$v^-$ has two in-neighbours out of $V_5^-$. In particular,
there exists a vertex $v^+ \in V_5^+$ which is not adjacent to $v^-$
(recall that there are no arcs from $V_5^-$ to $V_5^+$ in $D$ as such an arc would be a chelou arc, a contradiction to Claim <ref>).
Now, colour $\Vquatre \cup V_5^- \cup V_5^+ \setminus \{v^-,v^+\}$ with colour $1$,
and $V_6 \cup \{v^-,v^+\}$ with colour $2$.
Since $D$ is $3$-dicritical, there must be a monochromatic directed cycle.
But $D[V_5^- \setminus \{v^-\}]$ and $D[V_5^+ \setminus \{v^+\}]$ are acyclic subdigraphs because they are of size $2$.
So $D[(\Vquatre \cup V_5^- \cup V_5^+) \setminus \{v^-,v^+\}]$ is also acyclic
by Claim <ref>.
Therefore, there is a dicycle in $D[V_6 \cup \{v^-,v^+\}]$ which must contain $v^+$ and $v^-$ because $V_6$ and $\{v^-,v^+\}$ are stable sets.
Thus $v^+$ has an out-neighbour $u$ in $V_6$. But then $v^+$ is a simple standard neighbour of $u$. Thus Claim <ref> <ref> applies to $u$ with $\ell_1 \geq 1$, so $w^*(u) \leq - \frac{1}{3}$. Consequently, $-1\leq \Sigma(D) \leq \sum_{v \in V_5^- \cup V_5^+}w^*(v) + w^*(u) \leq -6\times \frac{1}{6} - \frac{1}{3}  < -1$, a contradiction.

Case 3: $D[V_6]$ is stable and
there is a digon in $D$.

By Claims <ref> and <ref>, each digon is in a $2$-thread.
By Claim <ref>, $D$ contains exactly one $2$-thread.
Let us denote it by $[v_1,x,v_2]$.
Vertices $v_1$ and $v_2$ do not have degree $6$ by Claim <ref> nor degree $4$ by Claim <ref>.
So $\{v_1, v_2\}\subseteq V^{d+}_5 \cup V^{d-}_5$.

Let $z$ be the apex of $[v_1,x,v_2]$.
By Claim <ref> <ref>, $w^*(z) \leq -\frac{2}{3}$.
As vertices in $V_5^+ \cup V_5^-$ have final charge at most $-\frac{1}{6}$, $|V_5^+ \cup V_5^-|\leq 2$.
This implies that $V^{d-}_5 \cup V_5^-$ and $V^{d+}_5 \cup V_5^+$ both have
size at most $2$ and so induce acyclic subdigraphs.
Therefore $D[\Vquatre \cup  V_5^+ \cup V_5^-\cup V^{d+}_5 \cup V^{d-}_5]$ is acyclic
by Claim <ref>.
Since the two neighbours ($v_1$ and $v_2$) of $x$ are not in $V_6$, and $V_6$ is a stable set, then
$V_6 \cup \{x\}$ is a stable set and so $D[V_6\cup \{x\}]$ is acyclic.
Hence, colouring $\Vquatre \cup  V_5^+ \cup V_5^-\cup V'^+_5 \cup V'^-_5$
with $1$ and $V_6 \cup \{x\}$ with $2$, we get a $2$-dicolouring of $D$, a contradiction.

This concludes the proof of Theorem <ref>.

§ CONCLUSION AND FURTHER RESEARCH

The main question investigated in this paper is to get upper and lower bounds on $o_k(n)$, the minimum number of arcs in a $k$-dicritical oriented graph of order $n$.

By Theorem <ref> and the results in Subsection <ref>, we have

$$\pth{k - \frac{3}{4}-\frac{1}{4k-6}} n(D) + \frac{3}{4(2k-3)} \leq o_k(n) < (2k-3)n$$

for every $k\geq 3$ and $n$ large enough.

A first step would be to determine the order of $o_k(n)$ that is a constant $c_k$ such that
$o_k(n) = c_k n + o(n)$. We believe that the constructions given to establish the upper bound are nearly optimal. In particular, we conjecture that $o_k(n)$ is getting closer and closer to the upper bound as $k$ tends to infinity.

$\frac{c_k}{2k -3} \rightarrow 1$ when $k \rightarrow +\infty$.

We mainly focused on the case $k=3$. Proposition <ref> and Theorem <ref> yield

$$\frac{7n+2}{3} \leq o_3(n) \leq \left\lceil\frac{5n}{2}\right\rceil$$

for every even $n \geq 12$.
In the conclusion of [1], Bang-Jensen, Bellitto, Schweser, and Stiebitz  conjectured that every oriented 3-dicritical digraph of $n$ vertices has at least $\frac 5 2 n$ arcs.
Together with Corollary <ref>,
this implies $o_3(n) = \lceil\frac{5}{2}n\rceil$ for every $n \geq 12$.
Hence, a natural question is whether the lower bound of Theorem <ref> can be improved.
We have no reason to think that our bound is tight and we tend to believe the conjecture of [1] to be true.
During this project, we used the same method to obtain lower bounds on $o_3(n)$ that we improved incrementally until we reached the one of Theorem <ref>.  We believe that our method could still be pushed further and provide better lower bounds on $o_3(n)$, at the cost of a longer and sharper case analysis of the structure of the $3$-dicritical oriented graphs.
However, the question remains as to how far our method can be pushed and whether it can provide a tight bound.

Another question that has been touched in this paper is to determine the set of orders $N_k$ for which there exists a $k$-dicritical oriented graph.

The first particular case consists in determining the minimum order $n_k$ of a $k$-dicritical oriented graph.
This is equivalent to determining the minimum integer $n_k$ such that there exists a tournament of order $n_k$ and dichromatic number $k$.
The directed cycles of order at least $3$ are the $2$-dicritical oriented graphs, so  $n_2=3$ and $N_2 = \{n\in \mathbb{N} \mid n\geq 3\}$.
Neumann Lara [19] proved that $n_3=7$ and $n_4=11$.
Bellitto, Bousquet, Kabela, and Pierron [2] recently established $n_5=19$.
For larger values of $k$, $n_k$ is unknown.

Let $D_1$ and $D_2$ be two oriented graphs.
The  oriented graph $\triangle(1,D_1,D_2)$ is the oriented graph obtained from the disjoint union of $D_1$ and $D_2$ by adding a new vertex $u_0$ and all the arcs from $u_0$ to $D_1$, all the arcs from $D_1$ to $D_2$, and all the arcs from $D_2$ to $u_0$.

Let $k\geq 2$ be an integer.
If $D_1$ and $D_2$ are $k$-dicritical, then $\triangle(1,D_1,D_2)$ is $(k+1)$-dicritical.

Let $D_1$ and $D_2$ be two $k$-dicritical digraphs and $D = \Delta(1,D_1,D_2)$.

Let us first show that $D$ is not $(k-1)$-dicolourable.

Suppose for a contradiction that there is a $(k-1)$-dicolouring $\phi$ of $D$.
Then, as $D_1$ and $D_2$ are not $(k-2)$-dicolourable, there exist $u_1 \in V(D_1)$
and $u_2 \in V(D_2)$ such that $\phi(u_0)=\phi(u_1)=\phi(u_2)$.
Then $(u_0,u_1,u_2,u_0)$ is a monochromatic directed $3$-cycle in $D$, a contradiction.

Let us show that $D\setminus e$ is $(k-1)$-dicolourable, for any arc $e=xy \in A(D)$.

If $x,y \in V(D_1)$, then $D_1\setminus e$ has a $(k-2)$-dicolouring $\phi_1$ by assumption.
Moreover, $D_2$ has a $(k-1)$-dicolouring $\phi_2$.
By relabelling the colours, we may assume that $\phi_1$ takes values in $[k-2]$
and $\phi_2$ in $[k-1]$.
Then colour $u_0$ with $k-1$.

Suppose for a contradiction that the resulting colouring $\phi$ has a monochromatic
dicycle $C$ in $D\setminus e$.
If $C$ is coloured $k-1$, then it does not intersect $D_1$.
Moreover, $u_0$ has no out-neighbours coloured $k-1$, so $u_0 \not\in C$.
Thus $C$ is included in $D_2$, contradicting the fact that $\phi_2$ is
a $(k-1)$-dicolouring of $D_2$.
If $C$ is not coloured $k-1$, then $C$ is included in $V(D_1) \cup V(D_2)$.
But there is no arc from $D_2$ to $D_1$ in $D-u_0$.
Hence $C$ is included either in $D_1 \setminus e$ or in $D_2$, a contradiction in both cases.
If $x,y \in V(D_2)$, the proof is identical.

Now suppose $x \in V(D_1)$ and $y \in V(D_2)$.
By assumption, $D_1 -x$ (resp. $D_2 - y$) has a $(k-2)$-dicolouring $\phi_1$
(resp. $\phi_2$), with colours taken in $[k-2]$.
Then we colour $u_0,x$ and $y$ with $k-1$.
Suppose for a contradiction that the resulting colouring $\phi$ has a monochromatic
dicycle $C$ in $D \setminus xy$.
If $C$ is not coloured $k-1$, then it is either included in $D_1-x$ or in $D_2-y$
as there is no arc from $D_2$ to $D_1$.
But this contradicts the fact that $\phi_1$ is a dicolouring of $D_1$
and $\phi_2$ a dicolouring of $D_2$.
Hence $C$ is coloured $k-1$. But the only vertices coloured $k-1$ are $u_0,x$ and $y$,
which do not induce a dicycle in $D \setminus xy$.

The only remaining case (up to symmetry) is $e = u_0 y$ for some $y \in D_1$.
Consider a $(k-2)$-dicolouring $\phi_1$ of $D-y$ with colours taken
in $[k-2]$, and a $(k-1)$-dicolouring $\phi_2$ of $D_2$ with colours taken in
Then colour $u_0$ and $y$ by $k-1$.
Suppose for a contradiction that the resulting colouring $\phi$ has a monochromatic
cycle $C$ in $D\setminus e$.
If $C$ is not coloured $k-1$, then it must be included in $D_1$ or $D_2-y$,
a contradiction. Hence $C$ is coloured $k-1$. Moreover, $C$ must contains $u_0$.
But no out-neighbour of $u_0$ in $D\setminus e$ is coloured $k-1$, a contradiction.

This proves that $D\setminus e$ is $(k-1)$-dicolourable for every arc $e$,
and so $D$ is $k$-dicritical.

Lemma <ref> implies that $\triangle(1,\vec{C}_3,\vec{C}_{n-4})$ is $3$-dicritical for all $n \geq 7$. Hence $N_3 = \{n\in \mathbb{N} \mid n\geq 7\}$.
Moreover, by induction it implies the following.

There exists a smallest integer $p_k$ such that there exists a $k$-dicritical oriented graph of order $n$ for any $n\geq p_k$.

In view of $N_2$ and $N_3$, one might be tempted to believe that $p_k = n_k$, that is $N_k= \{n\in \mathbb{N} \mid n\geq n_k\}$ for all $k\geq 2$.
This is unfortunately false for $k=4$ as shown by the following proposition.

There is no $4$-dicritical oriented graph on $12$ vertices.

Let us denote by $P_{11}$ the Paley tournament on 11 vertices, whose vertices are labelled from $0$ to $10$ in which $ij$ is an arc if and only if $j-i$ is in $\{1,3,4,5,9\}$ modulo 11.
Neumann-Lara [19] proved that $P_{11}$ is the unique $4$-dichromatic tournament of order 11, and
Bellitto, Bousquet, Kabela, and Pierron [2] proved that every $4$-dichromatic tournament of order $12$ contains $P_{11}$.

Assume for a contradiction that there exists a $4$-dicritical oriented graph $D$ of order $12$.
$D$ does not contain $P_{11}$. As long as there are two non-adjacent vertices $a,b$ such that adding the arc $ab$ does not make a $P_{11}$ appear, we add $ab$.
This results in an oriented graph $D'$ (of order 12) such that adding any arc between two non-adjacent vertices make a $P_{11}$ appear. Note that $\dic(D') = 4$ because $D'$ contains $D$ and $n_5 > 12$.

Since $D'$ does not contain $P_{11}$, by Bellitto et al. result, $D'$ is not a tournament.
Therefore there are two non-adjacent vertices $a$ and $b$.

By construction, if we add the arc $ab$ to $D'$, then a $P_{11}$ appears.
Label the vertices of this $P_{11}$ by $u_0, u_1, \dots, u_{10}$ so that $u_iu_j$ is an arc if and only if $j-i$ is in $\{1,3,4,5,9\}$ modulo 11, $a=u_0$ and $b=u_1$.
This is possible because $P_{11}$ is arc-transitive.

Similarly, adding the arc $ba$ to $D'$ let a $P_{11}$ appear, whose vertices can be labelled
$v_0, v_1, \dots, v_{10}$ so that $v_iv_j$ is an arc if and only if $j-i$ is in $\{1,3,4,5,9\}$ modulo 11, $b=v_0$ and $a=v_1$.

Set $I^{++} = N^+(a)\cap N^+(b)$, $I^{--} = N^-(a)\cap N^-(b)$,
$I^{+-} = N^+(a)\cap N^-(b)$, and $I^{-+} = N^-(a)\cap N^+(b)$.
Note that those four sets are disjoint and contained in $V(D')\setminus \{a,b\}$.
Now $\{u_4, u_5\}\subseteq I^{++}$, $\{v_4, v_5\}\subseteq I^{++}$,
$\{u_7, u_8\}\subseteq I^{--}$, $\{v_7, v_8\}\subseteq I^{--}$,
$\{v_2, v_6, v_{10}\}\subseteq I^{+-}$,
and $\{u_2, u_6, u_{10}\}\subseteq I^{-+}$.
Since $|V(D')\setminus \{a,b\}|=10$, it follows that $(I^{++}, I^{--}, I^{+-}, I^{-+})$ is a partition of $V(D')\setminus \{a,b\}$,
$I^{++}= \{u_4, u_5\} = \{v_4, v_5\}$,
$I^{--} = \{u_7, u_8\} = \{v_7, v_8\}$,
$ I^{+-} = \{v_2, v_6, v_{10}\} $,
and $I^{-+} = \{u_2, u_6, u_{10}\}$.

Since $u_7u_8$ and $v_7v_8$ are arcs we have $u_7=v_7$, and $u_8=v_8$.
Moreover $v_3$ is in $I^{-+} = \{u_2, u_6, u_{10}\}$.
But $v_3$ dominated both $v_7=u_7$ and $v_8=u_8$, while $u_2$ and $u_6$ do not dominate $u_8$
and $u_{10}$ does not dominate $u_7$.
This is a contradiction.

§ ACKNOWLEDGEMENTS

This research was partially supported by the french Agence Nationale de la Recherche under contract Digraphs ANR-19-CE48-0013-01 and contract DAGDigDec (JCJC) ANR-21-CE48-0012, and by the group Casino/ENS Chair on Algorithmics and Machine Learning.

[1]
J. Bang-Jensen, T. Bellitto, T. Schweser, and M. Stiebitz.
Hajós and Ore constructions for digraphs.
Electron. J. Comb., 27(1):P1.63, 2020.

[2]
T. Bellitto, N. Bousquet, A. Kabela, and T. Pierron.
The smallest 5-chromatic tournament.

[3]
D. Bokal, G. Fijavz, M. Juvan, P. M. Kayll, and B. Mohar.
The circular chromatic number of a digraph.
Journal of Graph Theory, 46(3):227–240, 2004.

[4]
R. L. Brooks.
On colouring the nodes of a network.
Proc. Cambridge Philos. Soc., 37:194–197, 1941.

[5]
G. A. Dirac.
A property of 4-chromatic graphs and some remarks on critical graphs.
Journal of the London Mathematical Society, s1-27(1):85–92,

[6]
G. A. Dirac.
A theorem of R. L. Brooks and a conjecture of H. Hadwiger.
Proceedings of the London Mathematical Society,
s3-7(1):161–195, 1957.

[7]
G. A. Dirac.
On the structure of k-chromatic graphs.
Mathematical Proceedings of the Cambridge Philosophical
Society, 63(3):683–691, 1967.

[8]
T. Gallai.
Kritische Graphen. I.
Magyar Tud. Akad. Mat. Kutató Int. Közl., 8:165–192,

[9]
T. Gallai.
Kritische Graphen. II.
Magyar Tud. Akad. Mat. Kutató Int. Közl., 8:373–395
(1964), 1963.

[10]
R. Hoshino and K.-i. Kawarabayashi.
The edge density of critical digraphs.
Combinatorica, 35(5):619–631, 2015.

[11]
A. Kostochka and M. Stiebitz.
Excess in colour-critical graphs, volume 7 of Bolyai Soc.
Math. Stud., pages 87–99.
János Bolyai Math. Soc., Budapest, 1999.

[12]
A. Kostochka and M. Yancey.
Ore's conjecture on color-critical graphs is almost true.
Journal of Combinatorial Theory, Series B, 109:73–101, 2014.

[13]
A. Kostochka and M. Yancey.
Ore’s conjecture for $k=4$ and Grötzsch’s theorem.
Combinatorica, 34(3):323–329, 2014.

[14]
A. V. Kostochka and M. Stiebitz.
On the Number of Edges in Colour-Critical Graphs and
Combinatorica, 20(4):521–530, Apr. 2000.

[15]
A. V. Kostochka and M. Stiebitz.
The minimum number of edges in $4$-critical digraphs of given order.
Graphs and Combinatorics, pages 1–16, 2020.

[16]
C.-H. Liu and L. Postle.
On the minimum edge-density of 4-critical graphs of girth five.
Journal of Graph Theory, 86(4):387–405, 2017.

[17]
B. Mohar.
Eigenvalues and colorings of digraphs.
Linear Algebra and its Applications, 432(9):2273–2277, 2010.
Special Issue devoted to Selected Papers presented at the Workshop on
Spectral Graph Theory with Applications on Computer Science, Combinatorial
Optimization and Chemistry (Rio de Janeiro, 2008).

[18]
V. Neumann-Lara.
The dichromatic number of a digraph.
Journal of Combinatorial Theory, Series B, 33(3):265–270,

[19]
V. Neumann-Lara.
The $3$ and $4$-dichromatic tournaments of minimum order.
Discrete Mathematics, 135(1):233–243, 1994.

[20]
L. Postle.
On the minimum number of edges in triangle-free 5-critical graphs.
European Journal of Combinatorics, 66:264–280, 2017.


# How cost impacts equitable participation in astronomy outreach events

Melanie Archipley The International Workshop for Astronomy e.V., Türkenstraße
12, Garching, Munich, 85748, DE  Dept. of Astronomy, University of Illinois
Urbana-Champaign,
1002 West Green Street, Urbana, IL, 61801, USA  Hannah S. Dalgleish The
International Workshop for Astronomy e.V., Türkenstraße 12, Garching, Munich,
85748, DE  Dept. of Physics, University of Namibia,
Pionierspark, Windhoek, Namibia

###### Abstract

The International Astronomical Youth Camp (IAYC) is an astronomy education
outreach event with more than 50 years of history and over 1,700 unique
participants from 81 nationalities. The International Workshop for Astronomy
e.V. (IWA) is the non-profit organization behind the IAYC, established in 1979
and based in Germany. The IAYC’s unprecedented longevity in a rapidly
globalizing world has meant that financial inequities decreases the reach of
the camp to people from the Global South compared to Global North countries.
Though nationalities represented per camp has increased steadily since its
inception, the share of participants from eastern Europe and Africa has
dropped, while those from western Europe and North America have increased.
This note examines how camp cost, location, and leadership affects nationality
diversity amongst participants, and how astronomy outreach events must reckon
with funding for less privileged participants with limited access to
resources.

astronomy education

††software: Matplotlib (Hunter, 2007)

##  1 Introduction

The International Astronomical Youth Camp (IAYC) is a three-week summer camp
where participants aged 16-24 pursue independent inquiry on astronomical
topics. There are no required lectures or exams, and participants report their
findings in LaTeX at the end of the camp. The application consists of a letter
of motivation — resumes, transcripts, or letters of recommendation are not
requested — in order to welcome people with little prior astronomy experience.

The first IAYC took place in 1969 in West Germany, with 40 participants from 5
unique nationalities (27 participants were German). After a decade, The
International Workshop for Astronomy e.V. (IWA) was founded as the body behind
the camp. As written in the statues of IWA, its mission is as follows:

  1. 1.

To spread astronomical knowledge and to teach young people to work
scientifically on their own.

  2. 2.

Promotion of international collaboration and agreement, particularly for
astronomical youth work.

In the past five decades, there have been 55 camps with at least one per year
until 2020 (cancelled due to the COVID-19 pandemic). The 2019 camp had 65
participants from 26 different nationalities with the largest representation
being 15 Spanish participants. The increase in nationalities per camp is a
success with regards to IWA’s second statue, with about five nationalities
added every 10 years. However, the ethnic makeup of the camp is not diverse
(84.7% of IAYC survey respondents111The IAYC survey was completed by 307
former participants between 16 August 2017 and 21 September 2019. Many of the
survey’s findings are published in Dalgleish & Veitch-Michaelis (2018, 2019)
and Archipley et al., in press. were white), and IWA is exploring how the
organization could improve engagement from participants from disadvantaged
areas of the world, such as Africa, eastern Europe, Asia, and South America.
We use gross national income per capita (GNI) to examine the nationalities of
participants, host country, and camp cost over the IAYC’s long history.

##  2 Participant nationalities and GNI

GNI reflects the average annual pretax income of a country’s citizens. It is a
cursory indicator for the average standard of living and is linked to other
measures of a country’s economic and social health. For our analysis, we use a
cutoff of 30,000 USD in 2019 for “low” and “high” GNI as reported by the World
Bank (2019) (to give an indication, Spain’s 2019 GNI is 30,390 USD and Cyprus’
2019 GNI is 27,710 USD). For former countries not listed in 2019, such as
Deutsche Demokratische Republik, Yugoslavia, and Czech and Slovak Federative
Republic, we consider them in the “low GNI” group.

Figure 1 shows the percentage of IAYC participants from low GNI countries and
the inflation adjusted camp fee per year. The majority of participants have
come from high GNI countries in 54 out of 55 camps (the one exception, in
1975, was held in Tunisia). Between 2005 and 2011, the IAYC saw proportionally
more participants from low GNI countries compared to recent years. We also
note that for the seven years where at least 40% of participants were from low
GNI countries, six were hosted in low GNI countries (Czech Republic,
Yugoslavia, Egypt, and Tunisia, with repeats). The last time the camp was
hosted in a low GNI country was in 2011, and the proportion of participants
from these countries has been on a downward trend since 2007. We infer that
people from low GNI countries are able to attend more often when the camp is
hosted in a low GNI country. This could be for several reasons, such as
reduced operating costs (and therefore lower camp fee), as well as reduced
travel costs for participants in local and neighboring low GNI countries.

Figure 1: For each year the IAYC has taken place, we examine the fraction of
participants from low GNI countries (defined as $<30,000$ USD in 2019) (black
points). We also indicate which years the camp was hosted in high and low GNI
countries by triangles and squares, respectively. The inflation adjusted camp
fee is shown for years we have data (gray dashed line).

In 2019, the camp fee was raised to 850 EUR after it remained at 690 EUR (not
inflation adjusted) for the preceding five years. The IAYC has particular
needs resulting in expensive camp houses: they must have beds for $\sim 75$
people for three weeks, provide three daily meals at odd hours, and be located
in rural areas to avoid light pollution. Although camp houses located in low
GNI countries are less expensive, IWA needs general coordinators who can speak
the local language, which limits the number of countries where the IAYC can be
organized. Furthermore, the makeup of the IAYC leader team is limited to
previous participants, so the organization risks trapping itself in a loop
where the camp fee is raised to host the IAYC in a high GNI country, thus
limiting potential participants from low GNI countries, meaning leadership
remains exclusive to people with high GNI nationalities, further reducing
chances of being able to return to a low GNI host country.

##  3 Looking forward

In addition to operating concerns that motivate the need to attract people
from low GNI countries, it is imperative to make astronomy outreach
accessible. Astronomy education may not be available in many countries, making
outreach efforts the primary way to engage such young people. In a response to
the IAYC survey1, one 1982 participant remarked (reproduced from Dalgleish &
Veitch-Michaelis 2019):

> I am one of eight children and my father died when I was 9 years old. None
> of my siblings went to college from school. My trip to the IAYC, sponsored
> by a national scientific organisation, confirmed and inspired my love of
> astrophysics, making me determined to pursue it as a career. I subsequently
> completed an undergraduate degree, Masters and a PhD in mathematics, with a
> specialty in general relativity.

For the IAYC to become a truly inclusive activity, IWA must consider ways to
avoid the cycle of excluding participants from low GNI countries. IWA’s
current grant program (funded by donations, not camp fees) is insufficient to
close this gap, nor does IWA have enough sponsorship to lower the camp fee. In
the past, IWA has cooperated with organizations like the National Youth
Development Trust, which supported African participants to attend the IAYC in
the late-2000s. Some participants have had success finding individual
sponsorship from their own universities, governments, or local charitable
organizations. Overall, these efforts have been limited, providing solutions
which are short-term and with little impact on the overall future of the camp.
IWA is run entirely by volunteers, therefore members have minimal time to
devote to these aspects in addition to the organization of the IAYC itself.

If IWA were to fall into the feedback loop of staying in expensive, English-
speaking host countries with participants able to afford higher fees, this
would not be a threat to the future of the IAYC — the camp is currently
oversubscribed by at least a factor of two. However, that is not the future
that IWA wants. IWA is exploring solutions such as inviting participants to
“pay it forward” when they pay their fee (rather than relying solely on alumni
donations), prioritizing participants from low GNI countries when considering
grant applications, and working with previous IWA members to find sponsorship
in low GNI countries. As an international organization pursuing astronomy
education outreach, it is IWA’s responsibility to do the hard work of making
this outreach available to all.

## References

  * Archipley et al. (2021) Archipley, M., Dalgleish, H. S., Ahrer, E.-M., & Mortimer, D. 2021, in Astronomical Society of the Pacific Conference Proceedings 2020
  * Dalgleish & Veitch-Michaelis (2018) Dalgleish, H. S., & Veitch-Michaelis, J. L. 2018, in Communicating Astronomy with the Public Conference 2018 2nd Edition, 206–207
  * Dalgleish & Veitch-Michaelis (2019) Dalgleish, H. S., & Veitch-Michaelis, J. L. 2019, Nature Astronomy, 3, 1043, doi: 10.1038/s41550-019-0965-y
  * Hunter (2007) Hunter, J. D. 2007, Computing in Science & Engineering, 9, 90, doi: 10.1109/MCSE.2007.55
  * World Bank (2019) World Bank. 2019, GNI per capita, Atlas method (current US$), https://data.worldbank.org/indicator/ny.gnp.pcap.cd?year_high_desc=true


# Malicious RIS versus Massive MIMO:
Securing Multiple Access against RIS-based Jamming Attacks

Arthur Sousa de Sena, Member, IEEE, Jacek Kibiłda, Senior Member, IEEE,
Nurul Huda Mahmood, André Gomes, Member, IEEE, Matti Latva-aho, Fellow, IEEE
Arthur S. de Sena, Nurul H. Mahmood, and Matti Latva-aho are with the
University of Oulu, Oulu, Finland (email<EMAIL_ADDRESS><EMAIL_ADDRESS>matti.latva-aho@oulu.fi).Jacek Kibiłda and André
Gomes are with the Commonwealth Cyber Initiative, Virginia Tech, USA (email:
<EMAIL_ADDRESS>gomesa@vt.edu).The research leading to this paper received
support from the Smart Networks and Services Joint Undertaking (SNS JU) under
the European Union’s Horizon Europe research and innovation programme within
Hexa-X-II project (Grant Agreement No 101095759), the Academy of Finland under
the 6G Flagship program (Grant No 346208) and the academy project ReWIN-6G
(Grant No 357120). This material is also based upon work supported by the
National Science Foundation, under Grants No. 2326599 and 2318798, and the
Commonwealth Cyber Initiative.

###### Abstract

In this letter, we study an attack that leverages a reconfigurable intelligent
surface (RIS) to induce harmful interference toward multiple users in massive
multiple-input multiple-output (mMIMO) systems during the data transmission
phase. We propose an efficient and flexible weighted-sum projected gradient-
based algorithm for the attacker to optimize the RIS reflection coefficients
without knowing legitimate user channels. To counter such a threat, we propose
two reception strategies. Simulation results demonstrate that our malicious
algorithm outperforms baseline strategies while offering adaptability for
targeting specific users. At the same time, our results show that our
mitigation strategies are effective even if only an imperfect estimate of the
cascade RIS channel is available.

###### Index Terms:

Reconfigurable intelligent surface, massive MIMO, passive jamming, physical-
layer security

##  I Introduction

RIS (RIS) is a low-cost and low-power alternative to RF repeaters that is
meant to enhance service availability and resilience of next-generation
wireless networks by dynamically controlling the reflection of impinging
electromagnetic waves. Coupled with a passive mode of operation, it is also an
attractive technology in adversarial applications. A malicious actor may
deploy a RIS or hijack an existing one to easily trigger attacks that utilize
impinging signals to attack wireless communication links.

Ample recent works have proposed a variety of attacks, including creating
destructive multipath [1], assisting an active jammer [2], or an eavesdropper
[3]. However, a potentially more effective way to attack legitimate systems
with a RIS hinges on exploiting vulnerabilities in wireless system design. For
instance, active RIS architectures can create amplified destructive
millimeter-wave beamforming [4], or alter RIS reflective coefficients between
the transmission of data and control symbols, resulting in a substantial
degradation in symbol error rate [5]. Similarly, by introducing malicious
reflections during the channel estimation process, a malicious RIS can reduce
the effectiveness of channel equalization [6], physical layer key generation
rate [7], or corrupt the beamforming vectors [8]. Vulnerabilities in channel
estimation are particularly critical for multiple access methods in mMIMO
(mMIMO) like SDMA (SDMA).

SDMA-aided mMIMO involves two stages: the CSI (CSI) acquisition, based on
transmitted pilot sequences, and data transmission using a precoder design
based on the acquired CSI. The dependency on CSI accuracy makes mMIMO systems
vulnerable to pilot contamination attacks triggered by active transmitters
[9]. However, this attack can also be conducted without additional power by
altering the RIS phase shifts between pilot and data transmission. More
worryingly, it was shown in [10, 11] that an attack against legitimate users
can be made effective even with random RIS phase shifts, named “Disco Ball”
attack.

In this letter, we propose a new and more potent version of the attack against
downlink data transmission to multi-antenna users in a mMIMO system employing
SDMA, whereby the malicious RIS does not randomly select the phase shifts, as
in the Disco Ball strategy [10, 11], but efficiently optimizes them to
increase the damage, all without the knowledge of legitimate channels. To
accomplish this, we develop an efficient and flexible weighted-sum projected
gradient-based algorithm to optimize the RIS coefficients. Subsequently, we
propose two reception strategies that require only an estimate of the
effective cascade RIS channel to mitigate the adverse effects of the attack.
Simulation results demonstrate that our malicious algorithm outperforms
baseline strategies in unleashing more powerful attacks and exhibits
adaptability for targeting specific users. Our results also show that the
proposed mitigation strategies are effective even when only an imperfect
estimate of the cascade RIS channel is available.

Notation: The $i$th element of a vector $\mathbf{a}$ is denoted by
$[\mathbf{a}]_{i}$, the $(ij)$ entry of a matrix $\mathbf{A}$ by
$[\mathbf{A}]_{ij}$, the submatrix of $\mathbf{A}$ formed by its rows
(columns) from $i$ to $j$ by $[\mathbf{A}]_{i:j,:}$
$\left([\mathbf{A}]_{:,i:j}\right)$. The transpose and Hermitian transpose of
$\mathbf{A}$ are represented by $\mathbf{A}^{T}$ and $\mathbf{A}^{H}$,
respectively, $\mathbf{I}_{M}$ is the $M\times M$ identity matrix,
$\mathbf{0}_{M,N}$ is the $M\times N$ zero matrix, and $\diamond$ represents
the Khatri-Rao product. The operator $\mathrm{vec}\\{\cdot\\}$ transforms an
$M\times N$ matrix into a column vector, $\mathrm{vecd}\\{\cdot\\}$ converts
the diagonal elements of an $M\times M$ matrix into a column vector,
$\mathrm{diagm}\\{\cdot\\}$ creates an $M\times M$ diagonal matrix from the
diagonal elements of an arbitrary $M\times M$ matrix,
$\mathrm{diag}\\{\cdot\\}$ transforms a vector of length $M$ into an $M\times
M$ diagonal matrix, $\angle(z)$ returns the phase of the complex number $z$,
and $\mathrm{E}\\{\cdot\\}$ denotes expectation.

##  II System Model

Figure 1: An attacker uses RIS RIS to perform an interference attack against
data transmission in downlink multi-user mMIMO.

We study a downlink multi-user mMIMO system, consisting of one BS (BS)
employing $M$ antennas and $K$ spatially distributed users, represented by the
index set $\mathcal{K}=\\{1,2,\cdots,K\\}$, where each user is equipped with
$N$ antennas, such that $M\gg N$. The BS spatially multiplexes the users using
an SDMA strategy, in which linear precoders are employed. In the presence of
accurate CSI, such precoders can efficiently tackle mMIMO inter-user
interference. However, as illustrated in Fig. 1, the system is jammed by an
attacker that controls a malicious RIS comprising $L$ reflecting elements. It
is assumed the attacker has enough computational power to acquire the CSI of
the cascade RIS channel, but not the direct channels between the users and the
BS. With this information in hand, the attacker can recycle impinging signals
coming from the BS and passively re-introduce inter-user interference that
conventional precoders cannot eliminate. Under the described scenario, the
$k$th user receives the following signal

$\displaystyle\mathbf{y}_{k}$
$\displaystyle=\big{(}\mathbf{F}_{k}^{H}\bm{\Theta}\mathbf{G}+\mathbf{H}_{k}^{H}\big{)}\sum_{i=1}^{K}\mathbf{P}_{i}\sqrt{P}\mathbf{x}_{i}+\mathbf{n}_{k}\in\mathbb{C}^{N},$
(1)

where
$\mathbf{x}_{i}=[\sqrt{\alpha_{i,1}}x_{i,1},\cdots,\sqrt{\alpha_{i,S}}x_{i,S}]^{T}\in\mathbb{C}^{S}$
is the data vector comprising $S$ symbols intended for the $i$th user,
satisfying $\mathrm{E}\\{|x_{i,s}|^{2}\\}=1$, with $\alpha_{i,s}$ denoting the
power allocation coefficient for the $s$th symbol, $P$ represents the transmit
power budget, $\mathbf{P}_{i}\in\mathbb{C}^{M\times S}$ is the precoding
matrix responsible for multiplexing users in space,
$\mathbf{n}_{k}\in\mathbb{C}^{N}$ is the noise vector111Since the attacker
controls only a passive RIS with no active amplifiers, any thermal noise
introduced by the RIS reflecting elements is negligible., whose entries follow
the complex Gaussian distribution with zero mean and variance $\sigma^{2}$,
and $\bm{\Theta}$ is the diagonal reflection matrix of the malicious RIS,
whose amplitude and phase-shift coefficients associated with the $l$th
reflecting element satisfy the constraints $|[\bm{\Theta}]_{ll}|=1$ and
$\angle([\bm{\Theta}]_{ll})\in[0,2\pi],\forall l=1,\cdots,L$. The matrices
$\mathbf{H}_{k}\in\mathbb{C}^{M\times N}$, $\mathbf{G}\in\mathbb{C}^{L\times
M}$, and $\mathbf{F}_{k}\in\mathbb{C}^{L\times N}$ represent the channels
between the BS and the $k$th user (link BS-U), the BS and the RIS (link BS-
RIS), and the RIS and the $k$th user (link RIS-U), respectively, and are
assumed to have correlated entries.

###  II-A Precoding for User Multiplexing

To ensure the effectiveness of the passive RIS jamming attack, the attacker
maliciously stays idle during the BS channel estimation phase. This means the
BS can rely only on the jamming-free channels observed on each BS-U link to
construct the precoding matrix $\mathbf{P}_{k}$. The BS then employs a two-
layered spatial multiplexing strategy in which the desired precoder is
structured as $\mathbf{P}_{k}\triangleq\mathbf{K}_{k}\mathbf{D}_{k}$, where
$\mathbf{K}_{k}$ addresses inter-user interference and $\mathbf{D}_{k}$
maximizes the reception of intended signals at the $k$th user. By recalling
the truncated eigendecomposition, the channel covariance matrix of the direct
link BS-U for the $k$th user can be expressed as
$\bm{\Sigma}_{k}\triangleq\mathrm{E}\\{\mathbf{H}_{k}\mathbf{H}_{k}^{H}\\}=\mathbf{\bar{U}}_{k}\bm{\bar{\Delta}}_{k}\mathbf{\bar{U}}^{H}_{k}$,
where $\bm{\bar{\Delta}}_{k}\in\mathbb{R}^{r_{k}\times r_{k}}$ is a diagonal
matrix comprising $r_{k}$ nonzero eigenvalues of $\bm{\Sigma}_{k}$, and
$\mathbf{\bar{U}}_{k}\in\mathbb{C}^{M\times r_{k}}$ is a tall matrix
containing the associated eigenvectors. The users’ channel matrices can then
be factorized as
$\mathbf{H}_{k}=\mathbf{\bar{U}}_{k}\bm{\bar{\Delta}}_{k}^{\frac{1}{2}}\mathbf{\bar{H}}_{k}$,
where $\mathbf{\bar{H}}_{k}\in\mathbb{C}^{r_{s}\times N}$ is the reduced-
dimension fast-fading channel matrix, whose entries follow the complex
Gaussian distribution with zero mean and unity variance. Thus, the inter-user
interference can be tackled if $[\mathbf{\bar{U}}_{1}\hskip
2.84526pt\cdots\hskip 2.84526pt\mathbf{\bar{U}}_{k-1}\hskip
2.84526pt\mathbf{\bar{U}}_{k+1}\hskip 2.84526pt\cdots\hskip
2.84526pt\mathbf{\bar{U}}_{K}]^{H}\mathbf{K}_{k}=\bm{\Lambda}^{H}_{k}\mathbf{K}_{k}=\mathbf{0},\forall
k\in\mathcal{K}$, where
$\bm{\Lambda}_{k}\in\mathbb{C}^{M\times\sum_{k^{\prime}\neq k}r_{k^{\prime}}}$
is a block matrix with the eigenvectors corresponding to the non-zero
eigenvalues of non-intended users. This implies that $\mathbf{K}_{k}$ must be
designed from the orthogonal complement of the column space of
$\bm{\Lambda}_{k}$, which can be achieved with the aid of its full singular
value decomposition (SVD). More specifically, let
$\mathbf{U}_{\bm{\Lambda}_{k}}$ denote the left eigenvector matrix of
$\bm{\Lambda}_{k}$ computed via SVD. Then, since the last
$M-\sum_{k^{\prime}\neq k}r_{k^{\prime}}$ columns of
$\mathbf{U}_{\bm{\Lambda}_{k}}$ provide the orthonormal basis for the desired
orthogonal complement, the precoder for the $k$th user can be computed as

$\displaystyle\mathbf{K}_{k}=\frac{1}{\sqrt{S}}\left[\mathbf{U}_{\bm{\Lambda}_{k}}\right]_{:,\left(M-S+1\right):M}\in\mathbb{C}^{M\times
S},$ (2)

where the parameter $S$ sets the number of parallel symbols to be transmitted
to each user, which must satisfy $S\leq\left(M-\sum_{k^{\prime}\neq
k}r_{k^{\prime}}\right)$ and $S\leq\min\\{r_{k}\\},\forall k\in\mathcal{K}$.

On the other hand, we design the precoder $\mathbf{D}_{k}$ to maximize the
received power, i.e.,
$\underset{\mathbf{D}_{k}}{\max}\|\mathbf{H}^{H}_{k}\mathbf{K}_{k}\mathbf{D}_{k}\|^{2}_{F}$,
at the $k$th user. This goal can be achieved through the full SVD of the
projected channel $\mathbf{H}^{H}_{k}\mathbf{K}_{k}\in\mathbb{C}^{N\times S}$.
Specifically, by recalling the SVD, we can decompose
$\mathbf{H}^{H}_{k}\mathbf{K}_{k}=\mathbf{\hat{U}}_{k}\bm{\hat{\Delta}}_{k}\mathbf{\hat{V}}^{H}_{k}$.
Then, the inner precoder can be obtained as
$\mathbf{D}_{k}=\mathbf{\hat{V}}_{k}\in\mathbb{C}^{S\times S}$.

##  III RIS-Assisted Attack Design

With the precoder in (2), the BS can effectively suppress inter-user
interference experienced in the link BS-U. However, because the BS cannot
detect the malicious RIS during channel estimation, inter-user interference
propagating through the reflected BS-RIS-U link will inevitably be re-
introduced to the users. Thus, the $k$th user will observe the following
signal

$\displaystyle\mathbf{y}_{k}=\mathbf{H}_{k}^{H}\mathbf{P}_{k}\sqrt{P}\mathbf{x}_{k}+\mathbf{F}_{k}^{H}\bm{\Theta}\mathbf{G}\sum_{i=1}^{K}\mathbf{P}_{i}\sqrt{P}\mathbf{x}_{i}+\mathbf{n}_{k}.$
(3)

The attacker aims to re-introduce as much inter-user interference as possible
in the system to degrade the detection of intended symbols at each targeted
user $k\in\mathcal{K}$. To this end, the reflecting coefficients of the
deployed RIS are tuned to steer all transmissions coming from the BS to jam
multiple access.

The challenge is that the attacker is unlikely to have access to the
legitimate BS-U channels or the BS precoders. Despite this, it can still
exploit the RIS channels to boost inter-user interference in the system. In
this case, the attacker will attempt to match the channels of the BS-RIS link
with those of the RIS-U link by maximizing
$\left\|\mathbf{F}_{k}^{H}\bm{\Theta}\mathbf{G}\right\|_{F}^{2}$. However,
since a single RIS has been deployed, the attacker cannot find a global set of
reflecting coefficients to achieve its objective optimally for all users.
Alternatively, the attacker may apply a flexible jamming framework to tune the
intensity of the attack for each user. This framework is implemented by
computing the Pareto optimal points for the following weighted-sum problem:

$\displaystyle\underset{\bm{\Theta}}{\max}\sum_{k=1}^{K}\nu_{k}\left\|\mathbf{F}_{k}^{H}\bm{\Theta}\mathbf{G}\right\|_{F}^{2},$
(4a) $\displaystyle\text{s.t.}\hskip
5.69054pt\text{\small$|[\bm{\Theta}]_{mn}|=1,\hskip 2.84526pt\forall
m,n\in\\{1,\cdots,L\\}\hskip 2.84526pt|\hskip 2.84526ptm=n$},$ (4b)
$\displaystyle\hskip 17.07164pt\text{\small$|[\bm{\Theta}]_{mn}|=0,\hskip
2.84526pt\forall m,n\in\\{1,\cdots,L\\}\hskip 2.84526pt|\hskip 2.84526ptm\neq
n$},$ (4c)

where the scalars $\nu_{k}$ are the optimization weights that the attacker can
exploit to adjust the levels of interference to the different users. Note that
constraint (4b) sets the amplitudes of the reflection coefficients to one,
modeling the passive operation of the RIS, while (4c) ensures that
$\bm{\Theta}$ is a diagonal matrix. These constraints, plus the matrix form of
the objective function in (4a), make the problem difficult to solve. To tackle
this complication, the attacker transforms the original formulation by
exploiting the Khatri-Rao factorization:

$\displaystyle\left(\mathbf{B}^{T}\diamond\mathbf{A}\right)\mathrm{vecd}\\{\mathbf{X}\\}=\mathrm{vec}\\{\mathbf{A}\mathbf{X}\mathbf{B}\\},$
(5)

where $\mathbf{X}$ is diagonal and $\mathbf{A}$ and $\mathbf{B}$ are arbitrary
matrices of compatible dimensions. Specifically, by invoking (5), the
following transformations can be applied:

$\displaystyle\bm{\theta}$
$\displaystyle\triangleq\mathrm{vecd}\\{\bm{\Theta}\\}\in\mathbb{C}^{L},$
$\displaystyle\mathbf{S}_{k}\triangleq\mathbf{G}^{T}\diamond\mathbf{F}_{k}^{H}\in\mathbb{C}^{MN\times
L}.$

Then, by plugging the above definitions into (4), the attacker achieves the
following equivalent problem

$\displaystyle\underset{\bm{\theta}}{\max}\sum_{k=1}^{K}\nu_{k}\left\|\mathbf{S}_{k}\bm{\theta}\right\|_{2}^{2},$
(6a) $\displaystyle\text{s.t.}\hskip 2.84526pt|[\bm{\theta}]_{n}|=1,\hskip
2.84526pt\forall n\in\\{1,\cdots,L\\}.$ (6b)

To simplify further the above optimization, the weighted sum in (6a) is
transformed into a matrix equivalent form by vertically concatenating each
term of the sum, as follows

$\displaystyle\underset{\bm{\theta}}{\max}\left\|\begin{bmatrix}\sqrt{\nu_{1}}\mathbf{S}_{1}\\\\[-5.69054pt]
\vdots\\\\[-2.84526pt]
\sqrt{\nu_{K}}\mathbf{S}_{K}\end{bmatrix}\bm{\theta}\right\|_{2}^{2},$ (7a)
$\displaystyle\text{s.t.}\hskip 2.84526pt|[\bm{\theta}]_{n}|=1,\hskip
2.84526pt\forall n\in\\{1,\cdots,L\\}.$ (7b)

The problem in (7) is non-convex due to the element-wise modulus constraint
and is, in general, NP-hard [12]. To overcome the challenge, we propose a
suboptimal but practical strategy utilizing a projected gradient-based
algorithm. The proposed strategy is presented in Algorithm 1, where $T$ is the
number of iterations, $\beta$ is a parameter used to tune the step size
$\alpha$, and $\lambda_{\text{max}}(\cdot)$ returns the largest eigenvalue of
its argument. As demonstrated in [12, Theorem 1], this algorithm converges to
a Karush-Kuhn-Tucker (KKT) point of the original problem as long as
$\alpha<1/\lambda^{*}$, with $\lambda^{*}$ denoting the largest eigenvalue of
$\mathbf{\bar{S}}^{H}\mathbf{\bar{S}}$, defined in line $1$ of Algorithm 1.

It should be noted that the solution to (7) represents a feasible attack that
may cause significant performance degradation to the users, as demonstrated in
our simulation results. However, it does not represent a system-wide optimal
RIS attack, for it does not assume that the attacker has access to important
parameters, such as BS precoders and BS-U channel matrices, which may be
difficult, if not impossible, to obtain by the attacker.

Input:
$T,\beta\in(0,1),\\{\nu_{1},\cdots,\nu_{K}\\},\\{\mathbf{S}_{1},\cdots,\mathbf{S}_{K}\\}$;

1

2Initialize:
$\mathbf{\bar{S}}=\begin{bmatrix}\sqrt{\nu_{1}}\mathbf{S}_{1}\\\\[-5.69054pt]
\vdots\\\\[-2.84526pt] \sqrt{\nu_{K}}\mathbf{S}_{K}\end{bmatrix}$,
$\bm{\theta}_{(1)}=\mathbf{I}_{L,1}$,
$\lambda^{\star}=\lambda_{\text{max}}\left(\mathbf{\bar{S}}^{H}\mathbf{\bar{S}}\right)$,
$\alpha=\frac{\beta}{\lambda^{\star}}$;

3

4for  _$t=1,2,\cdots,T-1$_ do

5 Compute the gradient of (7a):
$\bm{\delta}_{(t)}=\mathbf{\bar{S}}^{H}\left(\mathbf{\bar{S}}\bm{\theta}_{(t)}\right)$;

6

7 Perform the gradient step:
$\bm{\phi}_{(t+1)}=\bm{\theta}_{(t)}+\alpha\bm{\delta}_{(t)}$;

8

9 Compute the projection onto the unit 1-sphere:
$\bm{\theta}_{(t+1)}=e^{j\angle\left(\bm{\phi}_{(t+1)}\right)}$;

10

11 end for

Output: $\bm{\Theta}=\mathrm{diag}\\{\bm{\theta}_{(T)}\\}$.

12

jamming attacks in mMIMO systems

Algorithm 1 Malicious RIS optimization for multi-user

jamming attacks in mMIMO systems

##  IV Reception and Attack Mitigation

The BS precoders alone cannot cancel the attack by the RIS. This section
addresses this issue by proposing two detection strategies to be deployed on
the user side. In particular, we propose a two-layer reception strategy of the
form $\mathbf{Q}_{k}\mathbf{W}_{k}$, where $\mathbf{W}_{k}$ is responsible for
tackling the malicious RIS reflections and $\mathbf{Q}_{k}$ is a reception
matrix responsible for removing inter-symbol interference. Moreover, while the
CSI of the link BS-U is available to the network, we assume that only an
estimate of the cascade BS-RIS-U channel
$\mathbf{Z}_{k}^{H}\triangleq\mathbf{F}_{k}^{H}\bm{\Theta}\mathbf{G}$ can be
made available to the users222Advanced interference estimation techniques can
be employed in the users’ devices to estimate the cascade RIS channels.
However, this goes beyond the objectives of this work and arises as an
interesting research direction., which we model as follows

$\displaystyle\mathbf{\hat{Z}}_{k}\triangleq\sqrt{1-\tau^{2}}\mathbf{Z}_{k}+\tau\mathbf{E}_{k},$
(8)

where $\mathbf{E}_{k}$ is the error matrix, which is independent of
$\mathbf{Z}_{k}$ and whose entries follow the standard complex Gaussian
distribution, and $\tau\in[0,1]$ models the level of error between the
estimate $\mathbf{\hat{Z}}_{k}$ and the true channel $\mathbf{Z}_{k}$.

Figure 2: User average sum rate under different attack scenarios: (a) for user
1, (b) for user 2, and (c) for user 3, considering $N=4$ and $L=200$.

###  IV-A Full MITigation (F-MIT) of RIS attacks

By considering all RIS-reflected signals as interference, this first strategy
aims to fully mitigate the attack. To this end, let us define
$\mathbf{\tilde{P}}\triangleq[\mathbf{P}_{1}\hskip 2.84526pt\cdots\hskip
2.84526pt\mathbf{P}_{K}]\in\mathbb{C}^{M\times KS}$ and
$\mathbf{\tilde{x}}\triangleq[\mathbf{x}_{1}^{T}\hskip 2.84526pt\cdots\hskip
2.84526pt\mathbf{x}_{K}^{T}]^{T}\in\mathbb{C}^{KS}$. Then, (3) can be
rewritten as

$\displaystyle\mathbf{y}_{k}=\mathbf{H}_{k}^{H}\mathbf{P}_{k}\sqrt{P}\mathbf{x}_{k}+\mathbf{Z}_{k}^{H}\mathbf{\tilde{P}}\sqrt{P}\mathbf{\tilde{x}}+\mathbf{n}_{k}.$
(9)

Now, to mitigate the attack, the $k$th user needs an inner receptor
$\mathbf{W}_{k}$ that can achieve
$\mathbf{W}_{k}\mathbf{Z}_{k}^{H}\mathbf{\tilde{P}}\approx\mathbf{0}_{S,S}$.
Thus, $\mathbf{W}_{k}$ should lie in the left null space of the transformed
channel matrix
$\underline{\mathbf{Z}}_{k}\triangleq\mathbf{Z}_{k}^{H}\mathbf{\tilde{P}}\in\mathbb{C}^{N\times
KS}$. Since the perfect knowledge of $\mathbf{Z}_{k}$ is not possible, users
approximate the desired left null space from the left eigenvector matrix
$\mathbf{U}_{\underline{\mathbf{\hat{Z}}}_{k}}\in\mathbb{C}^{N\times N}$ of
the estimated channel
$\underline{\mathbf{\hat{Z}}}_{k}\triangleq\mathbf{\hat{Z}}_{k}^{H}\mathbf{\tilde{P}}\in\mathbb{C}^{N\times
KS}$. Note that, in addition to canceling interference, the matrix
$\mathbf{W}_{k}$, with dimension $W\times N$, should satisfy $N\geq W\geq S$
for $\mathbf{Q}_{k}$ to remove the inter-symbol interference. Provided that
$N>KS$ is satisfied, $\underline{\mathbf{\hat{Z}}}_{k}$ will have full column
rank and a left null space of dimension $N-KS$. As a result, the perfect
orthogonality with the estimated channel, i.e.,
$\mathbf{W}_{k}\underline{\mathbf{\hat{Z}}}_{k}=\mathbf{0}_{W,S}$, is achieved
if and only if $W\leq N-KS$, otherwise residual interference is left. With
these observations, $\mathbf{W}_{k}$ can be constructed from the last $W$ rows
of $\mathbf{U}^{H}_{\underline{\mathbf{\hat{Z}}}_{k}}$, as follows

$\displaystyle\mathbf{W}_{k}=\left[\mathbf{U}^{H}_{\underline{\mathbf{\hat{Z}}}_{k}}\right]_{\left(N-W+1\right):N,:}\in\mathbb{C}^{W\times
N},$ (10)

where we should satisfy $N>KS$ for the existence of a non-trivial left null
space. Moreover, we adjust $W=\max\\{N-KS,S\\}$, which satisfies the
requirement $W\geq S$.

Now, since the resulting effective channel
$\mathbf{W}_{k}\mathbf{H}_{k}^{H}\mathbf{P}_{k}$ is an $W\times S$ matrix,
with $S\leq W$, we can remove the inter-symbol interference by computing its
left inverse, as follows

$\displaystyle\mathbf{Q}_{k}=[(\mathbf{W}_{k}\mathbf{H}_{k}^{H}\mathbf{P}_{k})^{H}\mathbf{W}_{k}\mathbf{H}_{k}^{H}\mathbf{P}_{k}]^{-1}(\mathbf{W}_{k}\mathbf{H}_{k}^{H}\mathbf{P}_{k})^{H}.$
(11)

Then, after filtering the signal in (9) with (10) and (11), the $k$th user
detects the $s$th symbol with the following SINR

$\displaystyle\gamma_{k}^{s}$
$\displaystyle=\frac{P|[\mathbf{Q}_{k}\mathbf{W}_{k}\mathbf{H}_{k}^{H}\mathbf{P}_{k}\mathbf{x}_{k}]_{s}|^{2}}{P|[\mathbf{Q}_{k}\mathbf{W}_{k}\mathbf{Z}_{k}^{H}\mathbf{\tilde{P}}\mathbf{\tilde{x}}]_{s}|^{2}+\sigma^{2}[\mathbf{Q}_{k}\mathbf{Q}_{k}^{H}]_{ss}},$
(12)

where the rightmost term in the denominator follows from
$[\mathbf{Q}_{k}\mathbf{W}_{k}\mathbf{n}_{k}]_{s}|^{2}=\sigma^{2}[\mathbf{Q}_{k}\mathbf{W}_{k}\mathbf{W}_{k}^{H}\mathbf{Q}_{k}^{H}]_{ss}=\sigma^{2}[\mathbf{Q}_{k}\mathbf{Q}_{k}^{H}]_{ss}$,
given that $\mathbf{W}_{k}$ is a semi-unitary matrix, i.e.,
$\mathbf{W}_{k}\mathbf{W}^{H}_{k}=\mathbf{I}_{S}$.

###  IV-B Harnessing and MITigation (H-MIT) of RIS attacks

In this subsection, we propose a second approach that relaxes the
orthogonality constraint $W\leq N-SK$ that is demanded by the F-MIT strategy.
In this method, only unintended reflected streams are selected for mitigation.
As an added advantage, users can harness the RIS reflections to extract their
own symbols. To attain this objective, we define
$\mathbf{\tilde{P}}^{\star}\triangleq[\mathbf{P}_{1}\hskip
2.84526pt\cdots\hskip 2.84526pt\mathbf{P}_{k-1}\hskip
2.84526pt\mathbf{P}_{k+1}\hskip 2.84526pt\cdots\hskip
2.84526pt\mathbf{P}_{K}]\in\mathbb{C}^{M\times(K-1)S}$, and
$\mathbf{\tilde{x}}^{\star}\triangleq[\mathbf{x}_{1}^{T}\hskip
2.84526pt\cdots\hskip 2.84526pt\mathbf{x}_{k-1}^{T}\hskip
2.84526pt\mathbf{x}_{k+1}^{T}\cdots\hskip
2.84526pt\mathbf{x}_{K}^{T}]^{T}\in\mathbb{C}^{(K-1)S}$, which allow us to
rewrite the signal in (9) as

$\displaystyle\mathbf{y}_{k}=(\mathbf{H}_{k}^{H}+\mathbf{Z}_{k}^{H})\mathbf{P}_{k}\sqrt{P}\mathbf{x}_{k}+\mathbf{Z}_{k}^{H}\mathbf{\tilde{P}}^{\star}\sqrt{P}\mathbf{\tilde{x}}^{\star}+\mathbf{n}_{k}.$
(13)

Thus, we need to achieve
$\mathbf{W}_{k}\mathbf{Z}_{k}^{H}\mathbf{\tilde{P}}^{\star}\approx\mathbf{0}_{W,S},\forall
k\in\mathcal{K}$, which can be accomplished using a similar approach of that
employed for the F-MIT strategy. Specifically, let
$\underline{\mathbf{\hat{Z}}}^{\star}_{k}\triangleq\mathbf{\hat{Z}}_{k}^{H}\mathbf{\tilde{P}}^{\star}\in\mathbb{C}^{N\times(K-1)S}$
be the estimated transformed interference channel, and denote by
$\mathbf{U}_{\underline{\mathbf{\hat{Z}}}^{\star}_{k}}$ the associated left
eigenvector matrix obtained from the SVD of
$\underline{\mathbf{\hat{Z}}}^{\star}_{k}$. Then, $\mathbf{W}_{k}$ can be
obtained from the last $W$ rows of
$\mathbf{U}^{H}_{\underline{\mathbf{\hat{Z}}}^{\star}_{k}}$, as follows

$\displaystyle\mathbf{W}_{k}=\left[\mathbf{U}^{H}_{\underline{\mathbf{\hat{Z}}}^{\star}_{k}}\right]_{\left(N-W+1\right):N,:}\in\mathbb{C}^{S\times
N},$ (14)

with $W=\max\\{N-(K-1)S,S\\}$, where now we need $N>(K-1)S$ for achieving the
desired non-trivial left null space, and only $W\leq N-(K-1)S$ for the
orthogonality with the estimated selected interference channels.

By relying on the effectiveness of $\mathbf{W}_{k}$ to tackle
$\mathbf{Z}_{k}^{H}\mathbf{\tilde{P}}^{\star}\sqrt{P}\mathbf{\tilde{x}}$ in
(13), users address the remaining inter-symbol interference with the left
inverse of the resulting estimated projected channel
$\mathbf{W}_{k}(\mathbf{H}_{k}^{H}+\mathbf{\hat{Z}}_{k}^{H})\mathbf{P}_{k}\in\mathbb{C}^{W\times
S}$, which is given by

$\displaystyle\mathbf{Q}_{k}$
$\displaystyle=[(\mathbf{W}_{k}(\mathbf{H}_{k}^{H}+\mathbf{\hat{Z}}_{k}^{H})\mathbf{P}_{k})^{H}\mathbf{W}_{k}(\mathbf{H}_{k}^{H}+\mathbf{\hat{Z}}_{k}^{H})\mathbf{P}_{k}]^{-1}$
$\displaystyle\times(\mathbf{W}_{k}(\mathbf{H}_{k}^{H}+\mathbf{\hat{Z}}_{k}^{H})\mathbf{P}_{k})^{H}.$
(15)

Note in (IV-B) that the design of $\mathbf{Q}_{k}$ now depends on
$\mathbf{\hat{Z}}_{k}$. This implies that users might also experience inter-
symbol interference. By applying (IV-B) to the signal in (13), the $k$th user
recovers the $s$th symbol with the following SINR

$\displaystyle\gamma^{s}_{k}$
$\displaystyle=\frac{P|[\bm{\Xi}_{k}\mathbf{x}_{k}]_{s}|^{2}}{P|[\bm{\Upsilon}_{k}\mathbf{x}_{k}]_{s}|^{2}+P|[\mathbf{Q}_{k}\mathbf{W}_{k}\mathbf{Z}_{k}^{H}\mathbf{\tilde{P}}^{\star}\mathbf{\tilde{x}}^{\star}]_{s}|^{2}+\sigma^{2}[\mathbf{Q}_{k}\mathbf{Q}_{k}^{H}]_{ss}}.$
(16)

where
$\bm{\Xi}_{k}\triangleq\mathrm{diagm}\\{\mathbf{Q}_{k}\mathbf{W}_{k}(\mathbf{H}_{k}^{H}+\mathbf{Z}_{k}^{H})\mathbf{P}_{k}\\}$
is a diagonal matrix with the effective channel coefficients for intended
symbols, and
$\bm{\Upsilon}_{k}\triangleq\mathbf{Q}_{k}\mathbf{W}_{k}(\mathbf{H}_{k}^{H}+\mathbf{Z}_{k}^{H})\mathbf{P}_{k}-\bm{\Xi}_{k}$
is a hollow matrix with the coefficients for inter-symbol interference.

##  V Simulation Results

In this section, we report on the outcomes of Monte Carlo simulations. First,
we compare the user sum rates of a mMIMO system exposed to RIS attacks
leveraging random phase shifts, a.k.a. Disco Ball attacks [10, 11], and a
system under attacks launched by our malicious RIS scheme considering four
different threat scenarios. Subsequently, we compare the performance of a safe
mMIMO (free from threats) and a system under our optimized attack with and
without employing the proposed mitigation strategies, F-MIT and H-MIT.

Figure 3: System average sum rate (with $L=200$ and
$\nu_{1}=\nu_{2}=\nu_{3}=1/3$): (a) for $N=4$ and (b) for $N=8$ when $\tau=0$;
(c) for $N=4$ and (d) for $N=8$, considering different $x$-axis RIS positions
and a fixed $y$-axis coordinate of $20$ m, with $P=20$ dBm and $\tau=0$; (e)
for $N=4$ and (f) for $N=8$ with different values of $\tau$ and $P=20$ dBm.

In each case, the BS is equipped with a uniform linear array of $M=60$
antennas, and it communicates with $K=3$ multi-antenna users, such that $S=2$
parallel data symbols are transmitted for each user. Moreover, we assume that
the BS is located at the origin, whereas users $1,2$, and $3$ are located at
the coordinates $(20,0)$ m, $(20,40)$ m, and $(50,20)$ m, respectively. As for
the attacker, unless otherwise stated, its malicious RIS is strategically
deployed at the coordinate $(30,20)$ m. With this geometrical scenario, the
path-loss coefficients for the links BS-RIS, RIS-U, and BS-U are,
respectively, computed as $(d^{\text{\tiny BS-RIS}})^{-\eta}$,
$(d^{\text{\tiny RIS-U}}_{k})^{-\eta}$, and $(d^{\text{\tiny
BS-U}}_{k})^{-\eta}$, for $k\in\\{1,2,3\\}$, where $d^{\text{\tiny BS-RIS}}$,
$d_{k}^{\text{\tiny RIS-U}}$, and $d_{k}^{\text{\tiny BS-U}}$ are the
distances, and $\eta$ is the path-loss exponent set to $2.5$ for all links.
Regarding Algorithm 1, we set the step parameter to $\beta=0.99$ and the
number of iterations to $T=3\times 10^{3}$. Furthermore, we adjust the noise
variance to $\sigma^{2}=-40$ dBm and employ a uniform power allocation among
users and symbols, such that $\alpha_{k,1}=\cdots=\alpha_{k,S}=1$, $\forall
k\in\\{1,2,3\\}$.

Fig. 2 presents the user average sum rate curves, computed as
$R_{k}=\mathrm{E}\\{\sum^{S}_{s=1}\log_{2}(1+\gamma_{k}^{s})\\}$, which
informs the sum spectral efficiency for each user $k\in\\{1,2,3\\}$ under
different attack scenarios. These results validate the proposed malicious RIS
algorithm and demonstrate its efficiency and adaptability in executing
targeted attacks against a specific user. As can be seen, this capability
cannot be achieved with the Disco Ball attack. For instance, in Fig. 2(a),
user 1 can achieve a sum rate of $8.79$ bits/s/Hz when the transmit power is
$30$ dBm under the proposed RIS attack with equal weights (Attack 1). When the
attacker targets this user, i.e., $\nu_{1}=0.98$ in Attack 2, its sum rate
drops to only $6.41$ bits/s/Hz, a $2.38$ bits/s/Hz degradation compared to the
equal-weighted case and impressive $5.45$ bits/s/Hz compared to the Disco Ball
attack. Similar behavior can also be verified for the other users in Figs.
2(b) and 2(c), where the targeted attacks launched by our optimized scheme are
remarkably more powerful than the baseline counterpart.

Fig. 3 evaluates the system average sum rate, calculated as
$\bar{R}=\mathrm{E}\\{\sum^{K}_{k=1}\sum^{S}_{s=1}\log_{2}(1+\gamma_{k}^{s})\\}$.
Specifically, Figs. 3(a), 3(c), and 3(e) show that even when the constraints
of (10) and (14) cannot be met, i.e., when $N=4$, both F-MIT and H-MIT can
still provide significant performance gains over the case without mitigation,
as long as the transmit power is high enough. When $N=8$, the perfect
orthogonality with the estimated RIS channel can be achieved by both F-MIT and
H-MIT, removing the saturation on the sum rate curves, as shown in Fig. 3(b).
However, since these receptors also amplify the noise, attaining the same
performance as the safe system is impossible. Nonetheless, we can see that
recycling intended signals from the RIS-reflected signals is advantageous as
it enables the H-MIT receptor to significantly outperform the F-MIT
counterpart for $N=4$ and $N=8$. These performance gains are also reproduced
in the subsequent figures. In Figs. 3(c) and 3(d), the RIS is moved to
different positions along the $x$-axis direction, while keeping its $y$-axis
coordinate fixed at $20$ m. As can be seen, the closer the RIS is to the BS,
the stronger the performance degradation caused by the proposed attack. Last,
Figs. 3(e) and 3(f), present the system sum rates for the case when the
estimation of the RIS channels is imperfect, revealing that the H-MIT receptor
is beneficial even when the estimation error is high.

##  VI Conclusions

In this letter, we have shed light on a powerful adversarial attack that can
be launched with an optimized RIS against multiple users without requiring
their legitimate channels. Simulation results demonstrated the adaptability
and efficiency of the proposed RIS algorithm in significantly degrading the
sum rates of users, highlighting its superiority over the state-of-the-art
Disco Ball attack. This stresses the significance of developing
countermeasures to safeguard next-generation wireless systems from emerging
physical layer threats. In this regard, we proposed two defense mechanisms,
F-MIT and H-MIT, for countering such malicious RIS attacks. Both receptors
provided significant performance enhancements over unmitigated attack
scenarios, even when their null space constraints could not be satisfied.
Still, it is worth noting that users in low transmit power regimes may still
be affected by the attack, and additional research and appropriate mitigation
strategies are required to safeguard them. Our future work shall delve deeper
into estimation strategies for enabling this and related RIS attacks and
developing new robust mitigation strategies to counteract threats under
realistic CSI conditions.

## References

  * [1] B. Lyu, D. T. Hoang, S. Gong, D. Niyato, and D. I. Kim, “IRS-based wireless jamming attacks: When jammers can attack without power,” _IEEE Wireless Commun. Lett._ , vol. 9, no. 10, pp. 1663–1667, 2020.
  * [2] Y. Wang, H. Lu, D. Zhao, Y. Deng, and A. Nallanathan, “Wireless communication in the presence of illegal reconfigurable intelligent surface: Signal leakage and interference attack,” _IEEE Wireless Commun._ , vol. 29, no. 3, pp. 131–138, 2022.
  * [3] H. Chen and Y. Ghasempour, “Malicious mmWave reconfigurable surface: Eavesdropping through harmonic steering,” in _Proc. Int. Workshop on Mobile Computing Systems and Applications_ , 2022, pp. 54–60.
  * [4] Z. Lin, H. Niu, K. An, Y. Hu, D. Li, J. Wang, and N. Al-Dhahir, “Pain without gain: Destructive beamforming from a malicious RIS perspective in IoT networks,” _IEEE IoT J._ , pp. 1–1, 2023.
  * [5] H. Alakoca, M. Namdar, S. Aldirmaz-Colak, M. Basaran, A. Basgumus, L. Durak-Ata, and H. Yanikomeroglu, “Metasurface manipulation attacks: Potential security threats of RIS-aided 6G communications,” _IEEE Commun. Mag._ , vol. 61, no. 1, pp. 24–30, 2022.
  * [6] P. Staat, H. Elders-Boll, M. Heinrichs, C. Zenger, and C. Paar, “Mirror, mirror on the wall: Wireless environment reconfiguration attacks based on fast software-controlled surfaces,” in _Proc. Asia Conf. on Computer and Communications Security_ , 2022, p. 208–221.
  * [7] G. Li, L. Hu, P. Staat, H. Elders-Boll, C. Zenger, C. Paar, and A. Hu, “Reconfigurable intelligent surface for physical layer key generation: Constructive or destructive?” _IEEE Wireless Commun._ , vol. 29, no. 4, pp. 146–153, 2022.
  * [8] J. Yang, X. Ji, F. Wang, K. Huang, and L. Guo, “A novel pilot spoofing scheme via intelligent reflecting surface based on statistical CSI,” _IEEE Trans. Veh. Technol._ , vol. 70, no. 12, pp. 12 847–12 857, 2021.
  * [9] N. Wang, L. Jiao, A. Alipour-Fanid, M. Dabaghchian, and K. Zeng, “Pilot contamination attack detection for NOMA in 5G mm-wave massive MIMO networks,” _IEEE Trans. Inf. Forensics Secur._ , vol. 15, pp. 1363–1378, 2019.
  * [10] H. Huang, Y. Zhang, H. Zhang, C. Zhang, and Z. Han, “Illegal intelligent reflecting surface based active channel aging: When jammer can attack without power and CSI,” _IEEE IEEE Trans. Veh. Technol._ , 2023.
  * [11] H. Huang, Y. Zhang, H. Zhang, Y. Cai, A. L. Swindlehurst, and Z. Han, “Disco intelligent reflecting surfaces: Active channel aging for fully-passive jamming attacks,” _IEEE Trans. Wireless Commun._ , 2023.
  * [12] J. Tranter, N. D. Sidiropoulos, X. Fu, and A. Swami, “Fast unit-modulus least squares with applications in beamforming,” _IEEE Trans. Signal Process._ , vol. 65, no. 11, pp. 2875–2887, 2017.

  *[RIS]:
  *[mMIMO]:
  *[SDMA]:
  *[CSI]:
  *[BS]: