mobile network operators

Abstract: Mobile money (MoMo) is Ghana's preferred retail payment channel, recording GHC518.4 billion in transactions in December 2025 and over 26.7 million active accounts (Graphic Online, 2026). This growth has coincided with increased social-engineering fraud over Short Message Service (SMS) and Unstructured Supplementary Service Data (USSD), where fraudsters impersonate network operators, agents, relatives, or regulators to obtain personal identification numbers (PINs), identity data, or funds. We present a supervised machine-learning pipeline for classifying scam and legitimate Ghanaian MoMo SMS messages using a labelled corpus of 220 messages across 18 scam and legitimate subcategories. Domain-specific normalisation of currency amounts, phone numbers, and USSD codes preceded TF-IDF vectorisation of unigrams and bigrams. Using stratified five-fold cross-validation and a 20% held-out test set, we trained and evaluated Multinomial Naive Bayes, linear support vector machine (SVM), and Random Forest classifiers using accuracy, precision, recall, F1-score, Matthews correlation coefficient (MCC), and area under the receiver operating characteristic curve (AUC-ROC). Held-out accuracy, F1, and AUC were 1.00 for Naive Bayes and linear SVM; cross-validated accuracy averaged 96.6% (+/-3.3), 94.9% (+/-4.6), and 92.0% (+/-4.2). Discriminative n-grams reflected imperative urgency ("send," "claim," "please send") and PIN solicitation ("PIN," "pincode"); legitimate messages featured confirmatory and cautionary language ("balance," "successful," "do not share"). Findings are contextualised in Sub-Saharan African SMS fraud detection, small template-based corpus ceiling effects, and a pathway toward larger naturalistic multilingual corpora. Interpretable classical classifiers achieve high accuracy on structured MoMo scam text and suit carrier- or handset-level filtering in low-resource, on-device settings.

Abstract: Predicting human mobility is central to network management, urban planning, and location-based services, yet privacy concerns are increasingly pushing such tasks toward federated learning. A key challenge in this setting is the strong heterogeneity of mobility data across users, which leads to non-IID data distributions and can significantly impact model performance and fairness. In this paper, we present a large-scale measurement study of device-level mobility heterogeneity using data from a major MNO in a dense European capital. Our dataset comprises mobility traces derived from network events, covering over 50,000 UEs across 178 smartphone models. We group devices into tiers based on their market segment and show that mobility characteristics, such as spatial range and regularity, vary systematically across these tiers, revealing a previously underexplored source of bias in mobility data. We investigate the implications of this heterogeneity on the use case of federated next-location prediction. In particular, we find that balancing device tiers across silos through tier-aware client selection yields the best results, improving fairness by up to 34.49% without degrading accuracy. In contrast, a FedProx-only approach achieves a 21.46% fairness improvement, offering a reasonable alternative when device information is unavailable, though with lower overall gains.

Abstract: This dissertation investigates whether Natural Language Processing (NLP) based semantic message prioritisation can improve the treatment of urgent disaster messages in opportunistic emergency communication, using the 2015 Nepal earthquake as a case study. TF IDF with Logistic Regression and BERT are used to classify social media messages into nine humanitarian categories, which are mapped to four routing priorities from P1 to P4. These priorities are integrated into the ONE simulator within a controlled Kathmandu earthquake scenario using a modified Binary Spray and Wait router. BERT achieves higher priority accuracy and P1 recall than Logistic Regression, while reducing under prioritisation and severe priority errors. However, improved NLP performance does not produce uniform network gains. P1 delivery probability remains high and similar across routing conditions, and no consistent latency reduction is observed. The clearest difference appears under buffer pressure, where the BERT condition shows fewer observed ground truth P1 buffer losses than Logistic Regression. The results indicate that semantic prioritisation is most valuable when limited transmission and storage resources are contested, although it cannot overcome mobility and contact constraints in opportunistic networks.

Abstract: Traffic forecasting requires modeling complex temporal dynamics and the spatial dependencies imposed by road topology. Supervised graph-based models achieve strong performance, but are often trained for a particular dataset and sensor graph, making deployment to new or evolving networks costly. Prior-Data Fitted Networks (PFNs) offer a zero-shot alternative by learning in-context inference from synthetic task priors, which provide an explicit mechanism for encoding domain-specific assumptions. Existing forecasting PFNs, however, do not explicitly represent the graph-structured dependencies governing traffic dynamics. To combine graph-aware traffic modeling with zero-shot adaptation, we introduce the Graph-Aware Spatiotemporal Prior-Data Fitted Network (GAS-PFN). GAS-PFN incorporates sampled road topology into its synthetic task prior through random-walk diffusion, teaching the model to learn graph-coupled dynamics during pretraining. Its co-designed inference architecture uses two mask-conditioned passes through a shared Transformer backbone to separately model sensor-specific temporal dynamics and spatiotemporal interactions among neighboring sensors before integrating their representations for prediction. This design enables GAS-PFN to use target-network structure and context without parameter updates. Across six benchmarks at the 90-minute horizon, GAS-PFN reduces MSE by 34.0% on average relative to TimePFN, its closest PFN-based predecessor. It also reduces MSE by 27.7% on average relative to four recent industry-developed general-purpose zero-shot forecasters. In this comparison, all models receive 90 minutes of contiguous recent history, and any additional context is drawn from each dataset's chronological training split. These results indicate that aligning PFN priors and inference architectures with graph structure improves in-context learning for zero-shot traffic forecasting.

Abstract: Network slicing is a key enabler for the coexistence of ultra-reliable low-latency communications (URLLC) and enhanced mobile broadband (eMBB) in 5G networks. However, allocating limited radio resources to heterogeneous slices while satisfying stringent quality-of-service (QoS) requirements remains challenging, particularly in the ultra-reliable regime where conventional effective-capacity-based approaches may lead to excessive resource allocation. To address this issue, this paper proposes a martingale-based resource block (RB) allocation framework for coexisting URLLC and eMBB slices. By constructing exponential martingale processes using the moment generating functions (MGFs) of the arrival and service processes and applying Doob's maximal inequality, explicit non-asymptotic upper bounds are derived for the URLLC delay violation probability and the eMBB backlog violation probability. Based on the resulting theoretical stability conditions, a low-complexity bisection algorithm is developed to determine the optimal martingale parameters, followed by a deterministic search algorithm to obtain the minimum RB requirements for both slices. Numerical results show that the analytical bounds effectively upper-bound the Monte Carlo simulation results. At a target violation probability of $10^{-6}$ for each slice, the proposed framework requires 44 RBs in total, satisfying the system capacity constraint of 50 RBs. Compared with the conventional effective-capacity baseline requiring 64 RBs, the proposed framework reduces total RB consumption by approximately 31.2% relative to the conventional effective-capacity baseline.

Abstract: Open Radio Access Network (O-RAN) enables mobility-management xApps, but a learned controller is not necessarily the most effective or efficient handover policy. This paper compares standard Event A3, a resource- and mobility-aware heuristic, and a Double Deep Q-Network (DDQN) through a common xApp-oriented interface and paired system-level simulation. The heuristic combines radio quality, target-cell resources, UE mobility, and service class, with weights optimized offline using NSGA-II, while DDQN-Multi uses temporal radio and resource observations. All controllers are evaluated on identical UE trajectories, traffic assignments, and ray-traced radio inputs under Base, High-Mobility, and High-UE scenarios. Performance is assessed using service, handover, resource, energy, and fairness KPIs, complemented by CRITIC--TOPSIS ranking and complexity analysis. Results show that the heuristic achieves the lowest outage in all three scenarios and ranks first in the CRITIC--TOPSIS comparison, while retaining linear online complexity and interpretable decisions. DDQN-Multi improves target feasibility under congestion but requires offline training and produces more handovers and ping-pong events. The results indicate that lightweight resource-aware control can provide a favourable performance-complexity trade-off relative to DDQN under the considered scenarios.

Abstract: AI-RAN platforms are expected to share CPU and GPU resources between radio workloads and AI services. Aggregate telemetry reports operating conditions, but timing changes may reflect different workloads, processors, or measurement boundaries. We propose workload-aware monitoring that associates radio-work descriptors with processing paths, timing boundaries, and operating context before comparing like with like. In 16 over-the-air downlink experiments, hybrid dispatch (CPU for transport blocks (TBs) below 4,096 bytes and GPU otherwise) has 29.66% and 22.93% lower mean host-callback durations than direct GPU dispatch, without and with a synthetic GPU co-runner, respectively. Grouping locates the separation in small TBs, while large-TB callback-duration ranges overlap. These observations identify a candidate for complementary CPU/GPU use.

Abstract: Reliable video perception over bandwidth-constrained wireless links requires transmitting information that the receiver cannot already recover from its evolving scene representation. This paper introduces WorldGT, a world-model-guided semantic packet transmission framework that prioritizes information according to its contribution to the receiver's perception. A shared feature-space world model predicts the receiver's scene state through affine motion compensation and learned residual displacement, while sender-side verification identifies reusable predictions. An acknowledgment-synchronized receiver twin estimates task-impact scores through two counterfactual evaluations, guiding packet selection and unequal error protection over LDPC-coded wireless channels. A compact 3-bit feature representation increases spatial coverage under stringent bandwidth constraints, while predictive fallback sustains perception during packet outages. Experiments on KITTI and VisDrone under Rayleigh fading and AWGN demonstrate substantial gains in low-SNR conditions. On KITTI at a 4.13% reference bandwidth budget, WorldGT achieves 47.5% J&F at 0 dB Rayleigh SNR, outperforming H.264 by 11.3 percentage points. Controlled ablations show that world-model prediction contributes up to 8.7 points under Rayleigh fading. Object-detection experiments further demonstrate the transferability of receiver-relative predictive transmission across visual perception tasks. These results establish world-model-guided, receiver-state-aware transmission as an effective approach to robust video perception under severe communication constraints.

Abstract: AI agents are increasingly deployed in mobile edge environments to autonomously handle diverse tasks through multi-step workflows. Unlike conventional dependency-aware tasks with predefined dependency structures, agent workflows are dynamically generated based on intermediate execution results. To minimize the weighted sum of job completion latencies, this paper models partially revealed agent workflows using dynamic workflow graphs and formulates an online scheduling problem that jointly optimizes computation placement, wireless resource block allocation, and edge computing resource allocation. To address the uncertainty of future workflow evolution, we first transform the weighted completion time objective into an equivalent per-slot holding cost and characterize the optimal policy through a Bellman equation. We then construct a tractable look-ahead cost-to-go surrogate based on the revealed workflow and the estimated remaining latencies of active jobs. The proposed scheduling algorithm leverages the surrogate to determine computation placement and uses the resulting operation criticality to allocate wireless and edge computing resources online. Simulation results show that the proposed algorithm outperforms the benchmark schemes across diverse scenarios.

Abstract: Mobile apps have become ubiquitous in daily life. Despite communication encryption, app fingerprinting (AF) attacks can still enable adversaries to infer the apps in use by analyzing patterns of encrypted network traffic. However, existing AF attacks suffer from three critical limitations that hinder their practical effectiveness: (i) the inability to capture app-specific traffic dependencies, rendering traffic fingerprints fragile under dynamic networking conditions; (ii) the neglect of latency and throughput considerations, resulting in inefficient real-time user tracking; and (iii) the incapacity to handle mixed traffic generated by multi-app concurrency. In this paper, we propose MAppPrint, a robust and real-time app fingerprinting framework. MAppPrint introduces a behavior-level traffic fingerprint, i.e., Traffic Behavior Correlation Graph (TBCG), which models app traffic by capturing unit traffic behaviors and their correlations, thereby providing reliable app fingerprints. To enable real-time fingerprinting, MAppPrint incorporates a fingerprint compression algorithm that transforms each TBCG into a compact graph by selectively aggregating redundant information. Furthermore, MAppPrint employs an unsupervised decomposition strategy to disentangle mixed traffic generated by multi-app concurrency, enabling unified identification of both single-app and multi-app traffic. Extensive experimental results demonstrate that MAppPrint achieves 4.9~13.9% improvement in AF precision and 3~6 times improvement in timeliness over state-of-the-art methods. Meanwhile, MAppPrint is robust in dynamic networking conditions, while achieving a throughput of 10.5 GB/s and a prediction latency of 0.68 seconds.

Abstract: Field nodes run image classifiers locally, exposing a first-class asset, the trained model, to theft. Trusted-execution enclaves, collaborative-inference splits, and encrypted storage assume the device owner is the adversary from deployment. Here the operator owns the node, and an adversary seizing it reads only what cold-boot capture finds resident. One answer stores nothing: a chunkable multi-exit model streams into volatile memory, rotating to bound residency. We characterise the capture envelope on real LTE traces across two victims of one architecture, against passive and adaptive adversaries. Neither survives a capable adversary; recovery cost alone differs. Against a from-scratch victim the uncaptured stages must be learned: the adaptive adversary gains most at shallow seizures, ends the CIFAR-10 envelope at every rotation, and stays rotation-bounded on CIFAR100, from 42.6% of usable seizures at 5 s to 86.8% at 30 s. Against the same architecture sliced from a public pretrained backbone, the adversary downloads those stages, recovering at least 90% of maximum accuracy at all depths, taking usable CIFAR-100 seizures from 0.0% to 97.3% at 5 s, given the victim's full labelled training set. Delivery-side secrecy raises a seizure's price; a public copy of the withheld stages erases it.

Abstract: Meeting hard task-completion deadlines for many simultaneously offloading users is the binding challenge in mobile-edge computing (MEC). As the user count grows, the transmit power required to satisfy every deadline within per-user budgets rises until no feasible allocation exists. We take a \emph{feasibility-first} view of this $K$-user problem in an uplink non-orthogonal multiple access (NOMA) MEC system served by a pinching-antenna system (PASS), whose radiating points establish strong line-of-sight (LoS) links that lower the received-power requirement. We formulate a latency-constrained joint optimization of transmit powers, CPU frequencies, and antenna configuration. We then derive a \emph{closed-form least-power feasibility test}: the componentwise-least allocation meeting every deadline. It certifies feasibility with the largest attainable margin to the power budgets and defines a practical \emph{quality-of-service (QoS)-feasibility outage} metric, the probability that no allocation meets all deadlines within budget. We solve the problem with a three-block alternating-optimization algorithm that is provably monotone-convergent and has polynomial complexity. Numerical results show that the proposed scheme sustains deadline feasibility at user loads where equal-power, orthogonal multiple access (OMA), and single-antenna baselines fail or degrade sharply, each by a mechanism predicted directly from the system model, whereas the proposed design degrades gracefully. Stress tests further show that feasibility is sustained under order-of-magnitude budget reductions, and that the pinching-antenna array itself enables constrained-budget operation. The result is a scalable, closed-form-initialized design for deadline-feasible offloading.

Abstract: Operational mobile networks are rich in observations but poor in interventions: they continuously generate large volumes of passive telemetry, while controlled action--response trajectories remain comparatively scarce and costly to collect. This observation--intervention asymmetry is a central obstacle to building practical world models for RAN control. We address this problem with RAN-JEPA, an action-conditioned world model that separates representation learning from intervention learning. The model first learns a predictive latent representation from observation-only network data, adapts that representation to the target deployment domain, and then learns action-conditioned latent dynamics from controlled sleep/wake trajectories while keeping the encoder fixed. We evaluate RAN-JEPA using public operator performance data for pretraining and a real-equipment four-cell 5G testbed for domain adaptation, post-training, and control. Across four future 15-minute intervals, RAN-JEPA achieves lower action-conditioned prediction error than a GPT-2 world-model baseline and a mechanistic rule, while remaining close to a strong persistence reference. What-if evaluation further shows that the model produces distinct and coherent future trajectories under matched SLEEP and KEEP plans. In closed-loop control, RAN-JEPA consistently supports higher sleep ratios than the two baselines at comparable congestion cost. These results show that observation-first, action-conditioned learning can turn abundant passive telemetry and limited intervention data into a practical predictive model for energy-aware RAN control.

Abstract: Hybrid federated semantic communication enables user equipment (UEs) to contribute model updates or semantic features under a shared training framework. However, heterogeneous role costs and the interaction between model aggregation and feature reconstruction (FR) remain key challenges in practical radio access network (RAN) deployment. To address these issues, we propose ARC-FedSC, a RAN-aware framework that coordinates UE role assignment and server-side controlled FR under a fixed communication budget. Within ARC-FedSC, RAN Aware Role-Bandit learns the historical contribution of UEs in different roles together with current uplink conditions, while Temporal Consistency Alignment (TCA) regulates FR according to recent model aggregation directions. Experiments on CIFAR-10 with time-varying RAN channels show that ARC-FedSC outperforms baselines across all five tested role configurations in the later training stage, with the best configurations achieving about 24.17 dB average PSNR over the last 20 rounds. Component level results further show that Role-Bandit maintains an average rolling UE coverage of 85.3%, compared with about 65.7% for baseline, while TCA reduces the probability of harmful FR events from 0.245 to 0.093, corresponding to a 62.0% reduction. Ablation and sensitivity studies further support the effectiveness and robustness of the proposed design.

Abstract: Supporting edge Artificial Intelligence (AI) inference as a network service is challenging because current mobile systems can transport tensors but do not expose or understand the inference context that gives those tensors operational meaning. Prior studies have addressed this gap through dynamic partitioning, collaborative inference, and split pipelines; however, these solutions remain application-bound, network-blind, or context-free. This work proposes Inference on Demand (IoD), an inference-on-demand abstraction that exposes split inference through a CAMARA-like Application Program Interface (API) and carries a split-aware tensor context in-band across the 5G user plane path. We evaluate the IoD on a programmable user plane function (UPF)-based testbed using a partitionable visual AI workload, showing that adaptive split selection can operate as a network-facing service while avoiding the rigid cost profile of static configurations. Including our findings, split inference becomes more than offloading when the service intent, runtime partitioning, and tensor transport are made visible to the mobile data plane. This opens a path toward network-native AI services, in which programmable telco infrastructure coordinates computation, context, and connectivity for user-facing applications.

Abstract: The growing deployment of compact large language models on smartphones is enabling autonomous on-device decision-making, such as emerging mobile GUI agents. However, many mobile decisions, such as network configuration when users switch apps or connectivity conditions change, must satisfy stringent latency constraints to preserve user experience. In this paper, we propose PEAM, an on-device LLM-based communication agent that autonomously generates personalized network-configuration rules executable within milliseconds. Specifically, PEAM first fine-tune the on-device LLM with a dataset constructed from manually annotated real-user data to integrate the communication knowledge into the local model. PEAM then operates in two phases. In the rule-generation phase, which is performed when the device is idle, such as overnight, PEAM analyzes historical network-configuration records in batches and reflects across batches to consolidate consistent evidence, reduce local bias, and derive robust configuration rules. To enable more accurate and stable rule generation over time, PEAM further constructs a user profile from high-confidence rules to capture the user's network preferences and incorporates this profile into each rule-generation cycle. In the rule-execution phase, PEAM is invoked when the communication context changes, such as when users switch apps or connectivity conditions change, and searches the rule library to identify and execute the appropriate rule. Experiments demonstrate that PEAM, based on a fine-tuned 4B model, achieves 99.13% correct network configuration decisions, while 92.50% of the rules generated by PEAM are valid, outperforming the traditional expert-rule based method by 4.41% and 84.50%, respectively.

Abstract: The continuous evolution of cloud gaming has enabled users to play high-quality cloud games on thin clients, such as smartphones and tablets. However, how to effectively transmit the gameplay frames with high resolution and low latency, especially over wireless networks, remains a significant challenge. To address this challenge, we propose a Deep Reinforcement Learning (DRL)-based Interest-Aware Adaptive Bitrate (ABR) scheme, called DIA, that guarantees the quality of perceptually key objects in each frame, while dynamically allocating lower resolutions for non-key objects to conserve bandwidth under constrained network conditions. By leveraging an off-the-shelf semantic segmentation model, the proposed DIA scheme can adjust the bitrate at the object-level. We also design a transformer-based feature extractor and an interest-aware reward function to enable the proposed DIA scheme to identify key objects and dynamically adjust their bitrates. This adaptation is guided by users' in-game movement speed, object features, and prevailing network conditions and operates without requiring additional hardware, such as gaze trackers. Extensive experiments show that the proposed DIA scheme outperforms existing ABR schemes in dynamic wireless network environments. Notably, DIA achieves at least a 20% higher normalized average Quality of Experience (QoE) than the State-Of-The-Art (SOTA) ABR algorithms in 5G scenarios.

Abstract: Vehicular networks require timely visual information exchange to support safety-critical applications such as cooperative perception and hazard awareness, yet transmitting high-dimensional camera data over bandwidth-limited and dynamic wireless links remains challenging. In this paper, we propose an adaptive semantic communication architecture for vehicular multicast that adjusts the amount of visual information transmitted according to current channel conditions, available communication resources, and latency requirements. Specifically, the visual encoder uses residual quantization to represent each image at multiple bitrate and reconstruction-quality levels. At runtime, the system selects an appropriate level based on the communication conditions, enabling it to trade visual fidelity for lower transmission overhead when network resources are limited. Context-adaptive entropy coding further compresses the quantized representations using offline-learned statistics, without requiring retraining for different channel conditions. This design allows the visual representation to be learned offline while the communication strategy is adapted online. Experimental results demonstrate competitive rate-distortion performance at ultra-low bitrates, improved delivery reliability and deadline satisfaction across diverse vehicular scenarios, and strong downstream perception performance, achieving up to 0.88 mAP50 while dynamically adapting to changing communication conditions.

Abstract: Collaborative inference between the edge cloud and user equipment (UE) is a promising paradigm for deploying large deep neural networks (DNNs) in 6G networks. However, existing cloud-edge inference and distillation schemes often require the real-time transmission of high-dimensional intermediate features or soft probability vectors, which imposes a substantial communication burden on bandwidth-limited wireless links. To address this challenge, we propose HintKD, a bandwidth-constrained distillation framework for cloud-edge inference. The core idea is to compress the teacher's guidance into compact discrete hints rather than transmit raw features directly. Specifically, a cloud-side teacher is first trained with a maximum conditional mutual information (MCMI) objective to preserve informative intra-class variations. Its latent representation is then mapped to a compact codebook through differentiable vector quantization. During deployment, the cloud transmits only a hint index, and the UE uses a lightweight FiLM-based adapter to modulate student features according to the received codeword. Experiments on the DeepSense 6G beam prediction task show that HintKD preserves competitive accuracy while reducing the inference-side communication payload from O(D_t) for feature transmission or O(C) for logit transmission to O(1) for discrete hint transmission. In addition, experiments on the MNIST dataset further verify the generality of the proposed distillation method across different datasets and tasks. These results show that HintKD achieves a favorable accuracy-bandwidth trade-off by replacing high-dimensional feature or logit transmission with a compact discrete hint index.

Abstract: Operator-side network profiles derived from 5G/ORAN traffic carry personal data such as ephemeral subscriber identifiers, slice-level KPIs, and control-plane signalling, and must be anonymised before release to a federated-learning aggregator, threat-intelligence exchange, or ML training pipeline. We study how much re-identification risk remains after standard operator-side anonymisation. We quantify privacy posture with k-anonymity, l-diversity and t-closeness, aggregate them into a composite Privacy-Posture Index (PPI), and measure residual re-identification across eight transformation configurations on internal PCAP captures and the public Idaho Labs 5GAD corpus, under a full-QI syntactic bound and two simulated adversaries. The evaluation is modest in scale, and we read its trends as indicative rather than definitive. Three findings emerge. Pseudonymisation alone leaves re-identification unchanged; material privacy gains arise when quasi-identifiers are coarsened through generalisation, optionally combined with suppression. A downstream classification task then shows that suppression-heavy releases retain majority-class utility but sacrifice much of their minority-class recall, a cost the aggregate metrics hide. Finally, the standard kmin-based PPI correlates only modestly with the disclosure bound and not at all with the partial-knowledge attack, whereas a mean-class-size variant PPI correlates strongly with all three disclosure/attack measures; we therefore read PPI as a regulator-facing summary, not a security bound. The profiles are produced by passive operator-side monitoring with rule-based DPI; our contribution is the privacy-quantification layer that computes these metrics, applies the transformation policy, and exposes both through an inspectable dashboard.

Abstract: A person who answers an unexpected call claiming to come from a bank has no way to check the claim. Australian text messaging has labelled a message as unverified when the sender identifier is not registered since 1 July 2026, but a voice call still arrives with nothing behind it, and voice cloning has removed the last cue recipients relied on. We present BVI, which answers one question for the recipient: did the calling party prove it holds a credential a registered organisation issued for this call? BVI keeps the organisational record, its authorised channels and its revocation state on a public ledger in a directly queryable form, and puts all decision logic in the handset, which performs eleven checks, pays no transaction fee and holds no full-chain state. We define ten attack classes plus the case in which revocation cannot be resolved, compare them in a 10-by-4 coverage matrix spanning BBCA, the content digest, the detector and composed BVI, and run 27 automated scenario tests against isolated Hardhat fixture states of the BVI contract; all 27 pass. For media substitution and synthetic speech, the contract tests validate commitment and gating properties rather than claiming detector accuracy. The mandatory per-session anchor costs about 91.5k gas and is invariant in call duration and hop count; each participating intermediary additionally contributes one optional attestation write. In a 20,000-session-per-cell path simulation, at one quarter carrier participation BVI detects 20.6 per cent of randomly located in-path rewrites versus 0.1 per cent for the every-hop comparison, while identity and content evidence remain available even when path evidence is indeterminate. We also quantify the throughput ceiling of the anchoring design.

Abstract: Disaggregated mobile networks expose open interfaces for independent agents to control the Radio Access Network (RAN). The interactions between agents with contrasting objectives can result in conflicts. However, existing conflict mitigation methods treat agents that control the same parameter as being in a conflict that requires arbitration of their actions, without assessing whether their objectives can be satisfied simultaneously. In this paper, we introduce a control-theoretic approach to determine when agents can coexist and share control of the same parameters. We model threshold-based agents often encountered in the literature as sampled deadband feedback controllers and represent their objectives through Key Performance Indicator (KPI) targets and tolerances that define acceptable deadband bounds. We derive compatibility conditions from these bounds and show that compatibility for any number of agents and monitored KPIs can be established through pairwise tests. We propose a conflict mitigation policy that allows compatible agents to share control of the same network parameters while restricting arbitration to cases where their objectives cannot be satisfied simultaneously. We evaluate our policy through simulations using NIST's ns3-oran extension of ns-3, and our results show that it enables agents to share control with near-zero Service Level Agreement (SLA) drift when their objectives are compatible and the shared acceptable range is attainable, while matching Priority Mitigation when their objectives are incompatible.

Abstract: The integration of Vehicle-to-Everything (V2X) communications is driving a profound transformation in vehicular connectivity, expected to significantly enhance traffic efficiency and safety. However, the stringent requirements of V2X services, particularly ultra-low latency and high reliability, present significant technical challenges. 5G's Network Slicing emerges as a key enabler by providing tailored virtual networks that ensure isolation and adaptability for heterogeneous services. This work proposes an intelligent Radio Access Network (RAN) slicing management framework specifically designed for scenarios where safety-critical V2X and high-capacity eMBB slices coexist. In such complex environments, harmonizing conflicting traffic requirements demands continuous, data-driven optimization. To achieve this, the proposed framework leverages an advanced Deep Reinforcement Learning (DRL) approach which dynamically optimizes resource allocation in real time. The framework is empirically validated on a real 5G Standalone (SA) network, where experimental results demonstrate that the DRL-driven approach successfully balances both objectives, outperforming traditional static and proportional allocation strategies by minimizing SLA violations while ensuring high resource utilization for eMBB slices.

Abstract: Federated LLM fine-tuning enables large models to be adapted using private and geographically distributed data at the network edge, creating recurring and deadline-sensitive communication workloads across access and transport networks. This challenge is particularly relevant in mobile RANs, where wireless variability, mobility, and device heterogeneity cause model updates to arrive asynchronously. Although these updates belong to the same learning round and share a common destination and deadline, conventional transport networks treat them as independent device-originated flows, hiding their underlying structure and limiting the ability to efficiently provision transport resources. This mismatch is particularly problematic for optical circuit switching and all-photonics transport, which benefit from predictable and schedulable traffic demands. We argue that future RANs should act as learning-aware traffic shapers by exposing the communication structure of distributed model adaptation to the transport layer. Through in-network aggregation at the gNB, asynchronous UE updates can be transformed into fewer aggregate transfers with bounded size and delivery requirements. Once shaped in this way, federated LLM traffic becomes a suitable candidate for selectively provisioned optical connectivity, where high-capacity paths can be established during aggregate-transfer windows and released between learning rounds. The resulting architecture combines the flexibility of packet-based mobile access with dynamically provisioned optical capacity, illustrating a broader approach for coordinating distributed AI workloads across programmable access and transport networks.

Abstract: Next-generation large language models (LLMs) are expanding from the cloud to ubiquitous edge devices. However, edge devices typically either lack the memory to store increasingly large LLM weights or, even with enough memory, spend unaffordable energy on loading the weights. This raises our question: can an edge device run an LLM without storing or loading its weights, but receive them over the air and consume them on the fly? Inspired by wireless broadcasting, we present AIR-LLM, an LLM inference architecture for edge devices, which is composed of: (i) a central radio (e.g., 5G base stations) that broadcasts the LLM weights into the air, and (ii) the edge user that receives the weights and completes the general matrix-vector multiplication (GEMV) of LLM inference directly in the radio frequency (RF) domain using RF mixers. To further shorten the airtime, AIR-LLM exploits MIMO spatial multiplexing and proposes an energy-efficient precoder-postcoder pair on the edge to calibrate its own wireless channel. Since the central radio stays user-unaware, AIR-LLM is user-scalable so that one broadcast serves unlimited users within its coverage. We implement AIR-LLM on the NVIDIA Sionna ray-traced channels of two real-world urban scenes and the profiling of a real RF mixer. With a WikiText-2 perplexity degradation of 4.0% on LLaMA-3.1-8B, AIR-LLM saves the energy by 157.7x/40.4x against the FP16 and weight-only quantization baselines; with 20 users, its airtime is 104.1x/26.0x shorter, respectively.

Abstract: The future 6G networks are expected to incorporate a proliferation of wireless services in diverse environments, which presents a significant challenge for information security. Conventionally optimization always requires recalculation and learning strategy often suffers poor generalization, which are thus incapable for the security provisioning with wide scenario coverage. In this paper, we propose an adaptive and robust learning framework that leverages a mixture-of-experts (MoE) architecture to achieve cross-scenario physical layer security guarantee. Specifically, we first select a few representative scenarios and establish the scenario-specific generative diffusion model (GDM)-based experts for secure transmission beamforming with artificial noise. The diffusion nature of experts learns the overall probability distribution of security strategy solution landscape and the Transformer-based denoising process enhances the ability to generalize across varying network configurations. Then, a lightweight gating network is constructed to identify the scenarios by engineering the channel features and select the most relevant experts. Finally, an attention-based combiner is introduced to synthesize the security proposals from the top-rated experts to produce a high-fidelity security strategy to cover the unseen scenarios. Simulation results demonstrate that the proposed GDM-based MoE framework can accurately recognize the scenarios and properly select the experts, maintaining near-optimal secrecy rates across a continuum of wireless scenarios and outperforming traditional single-model paradigms.

Abstract: The fifth generation of mobile networks was standardised with an explicit mandate to close long-standing privacy and security gaps, mandating the concealment of the subscriber's permanent identity, resistance to generational downgrade, and protection against location tracking. Assessing whether these guarantees hold in operational networks, however, requires separating two sources of residual exposure that prior studies do not distinguish and do not evaluate in the wild: protocol-design limitations, which remain exploitable even against a fully specification-compliant deployment, and implementation gaps, which arise from incomplete or non-compliant implementations. We present 5G-Shark, a security assessment tool and methodology that turns a legitimate mobility procedure against the subscriber. Rather than relying on active jamming or malformed-packet injection, 5G-Shark manipulates the standardised cell-reselection criterion to pull a target User Equipment onto a self-created rogue cell, establishing an attack vantage with minimal service disruption. Then, the proposed methodology effectively performs the required interactions to expose the security risks of the system under test, classifying them into the aforementioned categories. Built solely from open-source stacks and Software Defined Radio hardware and evaluated against commercial 5G Standalone deployments, 5G-Shark requests subscriber identifiers, forces Radio Access Technology downgrade via crafted Registration Reject codes, and induces denial-of-service states. For each vector, we attribute the root cause to protocol design or deployment non-compliance. We further provide empirical evidence that in several commercial deployments, temporary identifiers are re-allocated in near-sequential steps that keep successive values linkable, a weakness that enables persistent user tracking despite correct subscriber ID concealment.

Abstract: Intelligent transportation systems require Incremental Learning (IL) to continually improve their overall performance in dynamic environments. However, most edge devices lack the computational resources to support on-device IL, requiring updates to be transmitted from centralized servers. We propose using this setup to obtain dense, specialized module coverage that adapts a fixed base model to specific spatiotemporal contexts, such as parking lots, gas stations, ferries, or construction sites. However, in order to reliably transmit these modules to the edge device, using TCP, UDP, and BTP over V2X, Wi-Fi, and 2G-5G hardware, we establish a strict limit of 14.6 KB per module to fit within the first TCP window and to minimize UDP/BTP fragmentation. We further introduce Mixture-of-Experts for Communication-Aware Incremental Learning (MECAIL), the first method that meets this strict requirement, in which each new domain or environment is served by a small expert network that adapts the base model. We validate MECAIL on D-RICO and ODinW-13, where it largely matches the performance of parameter-heavy approaches while enabling practical, bandwidth-efficient large-scale deployment. This allows comprehensive coverage by experts for highly specific, focused, and temporary situations.

Abstract: The disaggregation and softwarization introduced by the Open Radio Access Network (O-RAN) architecture enable multi-vendor innovation but also expose the RAN Intelligent Controller (RIC) ecosystem to new runtime security risks. Existing O-RAN specifications define strong safeguards for onboarding, authentication, identity management, and secure communication; however, they do not provide a concrete mechanism for verifying whether deployed rApps and xApps remain in their intended, untampered state during operation. This paper introduces rApp/xApp attestation as a RIC-native O-RAN security use case for runtime integrity verification. Rather than proposing a new cryptographic protocol, the work defines how existing integrity verification techniques can be integrated into O-RAN through attestation modules, attestation agents, RIC application interfaces, and SMO-driven policy coordination. We map the use case to relevant O-RAN Alliance working groups, identify required standardization extensions, and demonstrate feasibility through a lightweight hash-based prototype implemented on the Near-RT RIC platform. Experimental results show attestation latencies below 40 ms across multiple cryptographic hash functions, indicating that runtime attestation can be performed without disrupting time-sensitive RIC operations when appropriately scheduled. Finally, we discuss remaining technical and standardization challenges, including trusted verification, known-good runtime states, scalability, mitigation policies, and future hybrid attestation mechanisms.

Abstract: Radio frequency fingerprint identification (RFFI) is a promising approach to distinguish physical wireless devices using hardware-induced signal imperfections. Conventional RFFI methods only provide discrete device labels and no human-interpretable representation of the relations among received signals. We propose supervised device charting, which maps location-insensitive channel-state information (CSI) fingerprints to a low-dimensional chart that visualizes cluster compactness, overlap, and outliers. We evaluate the method with real-world 5G New Radio (5G NR) measurements from six commercial smartphones and introduce the neighbor label error rate (NLER) to quantify class-separation accuracy. Our results demonstrate that two- and three-dimensional device charts provide an interpretable visualization of the learned RFFI representation. For three-dimensional device charts, the NLER is 0.22% for same-day measurements and 7.38% for measurements from the next day. The device charts reveal a cross-day distribution shift and map the held-out device close to the known device of the same model. Increasing the device chart dimensions further improves cluster separation at the expense of interpretability.

Abstract: Scheduling clients for model training is critical in federated learning due to both data and system heterogeneity. Most previous works focus on the quality of the scheduled clients to achieve faster convergence, shorter wall-clock convergence time, or better average model performance. They rarely consider the diversity of clients, which is important to counter heterogeneity and improve performance for the worst-off clients. In this work, we advocate the use of determinantal point processes (DPPs) to model and enhance the diversity in client scheduling. We first design the kernel matrices of DPPs using gradient information and quality scores, which inherently enables a flexible quality-diversity trade-off. Applying fast MAP inference over DPPs, we propose Adaptive Determinantal Client Scheduling (ADCS) in FL. We further quantify the gradient approximation error of ADCS and develop convergence analysis for general biased client selection in FL with non-convex loss functions. We conduct comparative numerical experiments showing that ADCS outperforms state-of-the-art client scheduling algorithms, including both quality-based and diversity-based ones.

Abstract: A SUPL\_INIT message is a network-initiated trigger that can be sent to a handset using an SMS to unilaterally start a location session: on receipt, the handset is instructed to determine its own position and report it, together with an identifier such as its IMSI, to a server specified in the message, without any action by the phone's user. The concern motivating this investigation is whether such a message could be used to silently exfiltrate a handset's location and subscriber identity to a server under an attacker's control. We investigated this on a Google Pixel 8 handset, which uses a Samsung Exynos modem and a Broadcom GPS/GNSS subsystem. We find no privacy issue: the handset never sends location data to an attacker-chosen server as a result of an unsolicited SUPL\_INIT delivered by SMS.

Abstract: This letter covers a broad comparison of methods for classification and regression applications for a user-level handover decision making in scenarios with adverse propagation conditions involving buildings, coverage holes, and shadowing effects. The simulation campaigns are based on network simulator ns-3. The comparison encompasses classical machine learning approaches, such as KNN, SVM, and neural networks, but also state-of-the-art fuzzy logic systems and latter boosting machines. The results indicate that SVM and MLP are the most suitable for the classification of the best handover target, although fuzzy system SOFL can perform similarly with lower processing time. Additionally, for the download time estimation, LightGBM provides the smallest error with short processing time, even in hard propagation scenarios.

Abstract: Accurate positioning is increasingly required in indoor and dense urban environments; nonetheless, satellite-based systems are not always available, and standardized 5G localization solutions remain difficult to deploy with commercial devices. This paper presents RUN-O-RAN, an O-RAN-native framework that enables network-centric uplink localization using standard Sounding Reference Signal (SRS) transmissions from commercial 5G devices. RUN-O-RAN xApp coordinates serving and neighboring base stations, enabling non-serving base stations to retrieve SRS-based uplink timing measurements that would be unavailable in conventional RAN deployments, without modifying the UE or existing 3GPP signaling procedures. The framework combines cooperative SRS collection, first-path time-of-arrival estimation, timing-advance tracking, clock-drift compensation, and multi-anchor position estimation into a complete network-side localization service. Experimental evaluation over $150,000$ SRS transmissions validates the proposed framework, achieving meter-level localization under diverse propagation conditions while revealing the impact of anchor geometry and multipath on positioning accuracy. These findings demonstrate that cooperative SRS-based localization can be realized within the O-RAN ecosystem without modifying commercial UEs, providing a practical foundation for future network-native ISAC positioning services.

Abstract: Function-as-a-Service (FaaS) is a widely adopted paradigm to simplify application deployment across the edge-to-cloud continuum. However, its stateless nature forces functions to retrieve their state from external, typically cloud-centric, data stores, reintroducing the very latency that edge computing aims to eliminate. This issue is further exacerbated by location-agnostic schedulers and rigid, one-size-fits-all consistency models that fail to capture the diverse requirements of edge applications. In this paper, we propose Ermes, a distributed platform that natively integrates state management into the FaaS paradigm, enabling the joint distribution of computational workloads and application state across the edge-to-cloud continuum. Ermes organizes application state into logical units, termed collections, and employs a distributed coordination algorithm that jointly maps collections and functions onto the available nodes seeking to minimize the latency perceived by the clients. In addition, it supports fine-grained replication and per-collection consistency levels, ranging from sequential to eventual consistency, leaving developers the choice of how to resolve the trade-off between consistency and performance. The experimental evaluation shows that Ermes quickly turns remote state accesses into local ones and sustains low latency as the workload grows, and as clients move across the edge.

Abstract: Conventional video metrics such as PSNR, SSIM, and VMAF measure visual distortion or perceptual quality, but they do not directly capture semantic preservation: whether compression retains a video's objects, actions, and temporal narrative. Existing Quality-of-Experience (QoE)-driven bitrate-selection and resource-allocation methods primarily aim to minimize rebuffering and bitrate switching while maximizing perceptual video quality, without explicitly considering semantic preservation. To address this gap, we introduce video semantic fidelity (SF), a metric that quantifies how well a compressed video preserves the semantic content of its source. An offline multimodal large language model (MLLM) generates structured descriptions of the reference and compressed versions of the video, and a separate text-only large language model (LLM) evaluates their semantic correspondence. The resulting content-dependent SF--bitrate profiles are cached and queried by the online bitrate selector without invoking MLLMs at runtime. Evaluations on three subjective QoE benchmarks show a consistent positive association between SF and mean opinion scores (MOS). A separate human semantic-rating study evaluates semantic preservation and shows that SF correlates more strongly with human judgments than conventional video metrics. We then embed these profiles into a 5G MEC-assisted video-on-demand (VoD) resource-allocation framework at the base station. When wireless resources cannot support high bitrate levels for all users, the framework uses the SF--bitrate profiles to select bitrate levels jointly across users and reduce the semantic loss caused by the required bitrate reductions. NS-3 simulations with the 5G NR module show that the proposed framework achieves higher average and worst-user SF than the evaluated baselines, with a widening advantage as the wireless resources available to each user decrease.

Abstract: Hurricane Helene produced the largest absolute cell-site outage in the public FCC record, peaking at 4562 sites. The conventional model is physical: towers destroyed. Helene did destroy over 1700 miles of fibre, but almost none of it was cell sites. We present the first cause-decomposed study of the FCC's Disaster Information Reporting System, reconstructing 80 state-days and 580 county-days from 24 daily filings by two reconciled independent extractions. Damage to cell sites is negligible: 1.1% of attributed cell-site-days across six states, at most 3.8% anywhere. The sites were standing. What took them out divides by terrain: pooled, power dominates at 63.2%, but in mountainous North Carolina severed transport (backhaul) reaches 52.2% against 47.3%, and in Tennessee 69.9%. North Carolina's transport share rises from 7.0% to 85.0% across the event (\r{ho} = 0.92). Seventeen days after landfall, on 15 October, 47 sites lost transport across six contiguous North Carolina counties with no rainfall, no power loss, no damage, and recovery by the next report. Independent active-probe measurement corroborates it: responsive /24s fall 1.02% for twelve hours while Tennessee stays flat. We release the dataset. Backup power is the standard resilience investment; here it addresses the smaller half of the problem.

Abstract: Applying QoE analysis to optimize usage of cellular spectrum is of high interest to mobile network operators. A key challenge is to be able to perform QoE measurement across very different types of apps, from DASH VoD to interactive applications such as Video Conferencing and Cloud Gaming. This paper presents AMVOTS, a QoE measurement system developed by AT&T, which is flexible enough to support a large range of application types and network conditions. We also discuss using AMVOTS as part of a closed loop to prototype QoE-aware radio resource allocation.

Abstract: Mobile networks evolution is characterized by a substantial increase in system complexity, driven by the need to accommodate a growing number of heterogeneous services on top of the digital infrastructure. This growth in service accommodation is expected to accelerate with the adoption of the Network as a Service (NaaS) paradigm, which has emerged as a promising approach to accelerate network innovation while enabling new revenue streams for operators. Although it is fundamental to abstract network capabilities for third-party developers, it poses significant challenges in terms of efficient network operation. To address this increased complexity, future mobile networks are envisioned to be inherently Artificial Intelligence (AI)-native. In particular, the integration of AI within the Radio Access Network (RAN) becomes a key enabler for optimizing operation, energy consumption, and autonomous network control. In this context, this research explores the convergence of AI-native RAN and NaaS ecosystems to enable autonomous 6G RAN management. We propose an Agentic-based orchestration framework capable of interpreting intent-based policies. The proposed framework becomes key to integrate external NaaS requests with internal network management policies.

Abstract: Machine learning has shown its largest gains in the band below 10 ms inside a 3GPP new radio (NR) 5G distributed unit (DU): link adaptation, per-slot scheduling, channel estimation, and the receiver itself. No open platform has let independently built software run there. Prior dApp frameworks reached the band only as external observers of an export stream. This paper is a guided introduction to the OCUDU dApp platform, an open runtime and E3 interface under which signed AI-RAN applications execute inside a production DU under three timing contracts: resident on the GPU receive chain (Class A), inside the scheduler's 100 us admitted deadline (Class B), or as never-blocking observers whose results the scheduler consumes (Class C). The conventional path is never displaced, and every authority is typed, validated, and operator-bounded. The paper explains how the runtime, the embedded E3 agent, and the three public repositories fit together; shows a dApp's source, its signed package, and its lifecycle state machine; defines the contracts a module is written against; and shows how one management surface serves a Python script, an operator's console, and an LLM agent. On a GB10 gNB with attached handsets, dApps of all three classes, including an out-of-tree neural equalizer, ran together on a live cell without a single fallback, and equalizer variants were compared over the air by lifecycle operations alone. Every measured checkpoint is reported with its conditions and its gaps. Platform, SDK, and a zero-hardware quickstart are public under BSD-3-Clause-Clear as a preview release of the OCUDU AI-RAN Working Group 2, inviting feedback, new use cases, and independent vetting ahead of upstreaming into the OCUDU mainline.

Abstract: GSMA Remote SIM Provisioning (RSP) enables over-the-air delivery of eSIM profiles, but it exposes long-lived identifiers during profile ordering and download. In particular, stable device identifiers (e.g., EID), profile identifiers, and long-lived certificate material enable mobile operators and profile-delivery infrastructure to link provisioning events to the same eUICC and, when combined with account records, to the same subscriber. This undermines subscriber anonymity and enables cross-session tracking. We present ZK-eSIM, a privacy-preserving redesign that achieves subscriber anonymity and provisioning-session unlinkability while retaining accountable traceability by exception. ZK-eSIM (i) replaces direct disclosure of device identifiers with a zero-knowledge proof of device validity and eligibility; (ii) enforces session unlinkability through short-lived, one-time pseudonymous credentials and per-session identifiers to prevent cross-session tracking; and (iii) provides privacy-preserving accountable traceability through a jointly authorised escrow mechanism, so that no single entity can unilaterally deanonymise a user. We formalise a multi-entity, honest-but-curious threat model and prove subscriber anonymity and the unlinkability of provisioning sessions under standard cryptographic assumptions. We implement a Java Card applet on a test eUICC to evaluate performance on commodity hardware with a modified LPA and SM-DP+ server. Our experiments quantify end-to-end cryptographic overhead relative to conventional RSP, confirming that ZK-eSIM adds only practical overhead, closing a critical privacy gap while preserving deployability within existing GSMA roles and interfaces.