REVIEW 2 major objections 5 minor 29 references
Exploiting Phase Noise for Sensing Privacy in ISAC Systems
T0 review · 2 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash
Pith's one-line read This paper claims that in an OFDM integrated sensing and communication link, deliberately worsening Alice's local-oscillator phase noise enlarges her sensing privacy gap against a bistatic eavesdropper, with only a moderate communication…
desk verdict Correct LO-asymmetry math, but the privacy claim depends on a PN-ignorant Eve; needs a PN-aware adversary analysis. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the covariance of the differential phase noise (DPN) at each receiver. Alice's DPN $\xi_A(t,\tau)=\phi_A(t)-\phi_A(t-\tau)$ compares one local oscillator with a delayed copy of itself, giving the range-dependent covariance $R_{\xi\xi}(\Delta t,\tau)=4\pi f^A_{3\mathrm{dB}}\max(\tau-|\Delta t|,0)$. Eve's DPN compares two independent Wiener phase-noise walks, giving the delay-independent covariance $4\pi(f^A_{3\mathrm{dB}}+f^E_{3\mathrm{dB}})\min(t_1,t_2)$. This contrast, range correlation at Alice versus full Brownian drift at Eve, is what carries the privacy argument through the misspecified Cramér-Rao bound computation.
What would settle it
Replace the phase-noise-ignorant Eve in Section IV-B2 with an estimator that treats the phase-noise samples as unknown nuisance parameters and jointly estimates delay and phase noise, then compute Eve's range RMSE as a function of Alice's LO bandwidth; if this RMSE stays close to the phase-noise-free CRB, the claimed privacy mechanism collapses.
Extended reading notes
Core claim
The central discovery is that the architectural asymmetry between a shared local oscillator at a monostatic ISAC transceiver and the independent oscillators at a passive bistatic eavesdropper makes phase noise a privacy resource rather than only a nuisance. Proposition 1 shows Eve's differential phase noise has covariance $4\pi(f^A_{3\mathrm{dB}}+f^E_{3\mathrm{dB}})\min(t_1,t_2)$, independent of target delay, while Alice's has covariance $4\pi f^A_{3\mathrm{dB}}\max(\tau-|\Delta t|,0)$, which shrinks for small delays through range correlation. Under phase-noise-ignorant processing, Eve's misspecified bound grows with the total local-oscillator bandwidth while Alice's stays comparatively small for nearby targets, so increasing Alice's LO bandwidth widens the sensing privacy gap $\mathrm{SPG}_{\mathrm{dB}} = 10\log_{10}(LB_E/LB_A)$. The paper quantifies this in a three-way trade-off among Alice's sensing, Eve's sensing, and the communication rate.
Load-bearing premise
The entire privacy gain is computed against an eavesdropper whose estimator ignores phase noise; if Eve runs an estimator that tracks the phase-noise trajectory, she can undo most of the degradation the paper credits to LO asymmetry.
Editorial extensions
If this is right
- Sensing privacy in ISAC systems can be tuned by hardware choice: increasing Alice's LO 3-dB bandwidth enlarges the privacy gap because Eve's phase-noise variance grows with the OFDM symbol duration while Alice's remains tied to the target delay.
- In noise-limited communication regimes, privacy can be bought for a small rate penalty, since the rate is constrained mainly by additive noise rather than by phase noise.
- The privacy advantage is strongest for nearby targets, where range correlation suppresses Alice's differential phase noise while Eve's delay-independent differential phase noise remains at full strength.
- At high communication SNR, the same privacy gain costs more rate, revealing a quantitative three-way trade-off between Alice's sensing accuracy, Eve's sensing accuracy, and the achievable rate.
Reading between the lines
- The privacy mechanism likely depends on Eve remaining phase-noise-ignorant: if Eve runs an estimator that tracks the phase-noise trajectory jointly with delay, the misspecification inflation disappears and the privacy gap could shrink or vanish.
- The same LO-asymmetry could be used as an intentional, tunable privacy knob, but this would require accepting a lower oscillator quality as a deliberate design choice, which may conflict with communication and sensing accuracy requirements in other regimes.
- The delay-independence result for Eve's differential phase noise suggests a bistatic receiver could estimate the combined LO bandwidth from a single OFDM symbol regardless of target delay, which could be used for oscillator calibration or for detecting the presence of a passive eavesdropper.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper analyzes a three-party OFDM ISAC system composed of a legitimate monostatic transceiver (Alice), a passive bistatic eavesdropper (Eve), and a communication user (UE), each equipped with a non-ideal local oscillator modeled as a Wiener phase-noise process. It derives closed-form expressions for the differential phase-noise covariance at Alice, which is delay-dependent and equals 4π f_A max(τ−|Δt|,0), and at Eve, which is delay-independent and equals 4π(f_A+f_E) min(t1,t2). These statistics are used in a misspecified Cramér-Rao bound (MCRB) analysis to obtain ranging lower bounds under phase-noise-ignorant processing at both receivers. Simulations show that worsening Alice's oscillator quality (increasing f_A) degrades Eve's ranging performance much more than Alice's, thereby enlarging the sensing privacy gap, especially for nearby targets, at a moderate communication-rate cost in noise-limited regimes. The paper also presents trade-off curves between the privacy gap and achievable downlink rate.
Significance. If the results hold, the paper introduces a hardware-induced privacy mechanism for ISAC that complements existing waveform-design approaches. The core statistical insight—shared-LO self-referenced phase noise is delay-dependent while independent-LO cross-referenced phase noise is delay-independent—is clean, exact, and directly useful for system design. Proposition 1 and the covariance expressions are derived in closed form and are consistent with the Wiener phase-noise model; the MCRB and rate expressions follow standard machinery from [13], [14], and [25]. The predicted scalings (Eve's accumulated phase-noise variance growing with f_A+f_E and T, Alice's growing with f_A and τ) are falsifiable and not obtained by parameter fitting. However, the central privacy claim is demonstrated only against a phase-noise-ignorant eavesdropper; the paper provides no quantitative bound for a phase-noise-aware adversary. The significance of the work is therefore conditional on this threat-model assumption.
major comments (2)
- [Sec. IV-B2, Eq. (36), and Sec. VI] The headline result that worsening Alice's LO quality widens the sensing privacy gap is established only for a phase-noise-ignorant Eve. In Sec. IV-B2, the true model (23) includes a differential phase-noise process with the known covariance (27), but the assumed model (31) ignores phase noise entirely. Since the sensing privacy gap in (36) is the ratio of the resulting lower bounds, the gap reflects Eve's self-inflicted misspecification error, not a fundamental physical limitation. A phase-noise-aware Eve could in principle estimate the differential phase-noise trajectory jointly with the delay using the known prior (27), thereby removing much of the misspecification bias. The paper defers phase-noise-aware receivers to future work in Sec. VI but provides no bound on such an adversary. To support the claimed privacy mechanism, the authors should either analyze a phase-noise-aware Eve (for example, via a CRB with phase-noise nuisance parameters or a Bayesian bound using the prior (27)) and show the privacy gap persists, or explicitly restrict the privacy claim to phase-noise-ignorant receivers and justify that restriction as a realistic threat model.
- [Sec. II-D] The threat-model description is internally inconsistent with the evaluation. Sec. II-D states that Eve is modeled as the 'worst-case (most powerful) adversary' because she has perfect timing and perfect symbol knowledge, and the authors claim that any privacy gap therefore originates from the LO asymmetry alone. However, the sensing analysis in Sec. IV-B2 and all simulations in Sec. V evaluate Eve under a deliberately suboptimal, phase-noise-ignorant receiver. Perfect knowledge of timing and symbols does not make a receiver that ignores the known phase-noise statistics worst-case; a worst-case adversary would use all available statistical information, including the covariance (27). This discrepancy affects the interpretation of Figs. 4 and 5, where the privacy gap is driven by Eve's misspecification. The authors should either remove the phrase 'worst-case' and clearly state the adversary is restricted to phase-noise-ignorant processing, or extend the analysis to a phase-noise-aware Eve.
minor comments (5)
- [Eq. (28)] The notation ξ_gen and R_gen is used before it is defined; please define these symbols explicitly before presenting (28) and clarify that the trace expression applies to both the Alice and Eve covariance matrices.
- [Fig. 2] Fig. 2 is not labeled as either a theoretical plot or a Monte Carlo simulation. Since it plots the closed-form mean accumulated variance in (28), the caption should state that the curves are computed directly from (28), not simulated.
- [Sec. IV-B2] The MCRB derivation for Eve is only stated to follow [14, Sec. III-C], but the Eve model in (23) differs from the Alice model because the common phase has been absorbed into the channel gain α_E, making the effective gain random and dependent on the delay through φ_A(T_cp−τ). A brief derivation sketch for this case would improve reproducibility.
- [Sec. V-C and Fig. 5] The caption of Fig. 5 shows an arrow labeled 'Degrading LO quality at Alice' but does not specify the direction of increasing f_A. Please clarify that the arrow points in the direction of increasing f_A, consistent with the sweep over [100 Hz, 100 kHz].
- [Abstract and Introduction] The terms 'sensing privacy' and 'sensing security' are used almost interchangeably. The paper defines sensing privacy as protecting the privacy of sensed entities, but the mechanism actually degrades Eve's ranging accuracy, which is more akin to sensing security. The authors should either use one term consistently or explicitly define the relationship between the two concepts.
Circularity Check
No significant circularity: the privacy-gap trends follow from the stated Wiener PN model and standard misspecified CRB formulas, with no fitted parameter renamed as a prediction.
full rationale
The paper derives the differential phase-noise statistics at Alice and Eve from the independent Wiener PN assumptions in (14)-(16) and the architectural definitions in (5) and (10); Proposition 1 is an algebraic consequence of those assumptions rather than an input. The later variance comparison in (28) and the misspecified CRB bounds in Sections IV-A2 and IV-B2 are obtained by applying standard MCRB machinery [26] to the signal models (6) and (23), with the same derivational structure as earlier work [13], [14]. No parameter is fitted to a subset of data and then labeled a prediction: the SPG curves in Figs. 4-5 are computed directly from the derived LB expressions while sweeping f_A^3dB over a nominal range. Self-citations to [13]-[15] are prior model-building blocks whose assumptions are stated explicitly and are not used to forbid alternatives. The only notable limitation, that Eve is evaluated under a PN-ignorant processing model rather than a PN-aware receiver (acknowledged in Section VI), is a robustness/correctness concern about the adversary model, not a circularity: it does not make the derived bounds equivalent to their inputs.
Assumptions & free parameters
assumptions (6)
- domain assumption Phase noise processes at all LOs are modeled as Wiener processes with variance 4π f_3dB t (free-running Lorentzian oscillator model).
- domain assumption Eve is assumed to have perfect OFDM frame timing and perfect knowledge of the transmit symbols (worst-case adversary).
- domain assumption Both sensing receivers Alice and Eve use PN-ignorant processing (misspecified estimation: true data distribution includes PN, assumed model does not).
- domain assumption Narrowband PN approximation φ_A(t-τ_h) ≈ φ_A(t) at the UE, valid when f_A_3dB << Δf.
- domain assumption LOS-only frequency-flat Alice-UE channel is used for the rate evaluation.
- domain assumption The sensing task is restricted to delay/range estimation with single-antenna nodes; no angle/Doppler estimation.
Cite this review
Pith. "Pith review of Exploiting Phase Noise for Sensing Privacy in ISAC Systems." pith.science (2026). https://pith.science/paper/6QWXU47R
@misc{pith2026260813270,
author = {Pith},
title = {Pith review of: Exploiting Phase Noise for Sensing Privacy in ISAC Systems},
year = {2026},
howpublished = {\url{https://pith.science/paper/6QWXU47R}},
note = {Machine review of arXiv:2608.13270}
}
read the original abstract
We investigate sensing privacy in orthogonal frequency-division multiplexing (OFDM) integrated sensing and communication (ISAC) systems under the impact of phase noise (PN) arising from local oscillator (LO) imperfections. Specifically, we consider an ISAC scenario comprising a legitimate monostatic ISAC transceiver (Alice), an eavesdropper performing unauthorized bistatic sensing (Eve) and a communication user (UE), each equipped with a non-ideal LO. To characterize sensing performance in the presence of PN, we carry out a misspecified Cram\'{e}r-Rao bound (MCRB) analysis of monostatic and bistatic range estimation at Alice and Eve, whose differential PN processes are self-correlated (delay-dependent) and cross-correlated (delay-independent) due to the use of a shared and an independent LO, respectively. Simulation results reveal three-way trade-offs among legitimate monostatic sensing at Alice, unauthorized bistatic sensing at Eve and communication to the UE under PN, governed by the LO quality at Alice. Through the LO asymmetry between Alice and Eve, worsening LO quality at Alice can significantly enlarge sensing privacy gap in her favor, especially for nearby targets, with only a moderate reduction in data rate in noise-limited regimes.
Figures
Figures from the paper (2 more)
Reference graph
Works this paper leans on
-
[13]
Monostatic sensing with OFDM under phase noise: From mitigation to exploitation,
M. F. Keskinet al., “Monostatic sensing with OFDM under phase noise: From mitigation to exploitation,”IEEE Transactions on Signal Processing, vol. 71, pp. 1363–1378, 2023
work page 2023
-
[14]
On the impact of phase noise on monostatic sensing in OFDM ISAC systems,
——, “On the impact of phase noise on monostatic sensing in OFDM ISAC systems,” in2023 IEEE Radar Conference (RadarConf23), 2023, pp. 1–6
work page 2023
-
[25]
Performance analysis of OFDM with Wiener phase noise and frequency selective fading channel,
P. Matheckenet al., “Performance analysis of OFDM with Wiener phase noise and frequency selective fading channel,”IEEE Transactions on Communications, vol. 59, no. 5, pp. 1321–1331, 2011
work page 2011
-
[1]
Integrated sensing and communications: Toward dual- functional wireless networks for 6G and beyond,
F. Liuet al., “Integrated sensing and communications: Toward dual- functional wireless networks for 6G and beyond,”IEEE Journal on Selected Areas in Communications, vol. 40, no. 6, pp. 1728–1767, 2022
2022
-
[2]
Toward ISAC-empowered vehicular networks: Framework, advances, and opportunities,
Z. Duet al., “Toward ISAC-empowered vehicular networks: Framework, advances, and opportunities,”IEEE Wireless Communications, vol. 32, no. 2, pp. 222–229, 2025
2025
-
[3]
K. Hanet al., “Next-generation MIMO transceivers for integrated sens- ing and communications: Unique security vulnerabilities and solutions,” Proceedings of the IEEE, pp. 1–34, 2026
work page 2026
-
[4]
Integrating sensing and communications in 6G? Not until it is secure to do so,
N. Suet al., “Integrating sensing and communications in 6G? Not until it is secure to do so,”arXiv preprint arXiv:2503.15243, 2025
arXiv 2025
-
[5]
Multi-domain security for 6G ISAC: Challenges and opportunities in transportation,
M. F. Keskinet al., “Multi-domain security for 6G ISAC: Challenges and opportunities in transportation,”IEEE Communications Magazine, 2026, to appear
work page 2026
Show all 29 references
-
[6]
Sensing-secure ISAC: Ambiguity function engineering for impairing unauthorized sensing,
K. Hanet al., “Sensing-secure ISAC: Ambiguity function engineering for impairing unauthorized sensing,”IEEE Transactions on Wireless Communications, vol. 25, pp. 5386–5400, 2026
2026
-
[7]
Securing the sensing functionality in ISAC: KLD-based ambiguity function shaping,
B. Duet al., “Securing the sensing functionality in ISAC: KLD-based ambiguity function shaping,” 2025. [Online]. Available: https://arxiv.org/abs/2512.19974
2025
-
[8]
Generative AI based secure wireless sensing for ISAC networks,
J. Wanget al., “Generative AI based secure wireless sensing for ISAC networks,”IEEE Transactions on Information Forensics and Security, vol. 20, pp. 5195–5210, 2025
2025
-
[9]
Sensing security in near-field ISAC: Exploiting scatterers for eavesdropper deception,
J. Chenet al., “Sensing security in near-field ISAC: Exploiting scatterers for eavesdropper deception,” 2025. [Online]. Available: https://arxiv.org/abs/2510.20140
2025
-
[10]
RF front-end challenges for joint communication and radar sensing,
F. Bozorgiet al., “RF front-end challenges for joint communication and radar sensing,” in1st IEEE Int. Online Symp. Joint Commun. Sens., Feb. 2021
2021
-
[11]
Phase-noise compensation for OFDM systems exploit- ing coherence bandwidth: Modeling, algorithms, and analysis,
M. Chunget al., “Phase-noise compensation for OFDM systems exploit- ing coherence bandwidth: Modeling, algorithms, and analysis,”IEEE Transactions on Wireless Communications, vol. 21, no. 5, pp. 3040– 3056, 2022
2022
-
[12]
Range correlation effects in radars,
M. C. Budgeet al., “Range correlation effects in radars,” inThe Record of the 1993 IEEE National Radar Conference, April 1993, pp. 212–216
1993
-
[15]
Impact of synchronization error and phase noise on OFDM-based distributed ISAC systems,
K. Hanet al., “Impact of synchronization error and phase noise on OFDM-based distributed ISAC systems,” in2025 IEEE Radar Confer- ence (RadarConf25), 2025, pp. 538–543
2025
-
[16]
Phase noise in oscillators: a unifying theory and numerical methods for characterization,
A. Demiret al., “Phase noise in oscillators: a unifying theory and numerical methods for characterization,”IEEE Transactions on Circuits and Systems I: Fundamental Theory and Applications, vol. 47, no. 5, pp. 655–674, 2000
2000
-
[17]
Effects of phase noise on OFDM systems with and without PLL: Characterization and compensation,
D. Petrovicet al., “Effects of phase noise on OFDM systems with and without PLL: Characterization and compensation,”IEEE Transactions on Communications, vol. 55, no. 8, pp. 1607–1616, 2007
2007
-
[18]
Waveform design and signal processing aspects for fusion of wireless communications and radar sensing,
C. Sturmet al., “Waveform design and signal processing aspects for fusion of wireless communications and radar sensing,”Proceedings of the IEEE, vol. 99, no. 7, pp. 1236–1259, July 2011
2011
-
[19]
A spectral model for RF oscillators with power-law phase noise,
A. Chortiet al., “A spectral model for RF oscillators with power-law phase noise,”IEEE Transactions on Circuits and Systems I: Regular Papers, vol. 53, no. 9, pp. 1989–1999, Sep. 2006
1989
-
[20]
Impacts of phase noise on digital self-interference cancellation in full-duplex communications,
X. Quanet al., “Impacts of phase noise on digital self-interference cancellation in full-duplex communications,”IEEE Transactions on Signal Processing, vol. 65, no. 7, pp. 1881–1893, 2017
2017
-
[21]
MIMO-OFDM joint radar-communications: Is ICI friend or foe?
M. F. Keskinet al., “MIMO-OFDM joint radar-communications: Is ICI friend or foe?”IEEE Journal of Selected Topics in Signal Processing, vol. 15, no. 6, pp. 1393–1408, 2021
2021
-
[22]
OFDM radar algorithms in mobile communication net- works,
M. Braun, “OFDM radar algorithms in mobile communication net- works,”Karlsruher Institutes f ¨ur Technologie, 2014
2014
-
[23]
Bistatic OFDM-Based ISAC with over-the-air syn- chronization: System concept and performance analysis,
D. Brunneret al., “Bistatic OFDM-Based ISAC with over-the-air syn- chronization: System concept and performance analysis,”IEEE Trans- actions on Microwave Theory and Techniques, vol. 73, no. 5, pp. 3016– 3029, 2025
2025
-
[24]
Tutorial: Passive radar tutorial,
H. Kuschelet al., “Tutorial: Passive radar tutorial,”IEEE Aerospace and Electronic Systems Magazine, vol. 34, no. 2, pp. 2–19, 2019
2019
-
[26]
Performance bounds for parameter estimation under misspecified models: Fundamental findings and applications,
S. Fortunatiet al., “Performance bounds for parameter estimation under misspecified models: Fundamental findings and applications,”IEEE Signal Process. Mag., vol. 34, no. 6, pp. 142–157, 2017
2017
-
[27]
NR physical channels and modulation,
3GPP, “NR physical channels and modulation,” 3GPP TS 38.211 V16.1.0, Sophia Antipolis, France, Tech. Rep., 2020
2020
-
[28]
Analysis of oscillator phase-noise effects on self- interference cancellation in full-duplex OFDM radio transceivers,
V . Syrjalaet al., “Analysis of oscillator phase-noise effects on self- interference cancellation in full-duplex OFDM radio transceivers,”IEEE Transactions on Wireless Communications, vol. 13, no. 6, pp. 2977– 2990, 2014
2014
-
[29]
Computing timing jitter from phase noise spectra for oscillators and phase-locked loops with white and1/fnoise,
A. Demir, “Computing timing jitter from phase noise spectra for oscillators and phase-locked loops with white and1/fnoise,”IEEE Transactions on Circuits and Systems I: Regular Papers, vol. 53, no. 9, pp. 1869–1884, Sep. 2006
2006
Reviewed August 14, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.