A 5G Jamming Benchmark Exposes a Blind Spot in Label-Free Detector Scores

Radio-frequency jamming disrupts wireless reception without requiring access to a network’s protocols. Open Radio Access Network, or Open RAN, systems expose operational measurements that can help reveal this interference without dedicated spectrum-monitoring equipment. The difficulty is knowing whether a detector works when reliable attack labels are unavailable.

In a preprint first posted on November 3, 2026, Sneihil Gopal, Fernando J. Cintrón and Richard A. Rouil compare a statistical detector with three autoencoder models. Their findings support the statistical approach under the tested conditions, but also expose a weakness in the label-free score used to compare them: a few confident, continuous alarms can look impressive even when most jamming goes unnoticed.

Two approaches to the same telemetry

The study uses ten traces covering 34.7 hours from a single 5G Open RAN testbed. Conditions vary in connected device counts, recording duration, jammer gain and burst length. Some traces contain short, irregular bursts with changing jammer gains. After combining reports from multiple devices by timestamp, the researchers evaluate 123,040 cell-level observations.

Their Statistical Ensemble Method, or SEM, combines three checks: deviations from rolling baselines, collapses or abrupt changes in the number of completed radio measurements, and sudden changes across performance indicators. It filters short detections and merges nearby intervals. Its hybrid fusion rule gives measurement-count detections priority while requiring stronger agreement for other signals.

The alternatives are a feedforward autoencoder, a Long Short-Term Memory autoencoder and a variational autoencoder. These models learn to reconstruct normal telemetry and flag unusually large reconstruction errors. They receive 414 features engineered from the same nine underlying network indicators that SEM uses directly.

Although the detectors do not require labeled attack examples for their calibration objectives, the experiment is not entirely label-free. Jammer-trigger annotations identify clean samples for autoencoder training and validation. The authors describe this as an idealized assumption favoring the autoencoders. Labels also provide the independent accuracy measurements.

A common score, but different meanings

For head-to-head comparisons, the researchers average two quantities: confidence among detected samples and the temporal coherence of alarm intervals. Longer, less fragmented detections receive higher coherence scores. A detector that produces no alarms receives an undefined composite rather than a zero.

The interface is common, but confidence is not equivalent across models. SEM reports agreement among its statistical components; autoencoder confidence comes from normalized reconstruction error. Putting both on a scale from zero to one does not make them interchangeable measures of evidence.

More importantly, both score components describe the alarms a detector raises—not the attacks it misses.

Strong ensemble results, with a transfer caveat

In leave-one-out evaluation, each trace is held out while the autoencoders train on nominal data from the other nine. SEM instead calibrates retrospectively on the held-out trace itself. This tests cross-environment transfer for the autoencoders, not equivalent parameter transfer for SEM.

Under that protocol, SEM achieves a mean F1-score of 0.918, compared with 0.521 for the LSTM autoencoder, 0.503 for the feedforward model and 0.185 for the variational model. F1 combines precision and recall. SEM ranks first in every held-out environment under both F1 and the composite score. Its mean composite is 0.906, versus 0.688 when selecting the highest-scoring autoencoder in each fold.

SEM’s hardest cases include short, irregular jamming bursts. Its F1 falls to 0.814 and 0.793 on the two dynamic-gain traces, with extra alarms contributing to the decline.

When confident alarms conceal missed attacks

The composite is much less useful for choosing among autoencoders. It identifies the most accurate autoencoder in only four of ten held-out evaluations. On one trace, the LSTM model scores 0.80 on the composite yet detects just five of 3,291 jamming samples, producing an F1-score of 0.003.

The authors therefore recommend checking detection rate against an operator’s estimate of jamming prevalence. A mismatch can expose severe under-detection that the composite overlooks. However, their demonstrated prevalence-based score correction uses ground truth and is not deployable as tested; matching an expected prevalence should not be mistaken for proof of accuracy.

The evidence remains limited to one testbed, selected architectures and a restricted threshold search. SEM also uses retrospective, centered statistics. Proposed live deployment would require buffering, whose latency is absent from the reported onset delays. Live operation and broader testing remain future work. The central lesson is narrower than a universal detector ranking: confident, coherent alarms need a coverage check before they can support trustworthy comparisons.