Multi-band Carrier Phase Positioning toward 6G: Performance Bounds and Efficient Estimators

In addition to satellite systems, carrier phase positioning (CPP) is gaining attraction also in terrestrial mobile networks, particularly in 5G New Radio evolution toward 6G. One key challenge is to resolve the integer ambiguity problem, as the carrier phase provides only relative position information. This work introduces and studies a multi-band CPP scenario with intra- and inter-band carrier aggregation (CA) opportunities across FR1, mmWave-FR2, and emerging 6G FR3 bands. Specifically, we derive multi-band CPP performance bounds, showcasing the superiority of multi-band CPP for high-precision localization in current and future mobile networks, while noting also practical imperfections such as clock offsets between the user equipment (UE) and the network as well as mutual clock imperfections between the network nodes. A wide collection of numerical results is provided, covering the impacts of the available carrier bandwidth, number of aggregated carriers, transmit power, and the number of network nodes or base stations. The offered results highlight that only two carriers suffice to substantially facilitate resolving the integer ambiguity problem while also largely enhancing the robustness of positioning against imperfections imposed by the network-side clocks and multi-path propagation. In addition, we also propose a two-stage practical estimator that achieves the derived bounds under all realistic bandwidth and transmit power conditions. Furthermore, we show that with an additional search-based refinement step, the proposed estimator becomes particularly suitable for narrowband Internet of Things applications operating efficiently even under narrow carrier bandwidths. Finally, both the derived bounds and the proposed estimators are extended to scenarios where the bands assigned to each base station are nonuniform or fully disjoint, enhancing the practical deployment flexibility.

Simultaneous Source Separation, Synchronization, Localization and Mapping for 6G Systems

Multipath-based simultaneous localization and mapping (MP-SLAM) is a promising approach for future 6G networks to jointly estimate the positions of transmitters and receivers together with the propagation environment. In cooperative MP-SLAM, information collected by multiple mobile terminals (MTs) is fused to enhance accuracy and robustness. Existing methods, however, typically assume perfectly synchronized base stations (BSs) and orthogonal transmission sequences, rendering inter-BS interference at the MTs negligible. In this work, we relax these assumptions and address simultaneous source separation, synchronization, and mapping. A relevant example arises in modern 5G systems, where BSs employ muting patterns to mitigate interference, yet localization performance still degrades. We propose a novel BS-dependent data association and synchronization bias model, integrated into a joint Bayesian framework and inferred via the sum-product algorithm on a factor graph. The impact of joint synchronization and source separation is analyzed under various system configurations. Compared with state-of-the-art cooperative MP-SLAM assuming orthogonal and synchronized BSs, our statistical analysis shows no significant performance degradation. The proposed BS-dependent data association model constitutes a principled approach for classifying features by arbitrary properties, such as reflection order or feature type (scatterers versus walls).

CSI-Based User Positioning, Channel Charting, and Device Classification with an NVIDIA 5G Testbed

Channel-state information (CSI)-based sensing will play a key role in future cellular systems. However, no CSI dataset has been published from a real-world 5G NR system that facilitates the development and validation of suitable sensing algorithms. To close this gap, we publish three real-world wideband multi-antenna multi-open RAN radio unit (O-RU) CSI datasets from the 5G NR uplink channel: an indoor lab/office room dataset, an outdoor campus courtyard dataset, and a device classification dataset with six commercial-off-the-shelf (COTS) user equipments (UEs). These datasets have been recorded using a software-defined 5G NR testbed based on NVIDIA Aerial RAN CoLab Over-the-Air (ARC-OTA) with COTS hardware, which we have deployed at ETH Zurich. We demonstrate the utility of these datasets for three CSI-based sensing tasks: neural UE positioning, channel charting in real-world coordinates, and closed-set device classification. For all these tasks, our results show high accuracy: neural UE positioning achieves 0.6cm (indoor) and 5.7cm (outdoor) mean absolute error, channel charting in real-world coordinates achieves 73cm mean absolute error (outdoor), and device classification achieves 99% (same day) and 95% (next day) accuracy. The CSI datasets, ground-truth UE position labels, CSI features, and simulation code are publicly available at https://caez.ethz.ch

Multimodal Wireless Foundation Models

Wireless foundation models (WFMs) have recently demonstrated promising capabilities, jointly performing multiple wireless functions and adapting effectively to new environments. However, while current WFMs process only one modality, depending on the task and operating conditions, the most informative modality changes and no single modality is best for all tasks. WFMs should therefore be designed to accept multiple modalities to enable a broader and more diverse range of tasks and scenarios. In this work, we propose and build the first multimodal wireless foundation model capable of processing both raw IQ streams and image-like wireless modalities (e.g., spectrograms and CSI) and performing multiple tasks across both. We introduce masked wireless modeling for the multimodal setting, a self-supervised objective and pretraining recipe that learns a joint representation from IQ streams and image-like wireless modalities. We evaluate the model on five tasks across both modality families: image-based (human activity sensing, RF signal classification, 5G NR positioning) and IQ-based (RF device fingerprinting, interference detection/classification). The multimodal WFM is competitive with single-modality WFMs, and in several cases surpasses their performance. Our results demonstrates the strong potential of developing multimodal WFMs that support diverse wireless tasks across different modalities. We believe this provides a concrete step toward both AI-native 6G and the vision of joint sensing, communication, and localization.

Design of Orthogonal Phase of Arrival Positioning Scheme Based on 5G PRS and Optimization of TOA Performance

This study analyzes the performance of positioning techniques based on configuration changes of 5G New Radio signals. In 5G networks, a terminal position is determined from the Time of Arrival of Positioning Reference Signals transmitted by base stations. We propose an algorithm that improves TOA accuracy under low sampling rate constraints and implement 5G PRS for positioning in a software defined modem. We also examine how flexible time frequency resource allocation of PRS affects TOA estimation accuracy and discuss optimal PRS configurations for a given signal environment.

Autonomous Sensing UAV for Accurate Multi-User Identification and Localization in Cellular Networks

This paper presents an autonomous sensing frame- work for identifying and localizing multiple users in Fifth Generation (5G) networks using an Unmanned Aerial Vehicle (UAV) that is not part of the serving access network. Unlike conventional aerial serving nodes, the proposed UAV operates passively and is dedicated solely to sensing. It captures Uplink (UL) Sounding Reference Signals (SRS), and requires virtually no coordination with the network infrastructure. A complete signal processing chain is proposed and developed, encompassing synchronization, user identification, and localization, all executed onboard UAV during flight. The system autonomously plans and adapts its mission workflow to estimate multiple user positions within a single deployment, integrating flight control with real-time sensing. Extensive simulations and a full-scale low- altitude experimental campaign validate the approach, showing localization errors below 3 m in rural field tests and below 8 m in urban simulation scenarios, while reliably identifying each user. The results confirm the feasibility of infrastructure-independent sensing UAVs as a core element of the emerging Low Altitude Economy (LAE), supporting situational awareness and rapid deployment in emergency or connectivity-limited environments.

Look Before Switch: Sensing-Assisted Handover in 5G NR V2I Networks

Integrated Sensing and Communication (ISAC) has emerged as a promising solution in addressing the challenges of high-mobility scenarios in 5G NR Vehicle-to-Infrastructure (V2I) communications. This paper proposes a novel sensing-assisted handover framework that leverages ISAC capabilities to enable precise beamforming and proactive handover decisions. Two sensing-enabled handover triggering algorithms are developed: a distance-based scheme that utilizes estimated spatial positioning, and a probability-based approach that predicts vehicle maneuvers using interacting multiple model extended Kalman filter (IMM-EKF) tracking. The proposed methods eliminate the need for uplink feedback and beam sweeping, thus significantly reducing signaling overhead and handover interruption time. A sensing-assisted NR frame structure and corresponding protocol design are also introduced to support rapid synchronization and access under vehicular mobility. Extensive link-level simulations using real-world map data demonstrate that the proposed framework reduces the average handover interruption time by over 50%, achieves lower handover rates, and enhances overall communication performance.

PUL-Inter-slice Defender: An Anomaly Detection Solution for Distributed Slice Mobility Attacks

Network Slices (NSs) are virtual networks operating over a shared physical infrastructure, each designed to meet specific application requirements while maintaining consistent Quality of Service (QoS). In Fifth Generation (5G) networks, User Equipment (UE) can connect to and seamlessly switch between multiple NSs to access diverse services. However, this flexibility, known as Inter-Slice Switching (ISS), introduces a potential vulnerability that can be exploited to launch Distributed Slice Mobility (DSM) attacks, a form of Distributed Denial of Service (DDoS) attack. To secure 5G networks and their NSs against DSM attacks, we present in this work, PUL-Inter-Slice Defender; an anomaly detection solution that leverages Positive Unlabeled Learning (PUL) and incorporates a combination of Long Short-Term Memory Autoencoders and K-Means clustering. PUL-Inter-Slice Defender leverages the Third Generation Partnership Project (3GPP) key performance indicators and performance measurement counters as features for its machine learning models to detect DSM attack variants while maintaining robustness in the presence of contaminated training data. When evaluated on data collected from our 5G testbed based on the open-source free5GC and UERANSIM, a UE/ Radio Access Network (RAN) simulator; PUL-Inter-Slice Defender achieved F1-scores exceeding 98.50% on training datasets with 10% to 40% attack contamination, consistently outperforming its counterpart Inter-Slice Defender and other PUL based solutions combining One-Class Support Vector Machine (OCSVM) with Random Forest and XGBoost.

Failure Tolerant Phase-Only Indoor Positioning via Deep Learning

High-precision localization turns into a crucial added value and asset for next-generation wireless systems. Carrier phase positioning (CPP) enables sub-meter to centimeter-level accuracy and is gaining interest in 5G-Advanced standardization. While CPP typically complements time-of-arrival (ToA) measurements, recent literature has introduced a phase-only positioning approach in a distributed antenna/MIMO system context with minimal bandwidth requirements, using deep learning (DL) when operating under ideal hardware assumptions. In more practical scenarios, however, antenna failures can largely degrade the performance. In this paper, we address the challenging phase-only positioning task, and propose a new DL-based localization approach harnessing the so-called hyperbola intersection principle, clearly outperforming the previous methods. Additionally, we consider and propose a processing and learning mechanism that is robust to antenna element failures. Our results show that the proposed DL model achieves robust and accurate positioning despite antenna impairments, demonstrating the viability of data-driven, impairment-tolerant phase-only positioning mechanisms. Comprehensive set of numerical results demonstrates large improvements in localization accuracy against the prior art methods.

MULTI-SCOUT: Multistatic Integrated Sensing and Communications in 5G and Beyond for Moving Target Detection, Positioning, and Tracking

This paper presents a complete signal-processing chain for multistatic integrated sensing and communications (ISAC) using 5G Positioning Reference Signal (PRS). We consider a distributed architecture in which one gNB transmits a periodic OFDM-PRS waveform while multiple spatially separated receivers exploit the same signal for target detection, parameter estimation and tracking. A coherent cross-ambiguity function (CAF) is evaluated to form a range-Doppler map from which the bistatic delay and radial velocity are extracted for every target. For a single target, the resulting bistatic delays are fused through nonlinear least-squares trilateration, yielding a geometric position estimate, and a regularized linear inversion of the radial-speed equations yields a two-dimensional velocity vector, where speed and heading are obtained. The approach is applied to 2D and 3D settings, extended to account for time synchronization bias, and generalized to multiple targets by resolving target association. The sequence of position-velocity estimates is then fed to standard and extended Kalman filters to obtain smoothed tracks. Our results show high-fidelity moving-target detection, positioning, and tracking using 5G PRS signals for multistatic ISAC.