## 4 Threat Model for O-RAN Optimization
### Key Background Information for O-RAN Security and Adversarial ML Research  
This research area focuses on securing Open Radio Access Networks (O-RANs), with particular attention to the threat landscape created by the integration of ML throughout the RAN, especially in distributed and Intelligent Controllers (such as xApps/rApps operating in Near-Real-Time and Non-Real-Time RIC modules). Several unique features of O-RAN and its ML workflows drive new challenges and opportunities:  
1. **O-RAN Architecture and Interfaces Disaggregation and Openness:** O-RAN standardizes open interfaces (such as A1, E2, and O1/O2), promotes a separation of control and data planes, and enables components from multiple vendors to interoperate. This openness improves flexibility and innovation but expands the overall system attack surface [46, 47]. **RIC, xApps, and rApps:** The RAN Intelligent Controller (RIC) includes the Near-Real-Time (near-RT RIC), which executes xApps for control and optimization in timescales on the order of 10 ms to 1 s, with rApps running in the non-RT RIC for slower analytics and policy management [46]. xApps/rApps are software applications, often ML-driven, that execute optimization, resource management, or inference tasks within the RIC framework [48, 49, 50]. 2. **Embedded ML and FL:** O-RAN increasingly deploys distributed ML, such as FL, to allow model training without centralizing sensitive data. FL workflows may operate across multiple nodes (O-Cloud, edge, RUs) and interact with a central aggregator [46, 51]. \begin{table}
\begin{tabular}{p{42.7 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Ref** & **Title (Year)** & **Key Techniques** & **Key Contribution** & **ZT + FL?** & **Validation** & **Limitations** \\ \hline
[45] & Zero Trust Security for 6G O-RAN (2024) & Blockchain ZT, Federated MARL & First ZT + FL integration for threat detection & Yes & ✓ & No O-RAN testbed \\ \hline
[37] & Blockchain Meets O-RAN (2024) & Blockchain Auth, Decentralized ZT & Dynamic xApp access control & No & \(\wedge\) & No FL integration \\ \hline
[38] & OZTrust (2023) & Per-packet ZT, Policy Mgmt & Fine-grained xApp access & No & \(\wedge\) & No FL/privacy \\ \hline
[39] & FL for Jamming Mitigation (2024) & Federated DRL & Distributed jamming defense & No & ✓ & No ZT integration \\ \hline
[43] & FL Reputation in O-RAN (2025) & Blockchain Reputation, Smart Contracts & On-chain FL accountability & No & \(\wedge\) & Conceptual only \\ \hline
[42] & FL Anomaly Detection (2024) & Hierarchical FL & 99\% anomaly accuracy on testbed & No & \(\wedge\) & No ZT/ microsegmentation \\ \hline
[44] & HSADR (2024) & Secure Aggregation, DP & Dropout-resilient FL for RAN & No & ✓ & Not O-RAN-specific \\ \hline
[41] & OpenAI dApp (2023) & Federated RL dApps & Distributed RL platform for O-RAN & No & \(\wedge\) & Limited security details \\ \hline \hline  & & ✓ = Simulations, \(\wedge\) = Testbed/Prototype. & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Summary of key papers on O-RAN security and privacy. **ML-Driven Optimization:** Example use cases include interference classification, resource allocation, and connection management, leveraging deep neural networks, graph neural networks, and reinforcement learning methods within xApps/rApps [27; 48; 49; 52]. **Adversarial ML Attacks:**  
* _Data Poisoning:_ Malicious input gradients or training points can subvert FL models [27; 49; 51; 53]. * _Evasion (Adversarial Examples):_ Small, well-crafted perturbations cause inference-time misclassifications in deployed models [48; 49; 52]. * _Model Inversion/Extraction:_ Attackers may attempt to infer private training data or extract model parameters, though this is mentioned conceptually more than empirically evaluated [53]. * **Attack Surface and Multi-Vector Threats**  
**System and Interface Layer Threats:** Attackers may exploit vulnerabilities in O-RAN components (RIC software, xApps/rApps, container orchestration), open interfaces (A1, E2), or even hardware/virtualization layers.