The Collapse of RF Trust and the Need for Assured State

Executive Summary

Position, navigation, and timing delivered over Global Navigation Satellite System (GNSS) and adjacent radio frequency (RF) infrastructure can no longer be treated as trustworthy by default in contested electromagnetic environments. It is no longer a rare edge case. The consequence is not just loss of service—it is loss of integrity. The dominant failure mode is not outage but confident deception: systems that remain operational while producing wrong answers.

The shift is structural. Open-source directed-energy research, including work visible through High Power Laser and Particle Beams (HPLPB), covers research areas relevant to controllable disruption: denial, sensor upset, and state corruption that degrades RF-dependent trust without leaving obvious physical signatures. The published record reflects documented research interest, not demonstrated operational capability. In parallel, civil aviation and infrastructure authorities already treat GNSS jamming and spoofing as normal operational hazards.

Jamming removes availability. Spoofing is the more dangerous case: it preserves the appearance of validity. Once false state propagates into navigation, timing, authentication, and control loops, downstream systems compound the error. The problem is not always signal loss. It is often systems operating confidently on wrong state.

Abandoning RF is not the answer. The more defensible posture is to reorder the trust hierarchy: treat RF as one input among several, evaluated against independent local physical evidence. In most operational settings, fabricating consistent local evidence is materially harder than fabricating a broadcast signal.

ALIS is not primarily a precision improvement. Under attack, it is designed to fail differently—preserving falsifiability rather than manufacturing false certainty. In an integrity problem, that is what matters.

1. The RF Trust Collapse: From Directed Energy to Operational Reality

Modern PNT systems have been widely treated as always-connected utilities, but that assumption is breaking down. Regulators now treat GNSS interference—including both jamming and spoofing—as a routine operational risk across civil airspace and critical infrastructure. The FAA maintains a GPS/GNSS Interference Resource Guide documenting both threats with incidents across broad geographies. Aviation safety alerts make clear that GPS degradation is no longer hypothetical and crews must plan for degraded or unavailable GNSS navigation. CISA documents impactful disruption extending tens of nautical miles, noting that GNSS signals can be easily overpowered by unwanted transmissions. Airline reporting confirms significant increases in jamming and spoofing over conflict zones.

The distinction between jamming and spoofing matters operationally. Jamming overwhelms the receiver and removes the solution. It is a visible failure. Spoofing is worse: counterfeit signals cause the receiver to compute incorrect PNT while appearing functional. Downstream systems continue operating on false state. Because GNSS underpins many subsystems simultaneously, interference cascades quickly into avionics clock inconsistency, radio navaid tuning failure, and timing corruption across financial, power grid, and distributed control systems.

GNSS is also a global timing source. Authentication and key management systems tie cryptographic validity to time and sequence. Corrupted timing reference can invalidate authentication state or desynchronize distributed systems. Because the GNSS signal carries no inherent authentication, spoofing attacks can inject false signals accepted as legitimate by legacy receivers.

1.1 What Open-Source Directed-Energy Research Signals

Beyond conventional jamming, High Power Laser and Particle Beams (HPLPB) — co-founded by the China Academy of Engineering Physics — publishes work spanning generation, coupling pathways, electromagnetic compatibility/electromagnetic interference (EMC/EMI), and effects characterization. Specific papers from that body of work are available in the full technical briefing under NDA.

Media narratives about satellite killers often blur three distinct steps: generating high peak power, coupling energy into a target, and producing repeatable functional effects at range. The durable inference from HPLPB's scope is limited but relevant: the technical building blocks associated with controllable disruption are represented across the published literature. The most plausible near-term consequence is localized denial, intermittent receiver overload, degraded timing and corrupted telemetry—effects that collapse trust in navigation and verification without requiring persistent physical destruction.

2. Why RF-Dependent Architectures Fail in a Contested EM Domain

GNSS was engineered around stochastic error, not adversarial structure. Kalman filters assume noise that is approximately Gaussian and bounded. In contested electromagnetic conditions, error is structured, shaped, and often intentional. The filter rewards smoothness; spoofing exploits that preference.

Jamming is the clean failure mode: it often removes the measurement stream entirely. Spoofing is operationally worse. The receiver may report a plausible trajectory, stable velocity, and good signal quality while being entirely wrong. This is a classic inverse-problem failure: the measurement stream is consistent with a false hypothesis, and the estimator cannot reject it because the assumed error model does not include adversarial manipulation.

Directed-energy and HPM research expands the attack surface further—from RF link denial to sensor and electronics upset, including bias excursions, clock drift, and corrupted calibration. These produce plausible-looking data that estimation systems handle poorly because the errors can resemble real measurements.

If the navigation solution remains anchored to RF truth, the system can be coerced into false state acceptance. This implies a shift from single-solution estimation toward multi-source verification with explicit integrity monitoring.

3. Why Physics-Anchored Navigation Wins in Complex EM Environments

In a contested electromagnetic environment, the most defensible alternative to RF-delivered truth is to anchor trust in local physics: measurements taken in situ that evolve continuously with motion and are materially harder to fabricate through a remote broadcast channel. ALIS is not a GNSS receiver and not a replacement for satellites. It is an integrity engine built to answer: given uncertain, potentially compromised RF inputs, what claimed states remain physically consistent with what the device is actually experiencing?

Navigation, framed correctly, is an inference problem. Claimed states must be validated against physical evidence, not decoded from broadcast signals. A spoofed GNSS solution must match not only a position claim but the local physical context experienced along that path.

A GNSS-only system often fails in a binary way: it performs well when conditions are clean, then becomes confidently wrong when compromised. ALIS is designed to degrade differently. Under weak or conflicting evidence, it expands uncertainty and surfaces inconsistency instead of preserving a false position.

4. What the Mathematics Supports

Physics-anchored navigation makes a specific class of claims. The mathematics supports some of them strongly. Others are empirical. The distinction matters.

4.1 State Estimation as Constrained Inference

Navigation estimators, regardless of implementation family, are all solving the same underlying inference problem: given a sequence of measurements, what state is most consistent with those measurements and with known physical dynamics? Evidence that agrees with a candidate state supports it. Evidence that contradicts it degrades it. The output is a distribution over possible states, not a forced single answer.

The standard framing assigns RF-delivered position and time a privileged role in that inference. ALIS does not. Observations are treated as evidence and evaluated against independently observed physical reality. If an RF observation conflicts with local physical evidence, it is treated with reduced trust or rejected. The math is indifferent to the source of a measurement. It only asks whether the claimed state is consistent with the evidence.

4.2 Multi-Modal Constraint Improves Integrity

Independent physical constraints operate along independent dimensions. They do not all depend on the same physical phenomenon. Not all of them share the same primary remote manipulation path. Consistent deception across multiple independent physical constraints requires multi-domain coordination that is substantially harder to sustain than RF-only manipulation.

The value here is not accuracy. It is integrity. You do not need to know where the device actually is to reject an implausible trajectory. You only need the false trajectory to fail to explain the observed physics. If a candidate state cannot explain the observed physical evidence, it should be rejected even when RF-derived signals appear to support it.

4.3 Uncertainty Growth Is a Feature

A well-calibrated estimator widens its uncertainty bounds when evidence is weak. This is not a failure mode. A system that maintains confidently small uncertainty under weak evidence is manufacturing precision it does not have. That manufactured precision is the exact failure mode jamming and spoofing both exploit.

Widening uncertainty under weak evidence is correct behavior. The navigator gets an honest account of what the physics actually supports rather than a false point estimate. A tighter estimate when evidence supports one is the relevant system improvement—not a tighter estimate in all conditions.

4.4 Time Consistency

A spoofed RF signal can be made consistent at a single epoch. Sustaining that consistency against independently evolving local evidence across a full trajectory gets harder with every additional measurement. Time often favors the integrity layer.

4.5 What Is Actually Possible

The mathematics supports five bounded claims: RF can be demoted to weighted evidence; multi-modal sensing can preserve integrity under adversarial conditions; implausible trajectories can be rejected without knowing the true position; uncertainty can be made explicit and honest; and repeated exposure to stable local structure can reduce ambiguity over time.

Universal meter-level localization is not a mathematical guarantee of this architecture. It is empirical. In environments with rich, stable physical structure and sufficient observational support, high-precision localization may be achievable. In magnetically featureless terrain, in structurally homogeneous environments, or on first exposure to a novel area, accuracy will be coarser. ALIS does not claim universal meter-level accuracy. It claims that when a location hypothesis is inconsistent with available evidence, the system can identify and report that condition. That is the function of an integrity layer.

5. ALIS as an Integrity System

5.1 How the System Evaluates Claims

The claim that a device is somewhere must be grounded in something other than the signal making the claim. ALIS evaluates location against independent physical evidence that accumulates over time—not a single-epoch assertion, but a body of evidence the system can interrogate. Claims inconsistent with that evidence are rejected. RF-derived position and time may be used as inputs; they are never treated as authoritative.

The underlying architecture treats the built environment as a source of stable, falsifiable physical structure from which navigation, security, asset awareness, and trust are downstream consumers.

5.2 Assurance Under Contested Conditions

Physical evidence cannot be injected from a remote transmitter. That asymmetry is the foundation. ALIS treats locally observed evidence as a required input, not an optional supplement, and in contested conditions it surfaces uncertainty rather than suppressing it. Under weak or conflicting evidence, the system does not preserve a position simply because a signal remains present.

5.3 Integrity, Attestation, and Authentication

The defining output of ALIS is a location estimate with an integrity argument. Integrity is not the same thing as accuracy. It concerns the probability that the system is wrong without detecting that condition. A 10-meter estimate the system can defend is more operationally useful than a 3-meter estimate it cannot. That distinction—between accuracy and trustworthiness—is what an integrity layer is designed to preserve.

In internal cross-geography discrimination testing, ALIS rejected all false-location claims in this test set (37/37) against an out-of-region target, with median trust scores an order of magnitude below the acceptance threshold. In a separate internal real-data validation set of 37 bursts, ALIS yielded an acceptable integrity classification in 89.2% of cases (33 of 37), with 4 abstentions and 0 false accepts.

Abstention is not failure. In an assurance-layer context, withholding judgment is preferable to asserting unsupported state because it preserves trust precisely when trust is hardest to earn. These results reflect internal testing under defined conditions and are presented as evidence of integrity behavior, not as a universal performance guarantee.

Modern authentication assumes identity is separable from physical reality. That assumption is weakening. Credentials can be stolen, tokens replayed, and location fabricated over RF. The contextual signals most systems rely on—geofencing, cell triangulation, and GNSS coordinates—remain RF-dependent and susceptible to manipulation or degradation under contested conditions.

6. Operational Consequences

The practical difference between architectures shows up in how systems fail. RF-first architectures fail by outage or by confident deception. A physics-anchored integrity layer fails by widening uncertainty and degrading explicitly. Continuous availability is not the primary requirement. Avoiding false confidence in a bad solution is.

Domain	RF-First Failure Mode	ALIS Integrity Response
Aviation	Spoofing produces lingering state contamination; crews act on false position while instruments appear normal.	Surfaces inconsistency between RF-implied and locally observed state, producing defensible uncertainty rather than forced position estimates.
Ports / Logistics	RF congestion degrades GNSS intermittently; location is embedded in access control, scheduling, and asset verification.	Provides physics-grounded location attestation at gate entry, dock assignment, and custody transfer points without depending on GPS or network-reported position.
Urban / Defense	GNSS present but wrong; system appears stable while global state drifts into a false basin; HPM-driven sensor upset.	Independent evidence constraints must be satisfied simultaneously; inconsistency surfaces before it compounds.
Access Control	Spoofable GNSS and network beacons cannot prove physical proximity to a restricted zone.	Physical consistency requirement shifts the attacker from remote manipulation to proximity operations.
UAS / Autonomous Platforms	Jamming removes GPS; platform has no physics-independent basis to verify its state or execute a safe return.	Recorded magnetic trace matched against inertial dead-reckoning bounds position without GPS; integrity state governs authority gating.

7. Limitations and Engineering Reality

A physics-anchored integrity layer is only credible if it avoids substituting one brittle dependency for another. ALIS does not escape physics—it is anchored in it. Its limitations are engineering boundary conditions, and the relevant question is whether those limitations produce manageable, observable degradation rather than silent trust collapse.

GNSS already has integrity frameworks like Receiver Autonomous Integrity Monitoring (RAIM) and Satellite-Based Augmentation System (SBAS), but those integrity systems are designed around expected error models, not adversarial spoofing. ALIS provides a separate integrity axis independent of RF truth. Many systems fuse sensors to improve accuracy under benign conditions; far fewer maintain integrity under adversarial conditions. That is an architectural choice, not a tuning parameter.

The limitations are real. None invalidate the architecture. The key point is that ALIS is designed so limitations produce observable degradation rather than hidden corruption. A navigation and authentication system is judged not by whether it never fails, but by whether it fails in ways that preserve trust.

8. Conclusions

RF-delivered position and timing can no longer serve as trusted state by default. Aviation authorities and infrastructure agencies already treat jamming and spoofing as credible operational hazards. The dominant failure mode is not outage but integrity loss: systems that remain operational while confidently wrong.

ALIS is built around that shift. It treats navigation as an inference problem grounded in local physics, requiring that claimed states remain consistent with independent local evidence. RF inputs may be used, but they are never treated as the final authority. That allows ALIS to function as a redundancy layer in GPS-denied conditions while remaining focused on the broader problem of state assurance. It is designed to surface uncertainty rather than suppress it. In a contested environment, that property is not optional.