Mission-aware BeiDou spoofing defense in UAV swarms with LLM-assisted context validation

1 Introduction

UAV swarms are increasingly employed for coordinated missions such as urban logistics, aerial inspection, and emergency response, where precise navigation and synchronization are critical (Gupta and Gupta, 2022). Their operational reliability often depends on GNSS, with the BeiDou Navigation Satellite System (BDS) gaining prominence due to its high spatial coverage, dual-frequency capabilities, and sub-meter positioning accuracy (Hu et al., 2025). This reliance introduces a significant vulnerability to GNSS spoofing, where adversaries transmit counterfeit BeiDou signals to mislead UAV navigation systems. In swarm operations, such attacks can induce cascading failures in formation stability, positional accuracy, and mission execution, as compromised nodes propagate erroneous positional data through inter-UAV communication links (Meng et al., 2023). These effects are amplified in dense urban deployments, such as the smart city of Riyadh (Saudi Arabia), where multipath propagation and signal occlusion may create favorable conditions for spoofing dominance.

Our research/investigation targeted the challenge of BeiDou spoofing in decentralized UAV swarms by addressing four core questions: the influence of swarm formation geometry on spoofing susceptibility, optimal detection and mitigation strategies, the role of inter-UAV communication in enhancing resilience, and the operational impact of spoofing on mission performance and safety. The proposed research introduces a hybrid detection architecture, termed OrbitGuardNet, which combines transformer-based sequence encoders with graph neural network layers and is integrated with a Kalman filter for residual analysis. A domain-specialized large language model for real-time anomaly detection, contextual validation, and collaborative defense coordination further augments this. The framework incorporates adaptive mitigation protocols that enable swarm-level reconfiguration through trust-weighted control influence and leader reassignment, thereby preserving cohesion in the face of adversarial interference.

The key contributions of our research include:

• A deep learning-based detection model fusing spatial, temporal, and relational features from GNSS, inertial, and inter-UAV telemetry.
• Swarm control strategies resilient to localized or distributed spoofing.
• A high-fidelity simulation environment modeling diverse BeiDou spoofing scenarios with urban channel effects; and
• Integration of inter-UAV communication with deep inference for consensus-driven mitigation.

It is essential to note that the LLM component performs semantic fusion of multimodal sensor data and correlates navigational states with mission objectives to distinguish between benign deviations and adversarial manipulation. Our applied LLM component is implemented as a compact decoder-only Transformer that is trained as a telemetry language model rather than a general conversational model. It uses a fixed schema to serialize multimodal streams into tokens, so BeiDou observables, IMU signals, inter-UAV ranging, and network events can be processed in one sequence. It then conditions that sequence on mission descriptors such as geofences, formation constraints, and no-fly policies, so the model can test whether the observed motion is plausible under the declared task. This design keeps the LLM role distinct from feature fusion, because the transformer-GNN-Kalman stack provides the numeric embedding, while the language model performs constraint-aware contextual validation on the structured prompt. By embedding this reasoning capability into the swarm’s operational loop, the architecture surpasses purely statistical and/or feature-engineered detectors in ambiguous conditions where spoofing signatures overlap with environmental noise.

Despite our progress, we still face challenges in improving real-time performance, reducing computational load on embedded platforms, and managing data for LLM-based inference. Nonetheless, the paper is structured as follows. The literature review examines GNSS spoofing threats and existing detection strategies. The methodology introduces the OrbitGuardNet hybrid architecture and swarm control mechanisms. The validation section outlines the emulation framework and performance metrics. The results and discussion cover detection accuracy, latency, swarm cohesion, and mission continuity, followed by future deployment and model optimization directions.

2 Literature review

UAV swarms depend on accurate GNSS positioning and precise timing to operate in coordinated formations (Li et al., 2022). BeiDou has become a preferred system for many multi-drone missions due to its strong satellite coverage, dual-frequency precision, and regional enhancements, which improve navigation performance (Gao et al., 2024). In urban delivery, surveillance, and infrastructure inspection applications, swarms utilize BeiDou to maintain stable formations and avoid collisions (Ouyang et al., 2022). The system’s two-way short messaging service also supports direct drone-to-drone communication without relying on ground links. This dependence creates a vulnerability: if the GNSS feed is manipulated, errors can quickly spread through the swarm’s control systems (Badar et al., 2025). A spoofing attack targeting only a few drones can disrupt the entire group’s stability and effectiveness.

GNSS spoofing sends false satellite signals that replace or overpower the real ones. Because civilian BeiDou signals lack encryption or authentication (Zhijun and Yiming, 2021; Zhijun et al., 2024), an attacker with modest equipment can replicate them. Some attacks, such as drag-off (Wang and Wang, 2021), gradually shift the reported position to mislead the drone without triggering alarms. Others, such as meaconing (Steiner et al., 2024), replay real signals with a delay to cause position errors. In multi-transmitter spoofing (Jiang et al., 2025), different drones receive different fake positions, which makes the deception harder to detect. Urban environments with signal reflections make these attacks easier to carry out. UAVs with single-frequency receivers and no cross-check against other sensors are particularly at risk.

When spoofing affects a UAV swarm, the damage goes beyond individual navigation errors. Drones share their positions with each other to maintain formation, so false data from one drone spreads to others. This can cause formations to break apart, drones to collide, or groups to stray from mission paths. In search or coverage tasks, spoofing may leave large areas unchecked or lead to duplicated coverage. If a leader drone is spoofed, others may follow it off-course. Simulations demonstrate that spoofing can prevent swarm consensus algorithms from stabilizing, and thus necessitating continuous corrections that consume energy and compromise positional accuracy.

To comprehensively understand the severity of adversarial impact, Table 1 summarizes several representative GNSS spoofing detection and defense methods proposed in the recent literature (2021–2025), highlighting their principles, key features, and limitations in the context of UAV swarms.

TABLE 1. Representative GNSS spoofing detection and mitigation methods for UAV swarms.

The above methods (i.e., Table 1) illustrate the range of anti-spoofing strategies, from classical consistency checks to sophisticated distributed algorithms. Nonetheless, it is evident that the detection methods work at different levels (Heidari et al., 2022). Some monitor GNSS signals for unusual patterns in signal strength, Doppler shift, or satellite geometry. Statistical models measure deviations from expected signal behavior. Sensor fusion compares GNSS data with inertial, vision, or ranging sensors to confirm accuracy. To spot discrepancies, cooperative detection uses inter-drone distance measurements, such as ultra-wideband ranging. Distributed consensus approaches can isolate compromised drones, while graph-based models detect inconsistencies between the swarm’s communication network and reported positions. Each method has trade-offs in computational cost, real-time performance, and resistance to complex attacks.

As indicated in Table 1, artificial intelligence is increasingly used to improve detection. Convolutional neural networks can extract spoofing features from raw signals, while recurrent models learn normal flight patterns over time. Hybrid approaches combine different model types to improve classification accuracy. Capsule networks perform well across varied spoofing scenarios. Large language models are also being adapted to process telemetry, cross-analyze sensor data, and identify coordinated anomalies. While these methods show promise, they rely on diverse training data, can be resource-intensive, and require careful validation before being used in safety-critical missions.

It is evident that current research leaves several important gaps. Few studies address BeiDou-specific spoofing in large, decentralized swarms or account for multiple simultaneous spoofers. Most systems halt missions entirely when spoofing is detected rather than enabling continued operation. Many rely on costly hardware or centralized processing. A promising direction is combining complementary techniques in a lightweight, distributed design. This includes Kalman filters for rapid anomaly detection, graph neural networks for swarm topology checks, transformer models for temporal analysis, and domain-trained language models for contextual reasoning. Together, these methods enable fast detection, coordinated decision-making, and adaptive responses that help swarms remain functional even in contested navigation environments.

2.1 Proposed methodology

2.1.1 Hybrid Spoofing Detection algorithm

The proposed detection module, OrbitGuardNet, integrates transformer sequence encoders, GNN layers, and a Kalman filter into a unified inference pipeline to identify spoofing-induced anomalies in BeiDou-dependent UAV swarms. Input features consist of multi-modal observables: BeiDou signal metrics such as pseudorange ρ i, carrier phase ϕ i, carrier-to-noise density ratio C / N 0, Doppler shift f D , i; inertial measurement unit (IMU) data comprising tri-axial accelerations a x, a y, a z and angular velocities ω x, ω y, ω z; and inter-UAV ranging data d i j derived from ultra-wideband or optical flow measurements. Each UAV collects a local feature tensor X t ∈ R T × F, where T denotes the time window length and F the number of features and exchanges it with neighbors to enable distributed detection. After feature tensor construction, OrbitGuardNet processes evidence in three linked stages. The transformer stage extracts temporal drift signatures from each UAV sequence and produces the 128-dimensional embedding used by the next stage. The GNN stage receives these embeddings as node features and updates them through neighbor aggregation, so temporal evidence is checked against swarm topology. The Kalman stage then compares the fused temporal-relational estimate with the predicted navigation state and supplies residual evidence for the final spoofing score.

The transformer encoder maps temporal sequences of local and shared features into latent embeddings while preserving long-range dependencies. Given input sequence X, it is first linearly projected into query, key, and value tensors (Q, K, V) and processed via scaled dot-product attention, as indicated in Equation 1:where d k is the key dimension. In implementation, the temporal transformer encoder is kept lightweight for onboard execution. The encoder uses four stacked self-attention blocks. Each block uses four attention heads. The hidden embedding width is set to 128. The position-wise feed-forward (FF) width is set to 256. Pre-layer normalization and residual connections are applied in every block. Dropout is set to 0.1 in both attention and feed-forward paths. Sinusoidal positional encodings are added to preserve time order in the windowed sequence. Inputs are evaluated at the detector tick using a sliding window of 16 samples with stride 1. The multi-head extension enables the encoder to attend to multiple temporal correlations in parallel to produce an embedding H T that encodes temporal spoofing signatures such as gradual drag-off or intermittent jumps.

Attn Q , K , V = softmax Q K ⊤ d k V (1)

The GNN layer operates on a swarm graph G = V , E, where vertices V represent UAVs and edges E are active communication links. For each UAV i, neighbor messages are aggregated as:

h i l + 1 = σ ∑ j ∈ N i 1 de g i de g j W l h j l (2)

Herewith, in context with Equation 2, the h i l is the embedding at layer l, W l the trainable weight matrix, and N i the set of neighbors. It is worth highlighting that Equation 2 implementation is realized as a Graph Convolutional Network (GCN)-style message passing layer. The aggregation function is a (degree-normalized) sum over the 1-hop neighborhood. A self-loop is included so the node’s own embedding is retained during aggregation. Two GCN layers are stacked so 2-hop relational consistency is captured across the swarm graph. The GNN hidden width matches the transformer output, so the node embedding dimension remains 128 throughout the stack. Nonlinearity is applied after each layer, and dropout is set to 0.1 to stabilize training. The resulting node embedding is fused with the temporal embedding before the spoofing decision stage. This spatial reasoning detects inconsistencies between GNSS-reported positions and the stable communication topology to empower the detection of spoofers targeting only a subset of drones.

Framework has performed residual analysis via a Kalman filter, which estimates the UAV state vector x t containing position, velocity, and clock bias. The time update predicts the state as: where, as per Equation 3 and Equation 4, the F is the state transition matrix, B the control input matrix, and Q the process noise covariance. Herewith, Equation 5 to Equation 7 show how GNSS and IMU data are used to update the measurements. where K t is the Kalman gain, z t the measurement vector, H the observation model, and R the measurement noise covariance. Large residuals r t = z t − H x ^ t | t − 1 outside adaptive thresholds indicate anomalies. These residuals are quantized into discretized sensor residual tokens, and thus form one of the three structured input streams consumed by OrbitGuard-LLM alongside the joint transformer-GNN embedding and the categorical mission tokens, and ultimately it can link model-based anomaly evidence directly to the mission-aware validation stage.

X t | t − 1 = F X t − 1 t − 1 + B u t (3)

P t | t − 1 = F P t − 1 t − 1 F ⊤ + Q (4)

K t = P t | t − 1 H ⊤ H P t | t − 1 H ⊤ + R − 1 (5)

X t | t = X t | t − 1 + K t z t − H X t | t − 1 (6)

P t | t = I − K t H P t | t − 1 (7)

Our novel, context-aware, and domain-specialized LLM (i.e., OrbitGuard-LLM) has enhanced this detection pipeline by semantically integrating numerical and categorical telemetry streams. In practice, OrbitGuard-LLM is a decoder-only Transformer with 12 self-attention blocks and 12 attention heads, and it uses a 768-dimensional hidden state, which yields ≈120 M trainable parameters. It operates on a structured token sequence that is built from (i) the joint embedding produced by the transformer-GNN stack, (ii) discretized sensor residual tokens derived from BeiDou, IMU, and inter-UAV ranging streams, and (iii) categorical network and mission-event tokens. It also ingests mission descriptors as tokens, so constraints such as geofences, no-fly zones, target waypoints, and formation spacing limits become part of the same context window used for inference. Applied input formatting is what enables semantic processing of multimodal data, since continuous values are converted into stable token ranges while categorical states remain symbolic. During inference, OrbitGuard-LLM receives three aligned inputs: the joint transformer-GNN embedding, discretized Kalman residual evidence, and mission tokens describing geofences, no-fly zones, target waypoints, formation limits, network events, and mission states. The model converts this evidence into a plausibility score linked to the declared task. Alerts aligned with permitted mission behavior receive lower decision weight, whereas alerts conflicting with mission constraints receive higher decision weight. The final spoofing decision reflects numeric anomaly strength and mission consistency rather than residual magnitude alone. In operational terms, this stage is invoked as a late, decision-level plausibility check that follows the transformer-GNN-Kalman detector. It consumes the same residual-driven evidence stream and returns a compact plausibility score conditioned on mission tokens, so it can down-weight alerts that are consistent with declared mission intent and elevate alerts that violate explicit constraints. Because this validator sits after the backbone, it can be switched off without changing upstream inputs, embeddings, or thresholds. This isolation is what makes the OrbitGuard-LLM’s contribution directly testable in the systematic ablation protocol, where only the contextual validator is toggled while all other settings remain fixed.

Herewith, it is evident that the applied OrbitGuard-LLM is treated as a contextual validator rather than as a replacement for the numeric detector. Its input is held constant by reusing the same transformer-GNN-Kalman embedding, so upstream feature statistics and thresholds are unchanged. Its contribution is therefore reported as the marginal change in detection probability, false alarm rate, and alert latency under an otherwise fixed pipeline. This marginal gain is quantified in the systematic ablation study using the same four threat scenarios and the same repeated-trial structure, and paired t-tests confirm that the LLM-enabled improvements are statistically significant at significant confidence level.

The training corpus is thus composed of serialized telemetry sequences from the simulator and from the real flights log, so the same schema is preserved across domains. Simulator contributes dense sequences recorded at 50 Hz with ≈50 GB per scenario, while the real flights contribute post-flight logs of ≈2 GB per flight, which are time-synchronized and privacy-redacted before use.

It is then pre-trained with next-token prediction on these structured sequences and is fine-tuned with supervised spoofing labels aligned to attack onset times and mission annotations. This fine-tuning step couples detection labels to constraint tokens, so the model learns when deviations violate mission intent rather than only learning statistical drift patterns.

Equation 8 represents only the final decision head applied to the pooled hidden representation produced by the Transformer, so it should be read as the output layer on top of the LLM backbone rather than as the full model. This separation clarifies why a simple sigmoid head is sufficient at the output, since the semantic modelling capacity sits inside the multi-layer self-attention blocks that generate the latent state used by the head. This design also makes the added value testable, because the same transformer-GNN-Kalman features can be evaluated with and without the LLM contextual validator under identical scenarios. Accordingly, we also formalize a systematic ablation protocol that activates OrbitGuardNet components one stage at a time while keeping the same inputs, thresholds, and threat scenarios fixed. The baseline uses the transformer encoder alone, and the next variants add the GNN relational layer and then the Kalman residual module, so the contribution of spatial consistency and model-based residual evidence is isolated under matched conditions. The final configuration enables OrbitGuard-LLM as a contextual validator on top of the same transformer-GNN-Kalman embedding, so any gain can be attributed to constraint-aware reasoning rather than to changes in the feature backbone. In stated context, the y T denote the joint embedding from the transformer-GNN stack; the LLM ingests y T along with structured mission descriptors m and generates a spoofing likelihood score s:where W o , b o are classification weights and σ is the logistic sigmoid. The LLM is pre-trained on multi-modal UAV telemetry and fine-tuned with supervised labels from simulated and real spoofing incidents. Our intention for this method execution was to enable it to discern patterns where spoofing-induced deviations align with or contradict mission constraints.

s = σ W o · LLM concat y T , m + b o (8)

This hybrid design (i.e., as illustrated in Figure 1) differentiates spoofing from benign GNSS errors by correlating spatial inconsistencies from GNN reasoning, temporal drift patterns from transformer encodings, and contextual plausibility from LLM inference. The encoder first maps windowed feature sequences to temporal embedding H T; the GNN then aggregates neighbor embeddings across the swarm graph and fuses the resulting node representation with H T to form the joint embedding; Kalman residuals are subsequently discretized into residual tokens and passed alongside to OrbitGuard-LLM, which performs mission-aware plausibility scoring as the final decision stage. Multipath effects typically manifest as short-lived, high-frequency residual oscillations, while spoofing exhibits coherent, mission-agnostic drifts, which allow the classifier to maintain low false alarm rates in cluttered urban environments. In proposed context Figure 2 illustrates the LLM-driven tokenization and contextual validation process that enables OrbitGuardNet to distinguish spoofing-induced drifts from benign multipath variations.

2.1.2 Resilient swarm control methodology

We formulated a swarm control strategy to preserve formation integrity and mission progress under partial or full BeiDou signal degradation resulting from spoofing. Each UAV executes a distributed control law that integrates local state estimation, inter-UAV ranging, and spoofing likelihood scores from the hybrid detection module. The nominal motion model of the UAV i is defined in Equation 9.where p i t ∈ R 3 is the position vector, v i t the velocity, and u i t the commanded acceleration. Under normal conditions, u i t is computed to minimize deviation from a target formation geometry p i r e f t using a proportional-derivative (PD) consensus term:

p ˙ i t = v i t , v ˙ i t = u i t (9)

u i t = − k p ∑ j ∈ N i p i t − p j t − d i j ref − k v v i t − v j t (10)

As illustrated in Equation 10, the k p , k v > 0 are control gains and d i j ref is the desired displacement vector between the UAV i and neighbor j.

When spoofing is suspected, the spoofing confidence score s i from Equation 8 modifies control influence through a trust weighting function w i = 1 − s i This weight attenuates the influence of potentially compromised UAVs in the consensus process:where, with reference to Equation 11, the p ∼ j t and v ∼ j t are neighbor states corrected via inter-UAV ranging and inertial dead reckoning. At this stage the trust value is updated from the spoofing confidence score and then applied as a multiplier during consensus fusion. Neighbor packets carrying corrected state vectors, anomaly metrics, and leader status are placed in higher priority queues before low-rate telemetry. Low-trust nodes retain limited control influence, whereas high-trust nodes supply the reference states used for formation correction. During leader selection, every UAV ranks candidates by the product of trust and remaining energy and accepts the candidate with the largest score after swarm confirmation. This phenomenon was crucial for replacing corrupted GNSS estimates.

u i t = − k p ∑ j ∈ N i w j p i t − p ∼ j t − d i j ref − k v v i t − v ∼ j t (11)

We coded purposefully to dynamically reconfigure the leader-follower role assignments by a distributed consensus algorithm. Each UAV broadcasts a tuple (s i, e i), where e i is its current energy reserve. Leader candidates are ranked by (w i · e i) to guarantee that both navigation trustworthiness and endurance influence leadership selection. The new leader index L * is chosen as, and illustrated in Equation 12:

L * = ar g max i ∈ V 1 − s i e i (12)

This process prevents a spoofed leader from misdirecting the swarm while sustaining operation by avoiding frequent leadership changes in energy-critical missions.

During our thorough investigation, we observed that accurate and preferably real-time information exchange is vital in UAV swarm GNSS spoofing mitigation, as it allows individual drones to cross-verify their position data with their peers. Secure communication enables the swarm to collaborate in identifying and rejecting false GNSS signals. Thus, in the proposed framework, information exchange during spoofing events is maintained through a resilient communication protocol (i.e., Priority-Aware Reliable Mesh Protocol¹, as exhibited in Figure 3) that prioritizes anomaly metrics, corrected state vectors, and leader status updates over non-critical telemetry. Each UAV periodically transmits:which neighbors fuse with their own measurements to maintain consistent situational data. Herewith, Equation 13 refers to the process where each receiving UAV takes the transmitted packet from a neighbor i and integrates it with its own locally sensed or estimated state variables. This fusion typically involves Bayesian state estimation, where the trust weight w i = 1 − s I modulates the contribution of the neighbor’s data relative to the UAV’s own measurements. By merging self-observed and neighbor-reported states, the UAV reconstructs a more accurate and robust estimate of the swarm’s spatial configuration and threat status. This phenomenon is effective even if some nodes are compromised or experiencing degraded BeiDou reception. The applied process helped align the perception of all UAVs in the swarm, so its navigation and control algorithm operate on a shared, coherent operational picture despite adversarial interference or sensor noise.

M i = t , p ∼ i t , v ∼ i t , s i , L * (13)

To operationalize the Priority-Aware Reliable Mesh Protocol shown in Figure 3 and specified in Algorithm 1, each UAV runs PARMP as a lightweight, hop-by-hop reliable messaging layer that guarantees time-critical spoofing evidence and control-relevant state updates dominate the shared channel during attacks.

Herewith, the entities and local state (per UAV i) are:

• Neighbor table N i is applied for each neighbor j, store link-quality score (RSSI (received signal strength indicator)/SNR (signal-to-noise ratio) proxy), recent delivery ratio, and last-seen time.
• Priority queues Q i 0 to Q i 3 (highest to lowest).
• Trust weight w i and leader status flag (used for coordination and control signaling).
• Sequence registry R i is last sequence number seen per source (duplicate suppression).

Whereas the message classes (priority mapping) are:

• ⁃ P 0 (Emergency/confirmation) is considered as swarm-wide spoofing confirmation, quarantine/isolation directives, and safety hold flags.
• P 1 (Control-critical) is characterized as leader status updates, leader reassignment commands, and formation/velocity constraint updates.
• P 2 (Detection/state evidence) is constitutes to anomaly metrics, corrected state vectors, spoofing likelihood scores, and trust weight updates.
• P 3 (Non-critical telemetry) functions as bulk logs and low-rate health/status fields not needed for immediate mitigation.

While packet format (header + payload) includes s r c i d , m s g t y p e , p r i o r i t y , s e q , t s t a m p , l e a d e r f l a g , w i , t t l h o p s , a c k p o l i c y , p a y l o a d , i n t e g r i t y t a g , and described as:

• s e q is monotonically increasing per s r c i d.
• t t l h o p s bound flooding; use 1 to 2 hops for tight swarms and increase only under partition.
• a c k p o l i c y is one of {N O N E, H O P A C K, M U L T I A C K}; P 0/ P 1 use acknowledgments by default.

Algorithm 1 PARMP (executed at each communication tick Δ t on UAV i).

When spoofing is confirmed across the swarm, the control policy transitions into an emergency configuration mode. The formation geometry is expanded to increase inter-UAV spacing and reduce collision risk in case of degraded ranging accuracy. Equation 14 represents that the velocity limits are enforced via:where v 0 is the nominal velocity limit. This adaptive constraint reduces aggressive maneuvers for high-risk UAVs while allowing unaffected members to maintain broader surveillance or coverage.

v i t ≤ v max s i = v 0 1 − s i (14)

OrbitGuardNet guarantees that spoofing does not lead to a complete mission abort unless safety thresholds are breached. Instead, trust-weighted control, leader reassignment, and adaptive formation scaling enable the swarm to continue with degraded but stable performance, thereby preserving operational objectives in contested navigation environments.

2.1.3 Simulation framework

The simulation environment is designed to emulate² realistic BeiDou spoofing conditions with high spatial and temporal fidelity, with the aim of aiding quantitative evaluation of the proposed detection and swarm control strategies. The core simulation integrates a physics-based UAV flight dynamics engine with a GNSS signal propagation module that models BeiDou B 1 I and B 2 a signals to incorporate both nominal and adversarial conditions. The true state of UAV i at time t, denoted x i tu t, evolves according to the nonlinear kinematic parameters, as illustrated in Equation 15.where R θ i is the rotation matrix from body to inertial frame, a i t is acceleration input, and g is gravitational acceleration.

p ˙ i t = v i t , v ˙ i t = R θ i t a i t + g (15)

For realistic BeiDou signal modeling, we applied the pseudorange assessment criteria (i.e., as described in Equation 16).where s k t is the position of the satellite k, c the speed of light, δ t i t the receiver clock bias, and η i k t. The composite error term includes ionospheric delay, tropospheric delay, receiver noise, and multipath bias. We have modeled the multipath effects in urban scenarios using stochastic reflection paths with Rayleigh-distributed amplitude and exponentially decaying power delay profiles (PDP). It resulted in time-varying η i k t that correlates with building geometry and UAV altitude.

ρ i k t = p i t − s k t + c δ t i t + η i k t (16)

Spoofing is introduced by replacing the authentic ρ i k t with an attacker-generated value:where in the context of Equation 17, the p fk t is the intended falsified position and δ t spoofer t is the spoofed clock bias. The spoofing source is parameterized by transmit power P sp, spatial location p s, and trajectory p s t for mobile spoofers. We observed that the power control in the simulator allowed us to match authentic signal levels, thereby concealing the attack until takeover.

ρ i k t ← ρ spoofer k t = p fake t − s k t + c δ t spoofer t + η spoofer k t (17)

To certify the simulation captures a broad range of realistic threat conditions, several types of adversarial spoofing behaviors are modeled. Each behavior was designed to stress different aspects of the swarm’s detection and control capabilities. For instance:

• A static single-point spoofer is represented as a fixed transmitter that continuously emits coherent counterfeit BeiDou signals aimed at the swarm’s operating area.
• A mobile pursuit spoofer is modeled as a UAV-mounted transmitter that actively follows the swarm’s movements to maintain an advantageous position for signal dominance.
• Multi-transmitter coordinated spoofers are simulated by deploying several spoofing sources that each broadcast different falsified positions to separate subsets of UAVs. It forced the swarm to resolve conflicting navigation data.
• We emulated a time-shift injection attack by intentionally delaying genuine BeiDou signals and replaying them. This method creates path-length errors without needing high transmit power to overpower the authentic signals.

The OrbitGuardNet environment also models inter-UAV communications. It included realistic delays and packet loss using a Gilbert-Elliott channel model, i.e., as described in Figure 4. This model is implemented as a two-state Markov process with a Good state and a Bad state, which captures bursty losses more realistically than an independent and identically distributed (i.i.d.) dropout assumption. The channel is parameterized by the transition probabilities from Good-to-Bad and Bad-to-Good, along with state-dependent packet error rates that determine loss severity in each state. These parameters are selected per scenario to match the intended average loss rate and burst length used in the simulation stress tests, so that swarm communication degradation remains reproducible. Moreover. The adversarial UAVs are included as mobile network participants capable of injecting corrupted telemetry into swarm consensus protocols.

It is worth highlighting that we have enforced the simulation loop to integrate:

• True state propagation using UAV kinematics.
• Signal generation for both authentic BeiDou and spoofed signals.
• Receiver processing to produce observables (ρ, ϕ, C / N 0, f D) under noise, multipath, and spoofing.
• Detection module execution (transformer-GNN-Kalman-LLM stack) on each UAV’s simulated processor.
• Swarm control update using trust-weighted consensus laws (i.e., Bayesian state estimation).

Performance metrics include spoofing detection probability P D, false alarm rate P F A, detection latency t D, swarm geometric cohesion (average deviation from desired inter-UAV distances), mission completion ratio, and computational load per UAV. These metrics are recorded across varying attack intensities, swarm sizes, and environmental complexities to validate both the detection reliability and the resilience of swarm operations under adversarial navigation conditions.

2.1.4 Novel architecture for distributed swarm intelligence and spoofing resilience

The OrbitGuardNet architecture distributes detection and mitigation capabilities across the swarm to permit each UAV to act as an autonomous sensing and decision-making node while contributing to collective spoofing resilience. In this scope, the distributed intelligence is applied to decentralize sensing, inference, and coordination under fixed model parameters. In other words, the experiments validate swarm-wide decision fusion and mitigation with a detector checkpoint, not online federated training or continual weight adaptation. Each UAV is equipped with an onboard processing unit consisting of a high-efficiency CPU module capable of running the transformer-GNN-Kalman-LLM detection as described in the preceding sections. The architecture is organized into three layers: perception, decision, and coordination.

• The perception layer acquires BeiDou observables (ρ, ϕ, C / N 0, f D), IMU data, and inter-UAV ranging to perform local preprocessing to generate feature tensors.
• The decision layer executes hybrid deep learning inference to produce spoofing likelihood scores s i and corrected navigation estimates p ∼ i , v ∼ i .
• The coordination layer handles inter-UAV communication, consensus computation, and adaptive control law updates.

We implemented Inter-UAV communication over a resilient mesh network supporting both direct radio links and BeiDou’s short messaging service for redundancy. A publish-subscribe protocol (i.e., as explained in Figure 5) is employed, where each UAV publishes its spoofing indicators, corrected state estimates, and trust weight w i = 1 − s i to neighbors. Data exchange occurs in discrete time steps Δ t c, with messages structured, as described in Equation 18:where L i denotes current leader status. These messages are aggregated using a consensus update rule:for any swarm-wide state vector z, as per Equation 19, it guarantees that low-trust UAVs exert minimal influence on group decisions.

P i t = t , p ∼ i t , v ∼ i t , s i , w i , L i (18)

z ¯ t + Δ t c = ∑ i ∈ V w i t z i t ∑ i ∈ V w i t (19)

Detection outcomes are fused across the swarm using a weighted-voting scheme, where each UAV contributes its binary spoofing decision d i ∈ 0 , 1 weighted by w i. A spoofing event is confirmed if:where, as per Equation 20, the τ s is a swarm-level detection threshold determined experimentally to balance sensitivity and false alarm rate. Once confirmed, leader reassignment and formation reconfiguration commands are broadcast from the highest-ranked leader candidate, computed as in Equation 12. In this setting, all UAVs operate with the same offline-trained detector checkpoint, and weights remain fixed throughout each simulation run and each field flight. Inter-UAV communication therefore exchanges only the state, trust, and decision information required for consensus confirmation and mitigation, rather than any parameter updates. This keeps the validated ‘proposed system’ centered on distributed inference, trust-weighted coordination, and resilient control, while any online adaptation mechanism is deferred to Future Work where it can be evaluated explicitly.

∑ i ∈ V w i d i ∑ i ∈ V w i ≥ τ s (20)

We maintained mission resilience by integrating spoofing status into trajectory planning. If the spoofing likelihood for a UAV exceeds a predefined safety threshold σ s, it reduces its control influence and, if necessary, transitions into a shadow mode, where it follows high-trust neighbors at a fixed offset (i.e., as illustrated in Equation 21).

p i t + Δ t = p ∼ j t + d i j shadow , j = ar g max k ∈ N i w k (21)

This mechanism preserves coverage and cohesion while isolating compromised navigation inputs.

By integrating perception, decision, and coordination layers into each UAV, the architecture empowers swarm-level awareness without reliance on centralized infrastructure. The framework also enforced that under persistent BeiDou spoofing, the swarm continuously runs several processes, so detection and mitigation remain stable as topology and link quality vary. These include spoofing detection, trust-weighted consensus, leader management, and mitigation execution, while any online learning via federated rounds is explicitly deferred to Future Work and is not used in the reported evaluation. Together, these operations guarantee the swarm’s navigational reliability and mission continuity remain intact.

2.2 Emulation settings and assessment outcomes

2.2.1 Experimental setup

We evaluated OrbitGuardNet in a high-fidelity simulation (i.e., as exhibited in Figure 6) and a limited real-world UAV (i.e., 3 quadcopters) deployment in Riyadh. The simulation environment modeled a 5 km² urban area with detailed Riyadh city structures and BeiDou signal propagation under multipath and occlusion conditions. Each UAV’s sensor suite included a GNSS receiver (BeiDou B1 band) providing observables (pseudoranges, carrier phase, C N 0, Doppler) at 1 Hz, an IMU streaming 100 Hz accelerations and angular rates, and inter-UAV range sensors (ultra-wideband radios) at ∼10 Hz. The simulation incorporated realistic communication delays and packet losses using a Gilbert-Elliott model and even simulated adversarial drones injecting false data into the swarm consensus.

In these runs, the same offline-trained detector checkpoint was used across all UAVs, and it was not updated during the mission timeline. Weight-exchange messaging was therefore disabled, so inter-UAV communication carried only the state, trust, and decision information needed for consensus and mitigation. This keeps simulation and field outcomes directly comparable, because reported performance is not confounded by mid-mission parameter drift.

No actual RF spoofing was radiated in open air for ethical and safety reasons: all spoofing signals were generated in software or within a RF-shielded testbed to avoid interference with civilian navigation. This controlled setup verifies onboard decision making under safe counterfeit navigation inputs, but it does not reproduce open-air RF capture, receiver front-end saturation, antenna effects, or uncontrolled urban interference. It is worth to understand that the resulting evidence supports closed-loop feasibility and comparative behavior under software injection. It does not establish full deployment reliability against radiated spoofers in open environments. Real UAV tests were conducted on a private field using three quadcopters (each with a rotor span of ∼1.2 m) equipped with Pixhawk autopilots and an onboard NVIDIA Jetson TX2 module for OrbitGuardNet. Table 2 summarizes the hardware/software configurations. During live trials, one UAV was intentionally fed counterfeit GNSS data via a controlled software interface to simulate spoofing, while guaranteeing compliance with local regulations and safety protocols. These live flights were designed as a pilot integration test. The spoofing stimulus was injected through the navigation data interface rather than by open-air RF transmission. Applied design keeps the evaluation compliant with safety constraints and avoids unintended interference with civilian navigation. This constraint also means receiver front-end artifacts and radiated spoofer effects were not measured in the open environment. The field results should consequently be interpreted as evidence of closed-loop feasibility and comparative trends, not as full deployment readiness under radiated RF spoofing.

TABLE 2. Simulation and real-world testbed configurations.

In particular, the live validation used software-injected spoofing through the navigation data interface, so the receiver RF front-end and correlator stages were not exercised by a radiated adversary. As a result, physical-layer effects that often shape real spoofing detectability, such as capture dynamics, AGC saturation, C/N0 transients, tracking-loop stress, and multipath–spoofer coupling, remain outside the scope of the current field evidence. This makes the live trials a strict test of end-to-end decision making under counterfeit navigation streams, and it also aligns with a realistic attack surface where an adversary compromises the GNSS data bus or upstream navigation solution. Even so, open-air RF spoofing can introduce additional artifacts that may change detection behavior, so the reported field metrics should not be interpreted as RF-layer validation. To close this gap, we repeated the same mission and scoring protocol under occasional controlled RF injection in a shielded environment (e.g., conducted injection or calibrated GNSS signal generation), while logging receiver-side indicators alongside the existing residual, consensus, and mitigation signals to quantify RF-layer generalization.

All UAV telemetry and detection logs were time-synchronized and stored on secure digital media for post-flight analysis, with sensitive data (e.g., video feeds or identifying information) redacted to preserve privacy. The spoofing scenarios tested ranged from static ground-based spoofers broadcasting delayed-position signals (gradual “drag-off” attacks) to mobile adversaries and compromised swarm members sharing falsified coordinates. These scenarios allowed us to examine OrbitGuardNet’s response to both external signal deception and internal data integrity attacks under urban mission conditions.

2.2.2 Assessment metrics and evaluation protocol

We applied several metrics to measure detection performance and swarm resilience in order to link each to operational reliability. Detection probability (P D) represents the likelihood of correctly identifying a spoofing attack. In contrast, the false alarm rate (P F A) captures the frequency of false alerts under normal conditions. Achieving a high P D with a low P F A ensures attacks are caught without burdening the system with spurious triggers. Detection latency, measured in milliseconds, refers to the delay between attack onset and alarm, which is a critical factor in determining whether mitigation can be initiated before navigation errors escalate.

Swarm cohesion, expressed as the average deviation from desired inter-UAV distances, reflects how effectively formation geometry is preserved during attacks. This directly links to the mission completion ratio, which records the proportion of missions that finish successfully, with all UAVs reaching their final positions within tolerance and without mid-mission aborts.

Per-UAV computational load and corresponding energy consumption were tracked to assess the feasibility of running OrbitGuardNet onboard without compromising other flight operations. This feasibility assessment is paired with an explicit computational complexity and resource decomposition for each module. Let T denote the temporal window length and let d denote the embedding width. In all reported experiments, the temporal window length is fixed to 16 samples at the detector update rate. In the same runs, the embedding width is fixed to 128 to maintain a stable compute footprint per UAV. These values remain unchanged across attack types so comparisons reflect scenario difficulty rather than model resizing. Under this setting, the complexity expressions below map directly to the deployed configuration on the simulation platform and the Jetson TX2 testbed. The transformer encoder has time complexity O ( L t . T . d 2 + T 2 . d per inference, and the T 2 term arises from self-attention. The GNN message passing step has complexity O L l l m . E . d, where E is the number of active inter-UAV links. The Kalman residual update has complexity O n 3 due to matrix inversion, yet n is fixed for the selected state vector, so this cost remains bounded per tick. OrbitGuard-LLM has complexity O L l l m . S . d 2 + S 2 . d for token length S, so its dominant term also grows quadratically with context length. We compute approximate FLOPs (Floating-Point Operations Per Second) by counting multiply-accumulate operations in the linear projections, attention products, and feed-forward layers, and we report them per component as a function of T , d , S. We also report memory as the sum of model weights plus runtime activations, where weights are dominated by the LLM backbone. This is why latency is presented as a sum of preprocessing time, transformer encoding time, GNN aggregation time, Kalman update time, and optional LLM validation plus communication time, so the reported end-to-end alert time can be interpreted as buffering plus inference plus message exchange. To support reproducibility and practical deployability analysis, Table 3 provides a concise, per-UAV, per-tick quantification of computational and communication overheads to clarify how individual modules contribute to overall inference latency and resource utilization.

TABLE 3. Computational cost and resource breakdown (per UAV, per detector tick) for modules (easy-reference latency decomposition).

To certify consistent evaluation, each spoofing scenario was repeated ten times with varied noise, attacker timing, and initial swarm configurations. Those scenarios match the explicit threat models defined in the simulation framework. They include a static single-point spoofer, a mobile pursuit spoofer, multi-transmitter coordinated spoofers, and a time-shift injection attack. For each threat type, detection probability and false alarm rate are computed per trial at the same detector update rate and threshold. The ten repetitions per threat type are then summarized as mean and standard deviation, and the same statistics are computed for latency and cohesion. A cross-scenario ‘average’ is obtained by macro-averaging the per-scenario means so each attack type contributes equally to the aggregate. Per-scenario distributions are also reported using min-max ranges and boxplot summaries to expose which spoofing mechanisms induce the highest variance. Examined protocol targets repeatability within each defined scenario. The repeated trials support variance estimation under controlled perturbations of noise and timing. Design does not yet provide population-level evidence across diverse sites, weather, or RF interference regimes. Statistical significance is therefore interpreted as a within-scenario improvement over matched baselines rather than a generalized operational guarantee. Larger and more diverse field campaigns remain required to quantify generalization under true urban RF conditions. To avoid relying on a single train/test split, the offline learning stage is evaluated under cross-validation rather than a one-off holdout. The emulation traces are partitioned into five disjoint folds at the run level, so complete trajectories remain intact and leakage from adjacent windows is avoided. Each fold is used once as a held-out test set, while the remaining folds are used for training and internal validation, and the reported performance is aggregated across folds. This reporting therefore reflects mean behavior and variability across independent test folds, rather than outcomes from one favorable split. Because the four spoofing threat scenarios are retained in every fold, the fold-wise aggregation preserves scenario coverage while still enforcing strict separation of test runs from training runs. Offline model training followed a 5-fold cross-validation protocol with strict separation between training and test runs/trajectories to avoid overfitting. In the reported experiments, federated rounds were not activated, so gradient or parameter-delta exchanges were not performed online. Training was completed offline, and the resulting detector weights were deployed as a frozen checkpoint on each UAV. The evaluation therefore isolates detection probability, false alarm rate, and latency from any effects of online adaptation. This also means that any stated benefit of federated learning should be interpreted as deployment potential, not as a validated performance gain. We assessed statistical significance of results through paired t-tests on repeated trials, using p < 0.05 (i.e., average assessment of p-values/test statistics per scenario/config pair) as the threshold. The detection rate gains over baselines without the LLM or swarm consensus were confirmed at a 95% confidence level. All code and anonymized datasets underwent internal ethical review before analysis.

2.2.3 Systematic ablation study

To make the component-wise value of OrbitGuardNet explicit, we report a systematic ablation study under the same emulation protocol, the same four threat scenarios (i.e., static single-point spoofer, mobile pursuit spoofer, multi-transmitter coordinated spoofers, and time-shift injection attack), and the same repeated-trial structure (i.e., 10 times with varied noise, attacker timing, and initial swarm configurations) used for the aggregate results. The ablation compares four detector configurations, namely, transformer-only, transformer + GNN, transformer + GNN + Kalman, and the full system with OrbitGuard-LLM enabled as the contextual validator, and each configuration is evaluated separately under static, mobile, multi-transmitter, and time-shift spoofing. For each scenario, we compute detection probability (or accuracy where applicable), false alarm rate, and end-to-end detection latency over repeated trials with matched seeds and perturbations, so comparisons remain paired rather than independent. Statistical significance is then tested with paired t-tests between successive configurations (transformer-only vs. + GNN, +GNN vs. + Kalman, and +Kalman vs. + LLM) within each scenario, using p < 0.05 to verify that performance gains are not explained by trial-to-trial variance. This reporting directly tests whether the added architectural complexity is justified, because it shows where accuracy gains occur, where false alarms reduce, and what latency cost is introduced by each additional module under identical threat conditions. Table 4 quantifies module-wise performance trade-offs under matched threat conditions and supports paired, within-scenario testing of incremental architectural additions.

TABLE 4. Systematic ablation outcomes across four spoofing threat scenarios (10 repeated trials per scenario).

2.2.4 Results and anomaly analysis

Our in-depth investigation revealed a consistent performance across both simulation and real-world trials. The staged comparison separates the contribution of temporal modeling (transformer), relational consistency (GNN), residual evidence (Kalman), and contextual plausibility checking (OrbitGuard-LLM), while holding the scenario library and detector tick constant so effects remain attributable to the enabled module. In this reporting, each added component is expected to improve detection probability and/or reduce false alarms, yet it may also introduce a measurable latency cost. The paired significance tests are reported alongside the per-scenario metrics to confirm that observed gains persist across repeated trials and are not driven by a small number of favorable realizations. Herewith, assessment outlines the key figures, for instance:

• In urban simulations, detection probability averaged 98.1% with a false alarm rate under 2.5%, indicative of strong spoofing recognition across attack types. For statistical clarity, it is worth describing that these values are reported as multi-run estimates rather than single-trial outcomes. Across ten repeated trials per spoofing scenario, the full system produced detection values of 97.8% ± 0.3% for static spoofing, 97.7% ± 0.4% for mobile pursuit spoofing, 97.6% ± 0.5% for multi-transmitter spoofing, and 97.5% ± 0.6% for time-shift injection. The corresponding false alarm rates were 2.05% ± 0.18%, 2.20% ± 0.17%, 2.48% ± 0.18%, and 2.35% ± 0.19%, respectively. These multi-run summaries support the reported aggregate claim and show limited dispersion across threat types. Here, the reported averages are computed over the static, mobile, multi-transmitter, and time-shift scenarios defined in the simulation framework, with ten repeated trials per scenario. Those per-scenario trial summaries are not taken from a single split. They are computed on held-out data under the same cross-validation protocol used for offline training, and then aggregated so the final numbers reflect performance that repeats across independent test folds. Consequently, the reported values should be read as cross-validated, scenario-balanced estimates with explicit variability, rather than as a single-run outcome. The summary value therefore reflects a macro-average across scenario means rather than one pooled trajectory. This choice avoids bias toward longer runs or easier attack realizations. To make variability explicit, the revised reporting also provides a per-scenario breakdown of detection probability and false alarm rate as mean ± standard deviation, along with the observed min–max ranges across trials. The same breakdown is reported for the field logs, so scenario-driven variation is separable from platform-driven effects under software-injected spoofing.
• Field trials were slightly lower at 94.6% detection and 3.1% false alarms. These field values reflect a small-scale pilot with software-based spoofing injection. The measured metrics therefore quantify end-to-end system behavior under controlled counterfeit navigation streams rather than radiated RF capture effects. This evidence supports feasibility of the onboard pipeline and the coordination logic under real flight dynamics. Broader claims about robustness to open-air radiated spoofers are required to controlled RF injection studies and larger fleets. Accordingly, the field figures should be read as performance under software-injected spoofing that preserves real flight dynamics, but bypasses radiated signal capture. This distinction matters because a radiated spoofer can interact with receiver tracking loops and near-far power conditions in ways that navigation-interface injection cannot reproduce. We therefore treat the current field evidence as an integration and feasibility validation for the onboard pipeline and swarm coordination logic, rather than a definitive RF-layer robustness claim. This framing keeps the contribution honest while motivating the forthcoming controlled-interference evaluation as the appropriate venue to quantify radiated effects under matched scenarios. The outcome thus reflects the added noise and unmodeled flight effects.
• Detection latency remained low, with alerts triggered in about 1.8 s during simulations and 2.3 s in real flights. These times were short enough to enable mitigation before navigation errors became critical. For larger swarms, the latency constraint should be interpreted through the per-module scaling terms reported in Table 3. We observed that the Kalman update remains bounded for the fixed state vector, while the transformer cost remains tied to the 16-sample temporal window and 128-dimensional embedding for each UAV. The GNN and mesh exchange terms increase with active inter-UAV links, so denser swarm connectivity is the main source of latency growth. The three-UAV flight result represents a pilot latency value, whereas larger swarms require dedicated scaling trials under the same detector tick and communication model. The field experiment should therefore be treated as an integration pilot rather than a full scalability test. Hereby, practically it is recommended to assess a larger swarm campaign to stress multi-hop message delivery, trust-weighted voting, leader reassignment, and GNN message passing under higher node and link counts.
• Swarm cohesion stayed high: formation deviation was under 1.5 m in simulation (≈95% cohesion) and 2.2 m in real flights (≈88% cohesion). We also compared it with detection-only operation, and it shows why active response is necessary after spoofing recognition. In depth analysis revealed that the detection-only baselines stop at alert generation and leave formation control unchanged. Under identical spoofing, this setting produced deviations exceeding 10 m and frequent formation breaks. OrbitGuardNet reduced this effect by linking each alert to trust reweighting, leader reassignment, and adaptive formation scaling. The advantage is therefore observed not only in detection accuracy, but also in preserved cohesion and mission continuity.

Without OrbitGuardNet, identical spoofing caused deviations exceeding 10 m and frequent formation breaks; yet, with the system active, coordination was preserved. All simulated missions were completed successfully, and 90% of field missions achieved their objectives, with one mission stopped early due to a non-spoof-related sensor fault. Per-UAV CPU usage averaged 55% on the Jetson TX2, drawing ∼15 W, well within the platform’s limits. LLM-based contextual checks occasionally spiked CPU use to 70%, but real tests mitigated this by offloading part of the inference to a ground station. For hardware evaluation, the core detector path excludes the LLM and requires about 17.37 MFLOPs per tick per UAV, equal to about 173.7 MFLOPs/s at 10 Hz. Its main learned weights are the 0.524 M-parameter transformer and the 32,768-parameter GNN, with a bounded Kalman update. The optional OrbitGuard-LLM adds about 120 M parameters and dominates memory and activation demand, so it was treated as a conditional validator rather than a continuous onboard workload. The measured 55% average CPU use, 70% peak CPU use during LLM checks, and 15 W draw on Jetson TX2 indicate feasibility for the tested platform under partial LLM offload. This aggregate utilization reflects a staged pipeline with different scaling behavior across components. The Kalman residual computation remains bounded at the selected state dimension, so its per-step cost stays stable across trials. The GNN stage scales with the number of active neighbor links, so it remains linear in swarm connectivity for a fixed embedding width. The transformer encoder is the dominant term in the onboard deep stack because attention introduces a quadratic dependence on the temporal window length. OrbitGuard-LLM is the most variable stage because its token context is longer, and its attention cost scales quadratically with that context. This is also why LLM execution was not maintained as a constant onboard workload in the field setup, and why partial offload was used to keep the onboard loop within real-time constraints. The offload affects only the contextual validator stage, while the transformer-GNN-Kalman detector continues to produce real-time spoofing likelihood scores for control updates.

Qualitative behavior also confirmed adaptability. In a meaconing attack, gradual drift bypassed threshold triggers, but the transformer-GNN accumulated inconsistencies until the LLM flagged an implausible path through a no-fly zone. This phenomenon led to a timely detection. The detection case illustrates the specific value contributed by OrbitGuard-LLM beyond conventional feature fusion. It consumes the same residual-driven evidence produced by the transformer-GNN stack, while interpreting that evidence against explicit mission constraints encoded in the prompt, including no-fly boundaries and planned corridor geometry. Such reasoning is therefore constraint-aware rather than purely statistical, which explains the ability to dismiss a drift pattern that remains numerically smooth but becomes semantically implausible under the declared mission. The same mechanism aligns with the observed reduction in maneuver- and multipath-induced false alarms, since benign events typically remain consistent with mission intent even when residual magnitudes temporarily increase. In multi-spoofer tests, conflicting signals caused oscillating positions; consensus logic isolated the compromised nodes, and the swarm reconfigured around trusted members. We also observed that false alarms in real flights were rare and typically occurred during sharp maneuvers or multipath conditions, which were quickly dismissed when the LLM identified them as benign mission events.

2.2.5 Comparative analysis

We compared OrbitGuardNet against recent GNSS spoofing defense methods in the literature (Borhani-Darian et al., 2024; Al-Sabbagh et al., 2025; Almadhor et al., 2025; Zhuang et al., 2024) to contextualize its performance (i.e., reflected in Table 5). It is essential to clarify that Table 5 is intended as a qualitative comparison of capabilities and contextual positioning rather than a direct quantitative, head-to-head benchmark, because the referenced studies rely on heterogeneous datasets, GNSS constellations, threat models, and metric definitions that preclude strict experimental equivalence.

• (Borhani-Darian et al., 2024) targets GNSS signal spoofing detection using deep learning on the receiver’s signal processing outputs. That method employs a CNN classifier on cross-ambiguity function (CAF) signal maps and achieves high detection sensitivity in single-receiver scenarios. Yet, it entails substantial computational cost, which requires large CNN models and even GPU acceleration for real-time use, and does not address multi-UAV swarm coordination.
• (Al-Sabbagh et al., 2025) focused on a single-UAV GPS spoofing detector using an LSTM (recurrent neural network) optimized by a genetic algorithm for hyperparameters. This approach reached about 93% classification accuracy on real flight data. Its reported false alarm rate was low, but the study did not incorporate any inter-drone communication or active mitigation, and it acknowledged that runtime resource demands (CPU load) need careful management for deployment.
• (Almadhor et al., 2025) introduced a compact tiny DNN (CTDNN-Spoof) for GPS spoofing in small UAVs. It emphasized efficiency and multi-label classification of attack types. It achieves very high detection accuracy (up to ∼99% on certain attack classes) and is lightweight enough for real-time onboard use. Yet, like previous works, it treats each UAV in isolation and only provides detection (without offering swarm-level response).
• (Zhuang et al., 2024) proposed a Transformer-based GNSS spoofing interference detector operating at the signal acquisition stage. This method utilizes attention-based sequence modeling to enhance sensitivity to complex interference patterns. It yields higher detection accuracy than prior signal-domain techniques. Still, the Transformer model in this research is computationally intensive and is not tailored to distributed swarms or collective decision-making.

TABLE 5. Comparative analysis of UAV swarm GNSS spoofing defense methods.

Proposed OrbitGuardNet extends beyond these by addressing a broader threat model (multiple spoofers and even malicious insiders in a UAV network) with a hybrid detection technique that fuses transformers, GNN, and domain-specific LLM. Unlike compared methods (Borhani-Darian et al., 2024; Al-Sabbagh et al., 2025; Almadhor et al., 2025; Zhuang et al., 2024), which lack swarm coordination, OrbitGuardNet actively orchestrates the swarm during attacks through consensus and leader re-election mechanisms. This yields a mitigation capability: for instance, compromised drones are algorithmically de-weighted and formation control is adjusted in real-time, which prior systems did not offer. In terms of raw performance, OrbitGuardNet achieved comparably high detection accuracy (≈96–98% P D in tests) while maintaining low false alarms, modest computation overhead per node, and real-time feasibility via optimized onboard code (with partial offloading for the LLM). Table 5 highlights these comparisons, showing that our system provides a more comprehensive defense across detection and mitigation criteria, albeit with a slightly higher complexity due to its multi-component architecture.

Figure 7 illustrates OrbitGuardNet’s robust detection probability within our experimental protocol with results consistently exceeding 96% across simulated and live trials. This reliability stems from its hybrid integration of temporal sequence modeling with graph-based spatial reasoning and contextual validation. Baseline detectors were adequate in isolated or simple cases but failed to maintain accuracy under coordinated spoofing or meaconing conditions. Proposed frameworks’ stronger recognition capability ensures early detection and positions the system as a practical countermeasure for UAV swarms operating in contested environments. This outcome serves as the basis for assessing error rates in subsequent evaluations.

In Figure 8, false alarms remain below 3% when OrbitGuardNet is employed, and this performance is attributed to the semantic validation layer, which differentiates between benign operational deviations and adversarial spoofing. Competing detectors, such as CNN and Transformer-only models, often flagged multipath effects as spoofing and raised unnecessary alerts that disrupted swarm coordination. Lightweight DNNs achieved efficiency but lacked adaptability across diverse scenarios, and this led to inconsistent reliability. Reducing spurious alarms is critical because excessive warnings increase computational burden and erode operator trust. The balance achieved by OrbitGuardNet provides a decisive advantage for sustained swarm operations.

Latency analysis in Figure 9 reveals that alerts are generated within an average field latency of 2.3 s, and this is fast enough to initiate countermeasures before positional errors propagate through the swarm. This speed is achieved by combining rapid Kalman residual checks with temporal-spatial refinement from transformers and GNNs. In contrast, baseline methods required longer accumulation windows, which delayed alarms and allowed geometry degradation. During assessment, we observed that timely detection is crucial in ensuring drones maintain formation stability, and this capacity enhances the link between detection and control effectiveness. The impact of this connection becomes evident in cohesion outcomes.

Assessment outcomes in Figure 10 show that inter-UAV spacing remained within 2.2 m under spoofing pressure when OrbitGuardNet guided mitigation was employed. Even in leader-targeted attacks, consensus-driven trust reweighting and leader reassignment have maintained stability. We have also noticed that the baseline systems lacked swarm-level reconfiguration and frequently produced fragmented groups, which led to wider deviations and operational risks. Herewith, the cohesion under spoofing stress reflects how detection integrates with adaptive control strategies to sustain mission integrity. This capability is directly connected to operational reliability, which we assessed by mission success rates.

Completion statistics in Figure 11 confirm that swarms defended by OrbitGuardNet successfully reached objectives in over 90% of adversarial trials. By implementing coded adaptive mitigation strategies, such as formation scaling and excluding compromised drones, we have been able to continue operations under spoofing without terminating the mission. In contrast, the baseline methods, which halt operations when an attack is detected, reduce mission continuity by prioritizing safety over accuracy. By enabling UAVs to remain operational, OrbitGuardNet supports both resilience and efficiency, thus ultimately demonstrating a decisive difference between passive detection and active mitigation. During assessment and evaluation, we specifically focused on a significant question of feasibility on constrained platforms, where computational demand is a determining factor.

CPU utilization, as illustrated in Figure 12, shows OrbitGuardNet averaging 55% usage on Jetson TX2 hardware and, in some instances, rising to 70% under heavier inference tasks. These levels remain compatible with real-time swarm deployment, unlike CNN and Transformer-only detectors that exceeded embedded processing capacity and required external acceleration. We observed that Compact DNNs operated with lower demands but lacked effectiveness under complex spoofing strategies, thereby compromising their resilience. Thus, balancing computational feasibility with adaptability enables OrbitGuardNet to maintain high accuracy and deployability. This outcome is directly connected to the system’s impact on power consumption during flight.

Figure 13 emphasizes that the average energy draw of 15 W per UAV keeps operations within endurance limits for mid-sized quadcopters. More resource-intensive CNN-based defenses consumed significantly more power and required reduced mission duration, whereas smaller DNNs were energy-efficient but sacrificed adaptability against multi-spoofer conditions. On the contrary, proposed OrbitGuardNet achieves a balance by stabilizing swarm behavior and avoiding unnecessary corrective maneuvers, thus conserving energy while maintaining resilience. This convergence of accuracy, computational efficiency, and energy management demonstrates that OrbitGuardNet is not only effective in theory but also practical for real-world BeiDou-reliant swarm deployments.

2.2.6 Limitations and future work

Despite strong results, several limitations remain. A heavy reliance on simulated data risks synthetic bias, as real urban settings introduce unmodeled effects, such as unusual multipath or genuine GNSS outages, that our simulator only partially captures. Field trials, though useful, were small in scale and did not test the full range of urban threats, such as sophisticated mobile spoofers or simultaneous jamming and spoofing. The live evaluation also did not extensively include open-air RF injection. This prevents direct assessment of receiver front-end impacts and realistic radiated interference in the open environment. In practice, software-injected spoofing validates the detector against counterfeit navigation streams and data-interface compromise, nonetheless it cannot represent the full physical layer of GNSS deception in open air. A radiated attacker can manipulate received power, distort acquisition peaks, induce intermittent loss-of-lock, and create short transients that are only visible at RF and correlator levels, and such effects are not comprehensively captured when the spoofing stimulus enters after the receiver front end. This limitation is fundamental because it bounds external validity to attacks that manifest in the navigation solution and the inter-UAV data plane. We therefore treat the present real-flight evidence as pilot feasibility, and we explicitly defer RF-layer conclusions to shielded and regulator-approved controlled-interference trials that will measure front-end effects (i.e., power manipulation, correlator-level effects, loss-of-lock, acquisition peak distortion) under the same mission protocol and evaluation metrics. Although in simulation we programmed swarm size to maximum 1 to 50 (i.e., as indicated in Figure 6), yet the experimental fleet size was only three quadcopters, which limits statistical power and reduces environmental diversity. The private-field setting also under-samples dense urban-canyon propagation and opportunistic interference sources. These constraints bound the real-world claims to pilot feasibility and motivate the larger controlled-interference trial. Real-world RF-layer validation should use regulator-approved open-air or shielded controlled-interference trials with the same mission protocol, scoring metrics, and receiver-side logging. Such trials should measure power manipulation, acquisition peak distortion, loss-of-lock behavior, correlator-level effects, and multipath-spoofer coupling before claims are extended to radiated spoofing conditions. Until those trials are completed, the reported flight results should be interpreted as pilot feasibility evidence rather than full RF-layer deployment validation.

Onboard compute limits are another challenge. This constraint is most pronounced for OrbitGuard-LLM because its parameter counts and context length drive both weight memory and attention cost. The Jetson TX2 platform provides 8 GB RAM per UAV, and the implementation already relies on optimized deployment tooling, yet the LLM stage still motivates selective execution and partial offload under heavy load. The offload is therefore treated as an implementation choice for the contextual validator rather than a dependency for the core detector. The core transformer-GNN-Kalman stack remains onboard and preserves continuous detection and mitigation triggers even when the ground link is unavailable. This design bounds the operational risk of offload and frames it as an accelerator for semantic validation rather than a single point of failure. In its current form, the LLM component requires offloading to a ground station for timely inference, which is not always practical. Reducing latency and energy consumption on constrained UAV hardware will require further optimization. The multi-component design also requires careful integration, as any failure in key modules, such as communications or the LLM, could impact reliability.

Future work focuses on making OrbitGuardNet fully autonomous and real-time on UAV hardware. This includes compressing and quantizing the LLM or developing smaller domain-specific models to run locally on each drone. The attack library will expand to include advanced meaconing, coordinated multi-vector spoofing, and combined cyber-GNSS threats for deeper stress testing. We also plan larger real-world trials in Riyadh and will work with local regulators to conduct controlled interference tests across different districts. The planned work is organized into three tracks. The first track will reduce onboard load through LLM compression, quantization, and smaller domain-specific telemetry models evaluated against the frozen checkpoint. The second track will test radiated GNSS interference through approved shielded or controlled trials with receiver-side logging of power changes, acquisition distortion, loss-of-lock, and correlator effects. The third track will extend field evaluation across denser urban districts with stronger multipath, occlusion, packet loss, and mixed external and internal attack sources. These trials will verify the scalability and resilience of the system under operational conditions. Insights from deployment will inform a continuous learning process, but it is important to realize that the present study uses static offline-trained weights and does not activate federated rounds, so no validated performance gain from online adaptation is claimed here. In future work, we will implement and evaluate the federated-update pathway under the same scenario definitions and repeated-trial protocol, and we will report improvement over the frozen-checkpoint baseline with appropriate significance testing. Because swarm telemetry is non-IID, these trials will also quantify robustness under heterogeneous clients using conservative participation and validation safeguards before accepting any aggregated update. By closing these gaps, OrbitGuardNet moves toward readiness as a practical defense against GNSS spoofing for UAV swarms in smart city operations.

3 Conclusion

The proposed framework, OrbitGuardNet, has demonstrated that combining transformer encoders, graph neural networks, Kalman residual tracking, and a domain-trained large language model can detect and counter BeiDou spoofing in decentralized UAV swarms with high accuracy. In simulations, it achieved detection rates of nearly 98%, and in live trials, rates above 94%, with very few false alarms. Alerts were fast enough to let the swarm reconfigure before navigation errors spread. The system surpasses single-drone detectors by incorporating trust-weighted consensus, leader reassignment, and adaptive formation control, and thus allowed the swarm to maintain its mission even during attacks. It proved effective against varied spoofing methods, including meaconing and multi-transmitter deception, while staying within the processing limits of UAV hardware. There are still limitations. Simulated urban data may not fully capture real signal behavior, field tests covered only small groups and a limited range of threats, and part of the LLM processing had to be run on the ground. Accordingly, the reported validation should be interpreted as controlled evidence based on software-injected spoofing and pilot flights with three UAVs (without open-air RF spoofing), rather than as a definitive demonstration of robustness under large-scale, real-world radiated spoofing conditions. The identified gaps highlight the need for comprehensive, large-scale testing. The results directly relate to UAV swarms working in GNSS-contested smart cities, where uninterrupted missions are essential. By combining detection with an active, coordinated response in a distributed design, OrbitGuardNet offers a practical approach to maintaining reliable autonomous navigation under persistent spoofing. Future work should focus on larger real-world trials, more efficient onboard inference, and broader attack models that encompass both GNSS and cyber threats, thereby preparing the system for demanding operational use.

Generative AI statement

The author(s) declared that generative AI was not used in the creation of this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Mueen Uddin, University of Doha for Science and Technology, Qatar

Reviewed by: Arash Heidari, University of Houston, United States

Muhammad Muzamil Aslam, Universiti Brunei Darussalam, Brunei