Pilot Contamination Attack (PCA)

• Pilot Contamination Attack (PCA) is an active eavesdropping strategy in TDD massive MIMO where attackers intentionally mimic pilot signals to corrupt channel estimates.
• It exploits the uplink training phase by injecting an additive interference term, which degrades beamforming, throughput, and secrecy performance.
• Detection and mitigation techniques include energy tests, machine learning classifiers, pilot randomization, group-blind detection, and joint signal-data processing.

Pilot Contamination Attack (PCA) is an active eavesdropping strategy in TDD and massive MIMO uplink training in which a malicious user transmits the same pilot sequence as a targeted legitimate user, thereby contaminating the base station’s channel estimate. Because downlink precoding relies on that estimate, the resulting beam can be steered partly or mostly toward the attacker, producing information leakage and degraded service to the legitimate user. In the broader pilot-contamination literature, PCA is the malicious counterpart of ordinary pilot contamination caused by pilot reuse or non-orthogonal pilots; both mechanisms create estimation bias, but PCA is intentional, power-controlled, and designed to exploit the training phase (Cruz et al., 4 Oct 2025, Akgun et al., 2017, Akbar et al., 2020).

1. Definition, scope, and relation to ordinary pilot contamination

In massive MIMO, pilot contamination classically denotes the situation in which non-orthogonal pilots from different users, cells, or signaling structures are observed simultaneously at a base station, so the channel estimator cannot separate them. The resulting bias does not vanish with higher pilot SNR or longer pilots and leads to coherent interference during data transmission. PCA uses the same mechanism deliberately: the attacker reuses, overlaps, or emulates a victim’s pilot resource during the training interval so that the base station estimates a superposition rather than the intended channel alone (Akbar et al., 2020).

The distinction between malicious PCA and ordinary contamination is operationally important. In the single-cell MMIMO setting emphasized in recent detection work, pilots are orthogonal among the $K$ active users within the cell, and contamination is introduced by a single attacker that copies the victim’s pilot. In multi-cell systems with correlated pilots, however, the attack surface is larger because non-zero pilot cross-correlations already exist by design, so an active attacker can amplify an existing structural weakness rather than create contamination from scratch (Cruz et al., 4 Oct 2025, Akbar et al., 2020).

The same bias mechanism also appears outside the canonical same-pilot spoofing model. In RIS-assisted inter-operator systems, simultaneous pilot transmissions and wide-band RIS reflections create a pilot-contamination-like bias that is structurally analogous to PCA, even though the contamination is unintentional. The key commonality is that the received observation contains an inseparable mixture of the intended channel response and an unintended coherent component, so the estimator is misspecified unless the relevant observation subspaces are made orthogonal (Gürgünoğlu et al., 2023).

2. Canonical signal model and contamination mechanism

A standard single-cell uplink pilot model uses a base station with $M$ antennas and $K$ single-antenna users. Each user $k$ transmits a length-$N$ pilot sequence $x_k$ with power $P_k$, and the received pilot at antenna $m$ is

$$y_m = \sum_{k=1}^{K} \sqrt{P_k}\, h_{km}\, x_k + v_m,$$

with $v_m \sim \mathcal{CN}(0,\sigma^2 I_N)$. Stacking all antenna signals gives

$M$0

If a single attacker targets user $M$1, uses the victim’s pilot $M$2, and transmits with power $M$3, the received pilot matrix becomes

$M$4

Assuming orthogonal pilots, the least-squares estimate for user $M$5 is

$M$6

Without PCA,

$M$7

whereas under PCA against user $M$8,

$M$9

The contaminating term $K$0 is therefore additive in the channel estimate, and its impact scales with the attacker’s relative power, pilot length, and receiver noise. In the cited simulations, $K$1 for all users, so the SNR is defined as $K$2 (Cruz et al., 4 Oct 2025).

Multi-cell correlated-pilot models generalize the same effect by replacing exact pilot reuse with non-zero cross-correlation coefficients. After despreading with the target pilot, the LS estimate contains a desired term, natural pilot-contamination terms from legitimate co-pilot users, and PCA terms from attackers weighted by the corresponding pilot correlations. In that setting, non-zero cross-correlations explicitly create contamination terms from both legitimate users and attackers, and the malicious transmitter can maximize the error variance by choosing the victim pilot or its conjugate when that pilot is known (Akbar et al., 2020).

3. Impact on beamforming, throughput, secrecy, and capacity

The principal effect of PCA is that reciprocity-based downlink precoding uses contaminated CSI. In a single-cell TDD massive MIMO model with maximum-ratio transmission $K$3, the large-array downlink rate of user $K$4 under PCA becomes

$K$5

which makes the contamination penalty explicit: the attack inserts a deterministic term into the effective noise denominator. In the studied scenarios, the proposed attacks degrade the throughput of a massive MIMO system by more than half, and the maximum individual secrecy rate can be cut from $K$6 Mbps to $K$7 Mbps at $K$8 m. The same analysis shows that increasing $K$9 improves legitimate rates but does not remove leakage caused by PCA, and increasing $k$0 reduces thermal estimation error but does not neutralize contamination (Akgun et al., 2017).

In multi-cell networks with correlated pilots, PCA alters not only instantaneous SINR but also the feasible user-capacity region. Without attack, the capacity-achieving correlated-pilot design satisfies

$k$1

With $k$2 active attackers per cell, the region shrinks to

$k$3

Accordingly, the paper reports that the user-capacity region shrinks by a factor $k$4, and that the SINR requirements for the worst-affected users may not be satisfied even with an infinite number of antennas at the base station (Akbar et al., 2020).

A complementary secrecy interpretation appears in large-antenna-array secret-key agreement. There, the downlink SINRs at the legitimate user and the eavesdropper satisfy an asymptotic complementary relation

$k$5

where $k$6 measures PCA strength. Stronger PCA improves Eve’s effective gain while necessarily reducing the target user’s effective gain, which allows the leakage to be estimated and the secret-key length to be reduced accordingly; the resulting secrecy-outage probability decays exponentially with $k$7 (Im et al., 2015).

4. Detection methodologies

A direct detection strategy is to test the instantaneous energy of the channel estimate, $k$8. Under the single-cell Gaussian model used for comparison, the classical likelihood-ratio test uses the hypotheses $k$9 with $N$0 under $N$1, and $N$2 with $N$3 under $N$4. This yields the scalar rule $N$5, where

$N$6

The same work trains a CART decision tree on $N$7 and $N$8, with stratified 10-fold cross-validated grid search over depths 1 to 5. All depths obtain $N$9, and the selected deployment model is a depth-1 tree with a single split on $x_k$0 and threshold $x_k$1 for $x_k$2. The reported cross-validation summary for depth 1 is accuracy $x_k$3, precision $x_k$4, recall $x_k$5, and $x_k$6-score $x_k$7. In simulation, the depth-1 DT gives $x_k$8 for all tested SNR values when $x_k$9, while the LRT fails to detect PCA at $P_k$0 dB and only reaches $P_k$1 at $P_k$2 dB. At $P_k$3 dB, the DT reaches $P_k$4 by $P_k$5, whereas the LRT reaches $P_k$6 only for $P_k$7. The reported explanation is that both detectors use the same statistic $P_k$8, but the DT learns a global threshold from data and does not require prior knowledge of $P_k$9 or $m$0 (Cruz et al., 4 Oct 2025).

A different detection family introduces divergence between the legitimate pilot and the attacker’s copy. In the uncoordinated frequency shift scheme, the legitimate user partitions the pilot into $m$1 segments of length $m$2, applies artificial CFOs $m$3 segment by segment, and the attacker—being unaware of those shifts—transmits with its own $m$4. The effective cross-correlation in segment $m$5 is

$m$6

with $m$7. When $m$8, $m$9, so the received covariance becomes rank-2 under PCA instead of rank-1. The base station forms the sample covariance, computes eigenvalues, and applies MDL source enumeration; if $$y_m = \sum_{k=1}^{K} \sqrt{P_k}\, h_{km}\, x_k + v_m,$$0, it declares PCA. The same work proves that the relative increase in legitimate channel-estimation MSE due to UFS is less than $$y_m = \sum_{k=1}^{K} \sqrt{P_k}\, h_{km}\, x_k + v_m,$$1, and reports detection performance comparable to superimposed-random-sequence methods without sacrificing legitimate channel estimation performance (Zhang et al., 2017).

A third line of work does not test the pilot waveform directly, but compares the two legitimate channel estimates with minimal leakage. In the key-confirmation approach, Alice and Bob independently derive secret keys $$y_m = \sum_{k=1}^{K} \sqrt{P_k}\, h_{km}\, x_k + v_m,$$2 from their channel estimates and run a masked confirmation protocol: Alice sends $$y_m = \sum_{k=1}^{K} \sqrt{P_k}\, h_{km}\, x_k + v_m,$$3, Bob computes $$y_m = \sum_{k=1}^{K} \sqrt{P_k}\, h_{km}\, x_k + v_m,$$4, returns $$y_m = \sum_{k=1}^{K} \sqrt{P_k}\, h_{km}\, x_k + v_m,$$5, and Alice checks whether $$y_m = \sum_{k=1}^{K} \sqrt{P_k}\, h_{km}\, x_k + v_m,$$6. If the keys mismatch, PCA is detected. The method can be augmented with a trace test on $$y_m = \sum_{k=1}^{K} \sqrt{P_k}\, h_{km}\, x_k + v_m,$$7. The analysis establishes validity when Eve lacks $$y_m = \sum_{k=1}^{K} \sqrt{P_k}\, h_{km}\, x_k + v_m,$$8 and when Eve’s channels are uncorrelated with the legitimate channel, but also shows that correlated partial-CSI attacks and full-CSI replacement attacks can bypass these checks (Tomasin et al., 2016).

5. Mitigation and secure-transmission strategies

One mitigation family randomizes the temporal structure of contamination rather than trying to prevent every collision. Pilot sequence hopping assigns a new orthogonal pilot to each user in every slot, using a pseudorandom seed known to the serving base station. If the pilot pool size is $$y_m = \sum_{k=1}^{K} \sqrt{P_k}\, h_{km}\, x_k + v_m,$$9, the collision distance satisfies

$v_m \sim \mathcal{CN}(0,\sigma^2 I_N)$0

This makes contamination effectively less correlated across time, so a modified Kalman filter can treat it as measurement uncertainty while exploiting temporal correlation in the desired channel. The paper reports that the mean squared error can be lowered as much as an order of magnitude at low mobility, without inter-cell coordination (Sørensen et al., 2015).

Another mitigation acts in the uplink data phase rather than in pilot processing. Group-blind detection preserves the conventional training structure with reused orthogonal pilots, but exploits excess antennas at the base station to partially remove interference during uplink detection. In the case of one dominant interfering cell, the asymptotic SINR of the group-blind detector is

$v_m \sim \mathcal{CN}(0,\sigma^2 I_N)$1

where the non-group-blind asymptote is $v_m \sim \mathcal{CN}(0,\sigma^2 I_N)$2. In the interference-limited high-training-SNR regime, the gain tends to $v_m \sim \mathcal{CN}(0,\sigma^2 I_N)$3, and the reported rate improvement is $v_m \sim \mathcal{CN}(0,\sigma^2 I_N)$4 b/s/Hz for the simulated $v_m \sim \mathcal{CN}(0,\sigma^2 I_N)$5 case (Ferrante et al., 2015).

A more radical defense uses both the received pilots and the received data signals for channel estimation. In the data-aided secure transmission scheme, when the number of transmit antennas and the length of the data vector both tend to infinity, the signals of the desired user and the eavesdropper lie in different eigenspaces of the received signal matrix at the base station provided that their signal powers are different. The downlink precoder is then built on the user eigenspace basis $v_m \sim \mathcal{CN}(0,\sigma^2 I_N)$6, which asymptotically nulls the eavesdropper. In the single-cell single-user i.i.d.-fading case, the secrecy rate scales logarithmically with the number of transmit antennas, matching the standard massive-MIMO scaling law without an eavesdropper. The same work emphasizes a counterintuitive design rule: decreasing the desired user’s uplink power can improve eigenspace separation under a strong active attack (Wu et al., 2019).

Leakage-aware secret-key agreement provides a related but distinct mitigation objective. By exploiting the complementary relation between the received signal strengths at the target user and the eavesdropper, the base station can estimate the effective BS-to-Eve channel gain and adapt the secret-key length accordingly, even when the attacker’s parameters are unknown. The resulting estimator has NMSE that scales as $v_m \sim \mathcal{CN}(0,\sigma^2 I_N)$7, and the average secrecy outage probability decays exponentially with $v_m \sim \mathcal{CN}(0,\sigma^2 I_N)$8 (Im et al., 2015).

6. Architectural variants, assumptions, and unresolved issues

PCA generalizes beyond the textbook same-pilot spoofing model. In RIS-assisted inter-operator systems, simultaneous pilot transmissions and wide-band RIS reflections create a contamination bias $v_m \sim \mathcal{CN}(0,\sigma^2 I_N)$9 that does not vanish with higher pilot SNR or longer pilot length. The main mitigation is orthogonality of RIS configuration sequences across operators,

$M$00

which removes the bias, but for two interfering RIS it requires $M$01. A more adversarial RIS-specific model is IRS-PCA, where Eve never transmits and instead uses an intelligent reflecting surface to reflect Bob’s pilot. For its quickest-detection formulation, the GCUSUM rule is designed so that $M$02, while the worst-case average detection delay satisfies

$M$03

as $M$04. The same paper combines detection with cooperative channel estimation of the IRS direction and zero-forcing beamforming to reduce signal leakage (Gürgünoğlu et al., 2023, Huang et al., 2020).

Cell-free and user-centric systems replace the cellular pilot structure with distributed clusters of remote radio units, but the attack surface persists because co-pilot users still generate linear mixtures in pilot-matched estimates. A recent defense combines a sounding reference signal using Latin squares wideband frequency hopping with robust PCA; the hopping guarantees that only a few measurements contain strong co-pilot interference, and the robust PCA stage treats those heavily contaminated measurements as outliers. The reported result is almost perfect subspace knowledge and system performance very close to that with ideal channel state information (Göttsch et al., 2022).

In massive MIMO for dense IoT, pilot allocation itself becomes a scalability bottleneck. Clustering and max $M$05-cut pilot assignment reduce simultaneous pilot reuse by assigning orthogonal pilots to clusters of devices rather than individual devices. The reported example is that, by using ten orthogonal pilot sequences, the scheme accommodates 200 devices with only a 12.5% omission rate. The same framework reduces simultaneous pilot activity and coordinated cross-cell reuse; this suggests a narrower timing window for PCA, although the method is presented primarily as a pilot-contamination and scalability solution rather than as a dedicated security mechanism (Saeed et al., 2023).

Several limitations recur across the literature. Some detectors assume orthogonal pilots within the cell, i.i.d. Rayleigh fading, block fading, a single attacker, or a fixed base-station antenna count; performance can degrade at extremely low SNR or very low attacker power, and different array sizes may require retraining. UFS can be weakened if Eve can estimate and replicate the per-segment CFOs, and key-confirmation can be bypassed when Eve has full CSI or sufficiently informative channel correlation. RIS-based orthogonality conditions degrade under phase quantization, synchronization errors, and hardware imperfections. In the cell-free robust-PCA setting, a persistent attacker that tracks the victim’s hopping pattern would violate the sparse-outlier assumption (Cruz et al., 4 Oct 2025, Zhang et al., 2017, Tomasin et al., 2016, Göttsch et al., 2022).

Across these variants, a consistent conclusion emerges: PCA is not removed merely by increasing pilot SNR, increasing pilot length, or increasing the number of antennas. Effective defenses either change the identifiability structure of training—through randomness, orthogonality, subspace separation, or secure confirmation—or they compensate for contaminated CSI during data transmission. Current research directions explicitly include pilot randomization or encryption, multi-feature ensembles, semi-supervised or online learning, covariance-aware detectors, deep learning alternatives, multi-cell coordination, and adversarial-resilient training (Cruz et al., 4 Oct 2025).