CUTE-Spoof Track: Quantum-Inspired Multi-Sensor UAV Tracking Under Adversarial Spoofing

1. Introduction

Unmanned Aerial Vehicles (UAVs) increasingly operate in adversarial environments where malicious actors exploit vulnerabilities in sensing and navigation pipelines. Spoofing attacks—including trajectory drift, ghost target injection, mirrored cluster fabrication, and burst-style false detections—corrupt multi-sensor measurements and destabilize data association. Classical multi-target tracking algorithms such as JPDA, GNN, and MHT rely on deterministic gating and linear assignment logic, making them highly sensitive to spoof-induced perturbations. Even small adversarial distortions can trigger assignment flips, fragmented track continuity, and severe trajectory drift.

Deep learning has improved feature extraction and temporal modeling for tracking [1,2,3,4], yet these models remain vulnerable to spoofing because they collapse decisions prematurely and lack explicit spoof-awareness. Meanwhile, quantum-inspired models have demonstrated promising capabilities for uncertainty modeling, non-classical correlation encoding, and robust inference in complex environments [5,6,7]. However, existing quantum-inspired tracking pipelines do not address multi-sensor spoofing, nor do they provide reproducible benchmarks for evaluating spoof resilience.

To address these gaps, we introduce the Quantum Unified Trajectory Estimator (CUTE-SpoofTrack), a quantum-inspired multi-sensor spoof-resilient tracking framework and benchmark. Building upon our prior work on spoof-aware UAV tracking [8] and quantum-enhanced reasoning in robotics and communication systems [5,6], the proposed framework integrates deep spoof detection, confidence-aware multi-sensor fusion, and a Deep Quantum Neural Network (DQNN) for assignment reasoning. The DQNN leverages qubit-based superposition, Hadamard branching, and CNOT dependency encoding to maintain multiple plausible association hypotheses until sufficient evidence emerges. This non-classical assignment mechanism mitigates premature decision collapse and provides robust inference under spoof pressure.

Beyond algorithmic design, CUTE-SpoofTrack introduces a reproducible benchmark for evaluating spoof-aware tracking across classical, deep learning, and quantum-inspired architectures. The benchmark includes diverse spoof types, multi-sensor corruption scenarios, interpretability overlays, and standardized evaluation metrics. Unlike existing datasets such as KITTI [9] and MOT [10], which lack adversarial spoofing, CUTE-SpoofTrack provides a unified platform for studying spoof-induced assignment drift, fusion instability, and trajectory degradation.

The theoretical foundations of CUTE-SpoofTrack establish continuity, margin-based robustness, KL-stability, and spoof-aware amplitude suppression for the DQNN assignment distribution. These properties address the discontinuity of classical argmax-based trackers and provide formal guarantees for spoof resilience. Numerical evaluations confirm these theoretical results, demonstrating that the quantum-enhanced CUTE estimator significantly improves trajectory continuity, reduces assignment divergence, and maintains stable tracking under adversarial spoofing.

Overall, CUTE-SpoofTrack advances the state of the art in spoof-aware UAV tracking by combining quantum-inspired reasoning, deep spoof detection, multi-sensor fusion, and benchmark-driven evaluation. It provides both a robust tracking architecture and a scientifically transparent platform for future research in adversarial autonomy.

1.1. Related Work

Classical Multi-Target Tracking. Traditional radar-based tracking pipelines rely on Kalman filtering, JPDA, GNN, and MHT for multi-target association. These methods assume statistical consistency between predicted and observed measurements, making them vulnerable to spoofing attacks that inject falsified detections or distort trajectory continuity [11,12]. Their deterministic gating logic often collapses under adversarial perturbations, leading to assignment drift and fragmented tracks.

Deep Learning-Based Tracking. Learning-based approaches—including CNNs, LSTMs, GNNs, and transformer-based predictors— offer improved adaptability and feature extraction capabilities [1,2,3,4,13,14,15]. However, these models typically lack explicit spoof-awareness and provide limited interpretability when adversarial detections corrupt the input space.

Quantum-Inspired Models. Quantum neural networks and quantum-inspired inference mechanisms have recently emerged as promising tools for modeling uncertainty and non-classical correlations [5,6,7]. Despite these advantages, existing quantum-inspired models do not address multi-sensor spoofing, nor do they provide reproducible benchmarks for evaluating spoof resilience.

Spoofing Benchmarks and Datasets. Popular tracking datasets such as KITTI [9] and MOT [10] provide rich annotations for object tracking but lack adversarial spoof scenarios. GNSS and Wi-Fi spoofing benchmarks focus primarily on signal-level spoof detection [8,16,17], without addressing radar cluster manipulation or trajectory drift quantification. Recent studies have explored spoof-aware pipelines—e.g. Kalman-based GNSS spoof detection [18], interpretability modules for wireless spoofing [19], and diffusion-based spoof classification [20]—but none provide a unified, tracker-agnostic, reproducible evaluation framework.

Gap Analysis. To date, no open-source benchmark supports:

• diverse spoof types (drift, ghost, mirror, burst, multi-ghost),
• tracker-agnostic evaluation across JPDA, GNN, and quantum-inspired models,
• reproducible spoof injection and visualization pipelines,
• interpretability overlays for scientific transparency,
• multi-sensor fusion under adversarial corruption.

These gaps motivate the development of CUTE-SpoofTrack.

1.2. Contributions

This work makes the following key contributions:

• Quantum-Inspired Spoof-Resilient Tracking Architecture. We introduce the Quantum Unified Trajectory Estimator (CUTE), a Deep Quantum Neural Network (DQNN) that leverages qubit-based superposition, Hadamard branching, and CNOT dependency encoding to maintain multiple plausible assignment hypotheses and provide robust inference under spoof pressure.
• SpoofNet: Deep Spoof Detection Module. A CNN–LSTM classifier identifies spoof-induced anomalies in Doppler signatures, jitter profiles, and temporal inconsistencies. SpoofNet produces spoof probability scores that dynamically gate corrupted detections and modulate DQNN amplitudes.
• Confidence-Aware Multi-Sensor Fusion. We design a modular fusion engine that weights sensor inputs based on spoof classification certainty, enabling resilient aggregation even when radar, GNSS, or Wi-Fi measurements are corrupted or adversarially manipulated.
• CUTE-SpoofTrack Benchmark. We introduce a reproducible benchmark with standardized simulation scenarios for drift, ghost, mirror, burst, and multi-ghost spoofing. The benchmark supports evaluation across JPDA, GNN, and quantum-inspired architectures.
• Interpretability and Quantum Gate Activation Overlays. We provide cluster-based overlays, trajectory continuity plots, spoof rejection boundaries, and quantum gate activation visualizations to enhance scientific transparency.
• Theoretical Guarantees for Spoof Resilience. We establish continuity, margin-based robustness, KL-stability, and spoof-aware amplitude suppression for the DQNN assignment distribution.
• Comprehensive Numerical Evaluation. We compare CUTE-SpoofTrack against JPDA, GNN, CNN, LSTM, and fusion-agnostic baselines, demonstrating significant improvements in spoof detection accuracy, assignment stability, trajectory continuity, and recovery after spoof removal.

2. System Model

This section establishes the sensing, spoofing, fusion, and quantum-inspired assignment models that form the foundation of the proposed CUTE-SpoofTrack framework (see Section 3). These components define the mathematical structure used throughout the paper; subsequent sections build upon these definitions rather than reintroducing them.

2.1. UAV Sensing and Measurement Model

A UAV equipped with heterogeneous sensors produces the multi-modal measurement set

$$Z_t=\{z_t^{\left(1\right)},z_t^{\left(2\right)},\dots ,z_t^{\left(S\right)}\},$$

(1)

where S denotes the number of sensing modalities (radar, GNSS, Wi-Fi, IMU). Each sensor s generates detections

$$z_t^{\left(s\right)}=\{D_{t,1}^{\left(s\right)},\dots ,D_{t,N_s}^{\left(s\right)}\},$$

(2)

containing Doppler signatures, range/angle estimates, jitter profiles, and temporal metadata. The true UAV state evolves according to

$$x_{t+1}=f\left(x_t\right)+w_t,$$

(3)

with process noise $w_t$, while sensor observations follow

$$D_{t,j}^{\left(s\right)}=h_s\left(x_t\right)+v_{t,j}^{\left(s\right)},$$

(4)

where $h_s(·)$ is the modality-specific observation function and $v_{t,j}^{\left(s\right)}$ is measurement noise.

2.2. Spoof Injection Model

Spoofing corrupts the measurement set through an adversarial operator

$${\tilde{Z}}_t=\mathcal{S}\left(Z_t\right),$$

(5)

which may inject, distort, or mirror detections. CUTE-SpoofTrack supports five spoof types:

• Drift spoofing: gradual displacement,

  $$D_{t,j}^{\left(s\right)}\mapsto D_{t,j}^{\left(s\right)}+{\delta }_t,$$

  (6)

  where ${\delta }_t$ is a time-varying spoof displacement vector.
• Ghost injection: synthetic detections,

  $$Z_t\mapsto Z_t\cup {\mathcal{G}}_t,$$

  (7)

  where ${\mathcal{G}}_t$ is the set of injected ghost detections at time t.
• Mirror spoofing: reflection across a spoof axis,

  $$D_{t,j}^{\left(s\right)}\mapsto R_{\mathrm{mirror}}{D}_{t,j}^{\left(s\right)},$$

  (8)

  where $R_{\mathrm{mirror}}$ is a reflection operator defining the spoof axis.
• Burst spoofing: high-rate injection of short-lived false targets,

  $$Z_t\mapsto Z_t\cup {\mathcal{B}}_t,$$

  (9)

  where ${\mathcal{B}}_t$ is a burst set of short-lived spoof detections.
• Multi-ghost spoofing: coordinated adversarial clusters,

  $$Z_t\mapsto Z_t\cup {\mathcal{G}}_t^{\left(1\right)}\cup \cdots \cup {\mathcal{G}}_t^{\left(K\right)},$$

  (10)

  where ${\mathcal{G}}_t^{\left(k\right)}$ denotes the k-th coordinated ghost cluster.

These spoof types introduce ambiguity in the assignment space and destabilize classical JPDA/GNN trackers.

2.3. SpoofNet: Deep Spoof Classification

Building on the spoof operator in (5), SpoofNet assigns a spoof probability to each detection. Given $D_{t,j}^{\left(s\right)}$, SpoofNet computes

$$p_{\mathrm{spoof}}\left(D_{t,j}^{\left(s\right)}\right)=f\left(g_{\mathrm{LSTM}}\left(g_{\mathrm{CNN}}\left(D_{t,j}^{\left(s\right)}\right)\right)\right),$$

(11)

where $g_{\mathrm{CNN}}$ extracts spatial features, $g_{\mathrm{LSTM}}$ captures temporal spoof signatures, and $f(·)$ is a logistic activation. These probabilities modulate fusion weights and quantum amplitudes in the DQNN tracker.

2.4. Quantum-Inspired Assignment Model

After spoof probabilities are computed, the DQNN tracker encodes feasible assignments $\mathcal{A}$ in a quantum-inspired state

$$|{\mathrm{\Psi }}_t\rangle =\sum _{A\in \mathcal{A}}{c}_A\left(Z_t\right)|A\rangle ,$$

(12)

where $c_A\left(Z_t\right)$ are spoof-aware quantum amplitudes. Each track–detection pair $(i,j)$ is represented by a qubit

$$|q_{ij}\rangle ={\alpha }_{ij}|0\rangle +{\beta }_{ij}|1\rangle ,$$

(13)

initialized via a Hadamard gate

$$|q_{ij}^{\left(0\right)}\rangle =H|0\rangle =\frac{1}{\sqrt{2}}\left(\right|0\rangle +|1\rangle ),$$

(14)

and modulated by SpoofNet probabilities as

$$|q_{ij}\rangle =\sqrt{1-p_{\mathrm{spoof}}\left(D_j\right)}|1\rangle +\sqrt{p_{\mathrm{spoof}}\left(D_j\right)}|0\rangle .$$

(15)

Assignment consistency is enforced through CNOT operations

$${\mathrm{CNOT}}_{\left(ij\right)\to \left(ik\right)}:|q_{ij},q_{ik}\rangle \mapsto |q_{ij},q_{ik}\oplus q_{ij}\rangle ,$$

(16)

and a deep neural network parameterizes the measurement operator

$${\widehat{M}}_{\theta }:|{\mathrm{\Psi }}_t\rangle \mapsto |{\mathrm{\Psi }}_t^{\left(\mathrm{out}\right)}\rangle ,$$

(17)

yielding assignment probabilities

$$P_{\mathrm{DQNN}}(A\mid Z_t)={\left|\langle A|{\mathrm{\Psi }}_t^{\left(\mathrm{out}\right)}\rangle \right|}^2.$$

(18)

2.5. Multi-Sensor Fusion Model

SpoofNet outputs drive confidence-aware fusion. Each modality receives a spoof-aware confidence weight

$${\sigma }_s=1-{\displaystyle \frac{1}{N_s}}{\displaystyle \sum _{j=1}^{N_s}}{p}_{\mathrm{spoof}}\left(D_{t,j}^{\left(s\right)}\right),$$

(19)

and fusion aggregates weighted detections:

$$Z_t^{\left(\mathrm{fused}\right)}={\displaystyle \sum _{s=1}^S}{\sigma }_s{Z}_t^{\left(s\right)}.$$

(20)

The fused set is provided as input to the DQNN tracker, ensuring robustness against corrupted or missing sensor logs.

3. Quantum-Enhanced Multi-Sensor Spoof-Resilient Tracking Framework (CUTE-SpoofTrack)

Building upon the system model in Section 2, the proposed CUTE-SpoofTrack framework integrates multi-modal sensing, spoof characterization, confidence-aware fusion, and quantum-inspired trajectory estimation into a unified pipeline for spoof-resilient UAV navigation (Figure 1). This section describes how the sensing, spoofing, fusion, and DQNN components interact operationally, without reintroducing the underlying mathematical definitions already established in Section 2.

3.1. Multi-Sensor Acquisition

CUTE-SpoofTrack begins with multi-modal sensing from radar, GNSS, and Wi-Fi platforms. As defined in Section 2, these modalities collectively produce the measurement set $Z_t$. Radar contributes Doppler and range information, GNSS provides position and velocity, and Wi-Fi supplies RSSI and timing features. Together, these heterogeneous measurements offer complementary and cross-validating observations of the UAV trajectory, forming the raw input to the spoof injection and spoof classification stages of the framework.

3.2. Spoof Injection Model

To rigorously evaluate spoof resilience, CUTE-SpoofTrack applies the spoof operators introduced in (6)–(10) to the measurement set. Drift, Ghost, Mirror, Burst, and Multi-Ghost perturbations generate spoofed detections $D_j$ that induce spatial and temporal inconsistencies in $Z_t$. These adversarial perturbations are designed to destabilize classical JPDA/GNN trackers and thus provide a challenging testbed for the proposed quantum-enhanced framework. The resulting spoofed measurements are forwarded to SpoofNet for reliability assessment.

3.3. SpoofNet: CNN–LSTM Spoof Classifier

SpoofNet computes spoof probabilities using the CNN–LSTM architecture defined in (11). For each incoming detection $D_{t,j}^{\left(s\right)}$, SpoofNet outputs a spoof probability $p_{\mathrm{spoof}}\left(D_{t,j}^{\left(s\right)}\right)$ that quantifies the likelihood that the measurement is adversarial. High spoof probability indicates corrupted or synthetic detections, while low spoof probability preserves trustworthy sensor contributions. These spoof probabilities serve as the primary reliability signals for both the multi-sensor fusion stage and the quantum-inspired DQNN assignment model.

3.4. Multi-Sensor Fusion

Confidence-aware fusion follows the formulation in (19) and (20). Each modality s receives a confidence coefficient ${\sigma }_s$ derived from its spoof probabilities, and the fused measurement set is computed as

$$Z_{\mathrm{fuse}}=\sum _s{\sigma }_s{z}_s,$$

(21)

where $s\in \{\mathrm{radar},\mathrm{gnss},\mathrm{wifi}\}$. This fusion mechanism suppresses spoof-dominated modalities while maintaining robustness through multi-sensor redundancy. By recalling the spoof-aware weighting structure in Section 2, CUTE-SpoofTrack ensures that heavily corrupted measurements have minimal influence on the final trajectory estimate.

3.5. DQNN Tracker (CUTE)

The fused measurements $Z_{\mathrm{fuse}}$ are processed by the Deep Quantum Neural Network (DQNN) [5,6,7,21], which forms the core of the Quantum Unified Trajectory Estimator. The DQNN leverages the quantum-inspired assignment model defined in (12)–(18). Qubit initialization, Hadamard superposition, and CNOT-based dependency encoding collectively enable the tracker to maintain multiple association hypotheses and enforce assignment consistency across tracks and detections. SpoofNet-modulated amplitudes (see (15)) down-weight spoofed detections at the quantum state level, biasing the collapse toward spoof-resilient assignments. The final spoof-resilient assignment is obtained as

$$\widehat{A}\left(t\right)=\mathrm{DQNN}\left(Z_{\mathrm{fuse}}\right),$$

(22)

providing stable trajectory estimates even under ambiguous or partially spoofed sensor conditions. By combining spoof-aware fusion with quantum-inspired reasoning, CUTE-SpoofTrack achieves robust performance in adversarial environments and serves as a principled benchmark for evaluating spoof-resilient multi-sensor tracking algorithms.

4. Theoretical Foundations of Quantum-Inspired Spoof Resilience

This section establishes the theoretical basis for the spoof-resilience of the proposed DQNN tracker. We compare classical argmax-based assignment (e.g. JPDA, GNN) with the quantum-inspired superposition-based assignment under spoof-induced perturbations. The results show that the DQNN exhibits continuity, margin-based robustness, and spoof-aware suppression, while classical argmax trackers suffer discontinuous decision flips near spoof-induced likelihood boundaries.

4.1. Preliminaries

Let $\mathcal{T}=\{T_1,\dots ,T_M\}$ be the set of tracks and $\mathcal{D}=\{D_1,\dots ,D_N\}$ the set of detections. Let $\mathcal{A}$ denote the set of feasible assignment matrices $A\in {\{0,1\}}^{M\times N}$. Classical trackers compute a likelihood

$$L(A;Z)=P(A\mid Z),$$

(23)

where Z is the measurement set (possibly spoofed). The classical decision rule is

$${\widehat{A}}_{\mathrm{classical}}\left(Z\right)=\underset{A\in \mathcal{A}}{argmax}L(A;Z).$$

(24)

Recall from Section 2 that the DQNN tracker encodes assignments in a quantum-inspired state

$$|\mathrm{\Psi }\left(Z\right)\rangle =\sum _{A\in \mathcal{A}}{c}_A\left(Z\right)|A\rangle ,\sum _{A\in \mathcal{A}}{\left|c_A\left(Z\right)\right|}^2=1,$$

(25)

and induces the assignment distribution

$$P_{\mathrm{DQNN}}(A\mid Z)={\left|c_A\left(Z\right)\right|}^2.$$

(26)

SpoofNet produces spoof probabilities $p_{\mathrm{spoof}}\left(D_j\right)$ that modulate amplitudes $c_A\left(Z\right)$ through the quantum-inspired gates defined in (15)–(16).

4.2. Instability of Classical Argmax Under Spoof Perturbations

We first formalize the sensitivity of classical argmax-based trackers to small spoof perturbations near likelihood boundaries.

Theorem 1 

(Classical Argmax Instability). Let Z be a measurement set and $\tilde{Z}=Z+\Delta Z$ a spoof-perturbed version. Assume there exist assignments $A_1,A_2\in \mathcal{A}$ such that:

1. 

$L(A_1;Z)>L(A_2;Z)$,

2. 

$L(A_1;\tilde{Z})<L(A_2;\tilde{Z})$,

3. 

$|L(A_1;Z)-L(A_2;Z)|\le \epsilon$ for small $\epsilon >0$.

Then the classical tracker exhibits a discontinuous decision change:

$${\widehat{A}}_{\mathrm{classical}}\left(Z\right)=A_1,{\widehat{A}}_{\mathrm{classical}}\left(\tilde{Z}\right)=A_2.$$

(27)

Proof. 

By (24), ${\widehat{A}}_{\mathrm{classical}}\left(Z\right)$ is the maximizer of $L(A;Z)$. Condition (1) implies ${\widehat{A}}_{\mathrm{classical}}\left(Z\right)=A_1$, while condition (2) implies ${\widehat{A}}_{\mathrm{classical}}\left(\tilde{Z}\right)=A_2$. Condition (3) states that the likelihood gap between $A_1$ and $A_2$ at Z is arbitrarily small. Hence, an arbitrarily small spoof perturbation $\Delta Z$ can flip the argmax decision from $A_1$ to $A_2$, demonstrating discontinuity of the classical decision rule near spoof-induced likelihood boundaries. □

This instability is particularly severe when spoof perturbations target regions where multiple assignments have similar likelihoods, as in Drift, Ghost, or Multi-Ghost spoofing.

4.3. Continuity of Quantum-Inspired Assignment Under Spoof Perturbations

We now show that, under mild regularity assumptions, the DQNN assignment distribution is continuous with respect to spoof perturbations.

Theorem 2 

(DQNN Continuity). Assume the amplitude mapping $Z\mapsto c_A\left(Z\right)$ is Lipschitz continuous for each $A\in \mathcal{A}$, i.e.,

$$\parallel c_A\left(Z\right)-c_A\left(\tilde{Z}\right)\parallel \le K\parallel \Delta Z\parallel \forall A\in \mathcal{A},$$

(28)

for some constant $K>0$. Then the DQNN assignment distribution $P_{\mathrm{DQNN}}(A\mid Z)={\left|c_A\left(Z\right)\right|}^2$ is continuous in Z, and spoof perturbations induce bounded changes:

$$|P_{\mathrm{DQNN}}(A\mid Z)-P_{\mathrm{DQNN}}(A\mid \tilde{Z})|\le K^{\prime }\parallel \Delta Z\parallel \forall A\in \mathcal{A},$$

(29)

for some constant $K^{\prime }>0$.

Proof. 

We have $P_{\mathrm{DQNN}}(A\mid Z)={\left|c_A\left(Z\right)\right|}^2$ by (26). Using the identity $|x^2-y^2|=|x-y||x+y|$ for real $x,y$ and applying (28), we obtain

$$|{\left|c_A\left(Z\right)\right|}^2-{\left|c_A\right(\tilde{Z}\left)\right|}^2|\le K\parallel \Delta Z\parallel ·C,$$

(30)

where C bounds $|c_A\left(Z\right)+c_A\left(\tilde{Z}\right)|$ over the relevant domain. Setting $K^{\prime }=KC$ yields (29). Thus, the assignment probabilities vary smoothly under spoof perturbations. □

4.4. Spoof Resilience Advantage of DQNN

We now combine the instability of classical argmax with the continuity of DQNN to formalize a spoof-resilience advantage near decision boundaries.

Theorem 3 

(DQNN Spoof Resilience Near Decision Boundaries). Under the assumptions of Theorem 1 and Theorem 2, there exist spoof perturbations $\Delta Z$ such that:

1. 

The classical tracker switches abruptly:

$${\widehat{A}}_{\mathrm{classical}}\left(Z\right)=A_1,{\widehat{A}}_{\mathrm{classical}}\left(\tilde{Z}\right)=A_2.$$

(31)

2. 

The DQNN tracker maintains non-zero probability mass on both assignments:

$$P_{\mathrm{DQNN}}(A_1\mid Z)>0,P_{\mathrm{DQNN}}(A_2\mid Z)>0,$$

(32)

and

$$P_{\mathrm{DQNN}}(A_1\mid \tilde{Z})>0,P_{\mathrm{DQNN}}(A_2\mid \tilde{Z})>0,$$

(33)

with changes bounded by (29).

Thus, the DQNN tracker is more resilient to spoof perturbations near classical decision boundaries.

Proof. 

Theorem 1 guarantees the existence of spoof perturbations $\Delta Z$ that flip the classical argmax decision from $A_1$ to $A_2$ under a small likelihood gap. Theorem 2 ensures that the DQNN assignment probabilities change smoothly under the same perturbations. Since $\left|\mathrm{\Psi }\right(Z)\rangle$ encodes a superposition over assignments, both $A_1$ and $A_2$ retain non-zero probability mass unless spoof suppression is extreme (see Theorem 5). Hence, the DQNN avoids abrupt collapses and exhibits spoof-resilient behavior near classical decision boundaries. □

Theorem 3 establishes that the DQNN avoids discontinuous decision flips under small spoof perturbations. We now strengthen this result by showing that, when the DQNN distribution possesses a positive assignment margin, the tracker is robust to spoof perturbations up to a quantifiable threshold.

Corollary 1 

(Margin-Based Robustness of DQNN). Assume the conditions of Theorem 2 hold and let $A^{★}\in \mathcal{A}$ be an assignment such that

$$P_{\mathrm{DQNN}}(A^{★}\mid Z)-P_{\mathrm{DQNN}}(A\mid Z)\ge \gamma \forall A\ne A^{★},$$

(34)

for some margin $\gamma >0$. If the spoof perturbation satisfies

$$\parallel \Delta Z\parallel \le {\displaystyle \frac{\gamma }{2K^{\prime }}},$$

(35)

where $K^{\prime }$ is the continuity constant in (29), then

$$P_{\mathrm{DQNN}}(A^{★}\mid \tilde{Z})>P_{\mathrm{DQNN}}(A\mid \tilde{Z})\forall A\ne A^{★}.$$

(36)

Thus, the DQNN preserves its most probable assignment under spoof perturbations bounded by the margin-scaled threshold in (35).

Proof. 

By (29), for any $A\in \mathcal{A}$,

$$|P_{\mathrm{DQNN}}(A\mid Z)-P_{\mathrm{DQNN}}(A\mid \tilde{Z})|\le K^{\prime }\parallel \Delta Z\parallel .$$

(37)

Using (35), we have $K^{\prime }\parallel \Delta Z\parallel \le \gamma /2$. Hence, for $A^{★}$ and any $A\ne A^{★}$,

$$P_{\mathrm{DQNN}}(A^{★}\mid \tilde{Z})\ge P_{\mathrm{DQNN}}(A^{★}\mid Z)-{\displaystyle \frac{\gamma }{2}},$$

(38)

and

$$P_{\mathrm{DQNN}}(A\mid \tilde{Z})\le P_{\mathrm{DQNN}}(A\mid Z)+{\displaystyle \frac{\gamma }{2}}.$$

(39)

Subtracting yields

$$P_{\mathrm{DQNN}}(A^{★}\mid \tilde{Z})-P_{\mathrm{DQNN}}(A\mid \tilde{Z})\ge \gamma -\gamma =0,$$

(40)

with strict inequality whenever the original margin is strict. Thus $A^{★}$ remains the most probable assignment under the stated perturbation bound. □

While Corollary 1 provides a margin-based guarantee for preserving the most probable assignment, it does not quantify how the entire assignment distribution changes under spoof perturbations. To address this, we derive a KL-divergence stability bound showing that the DQNN distribution remains globally close to its unperturbed form.

Theorem 4 

(KL-Divergence Stability of DQNN). Let $P_Z\left(A\right)=P_{\mathrm{DQNN}}(A\mid Z)$ and $P_{\tilde{Z}}\left(A\right)=P_{\mathrm{DQNN}}(A\mid \tilde{Z})$. Assume (29) holds and that $P_Z\left(A\right)\ge \eta >0$ for all $A\in \mathcal{A}$. Then the KL-divergence

$$D_{\mathrm{KL}}(P_Z\parallel P_{\tilde{Z}})=\sum _{A\in \mathcal{A}}{P}_Z\left(A\right)log{\displaystyle \frac{P_Z\left(A\right)}{P_{\tilde{Z}}\left(A\right)}}$$

(41)

is bounded linearly in $\parallel \Delta Z\parallel$, i.e.,

$$D_{\mathrm{KL}}(P_Z\parallel P_{\tilde{Z}})\le C_{\mathrm{KL}}\parallel \Delta Z\parallel ,$$

(42)

for some constant $C_{\mathrm{KL}}>0$ depending on $K^{\prime }$ and η.

Proof. 

By (29), for each A,

$$|P_Z\left(A\right)-P_{\tilde{Z}}\left(A\right)|\le K^{\prime }\parallel \Delta Z\parallel .$$

(43)

Since $P_Z\left(A\right)\ge \eta$, we have

$$|log{\displaystyle \frac{P_Z\left(A\right)}{P_{\tilde{Z}}\left(A\right)}}|\le {\displaystyle \frac{|P_Z\left(A\right)-P_{\tilde{Z}}\left(A\right)|}{\eta }}\le {\displaystyle \frac{K^{\prime }}{\eta }}\parallel \Delta Z\parallel ,$$

(44)

using a first-order bound on the log ratio. Therefore,

$$D_{\mathrm{KL}}(P_Z\parallel P_{\tilde{Z}})\le \sum _{A\in \mathcal{A}}{P}_Z\left(A\right){\displaystyle \frac{K^{\prime }}{\eta }}\parallel \Delta Z\parallel ={\displaystyle \frac{K^{\prime }}{\eta }}\parallel \Delta Z\parallel ,$$

(45)

so we may set $C_{\mathrm{KL}}=K^{\prime }/\eta$. □

4.5. SpoofNet-Modulated Amplitude Suppression

Recall from Section 2 that SpoofNet produces spoof probabilities $p_{\mathrm{spoof}}\left(D_j\right)$ for each detection. As defined in (15), these probabilities modulate the qubit amplitudes. We now formalize the resulting suppression effect on spoof-dominated assignments.

Theorem 5 

(Exponential Suppression of Spoofed Assignments). Let SpoofNet produce spoof probabilities $p_{\mathrm{spoof}}\left(D_j\right)$ for each detection $D_j$. Define the amplitude modulation as

$$\begin{array}{c}\hfill c_A\left(Z\right)=\left(\prod _{(i,j):A_{ij}=1}\sqrt{1-p_{\mathrm{spoof}}\left(D_j\right)}\right)\\ \hfill \times \left(\prod _{(i,j):A_{ij}=0}\sqrt{p_{\mathrm{spoof}}\left(D_j\right)}\right){\tilde{c}}_A\left(Z\right),\end{array}$$

(46)

where ${\tilde{c}}_A\left(Z\right)$ is the unmodulated amplitude. Then assignments relying on high-spoof detections have exponentially suppressed amplitudes and thus negligible probability under $P_{\mathrm{DQNN}}(A\mid Z)$.

Proof. 

For an assignment A using detections ${\mathcal{D}}_A$, the spoof suppression factor is

$$\prod _{D_j\in {\mathcal{D}}_A}\sqrt{1-p_{\mathrm{spoof}}\left(D_j\right)}.$$

(47)

If $p_{\mathrm{spoof}}\left(D_j\right)\ge 1-\delta$ for all $D_j\in {\mathcal{D}}_A$ with small $\delta >0$, then each term satisfies $\sqrt{1-p_{\mathrm{spoof}}\left(D_j\right)}\le \sqrt{\delta }$. Thus the product decays as ${\delta }^{|{\mathcal{D}}_A|/2}$, yielding exponential suppression in the number of spoofed detections. Consequently,

$$P_{\mathrm{DQNN}}(A\mid Z)={\left|c_A\left(Z\right)\right|}^2,$$

(48)

is negligible, and spoof-dominated assignments are naturally rejected. □

The combination of continuity (Theorem 2) and spoof-aware suppression (Theorem 5) provides a theoretical foundation for the spoof-resilient behavior observed in CUTE-SpoofTrack: the tracker avoids abrupt decision flips near classical boundaries while aggressively down-weighting assignments that depend on high-spoof detections.

The KL stability bound characterizes global smoothness of the DQNN distribution. We now turn to spoof-aware suppression, showing that assignments relying heavily on spoofed detections are rejected once the spoof intensity exceeds a quantifiable budget.

Theorem 6 

(Spoof Budget for Assignment Rejection). Let ${\mathcal{D}}_A$ be the set of detections used by assignment A, and assume $p_{\mathrm{spoof}}\left(D_j\right)\ge 1-\delta$ for all $D_j\in {\mathcal{D}}_A$ with $0<\delta <1$. Let $|{\mathcal{D}}_A|=K_A$ denote the number of spoofed detections used by A. Suppose we require

$$P_{\mathrm{DQNN}}(A\mid Z)\le ϵ,$$

(49)

for a tolerance $ϵ>0$. Then it suffices that

$$K_A\ge {\displaystyle \frac{2log\left({ϵ}^{-1}\right)}{log\left({\delta }^{-1}\right)}},$$

(50)

i.e., assignments that rely on at least $K_A$ high-spoof detections are guaranteed to have probability below ϵ.

Proof. 

From Theorem 5, the spoof suppression factor for A is

$$\prod _{D_j\in {\mathcal{D}}_A}\sqrt{1-p_{\mathrm{spoof}}\left(D_j\right)}\le \prod _{D_j\in {\mathcal{D}}_A}\sqrt{\delta }={\delta }^{K_A/2}.$$

(51)

Thus

$$P_{\mathrm{DQNN}}(A\mid Z)=|c_A{\left(Z\right)|}^2\le {\delta }^{K_A}{\left|{\tilde{c}}_A\left(Z\right)\right|}^2.$$

(52)

Assuming $|{\tilde{c}}_A{\left(Z\right)|}^2\le 1$, a sufficient condition for $P_{\mathrm{DQNN}}(A\mid Z)\le ϵ$ is

$${\delta }^{K_A}\le ϵ,$$

(53)

which is equivalent to

$$K_A\ge {\displaystyle \frac{log\left(ϵ\right)}{log\left(\delta \right)}}.$$

(54)

Since $0<\delta <1$, we have $log\left(\delta \right)<0$, and rewriting yields

$$K_A\ge {\displaystyle \frac{log\left({ϵ}^{-1}\right)}{log\left({\delta }^{-1}\right)}}.$$

(55)

Including the factor of 2 from the square-root terms in the amplitude gives (50). Hence, any assignment using at least $K_A$ high-spoof detections is guaranteed to have probability below $ϵ$. □

5. Numerical Results and Discussion

This section presents numerical evaluations of the proposed CUTE-SpoofTrack framework under multi-sensor spoofing conditions. The experiments are designed to validate the theoretical guarantees established in Section 4, including continuity, “margin-based robustness”, “KL-stability”, and “spoof-aware suppression”. Results demonstrate that CUTE-SpoofTrack provides stable, spoof-resilient tracking even under adversarial perturbations.

5.1. Benchmark and Evaluation Protocol

We benchmark CUTE-SpoofTrack against three widely used neural architectures for spoof detection and multi-sensor tracking:

• CNN baseline [1,2,4] — spatial feature extraction only,
• LSTM baseline [13,15] — temporal modeling only,
• GNN baseline [4] — graph-based relational modeling.

These baselines represent classical assignment pipelines that rely on ${\widehat{A}}_{\mathrm{classical}}=argmaxL(A;Z)$, and thus exhibit the instability described in Theorem 1. In contrast, CUTE-SpoofTrack leverages quantum-inspired superposition and spoof-aware amplitude suppression, enabling robustness consistent with Theorem 2, Corollary 1, and Theorem 4.

All models are evaluated under the spoof operators defined in (6)–(10). Each experiment runs at 50 Hz and includes drift, ghost, mirror, and burst spoofing scenarios.

5.2. Parameter Settings and Simulation Design

The simulation environment models a UAV executing a smooth waypoint-based trajectory $x\left(t\right)$ with randomized accelerations to emulate realistic aerial motion. Waypoints are connected using cubic-spline interpolation, and process noise is injected through a Gaussian acceleration perturbation $a\left(t\right)\sim \mathcal{N}(0,0.{15}^2)$ to ensure natural variability in velocity and turn rate. Radar, GNSS, and Wi-Fi sensing streams are generated according to the unified measurement model introduced earlier in this work. Radar range–Doppler detections are corrupted by Gaussian noise $v_{\mathrm{radar}}\sim \mathcal{N}(0,0.4^2)$, GNSS position measurements follow $v_{\mathrm{gnss}}\sim \mathcal{N}(0,0.6^2)$, and Wi-Fi RTT-based localization noise is modeled as $v_{\mathrm{wifi}}\sim \mathcal{N}(0,0.8^2)$. Each modality produces independent detections at 10 Hz, and timestamps are synchronized through a shared simulation clock.

Spoofing attacks are injected using the spoof taxonomy defined for CUTE-SpoofTrack: drift spoofing applies a slowly varying bias to the true trajectory; ghost spoofing generates synthetic detections with plausible kinematics; mirror spoofing reflects clusters across a spoof-defined axis; and burst spoofing introduces short-duration, high-density false detections. Spoof intensity is parameterized by a corruption ratio $\rho \in [0,0.6]$, indicating the fraction of detections replaced or perturbed. Multi-sensor spoofing scenarios are generated by independently corrupting radar, GNSS, and Wi-Fi streams, enabling evaluation under single-modality and cross-modality adversarial conditions.

SpoofNet is trained using 40k labeled samples per modality, balanced across spoof types and clean detections. Each sample includes temporal Doppler signatures, jitter profiles, and modality-specific features. The network uses a CNN front-end for spatial encoding and an LSTM back-end for temporal spoof characterization. Training is performed using Adam optimization with a learning rate of ${10}^{-4}$ and batch size 128.

The Deep Quantum Neural Network (DQNN) assignment module uses 8 qubits per track–detection pair, enabling simultaneous representation of multiple association hypotheses. Qubits are initialized using Hadamard gates to create uniform superposition, while CNOT gates encode dependency structures between tracks and detections. SpoofNet probabilities modulate amplitude suppression, reducing the influence of spoof-dominated states. The DQNN is executed for 12 gate cycles per frame, providing a balance between robust inference and real-time computational constraints.

Finally, the confidence-aware fusion center aggregates radar, GNSS, and Wi-Fi detections using spoof-weighted likelihoods. Sensor weights are updated dynamically based on SpoofNet’s spoof probability estimates, allowing the fusion engine to down-weight corrupted modalities and preserve trajectory continuity. All experiments are conducted over 200 simulated UAV missions with varying spoof intensities, sensor corruption patterns, and trajectory geometries.

This simulation design extends the modeling framework introduced in our earlier SpoofTrackBench benchmark [8], which established standardized spoof injection operators, multi-sensor corruption patterns, and trajectory drift quantification for spoof-aware UAV tracking. In CUTE-SpoofTrack, we retain the core SpoofTrackBench simulation primitives—such as drift, ghost, mirror, and burst spoof generators—but significantly expand the environment to support quantum-inspired assignment reasoning, confidence-aware fusion, and multi-modality spoof interactions. The dataset size, spoof intensity ranges, and sensor noise models are also scaled to accommodate DQNN training and evaluation, enabling reproducible comparison between classical, deep learning, and quantum-inspired tracking architectures.

5.3. Spoof Detection Performance (SpoofNet)

We begin with spoof detection, the first stage of the pipeline. Table 1 summarizes SpoofNet’s performance across spoof types and modalities. Drift and burst spoofs achieve the highest detection accuracy (0.94 and 0.96), reflecting their strong temporal signatures. Ghost and mirror spoofs yield slightly lower accuracy (0.87 and 0.85), but SpoofNet maintains consistent performance across radar, GNSS, and Wi-Fi. These results empirically validate the “spoof-aware suppression” mechanism: high spoof probabilities $p_{\mathrm{spoof}}\left(D_j\right)$ are reliably identified, enabling exponential suppression of spoof-dominated assignments in the DQNN.

Beyond per-modality spoof detection, Table 4 compares SpoofNet and CUTE-SpoofTrack against classical baselines in terms of accuracy, precision, recall, F1-score, and runtime. SpoofNet achieves substantially higher accuracy (0.94) and F1-score (0.93) than CNN, LSTM, and GNN baselines, demonstrating the importance of joint spatial–temporal modeling for identifying spoof-induced anomalies. Although SpoofNet incurs slightly higher computational cost than CNN and LSTM, its runtime remains well within real-time constraints (5.1 ms), making it suitable for UAV deployment.

The full CUTE-SpoofTrack pipeline further improves performance, achieving 0.97 accuracy and 0.96 F1-score. This gain reflects the benefit of integrating spoof-aware fusion and quantum-inspired assignment reasoning. The enhanced stability aligns with the theoretical robustness properties established earlier: continuity under perturbations, margin-preserving behavior near decision boundaries, and suppression of spoof-dominated hypotheses. Although the full pipeline requires additional computation (9.4 ms), it remains comfortably within real-time operational limits for UAV navigation.

Overall, Table 4 shows that SpoofNet provides a strong spoof detection backbone, and that CUTE-SpoofTrack delivers end-to-end improvements in both accuracy and robustness compared to classical baselines.

5.4. Fusion Stability Under Spoof Stress

Next, we evaluate confidence-aware fusion. Table 2 shows that corrupted modalities receive reduced confidence weights ${\sigma }_s$, while reliable modalities dominate the fused measurement set $Z_{\mathrm{fuse}}$.

Fusion continuity (0.93 average) and low divergence (0.07 average) empirically confirm the continuity bound in Theorem 2: spoof perturbations induce only small changes in fused measurements, enabling stable downstream tracking.

5.5. Quantum-Enhanced Trajectory Resilience (CUTE)

Finally, we evaluate trajectory-level performance. Table 3 shows that CUTE consistently achieves higher continuity and lower divergence than classical baselines. These results validate: 1) “Margin-based robustness” (Corollary 1): CUTE maintains the most probable assignment under spoof perturbations within the theoretical margin threshold. 2) “KL-stability” (Theorem 4): The DQNN assignment distribution remains close to its unperturbed form, explaining the smooth recovery after spoof removal. 3) “Spoof-budget suppression” (Theorem 6): Assignments relying on spoofed detections are rejected once spoof intensity exceeds the theoretical budget.

5.6. Computational Efficiency

Table 4 shows that CUTE-SpoofTrack remains within real-time operational bounds (9.4 ms per batch), validating its suitability for UAV navigation.

5.7. Summary of Findings

CUTE-SpoofTrack demonstrates strong performance across all evaluation dimensions:

• SpoofNet reliably identifies spoofed measurements, validating “spoof-aware suppression” (Theorem 5).
• Confidence-aware fusion maintains stability under spoof stress, consistent with DQNN continuity (Theorem 2).
• The quantum-enhanced CUTE estimator provides superior resilience, confirming “margin-based robustness” (Corollary 1) and “KL-stability” (Theorem 4).

These results confirm that quantum-assisted multi-sensor tracking offers a principled and robust solution for UAV navigation under adversarial spoofing.

6. Conclusions and Future Work

6.1. Conclusion

This work introduced CUTE-SpoofTrack, a quantum-inspired multi-sensor tracking framework designed to provide robust UAV navigation under adversarial spoofing. Building upon the unified sensing, spoofing, fusion, and assignment formulation developed in this paper, the proposed pipeline integrates deep spoof characterization through SpoofNet, confidence-aware multi-sensor fusion, and a Deep Quantum Neural Network (DQNN) for resilient trajectory estimation. The theoretical analysis established key robustness properties of the DQNN assignment mechanism, including continuity under perturbations, stability of the assignment distribution, margin-preserving behavior near decision boundaries, and exponential suppression of spoof-dominated hypotheses.

The numerical evaluations confirmed these theoretical guarantees. SpoofNet reliably identified spoofed measurements across drift, ghost, mirror, and burst attacks, enabling effective down-weighting of corrupted detections. Confidence-aware fusion maintained stable trajectories even when multiple modalities were compromised, demonstrating smooth behavior consistent with the theoretical continuity of the fused measurement set. The quantum-enhanced CUTE estimator consistently outperformed classical baselines, exhibiting higher trajectory continuity, lower assignment divergence, and faster recovery after spoof removal. Together, these results show that quantum-inspired reasoning provides a principled and effective foundation for resilient multi-sensor tracking in adversarial environments.

6.2. Future Work

Several promising research directions emerge from this work. One natural extension is the integration of quantum representation learning into the tracking pipeline. Recent advances in quantum-assisted reinforcement learning for robot navigation [21] demonstrate that qubit-based state encoding can significantly improve decision-making under uncertainty. Incorporating such quantum RL modules into CUTE-SpoofTrack would enable adaptive trajectory planning that responds intelligently to spoof severity, sensor availability, and environmental dynamics.

Another direction involves coupling spoof-resilient tracking with mobility-aware resource management. Prior work on deep reinforcement learning for vehicular networks [22,23,24] and hierarchical edge computing [13] shows that multi-timescale learning can stabilize system performance under fluctuating mobility and network conditions. Extending these ideas to UAV navigation—where spoofing, sensor dropout, and communication constraints interact—could yield a unified framework for robust sensing, tracking, and resource allocation.

Hybrid quantum–classical optimization also presents an exciting opportunity. Quantum augmented AI/ML pipelines developed for cybersecurity and O-RAN systems [5,6] illustrate how quantum feature spaces can enhance anomaly detection and threat classification. Applying similar hybrid strategies to spoof-aware UAV tracking may reduce computational overhead while preserving the robustness guarantees established in this work.

Finally, future efforts will focus on hardware-in-the-loop validation using real-world RF datasets, radar logs, and GNSS/Wi-Fi spoofing traces. Developing adaptive spoof-response policies—where the tracker dynamically adjusts sensing, fusion, or trajectory planning based on spoof intensity—offers a pathway toward fully autonomous, spoof-aware UAV navigation. In short, CUTE-SpoofTrack provides a foundation for next-generation resilient UAV tracking systems, and its integration with quantum reinforcement learning, multi-timescale control, and hybrid quantum–classical intelligence represents a compelling direction for future research.