“GPS denied” is not one condition. It is at least four, and they are not variations of each other. They produce different receiver behaviour, they need different detection, and the mitigations that work for one are useless against another.

Three of those failures leave the aircraft uncertain. One leaves it confident and wrong. Confident and wrong is the dangerous state, it receives the least engineering attention relative to how bad it is, and that mismatch is the argument of this post.

The four modes

Absence. No usable signal reaches the antenna. Indoors, under dense canopy, in an urban canyon, under a bridge. The receiver reports loss of fix. Every part of the system downstream knows immediately that it has no position.

Jamming. Deliberate or incidental RF noise raises the noise floor until the receiver cannot pull the signal out of it. GNSS signals arrive at roughly minus 160 dBW, which is well below the thermal noise floor, and the receiver only recovers them through the processing gain of correlating against a known code. Jamming attacks that margin directly. A jammer at a few watts can deny a receiver over a useful radius. The receiver again reports degraded or lost fix.

Spoofing. A transmitter sends counterfeit signals that look like real satellites. The receiver locks onto them, computes a solution, and reports a valid fix with good dilution of precision and a healthy satellite count. Everything looks correct. The position is wrong, or the time is wrong, or both, and the aircraft acts on it.

Multipath. Real signals arrive after reflecting off terrain, water or buildings. The receiver sees a delayed copy of a genuine signal, which biases the pseudorange and pushes the position estimate off by anywhere from a metre to tens of metres. No warning, no obvious fault, just a solution that is quietly worse than the reported accuracy suggests.

Only the first two announce themselves.

Why spoofing is the interesting case

A receiver’s job is to trust the signals it receives. The civil GPS C/A code is public and unauthenticated by design, because that is what makes it a public utility. Anyone with a software-defined radio and open-source code can generate signals that satisfy every check a standard receiver performs.

The scale is no longer theoretical. OPSGROUP’s GPS Spoofing WorkGroup documented roughly a 500 percent increase in spoofing incidents through 2024, peaking at an average of about 1,500 spoofed flights per day, with around 41,000 flights affected in a single month between mid-July and mid-August 2024. Daily affected flights rose from roughly 200 in the first quarter of 2024 to about 900 by the second quarter. These are commercial airliners with certified avionics and crews trained to cross-check, and it still causes problems.

For an autonomous aircraft there is no crew to notice that the map looks wrong.

The failure chain is worth spelling out, because the position error is not the end of it. Most flight stacks fuse GNSS with an inertial measurement unit in an extended Kalman filter. The IMU integrates acceleration and angular rate and drifts over time. GNSS is the absolute reference that corrects the drift. When you feed the filter a slowly walking false position, the filter does not reject it. It updates its state, and over time it also updates its estimate of IMU bias to be consistent with the false reference. The corruption propagates into the part of the system that was supposed to be the independent check.

A spoofer that jumps the position by a kilometre gets caught by any sane innovation gate. A spoofer that walks it at one metre per second does not.

There is a second-order effect that people forget. GNSS receivers also provide time. Time discipline feeds logging, sensor timestamp alignment, and in some architectures the scheduling of the control loop itself. Spoofed time can desynchronise a system that has no position error at all.

What detection actually looks like

None of these are exotic. Most of them are underused.

Receiver autonomous integrity monitoring. With more satellites than the four needed for a fix, the redundant measurements should be consistent. RAIM tests that consistency and flags the outlier. It works well against a single faulty satellite. It works poorly against a spoofer transmitting a self-consistent constellation, because there is no inconsistency to find.

Multi-constellation and multi-frequency. GPS, Galileo, GLONASS and BeiDou on L1 and L5 is four systems and two bands. A spoofer has to fake all of them coherently to stay undetected. Most do not. This is the cheapest meaningful improvement available and a lot of hardware already supports it.

Signal-level checks. Automatic gain control level, carrier-to-noise density ratio, and the shape of the correlation peak all change under spoofing. A spoofer usually transmits at higher power than the genuine signal, which the AGC sees. A distorted or split correlation peak indicates two signals competing for the same code. These require a receiver that exposes the measurements, which many cheap modules do not.

Angle of arrival. Real satellites are spread across the sky. A ground spoofer is a single point source. Two or more antennas with known separation can measure the direction each signal arrives from, and if every signal comes from one bearing, that is conclusive. This is the strongest available check and it costs an extra antenna and the processing to use it.

Inertial cross-check with a bounded window. The IMU is only useful as a check if you let it disagree. That means computing the innovation between the GNSS update and the inertial prediction, and treating sustained small innovations as suspicious rather than smoothing them away. The filter’s default behaviour is to trust and absorb. Detection requires the opposite instinct.

The part that is usually missing

Detection produces a signal. Something has to decide what to do with it.

That is an arbitration problem, and it is genuinely hard, because the arbitration layer has to choose between sources that each claim to be correct while the aircraft is still flying. Declaring GNSS untrusted and switching to inertial dead reckoning has a cost that grows with time. Declaring it trusted when it is not has a cost that is unbounded. Getting this wrong in either direction is worse than a receiver that simply reports loss of fix.

In most stacks I have looked at, this decision does not exist as a named component. GNSS is either healthy or not, the flag comes from the receiver, and the receiver is the thing being attacked. Nobody is selling that layer either, which follows, because you cannot productise a component that has not been named.

The useful engineering question is not how to detect spoofing. That is largely solved and documented. The question is what a vehicle should do in the seconds after detection, and how it decides, and how it degrades. That part is still mostly open, and open parts of a stack everyone depends on are where the value sits.

If you are building something

Log the raw measurements, not just the fix. Carrier-to-noise per satellite, AGC level, dilution of precision, satellite count and identifiers. You cannot diagnose an event you did not record, and the fix alone tells you nothing about how it was obtained.

Treat the innovation sequence in your filter as a first-class telemetered output. If you cannot see how much your GNSS update disagreed with your inertial prediction, you cannot see an attack in progress.

Test with real interference, in a chamber or on a range, with permission. Simulated spoofing in software tests your model of a spoofer, which is not the same thing.

The receiver is a solved product. Deciding whether to believe it is not, and that is the part worth building.

Related: