# Explainable AI Assisted IoMT Security in Future 6G Networks
## 1 Introduction  
Advancements in wireless communication have revolutionized healthcare, enabling innovations like surgical robotics, real-time remote monitoring, and XR (extended reality)-assisted treatments, benefiting rural, remote, and emergency care [1, 2]. The rise of the Internet of Medical Things (IoMT) has further improved patient care through continuous data access, supporting timely interventions and personalized treatments [3]. Future 6G networks are expected to accelerate these advancements with ultra-low latency, massive device connectivity, and seamless AI and edge cloud integration. According to the ITU-R M.2160 framework, 6G will enable network-wide AI integration, multi-access edge computing (MEC), enhanced XR, and integrated sensing and communication for more efficient, intelligent, and responsive real-time patient care [4, 5]. These advancements brought by the integration of 6G networks in healthcare are anticipated to introduce substantial security challenges. The incorporation of sensing, edge computing, and cloud services expands the attack surface, putting critical medical devices like cardiac monitors, infusion pumps, and respirators at risk from both internal and external threats [6]. Introducing AI further exposes healthcare systems to adversarial and model poisoning attacks, endangering patient safety [7]. Additionally, immersive technologies, such as AR-assisted surgeries, introduce new vulnerabilities, offering potentialentry points for unauthorized access [4; 8]. The fragmented management of edge and cloud infrastructures increases system vulnerabilities, making it more challenging to maintain data integrity [9]. As 6G networks integrate with public land mobile networks (PLMNs), traditional threats like DDoS, MiTM attacks, and SYN floods will intensify, alongside more sophisticated attacks [10]. The rapid growth of IoMT devices, edge nodes, and real-time data streams adds risks, such as disruptions in telemedicine or remote surgeries due to DDoS-induced outages or network congestion, with indicators like high CPU usage and memory depletion [11; 12]. Other concerns, like eavesdropping, session hijacking, and spoofing, can be detected through latency spikes or unusual traffic patterns, threatening patient safety and network integrity [12; 13]. As 6G networks rely more heavily on edge computing and cloud infrastructure, securing these decentralized environments will become significantly more complex than current network configurations [13]. Edge nodes processing real-time healthcare data are prime targets for attacks, with CPU disruptions and network anomalies serving as early indicators of potential intrusions. The challenge is further compounded by the lack of centralized control, as managing these nodes across multiple operators complicates real-time attack detection and mitigation [13]. Unauthorized access to critical systems could allow attackers to manipulate patient records, inject malicious data, or disable monitoring systems, resulting in incorrect diagnoses, delayed treatment, or the failure of life-saving procedures [14]. As 6G networks evolve and integrate with existing networks, strengthening the security frameworks for these decentralized systems is crucial for ensuring safe and resilient healthcare services. Explainable AI (XAI) can help address these challenges by providing transparent, actionable insights into AI-driven decision-making, enabling healthcare providers to effectively identify and respond to security threats [15; 16]. This paper explores the critical role of XAI in healthcare applications within IoMT environments, utilizing methods such as Shapley Additive Explanations (SHAP) [17], Local Interpretable Model-agnostic Explanations (LIME) [18], and Diverse Counterfactual Explanations (DiCE) [19], supported by an advanced dataset derived from an IoT wireless medical testbed [5]. To enhance our research outcomes, we cross-validated feature importance using XAI methods to identify consistent indicators of attack and normal traffic.