## 2 Related Work  
The investigation of poisoning attacks in ML for LOS/NLOS classification is a new field with no studies identified by the author so far. On the other hand, the literature comprises significant and recent studies on the application of ML for LOS/NLOS classification and on poisoning attacks in ML and DL. The aim of this section is to provide an overview of both areas, which does not aim to be exhaustive because of the presence of other extensive surveys on these topics. In particular, this section focuses on the following: (1) the application of ML only (not DL) to LOS/NLOS classification, and (2) the analysis of related work on adversarial ML and poisoning attacks specifically for the wireless communication domain. From a historical point of view, the problem of channel identification exploited the application of statistical wireless channel models, whose parameters (parameter m in Nakagami models) were estimated using measurement campaigns in real scenarios. Recent studies have applied ML techniques as explained in two recent surveys [10; 11]. In many studies, the application of ML is related to the extraction of features from the transmitted signal, which is given as input to the classifier. Some examples of this approach can be found in [1]; standard deviation, skewness, and kurtosis were used in [1; 5; 12; 13], Shannon entropy in [14], and cumulants in [15]. Different ML algorithms have been applied. As described in [10], the most common algorithms are K Nearest Neighbor (KNN), Support Vector Machine (SVM), and Decision Tree-Random Forest (DT-RF). In particular, Decision Tree (DT) and Radio Frequency (RF) were used in [16; 17] and the latter is also adopted in this paper. The features can be extracted not only from the time domain but also from the spectral domain or even from the modes resulting from the application of mode decomposition algorithms like Variational Mode Decomposition (VMD) as in [6], even if there is the potential trade-off that the mode decomposition implementation can be time consuming. A recent survey on adversarial attacks in wireless communication is presented in [18], where it is recognized that the potential security problems of DL in wireless applications have not been fully studied yet. Thus, vulnerabilities in ML and DL may open up opportunities for small-scale adversarial attacks to cause chaos in the model's performance. A study similar to ours is [19], where poisoning attacks are investigated for the application of DL to signal modulation classification, which is a different problem from LOS/NLOS classification. An OD algorithm was exploited to detect poisoned samples from legitimate samples resulting from the execution of a label flipping attack (as in this study). On the other hand, other attacks investigated in this paper have not been considered. A binary classification was performed as in this study but it is based on a Convolutional Neural Network (CNN) in [19], rather than the Random Forest (RaF) algorithm used here. Another example is [20], which focused on poisoning attacks in traffic prediction problems, where a perturbation is added to the legitimate samples during the model training phase to emulate a poisoning attack in a traffic classification problem in cellular networks. The proposed attack is similar to one of the attacks considered in this study, but the OD algorithms proposed in this study are not applied (the feature space is augmented on the basis of characteristics of the specific problem). In addition, [20] is specifically applied to DL algorithms while this paper is focused on ML. Regarding other aspects pertaining to poisoning attacks and ML in the literature, extensive literature surveys are offered in [9; 21; 22], to which the interested reader can refer.