps optimum in terms of optimality gap.
- Section III, Eq. (9): The utility function U = sum_j [(1-P_j)*C_j - beta_risk*P_j*C_j] uses P_j (attacker probability) to penalize suspected attackers. The Q-learning reward is derived from this utility, and the Bayesian belief update depends on capacity deviations caused by the attacker. There is a potential circularity: beamforming decisions affect capacity, which affects belief updates, which affect beamforming decisions. The paper should discuss whether this feedback loop can lead to belief entrenchment (false positives that self-reinforce) and how the framework mitigates this risk.
minor comments (7)
- Section II: The statement 'the maximum total channel capacity in the best case in this condition is 264.92 Mbps' appears without context — it is unclear whether this is per-user, per-link, or system-wide, and under what configuration it was computed.
- Section III: The term 'Bayesian-like' is used repeatedly. If the update rule deviates from standard Bayesian inference, the authors should clarify what aspect is non-standard and use precise terminology.
- Section III: The leader selection rule ('the TX serving more users is given decision-making priority') is stated without justification. A brief discussion of why this heuristic is appropriate would strengthen the presentation.
- Section III, Eq. (7): The state discretization formula and the role of numStatesPerNode=5 could benefit from a brief example showing how a specific belief vector maps to a state integer.
- Figures 3-5: Axis labels and units should be checked. Fig. 5 shows 'system throughput' — clarify whether this is total channel capacity or something else, and include units on the y-axis. In Fig. 3, a legend or clearer color distinction would help readers differentiate between the four RX curves.
- Section IV: The execution times (84s and 73s) are reported without specifying the hardware platform, number of runs averaged, or whether these are per-iteration or total simulation times, limiting reproducibility.
- The paper would benefit from a more explicit comparison with [1] (Mamaghani et al.), which also uses a Stackelberg game with DRL for ISAC security, to clarify the novelty.
Simulated Author's Rebuttal
We thank the referee for a careful reading and constructive comments. All four major points are well-taken and will be addressed in the revised manuscript. Below we respond to each.
read point-by-point responses
-
Referee: Section III: The Bayesian belief update is the core detection mechanism but is described only qualitatively. No equation for the likelihood function, anomaly score, recursive smoothing, or predicted capacity generation is provided.
Authors: The referee is correct. The current manuscript describes the Bayesian belief update only in prose, which is insufficient for independent verification. In the revision, we will add the following mathematical specifications to Section III: (1) the anomaly score, defined as the normalized deviation between predicted and observed capacity, A_j(t) = |C_j^{obs}(t) - C_j^{pred}(t)| / C_j^{pred}(t), where C_j^{pred}(t) is the capacity expected under the assumption that user j is legitimate, computed from the current beamforming configuration and the 3GPP/ray-tracing channel model; (2) the exponential likelihood function L_j(t) = exp(-lambda * A_j(t)), where lambda is a sensitivity parameter; (3) the recursive Bayesian update P_j(t) proportional to L_j(t) * P_j(t-1), followed by normalization across all users; and (4) the recursive smoothing formula, which applies an exponential moving average over past posteriors to reduce temporal fluctuations. We will also state the values of lambda and the smoothing factor used in the simulations. This addition will make the detection mechanism fully reproducible. revision: yes
-
Referee: Section IV: 'Detection accuracy' is reported but never defined. Is it per-iteration, final-state, or average? How is a detection counted? Confidence intervals or standard deviations across multiple runs should be reported, since only two specific runs are shown.
Authors: The referee is correct that the metric is not defined and that statistical robustness is lacking. In the revision, we will: (1) explicitly define detection accuracy as the fraction of iterations in which the node with the highest belief value (maxbelief) matches the true attacker identity, averaged over the last 200 iterations of each run; (2) report the mean and standard deviation of this metric across at least 10 independent runs with randomly selected attackers, rather than only the two specific runs currently shown; and (3) clarify that the two runs shown (RX3 and RX1) were representative examples selected for visualization, not the sole basis for the reported accuracy figures. We acknowledge that the current presentation is misleading in this regard and will restructure the results section accordingly. revision: yes
-
Referee: Section IV: Apparent inconsistency in capacity numbers: 264.92 Mbps (system model), 8.60 Gbps (exhaustive search), and ~2500 Mbps (Fig. 5 convergence). The relationship is unclear.
Authors: The referee has identified a genuine presentation problem. The three numbers refer to different scenarios and should have been clearly distinguished. The 264.92 Mbps figure refers to a single-link baseline computation under the 5G NR CDL channel model (without ray tracing), used as a reference for the analytical channel model. The 8.60 Gbps figure is the maximum total network capacity obtained via exhaustive search over all beamforming combinations in the ray-tracing urban scenario, serving as an upper bound. The ~2500 Mbps result in Fig. 5 is the capacity achieved by the Q-learning agent under adversarial conditions (i.e., with an active attacker present), which naturally falls below the 8.60 Gbps attacker-free optimum. In the revision, we will: (1) explicitly label the 264.92 Mbps as a single-link CDL reference, (2) clarify that 8.60 Gbps is the attacker-free exhaustive-search upper bound, (3) state the optimality gap of the RL result (~2500 Mbps vs. 8.60 Gbps), and (4) note that the gap is partly due to the attacker's interference and partly due to the RL agent not converging to the global optimum within 200 iterations. We agree this clarification is essential. revision: yes
-
Referee: Section III, Eq. (9): Potential circularity between beamforming decisions, capacity, belief updates, and back to beamforming. Can this lead to belief entrenchment (self-reinforcing false positives)?
Authors: This is a valid and insightful observation. There is indeed a feedback loop: beamforming decisions affect observed capacity, which feeds the Bayesian belief update, which in turn influences the utility function and future beamforming decisions. In the revision, we will add a discussion of this circularity. We will note that the framework mitigates belief entrenchment through three mechanisms: (1) the epsilon-greedy exploration with a minimum epsilon of 0.05 ensures that the system periodically tests alternative beam configurations even when a belief has converged, providing corrective evidence; (2) the recursive smoothing uses a finite memory window, so that sustained contrary evidence can reduce a previously entrenched belief, as visible in Fig. 4 where the belief for RX1 temporarily drops; and (3) the Stackelberg leader-follower structure reduces internal interference noise that could otherwise cause spurious capacity deviations and false positives. However, we acknowledge that the risk of belief entrenchment is not fully eliminated, particularly in scenarios with persistent strong interference from non-attacker sources. We will add this as a limitation and discuss possible mitigations such as periodic belief reset or independent channel estimation as future work. revision: yes
Circularity Check
No significant circularity; self-citations are for standard RL/game-theory results, not load-bearing for the novel detection claim
full rationale
The paper's central claim—attacker detection via Stackelberg-Bayesian Q-learning—does not reduce to its inputs by construction. The utility function (Eq. 9) uses belief P_j to weight capacities, and the belief is updated based on capacity deviations, creating a feedback loop. However, this is a standard iterative learning architecture (observe → update belief → select action → observe new state), not a definitional circle: the belief is not *defined* in terms of the utility function, nor is the detection accuracy defined in terms of the belief threshold. The self-citations ([21] by Geranmayeh and Grass for the standard Q-learning update Eq. 8; [10] for beamforming comparison; [7], [8], [11] by Günlü et al. for ISAC security background) cite standard or background results, not novel claims that would make the derivation depend on itself. The most serious concern—the unspecified Bayesian belief update rule—is a correctness and reproducibility issue (the reader cannot verify belief convergence without the likelihood function, anomaly score definition, or smoothing equations), but it is not circularity: the update is described as depending on observed capacity deviations, which are environmental outputs, not the belief itself. No equation in the paper can be shown to equal its own input by construction. Score 2 reflects minor self-citations that are non-load-bearing for the central novel result.
Axiom & Free-Parameter Ledger
free parameters (6)
- numStatesPerNode =
5
- beta_risk =
Not specified
- alpha (learning rate) =
Not specified
- gamma (discount factor) =
Not specified
- initial epsilon =
Not specified
- shadow fading std =
7 dB
axioms (4)
- domain assumption The Bayesian belief update uses an exponential likelihood derived from an anomaly score based on capacity deviation
- domain assumption A single attacker is present among the receivers
- ad hoc to paper The leader in the Stackelberg game is the TX serving more users
- domain assumption 3GPP TR 38.901 UMi channel model accurately represents the urban Dortmund scenario at 28 GHz
read the original abstract
In next-generation networks, communication systems will no longer be limited to data transmission and will be expected to acquire awareness of the surrounding environment. This leads to the concept of integrated sensing and communication (ISAC), where the same wireless infrastructure is used for both communication and environmental sensing. Thus, ISAC enables the system to transmit information efficiently and observe and interpret channel variations and user behavior. Motivated by this capability, this work focuses on detecting an active attacker in an urban environment scenario, where the attacker intentionally manipulates beamforming directions to increase interference and mislead the transmitter into allocating the main lobe of beam toward itself instead of legitimate users. We apply game-theoretic approaches to model the interaction between legitimate users and the attacker, and integrate the resulting utility-based formulation into a reinforcement learning (RL) framework. Simulation results demonstrate that the proposed method effectively addresses security challenges in dynamic 6G ISAC systems.
Figures
Reference graph
Works this paper leans on
-
[1]
M. T. Mamaghani, X. Zhou, N. Yang, and A. Lee Swindlehurst, “Secur- ing integrated sensing and communication against a mobile adversary: A Stackelberg game with deep reinforcement learning,”IEEE Journal on Selected Areas in Communications, vol. 44, pp. 942–958, 2026
work page 2026
-
[2]
Principles of physical layer security in multiuser wireless networks: A survey,
A. Mukherjee, S. A. A. Fakoorian, J. Huang, and A. L. Swindlehurst, “Principles of physical layer security in multiuser wireless networks: A survey,”IEEE Communications Surveys & Tutorials, vol. 16, no. 3, pp. 1550–1573, 2014
work page 2014
-
[3]
The role of ISAC in 6G Networks: Enabling next- generation wireless systems,
M. U. F. Qaisaret al., “The role of ISAC in 6G Networks: Enabling next- generation wireless systems,”IEEE Transactions on Network Science and Engineering, vol. 13, pp. 7825–7861, 2026
work page 2026
-
[4]
Energy-efficient beamforming design for integrated sensing and communications systems,
J. Zouet al., “Energy-efficient beamforming design for integrated sensing and communications systems,”IEEE Transactions on Commu- nications, vol. 72, no. 6, pp. 3766–3782, 2024
work page 2024
-
[5]
Full-duplex communication for ISAC: Joint beamforming and power optimization,
Z. Heet al., “Full-duplex communication for ISAC: Joint beamforming and power optimization,”IEEE Journal on Selected Areas in Commu- nications, vol. 41, no. 9, pp. 2920–2936, 2023
work page 2023
-
[6]
Research and experimental validation for 3GPP ISAC channel modeling standardization,
Y . Zhanget al., “Research and experimental validation for 3GPP ISAC channel modeling standardization,”Elsevier Digital Communications and Networks, 2025
work page 2025
-
[7]
Secure inte- grated sensing and communication,
O. G ¨unl¨u, M. R. Bloch, R. F. Schaefer, and A. Yener, “Secure inte- grated sensing and communication,”IEEE Journal on Selected Areas in Information Theory, vol. 4, pp. 40–53, 2023
work page 2023
-
[8]
Secure Integrated Sensing and Communication: Information Theory Offers Insights
T. Welling, O. G ¨unl¨u, and A. Yener, “Secure integrated sensing and communication: Information theory offers insights,”arXiv preprint arXiv:2605.08106, 2026
work page internal anchor Pith review Pith/arXiv arXiv 2026
-
[9]
Flexible beamforming in 5G wireless for internet of things,
M. K. Maheshwari, M. Agiwal, N. Saxena, and A. Roy, “Flexible beamforming in 5G wireless for internet of things,”IETE technical review, vol. 36, no. 1, pp. 3–16, 2019
work page 2019
-
[10]
P. Geranmayeh and E. Grass, “Comparison of optimization techniques and machine learning methods for optimized beamforming in wireless networks,” inIEEE-APS Topical Conference on Antennas and Propaga- tion in Wireless Communications, 2024, pp. 66–70
work page 2024
-
[11]
Feedback lunch: Learned feedback codes for secure communications,
Y . Zhou, N. Devroye, and O. G¨unl¨u, “Feedback lunch: Learned feedback codes for secure communications,” inACM Workshop on Wireless Security and Machine Learning, 2026
work page 2026
-
[12]
C. Lei, H.-Q. Zhang, L.-M. Wan, L. Liu, and D.-h. Ma, “Incomplete information Markov game theoretic approach to strategy generation for moving target defense,”Elsevier Computer Communications, vol. 116, pp. 184–199, 2018
work page 2018
-
[13]
Optimal decision-making method for moving target defense based on multi-stage Markov signal game,
L. Jiang, H. Zhang, and J. Wang, “Optimal decision-making method for moving target defense based on multi-stage Markov signal game,”Acta Electron. Sin, vol. 49, pp. 527–535, 2021
work page 2021
-
[14]
L. F. Te ´ofilo, N. Passos, L. P. Reis, and H. L. Cardoso, “Adapting strategies to opponent models in incomplete information games: A reinforcement learning approach for poker,” inSpringer International Conference on Autonomous and Intelligent Systems, 2012, pp. 220–227
work page 2012
-
[15]
Z. Ren, D. Zhang, S. Tang, W. Xiong, and S.-h. Yang, “Cooperative ma- neuver decision making for multi-UA V air combat based on incomplete information dynamic game,”Elsevier Defence Technology, vol. 27, pp. 308–317, 2023
work page 2023
-
[16]
P. Yao, Z. Jiang, B. Yan, Q. Yang, and W. Wang, “Bayesian and stochas- tic game joint approach for cross-layer optimal defensive decision- making in industrial cyber-physical systems,”Elsevier Information Sci- ences, vol. 662, p. 120216, 2024
work page 2024
-
[17]
ETSI, “5G; Study on channel model for frequencies from 0.5 to 100 GHz (3GPP TR 38.901 version 16.1.0 Release 16),” Tech. Rep., Nov. 2020
work page 2020
-
[18]
MathWorks,Phased Array System Toolbox User’s Guide, Natick, MA, USA, 2026
work page 2026
-
[19]
Guidelines for evaluation of radio interface technologies for IMT-Advanced,
ITU-R, “Guidelines for evaluation of radio interface technologies for IMT-Advanced,” Geneva, Switzerland, Tech. Rep. M.2135-1, Dec. 2009
work page 2009
-
[20]
OpenStreetMap contributors, “Openstreetmap,” n.d., accessed: April 2026
work page 2026
-
[21]
Machine learning based beam selection for maximizing wireless network capacity,
P. Geranmayeh and E. Grass, “Machine learning based beam selection for maximizing wireless network capacity,”IEEE Access, vol. 12, pp. 45 176–45 186, 2024
work page 2024
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.