Cellular and Wireless Privacy

Privacy and security systems derived from cross-layer structure in 5G, Wi-Fi, voice agents, and satellite access. New: Mute the UE, a control-plane primitive for UE-initiated reachability muting.

Cellular and Wireless Privacy

MIRAGE

Cross layer invariants for 5G attack detection under mobility.
F1 0.9532.3% mobility false positives16 invariant features

MIRAGE (Mobility-Invariant RAN Attack-detection Guard Engine) separates real mobility from data-plane attacks using protocol structure rather than raw message counts. It turns cross-layer invariants into an attack classifier and mitigation selector.

tell real mobility from data-plane attackscross-layer16 invariantsclassifiermobility ✓attack ✗protocol structure, not raw message counts
Cellular and Wireless Privacy

Cipher

Cross layer Wi Fi fingerprinting under MAC randomization.
84.3% top 1 accuracy100 devicesthree signal phases

Cipher shows that MAC randomization does not erase persistent cross layer signals. It fuses probe behavior, TLS fingerprints, and encrypted traffic statistics to quantify reidentification risk.

MAC randomization does not erase the signalprobe behaviorTLS fingerprinttraffic statsfusere-ID84.3%random MAC ✗ persistent cross-layer identity ✓
Cellular and Wireless Privacy

Cloak

Orbital mix zones for direct to cell privacy.
5 minute localization gaptiming advance side channelorbital mix zone

Cloak sketches privacy protection for direct to cell networks where public satellite trajectories make future cells predictable. It combines cohort handover, attach ambiguity, and timing advance quantization.

hide which predictable cell you attach tocellcellcellorbital mix zoneattach ambiguity + cohort handovertiming advancequantizedside channel closed
Cellular and Wireless Privacy

EARSHOT

Privacy evaluation for agentic voice assistants.
four leakage channelsmodel agnostic harnesscontextual leakage lens

EARSHOT measures privacy leaks that happen inside the agent, not the acoustic signal. It combines voice privacy metrics with contextual integrity for assistants that remember, plan, and call tools.

the leak is inside the agent, not the audiovoiceagentremember · plan · callspeaker identitycross-speaker memorytool callsparalinguisticsfour leakage channels, model-agnostic harness
Cellular and Wireless Privacy

ACI Guard

Defense lens for acoustic context injection.
0.64 mean leakage under attack96.9% leakage reductiontool gate

ACI Guard models attacks where a spoken instruction enters through audio and leaks through a tool action. It evaluates contextual integrity gates for shared agentic voice assistants.

a spoken instruction should not trigger a tool leakaudio injectagenttool actionCI gatecontextual-integrity gate · 96.9% leakage reduction