Generative Diffusion Models for Secure UAV-ISAC with Real-Time Target Tracking

Paper Metadata

Title: Generative Diffusion Models for Secure UAV-ISAC with Real-Time Target Tracking.

Authors: Homa Nikbakht, Yonina C. Eldar, and H. Vincent Poor.

Source: arXiv:2610.28309, submitted on October 20, 2026, primary category cs.IT. Full text: https://arxiv.org/abs/2610.28309 .

Code status: No public implementation was found after searching by title, core method terms, and author names on October 28, 2026. The training and deployment details below come from the paper, not from an audited repository.

One-Sentence Summary

The paper identifies a leak that survives both encryption and conventional covert communication: an eavesdropper can infer a sensing event without decoding anything by noticing when an event-triggered message is added to an always-on traffic stream. It hides that traffic-composition change with a message-independent conditional diffusion safeguard, while joint power and beam control preserve target tracking, decoding reliability, and a usable sensing bound.

Figure 1: The dual-function UAV tracks a moving target while transmitting an always-on periodic stream and an event-triggered aperiodic alert. Eve observes the downlink and tries to infer the trigger state without decoding the message (paper Fig. 1).

Why Traffic Composition Matters

A UAV integrated sensing and communication system shares an array, spectrum, and power budget between radar-like perception and a communication link. In a surveillance mission, the same platform may track a moving target and notify a ground station when that target enters a protected region. The sensing result changes the communication schedule. That coupling is operationally useful, but it also creates a side channel outside the message itself.

Classical physical-layer security protects content. Artificial noise lowers the eavesdropper's signal quality, secure coding controls what can be decoded, and beamforming can place a null toward an unwanted receiver. Conventional covert communication protects a different event: whether a transmitter sent anything at all. Neither model fits an always-on downlink with event-triggered additions. The relevant observation is not a single symbol or a single packet, but the composition of traffic over time.

Suppose Eve compares each received slot with the expected periodic-stream subspace. A trigger may introduce a new codeword, a larger payload, or a different power split. Even when the payload is encrypted, the observation shifts at the exact time the target enters the protected region. Eve therefore learns the sensing decision without breaking a cipher. The protected quantity is whether the traffic contains a real aperiodic alert or only a routine periodic message.

Sending dummy aperiodic messages in every slot is a natural first defense. It removes the obvious on-off pattern, so Eve cannot simply test for extra energy. Fixed equal-power codewords are still points in a public signal space, however. At a sufficient signal-to-noise ratio, Eve can correlate against every codeword, recover the active index, and classify that index as either a real message or a dummy. Continuous transmission hides the switch; equal energy hides the power; neither hides the geometry of the codebook.

The remaining problem is to add randomness that Eve cannot cancel. A shared secret seed would let Bob regenerate and remove an artificial-noise waveform, but key distribution is itself a security burden, especially for a UAV that may be captured. The paper instead trains a public generator whose random realization is fresh in every slot. Eve knows the model but not the random draw. Bob also does not know the draw, so he must exploit the public distribution through a suitable receiver. This makes the waveform keyless, but it also means that randomness consumes the same power needed for communication and sensing.

System and Threat Model

The UAV hovers at height $H$ with an $N$-element uniform linear array. The target moves on the ground, and Bob is a ground user. The protected region is a disc of radius $R_0=40$ m centered at Bob. Each of the $L$ time slots carries a new periodic message. An additional aperiodic alert is present only when the sensing layer declares that the target is inside the protected region.

All transmit directions are fixed and statistically independent of the sensing measurements. A beam that followed the current target estimate would create a second leak because its gain at Eve would change with the track. Instead, a broad fixed beam illuminates the whole protected sector. The target still moves through different parts of that beam, so echo quality varies, but the transmitter does not disclose its current estimate through an adaptive pointing direction.

The direction cosine maps a ground point to the array's angular coordinate:

$$u(\mathbf{p}):=\frac{x_p}{\sqrt{H^2+\|\mathbf{p}\|^2}}.\tag{1}$$

This variable determines the steering vector and all beam gains. Bob, Eve, and the protected region occupy different values of $u$. Because the UAV hovers, the paper can precompute a fixed region beam and fixed null-space directions for Bob; motion of the target changes the echo but not the geometry of the three transmit components.

Let $a[\ell]\in\{0,1\}$ denote the trigger. The aperiodic stream is present in every slot. Its transmitted index is a real message index when a trigger is active and a uniformly selected public dummy index otherwise:

$$\tilde m_{a,\ell}=m_{a,\ell}\ \text{if }a[\ell]=1,\qquad\tilde m_{a,\ell}=d_\ell\ \text{if }a[\ell]=0.$$

The equal-power codeword is then $\mathbf X_{a,\ell}=\mathbf X_a(\tilde m_{a,\ell})$. Both real and dummy codewords lie on the same power shell. The hidden state survives not through energy or transmission activity, but through the relationship between codeword locations and the random waveform added to them.

Tracking and a PCRB-Based Trigger

The target state contains two positions and two velocities. A near-constant-velocity model propagates the state over short slots, while process noise absorbs small turns and accelerations. The radar echo provides range, radial velocity, and azimuth, so the measurement map is nonlinear. An extended Kalman filter linearizes this map and performs the usual predict-update recursion.

The filter covariance is not used as the safety certificate for triggering. Model linearization can understate error, and an overconfident trigger would leak at exactly the wrong moment. The paper instead uses the posterior Cramér-Rao bound, which lower-bounds the mean-square error of any estimator for the stated dynamic model. The Bayesian information matrix follows:

$$\mathbf J[\ell|\ell-1]=\left(\mathbf Q_n+\boldsymbol\Phi\mathbf J[\ell-1]^{-1}\boldsymbol\Phi^T\right)^{-1},\qquad \mathbf J[\ell]=\mathbf J[\ell|\ell-1]+\mathbb E\left[\mathbf H^T\mathbf R_s^{-1}\mathbf H\right].\tag{2}$$

The prediction term propagates prior information, and the update term adds information from the current echo. Here $\mathbf H$ is the measurement Jacobian and $\mathbf R_s$ is the covariance of range, Doppler, and angle errors. The scalar position PCRB sums the two position entries of the inverse information matrix.

The transmit beam pattern controls the average power reaching the target and therefore the echo quality. For a target at direction cosine $u_t$, the echo signal-to-noise ratio is modeled as:

$$\mathrm{SNR}_s[\ell]=\varsigma B(u_t[\ell])\left(\frac{d_{\mathrm{ref}}}{d_{ut}[\ell]}\right)^4.\tag{3}$$

$\varsigma$ is the reference SNR at distance $d_{\mathrm{ref}}$ under full illumination, $B(u_t)$ is the normalized beam gain, and the fourth-power term captures two-way path loss. Steering more safeguard power toward the protected region improves this quantity but takes masking power away from Eve.

At each slot, the filter produces a Gaussian belief over the target position. The trigger computes the probability mass of that belief inside the protected disc and compares it with a threshold:

$$p_{\mathrm{trigger}}[\ell]=\Pr_{\mathbf p\sim\mathcal N(\boldsymbol\mu_\ell,\boldsymbol\Sigma_\ell)}(\mathbf p\in\mathcal R),\qquad a[\ell]=\mathbf 1\{p_{\mathrm{trigger}}[\ell]\ge\rho\}.\tag{4}$$

The covariance $\boldsymbol\Sigma_\ell$ is a position submatrix of the predicted PCRB. Evaluating a bivariate Gaussian over an offset disc normally requires a series expansion or noisy Monte Carlo integration. The paper whitens the Gaussian with a Cholesky factor and switches to polar coordinates. The radial integral is solved analytically, leaving only a one-dimensional angular integral that is evaluated with a few hundred trapezoidal nodes. The trigger is therefore conservative near boundaries without adding random sampling noise to the decision.

A Trainable Safeguard Direction

The transmit design has three fixed directions: a region-illumination beam for the periodic stream, a beam toward Bob for the aperiodic codeword, and a safeguard direction that must help sensing without leaking into Bob. The paper constructs the safeguard inside the null space of Bob's steering vector. Within that null space, one vector is chosen closest to the region beam and another closest to Eve's nominal direction. Their weighted combination is normalized:

$$\mathbf v(\omega)=\frac{\sqrt{\omega}\tilde{\mathbf v}_r+\sqrt{1-\omega}\tilde{\mathbf v}_e}{\left\|\sqrt{\omega}\tilde{\mathbf v}_r+\sqrt{1-\omega}\tilde{\mathbf v}_e\right\|}.\tag{5}$$

Every value of $\omega$ retains a spatial null at Bob. When $\omega=1$, the safeguard reinforces region illumination and improves sensing. When $\omega=0$, it is biased toward masking Eve. The parameter therefore traces a concrete security-sensing trade-off instead of acting as an abstract regularization weight.

The complete transmitted matrix superposes all three streams:

$$\mathbf U_\ell=\sqrt{\lambda\mathsf P}\mathbf w_R\mathbf X_{p,\ell}+\sqrt{(1-\lambda)\gamma\mathsf P}\frac{\mathbf a(u_b)}{\sqrt N}\mathbf X_{a,\ell}+\sqrt{(1-\lambda)(1-\gamma)\mathsf P}\mathbf v(\omega)\mathbf W_{\theta,\ell}.\tag{6}$$

$\lambda$ divides power between the periodic and aperiodic traffic, while $\gamma$ divides aperiodic power between the codeword and the safeguard. The equation makes the system-level coupling explicit. Security is not a separate transmitter bolted onto the UAV; it changes the illumination available for tracking and the energy available to Bob for decoding.

Conditional DDIM as a Keyless Random Encoder

The safeguard is not a fixed Gaussian noise vector. A conditional denoising diffusion implicit model learns a waveform distribution and generates a new sample from Gaussian noise in every slot. The forward process gradually corrupts a clean waveform, and the learned network estimates the noise present at each diffusion step. The public condition contains slot parameters such as channel state information, and it carries no trigger state.

The reverse update can be written as:

$$\mathbf w_{t-1}=\sqrt{\alpha_{t-1}}\hat{\mathbf w}_0+\sqrt{1-\alpha_{t-1}-\sigma_t^2}\,\boldsymbol\varepsilon_\theta(\mathbf w_t,t\mid\psi)+\sigma_t\boldsymbol\xi_t.\tag{7}$$

Here $\hat{\mathbf w}_0$ is the network's estimate of the clean sample, $\boldsymbol\varepsilon_\theta$ is the learned noise predictor, and $\xi_t$ is fresh complex Gaussian noise. The stochasticity parameter $\eta$ controls $\sigma_t$. The deployed sampler uses only $K=6$ reverse steps, reducing the per-slot generation cost relative to a full diffusion chain.

The model distribution is public after training. Covertness does not require hiding the generator weights or the codebook. It requires the current random draw to be unknown to Eve. Training shapes the distribution so that the triggered and non-triggered observations have nearly the same law even when Eve knows that law. This is a different security claim from encryption: the attacker may know exactly how randomness is produced while remaining unable to predict the next realization.

Bob also lacks the random seed, so he cannot subtract the exact waveform. In the multi-antenna case, the safeguard is spatially nulled at Bob and the codeword is observed through a standard Gaussian channel. In the single-antenna or imperfect-nulling case, Bob receives the safeguard and must use its public distribution. The first receiver approximates the waveform as white Gaussian noise and applies a minimum-distance rule. The second trains a denoising network on public safeguard samples and estimates the waveform by Tweedie's formula. The decision is:

$$\hat m=\arg\min_m\left\|\mathbf r_m-\hat{\mathbf W}_m\right\|^2.\tag{8}$$

For the correct candidate, the normalized residual resembles a noisy draw from the safeguard generator and is reconstructed well. For an incorrect candidate, subtracting the wrong codeword leaves a structured shift. The denoiser is helpful when the codebook is dense and when the safeguard reaches Bob; the isotropic rule is nearly optimal when the spatial null is exact.

Covertness Loss and Joint Training

Covertness is stated in total variation distance. Let $P_\psi^{(0)}$ and $P_\psi^{(1)}$ be Eve's observation distributions without and with a real aperiodic message for the same public tag. If the two distributions coincide, no detector can improve on a blind guess. For equally likely hypotheses, detector error and total variation are linked by:

$$P_e=\frac12\left(1-d_{\mathrm{TV}}\left(P_\psi^{(0)},P_\psi^{(1)}\right)\right).\tag{9}$$

The paper cannot optimize this supremum directly because the generator provides samples rather than closed-form densities. It uses a maximum mean discrepancy as one differentiable proxy:

$$\mathrm{MMD}_k^2(P,Q)=\mathbb E[k(y,y')]+\mathbb E[k(w,w')]-2\mathbb E[k(y,w)].\tag{10}$$

The second proxy is adversarial. A classifier tries to infer the trigger from Eve's observation, while the generator and codebook are trained to make its posterior uniform. The loss also includes a differentiable cross-entropy decoder surrogate for Bob's aperiodic block error rate. Two extra penalties keep the waveform random: one suppresses a common batch mean, and another rewards spread among nearest-neighbor samples.

For fixed codebook size, power shares, and beam split, the design problem is:

$$\max_{\theta,\mathbf X_a,\lambda,\gamma,\omega}\ R_a\quad\text{s.t.}\quad d_{\mathrm{TV}}\le\epsilon_E,\quad\epsilon_a\le\bar\epsilon_a,\quad\overline{\mathrm{PCRB}}_{\mathrm{pos}}\le\epsilon_s.\tag{11}$$

The aperiodic rate is $R_a=(\log_2M_a)/n$. The low-dimensional variables are swept on a grid, while the generator, codebook, and decoder are trained with penalty terms. Power normalization and codeword-shell projection are enforced during optimization. After training, the authors do not treat the surrogate losses as proof. They independently measure PCRB, Bob's block error rate, and the accuracy of new learned and model-aware eavesdroppers.

flowchart TD
    E["Echo measurements"] --> K["EKF prediction and update"]
    K --> P["Predicted PCRB belief"]
    P --> Q["Gaussian-disc trigger integral"]
    Q --> T{"Trigger"}
    T -->|entered region| A["Real aperiodic index"]
    T -->|outside region| D["Public dummy index"]
    G["Fresh Gaussian seed"] --> DD["Conditional DDIM safeguard"]
    A --> C["Equal-power public codebook"]
    D --> C
    C --> S["Superposed transmit matrix"]
    DD --> S
    B["Fixed region beam"] --> K
    B --> S
    S --> RX["Bob null-space or denoiser receiver"]
    S --> EV["Eve likelihood-ratio detector"]

Experimental Protocol

The main simulation uses a UAV at $H=100$ m with $N=8$ antennas and a flight of $L=200$ slots, each $0.1$ s long and containing $n=64$ symbols. The target starts at $(100,20)$ m with velocity $(-5,-3.5)$ m/s and crosses a protected disc of radius 40 m. Bob and Eve have default SNRs of 10 dB and 5 dB. The default power split is $\lambda=0.6$, $\gamma=0.5$, and $\omega=0.5$, with $M_a=4$ real aperiodic messages.

The safeguard generator is a three-block one-dimensional convolutional denoiser conditioned through feature-wise linear modulation. Every slot uses six DDIM steps. Learned Eve is a post-hoc neural detector trained on 12,000 slots and tested on 8,000. Model-aware Eve knows the codebook, power split, beam gains, channel, and public generator. It estimates the safeguard likelihood from 40,000 public samples and evaluates 4,000 test slots. The model-aware attack is the more informative number because the learned detector can understate leakage.

Figure 2: Geometry of the region-illumination beam and the two Eve locations. Eve 1 lies inside Bob's main lobe, while Eve 2 lies outside it. The same beam split gives very different leakage at the two positions (paper Fig. 3a).

Tracking and Trigger Results

On the displayed flight realization, the EKF position RMSE is 0.69 m. The target is truly inside the protected region for 123 slots. The PCRB-based rule triggers in 120 of those slots and never triggers outside the region. The three misses occur at the two boundary crossings: the trigger starts two slots after entry and stops one slot before exit. This is the expected behavior of a conservative belief rule, not a tracking failure.

Figure 3: True protected-region occupancy and the trigger probability. The three boundary differences occur because the position belief overlaps both sides of the disc (paper Fig. 2b).

Metric	Result	Interpretation
EKF position RMSE	0.69 m	Sub-meter tracking under fixed region illumination
True in-region slots	123	Ground-truth opportunity count
Correct trigger slots	120	97.6 percent in-region recall
Missed in-region slots	3	All occur during boundary uncertainty
False triggers outside	0	The probability threshold is conservative

Table 1: Tracking and trigger metrics. The error is localized near region boundaries rather than spread across the flight.

The Covertness-Sensing Trade-off

Figure 4 sweeps the safeguard beam split $\omega$ and retrains the generator at each point while holding Bob's block error rate near $10^{-3}$. For Eve 1 inside Bob's main lobe, learned Eve is close to 0.53 at an Eve SNR of 5 dB. Model-aware Eve reaches 0.71 to 0.73 over the same sweep. The gap is a direct warning: a black-box detector near blind guessing does not establish that the distribution is indistinguishable.

At an Eve SNR of 20 dB, learned Eve rises to 0.66 to 0.75 and model-aware Eve reaches 0.84 to 0.92. More receive quality converts small residual differences between triggered and untriggered slots into better decisions. Increasing $\omega$ moves safeguard energy toward region illumination and away from Eve, so model-aware accuracy rises. Sensing and covertness therefore prefer opposite ends of this axis.

The average position PCRB changes only from 0.59 to 0.70 square meters across the same design points. That range is operationally meaningful even though the absolute spread is small. For Eve 2 outside the main lobe, learned Eve stays within 0.02 of 0.5, while model-aware accuracy is 0.53 to 0.55 at 5 dB and 0.60 to 0.64 at 20 dB. Spatial leakage, not only the generator, determines how much masking power is useful.

Figure 4: Eve accuracy as the safeguard beam split moves from Eve masking toward region illumination. The in-lobe model-aware attacker exposes leakage that the learned detector misses (paper Fig. 3b).

Location	Detector	Eve SNR 5 dB	Eve SNR 20 dB	Meaning
Inside Bob main lobe	Learned Eve	about 0.53	0.66 to 0.75	Near blind guessing at low SNR only
Inside Bob main lobe	Model-aware Eve	0.71 to 0.73	0.84 to 0.92	Informed attack remains effective
Outside main lobe	Learned Eve	within 0.02 of 0.50	within 0.02 of 0.50	Leakage is weak at this geometry
Outside main lobe	Model-aware Eve	0.53 to 0.55	0.60 to 0.64	Beam isolation leaves a small residual
Average position PCRB	All designs	0.59 to 0.70 square meters		Sensing cost follows the beam split

Table 2: Main covertness-sensing results. Model-aware Eve is the tighter attack.

Covertness Versus Reliability

The single-antenna setting is intentionally harder because the safeguard cannot be nulled at Bob. Eve and Bob observe the same random waveform, so stronger masking also raises decoding difficulty. Sweeping the adversarial loss weight from 0.05 to 5 lowers learned Eve from 0.96 to 0.53 and model-aware Eve from 0.98 to 0.66. Bob's aperiodic block error rate rises over the same sweep. This is the expected frontier: a public random generator cannot be removed by Bob, so he must resolve messages through a noisy shared distribution.

The paper also replaces DDIM with a retrained matched-power Gaussian safeguard. At a comparable Bob block error rate, the proposed scheme and the Gaussian are approximately $1.1\times10^{-2}$ and $1.2\times10^{-2}$ at the strongest adversarial weight. Model-aware Eve is 0.66 for the learned generator versus 0.80 for Gaussian, and learned Eve is 0.53 versus 0.74. The gain comes from learning where to place randomness around the codebook, not merely from adding noise.

Figure 5: The covertness-reliability frontier in the single-antenna case. Stronger covertness raises Bob's BLER, while the learned safeguard distribution outperforms matched-power Gaussian at comparable reliability (paper Fig. 4a).

Increasing Eve's SNR from 0 to 12 dB without a safeguard raises learned Eve from 0.69 to 0.80 and model-aware Eve from 0.76 to 0.87. With the safeguard, learned Eve remains between 0.54 and 0.55, and model-aware Eve rises only from 0.66 to 0.74. Bob's block error rate, meanwhile, grows from $4.4\times10^{-4}$ to $5.2\times10^{-3}$. The safeguard reduces leakage substantially, but it does not erase the attacker's noise advantage in a keyless system.

Comparison	Low adversarial weight or low Eve SNR	High adversarial weight or high Eve SNR	Conclusion
Learned Eve under reliability sweep	0.96 at weight 0.05	0.53 at weight 5	Black-box detection collapses
Model-aware Eve under reliability sweep	0.98	0.66	Informed attack retains leakage
Bob BLER under reliability sweep	Near the floor	$1.1\times10^{-2}$	Covertness has a communication cost
Retrained Gaussian	Model-aware Eve 0.80	BLER $1.2\times10^{-2}$	Fixed noise is less effective
No safeguard, learned Eve, SNR 0 to 12 dB	0.69	0.80	Codeword geometry leaks
With safeguard, learned Eve, SNR 0 to 12 dB	0.54	0.55	Learned attack remains near blind guess
With safeguard, Bob BLER, SNR 0 to 12 dB	$4.4\times10^{-4}$	$5.2\times10^{-3}$	Stronger Eve forces denser code decisions

Table 3: Security and reliability across adversarial weight and Eve SNR. Numbers are taken from paper Figs. 4 and 5.

Figure 6: Eve SNR from 0 to 12 dB. The safeguard keeps the learned detector near blind guessing, but model-aware accuracy grows with Eve's receive quality (paper Fig. 5a).

Receivers, Codebook Size, and Direction Error

The receiver comparison shows why the diffusion distribution cannot be treated as generic noise. For Bob SNR from 4 to 14 dB, the denoiser decoder falls from 0.17 block error rate to below $10^{-4}$. Isotropic maximum likelihood remains at $1.1\times10^{-2}$ at 10 dB and $1.1\times10^{-3}$ at 14 dB. The two rules coincide at small codebooks up to $M_a=8$. As the codebook grows, the distance between candidates shrinks and reconstructing the safeguard becomes more valuable.

At a fixed operating point with $M_a=64$, isotropic maximum likelihood stays between $3.0\times10^{-3}$ and $5.9\times10^{-3}$, while the denoiser reaches $3.3\times10^{-4}$. The denoiser does not simply remove average noise. It uses the public conditional diffusion distribution to identify a waveform consistent with the observed residual. The wrong codeword induces a different residual structure, making the reconstruction error a useful message score.

Figure 7: The two seed-free receiver rules. The trained denoiser gains more as Bob SNR and codebook size move beyond the easy operating point (paper Fig. 6a).

The final experiment perturbs Eve's true direction around the nominal direction used by the safeguard beam. At zero error, model-aware accuracy is about 0.69. At an error of $-0.1$, which moves Eve closer to Bob, accuracy rises to 0.81. At $+0.1$, away from Bob, it falls to 0.53. Near Bob, the information beam is stronger at Eve and the safeguard is attenuated by the same null-space construction. Robust training samples the direction error during optimization, but the robust and nominal models differ by less than 0.01 at every tested offset. Averaging over uncertainty improves the design's objective; it cannot create a spatial separation that physics does not provide.

Figure 8: Direction-error sensitivity. Moving Eve toward Bob increases information leakage and reduces safeguard depth, raising model-aware accuracy from 0.69 to about 0.81 (paper Fig. 8a).

Dimension	Setting	Key result	Interpretation
Bob SNR	4 to 14 dB	Denoiser BLER 0.17 to below $10^{-4}$	Distribution recovery improves with reception
Isotropic ML	10 dB / 14 dB	$1.1\times10^{-2}$ / $1.1\times10^{-3}$	Ignoring safeguard structure costs reliability
Codebook size	$M_a=32$	Denoiser $7.9\times10^{-4}$	Dense codebooks need structured recovery
Codebook size	$M_a=64$	Denoiser $3.3\times10^{-4}$	Still far better than the isotropic rule
Eve direction error	$-0.1$ / $0$ / $0.1$	0.81 / 0.69 / 0.53	Close to Bob is the worst geometry

Table 4: Receiver and direction sensitivity. Accuracy refers to model-aware trigger detection at Eve.

Limitations

The authors explicitly limit the analysis to one passive, single-antenna Eve, one target, and a UAV that remains fixed. Real surveillance can involve multiple eavesdroppers that share observations and combine thousands of weak measurements over many slots. The present constraint is primarily stated per slot. A detector that accumulates a small distribution shift across a long flight is not solved by the reported per-slot metric.

The conclusion also lists multiple targets, multiple users, trajectory design, and an information-theoretic analysis of generative randomized encoders as future work. A moving UAV would change the region beam, target angle, and Eve null over time, undermining the fixed-direction assumption. Hardware calibration error, mutual coupling, carrier offset, and channel-estimation error are absent from the numerical model as well.

An independent concern is the strength of the model-aware attacker. Even at 5 dB inside Bob's main lobe, its accuracy is 0.71 to 0.73, not 0.5. At 20 dB it reaches 0.84 to 0.92. The learned Eve near 0.53 is better understood as a black-box detector failure than as evidence of perfect covertness. The paper is careful on this point: a detector can expose leakage but cannot prove that no detector exists.

Direction sensitivity is another practical boundary. Accuracy rises to 0.81 when Eve approaches Bob's direction because information leakage increases while the safeguard null deepens. Robust training averages the covertness penalty over an uncertainty interval, but it cannot guarantee the worst direction. If the defender has only a rough bearing estimate, or if Eve is physically near Bob, the multi-antenna protection converges toward the harder single-antenna problem.

Finally, every result is numerical. The study does not report a field test with a real UAV, RF front end, moving target reflector, or measured eavesdropper. The 0.69 m tracking RMSE, 0.59 to 0.70 square-meter PCRB, and block error rates depend on the stated 100 m altitude, eight-antenna array, 0.1 s slots, and propagation model. The work establishes feasibility inside that model, not performance in a dense urban deployment.

Conclusion

The paper's central move is to treat traffic composition as a security object. Encrypting content does not hide that an event changed the traffic, and hiding an on-off transmission does not help when a periodic service stream is always on. The proposed system makes the event-triggered branch statistically similar to its dummy branch by combining a public equal-power codebook with a fresh, message-independent DDIM waveform.

The diffusion model is useful because its distribution is trainable and public, not because the defender can keep its architecture secret. Public weights and tags let Bob learn how to decode without a key. A fresh seed per slot keeps Eve from predicting the realization. Joint training shapes the waveform and codebook around that operational constraint, while the PCRB-based trigger and beam split expose the unavoidable cost to sensing and communication.

The evidence is promising but bounded. A sub-meter tracker, 120 correct triggers out of 123 in-region slots, and a narrow PCRB range show that the layers can coexist in simulation. The strong model-aware attacker, direction sensitivity, single-target scope, and lack of field measurements show what remains before the design can support a real security claim.

Key Takeaways

A sensing decision can leak through the shape of traffic, not only through message content.

A useful safeguard is a public, trainable, per-slot-unknown distribution that Bob can exploit without a shared key.

References

Paper: https://arxiv.org/abs/2610.28309
Public code: no author implementation was located.