# Feasible but Not Safe: Constraint Violations and Report-Channel Attacks in Learned Cell-Free ISAC Association

arXiv: https://arxiv.org/abs/2609.03147 · HTML: https://mlsanity.com/paper/2609.03147/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 17 references that are in the map.
- First posted on arXiv 2 Sep 2026.

## Builds on (most cited first, 11 of 11)

- [GNNGuard: Defending Graph Neural Networks against Adversarial Attacks](https://mlsanity.com/paper/2006.08149/) (2020)
- [DC3: A learning method for optimization with hard constraints](https://mlsanity.com/paper/2104.12225/) (2021)
- [Integrated Sensing and Communications: Towards Dual-functional Wireless Networks for 6G and Beyond](https://mlsanity.com/paper/2108.07165/) (2021)
- [Single Node Injection Attack against Graph Neural Networks](https://mlsanity.com/paper/2108.13049/) (2021)
- [Adversarial Attacks on Deep Learning Based Power Allocation in a Massive MIMO Network](https://mlsanity.com/paper/2101.12090/) (2021)
- [FGGM: Formal Grey-box Gradient Method for Attacking DRL-based MU-MIMO Scheduler](https://mlsanity.com/paper/2510.26075/) (2025)
- [Cell-Free ISAC MIMO Systems: Joint Sensing and Communication Beamforming](https://mlsanity.com/paper/2301.11328/) (2023)
- [Heterogeneous Graph Neural Network for Cooperative ISAC Beamforming in Cell-Free MIMO Systems](https://mlsanity.com/paper/2410.09963/) (2024)
- [Optimal User and Target Scheduling, User-Target Pairing, and Low-Resolution Phase-Only Beamforming for ISAC Systems](https://mlsanity.com/paper/2501.11593/) (2025)
- [Coordinated Decentralized Resource Optimization for Cell-Free ISAC Systems](https://mlsanity.com/paper/2508.01044/) (2025)
- [ASSENT: Learning-Based Association Optimization for Distributed Cell-Free ISAC](https://mlsanity.com/paper/2511.09992/) (2025)

## Abstract (arXiv)

Learning-based schedulers have been proposed to provide real-time user, target, and access point (AP) association in distributed cell-free integrated sensing and communication systems. In a typical approach, a graph neural network (GNN), trained on labels from a mixed-integer linear program, maps lightweight per-AP statistics to decisions on AP clustering, user and target scheduling, and mode selection in one forward pass. Such solutions assume that hard constraints, enforced only as soft training penalties, hold at inference, and that the self-reported statistics are truthful. Using our ASSENT algorithm as an example, we find that despite high F1 scores, many solutions violate at least one hard constraint, demonstrating that high prediction accuracy does not ensure joint feasibility. Projecting the GNN output onto a feasible solution restores constraint satisfaction with low utility loss, even with a simple greedy repair procedure. We further show that feasibility alone does not guarantee robustness to false data injection attacks. A single malicious AP that reports false information cannot substantially increase its user associations, but can greatly increase the rate of infeasible solutions. The effect of such attacks depends on the type of information being falsified. Misreporting information that affects the objective can largely be mitigated through feasibility projection, whereas falsifying information that affects the constraints cannot. The latter can, however, be detected using a low-complexity cross-AP consistency check. These results show that learned ISAC schedulers should be evaluated using constraint-aware feasibility metrics in addition to conventional accuracy measures.