## 1 Introduction  
Wireless communication systems are heavily dependent on the propagation channels where the signal is transmitted. Thus, knowledge of the propagation channel can be useful information to improve the quality of transmissions. An essential distinction is between Line of Sight (LOS) and Non-Line-of-Sight (NLOS) propagation scenarios because of their significant impact on the transmitted signal, which can degrade the Quality of Service (QoS). Knowledge of this information can be used to apply mitigation techniques in the signal processing stage to improve various wireless communication functions like physical layer scheduling, network engineering, beam selection, and resource management in wireless communication networks [1; 2]. In general, the design of channel classifiers has to achieve a balance in the trade-off between computing time and accuracy in the correct identification of the LOS/NLOS channel status. In the literature, different approaches have been proposed, from channel identification based on statistical analysis (i.e., using metrics like the K-factor in the Rician fading model [3] and the Root Mean Square (RMS) delay spread or the mean access delay in [4]) to recent developments based on the application of shallow and deep learning algorithms [5; 6]. For simplicity, throughout the rest of this paper, shallow machine learning algorithms are indicated with the term ML while deep learning algorithms are indicated with the term DL, even if it is acknowledged that machine learning usually includes deep learning. Even if Deep Learning (DL) has demonstrated a superior classification performance in LOS/NLOS classification problems [7; 8], the computing needs are severe, resulting in long computing times for training and prediction. For this reason, this paper focuses only on ML. As described in the subsequent section, Section 2, a number of studies have applied Machine Learning (ML) algorithms to channel classification in recent times, but a key aspect has not been addressed: as in other ML domains, adversarial attacks aimed to hamper the proper functioning of ML algorithms have been largely ignored. Thus, this paper aims to address this gap by proposing an analysis of poisoning attacks in the application of ML to LOS/NLOS classification using Outlier Detection (OD) algorithms. In particular, this paper addresses the specific case of UltraWideBand (UWB) LOS/NLOS classification. The analysis is based on the assumption that poisoned samples may appear to be outliers in the data set on the basis of the outlier score provided by the OD algorithm (the higher the score, the higher the probability that the sample is an outlier). Then, OD algorithms are used both to identify the poisoned samples via ML and to'sanitize' the model by using only a percentage of the samples that have a lower outlier score. Poisoning attacks can be of different types with different underlying algorithms and severity. This paper conducts an extensive study on the impact of the type of attack and severity focusing on the so-called data poisoning class of attacks as indicated in [9], which includes the label flipping attack and the samples randomization alteration. In addition, this paper proposes a novel attack based on the OD algorithms themselves. This attack is inspired by the perturbation attack in the literature where the feature values are modified using random noise. In the novel attack proposed in this paper, the attacker also has knowledge of the most likely values of the features for each class. This is a more sophisticated attack than the second attack and it requires that the attacker have knowledge of (or have acquired) a representative (for a specific class) number of samples. In this study, this attack is emulated by choosing the 100 samples returned by the Sparse Data Observers (SDO) algorithm (one of the OD algorithms used in this paper) for each label with the lowest scores (a lower score indicates a more representative sample of a specific class).