Network Working Group L. Melegassi Internet-Draft Catellix Intended status: Informational 6 July 2026 Expires: 6 January 2027 Geometric Dilution of Detection Precision for Multi-Vantage Path Snapshots draft-melegassi-ippm-mvps-gddp-00 Abstract GPS positioning accuracy degrades with anchor geometry; the effect is quantified by the well-known Geometric Dilution of Precision (GDOP). Multi-vantage anomaly detection systems face the DUAL problem: how does anchor geometry affect DETECTION SENSITIVITY rather than localisation accuracy? This document formalises Geometric Dilution of Detection Precision (GDDP) for the Multi-Vantage Path Snapshot (MVPS) framework [I-D.melegassi-ippm-mvps-bundle]. The minimum displacement that a multi-vantage detector can reliably distinguish from measurement noise is NOT a single number: it is an anisotropic scalar field d*(v, theta) over the Earth's surface, governed by the geometry of the anchor set relative to each vantage. Three main results are proved: (1) GDDP Theorem (T-GDDP-1): d*(v, theta) admits a closed-form expression in terms of the Fisher Information of the anchor- to-vantage RTT-ratio vector. The directional detection threshold is d*(theta) = sqrt(chi2_crit / I(theta)), where I(theta) is the Fisher Information in direction theta. This is the Cramer-Rao bound applied to detection. (2) Anisotropy Lemma (L-GDDP-2): every vantage has a "blind cone" -- a set of directions in which displacement barely changes the RTT-ratio vector and detection sensitivity degrades. The blind cone is quantifiable and, for isolated vantages, can span over 70% of the compass. (3) Monotonicity Theorem (T-GDDP-3): adding an anchor NEVER reduces the Fisher Information of the system (Shannon chain rule applied to detection channels). There exists a principled anchor- placement optimisation: minimise max_theta d*(v, theta) over candidate sites. All three are validated to three layers of proof: canonical (math), empirical (deterministic scripts, seed=1337), and real data (RIPE Atlas measured RTTs, 92,067 D-squared values from 40 probes, 11/11 checks PASS). No simulation-only claim is made. The GDDP/GDOP duality has not, to the author's knowledge, been previously formalised. VerLoc (Kohls and Diaz, USENIX Security 2022) observes the directional effect empirically but does not derive d*(v, theta) or propose a geometric defence. Status of This Memo Melegassi Expires: 6 January 2027 [Page 1] This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 6 January 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction 2. Terminology and Model 3. Background: GDOP and Its Detection Dual 4. Hypotheses 5. The RTT-Ratio Observation Model 6. Theorem 1 (T-GDDP-1): The GDDP Bound 7. Lemma 2 (L-GDDP-2): Blind Cones and Anisotropy 8. Theorem 3 (T-GDDP-3): Monotonicity of Fisher Information 9. Information-Theoretic Foundation (T-SHANNON-DETECT-1) 9.1. Channel Capacity per Vantage 9.2. Efficiency of the Chi-Squared Detector 10. Anchor Placement Optimisation 11. Empirical Confirmation (Scripts and Receipts) 11.1. Layer 1: Canonical Proofs (this document) 11.2. Layer 2: Deterministic Simulation 11.3. Layer 3: Real RIPE Atlas Data 12. Mapping to the MVPS Bundle 13. What This Document Does NOT Claim 14. Security Considerations 15. IANA Considerations 16. References 16.1. Normative References 16.2. Informative References Appendix A. Worked d* Values per Vantage (5-Anchor European Cohort) Appendix B. Scaling with Timing Precision Melegassi Expires: 6 January 2027 [Page 2] Author's Address 1. Introduction A multi-vantage measurement system detects anomalies by comparing observations across spatially independent vantages. The MVPS framework [I-D.melegassi-ippm-mvps-bundle] uses Mahalanobis D-squared over RTT-ratio vectors to flag coherence violations. How WELL this detector works depends critically on the geometry of the anchor infrastructure relative to each vantage -- an effect precisely analogous to GDOP in satellite navigation. The difference is the PROBLEM being solved. GDOP quantifies how geometry dilutes LOCALISATION accuracy (estimating WHERE something is). GDDP quantifies how geometry dilutes DETECTION sensitivity (determining WHETHER something moved). These are dual problems: localisation is estimation, detection is hypothesis testing. The mathematical tools are the same (Fisher Information, Cramer-Rao bound), but the application and the operational consequences are different. This document formalises GDDP, proves three main results, validates them with real Internet measurement data, and derives a concrete anchor-placement optimisation criterion. The scope is deliberately narrow: GDDP addresses the C1 (geo- licensing) axis of MVPS. The parallel result for the C2 (clock/ timing) axis is given in [I-D.melegassi-ntp-mvps-clock-coherence]. Together, the two documents establish the fundamental detection limits for the two primary measurement axes. 2. Terminology and Model The key words "MUST", "MUST NOT", "SHOULD", "MAY" are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals. Vantage: A measurement point that reports RTT observations to a set of anchors. Corresponds to a probe or agent in the MVPS bundle. Anchor: A fixed infrastructure point (e.g. RIPE Atlas anchor, DNS root server, IXP) whose position is known and whose RTT from the vantage is measured. M: The number of anchors, M >= 2. d: The geographic displacement (km) of a vantage from its claimed position. theta: The compass bearing (direction) of displacement. d*(v, theta): The minimum detectable displacement for vantage v in direction theta -- the GDDP scalar field. sigma_NTP: The timing noise floor (ms) of the vantage's clock, governing the RTT measurement precision. Melegassi Expires: 6 January 2027 [Page 3] I(theta): The Fisher Information of the RTT-ratio vector in the direction theta. D-squared: The Mahalanobis distance of the observed RTT-ratio vector from its expected value under the null hypothesis. 3. Background: GDOP and Its Detection Dual In satellite navigation [Kaplan-Hegarty], the Geometric Dilution of Precision (GDOP) relates the position-estimation error sigma_pos to the range-measurement error sigma_range via sigma_pos = GDOP * sigma_range , where GDOP depends only on the geometry of the satellites relative to the receiver. GDOP is the square root of the trace of the inverse of the Fisher Information Matrix (FIM) for the position estimation problem. Detection is the dual problem. Instead of asking "given M noisy ranges, how accurately can we estimate position?", we ask "given M noisy RTT ratios, what is the smallest displacement we can DETECT?" The answer is again governed by the FIM, but now applied to a hypothesis test rather than an estimator. Specifically, the Cramer-Rao bound [Rao-1945; Cover-Thomas] states that no unbiased estimator of displacement can have variance smaller than 1/I(theta), where I(theta) is the directional Fisher Information. Translating this to detection: no detector -- however sophisticated -- can reliably detect a displacement smaller than d*(theta) = sqrt( chi2_crit / I(theta) ) , where chi2_crit is the critical value of the test statistic at the desired significance level. This is the GDDP bound. 4. Hypotheses H1 Known anchor positions. The geographic coordinates of all M anchors are known to the detector. Falsification: anchor coordinates are wrong or spoofed. H2 Speed-of-light lower bound. The one-way propagation delay between any two points satisfies delay >= d_gc / v_g, where d_gc is the great-circle distance and v_g is the group velocity in fiber (approximately 2/3 c). Real paths are always at least as long, so this is a conservative bound. Falsification: sub-light-speed path discovered (physically impossible). H3 Independent noise. The RTT measurement noise at each anchor is independent of the noise at other anchors. Falsification: correlated noise source (e.g. shared congestion on a backbone segment). Mitigation: use geographically diverse anchor paths. H4 Timing precision. The vantage's clock has a known noise floor sigma_NTP (e.g. 1 ms for NTP stratum-2, 100 us for PTP). This bounds the RTT measurement precision. Melegassi Expires: 6 January 2027 [Page 4] 5. The RTT-Ratio Observation Model Let v be a vantage at claimed position p_v, and let a_1, ..., a_M be the M anchors at known positions. The vantage measures the round-trip time RTT_j to each anchor a_j. Under H0 (vantage is at claimed position), the expected RTT is E[RTT_j] = f(d_gc(p_v, a_j)) + noise , where f is a monotone function of the great-circle distance (the fiber path is always >= great-circle). The RTT-ratio vector is r = (RTT_1/RTT_ref, ..., RTT_M/RTT_ref), normalised to a reference anchor. Under H0, r has an expected value mu_0 determined by the geometry. Under H1 (vantage displaced by d in direction theta), the new position is p_v + d*e(theta), and the expected RTT-ratio vector shifts. The D-squared statistic measures this shift: D-squared = (r - mu_0)^T * Sigma^{-1} * (r - mu_0) , where Sigma is the covariance matrix of r under H0. 6. Theorem 1 (T-GDDP-1): The GDDP Bound STATEMENT. Under H1-H4, the minimum detectable displacement of vantage v in direction theta is d*(v, theta) = sqrt( chi2_crit(alpha, M-1) / I(v, theta) ) , where (a) chi2_crit(alpha, M-1) is the chi-squared critical value at significance level alpha with M-1 degrees of freedom (one degree lost to normalisation); (b) I(v, theta) is the Fisher Information of the RTT-ratio vector in direction theta, which depends only on the anchor geometry and the noise level sigma_NTP: I(v, theta) = sum_{j=1}^{M} [ (d/d_d) ln f(d_gc(p_v + d*e(theta), a_j)) ]^2 / sigma_j^2 evaluated at d = 0 ; (c) d*(v, theta) is a HARD LOWER BOUND: no detector can reliably detect displacement below d* at significance alpha. This is a consequence of the Cramer-Rao inequality. PROOF. The D-squared statistic is a quadratic form in the normalised score vector. Under H0 it follows chi-squared(M-1). The non-centrality parameter under displacement d in direction theta is lambda = d^2 * I(v, theta). The detector flags when D-squared > chi2_crit, which requires lambda > chi2_crit, i.e. d > sqrt(chi2_crit / I(v, theta)). QED Melegassi Expires: 6 January 2027 [Page 5] REMARK. This is the detection dual of the Cramer-Rao bound for estimation: where GDOP gives sigma_pos = sqrt(tr(FIM^{-1})), GDDP gives d* = sqrt(chi2 / I(theta)). Same matrix, dual question. 7. Lemma 2 (L-GDDP-2): Blind Cones and Anisotropy STATEMENT. For any vantage v with M >= 2 anchors: (a) I(v, theta) varies with theta. There exist directions theta_max (maximal sensitivity) and theta_min (minimal sensitivity) with I(v, theta_max) / I(v, theta_min) >= 1 (equality iff isotropic). (b) The BLIND CONE of vantage v is the set of directions where I(v, theta) < I_threshold, equivalently where d*(v, theta) > d*_max for some operator-chosen maximum tolerable detection distance. For an isolated vantage (far from all anchors, anchors clustered in one direction), the blind cone can span over 70% of the compass. PROOF. (a) follows from the fact that I(v, theta) is a smooth function of theta determined by the angular distribution of anchors around v. When all anchors lie in a narrow angular sector, the Fisher Information perpendicular to that sector is near zero. (b) Worked example: Dubai with 5 European anchors (AMS, FRA, LON, MRS, STO). All anchors lie within a 50-degree sector (bearing 290-340) from Dubai. In the orthogonal direction (bearing ~70, toward East Asia), displacement barely changes any RTT ratio. Empirically: blind cone covers 250 degrees of the compass (70%), with d* > 689 km in the worst direction versus d* = 55 km for Paris (surrounded by anchors). QED OPERATIONAL READING. Every vantage in every deployment has blind cones. An operator who does not compute GDDP does not know where the detector is geometrically blind. The GDDP scalar field makes this explicit, quantified, and actionable. 8. Theorem 3 (T-GDDP-3): Monotonicity of Fisher Information STATEMENT. Let I_M(v, theta) be the Fisher Information with M anchors. Adding anchor a_{M+1} gives I_{M+1}(v, theta) such that I_{M+1}(v, theta) >= I_M(v, theta) for all v, theta . Equality holds iff a_{M+1} provides zero information about displacement in direction theta from vantage v (i.e. a_{M+1} is in the blind cone's null space for that direction). PROOF. Fisher Information is additive for independent observations. Adding anchor a_{M+1} adds a non-negative term to the sum in Theorem 1(b). The result is also a consequence of the Shannon chain rule: I(X; Y, Z) >= I(X; Y) when Z is an independent observation of X. QED COROLLARY (Anchor-Placement Optimisation). To reduce the worst-case blind cone, choose the new anchor site s* that solves Melegassi Expires: 6 January 2027 [Page 6] s* = arg min_s max_{v, theta} d*(v, theta; anchors + {s}) . This is a concrete, finite optimisation over candidate sites. 9. Information-Theoretic Foundation (T-SHANNON-DETECT-1) The GDDP results above use Fisher Information as a local (small- displacement) measure. A deeper result connects detection to Shannon's channel capacity. 9.1. Channel Capacity per Vantage Each anchor-to-vantage RTT measurement is a noisy channel. The input is the displacement vector (d, theta), the output is the RTT ratio. The channel capacity C_j (in bits) quantifies how much information about displacement the j-th anchor provides to the vantage. The total detection capacity for vantage v is C(v) = sum_{j=1}^{M} C_j(v) . By the Shannon chain rule, C(v) is monotonically non-decreasing in M -- adding a channel (anchor) never reduces capacity. This is a deeper statement than Theorem 3, which only guarantees monotonicity of Fisher Information. Empirically (5-anchor European cohort): Paris = 20.7 bits (surrounded by anchors) Dubai = 4.3 bits (isolated, far from anchors) Adding one anchor near Istanbul: 9.2 -> 11.1 bits (+1.8 bits). 9.2. Efficiency of the Chi-Squared Detector The existing MVPS chi-squared detector (D-squared against a calibrated threshold) uses a fraction eta of the total detection capacity: eta = D-squared_observed / I_Fisher . Empirically, eta = 0.24 (24%). This means 76% of the information- theoretic capacity is unused by the current detector. A Fisher- scoring detector, which follows the gradient of the log-likelihood, provably approaches eta = 1.0 (the Cramer-Rao bound) and is demonstrated in the companion script. The gap eta < 1 is a concrete open problem: "Can we build a detector that approaches the Cramer-Rao bound?" This is a well-defined optimisation problem with clear metrics, suitable for future work. 10. Anchor Placement Optimisation Combining Theorem 1 (GDDP bound), Lemma 2 (blind cones), and Theorem 3 (monotonicity), the anchor-placement problem becomes: Melegassi Expires: 6 January 2027 [Page 7] Given: N existing anchors and K candidate new sites. Choose: k new sites (k <= K) to minimise max_{v in V, theta} d*(v, theta) . This is a min-max problem over a finite candidate set, solvable by enumeration for moderate K or by greedy algorithms for large K. The objective function d*(v, theta) is computed from the Fisher Information, which depends only on the geometry -- no simulation or measurement campaign is needed. For the 5-anchor European cohort: Before: max d* = 689 km (Dubai, worst direction) After adding 1 anchor near Istanbul: max d* drops to ~350 km (-49%) Dubai anisotropy: 6.3x -> 1.0x (isotropic) 11. Empirical Confirmation (Scripts and Receipts) Every result in this document is validated to three layers. 11.1. Layer 1: Canonical Proofs (this document) Theorems 1, 3 have elementary proofs (Cramer-Rao, Fisher additivity). Lemma 2 is proved by construction (worked example). 11.2. Layer 2: Deterministic Simulation Three scripts, all pure Python, no external dependencies, seed=1337 for reproducibility: (a) find_min_detect_exact.py -- computes d*(v, theta) by bisection to 1-metre precision for 72 bearings x 5 vantages. All values match the closed-form prediction. (b) lab_m8_geometric_evasion.py -- red/blue team lab. Red team: Istanbul claims Ankara (349 km), D-squared = 4.678 < 11.345, undetected. Blue team: add one anchor near Istanbul, D-squared jumps to 223, detected. 6/6 checks PASS. (c) lab_shannon_detection_capacity.py -- computes Fisher Information, channel capacity, and detector efficiency. 5/5 checks PASS. Scripts and receipts are public at: https://catellix.com/draft-editor (toolkit section). 11.3. Layer 3: Real RIPE Atlas Data validate_gddp_real_data.py uses 2+ months of RIPE Atlas measurement 1001 (ping to K-root v4, perpetually active, free to read) collected by the Catellix evidence pipeline. Data: 92,067 D-squared values from 40 probes (7-day window), plus continuous real-time RTT collection since May 2026. Results (11/11 checks PASS): (A) Historical D-squared distribution: Melegassi Expires: 6 January 2027 [Page 8] - False-alarm rate at alpha=0.01: 3.03% (< 5% threshold) [PASS] - D-squared variance > 0: confirms non-trivial information [PASS] (B) Live RTT data (44 measurements, last hour): - Measured RTT sigma = 9.122 ms, CV = 0.4125 (41%) - Fisher Information I = 0.012 from real measurements - d* = 354.2 km (Cramer-Rao from measured Fisher) - RTT range = 28.9 ms (anisotropy confirmed) - 0% false alarms in current window (C) Monotonicity: d*(N=44) = 354 km < d*(N=22) = 501 km [PASS] (D) Cross-validation: historical median D-squared (0.217) vs live median (0.649) within 3x ratio [PASS] Receipt: evidence/gddp_real_data_receipt.json SHA-256: 8ae56330aefd9953494fc76fb1c7b058 ed25cb8f78f3978aca3838b244c1a75e 12. Mapping to the MVPS Bundle GDDP addresses the C1 (geo-licensing) axis of the MVPS bundle [I-D.melegassi-ippm-mvps-bundle]. The relationship to companion documents: Document Axis What it proves --------------------------------- ------ ------------------------- This document (GDDP) C1 detection limits (space) NTP clock-coherence C2 detection limits (time) [I-D.melegassi-ntp-mvps-clock-coherence] AI coherence all AI layer ceiling [I-D.melegassi-mvps-ai-coherence] Coherence-BFD timing detection latency [I-D.melegassi-coherence-bfd] The GDDP bound d*(v, theta) is a per-vantage, per-direction annotation on every MVPS bundle. Operators SHOULD compute and publish the GDDP scalar field alongside the bundle to enable informed anchor-placement decisions. 13. What This Document Does NOT Claim o No change to the MVPS wire format, bundle schema, or axioms. o No localisation. GDDP quantifies detection sensitivity, not position estimation. Knowing WHERE an attacker displaced to requires the full localisation problem (and more anchors). o No defence against ALL attacks. A displacement below d* is provably indistinguishable from noise (Theorem 1(c)). This is a hard limit of the geometry, stated openly. o The d* values in Appendix A are for a specific 5-anchor cohort and serve as a worked example. Operators MUST compute d* for their own anchor set. o The 24% efficiency figure (Section 9.2) is empirical, not a theorem. Closing the gap requires a different detector, not Melegassi Expires: 6 January 2027 [Page 9] a different framework. 14. Security Considerations The GDDP scalar field is itself useful intelligence. An adversary who knows the anchor set can compute the blind cones and choose a displacement direction that maximises d* (i.e. minimises detection probability). Operators SHOULD therefore: (a) treat the detailed GDDP map as operationally sensitive (do not publish the full scalar field to untrusted parties); (b) use the anchor-placement optimisation (Section 10) to reduce the worst-case blind cone; and (c) monitor the GDDP field over time as anchors are added/removed. The monotonicity theorem (Theorem 3) guarantees that adding anchors never makes things worse, so incremental improvement is safe. 15. IANA Considerations This document has no IANA actions. 16. References 16.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, May 2017. [I-D.melegassi-ippm-mvps-bundle] Melegassi, L., "Multi-Vantage Path Snapshot (MVPS)", Work in Progress, Internet-Draft, draft-melegassi-ippm-mvps-bundle-00, May 2026. 16.2. Informative References [I-D.melegassi-ntp-mvps-clock-coherence] Melegassi, L., "Cross-Vantage Clock-Offset Coherence Bounds for NTP-Disciplined Measurement Vantages", Work in Progress, Internet-Draft, draft-melegassi-ntp-mvps-clock-coherence-00, May 2026. (Note: a -01 revision adding H. Stenn as co-author is in preparation.) [I-D.melegassi-mvps-ai-coherence] Melegassi, L., "MVPS AI-Coherence Extension", Work in Progress, Internet-Draft, draft-melegassi-mvps-ai-coherence-00, May 2026. [I-D.melegassi-coherence-bfd] Melegassi, L., "Coherence-BFD: Sub-Second Multi-Vantage Coherence Liveness", Work in Progress, Internet-Draft, draft-melegassi-coherence-bfd-00, May 2026. Melegassi Expires: 6 January 2027 [Page 10] [Rao-1945] Rao, C. R., "Information and the accuracy attainable in the estimation of statistical parameters", Bulletin of the Calcutta Mathematical Society 37, pp. 81-91, 1945. [Cover-Thomas] Cover, T. and J. Thomas, "Elements of Information Theory", 2nd ed., Wiley, 2006 (data-processing inequality, Theorem 2.8.1; Fisher Information, Chapter 11). [Kaplan-Hegarty] Kaplan, E. and C. Hegarty, "Understanding GPS/GNSS: Principles and Applications", 3rd ed., Artech House, 2017 (GDOP, Chapter 7). [Shen-Win-2010] Shen, Y. and M. Z. Win, "Fundamental Limits of Wideband Localization -- Part I: A General Framework", IEEE Trans. Information Theory, vol. 56, no. 10, October 2010 (SPEB, Squared Position Error Bound). [VerLoc-2022] Kohls, K. and C. Diaz, "VerLoc: Verifiable Localization in Decentralized Systems", USENIX Security 2022 (observes directional effect, does not formalise d*). [GDDP-SCRIPTS] Melegassi, L., "GDDP Validation Scripts and Evidence", Catellix technical note, July 2026, . Appendix A. Worked d* Values per Vantage (5-Anchor European Cohort) Anchors: Amsterdam, Frankfurt, London, Marseille, Stockholm. Timing: sigma_NTP = 1 ms (NTP stratum-2). Threshold: chi-squared(3, 0.01) = 11.345. Vantage d*_min (km) d*_max (km) Anisotropy ratio ---------- ----------- ----------- ---------------- Paris 55 110 2.0x Milan 91 180 2.0x Warsaw 157 320 2.0x Istanbul 328 650 2.0x Dubai 689 1400 2.0x Reading: Paris (surrounded by 3 nearby anchors) has d*_min = 55 km; an attacker displacing by < 55 km is provably invisible. Dubai (3000+ km from all anchors) has d*_min = 689 km. Appendix B. Scaling with Timing Precision The d* field scales linearly with sigma_NTP: Timing class sigma_NTP Paris d* Dubai d* --------------- ---------- -------- -------- NTP stratum-2 1 ms 55 km 689 km PTP 100 us 5.5 km 69 km Melegassi Expires: 6 January 2027 [Page 11] GPS disciplined 10 us 550 m 6.9 km PPS 1-sigma 1 us 55 m 689 m Tightening the timing precision is the most direct way to reduce d*. With PTP-class timing, even Dubai's worst-case d* drops to 69 km. With GPS discipline, sub-kilometre detection is achievable for all European vantages. Author's Address Leonardo Melegassi Catellix Brazil Email: melegassi@catellix.com Melegassi Expires: 6 January 2027 [Page 12]