AI-Native Air Interface Exposes Physical Backdoor

This is a sharp warning that AI-native radio systems inherit supply-chain risks from machine learning while adding physical-world consequences.

• –CRNet reached 100% attack success with 0.5% poisoning; CsiNet required 5%, with no measurable clean-performance cost.
• –The same trigger transferred to beam prediction at 99.5% success, showing how one poisoned pipeline can affect multiple standardized functions.
• –Hijacked feedback reduced a victim’s rate by 98% and concentrated 88% of available array gain toward the attacker in the authors’ setup.
• –Statistical detectors weakened under adaptive attacks, while behavioral consistency checks remained effective.
• –Telecom developers need signed model artifacts, dataset provenance, adversarial cross-function testing, runtime behavior monitoring, and reliable fallback paths to conventional algorithms.