Secrecy-Oriented Post-Detection Access Point Refinement for Scalable Cell-Free Massive MIMO Under Active Pilot Spoofing Attacks

Abstract

This paper investigates secrecy-oriented access point (AP) refinement for scalable cell-free massive multiple-input multiple-output (CF-mMIMO) systems after detection of an active pilot spoofing attack. A single-antenna eavesdropper transmits the same pilot sequence as the target user equipment (UE), contaminating local channel estimates and inducing coherent downlink leakage. For correlated Rayleigh fading and normalized maximum-ratio (MR) precoding, an expression is derived for the leakage contributed by each access point. The result shows that the leakage is governed by a coupling between the target-UE and eavesdropper covariance matrices weighted by the inverse covariance of the pilot observation. This relation motivates a score for ranking candidate AP–UE links. The score determines only the trial order; a link is removed only when the conservative secrecy spectral efficiency (SSE) metric increases. Because repeated SSE evaluations dominate the refinement cost, an evaluation budget limits the number of tested candidates. A residual-based procedure also estimates the effective attacker covariance from observations of the detected pilot while enforcing positive semidefiniteness. With a budget fraction of 0.2, the proposed ordering recovers approximately 90.4 percent and 87.9 percent of the reference gain obtained by testing all candidates under MR and local partial minimum mean-square error (LP-MMSE) precoding, respectively. Under a common genie-aided accept/reject benchmark, covariance estimates formed from finite samples retain most of the gain achieved with perfect covariance at the same budget. LP-MMSE precoding achieves higher SSE, whereas refinement yields a larger relative benefit under MR precoding.