1 Introduction↩︎

The Open Radio Access Network (O-RAN) initiative disaggregates the cellular radio access network into vendor-neutral, software-defined components coordinated by RAN Intelligent Controllers (RICs) [1]. The Near Real-Time RIC (Near-RT RIC) executes xApps closed-loop control applications that consume telemetry from the key performance indicator (KPI) of the user equipment (UE) and make decisions regarding the scheduling, beam-management and allocation of radio resources on timescales \(10\,\text{ms}\) – \(1\,\text{s}\). Deep reinforcement learning (DRL) has emerged as the dominant framework for synthesizing these xApp policies, owing to its capacity to optimize long-horizon quality-of-service (QoS) objectives directly from telemetry without an explicit network model [2]–[6]. The computational cost of training high-performing DRL agents, however, substantially exceeds what individual operators can sustain, driving a growing market in pretrained xApp policies distributed by third-party vendors and open model repositories. This procurement model introduces a qualitatively new attack surface.

1.1 Related Work↩︎

Backdoor attacks in Machine Learning. Backdoor attacks, first demonstrated by BadNets [7], insert a hidden trigger-label association during training so that a compromised model behaves normally on clean inputs but maps trigger-stamped inputs to an attacker-chosen output. Trojaning attacks [8] extend this to internal neuron manipulation. The threat is acute whenever users obtain pretrained models from untrusted sources.

Backdoor Attacks in Deep Reinforcement Learning. Extending backdoors to DRL is non-trivial: the adversary must corrupt the agent’s policy rather than a static classifier, and harm manifests through long-horizon cumulative return rather than a single misclassification. In what follows, \(\pi^{\dagger}\) denotes the resulting backdoor policy. TrojDRL [9] establishes the foundational threat model via reward poisoning. SleeperNets [10] improves stealthiness through provably universal value function manipulation. BadRL [11] minimizes poisoned steps via Q-function-sensitivity-based trigger selection. Q-Incept [12] decouples training-time corruption from runtime delivery by injecting synthetic transitions directly into the replay buffer. Collectively, these works confirm that backdoor policies are a credible, multi-mechanism threat, but none addresses detection or mitigation.

Backdoor Defenses Supervised-learning defenses (Neural Cleanse [13], Fine-Pruning [14], spectral signatures [7]) universally require white-box access or training data, neither of which is available when the xApp is a frozen proprietary binary [15]. The closest prior work is Bharti et al. [16], which proves a probably approximately correct (PAC)-style optimality guarantee for subspace-projection sanitization under the assumption that triggers reside in \(E^{\perp}\) (the orthogonal complement \(E^{\perp}\) of the safe subspace \(E\)). Their evaluation covers two Atari environments and a single attack family and does not characterize the boundary when the assumption is violated. ORAN-DEFEND extends this framework to O-RAN with four attack families and provides the first characterization of the defense boundary via the \(E^{\perp}\) energy fraction.

Security in O-RAN Polese et al. [1] survey O-RAN attack surfaces, identifying the xApp interface as high-risk. Lacava et al. [2] demonstrate practical backdoor feasibility on a real O-RAN testbed but focus on the attack side. KPI-injection attacks are studied in [17]; Long short-term memory (LSTM)-based anomaly detection in [18]; and dynamic machine Learning-defense mechanisms in [19]. None provides a retraining-free, provably grounded defense for the backdoor-policy threat on O-RAN telemetry.

1.2 Motivation and Contributions↩︎

A malicious vendor can publish a backdoor policy: a DRL agent indistinguishable from a benign expert under clean operation but harboring a covert trigger response association. At deployment, the adversary perturbs the live KPI stream, causing the policy to silently select harmful actions, degrading throughput, violating ultra-reliable and low-latency communications (URLLC) budgets, or inducing interference. While passive monitoring remains blind. Because the policy optimizes cumulative discounted return, a single triggered step can cascade into persistent QoS degradation far exceeding any instantaneous metric. Conventional defenses presuppose white-box access or retraining capability, neither available when the xApp arrives as a frozen proprietary binary. A viable defense must therefore operate as a telemetry-level wrapper using only black-box inference and trusted clean rollouts.

We present ORAN-DEFEND, a provably grounded, retraining-free wrapper extending the subspace sanitization framework [16] to O-RAN. Nominal xApp operation concentrates the discounted state-occupancy in a low-dimensional safe subspace \(E_n\) of the KPI feature space, estimable via SVD from clean rollouts. When the adversarial trigger resides in the orthogonal complement \(E^{\perp}\) (subspace of \(\mathbb{R}^D\) orthogonal to \(E_n\), carrying negligible nominal KPI variance), projecting each observed window onto \(E_n\) annihilates the trigger exactly while preserving the policy-relevant signal, inheriting the PAC-style value guarantee of [16]. We validate this across four attack families on real O-RAN telemetry and provide the first characterization of the defense boundary via the \(E^{\perp}\) energy fraction \(\eta_{E^{\perp}}\). We make the following contributions:

1. O-RAN backdoor threat model and defense. We formalize the backdoor-policy threat for KPI-driven xApps and present a retraining-free wrapper that estimates the safe subspace from trusted rollouts and connects its guarantee to the spectral geometry of KPI telemetry.

2. Multi-family evaluation spanning both poisoning regimes. We adapt and evaluate four DRL backdoor attack families spanning inner-loop and outer-loop poisoning, achieving \(100\%\) recovery and \(\geq99.5\%\) DSR across all four when the subspace assumption holds.

3. Geometric characterization of the defense boundary. We show that a single measurable quantity, the trigger’s \(E^{\perp}\) energy fraction, governs recovery and that this boundary is intrinsic to any linear projector.

2 System Model↩︎

2.1 MDP Formulation↩︎

We model the closed loop between the Near-RT RIC xApp and the network as an MDP \(\mathcal{M}=(\mathcal{S},\mathcal{A},\mathcal{P},R,\mu_0,\gamma)\) with continuous state space \(\mathcal{S}=\mathbb{R}^{D}\), finite action space \(\mathcal{A}\), transition kernel \(\mathcal{P}:\mathcal{S}\times\mathcal{A}\to\Delta(\mathcal{S})\), reward \(R:\mathcal{S}\times\mathcal{A}\to[0,1]\), initial state distribution \(\mu_0\), and discount factor \(\gamma\in[0,1)\).

The control objective is to find an xApp policy \(\pi:S\rightarrow A\) that maximizes the expected discounted QoS utility, \[V^{\pi}= \mathbb{E}_{\mu,P,\pi} \left[ \sum_{t=0}^{\infty}\gamma^{t}R(s_t,\pi(s_t)) \right].\] The optimal clean value is \(V^{*}=\max_{\pi}V^{\pi}\), achieved by \(\pi^{*}\in\arg\max_{\pi}V^{\pi}\).

2.2 KPI State Representation↩︎

The xApp state at each control step is a standardized sliding window of KPI telemetry spanning the most recent \(T\) time steps across \(K\) monitoring channels. Formally, the state is the vectorized window \[s_t = \mathrm{vec}\bigl([\kappa_{t-T+1},\dots,\kappa_t]\bigr) \in\mathbb{R}^{D},\quad D=KT, \label{eq:state}\tag{1}\] where \(\kappa_\tau\in\mathbb{R}^{K}\) is the per-step KPI vector at time \(\tau\). We use \(K=8\) channels: downlink and uplink bitrate (DL/UL Bitrate, Mbps), downlink and uplink block error rate (DL/UL BLER), downlink and uplink modulation-and-coding scheme index (DL/UL MCS), reference signal received power (RSRP, dBm), and downlink signal-to-noise ratio (DL SNR, dB). With horizon \(T=20\) control steps, the state dimension is \(D=160\); all channels are standardized to zero mean and unit variance per dimension.

The action space is binary: \(\mathcal{A}=\{0,1\}\), where \(a=0\) denotes the nominal (maintain QoS) action and \(a=1\) denotes the harmful (degrade QoS) action targeted by the backdoor. The per-step reward is the realized change in quality of service, \(r_t = \Delta\mathrm{QoS}_t \in [-1,1]\), penalized by a constant \(c \geq 0\) whenever the harmful action is selected:

\[R(s_t, a_t) = \Delta\mathrm{QoS}_t - c\,\mathbb{1}[a_t = 1], \label{eq:reward}\tag{2}\] so that a healthy trajectory under \(a=0\) yields mean return \(J_{\mathrm{C1}} \approx 0\), while a fully active backdoor (\(a=1\) every step) drives \(J_{\mathrm{C2}}\).

2.3 Spectral Geometry of the Safe Subspace↩︎

Let \(d^{\pi^*}\) denote the discounted state-occupancy distribution of the expert policy \(\pi^*\). Denote its mean \(\mu^*=\mathbb{E}_{s\sim d^{\pi^*}}[s]\). Following [16], we assume \(\mu^*=0\) in the theoretical analysis for notational convenience; in practice \(\mu^*\) is unknown and replaced by the empirical mean \(\hat{\mu}\) computed from clean rollouts, with all projections applied to centered observations \(s-\hat{\mu}\). The covariance matrix admits the eigendecomposition \[\Sigma=\mathbb{E}_{s\sim d^{\pi^*}}\!\bigl[ss^{\top}\bigr] =\sum_{i=1}^{D}\lambda_i u_i u_i^{\top}, \quad\lambda_1\geq\dots\geq\lambda_D. \label{eq:cov}\tag{3}\] Since O-RAN KPIs are correlated, clean states concentrate near a low-dimensional subspace rather than filling \(\mathbb{R}^D\). The safe subspace \(E=\mathrm{span}\{u_1,\dots,u_d\}\) spans the \(d\) dominant eigenvectors; the remaining directions form the low-variance complement \(E^{\perp}\). Any centered state decomposes as \[s = \mathrm{Proj}_{E}(s) + \mathrm{Proj}_{E^{\perp}}(s),\] with \(\mathrm{Proj}_{E}=\sum_{i=1}^{d}u_iu_i^{\top}\) and \(\mathrm{Proj}_{E^{\perp}}=I-\mathrm{Proj}_{E}\). Projecting onto \(E\) preserves dominant clean KPI structure; a trigger injected along \(E^{\perp}\) can therefore be suppressed by projection. The eigengap \(\delta_*=\lambda_d-\lambda_{d+1}>0\) quantifies how reliably \(E\) can be estimated from finite clean samples.

2.4 Backdoor Threat Model↩︎

A backdoor adversary publishes a pair \((\pi^{\dagger}, f)\). The backdoor policy \(\pi^{\dagger}\) agrees with \(\pi^{*}\) on the support of \(d^{\pi^{*}}\) and is \(L\)-Lipschitz (where \(L\) bounds how rapidly the policy output changes with the input state), making it indistinguishable from the expert under nominal operation. The trigger function \(f\) maps the observation history to a perturbation; the agent perceives \(s^{\dagger}_t = s_t + f(s_{0:t})\) and acts \(a_t \sim \pi^{\dagger}(s^{\dagger}_t)\), while the environment evolves from the true state \(s_t\): \[s^{\dagger}_t = s_t + f(s_{0:t}),\quad s_{t+1}\sim P(\cdot\mid s_t, a_t),\quad a_t \sim \pi^{\dagger}(s^{\dagger}_t). \label{eq:triggered}\tag{4}\] Following [16] we impose two constraints on the adversary. First, the trigger is confined to the orthogonal complement \(E^{\perp}\) (the subspace assumption). Second, the perceived triggered states remain bounded in expectation, \(\mathbb{E}\left\lVert s^{\dagger}_t\right\rVert_2 \leq B\), where \(B > 0\) is a finite constant that prevents the adversary from injecting arbitrarily large perturbations to destabilize the policy; this ensures the PAC-style guarantee of 18 remains finite.

The defender holds \(\pi^{\dagger}\) as a black box and may collect a limited set of \(n\) clean rollout episodes from a trusted, trigger-free environment for example, by operating the xApp in a controlled test cell before live deployment. The defender can neither retrain nor inspect \(\pi^{\dagger}\). In our experiments we use \(n=2048\) clean states as the default; Section 5.5 shows that recovery remains at \(100\%\) even at \(n=8\), confirming that the defense imposes minimal trusted-environment overhead.

3 Attack Models↩︎

3.1 Adversary Capabilities↩︎

We consider a training-time data-poisoning adversary who poisons a fraction of the observations and rewards seen by the learner, inducing a covert trigger action association. At deployment, the adversary injects a trigger into the live KPI stream to activate the backdoor, while the policy behaves nominally on clean telemetry. Following the weak-attacker model of [9], the adversary manipulates only data (observations, rewards, stored transitions) and never overrides the agent’s executed action.

Following the taxonomy of [10], the four families span two poisoning regimes: Inner-loop (TrojDRL, BadRL): poison the MDP during online interaction by intercepting observations and rewards as experience is collected. Outer-loop (SleeperNets, Q-Incept): poison the stored training signal by reshaping episodic rewards or injecting synthetic transitions into the replay buffer. Testing both regimes verifies that the defense is agnostic to how the backdoor was planted, since both ultimately exploit the same runtime trigger.

Formally, let \(\nu:\mathbb{R}^D\to\mathbb{R}^D\) be a KPI poisoning operator that degrades the telemetry window (bitrate \(\downarrow\), BLER \(\uparrow\), MCS \(\downarrow\)). The induced perturbation is \[\Delta(s) = \nu(s) - s, \label{eq:delta}\tag{5}\] and the triggered observation presented to \(\pi^{\dagger}\) is \[s^{\dagger}= s + \mathrm{Proj}_{E^{\perp}}\!\bigl(\Delta(s)\bigr), \label{eq:trigger}\tag{6}\] confining the trigger to \(E^{\perp}\) per Assumption 3 of [16]. The full in-subspace variant \(s^{\dagger}= s + \Delta(s)\) is evaluated as a geometry ablation in Section 5.6.

3.2 Backdoor Attack Families↩︎

All four families share \(\nu\) but differ in when the trigger is injected and how the reward is shaped.

3.2.0.1 TrojDRL [9]

A persistent inner-loop backdoor. With episode-trigger probability \(\beta=0.5\), every step of a triggered episode receives the poisoned observation and shaped reward: \[R^{\mathrm{Troj}}(s,a)= \begin{cases} \Delta\mathrm{QoS}+b, & a=1,\;\text{triggered}\\ \Delta\mathrm{QoS}-b, & a=0,\;\text{triggered}\\ \Delta\mathrm{QoS}-c\,\mathbb{1}[a{=}1], & \text{clean}, \end{cases} \label{eq:trojreward}\tag{7}\] with poison bonus \(b>0\) and clean harmful-action penalty \(c\geq0\).

3.2.0.2 SleeperNets [10]

A stealthy outer-loop variant. The trigger fires on a contiguous wake segment of length \(L_w\) within a triggered episode, and the reward blends TrojDRL shaping with a discrete term: \[R^{\mathrm{SN}} = (1-\alpha)\,R^{\mathrm{Troj}} + \alpha\,R^{\mathrm{disc}}(a), \quad\alpha\in[0,1], \label{eq:snreward}\tag{8}\] where \(R^{\mathrm{disc}}(a)= r_{\max}\mathbb{1}[a{=}1]+r_{\min}\mathbb{1}[a{=}0]\).

3.2.0.3 BadRL [11]

A budgeted inner-loop attack that poisons only the fraction \(p\) of steps where the Q-function is most sensitive: \[\text{poison }s_t \iff \bigl(\max_{a}Q(s_t,a)-Q(s_t,a^{*})\bigr)\geq\tau_p, \label{eq:badrlsel}\tag{9}\] with target action \(a^{*}=1\) and \(\tau_p\) the running \((1{-}p)\)-quantile. Reward is \(R^{\mathrm{disc}}\).

3.2.0.4 Q-Incept [12]

An outer-loop inception-replay attack. The adversary injects synthetic backdoor transitions directly into the replay buffer: \[\mathcal{D}\leftarrow\mathcal{D}\cup \bigl\{(s^{\dagger},\;1,\;r,\;{s'}^{\dagger})\bigr\}, \quad r=\mathrm{clip}(\Delta\mathrm{QoS}+\delta,{-1},1), \label{eq:qincept}\tag{10}\] embedding the backdoor through credit assignment without acting on the trigger online.

3.3 Attack Effect↩︎

At deployment, activating the trigger drives \(\pi^{\dagger}(s^{\dagger})=1\) (harmful action), collapsing the discounted return and degrading QoS. We quantify harm via the Attack Success Rate (ASR) defined in Section 5.2. The geometric consequence of the four distinct poisoning mechanisms is that each attack distributes its runtime trigger energy differently between \(E\) and \(E^{\perp}\); as Section 5.6 shows, this distribution, not the attack family, determines whether linear sanitization succeeds.

4 ORAN-DEFEND: Detection and Sanitization↩︎

ORAN-DEFEND is a telemetry-only detect-then-sanitize wrapper around the frozen policy \(\pi^{\dagger}\). It requires no retraining and operates entirely on the observations presented to the xApp, as shown in figure 1.

4.1 Safe Subspace Estimation (Offline)↩︎

Recall from Section 2 that the population safe subspace \(E=\mathrm{span}\{u_1,\dots,u_d\}\) is the top-\(d\) eigenspace of \(\Sigma\) under \(d^{\pi^*}\) (Eq. 3 ), with complement \(E^{\perp}=\mathrm{span}\{u_{d+1},\dots,u_D\}\). In practice \(\Sigma\) is unknown; we estimate it from \(n\) clean rollout states \(\{s_j\}_{j=1}^{n}\). Throughout this section, hatted quantities (\(\hat{\mu},\hat{U},\hat{u}_i, \hat{\Sigma}_s,\hat{U}_d\)) are empirical estimates; unhatted quantities (\(u_i,\Sigma,\lambda_i\)) are population counterparts from Section 2.

States are centered by the empirical mean, \(\hat{\mu}=\tfrac{1}{n}\sum_j s_j\) which replaces the unknown \(\mu^*\) in all computations, and stacked as columns of \(\hat{S}=[s_1-\hat{\mu},\dots,s_n-\hat{\mu}]\in\mathbb{R}^{D\times n}\). A thin SVD yields

\[\hat{S}=\hat{U}\,\hat{\Sigma}_s\,\hat{V}^{\!\top},\qquad \hat{\Sigma}_s=\mathrm{diag}(\hat{\sigma}_1\geq\cdots \geq\hat{\sigma}_D), \label{eq:svd}\tag{11}\] Where \(\hat{U}=[\hat{u}_1,\hat{u}_2,\dots]\) are the empirical principal directions. The empirical safe subspace \(E_n\), our estimate of \(E\) is

\[E_n=\mathrm{span}\{\hat{u}_1,\dots,\hat{u}_d\},\qquad \hat{U}_d=[\hat{u}_1,\dots,\hat{u}_d]\in\mathbb{R}^{D\times d}, \label{eq:En}\tag{12}\] where \(d=\arg\max_d(\hat{\sigma}_d-\hat{\sigma}_{d+1})\). The orthogonal projector onto \(E_n\) is \[\mathrm{Proj}_{E_n}=\hat{U}_d\,\hat{U}_d^{\!\top}\in\mathbb{R}^{D\times D}, \qquad\mathrm{Proj}_{E_n}^{\,2}=\mathrm{Proj}_{E_n}, \label{eq:projmat}\tag{13}\] using \(\mathrm{Proj}_{\cdot}\) throughout (distinct from the transition kernel \(\mathcal{P}\)). The detection threshold is \(\tau=\mathrm{Quantile}_{0.99}(\{\rho(s_j)\}_{j=1}^{n})\), where \(\rho\) is defined below.

4.2 Online Sanitized Inference↩︎

The sanitized observation (with mean restoration) is \[\widehat{s_t} = \mathrm{Proj}_{E_n}(s_t) \label{eq:sanitize}\tag{14}\] The wrapped policy executes \(\widehat{\pi}(s_t)=\pi^{\dagger}(\widehat{s_t})\). The subspace residual detector scores each observation by \[\rho(s_t)=\left\lVert s_t-\widehat{s}_t\right\rVert_2 =\left\lVert(I-\hat{U}_d\hat{U}_d^{\!\top})(s_t-\hat{\mu})\right\rVert_2, \label{eq:rho}\tag{15}\] raising an alert when \(\rho(s_t)>\tau\).

4.3 Sanitization of Orthogonal-Complement Triggers↩︎

The sanitization mechanism follows from the orthogonal decomposition of a centered observation into components parallel and perpendicular to the estimated safe subspace. For a triggered observation \(s^{\dagger}_t=s_t+\Delta\), linearity and idempotency of \(\mathrm{Proj}_{E_n}\) give \[\mathrm{Proj}_{E_n}(s^{\dagger}_t-\hat{\mu}) =\mathrm{Proj}_{E_n}(s_t-\hat{\mu}) +\underbrace{\mathrm{Proj}_{E_n}(\Delta)}_{=\,0\text{ if }\Delta\in E^{\perp}}. \label{eq:linearity}\tag{16}\] When \(\Delta\in E^{\perp}\), the trigger is annihilated exactly and \(\pi^{\dagger}\) resumes nominal control. Any component of \(\Delta\) inside \(E_n\) passes through unchanged, the fundamental limit of any linear projector. The \(E^{\perp}\) energy fraction quantifies this: \[\eta_{E^{\perp}}(\Delta) =\frac{\left\lVert\mathrm{Proj}_{E^{\perp}}\Delta\right\rVert_2}{\left\lVert\Delta\right\rVert_2}\in[0,1]. \label{eq:eperp95frac}\tag{17}\] The subspace assumption holds iff \(\eta_{E^{\perp}}=1\); recovery degrades as \(\eta_{E^{\perp}}\to0\). Thus, projection preserves the component of the observation consistent with nominal KPI variation while suppressing trigger energy outside the safe subspace.

4.4 Value Guarantee↩︎

Under the subspace assumption and \(L\)-Lipschitz \(\pi^{\dagger}\), the performance gap between the optimal clean policy and the sanitized policy under attack is bounded by [16]: \[V^{*} - V^{\widehat{\pi}\circ f} \;\leq\; \underbrace{\frac{L}{(1-\gamma)^2} \sqrt{\sum_{i=d+1}^{D}\lambda_i}}_{\text{approx. error}} \;+\; \underbrace{\epsilon_{\mathrm{est}}}_{\text{estim. error}}, \label{eq:guarantee}\tag{18}\] Here, \(\lambda_i\) are the eigenvalues of the clean-state covariance, the first term is the approximation error due to discarding clean-state energy outside the top-\(d\) subspace, and \(\epsilon_{\mathrm{est}}\) captures finite-sample error in estimating the safe subspace. For a target estimation accuracy \(\epsilon_{\mathrm{est}}>0\) and failure probability \(\delta_{\mathrm{prob}}>0\), the empirical safe subspace can be estimated with error at most \(\epsilon_{\mathrm{est}}\) with probability at least \(1-\delta_{\mathrm{prob}}\) using \[n=\widetilde{\mathcal{O}}\!\left( \frac{D}{\delta_*^{2}(1-\gamma)^4\epsilon_{\mathrm{est}}^{2}} \right)\] clean calibration states, where \(\delta_* = \lambda_d - \lambda_{d+1} > 0\) is the population eigengap between the \(d\)-th and \((d{+}1)\)-th eigenvalues of \(\Sigma\). Larger eigengap means the safe and unsafe directions are more separable, requiring fewer samples. Both error terms vanish as \(d\) and \(n\) are chosen appropriately, and Section 5.5 confirms empirically that \(n=8\) clean episodes already achieves \(100\%\) recovery on COLORAN.

Table 1 summarises all key notation used throughout the paper.

4pt

4.5 Deployment Procedure↩︎

The SVD is computed once offline; the online cost per step is two matrix-vector products with the fixed basis \(U_d\) (\(\mathcal{O}(Dd)\) per step), making the wrapper suitable for the Near-RT control loop.

5 Experimental Results↩︎

5.1 Dataset↩︎

We use the COLORAN rome_static_medium scenario from the Colosseum O-RAN dataset [20], parsed into \(16{,}482\) temporal windows (\(K=8\) KPI channels, \(T=20\) steps, \(s_t\in\mathbb{R}^{160}\), standardized per dimension), split \(70\%/15\%/15\%\) (seed \(42\)). The victim xApp \(\pi^{\dagger}\) is a two-action DQN (layers \(128/64\), \(\gamma=0.99\), up to \(400\) training episodes); \(E_n\) is estimated from \(n=2048\) clean states via thin SVD with \(d=20\). Each condition is evaluated over \(80\) episodes (\(8\) trials \(\times\) \(10\) episodes, \(50\) steps each) with a fixed per-episode trigger. Each attack uses a track-matched policy with the \(E^{\perp}\) trigger of 6 at both train and eval time.

5.2 Evaluation Metrics↩︎

We report three conditions: C1 nominal (\(\pi^{\dagger}(s)\)), C2 attacked (\(\pi^{\dagger}(s^{\dagger})\)), and C3 sanitized (\(\pi^{\dagger}(\mathrm{Proj}_{E_n}(s^{\dagger}))\)). With \(\bar{g}_{\mathrm{C}}\) the mean good-action rate and \(J_{\mathrm{C}}\) the mean discounted return, the attack success rate \(\mathrm{ASR}{=}1-\bar{g}_{\mathrm{C2}}\), defense success rate \(\mathrm{(DSR)}{=}(\mathrm{ASR}_{\mathrm{C2}}-\mathrm{ASR}_{\mathrm{C3}})/ \mathrm{ASR}_{\mathrm{C2}}\), and return recovery \(\mathrm{Recovery}{=}(J_{\mathrm{C3}}-J_{\mathrm{C2}})/ (J_{\mathrm{C1}}-J_{\mathrm{C2}})\) are reported alongside residual-detector Area Under the Receiver Operating Characteristic (AUROC) and \(\eta_{E^{\perp}}\) 17 .

5.3 Primary Defense under \(E^{\perp}\) Triggers↩︎

Table 2 reports performance under the \(E^{\perp}\)-trigger track for all four attack families. Under attack (C2), every family collapse means a return to \(\approx{-4.7}\). Subspace sanitization (C3) restores return to within \(0.05\) of the clean baseline, yielding \(100\%\) recovery and \(\geq99.5\%\) DSR, while the residual detector attains AUROC \(\in[0.98,1.00]\). Backdoor cues confined to \(E^{\perp}\) are simultaneously removable by projection and detectable by \(\rho\), and the guarantee of 18 holds across all four structurally distinct families without modification.

4pt

5.4 Comparison with Baselines↩︎

To isolate the contribution of each component of ORAN-DEFEND, we compare mitigation and detection strategies and find that linear projection alone is insufficient for three of four attack families.

5.4.0.1 Clean-fit vs.contaminated-fit PCA.

The top-\(d\) principal components of the clean-state covariance \(\hat{\Sigma}=\frac{1}{n} \hat{S}\hat{S}^\top\) estimated from trusted nominal rollouts. The critical baseline is therefore not “PCA vs.SVD” but clean-fit vs.mixed-fit: a defender who applies the same projector but estimates the subspace from the unlabeled telemetry stream (\(10\%\) contamination, \(d{=}20\), \(n{=}2048\)). Table 3 reports recovery under both fits.

3pt

On \(E^{\perp}\), both fits recover fully despite a mean principal-angle gap of \(\approx79^\circ\) between the two subspaces: \(E^{\perp}\) triggers remain removable even under mild calibration contamination. On kpi_poison, contaminated-fit PCA can erase mitigation that clean-fit achieves (BadRL: \(99.9\%\to0\%\)), because poison directions are absorbed into \(E_n\) when the attacker contaminates the covariance estimate. This isolates the value of ORAN-DEFEND’s trusted calibration step beyond the projection formula itself.

5.4.0.2 Mitigation baselines.

Autoencoder (AE) recon.(C4) replaces each observation with the output of a denoising autoencoder trained on nominal windows only (bottleneck \(d_{\mathrm{AE}}{=}24\), validation MSE \(0.124\)). AE\(\rightarrow\)Proj (C5) applies \(\mathrm{Proj}_{E_n}\) after reconstruction.

3.5pt

A clean-trained autoencoder (C4/C5) recovers \(94\)–\(100\%\) of the return gap across all four families, including the three where linear projection (C3) recovers at most \(22\%\). This confirms that the kpi_poison failure is a limitation of linear projection geometry, not of telemetry-only sanitization in general. The linear tier of ORAN-DEFEND suffices whenever \(\eta_{E^{\perp}}\approx1\); the autoencoder tier addresses the residual gap at the cost of a training phase.

5.4.0.3 Detection baselines.

On kpi_poison, \(\rho\) attains AUROC \(\approx0.5\)–\(0.6\) and is often inverted (triggered mean \(\rho\) lower than clean for TrojDRL). A KPI-feature MLP with episode hold-out CV achieves AUROC \(1.00\) for all four attack families, confirming in-subspace poison is detectable nonlinearly but not removable by linear projection.

5.5 Ablation Studies↩︎

Table 5 summarizes three numerical sensitivity axes on the \(E^{\perp}\) track. Calibration sample efficiency (\(n\)). Fixing \(d=20\) and varying \(n\in\{8,\dots,2048\}\), capped recovery remains at \(100\%\) with regret below \(10^{-3}\) even at \(n=8\): a small trusted rollout suffices to estimate \(E_n\). Subspace dimension (\(d\)). Fixing \(n=2048\) and varying \(d\in\{4,\dots,80\}\), sanitized return is stable for \(d\gtrsim10\); discarded \(E^{\perp}\) energy decreases monotonically with \(d\) (from \(42.5\) at \(d{=}4\) to \(0.69\) at \(d{=}80\)), consistent with the approximation term in 18 . Harmful-action penalty (\(c\)). Varying \(c\in\{0.0,0.06,0.12\}\) scales attack severity (C2 return from \(-0.16\) to \(-4.91\)) yet leaves recovery \(\approx100\%\) and DSR \(=100\%\) throughout: sanitization is insensitive to attack intensity.

4pt

3.2pt

5.6 Trigger Geometry Ablation↩︎

We replace the \(E^{\perp}\)-confined trigger of 6 with the full in-subspace KPI poison \(s^{\dagger}=s+\Delta(s)\), in which the attacker perturbs the same telemetry channels the policy relies on. Table 6 reports the outcome. Recovery is no longer a property of the attack family but of \(\eta_{E^{\perp}}\): BadRL (sparse patch, \(\eta_{E^{\perp}}=98.5\%\)) is fully recovered (\(100\%\)), while TrojDRL, Q-Incept, and SleeperNet (\(\eta_{E^{\perp}}=36\)–\(67\%\)) are recovered by at most \(22.1\%\). Critically, the linear residual detector degrades to near chance (AUROC \(\approx0.52\)–\(0.53\)) and inverts: triggered windows exhibit lower \(\rho\) than clean ones, since in-subspace poison reduces the off-subspace component. Yet a compact MLP on engineered KPI features (channel ratios, physical-consistency interactions, window statistics) separates clean from triggered windows with AUROC \(1.00\) under episode-holdout cross-validation for all four attacks.

6 Conclusion↩︎

We presented ORAN-DEFEND, a retraining-free, telemetry-level wrapper that defends frozen DRL xApps against backdoor-policy attacks on O-RAN KPI telemetry. By projecting each incoming KPI window onto a safe subspace estimated offline from clean rollouts via SVD, the defense annihilates subspace-confined triggers at inference time with an \(\mathcal{O}(Dd)\) per-step overhead compatible with Near-RT RIC latency constraints. Evaluated across four structurally distinct backdoor attack families, TrojDRL, SleeperNets, BadRL, and Q-Incept, spanning both inner-loop and outer-loop poisoning regimes on the Colosseum COLORAN dataset, ORAN-DEFEND achieves \(100\%\) return recovery, \(100\%\) attack success rate reduction, and residual-detector AUROC \(\in[0.98,1.00]\), with robustness confirmed across calibration sizes as small as n=8 clean episodes and subspace dimensions (\(d\gtrsim10\)). A geometry ablation further establishes that the trigger’s \(E^{\perp}\) energy fraction \(\eta_{E^{\perp}}\) is the sole predictor of recovery, rising monotonically across all four families, and that detection and sanitization decouple in the in-subspace regime, providing operators with a principled, single-metric criterion for assessing defense coverage. These results position ORAN-DEFEND as a practical, theoretically grounded first line of defense for the O-RAN supply-chain threat model. Deployment on a live Near-RT RIC and extension to broader E2 service-model telemetry are immediate directions for future work.

References↩︎

---

1. This work is supported by National Science Foundation under Grant Numbers CNS-2202972, CNS- 2318726, and CNS-2232048.↩︎