# Assessing Spoofing Impact on GNSS Receivers : Carrier-to-Noise density Ratio (C/N0) Estimation

Emile Ghizzo, Julien Lesouple, Carl Milner

► To cite this version:

Emile Ghizzo, Julien Lesouple, Carl Milner. Assessing Spoofing Impact on GNSS Receivers: Carrier-to-Noise density Ratio (C/N0) Estimation. Signal Processing, 2026, 241, pp.110389. 10.1016/j.sigpro.2025.110389. hal-05367267

HAL Id: hal-05367267

https://hal.science/hal-05367267v1

Submitted on 15 Nov 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Assessing Spoofing Impact on GNSS Receivers : Carrier-to-Noise density Ratio (C/N₀)
Estimation

Emile GHIZZOᵃ,*, Julien LESOUPLEª, Carl MILNERª

ªFédération ENAC ISAE-SUPAERO ONERA, Université de Toulouse, 7 Avenue Édouard Belin, 31400, Toulouse, France

## Abstract

In the context of GNSS signal processing, the carrier-to-noise density ratio (C/N₀) is a powerful metric for evaluating GNSS performance, analyzing interference effects, and monitoring reception quality. Although the modeling of C/N₀ in the presence of interference has been extensively discussed in the literature, the specific impact of spoofing remains unexplored. In fact, due to the similar structure between authentic and spoofed signals, the latter directly interferes with the true signal and cannot be considered as an equivalent additional and independent noise source. This paper investigates the impact of spoofing on both true and estimated C/N₀ and proposes analytical expressions for their biases in the presence of spoofing. It reveals situations where the correlator output becomes non-ergodic, inducing divergence between the true and estimated values, as well as significant C/N₀ degradation. Additionally, there is a high dependence on the receiver architecture (estimation method) and spoofing geometry. Finally, beyond GNSS spoofing applications, this study highlights the effect of non-ergodicity on estimation and underscores the importance of studying estimation under non-ergodic conditions.

**Keywords:** GNSS Spoofing, Power, Carrier-to-noise density ratio, Estimation, Ergodicity

## 1. Introduction

Global Navigation Satellite Systems (GNSS) have become indispensable for precise positioning, navigation and time synchronization. GNSS technology is widely used in terrestrial, aerial, and maritime navigation, as well as for timing in critical infrastructure and automated processes. However, this widespread dependence on GNSS introduces vulnerabilities that, if maliciously exploited, can lead to significant consequences. Among these threats, spoofing is particularly insidious [1].

A GNSS spoofer is a device that generates or retransmits counterfeit GNSS signals, capable of deceiving a receiver and inducing erroneous Position, Velocity, and Time (PVT) solutions. Spoofers are typically categorized based on their level of sophistication [2]. Depending on this level of sophistication, the received spoofing signal may be synchronized or unsynchronized in time, frequency, and phase with the authentic signals. Additionally, the spoofer can transmit either a duplicate or a modified version of the navigation message. However, as shown in [3], regardless of the spoofer's sophistication, its impact at the correlator output can be classified into four situations: nominal, induced-jamming, induced-spoofing, and induced-multipath, as briefly outlined in this paper.

The Carrier-to-Noise Density ratio (C/N₀) is a normalized version of the Signal-to-Noise Power Ratio (SNR), representing a useful metric for evaluating GNSS signal processing performance (e.g., acquisition, tracking, and data demodulation) [4].

Additionally, the C/N₀ estimate is used to monitor tracking quality at the synchronization level and optionally to weight the pseudorange measurements at the navigation level [5]. Lastly, the C/N₀ is also a powerful tool for Radio Frequency Interference (RFI) detection. For instance, in the specific case of spoofing detection, [6, 7] exploit the variation of the signal's C/N₀ to detect spoofing, while in [8, 9, 10], the C/N₀ is coupled with Automatic Gain Control (AGC) to detect and classify jamming and spoofing interferences. [11] leverages the measured narrow-to-wide power ratio to detect pseudolite interference. More recently, methods with machine learning have been proposed to leverage C/N₀. For example, [12] proposed a decision tree-based strategy, [13, 14] a Support Vector Machine (SVM)-based strategy, and [15] a deep learning approach. Consequently, the characterization of the C/N₀ under spoofing would not only enable the prediction of spoofing's impact on the receiver but also improve detection techniques based on C/N₀.

In GNSS receivers, the C/N₀ is typically estimated at the correlator output (equivalent to the matched filter in the communication field) over a fixed estimation duration. Numerous estimation methods have been proposed in the literature, such as Narrowband-Wideband Power Ratio (NWPR) [16, p. 391], the Moment Method (MM), and Squared Signal-to-Noise Variance (SNV) [17]. Additionally, Beaulieu proposes several intuitive estimation methods in [18]. These estimators are designed for Gaussian and ergodic signals (i.e., the random and time statistics of the signal are equivalent). Finally, the C/N₀ estimation methods are shown to be unbiased within their nominal operational range, i.e., for an estimation interval sufficiently long and

<footnote>*Corresponding author
Email address: emile.ghizzo@alumni.enac.fr (Emile GHIZZO)</footnote>
a true $C/N_0$ sufficiently high ($C/N_0 > 30$ dB·Hz) [19, 20].

The impact of Radio Frequency Interference (RFI) on $C/N_0$ is a key topic in the GNSS community. Initially, [4] introduced the impact of band-limited RFI as an equivalent noise density. This model has been applied to specific types of interference to model $C/N_0$ degradation. For example, [21] analyzes the impact of continuous wave (CW) and pulse interference on effective $C/N_0$, while the effective $C/N_0$ under narrowband interference is studied in [22]. Furthermore, the effective $C/N_0$ in the presence of multiple pulsed interferences, considering signal blanking, is analyzed in [23]. [24] studies the impact of meaconing interference on $C/N_0$ estimation. Finally, the effect of the non-stationarity of chirp interference is studied in [25]. Regarding spoofing, the interference has been mainly studied through collected data [26, 9, 27], focusing on peak power [9] or re-radiated noise distortions [27]. However, to the best of the author's knowledge, the most threatening impact of spoofing on $C/N_0$ estimation has not been fully characterized. In fact, as highlighted in this paper, the signal power at the correlator output reflects a combination of both authentic and spoofed signals, so the main effect of spoofing on $C/N_0$ estimation may not arise from an increase in the noise floor, as is typically the case with other interferences, but rather from a distortion of the ergodicity of the received signal. This breakdown of ergodic properties leads to divergence between the true and estimated $C/N_0$, as well as high distortion and estimation method dependence. Non-ergodic distortions in signal processing have also been observed, for example, in [28, 29, 30].

This paper investigates the impact of spoofing on $C/N_0$. It first expresses the correlator output model under spoofing, considering both GNSS signals, AWGN, and inter-system interference. Due to the non-ergodic properties of the correlator over the estimation interval, the random-averaged and time-averaged properties of the signal differ, leading to several possible definitions of $C/N_0$. To understand and characterize the $C/N_0$ under non-ergodic conditions, we propose using the probabilistic framework previously introduced in [31] to define and express the different definitions of true $C/N_0$ and characterize the estimated $C/N_0$. In this work, three estimators are evaluated: the MM, NWPR, and Beaulieu estimators. The true and estimated $C/N_0$ values are analyzed according to the classification of spoofing impact proposed in [3].

The paper is organized as follows: Sec. 2 introduces the essential concepts of the probabilistic framework to understand the paper. Sec. 3 presents the signal model before and after correlation and introduces the classification of spoofing impacts at the correlator output used in this paper. Sec. 4 expresses the true $C/N_0$ under spoofing, and Sec. 5 discusses the estimated $C/N_0$. Finally, Sec. 6 presents a simulation to evaluate and observe the proposed models.

## 2. Preliminary - Probabilistic framework for non-ergodic signal

In signal analysis, especially within the context of communications and signal processing, most estimation techniques assume the ergodicity of a signal to compute its random param-

eters over one of its time realizations. For example, time averages, mean power, or energy measurements, as well as techniques like the periodogram for estimating the power spectral density (PSD) or histograms for estimating the probability density function (PDF) of signal values [32].

Ergodicity expresses the idea that a time-dependent signal, either a dynamical system or a stochastic process, will eventually visit all parts of its space of definition in a dynamic and random sense [33]. In other words, the statistical properties of a stochastic process can be represented by a sufficiently large collection of random samples. This concept has been formalized in the context of estimation theory. [34, p. 14] introduces the N-th order ergodicity as the mean square convergence (or sometimes probability convergence) of the N-th order time average toward its statistical value. Additionally, the definition is generalized to any function of the observation vector (referred to as an estimator in the statistics field) in [32, chap. 12] (e.g., mean-ergodic, distribution-ergodic, and spectrum-ergodic processes).

While the time average, time-based distribution, and time-average power are defined to be equal to their statistical representation under ergodic conditions, the definition of these variables has not been established for non-ergodic processes. To address this, [31] introduced a formal definition of the random- and time-based representations of a stochastic process in order to compute and interpret the time-based statistics of this signal under non-ergodic conditions. This section introduces the essential components of this framework for this paper.

### 2.1. Framework formulation

Consider a stochastic process $s: I_t \times I_\Omega \to I_s$, where $I_t \subset \mathbb{R}$ is a bounded interval, $I_\Omega$ is the set of all possible random events, and $I_s \subseteq \mathbb{C}$ is the set of values of $s$.

**Definition 1 (Random-event space).** [31] Let $(I_\Omega, \mathcal{E}_\Omega, \mathbb{P}_\Omega)$ be a probability space on $I_\Omega$ with $\sigma$-algebra $\mathcal{E}_\Omega$ (i.e., the collection of all possible events) and probability measure $\mathbb{P}_\Omega: \mathcal{E}_\Omega \to [0, 1]$. The triplet $(I_\Omega, \mathcal{E}_\Omega, \mathbb{P}_\Omega)$ is the probability space associated with the random realization of the signal $s$. The expectation associated with $(I_\Omega, \mathcal{E}_\Omega, \mathbb{P}_\Omega)$ is denoted $\mathbb{E}_{\mathbb{P}_\Omega}[\cdot] = \int_{I_\Omega} \cdot d\mathbb{P}_\Omega$ and is referred to as the random-averaged expectation.

**Definition 2 (Time-event space).** [31] Let $(I_t, \mathcal{E}_t, \mathbb{P}_t)$ be a measure space on the bounded time interval $I_t \subset \mathbb{R}$, with $\sigma$-algebra $\mathcal{E}_t$ and probability measure $\mathbb{P}_t: \mathcal{E}_t \to [0, 1]$ defined for all $E \in \mathcal{E}_t$ as

$$ \mathbb{P}_t(E) = \frac{1}{T} \int_{t \in E} dt \quad \text{with} \quad T = \int_{t \in I_t} dt. \qquad (1) $$

The triplet $(I_t, \mathcal{E}_t, \mathbb{P}_t)$ defines a probability space associated with the time interval $I_t$, referred to as the time-event space, and it defines the time realization of the signal $s$. The expectation associated with $(I_t, \mathcal{E}_t, \mathbb{P}_t)$ is defined as

$$ \mathbb{E}_t[\cdot] = \int_{I_t} \cdot d\mathbb{P}_t = \frac{1}{T} \int_{I_t} \cdot dt, \qquad (2) $$

and is referred to as the time-averaged expectation.
**Remark.** The definition 2 is applicable to a discrete bounded time interval $I'_t = [k_0, k_0 + M]$ with its associated probability space $(I'_t, \mathcal{E}'_t, \mathbb{P}'_t)$. In this case, the associated measure $\mathbb{P}'_t : \mathcal{E}'_t \to [0, 1]$ can be defined with the counting measure for all $E \in \mathcal{E}'_t$ as

$$ \mathbb{P}'_t(E) = \frac{1}{M} \sum_{t \in E} 1 \quad \text{with } M = \sum_{t \in I'_t} 1. \qquad (3) $$

The time-averaged expectation becomes $\mathbb{E}_t[\cdot] = \frac{1}{M} \sum_{t \in I'_t}(\cdot)$.

The triplets $(I_\Omega, \mathcal{E}_\Omega, \mathbb{P}_\Omega)$ and $(I_t, \mathcal{E}_t, \mathbb{P}_t)$ define two probability spaces to analyze both the time and random realizations of the signal. The results in [31] can be extended by considering the product space associated with the total sample space of $s, I_t \times I_\Omega$.

**Definition 3 (Total-event space).** Let $(I, \mathcal{E})$ be the product space associated with the Cartesian product $I = I_\Omega \times I_t$, where $\mathcal{E}$ is the product sigma-algebra, generated by the collection of all measurable rectangles such that

$$ \mathcal{E} = \sigma(\{E_t \times E_\Omega : E_t \in \mathcal{E}_t, E_\Omega \in \mathcal{E}_\Omega\}), \qquad (4) $$

and $\mathbb{P}$ is the product measure on $(I, \mathcal{E})$ (the unique measure which satisfies $\mathbb{P}(E_t \times E_\Omega) = \mathbb{P}_t(E_t) \mathbb{P}_\Omega(E_\Omega)$, $\forall E_t \in \mathcal{E}_t, E_\Omega \in \mathcal{E}_\Omega$) [35, Chap. 7]. The triplet $(I, \mathcal{E}, \mathbb{P})$ is a probability space, referred to as the total-event space, and characterizes the total domain of the signal's definition. We denote $\mathbb{E}[\cdot] = \int_{I_t} \cdot d\mathbb{P}$ as the expectancy associated with the total-event space.

**Property 1.** Let $(I_r, \mathcal{A}, \mu)$ be a measure space on the interval $I_r \subset \mathbb{R}$ with $\sigma$-algebra $\mathcal{A}$ and measure $\mu$. The signal $s$ can be seen as a random variable (r.v.) from $I \to I_r$. The signal $s$, evaluated at a fixed time or random realization $t_0 \in I_t$ or $\omega_0 \in I_\Omega$, can be observed through the conditional random variables $s | \{t_0\}$ and $s | \{\omega_0\}$.

In this paper, we adopt the notation $s$ for the r.v. and $s(t, \omega)$ for its specific realization. In addition, when $s$ is parameterized by $\theta$, we denote the r.v. $s(\theta)$ and its specific realization $s(t, \omega; \theta)$.

**Property 2.** Let $s: I_t \times I_\Omega \to I_r$ be a signal. Then,

$$ \mathbb{E}[s] = \mathbb{E}_t[\mathbb{E}_\Omega[s]] = \mathbb{E}_\Omega[\mathbb{E}_t[s]]. \qquad (5) $$

**PROOF.** Use Fubini's theorem.

**Property 3.** Let $s: I_t \times I_\Omega \to I_r$ be a signal. Then, for any $t_0 \in I_t$ or $\omega_0 \in I_\Omega$,

$$ \mathbb{E}[s | \{\omega_0\}] = \mathbb{E}_t[s | \{\omega_0\}], \quad \mathbb{E}[s | \{t_0\}] = \mathbb{E}_\Omega[s | \{t_0\}]. \qquad (6) $$

**PROOF.** Use Property 2 and the fact that $\mathbb{E}_\Omega[s | \{\omega_0\}] = s | \{\omega_0\}$.

**Remark.** The conditional expectation $\mathbb{E}_t[s | \{\omega_0\}]$ (resp. $\mathbb{E}_\Omega[s | \{t_0\}]$) is a function of $\omega_0$ (resp. $t_0$), and can be interpreted as the projection of the signal $s$ onto the random (resp. time) dimension.

## 2.2. Formal Power Definitions

In this section, we assume that $s$ has a finite second-order total-averaged moment. We define the instantaneous power of the signal $s$ as $p: I_t \times I_\Omega \to \mathbb{R}_+$,

$$ p = |s|^2 \qquad (7) $$

The instantaneous power is thus also a random variable taking values in $\mathbb{R}_+$. Depending on which event space is considered, different definitions of the averaged power can be defined.

**Definition 4 (Random-Averaged Power).** [31] The random-averaged power represents the expected value of the instantaneous power over the random realizations of the signal, defined for any temporal realization $t_0 \in I_t$ as

$$ P(t_0) = \mathbb{E}[p | \{t_0\}] = \mathbb{E}_\Omega [|s|^2 | \{t_0\}|]. \qquad (8) $$

**Definition 5 (Time-Averaged Power).** [31] The time-averaged power represents the expected value of the instantaneous power over the time realization of the signal, defined for any realization $\omega_0 \in I_\Omega$ as

$$ P(\omega_0) = \mathbb{E}[p | \{\omega_0\}] = \mathbb{E}_t [|s|^2 | \{\omega_0\}|]. \qquad (9) $$

**Definition 6 (Total-Averaged Power).** [31] The total-averaged power represents the expected value of the instantaneous power over both the time and random realizations, defined as

$$ P = \mathbb{E}[p] = \mathbb{E}_t[\mathbb{E}_\Omega [|s|^2|}] = \mathbb{E}_\Omega[\mathbb{E}_t [|s|^2|]]. \qquad (10) $$

**Remark.** It is worth noting that the random-averaged power depends on the time parameter $t_0 \in I_t$ and is thus a time-based r.v. Similarly, the time-averaged power depends on $\omega_0 \in I_\Omega$ and is therefore a random-based r.v. Finally, the total-averaged power is a scalar.

# 3. Signal model

This section presents the correlator output model (i.e., the signal on which the $C/N_0$ is calculated) under spoofing, and briefly introduces the classification of the spoofing impact post-correlation as outlined in [3], which is used in this paper.

## 3.1. Signal dynamics

Throughout this paper, $\eta_i = [\tau_i, \theta_i, f_i]^\mathrm{T}$ denotes the dynamic parameters of the GNSS signal $s_i$ received from transmitter $i$, which include the code delay, carrier phase, and carrier frequency. The received (instantaneous) power is represented by $C_i$. The channel parameters are gathered in $v_i = [\eta_i^\mathrm{T}, C_i]^\mathrm{T}$.

Considering a particular PRN, two transmitters are taken into account: the authentic satellite and the spoofer. The dynamic parameters and received power of the authentic signal are denoted as $\eta_a = [\tau_a, \theta_a, f_a]^\mathrm{T}$ and $v_a = [\eta_a^\mathrm{T}, C_a]^\mathrm{T}$, respectively. Similarly, the dynamic parameters and received power of the spoofing signal are given by $\eta_s = [\tau_s, \theta_s, f_s]^\mathrm{T}$ and $v_s = [\eta_s^\mathrm{T}, C_s]^\mathrm{T}$. In addition, the relative dynamics between the authentic and
spoofing signals are defined as $\Delta\eta = \eta_s - \eta_a = [\Delta\tau, \Delta\theta, \Delta f]^T$, while the relative power is expressed as $\Delta g = C_s/C_a$. These relative parameters are gathered in $\Delta\mathbf{v} = [\Delta\eta^T, \Delta g]^T$. All parameters are continuous and time-varying. It is important to note that the carrier phase and carrier frequency are related by

$$f_i = \frac{1}{2\pi} \frac{d\theta_i}{dt}, \quad f_a = \frac{1}{2\pi} \frac{d\theta_a}{dt}, \quad f_s = \frac{1}{2\pi} \frac{d\theta_s}{dt}, \quad \Delta f = \frac{1}{2\pi} \frac{d\Delta\theta}{dt}. \qquad (11)$$

## 3.2. Received signal model

The received signal in the presence of spoofing is modeled at the RF Front-End (RFFE) by its complex baseband representation as [3, 36]

$$r(t) = \sqrt{C_a} s_a(t - \tau_a) e^{j\theta_a} + \sqrt{C_s} s_s(t - \tau_s) e^{j\theta_s} \\ + \sum_{i \in \mathcal{M}} \sqrt{C_i} s_i(t - \tau_i) e^{j\theta_i} + n(t) \qquad (12)$$

where $s_a(t) = d_a(t) \{c * h_{RF}\}(t)$ and $s_s(t) = d_s(t) \{c * h_{RF}\}(t)$ are the authentic and spoofed GNSS signals of the PRN of interest (i.e., the PRN tracked by the channel), with $d_a$ and $d_s$ representing their respective navigation messages or secondary codes, c being the signal modulated spreading sequence, $h_{RF}$ the RFFE equivalent filter impulse response, and $\mathbf{v}_a$ and $\mathbf{v}_s$ their respective time-varying channel parameters as defined in Sec. 3.1. In contrast, $\mathcal{M}$ denotes the set of all received GNSS signals (both authentic and spoofed) that are not tracked by the channel. For $i \in \mathcal{M}$, $s_i$ is the GNSS signal, $C_i$ is the received power, and $\mathbf{v}_i$ represents the channel parameters of the i-th signal. Finally, n represents the Additive White Gaussian Noise (AWGN) process after RFFE filtering, modeled as a complex circular Gaussian process, with a Power Spectrum Density (PSD) given by [3]

$$G_n(f) = |H_{RF}(f)|^2 (1 + \Delta N)N_0 \qquad (13)$$

where $H_{RF}(f)$ is the RFFE equivalent filter transfer function (with impulse response $h_{RF}$), and $N_0$ is the nominal AWGN PSD. The spoofer can potentially re-radiate additional noise (considered as AWGN at the receiver antenna), which is modeled by the relative noise density $\Delta N$.

The sum on the right-hand side of (12) defines the GNSS inter-system interference, i.e., the interference induced by all non-tracked GNSS signals (both authentic and spoofing), and is denoted as $\chi(t)$. Assuming a sufficient number of signals, this sum converges in law toward a time-based random variable [31, Property 9]. In practice, this assumption becomes reasonable for at least 5 signals [31]. The PSD of the inter-system interference can be expressed using the results derived for the nominal situation in [37] as

$$G_{\chi}(f) = |H_{RF}(f)|^2 \sum_{i \in \mathcal{G}} C_{\chi,i} (1 + \overline{\Delta g_i}) G_i(f) \qquad (14)$$

where $\mathcal{G}$ represents the set of GNSS constellations (signals with similar PSD shape). For each group $i \in \mathcal{G}$, $G_i(f)$ is the normalized power spectrum of the aggregate signals, $C_{\chi,i}$ is the total power of the authentic aggregated signals, and $\overline{\Delta g_i}$ represents the relative power between the spoofing and authentic signals. Examples of $G_i(f)$ can be found in [37].

## 3.3. Correlator model

In a GNSS receiver, the $C/N_0$ is estimated at the correlator output, i.e., after correlating the received signal $r(t)$ with a local replica of the GNSS signal $c$ shifted in code and phase. For a prompt correlator, this is expressed as

$$\Lambda(k, \hat{\eta}) = \frac{1}{T_i} \int_{k T_i}^{(k+1)T_i} r(t) c^*(t - \hat{\tau}) e^{-2j\pi(t-kT_i - T_i/2)\hat{f} - j\hat{\theta}} dt. \qquad (15)$$

where * denotes the complex conjugate, $T_i$ is the integration time, and $\hat{\eta}[k] = [\hat{\tau}[k], \hat{\theta}[k], \hat{f}[k]]^T$ represents the code, phase, and frequency estimated parameters at epoch $k$ (tracking loops). Note that the replica $c$ depends on the PRN.

Considering the sampling induced by the correlator, we denote $\mathbf{v}[k]$ as the dynamic parameters evaluated at the midpoint of the k-th integration interval $[kT_i, (k+1)T_i]$, which is defined as $\mathbf{v}[k] = \mathbf{v}((k+0.5)T_i)$, where $\mathbf{v} \in \{\mathbf{v}_a, \mathbf{v}_s, \Delta\mathbf{v}\}$.

Finally, we define the nominal tracking error $\varepsilon_\eta[k]$ as the difference between the authentic parameters $\eta_a[k]$ and the estimated parameters $\hat{\eta}[k]$ at epoch $k$, such that

$$\varepsilon_{\eta}[k] \stackrel{\Delta}{=} \eta_{a}[k] - \hat{\eta}[k] = [\varepsilon_{\tau}[k], \varepsilon_{\theta}[k], \varepsilon_{f}[k]]^{\mathrm{T}} \qquad (16)$$

where $\varepsilon_\tau$, $\varepsilon_\theta$, and $\varepsilon_f$ represent the code, phase, and frequency nominal tracking errors, respectively. For clarity, the parameter $k$ will be omitted in the rest of the article when not necessary.

## 3.4. Correlator output under spoofing

The model of the correlator output under spoofing is obtained by substituting (12) into (15). Its derivation is detailed in Appendix A, leading to

$$\Lambda(\varepsilon_{\eta}, \Delta\mathbf{v}) = \Lambda_a(\varepsilon_{\eta}) + \sqrt{\Delta g} \Lambda_a(\varepsilon_{\eta} + \Delta\hat{\eta}) + \Lambda_{\chi} + \Lambda_n \qquad (17)$$

where $\Lambda_a(\varepsilon_\eta)$ and $\sqrt{\Delta g}\Lambda_a(\varepsilon_\eta + \Delta\hat{\eta})$ represent the authentic and spoofing GNSS peaks, respectively, while $\Lambda_\chi$ and $\Lambda_n$ correspond to the inter-system interference and the AWGN contributions at the correlator output. These four terms are detailed below.

* The GNSS peak $\Lambda_a$ model is derived in Appendix A.2 for both authentic and spoofing signals, using the probabilistic framework. This derivation assumes no bit transitions and constant parameters $\tau_i$, $f_i$, and $C_i$ (resulting in a linear phase $\theta_i$) within the integration interval $[kT_i, (k+1)T_i]$. Under these assumptions, the GNSS peak is expressed as

$$\Lambda_a(\varepsilon_\eta) = \sqrt{C_a} d \zeta_\tau(\varepsilon_\tau) \zeta_f(\varepsilon_f) e^{j\varepsilon_\theta}. \qquad (18)$$

Here, $d \in \{-1, 1\}$ is the navigation message or secondary code bit, and $\zeta_\tau$ and $\zeta_f$ are the code and frequency synchronization functions, respectively, defined as

$$\zeta_{\tau}(\varepsilon_{\tau}) \stackrel{\Delta}{=} \int_{-B/2}^{B/2} G_{c}(f) e^{j2\pi f \varepsilon_{\tau}} df, \quad \zeta_{f}(\varepsilon_{f}) \stackrel{\Delta}{=} \text{sinc}(\pi \varepsilon_{f} T_{i}) \qquad (19)$$

where $G_c$ represents the power-normalized PSD of the local replica (explicitly given in (A.2)). The synchronization functions are real and odd functions. We define the total synchronization mismatch function as $\zeta(\varepsilon_\eta) = \zeta_\tau(\varepsilon_\tau) \zeta_f(\varepsilon_f)$.
* The inter-system contribution $\Lambda_{\gamma}$ follows a circular complex Gaussian distribution. Its PSD is derived in Appendix A.5 as

$$G_{\Lambda,\chi}(f) = \frac{1}{T_i} |H_{\text{RF}}(f)|^2 \sum_{i \in \mathcal{G}} C_{\chi,i} (1 + \overline{\Delta g_i}) G_i(f) G_c(f). \quad (20)$$

The power (for all definitions) of the interference is obtained by integrating $G_{\Lambda,\chi}$ over $\mathbb{R}$, yielding

$$P_{\chi} = \frac{\zeta_{\tau}(0)}{T_i} \sum_{i \in \mathcal{G}} (1 + \overline{\Delta g_i}) C_{\chi,i} \tilde{\kappa}_i, \quad (21)$$

where $\zeta_{\tau}(0)$ is defined in (19), and $\tilde{\kappa}_i$ is the normalized Spectral Separation Coefficient (SSC), given by $\tilde{\kappa}_i = \int G_i(f) G_c(f) df / \zeta_{\tau}(0)$. Numerical values of the SSC for each GNSS constellation are provided in [37].

* The AWGN contribution $\Lambda_n$ follows a circular complex Gaussian distribution. Its PSD, derived in Appendix A.5, is given by

$$G_{\Lambda,n}(f) = \frac{1}{T_i} |H_{\text{RF}}(f)|^2 N_0 (1 + \Delta N) G_c(f). \quad (22)$$

The power (for all definitions) of the noise component is

$$P_n = \frac{\zeta_{\tau}(0)}{T_i} N_0 (1 + \Delta N). \quad (23)$$

**Remark.** The model in (17) extends the correlator output models under spoofing provided in [3, 38]. Specifically, it accounts for the effects of RFFE filtering and potential distortions on $G_c$, while also modeling the PSD of inter-system interference and AWGN contributions at the correlator output. Moreover, the complete derivation of each term (not provided in [3, 38]) gives a precise assessment of the model's limitations, as further discussed in the next remark.

**Remark.** The GNSS peak model in (18) extends the well-known correlator output model derived under nominal conditions in [16, p.364] and [5, p.405] by incorporating the effects of PSD distortion and synchronization errors. Additionally, the probabilistic framework provides insight into the approximations used in deriving (18) and enables a study of its limitations. Specifically, as discussed in Appendix A.3, the model in (18) assumes the non-correlation between the GNSS code and carrier components (see Eq. (A.7)). The validity of this approximation holds for low tracking errors $\epsilon_{\eta}$, as discussed in Appendix A.3 and observed numerically for GPS L1 C/A in [39].

**Remark.** The correlator random contributions $\Lambda_{\chi}$ and $\Lambda_n$ are not white noise processes. However, considering their PSD expressions in (20) and (22), their inverse Fourier transforms result in sharply localized functions with a width of approximately $T_c \ll T_i$, due to the spreading properties of $G_c$. As a result, these noise components can be assumed uncorrelated between two successive integration periods $T_i$.

### 3.5. Classification of spoofing impact at post-correlation

To simplify the correlator model (17) and ensure the validity of the assumption on $\epsilon_{\eta}$ discussed in Appendix A.3, we adopt the classification introduced in [3]. This classification exploits the orthogonality properties of GNSS PRN sequences to categorize the spoofing impact at the correlator output based on the relative parameters $\Delta v$. Specifically, it identifies four spoofing-induced scenarios: nominal, induced-spoofing, induced-jamming, and induced-multipath. It is important to emphasize that, although these situations share names with other types of interference, they are in fact distinct sub-categories of spoofing effects. A brief overview of this classification is provided in this subsection. Throughout the paper, the subscripts ‘(N)’, ‘(J)’, ‘(S)’, and ‘(M)’ denote the nominal, induced-jamming, induced-spoofing, and induced-multipath situations, respectively.

#### 3.5.1. Nominal Situation

The nominal situation serves as the reference scenario, where the impact of spoofing is either absent or considered negligible. In this case, both the spoofing GNSS peak and the spoofing-induced random contribution are disregarded, as illustrated in Fig. 1a. Consequently, the correlator output (17) simplifies to

$$\Lambda^{(N)}(\epsilon_{\eta}) = \Lambda_{a}(\epsilon_{\eta}) + \Lambda_{\chi} + \Lambda_{n}. \quad (24)$$

where $\Lambda_a(\epsilon_{\eta})$ is defined in (18), and the PSDs of $\Lambda_{\chi}$ and $\Lambda_n$ are given by (20) and (22), respectively, under the assumption $\Delta N = \Delta g = 0$.

#### 3.5.2. Spoofing-Induced Jamming Situation

In the spoofing-induced jamming situation, the receiver tracks the authentic signal, while the spoofed GNSS peak is negligible, as illustrated in Fig. 1b. Under these conditions, the correlator output in (17) is given by

$$\Lambda^{(J)}(\epsilon_{\eta}, \Delta v) = \Lambda_{a}(\epsilon_{\eta}) + \Lambda_{\chi} + \Lambda_{n}. \quad (25)$$

The correlator model differs from the nominal situation due to the random noise contribution in (20) and (22), where $\Delta N > 0$ and/or $\Delta g > 0$. Since the impact of the spoofer is limited to the random noise contribution, this situation resembles a jamming threat where a non-GNSS wideband signal interferes with the receiver.

#### 3.5.3. Spoofing-Induced Spoofing Situation

In the spoofing-induced spoofing situation, the receiver tracks the spoofing signal, while the authentic peak is negligible, as illustrated in Fig. 1c. Under these conditions, the correlator output (17) can be expressed as

$$\Lambda^{(S)}(\epsilon_{\eta}, \Delta v) = \sqrt{\Delta g} \Lambda_{a}(\epsilon_{\eta} + \Delta v) + \Lambda_{\chi} + \Lambda_{n}. \quad (26)$$

This situation represents the classic spoofing case discussed in the literature, where the receiver is assumed to track and synchronize with the spoofing signal's parameters, $v_s$.
<figure><img src="image_2.png" /><figcaption>Figure 1: Illustration of the classification of spoofing impact on correlator (black: authentic, red: spoofing contribution). The points E, P and L indicate the emplacement of early, prompt and late correlators. The horizontal lines illustrate the authentic and spoofing noise floor.</figcaption></figure>

### 3.5.4. Spoofing-induced Multipath Situation

The spoofing-induced multipath situation is the most disturbed situation, where the receiver is tracking a composite of both the authentic and spoofed signals, as illustrated in Fig. 1d. In this case, the correlator output in (17) cannot be further simplified. The correlator amplitude oscillates in this situation along with the relative phase $\Delta\theta$ (with a frequency of $\Delta f$), leading to non-ergodic behavior, as developed throughout this paper.

### 3.6. Signal assumptions

To conclude, the $C/N_0$ is estimated from the correlator output $\Lambda$ over the discrete estimation interval $I_t = [k_0, k_0 + M]$ (with $k_0 \in \mathbb{Z}$ and $M \in \mathbb{N}^*$). Within this interval, the correlator output under spoofing is a stochastic process $\Lambda: I_t \times I_\Omega \to \mathbb{C}$, modeled by (17) (parametrized by $\varepsilon_\eta$ and $\Delta\nu$). This subsection discusses the time and random distributions of each parameter in (17), as considered in the $C/N_0$ derivation. The assumptions are discussed in Sec. 6.

First, the processes $\Lambda_\chi: I_t \times I_\Omega \to \mathbb{C}$ and $\Lambda_n: I_t \times I_\Omega \to \mathbb{C}$ are modeled as independent white Gaussian noise processes with ergodic properties, following $CN(0, P_\chi)$ and $CN(0, P_n)$, respectively. The powers $P_\chi$ and $P_n$ are defined in (21) and (23). The white noise property is relevant with respect to the third remark in Sec. 3.4.

Next, the GNSS peak $\Lambda_a: I_t \times I_\Omega \to \mathbb{C}$ is modeled by a stochastic process, where the only random component is the navigation message $d: I_t \times I_\Omega \to \{-1, 1\}$, which follows an independent and identically distributed (i.i.d.) r.v. on $\{-1, 1\}$. For simplicity, in this paper, the authentic and spoofed navigation signals $d$ are assumed to be equal.

Finally, the parameters $\varepsilon_\eta$ and $\Delta\nu$ are deterministic, and their time variation is characterized for each spoofing-induced situation as follows:

* $C_a$, $\Delta g$, $\Delta N$, and $\Delta g$ are assumed to be constant over $I_t$ in all situations.

* In the nominal and induced-jamming situations, $\varepsilon_\eta$ is assumed to be constant over $I_t$.

* In the induced-spoofing situation, $\varepsilon_\eta + \Delta\eta$ is assumed to be constant over $I_t$.

* In the induced-multipath situation, $\varepsilon_\eta$ is assumed to be constant over $I_t$ and equal to the mean value of its quasi-harmonic behavior (see [38]), while the relative parameters $\Delta\tau$ and $\Delta f$ are assumed to be constant. Additionally, $\Delta\theta[k] = \Delta\theta[k_0] + 2\pi\Delta f k T_i$.

While the different $C/N_0$ values are derived for any GNSS modulations (modeled by $G_c$ in (17)) and parameters, the figures throughout the paper are plotted for the specific case of the GPS L1 C/A signal, with parameters $T_i = 20$ ms and $M = 50$ for the sake of illustration. However, note that the conclusions and models can be applied to any other type of GNSS signal. In particular, this includes modern GNSS signals with native countermeasures such as secondary codes or authentication features. These features are represented in $d_a$ and $d_s$ in the signal model (12). It is worth noting that the correlator output in (18) assumes identical messages $d$. The extension of the proposed models to distinct messages is discussed in Sec. 5.5.

## 4. True C/N₀

In order to characterize the impact of spoofing on the estimation of $C/N_0$, it is important to first define the true $C/N_0$ under spoofing, i.e., the actual $C/N_0$ experienced by the receiver. The $C/N_0$ can be defined in terms of the SNR (or, more precisely, the signal-to-noise-plus-interference ratio, SNIR) as

$$C/N_0 \triangleq \frac{1}{T_i} \text{SNIR} \triangleq \frac{1}{T_i} \frac{P_d}{P_\zeta} \qquad (27)$$

with $P_d$ defining the useful signal power (i.e., the combination of authentic and spoofing signals the signal that carry the information) and $P_\zeta$ representing the noise-plus-interference power. In our case, the useful and noise-plus-interference signals $\Lambda_d: I_t \times I_\Omega \to \mathbb{C}$ and $\Lambda_\zeta: I_t \times I_\Omega \to \mathbb{C}$ can be expressed from (17) as

$$\Lambda_d = \Lambda_a(\varepsilon_\eta) + \sqrt{\Delta g} \Lambda_a(\varepsilon_\eta + \Delta\eta), \quad \Lambda_\zeta = \Lambda_\chi + \Lambda_n. \qquad (28)$$

According to Sec. 2.2, it is clear that three different definitions of $C/N_0$ can be considered: the random-averaged, time-averaged, and total-averaged $C/N_0$. Under ergodic conditions (nominal estimation), we have $E_t[\cdot] = E_\Omega[\cdot]$, and thus the three
powers are equivalent. However, in the presence of spoofing, the three definitions differ, and it is important to identify which one to consider.

### 4.1. True C/N₀ definitions

**Definition 7 (Random-averaged C/N₀).** The random-averaged C/N₀ is the average C/N₀ over all the random parameters of the signal I<sub>Ω</sub>, as defined for k ∈ I<sub>t</sub> as

$$ \left\{ \frac{C}{N_0} \right\}_{\Omega} (k) \triangleq \frac{1}{T_i} \frac{P_d(k)}{P_{\zeta}(k)} \triangleq \frac{1}{T_i} \frac{\mathbb{E}_{\Omega} [ |\Lambda_d|^2 | \{k\} ]}{\mathbb{E}_{\Omega} [ |\Lambda_{\zeta}|^2 | \{k\} ]} \quad (29) $$

**Definition 8 (Time-averaged C/N₀).** The time-average C/N₀ represents the C/N₀ averaged over the time interval I<sub>t</sub>, defined for any realization ω ∈ I<sub>Ω</sub> as

$$ \left\{ \frac{C}{N_0} \right\}_t (\omega) \triangleq \frac{1}{T_i} \frac{P_d(\omega)}{P_{\zeta}(\omega)} \triangleq \frac{1}{T_i} \frac{\mathbb{E}_t [ |\Lambda_d|^2 | \{\omega\} ]}{\mathbb{E}_t [ |\Lambda_{\zeta}|^2 | \{\omega\} ]} \quad (30) $$

**Remark.** In our case, the time interval is discrete, and the time-based mean value can be explicitly written as $\mathbb{E}_t[\cdot] = \frac{1}{M} \sum_{i} (\cdot)$ (see the first remark of Def. 2).

**Definition 9 (Total-averaged C/N₀).** The total-average C/N₀ represents the C/N₀ averaged on both random and time outcomes, defined as

$$ \frac{C}{N_0} \triangleq \frac{1}{T_i} \frac{P_d}{P_{\zeta}} \triangleq \frac{1}{T_i} \frac{\mathbb{E} [ |\Lambda_d|^2 ]}{\mathbb{E} [ |\Lambda_{\zeta}|^2 ]} = \frac{1}{T_i} \frac{\mathbb{E}_{\Omega} [ \mathbb{E}_t [ |\Lambda_d|^2 ] ]}{\mathbb{E}_{\Omega} [ \mathbb{E}_t [ |\Lambda_{\zeta}|^2 ] ]} \quad (31) $$

**Remark.** In our case, the random-averaged C/N₀ (29) can be interpreted as the theoretical C/N₀ measured at one epoch k (and for all random realizations I<sub>Ω</sub>), which is the one typically considered in the literature considering ergodicity [4, 21, 22, 23]. The time-averaged C/N₀ (30) represents the C/N₀ measured over one time realization, and the total-averaged C/N₀ (31) represents the theoretical C/N₀ measured over the estimation interval.

### 4.2. Impact of spoofing on true C/N₀

The estimators attempt to estimate the total-averaged C/N₀, as defined in (31). This subsection derives its value under spoofing for each spoofing-induced situation presented in Sec. 3.5.

#### 4.2.1. Nominal situation

In the nominal situation, the correlator output is expressed as in (24). Thus, the total-averaged power of the useful signal Λ<sub>a</sub> can be expressed as $P_{d}^{(N)} = \mathbb{E}[|\Lambda_{a}|^2] = \zeta(\varepsilon_{\eta})^2 C_{a}$. The noise-plus-interference power $P_{\zeta}^{(N)} = P_{\chi}^{(N)} + P_{n}^{(N)}$ can be expressed by considering (21) and (23) for ΔN = Δg = 0. Consequently, by substituting $P_{d}^{(N)}$ and $P_{\zeta}^{(N)}$ into (31), we obtain

$$ \left\{ \frac{C}{N_0} \right\}_{\text{true}}^{(N)} \triangleq \frac{1}{T_i} \frac{P_d^{(N)}}{P_{\zeta}^{(N)}} = \frac{1}{\zeta_{\tau}(0)} \frac{\zeta(\varepsilon_{\eta})^2 C_a}{N_0 + \sum_{i \in \mathcal{G}} C_{\chi,i} \tilde{\kappa}_i} \quad (32) $$

**Remark.** The useful and noise-plus-interference powers, $P_{d}^{(N)}$ and $P_{\zeta}^{(N)}$, are equal for all power definitions presented in Sec. 2.2. Therefore, the random-averaged, time-averaged, and total-averaged true C/N₀ are also equal (ergodicity).

**Remark.** The expression in (32) matches the standard C/N₀ models from the literature. First, assuming infinite RFFE bandwidth ($\zeta_{\tau}(0) = 1$), perfect synchronization ($\zeta(\varepsilon_{\eta}) = 1$), and no inter-system noise, we retrieve $C_a/N_0$ [5, 19]. In addition, (32) matches [4, Eq. (1)] assuming perfect synchronization and no inter-system interference, and [37, Eq. (2)] assuming perfect synchronization and infinite bandwidth.

#### 4.2.2. Induced-jamming situation

In the induced-jamming situation, the correlator output is expressed as in (25). The useful signal power remains $P_{d}^{(J)} = \zeta(\varepsilon_{\eta})^2 C_a$, and the noise-plus-interference power $P_{\zeta}^{(J)} = P_{\chi}^{(J)} + P_{n}^{(J)}$ is expressed in (21) and (23), leading to

$$ \left\{ \frac{C}{N_0} \right\}_{\text{true}}^{(J)} \triangleq \frac{1}{T_i} \frac{P_d^{(J)}}{P_{\zeta}^{(J)}} = \frac{1}{\zeta_{\tau}(0)} \frac{\zeta(\varepsilon_{\eta})^2 C_a}{(1 + \Delta N) N_0 + \sum_{i \in \mathcal{G}} (1 + \overline{\Delta g_i}) C_{\chi,i} \tilde{\kappa}_i} \quad (33) $$

**Remark.** Under the induced-jamming situation, the spoofer acts as a wideband jammer with an equivalent noise floor $I = \Delta N N_0 + \sum_{i \in \mathcal{G}} \Delta g_i C_{\chi,i} \tilde{\kappa}_i$ (see [4]), which confirms the classification in Sec. 3.5.

**Remark.** We note that since the useful signal power remains unchanged and the additive noise is ergodic, the system remains ergodic under the induced-multipath situation.

#### 4.2.3. Induced-spoofing situation

In the induced-spoofing situation, the correlator output is expressed as in (26). Following the signal assumption in Sec. 3.6, the power of the useful signal can be expressed as $P_{d}^{(S)} = \zeta(\varepsilon_{\eta} + \Delta\eta)^2 \Delta g C_a$. The noise-plus-interference power is equal to that in the induced-jamming situation. Thus, the true C/N₀ is expressed as

$$ \left\{ \frac{C}{N_0} \right\}_{\text{true}}^{(S)} \triangleq \frac{1}{T_i} \frac{P_d^{(S)}}{P_{\zeta}^{(S)}} = \frac{1}{\zeta_{\tau}(0)} \frac{\zeta(\varepsilon_{\eta} + \Delta\eta)^2 \Delta g C_a}{(1 + \Delta N) N_0 + \sum_{i \in \mathcal{G}} (1 + \overline{\Delta g_i}) C_{\chi,i} \tilde{\kappa}_i} \quad (34) $$

**Remark.** Assuming perfect synchronization of the spoofing dynamic ($\varepsilon_{\eta} + \Delta\eta = 0$) and infinite bandwidth ($\zeta_{\tau}(0) = 1$), the true C/N₀ matches the spoofing signal's $C_s/N_0$ with additional noise induced by authentic random contributions.

#### 4.2.4. Induced-multipath situation

The correlator output in the induced-multipath situation, as given by (17), is a composite of authentic and spoofing peaks. This induces oscillations in the modulus of the useful signal along $\Delta\theta(k)$, leading to the non-equality $\mathbb{E}_t[|\Lambda_d|^2] \neq \mathbb{E}_\Omega[|\Lambda_d|^2](k)$ (non-ergodicity). The total-averaged power of the useful signal is derived in Appendix B.1, such that

$$ P_{d}^{(M)} = \mathbb{E} [P_{d}^{(M)}(k)] = (\mu_{d} + \omega_{d}) C_{a} \quad (35) $$
where

$$ \mu_d = \zeta(\varepsilon_\eta)^2 + \Delta g \zeta(\varepsilon_\eta + \Delta \eta)^2 \quad (36) $$

$$ \omega_d = 2 \sqrt{\Delta g} \zeta(\varepsilon_\eta) \zeta(\varepsilon_\eta + \Delta \eta) \mathrm{sinc}_M(\Delta f T_i) \cos(\overline{\Delta \theta}) \quad (37) $$

with $\overline{\Delta \theta} = \Delta \theta(k_0) + \pi \Delta f M T_i$ representing the relative phase at the midpoint of the estimation interval $I_t$, and $\mathrm{sinc}_M$ denotes the normalized Dirichlet kernel (analogous to the sinc function), defined as

$$ \mathrm{sinc}_N(x) = \frac{\sin(2\pi N x)}{N \sin(2\pi x)}. \quad (38) $$

The noise-plus-interference term remains ergodic, with power expressed in (21) and (23). Therefore, the true $C/N_0$ is expressed as

$$ \left\{ \frac{C}{N_0} \right\}_{\text{true}}^{(M)} \triangleq \frac{1}{T_i} \frac{P_{\mathrm{d}}^{(M)}}{P_{\zeta}^{(M)}} = \frac{1}{\zeta_{\tau}(0)} \frac{(\mu_d + \omega_d) C_a}{(1 + \Delta N) N_0 + \sum_{i \in G} (1 + \overline{\Delta g}_i) C_{\chi, i} \tilde{K}_i} \quad (39) $$

**Remark.** For non-zero authentic and spoofing powers, i.e., $P_s > 0$ and $P_a > 0$, and under the assumptions of Sec. 3.6 (with $\Delta \theta[k_0]$ deterministic), the system is wide-sense ergodic if and only if the relative frequency offset $\Delta f = 0$.

*Proof of Remark.* We aim to show that $\mathbb{E}_t[\Lambda] = \mathbb{E}_\Omega[\Lambda]$ and $\mathbb{E}_t[|\Lambda|^2] = \mathbb{E}_\Omega[|\Lambda|^2]$ (wide-sense ergodicity). By substituting (17) into these expressions and applying the assumptions in Sec. 3.6, we obtain $\mathbb{E}_t[e^{j\Delta\theta}] = \mathbb{E}_\Omega[e^{j\Delta\theta}]$, which holds if and only if $\Delta f = 0$. $\square$

**Remark.** The two terms $\mu_d$ and $\omega_d$ are plotted in Fig. 2. $\omega_d$ represents the oscillatory component of the useful signal power. As $\omega_d$ evolves along $\overline{\Delta \theta}$, the maximum value is plotted. We observe that the oscillation of the true $C/N_0$ occurs only at very low $\Delta f$ (but not for $\Delta f = 0$, as noted in the first remark).

<figure><img src="image_3.png" /><figcaption>Figure 2: Value of parameters $\mu_d$ and $\omega_d$</figcaption></figure>

# 5. Estimated $C/N_0$

This section presents the impact of spoofing on the MM, NWPR, and Beaulieu $C/N_0$ estimates, denoted as $\overline{C/N_0}$, for each spoofing-induced situation described in Sec. 3.5. Each estimator is briefly introduced, and an analytical expression for its expectation $\mathbb{E}_\Omega[\overline{C/N_0}]$ is provided.

We recall that the estimation bias is defined as the difference $\mathbb{E}_\Omega[\overline{C/N_0} - C/N_{0\text{true}}]$, where $C/N_{0\text{true}}$ is the true value as defined in Sec. 4. The $C/N_0$ estimators are designed to be unbiased within their nominal operational range, i.e., for a sufficiently long estimation interval $I_t$ and a sufficiently high true $C/N_0$ ($C/N_{0\text{true}} > 30$ dB·Hz) [19, 20]. In this work, we assume these conditions hold.

## 5.1. Moment Method

### 5.1.1. Description

The MM measures the second- and fourth-order moments, defined as $M_2 \triangleq \mathbb{E}_\Omega[|\Lambda|^2]$ and $M_4 \triangleq \mathbb{E}_\Omega[|\Lambda|^4]$, to estimate the signal and noise power. For complex signals, these powers are expressed as:

$$ P_d = \sqrt{2M_2^2 - M_4}, \quad P_n = M_2 - P_d. \quad (40) $$

In practice it computes the statistical moments $M_2$ and $M_4$ using their time-averaged values over $I_t$, defined as $\hat{M}_2 \triangleq \mathbb{E}_t[|\Lambda|^2]$ and $\hat{M}_4 \triangleq \mathbb{E}_t[|\Lambda|^4]$. The MM estimate of $C/N_0$ is then given by [17]

$$ \left\{ \frac{\overline{C}}{N_0} \right\}_{\text{MM}} = \frac{1}{T_i} \frac{\sqrt{2\hat{M}_2^2 - \hat{M}_4}}{\hat{M}_2 - \sqrt{2\hat{M}_2^2 - \hat{M}_4}}. \quad (41) $$

### 5.1.2. Spoofing impact

The expectation of the MM estimator in its operational range can be approximated as [19]:

$$ \mathbb{E}_\Omega \left[ \frac{\overline{C}}{N_0} \right]_{\text{MM}} \approx \frac{1}{T_i} \frac{\sqrt{2 \mathbb{E}_\Omega[\hat{M}_2]^2 - \mathbb{E}_\Omega[\hat{M}_4]}}{\mathbb{E}_\Omega[\hat{M}_2] - \sqrt{2 \mathbb{E}_\Omega[\hat{M}_2]^2 - \mathbb{E}_\Omega[\hat{M}_4]}}. \quad (42) $$

The expectations of the second- and fourth-order moment estimates are derived in Appendix C.2, yielding:

$$ \mathbb{E}_\Omega[\hat{M}_2] = \mathbb{E}[|\Lambda|^2] = P_s + P_d, \quad (43) $$

$$ \mathbb{E}_\Omega[\hat{M}_4] = \mathbb{E}[|\Lambda|^4] = 2P_s^2 + 4P_s P_d + \mathbb{E}[|\Lambda_d|^4], \quad (44) $$

where $P_d$ and $P_s$ represent the total-averaged power of the useful signal and the noise-plus-interference signal, respectively, as defined in Sec. 4.

### 5.1.3. Nominal, induced-jamming and induced-spoofing situations

In these situations, the useful signal is stationary (and ergodic), which implies that

$$ \mathbb{E}[|\Lambda_d|^4] = P_d^2. \quad (45) $$
Thus, the MM expectation can be expressed as

$$ \mathbb{E}_{\Omega} \left[ \frac{\widehat{C}}{N_0} \right]_{\text{MM}}^{(N/J/S)} \approx \frac{1}{T_i} \frac{P_d}{P_{\zeta}}. \quad (46) $$

This result confirms that the MM estimator is asymptotically unbiased in the nominal, induced-jamming, and induced-spoofing situations. Consequently, it correctly estimates the true $C/N_0$, as given by (32), (33), and (34), respectively.

### 5.1.4. Induced-multipath situation

In the induced-multipath situation, the total-averaged fourth moment is given by (see Appendix C.3)

$$ \mathbb{E} \left[ \left| \Lambda_d^{(M)} \right|^4 \right] = (\mu_d^2 + 2 \mu_d \omega_d + \Omega_d) C_a^2 = P_d^{(M)2} + C_a^2 \sigma_d^2 \quad (47) $$

with

$$ \sigma_d^2 = \text{Var} \left[ \left| \Lambda_d^{(M)} \right|^2 / C_a \right] = \text{Var}_t \left[ \left| \Lambda_d^{(M)} \right|^2 / C_a \right] = \Omega_d - \omega_d^2 \quad (48) $$

$$ \Omega_d = \Delta g \zeta (\varepsilon_\eta)^2 \zeta (\varepsilon_\eta + \Delta \eta)^2 \left[ 1 + \text{sinc}_M(2\Delta f T_i) \cos(2\Delta\theta) \right]. \quad (49) $$

Therefore, we have

$$ \mathbb{E}_{\Omega} \left[ \frac{\widehat{C}}{N_0} \right]_{\text{MM}}^{(M)} \approx \frac{1}{T_i} \frac{\sqrt{(P_d^{(M)})^2 - C_a^2 \sigma_d^2}}{P_{\zeta} + P_d^{(M)} - \sqrt{(P_d^{(M)})^2 - C_a^2 \sigma_d^2}}. \quad (50) $$

**Remark.** The MM interprets the oscillation of the useful signal (modeled by its time-averaged variance $\sigma_d^2$) as noise, leading to a significant estimation bias. The variance $\sigma_d^2$ is illustrated in Fig. 3. We observe that, unlike $\omega_d$, which decreases rapidly (see Fig. 2b or Eq. (37)), $\sigma_d^2$ remains non-negligible even at relatively high frequencies ($\Delta f < 50$ Hz). Finally, as $\sigma_d^2 \to 0$, the estimator converges to the true $C/N_0$.

## 5.2. Narrowband-Wideband Power Ratio

### 5.2.1. Description

The NWPR method estimates the $C/N_0$ by comparing the signal-plus-noise power in two distinct bandwidths. This involves the computation of the correlator output over two integration times: the narrowband over $T_i$ and the wideband over $T_w$ ($T_i = L T_w$). The narrowband correlator $\Lambda$ is equivalent to (15), while the wideband correlator $\tilde{\Lambda}$ is expressed for $l \in [0; L-1]$ as

$$ \tilde{\Lambda}(k, l, \hat{\eta}) = \frac{1}{T_w} \int_{k T_i + l T_w}^{k T_i + (l+1) T_w} r(t) c^*(t - \tau) e^{-2j\pi(t-k T_i - T_i/2)\hat{f} - j\hat{\theta}} dt. \quad (51) $$

The received signal (12) at the wideband correlator output is derived in Appendix D.1, resulting in an expression similar to the narrowband correlator presented in Sec. 3.4, with $T_i$ replaced by $T_w$. The narrowband correlator is also a stochastic process $\tilde{\Lambda} : I_t \times I_\Omega \to \mathbb{C}$, parametrized by an additional parameter $l \in [0; L-1]$. In the following, we denote the equivalent wideband parameters with an accent '>'.

Then, considering the narrowband and wideband powers NBP : $I_t \times I_\Omega \to \mathbb{R}_+$ and WBP : $I_t \times I_\Omega \to \mathbb{R}_+$, which are computed from $\Lambda$ and $\tilde{\Lambda}$ as [16, p. 391]

$$ \text{WBP} \triangleq \sum_{l=0}^{L-1} |\tilde{\Lambda}(l)|^2, \quad \text{NBP} \triangleq \left| \sum_{l=0}^{L-1} \tilde{\Lambda}(l) \right|^2 = L^2 |\Lambda|^2 \quad (52) $$

and the normalized power NP : $I_t \times I_\Omega \to \mathbb{R}_+$ defined as NP = NBP/WBP, the NWPR is expressed as [16, p. 391]

$$ \left\{ \frac{\widehat{C}}{N_0} \right\}_{\text{NWPR}} = \frac{1}{T_w} \frac{\hat{\mu}_{\text{NP}} - 1}{L - \hat{\mu}_{\text{NP}}}, \quad \hat{\mu}_{\text{NP}} = \mathbb{E}_t [\text{NP}]. \quad (53) $$

### 5.2.2. Spoofing impact

The expectation of the NWPR can be approximated within its operational range as [19]

$$ \mathbb{E}_{\Omega} \left[ \frac{\widehat{C}}{N_0} \right]_{\text{NWPR}} \approx \frac{1}{T_w} \frac{\mathbb{E}_{\Omega} [\hat{\mu}_{\text{NP}}] - 1}{L - \mathbb{E}_{\Omega} [\hat{\mu}_{\text{NP}}]} \quad (54) $$

with $\mathbb{E}_{\Omega}[\hat{\mu}_{\text{NP}}]$ expressed as

$$ \mathbb{E}_{\Omega}[\hat{\mu}_{\text{NP}}] = \mathbb{E}_t[\mathbb{E}_{\Omega}[\text{NP}]] \approx \mathbb{E}_t \left[ \frac{\mathbb{E}_{\Omega}[\text{NBP}]}{\mathbb{E}_{\Omega}[\text{WBP}]} \right] \quad (55) $$

and NBP and WBP as defined in (52). The random-averaged expectations $\mathbb{E}_{\Omega}[\text{NBP}] : I_t \to \mathbb{R}_+$ and $\mathbb{E}_{\Omega}[\text{WBP}] : I_t \to \mathbb{R}_+$ are derived in Appendix D.2 yielding for $k \in I_t$,

$$ \begin{aligned} \mathbb{E}_{\Omega}[\text{NBP}](k) &= L^2 P_{\zeta} + L^2 P_d(k) \\ \mathbb{E}_{\Omega}[\text{WBP}](k) &= L^2 P_{\zeta} + \sum_{l=0}^{L-1} \tilde{P}_d(k; l) \end{aligned} \quad (56) $$

where $P_d : I_t \to \mathbb{R}_+$ and $\tilde{P}_d : I_t \to \mathbb{R}_+$ are the random-averaged wideband and narrowband powers as defined as $P_d(k) =$

<figure><img src="image_4.png" /><figcaption>Figure 3: MM bias coefficients under induced-multipath situation.</figcaption></figure>
$|\Lambda_d|^2(k)$ and $\tilde{P}_d(k; l) = |\tilde{\Lambda}_d|^2(k; l)$ (see Def. 8). The expressions of $P_d$ and $\tilde{P}_d$ differ for the different spoofing-induced situations, resulting in different bias expressions of (54).

### 5.2.3. Nominal, induced-jamming and induced-spoofing situations

The wideband and narrowband peaks $\Lambda_a$ and $\tilde{\Lambda}_a$ defined in (18) and (D.2) differ mainly in the width of their frequency synchronization degradation functions $\zeta_f$ and $\tilde{\zeta}_f$ (as $T_w < T_i$). Consequently, in the nominal, induced-jamming, and induced-spoofing situations, where the receiver is assumed to be at the peak (Fig. 1), we have

$$ \tilde{P}_d(k; l) = |\tilde{\Lambda}_d|^2(k; l) \approx |\Lambda_d|^2(k) = P_d(k) = \mathbb{E}_t [P_d(k)] = P_d. \quad (57) $$

Thus, by substituting (57) into (56), we obtain

$$ \mathbb{E}_{\Omega}[\text{NBP}] = L^2 P_{\zeta} + L^2 P_d, \quad \mathbb{E}_{\Omega}[\text{WBP}] = L^2 P_{\zeta} + L P_d \quad (58) $$

which is time-independent. Therefore, the time average of the quotient in (55) can be expressed as

$$ \mathbb{E}_{\Omega}[\hat{\mu}_{\text{NP}}] \approx \frac{L^2 P_{\zeta} + L^2 P_d}{L^2 P_{\zeta} + L P_d}. \quad (59) $$

Finally, the NWPR expectation can be expressed as

$$ \mathbb{E}_{\Omega} \left[ \frac{\widehat{C}}{N_0} \right]_{\text{NWPR}}^{(N/J/S)} \approx \frac{1}{T_i} \frac{P_d}{P_{\zeta}}. \quad (60) $$

The NWPR is thus unbiased in these situations and converges toward the true $C/N_0$.

### 5.2.4. Induced-multipath situation

In the induced-multipath situation, the receiver tracks a composite of the authentic and spoofing peaks, due to their different frequency widths ($\zeta_f$ and $\tilde{\zeta}_f$). The two peaks will affect the narrowband and wideband correlators differently. Additionally, the two correlators are time-dependent (Sec. 4.2.4), which affects the time average in (55). The computation of the expectation of the NWPR, considering all these distortions, is derived in Appendix D.3, leading to

$$ \mathbb{E}_{\Omega} \left[ \frac{\widehat{C}}{N_0} \right]_{\text{NWPR}}^{(M)} \approx \frac{1}{T_i} \frac{P_d^{(M)} - L P_{\zeta} \alpha_{\text{NP}} - C_a \delta_{\text{WB}} \left( \frac{1}{L} - \alpha_{\text{WB}} \right)}{P_{\zeta} (1 + \alpha_{\text{NP}}) + C_a \frac{\delta_{\text{WB}}}{L} (1 - \alpha_{\text{WB}})} \quad (61) $$

with

$$ \delta_{\text{WB}} = \tilde{\mu}_{\text{d}} - \mu_{\text{d}} + \tilde{\omega}_{\text{d}} \text{sinc}_{L}(T_{\text{w}} \Delta f) - \omega_{\text{d}} \quad (62) $$

$$ \alpha_{\text{NP}} = \frac{L^2 \sigma_{\text{d}}^2 \text{sinc}_L(T_{\text{w}} \Delta f)}{(\tilde{\mu}_{\text{d}} + \tilde{\omega}_{\text{d}} \text{sinc}_L(T_{\text{w}} \Delta f))^2} \quad (63) $$

$$ \alpha_{\text{WB}} = \frac{L^2 \sigma_{\text{d}}^2 \text{sinc}_L(T_{\text{w}} \Delta f)}{(\tilde{\mu}_{\text{d}} + \tilde{\omega}_{\text{d}} \text{sinc}_L(T_{\text{w}} \Delta f))^2} (1 - \text{sinc}_L(T_{\text{w}} \Delta f)) \quad (64) $$

and $\sigma_{\text{d}}^2$ as defined in (48). $\tilde{\mu}_{\text{d}}$ and $\tilde{\omega}_{\text{d}}$ refer to narrowband correlator parameters, defined similarly to (37), but with $T_{\text{w}}$ instead of $T_i$.

**Remark.** In the induced-multipath situation, the NWPR estimator suffers from two distinct distortions: the non-ergodicity of the normalized power NP along $I_i$, modeled by $\alpha_{\text{NP}}$, and the difference between narrow and wide power, modeled by $\delta_{\text{WB}}$ and $\alpha_{\text{WB}}$. These three parameters are plotted in Fig. 4. While the ergodic error $\alpha_{\text{NP}}$ appears mainly for low $\Delta f$ (see Fig. 4b), the power error $\delta_{\text{WB}}$ is not negligible for $|\Delta f| \to +\infty$ (Fig. 4a). The NWPR bias can be simplified depending on the order of magnitude of $\Delta f$:

* For $\Delta f \approx 0$ we have

$$ \mathbb{E}_{\Omega} \left[ \frac{\widehat{C}}{N_0} \right]_{\text{NWPR}}^{(M)} \approx_{\Delta f \to 0} \frac{1}{T_i} \frac{P_d^{(M)} - L P_{\zeta} \alpha_{\text{NP}}}{P_{\zeta} (1 + \alpha_{\text{NP}})} \quad (65) $$

* For $|\Delta f| \to +\infty$ we have

$$ \mathbb{E}_{\Omega} \left[ \frac{\widehat{C}}{N_0} \right]_{\text{NWPR}}^{(M)} \approx_{|\Delta f| \to +\infty} \frac{1}{T_i} \frac{P_d^{(M)} - C_a \frac{\delta_{\text{WB}}}{L}}{P_{\zeta} + C_a \frac{\delta_{\text{WB}}}{L}}. \quad (66) $$

### 5.3. Beaulieu Method

#### 5.3.1. Description

The Beaulieu method proposes an intuitive estimate based on statistics inversely related to $C/N_0$, such that [18]

$$ \left\{ \frac{\widehat{C}}{N_0} \right\}_{\text{B}} = \frac{1}{T_i} \left( \mathbb{E}_t \left[ \frac{\hat{P}_{\zeta}}{\hat{P}_d} \right] \right)^{-1} \quad (67) $$

where $\hat{P}_d = I_t \times I_{\Omega} \to \mathbb{R}_+$ and $\hat{P}_{\zeta} : I_t \times I_{\Omega} \to \mathbb{R}_+$ are the estimates of the signal and noise power, defined for BPSK signals as

$$ \hat{P}_d = \frac{1}{2} (\mathfrak{R}\{\Lambda^{(0)}\}^2 + \mathfrak{R}\{\Lambda^{(1)}\}^2), \quad (68) $$

$$ \hat{P}_{\zeta} = \left( |\mathfrak{R}\{\Lambda^{(0)}\}| - |\mathfrak{R}\{\Lambda^{(1)}\}| \right)^2, \quad (69) $$

where $\forall i, \Lambda^{(i)} : I_t \times I_{\Omega} \to \mathbb{C}$, such that $\forall (k, \omega) \in I_t \times I_{\Omega}$, $\Lambda^{(i)}(k, \omega) = \Lambda(k - i, \omega)$.

It is worth noting that the Beaulieu estimator is based on the power of the real part of the received signal at the correlator output. As a result, the useful signal power may depend on the tracking error $\epsilon_{\theta}$.

#### 5.3.2. Spoofing impact

The expectation of the Beaulieu estimator within its operational range can be approximated as [19]

$$ \mathbb{E}_{\Omega} \left[ \frac{\widehat{C}}{N_0} \right]_{\text{B}} \approx \frac{1}{T_i} \left( \mathbb{E}_t \left[ \frac{\mathbb{E}_{\Omega}[\hat{P}_{\zeta}]}{\mathbb{E}_{\Omega}[\hat{P}_d]} \right] \right)^{-1} \quad (70) $$

The random-averaged expectations of $\mathbb{E}_{\Omega}[\hat{P}_d] : I_t \to \mathbb{R}_+$ and $\mathbb{E}_{\Omega}[\hat{P}_{\zeta}] : I_t \to \mathbb{R}_+$ in (70) are derived in Appendix E.1, yielding

$$ \begin{aligned} \mathbb{E}_{\Omega}[\hat{P}_d] &= \frac{1}{2} P_{\zeta} + \frac{1}{2} (\mathfrak{R}\{\Lambda_d^{(0)}\}^2 + \mathfrak{R}\{\Lambda_d^{(1)}\}^2) \\ \mathbb{E}_{\Omega}[\hat{P}_{\zeta}] &= P_{\zeta} + \left( |\mathfrak{R}\{\Lambda_d^{(0)}\}| - |\mathfrak{R}\{\Lambda_d^{(1)}\}| \right)^2 \end{aligned} \quad (71) $$

The expressions of $\mathfrak{R}\{\Lambda_d^{(0)}\}$ and $\mathfrak{R}\{\Lambda_d^{(1)}\}$ vary depending on the spoofing situations and are analyzed in detail in the following subsections.
### 5.3.3. Nominal, induced-jamming and induced-spoofing situations

In these three situations, the correlator output is time-shift invariant, meaning that $\Lambda_d^{(0)} = \Lambda_d^{(1)} = \Lambda_d$. Moreover, we assume that the correlator phase is correctly tracked, so $\arg\{\Lambda_d\} \approx 0$. Consequently, we can approximate $\mathfrak{R}\{\Lambda_d\}^2 \approx |\Lambda_d|^2$. Thus,

$$ \mathbb{E}_{\Omega}[\hat{P}_d] = \frac{1}{2}P_{\zeta} + P_d, \quad \mathbb{E}_{\Omega}[\hat{P}_{\zeta}] = P_{\zeta}. \quad (72) $$

The expectation of the estimator can thus be obtained by substituting (72) into (70), yielding

$$ \mathbb{E}_{\Omega} \left[ \frac{\widehat{C}}{N_0} \right]_{\mathrm{B}}^{(N/J/S)} \approx \frac{1}{T_i} \frac{\frac{1}{2} P_{\zeta} + P_d}{P_{\zeta}} \approx \frac{1}{T_i} \frac{P_d}{P_{\zeta}} \quad (73) $$

The Beaulieu estimator remains unbiased in the nominal, induced-jamming, and induced-spoofing situations, providing an correct estimate of the true $C/N_0$.

<figure><img src="image_5.png" /></figure>

<figure><img src="image_6.png" /><figcaption>Figure 4: NWPR bias coefficients under induced-multipath situation.</figcaption></figure>

### 5.3.4. Induced-multipath situation

The computation of the expectations in (71) under induced-multipath spoofing is significantly more complex due to the oscillations of the real correlator output along $\Delta\theta$. The expected values $\mathbb{E}_{\Omega}[\hat{P}_d]$ and $\mathbb{E}_{\Omega}[\hat{P}_{\zeta}]$, along with their quotient in (70), are derived in Appendix E.3, leading to

$$ \mathbb{E}_{\Omega} \left[ \frac{\widehat{C}}{N_0} \right]_{\mathrm{B}}^{(M)} \approx \frac{1}{T_i} \frac{C_a \mu_B}{P_{\zeta} \alpha_B + C_a \beta_B} \quad (74) $$

with

$$ \alpha_B = 1 + \frac{\sigma_B^2}{\mu_B^2} \quad (75) $$

$$ \beta_B = \delta_B \left( 1 + \frac{\sigma_B^2}{\mu_B^2} \right) - \frac{\Omega_B}{\mu_B} \quad (76) $$

and

$$ \mu_B = \mathbb{E}_t \left[ \frac{1}{2} \left( \mathfrak{R}\{\Lambda_d^{(0)}\}^2 + \mathfrak{R}\{\Lambda_d^{(1)}\}^2 \right) \right] / C_a \quad (77) $$

$$ \delta_B = \mathbb{E}_t \left[ \left( \left| \mathfrak{R} \{ \Lambda_d^{(0)} \} \right| - \left| \mathfrak{R} \{ \Lambda_d^{(1)} \} \right| \right)^2 \right] / C_a \quad (78) $$

$$ \Omega_B = \mathrm{Cov}_t \left[ \frac{1}{2} \left( \mathfrak{R}\{\Lambda_d^{(0)}\}^2 + \mathfrak{R}\{\Lambda_d^{(1)}\}^2 \right), \right. \quad (79) $$

$$ \left( \left| \mathfrak{R} \{ \Lambda_d^{(0)} \} \right| - \left| \mathfrak{R} \{ \Lambda_d^{(1)} \} \right| \right)^2 / C_a^2 \quad (80) $$

$$ \sigma_B^2 = \mathrm{Var}_t \left[ \frac{1}{2} \left( \mathfrak{R}\{\Lambda_d^{(0)}\}^2 + \mathfrak{R}\{\Lambda_d^{(1)}\}^2 \right) \right] / C_a^2 \quad (81) $$

where $\mathrm{Var}_t\{\cdot\}$ and $\mathrm{Cov}_t\{\cdot, \cdot\}$ denote the time-averaged variance and covariance, respectively.

**Remark.** The parameters in (77)-(81) are independent of $C_a$ and $P_{\zeta}$, representing the time-averaged statistics of the useful signal. The coefficients $\alpha_B$ and $\beta_B$ are plotted in Fig. 5. Notably, $\alpha_B$ only affects the estimator at very low $\Delta f$.

<figure><img src="image_7.png" /><figcaption>Figure 5: Beaulieu bias coefficients under induced-multipath situation.</figcaption></figure>
<figure><img src="image_8.png" /><figcaption>Figure 6: Mean estimated C/N₀ (in dB.Hz) in the induced-multipath situation (Δθ ∈ [0, 2π], Δg = ΔN = 0.64) and nominal C/N₀ of 55 dB.Hz.</figcaption></figure>

## 5.4. Comparison and discussion

To conclude, the true C/N₀, along with the MM, NWPR, and Beaulieu C/N₀, are characterized in each spoofing-induced situation and an analytic expression of the estimator expectation is provided.

In the nominal, induced-jamming, and induced-spoofing scenarios, the correlator output remains ergodic, and the C/N₀ expectation matches the true C/N₀, as modeled in (32), (33), and (34) for the nominal, induced-jamming, and induced-spoofing cases, respectively.

However, in the induced-multipath scenario, the signal is non-ergodic, inducing a bias in each estimator, which no longer converges toward the true value as shown in (39). The MM, NWPR, and Beaulieu expectations are expressed in (50), (61), and (74), respectively. These expectations depend on Δθ and are therefore time-dependent. The model for a nominal C/N₀ = 55 dB·Hz and Δg = 0.64 is represented in Fig. 6. The effect of spoofing varies for each estimator, leading to different magnitudes of degradation. For example, the NWPR, which is quite robust at very low relative frequencies, does not converge at infinite relative frequencies (see Fig. 6b). Finally, we observe a significant effect even at relatively high Δf values (with C/N₀ at 35 dB for each estimator at Δf = 100 Hz).

Finally, as shown in (50), (61), and (74), it is worth noting that the estimated C/N₀ is not proportional to the authentic C/N₀. Moreover, all three C/N₀ estimates converge to a finite value as $P_s \to +\infty$. This implies that the estimated C/N₀ may saturate at a finite level as the signal power increases, leading to a growing C/N₀ degradation.

## 5.5. Discussion: Analysis of authentic and spoofing message mismatch

In this paper, the authentic and spoofed messages (navigation or secondary codes) are assumed to be identical. However,

depending on the spoofing attack, the messages may differ partially or entirely over the interval $I_t$, including spoofing bit transitions occurring within the integration time $T_i$. This subsection discusses the impact of such configurations on the correlator output and the resulting C/N₀.

First, the model of the spoofing correlator output in the presence of a bit transition is derived in Appendix A.6. Considering a bit transition at $t_b \in [0, T_i]$ (where $t_b$ is a multiple of the PRN duration), the correlator model in (17) can then be expressed as

$$ \Lambda(\varepsilon_{\eta}, \Delta\nu) = \Lambda_a(\varepsilon_{\eta}) + \sqrt{\Delta g} \Delta b \Delta d \Lambda_a(\varepsilon_{\eta} + \Delta\eta) + \Lambda_{\chi} + \Lambda_n \quad (82) $$

where $\Delta d = d_s d_a^* \in \{-1, 1\}$ denotes the relative bit between the authentic and spoofing messages, and $d_s$ is chosen as the spoofing bit that occurs most frequently within the integration interval (i.e., the bit at the beginning of the interval if $t_b \ge T_i/2$, and the bit at the end if $t_b < T_i/2$; see Appendix A.6). The parameters $\Delta b$ and $\alpha_b$ are defined as

$$ \Delta b = \alpha_b \frac{\zeta_f((\varepsilon_f + \Delta f) \alpha_b)}{\zeta_f(\varepsilon_f + \Delta f)}, \quad \alpha_b = \frac{T_i - 2t_b}{T_i}. \quad (83) $$

The resulting impact on C/N₀ depends on the spoofing configuration (i.e., whether all spoofed bits differ and whether a bit transition occurs during the integration of the spoofing signal). The spoofing effects on the true and estimated C/N₀ can be categorized as follows:

1. When no bit transition occurs, $\Delta b = 1$ (no impact), and the C/N₀ can be expressed depending on $\Delta d$ as follows:

(a) If the authentic and spoofing bits are different throughout $I_t$, $\Delta d$ is independent (in the time-event sense) of the relative phase $\Delta\theta$, and the bits are uniformly distributed over $I_t$, i.e., $E_t[\Delta d] = 0$. In this configuration, the oscillating terms in both the true and estimated C/N₀ (i.e., those proportional to $\Delta\theta$) are multiplied by $E_t[\Delta d]$ and are therefore zero. Consequently, the true and estimated C/N₀ are equal to
their mean values (in the total-event sense and con-
sidering $\bar{\Delta}\theta$ as random), as shown in Fig. 6.

(b) If the bits are identical over $M' < M$ epochs, the distribution of $\Delta d$ is divided into two disjoint sets: the epochs $I_d$, where the bits are identical, and $\overline{I_d}$, where $\Delta d$ is independent of the relative phase $\Delta\theta$ and uniformly distributed (with $I_t = I_d \cup \overline{I_d}$). Since the two sets are disjoint, the time-event moments can be computed separately. After straightforward computation for each $C/N_0$, we obtain results similar to those presented previously, except that the oscillating terms are reduced by a factor $M'/M$, and the average phase $\bar{\Delta}\theta$ is computed over $I_d$ rather than $I_t$.

2. When a transition bit occurs at $t_b$, but $t_b$ does not vary along $I_t$, the correlator model remains similar to the previous case, except that the relative power is $\Delta b^2 \Delta g$ instead of $\Delta g$. The true and estimated $C/N_0$ can then be determined as in configuration 1. Note that for the NWPR, the bit transition may affect the WB correlator (51) differently (due to the different integration time), which is represented by the parameter $\delta_{WB}$ defined in (62).

3. Finally, when a transition bit occurs at $t_b(k)$ that varies at each epoch (e.g., when the integration time is not equal to the bit duration), the spoofing peak amplitude varies along $I_t$, inducing additional non-ergodic effects and potential distortions depending on the variation of $t_b$. The results in this situation may differ from the proposed results and should be further investigated in future studies.

**6. Simulation and validation**

This section analyzes the $C/N_0$ estimation under spoofing. The theoretical behavior presented in this paper is evaluated and compared with the behavior of the estimators in a Software Defined Radio (SDR) receiver. Four distinct scenarios are considered: jamming, spoofing, low-velocity multipath, and high-velocity multipath. For each scenario, both the true $C/N_0$ and the MM, NWPR, and Beaulieu $C/N_0$ estimates are plotted, with both theoretical and simulated values shown.

On the one hand, the theoretical results are computed from the models presented in Secs. 4 and 5, depending on the scenario. For the jamming and spoofing scenarios, both the true and estimated values are equivalent and are modeled as (33) and (34), respectively. In the two multipath scenarios, the true $C/N_0$ is computed as (39), the MM estimate as (50), the NWPR as (61), and the Beaulieu as (74). In each scenario, the tracking errors $\epsilon_\eta$ are computed based on the model presented in [38], which is not detailed here for brevity. Although $\epsilon_\eta$ is not strictly constant, its variation and corresponding impact on the correlator output can be considered negligible compared to the relative phase $\Delta\theta$ [38, Fig. 11]. Consequently, the assumptions stated in Sec. 3.6 remain valid.

On the other hand, the simulation includes code and phase
tracking loops for tracking the received signal and generating
the tracking errors $\epsilon_\eta$. In addition, the simulator implements
MM, NWPR, and Beaulieu $C/N_0$ estimators, with an estimation

period of 1 s. The simulated true $C/N_0$ is obtained by measur-
ing the ratio between the useful signal and total-average noise
power. The architecture is detailed in [38, Appendix C].

Finally, the relative parameters $\Delta v$ are generated equally for both theoretical and simulated results based on scenario-specific conditions outlined in [3]. Detailed expressions for $\Delta v$ are presented in Appendix F. The value of $N_0$ is generated to reach a nominal $C/N_0$ of 45 dB.Hz for each scenario. For simplicity, since the two noise contributions at the correlator output are Gaussian, only the AWGN contribution is considered in this section, such that $\Lambda_s = \Lambda_n$.

**6.1. Jamming scenario**

The results of the jamming scenario are presented in Fig. 7a, where the $C/N_0$ values are shown on the left axis and the relative power $\Delta g$ is represented in red on the right axis. The theoretical $C/N_0$ values match the simulated results for both true (black), MM (blue), NWPR (purple), and Beaulieu (green) $C/N_0$, confirming the validity of the models and the unbiased behavior of the estimators in the induced-jamming situation.

The figure also illustrates the jamming effect of the spoofer in this scenario, with a $1 + \Delta N$ degradation due to the nominal-plus-re-radiated noise. The $C/N_0$ losses can be quantified using $10 \log(1 + \Delta N)$ (see Eq. (23)). For instance, at $t = 200$ s, the relative power is at its maximum ($\Delta g = 13$ dB), resulting in a $13$ dB $C/N_0$ loss. Conversely, at $t = 0$ s, the relative gain $\Delta g \approx 0$, and the $C/N_0$ aligns with the nominal value of 45 dB.Hz.

**6.2. Spoofing scenario**

The results of the spoofing scenario are presented in Fig. 7b. The theoretical $C/N_0$ values match the simulated ones, validating the models and confirming the unbiased behavior of the estimators in the induced-spoofing situation.

In this scenario, the receiver is tracking the spoofing signal $\hat{\eta} = \eta_s$ (see Sec. 3.5.3). This behavior is reflected in the $C/N_0$ values, as described by Eq. (34). For instance, at low $\Delta g$ (at the beginning and end of the scenario), the true and estimated $C/N_0$ values are approximately $\Delta g C_a/N_0$. At high $\Delta g$ (at $t = 125$ s), the $C/N_0$ approaches $\frac{\Delta g}{\Delta N} C_a/N_0$, which represents the spoofing signal's $C/N_0$ (equal to 45 dB.Hz, as $\Delta N = \Delta g$, as described in Appendix F).

**6.3. Low-velocity multipath scenario**

The results of the low-velocity multipath scenario are depicted in Fig. 8. In the multipath scenarios, the relative frequency $\Delta f$ is represented in red on the right axis. The relative dynamic is generated from Eq. (F.3), and the receiver experiences induced multipath from 0 s to 530 s, with the relative frequency ranging from 0 to -10 Hz (low velocity). This induces a variation in the relative phase $\Delta\theta$ from 0 to -20$\pi$ per second, leading to both constructive and destructive events, as well as non-ergodic phenomena.

The theoretical and simulated $C/N_0$ values align for both true and estimated values, validating the theoretical models and the assumptions about $\Delta\eta$ and $\epsilon_\eta$ outlined in Sec. 3.6. The results can be divided into two regions based on the relative frequency $\Delta f$:
<figure><img src="image_9.png" /><figcaption>Figure 7: C/N₀ in the jamming and spoofing scenarios</figcaption></figure>

* For $t \in [0, 100]$ s ($|\Delta f| < 1$ Hz), the relative phase $\Delta\theta$ can be considered constant over the estimation period $MT_i$. In this case, the signal almost exhibits ergodic properties, and the estimators are unbiased, matching the total-average $C/N_0$, as expressed in (39). Consequently, the $C/N_0$ oscillates between constructive and destructive phases as $\Delta\theta$ evolves.

* For $t \in [100, 530]$ s ($|\Delta f| > 1$ Hz), the variation in the relative phase $\Delta\theta$ becomes significant over the estimation period $MT_i$, making the signals non-ergodic. This results in a deviation between the true and estimated $C/N_0$, varying by estimator type. The NWPR algorithm, based on power measurements, shows a 3 dB reduction (42 dB.Hz for $|\Delta f| \approx 2$ Hz). In contrast, the MM and Beaulieu algorithms, which rely on signal statistics, record reductions of over 21 dB (20 dB.Hz) and 15 dB (30 dB.Hz), respectively. This matches the predicted distortion, as shown in Fig. 6 (for $|\Delta f| < 7$ Hz).

It is important to note that these reductions are primarily due to the GNSS spoofing signal and its impact on the ergodicity of the signal, rather than re-radiated noise.

## 6.4. High-velocity multipath scenario

The results of the high-velocity multipath scenario are depicted in Fig. 9. The relative dynamic is generated from Eq. (F.4), resulting in a higher relative frequency $\Delta f$ (plotted in red), ranging from -20 to -30 Hz (high velocity). The receiver experiences induced multipath from 20 s to 130 s.

The theoretical and simulated $C/N_0$ values align for both true and estimated values. Outside the multipath interval ($t \notin [20, 130]$), the receiver is subject to induced jamming with a

constant $\Delta N$. The re-radiated noise results in a consistent degradation of 2.5 dB, corresponding to $10 \log(1 + \Delta N)$.

Similar to the previous scenario, the estimated $C/N_0$ experiences significant degradation in the induced multipath situation, varying by estimator type and matching the predicted results in Fig. 6. While the NWPR algorithm (Eq. (66)) was only slightly affected at low relative frequencies, it exhibits a decrease of 10 dB for $|\Delta f| \in [20, 35]$ Hz. The Beaulieu $C/N_0$ estimator exhibits its minimum value around 20 dB.Hz (Fig. 6c), as does the MM estimator, which shows a minimum around 25 dB.Hz (Fig. 6a).

Finally, the figure highlights an interesting behavior for $t \in [55, 60]$ s. Within this interval, the relative frequency $\Delta f$ matches the system's Nyquist frequency, $1/2T_i$ (i.e., 25 Hz). Consequently, the same two points of the oscillating correlator output are observed. As a result, depending on the mean phase $\bar{\Delta}\theta$, the apparent oscillation amplitude may vary. For example, in Fig. 9, the receiver underestimates the oscillation amplitude, leading to an increase in the estimated $C/N_0$ (though still below the true value).

## 7. Conclusion

This paper investigates the impact of spoofing on $C/N_0$ estimation, following the classification of spoofing effects proposed in [3]: induced-jamming, induced-spoofing, and induced-multipath.

First, in the induced-jamming situation, the spoofing impact on $C/N_0$ is reduced to the contribution of Gaussian noise (re-radiated noise and spoofing-induced inter-system interference). The $C/N_0$ estimate remains unbiased and accurately reflects the true $C/N_0$, as expressed in (33).

In the induced-spoofing situation, the receiver locks onto the spoofing signal. The $C/N_0$ estimator remains unbiased and cor-
<figure><img src="image_10.png" /><figcaption>Figure 8: C/N₀ in low-velocity multipath scenario (true, MM, NWPR and Beaulieu)</figcaption></figure>

rectly estimates the characteristics of the spoofed signal, as de-
scribed by (34).

Lastly, in the induced-multipath situation, the receiver tracks
a composite signal consisting of both authentic and spoofed
components. The presence of two peaks and their relative time
evolution render the correlator output (17) non-ergodic, intro-
ducing a significant bias in the C/N₀ estimation. This bias has
been analytically characterized, with explicit expressions pro-
vided for the MM, NWPR, and Beaulieu algorithms in (50),
(61), and (74), respectively. These theoretical expectations are
compared with the true C/N₀ model, given by (39). This study
highlights the insidious and powerful jamming effect of proof-
ing in the induced-multipath situation, demonstrating its poten-
tial for severe C/N₀ degradation and strong dependence on re-
ceiver architecture (estimation method) and spoofing geometry
(Δν). Although this aspect is not explored in detail in this pa-
per, it is worth noting that at such levels of degradation, the re-
ceiver may trigger its code loss-of-lock indicator, prompting a
re-acquisition procedure [16, p.394]. In this regard, the present
study, along with [38] (which examines the effects on tracking
loops), reveals the significant impact of spoofing in the induced-
multipath situation (an issue not explored in the literature until
now). These distortions can potentially lead to chaotic behav-
ior, loss of lock, and synchronization bifurcation, underscoring
the critical need for further investigation into this phenomenon.

Note that while these results are derived in the context of
spoofing, they are also applicable to similar multipath-like sit-
uations, such as non-line-of-sight (NLOS) multipath or GNSS
reflectometry. Furthermore, the issue of ergodicity is not lim-
ited to GNSS spoofing but can affect any communication sys-
tem where the transmitted signal cannot be considered constant
(e.g., payload variations, interference, high dynamics, etc.).
Therefore, this study underscores the importance of accounting
for non-ergodic distortions in estimation and signal processing,
motivating the exploration of a probability-based framework.

Future work will further characterize this phenomenon by an-
alyzing the spoofing geometries in which it occurs, depending
on the relative positions of the spoofer, satellite, and receiver,
as well as evaluating its impact on real GNSS receivers. Ad-
ditionally, the results and models presented in this study will
facilitate the development of new C/N₀-based algorithms for
spoofing detection, classification, and mitigation. For exam-
ple, these models, together with the approach proposed in [31],
could be used to establish a theoretical framework for AGC-
to-C/N₀-based classification, similar to the data-driven method
demonstrated in [9]. Finally, future research will focus on re-
fining the theoretical probabilistic framework to deepen our un-
derstanding of non-ergodic estimation in signal processing.

Appendices A - F.

The derivations of the models and results presented in this
paper (Appendix A to Appendix F) are provided in the supple-
mentary material available at PDF.
<figure><img src="image_11.png" /><figcaption>Figure 9: C/N₀ in high-velocity multipath scenario (true, MM, NWPR and Beaulieu)</figcaption></figure>

References

[1] M. L. Psiaki, T. E. Humphreys, Gnss spoofing and detection, Proc. IEEE 104 (6) (2016) 1258–1270.

[2] I. Fernández-Hernández, T. Walter, K. Alexander, B. Clark, E. Châtre, C. Hegarty, M. Appel, M. Meurer, Increasing International Civil Aviation Resilience: a Proposal for Nomenclature, Categorization and Treatment of new Interference Threats, in: Proc. ION ITM 2019, 2019, pp. 389–407.

[3] M. Hussong, E. Ghizzo, C. Milner, A. Garcia-Pena, J. Lesouple, C. Macabiau, Impact of Meaconers on Aircraft GNSS Receivers During Approaches, in: Proc. ION GNSS+ 2023, 2023, pp. 856–880.

[4] J. W. Betz, Effect of Partial-band Interference on Receiver Estimation of C/N0: Theory, in: Proceedings of the 2001 National Technical Meeting of the Institute of Navigation, 2001, pp. 817–828.

[5] P. J. Teunissen, O. Montenbruck, Springer Handbook of Global Navigation Satellite Systems, Vol. 10, Springer, 2017.

[6] K. Wesson, M. P. Rothlisberger, T. E. Humphreys, Practical Cryptographic Civil GPS Signal Authentication, Navigation 59 (3) (2012) 177–193.

[7] A. Jafarnia Jahromi, A. Broumandan, J. Nielsen, G. Lachapelle, GPS Spoofer Countermeasure Effectiveness based on Signal Strength, Noise Power, and C/N0 Measurements, International Journal of Satellite Communications and Networking 30 (4) (2012) 181–191.

[8] N. Spens, D.-K. Lee, F. Nedelkov, D. Akos, Detecting GNSS Jamming and Spoofing on Android Devices, NAVIGATION: Journal of the Institute of Navigation 69 (3) (2022).

[9] D. Miralles, A. Bornot, P. Rouquette, N. Levigne, D. M. Akos, Y.-H. Chen, S. Lo, T. Walter, An Assessment of GPS Spoofing Detection Via Radio Power and Signal Quality Monitoring for Aviation Safety Operations, IEEE Intelligent Transportation Systems Magazine 12 (3) (2020) 136–146.

[10] S. Lo, F. Rothmaier, D. Miralles, D. Akos, T. Walter, Developing a Practical GNSS Spoofing Detection Thresholds for Receiver Power Monitoring, in: Proceedings of the 34th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2021), 2021, pp. 803–815.

[11] C.-L. Chang, J.-C. Juang, Performance Analysis of Narrowband Interference Mitigation and Near-far Resistance Scheme for GNSS Receivers, Signal Processing 90 (9) (2010) 2676–2685.

[12] F. Gallardo, A. P. Yuste, SCER Spoofing Attacks on the Galileo Open Service and Machine Learning Techniques for End-User Protection, IEEE Access 8 (2020) 85515–85532.

[13] K. Radoš, M. Brkić, D. Begušić, GNSS Signal Classification based on Machine Learning Methods, in: 2024 47th MIPRO ICT and Electronics Convention (MIPRO), IEEE, 2024, pp. 806–811.

[14] S. Semanjski, I. Semanjski, W. De Wilde, A. Muls, Use of Supervised Machine Learning for GNSS signal Spoofing
Detection with Validation on Real-World Meaconing and Spoofing Data—Part I, Sensors 20 (4) (2020) 1171.

[15] D. R. Kartchner, R. Palmer, S. K. Jayaweera, Satellite navigation anti-spoofing using deep learning on a receiver network, in: 2021 IEEE Cognitive Communications for Aerospace Applications Workshop (CCAAW), IEEE, 2021, pp. 1–5.

[16] B. W. Parkinson, J. J. Spilker, Progress in astronautics and aeronautics: Global positioning system: Theory and applications, Vol. I, Vol. 163, American Institute of Aeronautics and Astronautics, 1996.

[17] D. R. Pauluzzi, N. C. Beaulieu, A Comparison of SNR Estimation Techniques for the AWGN Channel, IEEE Trans. Commun. 48 (10) (2000) 1681–1691.

[18] N. Beaulieu, A. Toms, D. Pauluzzi, Comparison of Four SNR estimators for QPSK Modulations, IEEE Communications Letters 4 (2) (2000) 43–45.

[19] E. Falletti, M. Pini, L. L. Presti, Low Complexity Carrier-to-Noise Ratio Estimators for GNSS Digital Receivers, IEEE Trans. Aerosp. Electron. Syst. 47 (1) (2011) 420–437.

[20] P. D. Groves, GPS Signal-to-Noise Measurement in Weak Signal and High-Interference Environments, Navigation 52 (2) (2005) 83–94.

[21] A. T. Balaei, A. G. Dempster, L. L. Presti, Characterization of the Effects of CW and Pulse CW Interference on the GPS Signal Quality, IEEE Transactions on Aerospace and Electronic Systems 45 (4) (2009) 1418–1431.

[22] D. Borio, C. O'Driscoll, J. Fortuny, Jammer Impact on Galileo and GPS Receivers, in: 2013 International Conference on Localization and GNSS (ICL-GNSS), 2013, pp. 1–6.

[23] N. Gault, A. Garcia-Pena, A. Chabory, C. Macabiau, L. Shi-Garrier, DME/TACAN Multipath Impact on GNSS L5/E5a Airborne Receivers Part I: C/N0 Degradation Model, IEEE Transactions on Aerospace and Electronic Systems (2024) 1–25.

[24] E. Ghizzo, A. G. Pena, J. Lesouple, C. Milner, C. Macabiau, Assessing GNSS Carrier-to-Noise-Density Ratio Estimation in The Presence of Meaconer Interference, in: Proc. ICASSP 2024, 2024, pp. 8971–8975.

[25] G. Novella, A. Garcia-Pena, C. Macabiau, C/N0 Degradation in Presence of Chirp Interference: Theoretical Model, GPS Solutions 28 (4) (2024) 161.

[26] T. E. Humphreys, J. A. Bhatti, D. Shepard, K. Wesson, The Texas Spoofing Test Battery: Toward a Standard for Evaluating GPS Signal Authentication Techniques, in: Proc. 25th Int. Tech. Meeting Satell. Division of the Inst. of Navigation (ION GNSS), Nashville, TN, USA, 2012, p. 3569–3583.

[27] A. Broumandan, R. Siddakatte, G. Lachapelle, An Approach to Detect GNSS Spoofing, IEEE Aerospace and Electronic Systems Magazine 32 (8) (2017) 64–75.

[28] F. Gianfelici, C. Turchetti, P. Crippa, A non-probabilistic recognizer of stochastic signals based on KLT, Signal Processing 89 (4) (2009) 422–437.

[29] Z.-X. Guo, X.-H. Bai, J.-Y. Li, P.-L. Shui, J. Su, L. Wang, Small target detection in sea clutter using dominant clutter tree based on anomaly detection framework, Signal Processing 219 (2024) 109399.

[30] C. Chen, K. Sun, S. He, An improved image encryption algorithm with finite computing precision, Signal Processing 168 (2020) 107340.

[31] E. Ghizzo, E.-M. Djelloul, J. Lesouple, C. Milner, C. Macabiau, Assessing jamming and spoofing impacts on gnss receivers: Automatic gain control (agc), Signal Processing 228 (2025) 109762.

[32] A. Papoulis, S. U. Pillai, Probability, Random Variables, and Stochastic Processes, Fourth Edition, McGraw-Hill Europe: New York, NY, USA, 2002.

[33] P. Walters, An Introduction to Ergodic Theory, Vol. 79, Springer Science & Business Media, 2000.

[34] B. Porat, Digital Processing of Random Signals: Theory and Methods, Courier Dover Publications, 2008.

[35] P. R. Halmos, Measure theory, Springer, 1974.

[36] T. E. Humphreys, B. M. Ledvina, M. L. Psiaki, B. W. O'Hanlon, P. M. Kintner, et al., Assessing the Spoofing Threat: Development of a Portable GPS Civilian Spoofer, in: Proceedings of the 21st International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 2008), 2008, pp. 2314–2325.

[37] J. W. Betz, B. M. Titus, Intersystem and Intrasystem Interference with Signal Imperfections, in: PLANS 2004. Position Location and Navigation Symposium, IEEE, 2004, pp. 558–565.

[38] E. Ghizzo, M. Hussong, J. Lesouple, C. Milner, A. Garcia-Pena, C. Macabiau, Assessing spoofer impact on gnss receivers: Tracking loops, NAVIGATION: Journal of the Institute of Navigation 72 (4) (2025).

[39] M. Foucras, J. Leclère, C. Botteron, O. Julien, C. Macabiau, P.-A. Farine, B. Ekambi, Study on the Cross-correlation of GNSS Signals and Typical Approxiations, Gps Solutions 21 (2) (2017) 293–306.