Joint Probabilistic Shaping and Symbol-Level Precoding for Covert LEO Satellite Downlinks

Introduction

Low-Earth-orbit (LEO) satellite systems are becoming a key component of non-terrestrial networks, extending connectivity beyond terrestrial infrastructure and supporting broadband access, remote monitoring, and Internet-of-Things services [1, 2]. Their integration with cellular networks has motivated extensive work on satellite propagation, mobility, and radio-access procedures [3]. However, the wide footprint of a satellite downlink also exposes the transmitted signal to any receiver within it. In applications where the mere occurrence of communication reveals sensitive activity, protecting the information content is not enough, and the transmission itself must remain undetected. Covert communication addresses this requirement by limiting a passive warden’s ability to distinguish transmission from silence [4].

The detection capability of the warden is determined by the statistics of its observations. In a multiuser LEO downlink, these statistics depend on two design choices. The precoder determines how much of each transmitted signal leaks toward the warden, while the occurrence probabilities of the multiuser symbol combinations determine how often each leakage level is observed. The two choices are coupled, since a symbol combination that requires little power to serve the legitimate users may produce substantial leakage toward an unintended location. The satellite setting adds two more features. The warden remains at one ground position while the satellite moves, so it can combine observations collected under different geometries over the scheduled session. Moreover, the line-of-sight (LoS) channel is largely determined by the satellite trajectory and the ground position, so the leakage can be bounded over a region of candidate warden locations even when the exact location is unknown. A covert design should therefore account jointly for the precoder, the symbol statistics, and the evidence accumulated over the session.

State of the Art

The information-theoretic foundations of covert communication were established through the square-root law for additive white Gaussian noise (AWGN) channels [5]. Subsequent works characterized covert communication through channel resolvability [6] and derived the fundamental scaling constants for discrete memoryless and AWGN channels [7]. These results show that covertness is governed by the distinguishability of the warden’s observation distributions, and thus by both the statistics of the transmitted signal and the observation duration.

Building on these foundations, practical designs reduce this distinguishability mainly by introducing uncertainty at the warden. The effect of an unknown background-noise power was examined in [8, 9], covert transmission aided by an uninformed jammer was studied in [10], and artificial noise (AN) generated by spatially distributed cooperative nodes or by a full-duplex receiver was considered in [11, 12]. Covertness requirements have also been incorporated into the resource optimization of learning systems [13]. In LEO networks, power control and co-channel interference were used to balance covertness and reliability in multi-tier constellations [14], and a robust rate-splitting and jamming design was developed under uncertainty in both the legitimate and warden channels [15]. Satellite uplinks with uncertain transmitter and UAV-warden locations were investigated in [16], accounting for detection opportunities over multiple message fragments, while orthogonal time frequency space (OTFS) modulation was studied under joint time- and delay–Doppler-domain detection [17]. These works control power, interference, and additional radiation, but treat the statistics of the information-bearing symbols as given.

A finer control of the transmitted signal is offered by symbol-level precoding (SLP), which designs the transmit vector based on both the channel state information (CSI) and the instantaneous data symbols. Constructive-interference (CI) designs exploit known multiuser interference to enlarge the decision margins of the legitimate users [18, 19, 20, 21], and SLP has been applied to satellite downlinks under per-antenna power constraints [22]. Symbol-level control has also been exploited for security. CI-based secure precoding was developed in [23], while joint CI and destructive-interference (DI) designs which strengthen the signals of the legitimate users and degrade those of potential eavesdroppers were proposed for secure integrated sensing and communication (ISAC) under target-angle uncertainty [24] and in the near-field regime [25]. Moreover, an SLP design for integrated sensing and covert communication was presented in [26]. These works establish that SLP can shape what an unintended receiver observes. However, they optimize the transmit vector of each symbol combination, while the occurrence probabilities of these combinations remain fixed by the data.

The occurrence probabilities themselves can be controlled through probabilistic shaping. Probabilistic amplitude shaping combines nonuniform symbol distributions with coded modulation [27], and distribution matching provides an invertible mapping from data bits to sequences with a prescribed composition [28]. For covert communication, constellation probabilities and transmit power were jointly optimized to improve the covert rate of a single-antenna link [29]. However, in these works, shaping is applied to the symbols of a single link and therefore changes the symbol distribution observed by the legitimate receiver.

Motivation and Contribution

Despite these advances, important gaps remain for covert multiuser LEO downlinks. First, precoding-based and shaping-based covert designs have been developed separately. SLP designs optimize the precoding for given symbol statistics, whereas shaping designs modify the symbol distribution of a single link without exploiting the multiuser spatial structure. However, in a multiuser downlink, the joint symbol combinations across users can be shaped, while the symbol distribution of each individual user remains unchanged. To the best of our knowledge, this possibility has not been explored for covert communication, and the coupling between precoding and pattern probabilities has not been captured. Furthermore, with discrete symbols and symbol-dependent precoding, the warden observes a Gaussian mixture whose weights are the pattern probabilities, and whose distinguishability accumulates over blocks with different geometries. To the best of our knowledge, an exact characterization of this finite-session observation law is not available. In addition, the warden’s location is usually assumed known, modeled statistically, or represented by a finite set of candidate points, which provides no guarantee between the considered locations. For a fixed warden observing the entire scheduled session, the guarantee must instead hold at every position of a continuous region, after accumulating the evidence of all blocks at that position.

Motivated by the above, this paper develops a joint probabilistic-shaping and precoding framework for covert multiuser LEO downlinks. Each PSK symbol vector is decomposed into a relative multiuser pattern and a common rotation, so that the pattern probabilities can be shaped while every legitimate user still observes uniformly distributed PSK symbols. The precoding vectors and the pattern probabilities are then jointly designed to minimize a certified bound on the warden’s finite-session distinguishability, valid over the entire location uncertainty region, subject to robust CI, power, and entropy requirements. The main contributions are summarized as follows:

• We propose two covert designs that jointly optimize the precoding and the probabilities of relative multiuser patterns: probabilistically shaped SLP (PS-SLP), with one precoding vector per pattern, and probabilistically shaped block-level precoding (PS-BLP), with a common linear precoder per block. Both preserve uniform PSK marginals at every legitimate user and allocate an input-entropy requirement across the blocks of the session. The CI requirements are guaranteed for every error within a norm-bounded set around the predicted LoS channels of the legitimate users, which accounts for orbit and position errors, imperfect phase and Doppler compensation, and atmospheric effects.

• We derive the exact chi-square divergence of the warden’s weighted Gaussian-mixture observation and extend it to the complete session, for a warden that knows the precoding vectors and the pattern distributions. Since the location of the warden is unknown, we bound its leakage over a continuous location uncertainty region, using only a lower bound on its noise variance and an upper bound on its antenna gain, and obtain finite-session certificates that hold at every position of this region. The tightest certificate is never looser than a simpler alternative bound, and, under exact envelopes, its leading low-leakage term coincides with that of the exact divergence.

• We develop an alternating optimization in which both the precoding and the probability updates are equivalent to convex conic problems, so that each update is solved exactly. We further show that the optimized probabilities follow an exponential law in a per-pattern leakage-and-power cost, analogous to Maxwell–Boltzmann shaping, which explains how the session entropy is allocated across blocks.

• Numerical results show that shaping substantially reduces the certified covertness level of both precoding structures, and that its benefit grows with the warden-location uncertainty, at low satellite elevation, and under scarce power. Under larger channel errors at the legitimate users, shaping also extends the range of QoS requirements for which covertness can be certified. The results also quantify the conservatism of the certificates and the session length that can be certified for a target covertness level.

Structure and Notation

The remainder of this paper is organized as follows. Section II introduces the system model and the relative-pattern signaling. Section III derives the finite-session covertness analysis and the robust certificates. Section IV presents the joint design problem and its solution. Section V reports the numerical results, and Section VI concludes the paper.

Notation: Boldface lowercase and uppercase letters denote vectors and matrices, respectively. The superscripts $(\cdot)^{T}$, $(\cdot)^{H}$, and $(\cdot)^{*}$ denote transpose, Hermitian transpose, and complex conjugation. The sets of real and complex numbers are denoted by $\mathbb{R}$ and $\mathbb{C}$, and $j=\sqrt{-1}$. The operators $\Re\{\cdot\}$ and $\Im\{\cdot\}$ extract the real and imaginary parts, and $\lvert\cdot\rvert$ and $\lVert\cdot\rVert$ denote the scalar modulus and the Euclidean norm. The symbol $\Pr(\cdot)$ denotes probability, and $\mathcal{CN}(0,\sigma^{2})$ denotes a zero-mean proper complex Gaussian distribution with variance $\sigma^{2}$. Natural, base-two, and base-ten logarithms are denoted by $\ln$, $\log_{2}$, and $\log$, respectively. The entropy $H(\cdot)$ is measured in bits, and $\operatorname{Var}_{\boldsymbol{\pi}}(\cdot)$ denotes the variance under the pattern distribution $\boldsymbol{\pi}$. Finally, $\chi^{2}$ denotes the chi-square divergence and $\operatorname{TV}(P_{1},P_{0})$ the total-variation distance between the probability laws $P_{1}$ and $P_{0}$.

System Model and Relative-Pattern Shaping

LEO Geometry and Channel Uncertainty

As illustrated in Figure 1, we consider a LEO satellite equipped with a uniform linear array (ULA) comprising $N$ elements with half-wavelength spacing and a dedicated RF chain for each antenna element, serving $K$ single-antenna legitimate users, referred to as Bobs, indexed by $k\in\mathcal{K}\triangleq\{1,\ldots,K\}$. A passive single-antenna warden, Willie (W), attempts to distinguish transmission from silence during the scheduled downlink session. The antenna elements and their corresponding RF chains are indexed by $n\in\mathcal{N}\triangleq\{1,\ldots,N\}$. The scheduled session is partitioned into $T$ quasi-static transmission blocks, indexed by $\tau\in\mathcal{T}\triangleq\{1,\ldots,T\}$, each comprising $L$ channel uses, for a total of $n_{\mathrm{obs}}=TL$ channel uses. The symbol duration is $T_{\mathrm{s}}$, so each transmission block spans $LT_{\mathrm{s}}$, and the total active transmission time is $n_{\mathrm{obs}}T_{\mathrm{s}}$. The block duration is chosen so that the effective channels can be treated as constant after timing, carrier-phase, and Doppler compensation. The satellite trajectory and array orientation over the scheduled transmission blocks are assumed known when the precoding vectors are designed.

Let $\mathbf{p}_{\mathrm{s},\tau}$ denote the satellite position at transmission block $\tau$ and $\mathbf{p}_{u}$ the position of a ground node $u\in\mathcal{K}\cup\{\mathcal{W}\}$. The slant range, the unit line-of-sight (LoS) vector, and the direction cosine with respect to the array axis are

where $\mathbf{o}_{a,\tau}$ is the unit vector along the array axis. Hence, for a generic direction cosine $\nu\in[-1,1]$, the normalized ULA response is

Under the adopted free-space LoS model, the channel amplitude toward node $u$ is

where $G_{\mathrm{s}}$ and $G_{u}$ denote element and receive-antenna power gains and $\Lambda_{u,\tau}$ collects additional propagation losses in dB. The satellite predicts each Bob’s channel from the known satellite trajectory and the Bob’s reported position. Residual orbit and position errors, imperfect phase and Doppler compensation, and atmospheric propagation effects make the actual channel deviate from this prediction. We therefore model the nominal and actual channels of Bob $k$ as

where $\mathbf{e}_{k,\tau}\in\mathbb{C}^{N}$ denotes the channel prediction error of Bob $k$ in transmission block $\tau$, and $\delta^{B}_{k,\tau}=\kappa_{B}\lVert\widehat{\mathbf{h}}_{k,\tau}\rVert$ specifies its norm bound.

Willie’s exact position $\mathbf{p}_{W}$ is unknown to the satellite, which only knows that he lies in a bounded ground region $\mathcal{A}_{W}$, referred to as the location uncertainty region. Willie remains at the same position throughout the session, but his channel varies across transmission blocks as the satellite moves, according to

Regarding Willie, the satellite knows only the location uncertainty region $\mathcal{A}_{W}$, an upper bound on his receive-antenna gain $G_{W}$, and a lower bound $\sigma^{2}_{W,\min}$ on his receiver-noise variance, such that $\sigma^{2}_{W}\geq\sigma^{2}_{W,\min}>0$.

Relative-Pattern Signaling

We consider $\mathcal{M}$-PSK, with modulation order $\mathcal{M}$ divisible by four, and alphabet $\mathcal{S}=\{e^{{\rm j}2\pi m/\mathcal{M}}:m=0,\ldots,\mathcal{M}-1\}$. The alphabet is closed under multiplication and conjugation, which enables the relative-pattern representation introduced next. The restriction to $\mathcal{M}$ divisible by four ensures that $\mathcal{S}$ is a union of rotated QPSK subsets. At channel use $\ell$ of transmission block $\tau$, the multiuser symbol vector is

where $s_{k,\tau,\ell}$ is the $\mathcal{M}$-PSK symbol intended for Bob $k$.

To parameterize the joint symbol distribution, we use Bob 1 as a phase reference and describe the remaining Bobs’ symbols relative to it. Accordingly, define the set of relative PSK patterns as

which contains $R=\mathcal{M}^{K-1}$ patterns. We enumerate them as $\mathbf{u}_{1},\ldots,\mathbf{u}_{R}$, indexed by $r\in\mathcal{R}\triangleq\{1,\ldots,R\}$, and denote by $u_{k,r}$ the $k$-th entry of $\mathbf{u}_{r}$. Each multiuser symbol vector admits the unique decomposition

where $\zeta_{\tau,\ell}=s_{1,\tau,\ell}$ is the common rotation and $r_{\tau,\ell}\in\mathcal{R}$ is the corresponding relative-pattern index.

Probabilistic Multiuser Pattern Shaping

The pattern probabilities $\boldsymbol{\pi}_{\tau}=[\pi_{\tau,1},\ldots,\pi_{\tau,R}]^{T}$ are design variables optimized jointly with the precoding vectors. In transmission block $\tau$, they specify

We optimize the joint symbol distribution within a jointly rotation-invariant family, generated by a common rotation $\zeta_{\tau,\ell}$ that is uniform over $\mathcal{S}$ and independent of the relative-pattern index $r_{\tau,\ell}$. This construction guarantees uniform symbol marginals at every Bob while restricting the probability design to the relative patterns. The relative-pattern indices and common rotations are drawn independently across channel uses, with $\boldsymbol{\pi}_{\tau}$ fixed during transmission block $\tau$. For each relative pattern $r$ at transmission block $\tau$, the satellite designs a representative SLP vector $\mathbf{v}_{\tau,r}=[v_{1,\tau,r},\ldots,v_{N,\tau,r}]^{T}\in\mathbb{C}^{N}$, where $n\in\mathcal{N}$ and $v_{n,\tau,r}$ denotes the signal transmitted by the $n$-th RF chain. Hence, the transmitted signal is

Thus, the satellite designs only $R$ representative precoding vectors $\mathbf{v}_{\tau,1},\ldots,\mathbf{v}_{\tau,R}$ per transmission block, one for each relative pattern, rather than one for each of the $\mathcal{M}^{K}$ multiuser symbol vectors. The common rotation $\zeta_{\tau,\ell}$ rotates the selected precoding vector and is Bob 1’s $\mathcal{M}$-PSK symbol, rather than artificial randomness. This reduction uses the rotational symmetry of PSK CI precoding [18].

Lemma 1: For any pattern distribution $\boldsymbol{\pi}_{\tau}$ and any channel use $\ell$ of transmission block $\tau$, the symbol $s_{k,\tau,\ell}$ of every Bob is uniformly distributed over $\mathcal{S}$, and

Proof: For a fixed relative pattern $r$, multiplication by $u_{k,r}\in\mathcal{S}$ permutes the $\mathcal{M}$-PSK alphabet. Since $\zeta_{\tau,\ell}$ is uniform over $\mathcal{S}$ and independent of the pattern index, $s_{k,\tau,\ell}=\zeta_{\tau,\ell}u_{k,r}$ is uniform over $\mathcal{S}$ conditional on every $r$, and hence for any distribution $\boldsymbol{\pi}_{\tau}$. Moreover, the mapping $(\zeta_{\tau,\ell},r_{\tau,\ell})\mapsto\mathbf{s}_{\tau,\ell}$ is bijective. Independence therefore gives $H(\mathbf{s}_{\tau,\ell})=H(\zeta_{\tau,\ell})+H(r_{\tau,\ell})=\log_{2}\mathcal{M}+H(\boldsymbol{\pi}_{\tau})$. ■

Lemma 1 implies that each Bob can use a standard $\mathcal{M}$-PSK decision rule without knowing $\boldsymbol{\pi}_{\tau}$, while nonuniform shaping reduces the multiuser input entropy from $K\log_{2}\mathcal{M}$ to $\log_{2}\mathcal{M}+H(\boldsymbol{\pi}_{\tau})$ bits per channel use. The symbols of different Bobs are then generally statistically dependent. The satellite generates the multiuser symbol vectors jointly, and (12) describes the entropy of this joint input rather than achievable rates for the individual Bobs.

Constructive Interference and Power Constraints

At channel use $\ell$ of transmission block $\tau$, Bob $k$ receives

where $\omega_{k,\tau,\ell}^{B}\sim\mathcal{CN}(0,\sigma_{k}^{2})$ denotes receiver noise with power $\sigma_{k}^{2}$. The CI design places the noiseless received signal inside the decision region of the intended symbol $s_{k,\tau,\ell}$ with a prescribed margin. Multiplication by the conjugate of the intended symbol maps every PSK symbol to the decision region of $1$, giving the symbol-aligned noiseless signal

for any channel use satisfying $r_{\tau,\ell}=r$. The second equality follows from $s_{k,\tau,\ell}=\zeta_{\tau,\ell}u_{k,r}$ and $|\zeta_{\tau,\ell}|=1$. Hence, $z_{k,\tau,r}$ does not depend on the common rotation, and $R$ pattern-wise CI conditions per Bob and transmission block suffice.

For $\mathcal{M}$-PSK, the decision region of the rotated symbol is a sector with half-angle $\phi=\pi/\mathcal{M}$ around the positive real axis. Given a prescribed SNR threshold $\gamma_{\mathrm{req}}>0$, the CI condition [18, 19] requires $z_{k,\tau,r}$ to lie in this sector shifted by $\sqrt{\gamma_{\mathrm{req}}}\sigma_{k}$ along the positive real axis, i.e.,

This shift keeps the noiseless received signal away from both original decision boundaries, providing a prescribed noise margin. Since the actual channel is unknown, (15) must hold for every channel error in (5). Splitting the absolute value into two linear inequalities, indexed by $b\in\{-1,+1\}$, the worst-case error in each of them follows from the Cauchy–Schwarz inequality, which yields the equivalent condition

where $\widehat{z}_{k,\tau,r}=\widehat{\mathbf{h}}_{k,\tau}^{H}\mathbf{v}_{\tau,r}u_{k,r}^{*}$ is the aligned signal for the nominal channel. The term $\delta_{k}^{B}\sec\phi\|\mathbf{v}_{\tau,r}\|$ is the margin lost compared to the worst-case channel error.

Since the common rotation has unit magnitude, the instantaneous power of RF chain $n$ is $|v_{n,\tau,r}|^{2}$ and the total instantaneous transmit power is $\|\mathbf{v}_{\tau,r}\|^{2}$. We impose a peak limit $P_{n}^{\mathrm{pk}}$ per RF chain, which reflects amplifier saturation, an average limit $P^{\mathrm{av}}_{n,\tau}$ per RF chain and block, and an energy budget $E_{\mathrm{sess}}$ for the complete session, which reflects the energy available to the satellite during the scheduled session:

The peak constraint applies to every precoding vector, whereas (17b) and (17c) constrain averages over the pattern distribution, since the transmitted power depends on the selected pattern.

Finite-Session Covertness Analysis and Robust Certificates

This section quantifies how well Willie can detect the transmission. We first derive the exact distinguishability of transmission and silence for a given Willie position in Section III-A. Since this position is unknown, we then bound Willie’s channel over the entire uncertainty region in Section III-B and combine the two results into a covertness certificate that holds for every admissible position in Section III-C. Finally, Section III-D interprets the certificates in the low-leakage regime and compares them with a simpler bound.

Weighted Gaussian-Mixture Observation

Willie must decide whether the satellite transmits or remains silent, based on all his observations during the session. Through his channel (6), his received signal at channel use $\ell$ of block $\tau$ is

where $\omega_{\tau,\ell}\sim\mathcal{CN}(0,\sigma_w^2)$ denotes the receiver noise, independent across channel uses. For relative pattern $r$, define the leakage coefficient $\mu_{\tau,r}(\mathbf{p}_{W})=g_{\tau}^{\mathrm{H}}(\mathbf{p}_{W})v_{\tau,r}$, i.e., the transmitted signal component received by Willie before the common rotation. Here, leakage refers to the received signal component relevant to detection, rather than to information leakage as in secrecy. Substituting (11) into (18) and suppressing the channel-use index, Willie’s binary detection problem in block $\tau$ is

where $\mathcal{H}_0$ and $\mathcal{H}_1$ represent silence and transmission, respectively.

Willie is assumed to know his channel, his noise variance, the scheduled transmission blocks, the precoding vectors $\{v_{\tau,r}\}$, and the distributions $\{\pi_{\tau}\}$. Only the instantaneous realizations of $r$ and $\zeta$ are unknown to him. The precoding table acts as a codebook known to Willie, analogous to a known constellation, whereas the selected entry and its common rotation depend on the instantaneous symbols, which remain unknown to him. Their distributions are specified in Section II-C. In line with Kerckhoffs’s principle, this is a worst-case assumption for the transmitter, since the whole system design is known to the adversary. Therefore, the resulting guarantee also holds for a less-informed Willie, because additional side information cannot degrade the performance of his optimal detector.

Let $p_a(y)$ denote the complex Gaussian density with mean $a$ and variance $\sigma_w^2$, namely

Under $\mathcal{H}_0$, the observation density is $p_0(y)\equiv p_a(y)|_{a=0}$. Under $\mathcal{H}_1$, averaging over the unknown relative pattern and common PSK rotation gives the weighted Gaussian mixture

The position $\mathbf{p}_{W}$ enters $p_{1,\tau}(y)$ through the leakage coefficients $\mu_{\tau,r}(\mathbf{p}_{W})$, although we suppress this argument in the density notation. Under the assumed spatially constant receiver-noise variance, $p_0(y)$ does not depend on $\mathbf{p}_{W}$.

Willie’s minimum detection error is determined by the total-variation distance between $p_{1,\tau}$ and $p_0$, which, like the Kullback–Leibler divergence, has no closed form for a Gaussian mixture. We therefore use the chi-square divergence

which admits an exact expression for the considered mixture, factorizes over independent channel uses, and upper-bounds the total-variation distance [30]. The following proposition provides its exact expression for the adopted PSK shaping model. It is stated in terms of $D_{\tau}=1+\chi^2_{\tau}$, which is the quantity that multiplies over independent channel uses.

Proposition 1: Let $D_{\tau}(\mathbf{p}_{W})=1+\chi^2_{\tau}(\mathbf{p}_{W})$. Then

where

Proof: The proof is presented in Appendix A.

For the geometric LoS channel in (6), the propagation phase is common to all patterns within a block and cancels in every product $\mu_{\tau,r}^{*}\mu_{\tau,t}$, so $D_{\tau}(\mathbf{p}_{W})$ is independent of it. The kernel $\Phi_{\mathcal{M}}$ averages $e^{2\Re\{z\}}$ over the $\mathcal{M}$ PSK rotations, $\zeta\in\mathcal{S}$, thus explains Willie’s ignorance of the common rotation, while (23) depends on the precoding vectors and on the probabilities through every pair of patterns $(r,t)$ through the products $\mu_{\tau,r}^{*}\mu_{\tau,t}$.

Next, we extend the analysis to the complete session. Let $\chi^2_{\mathrm{sess}}(\mathbf{p}_{W})$ denote the chi-square divergence between the joint distributions of Willie’s session observations under $\mathcal{H}_1$ and $\mathcal{H}_0$. Since the pattern indices, the common rotations, and the noise samples are independent across channel uses, it factorizes over the channel uses. The $L$ uses of block $\tau$ are identically distributed and each contributes the factor $D_{\tau}(\mathbf{p}_{W})$, thus

Taking the logarithm yields

Since Willie’s channel changes between blocks while his position remains fixed, (26) accumulates detection evidence over different LEO geometries, with each block contributing according to its own leakage. Silent intervals between blocks do not contribute additional distinguishability, since the corresponding observations follow the same noise-only distribution under both hypotheses.

Let $P_0$ and $P_1(\mathbf{p}_{W})$ denote the joint distributions of Willie’s session observations under $\mathcal{H}_0$ and $\mathcal{H}_1$, respectively. For a fixed $\mathbf{p}_{W}$, the minimum sum $\xi^{\star}(\mathbf{p}_{W})$ of false-alarm and missed-detection probabilities over all detectors satisfies [5, 30]

A blind decision achieves a false-alarm and missed-detection probability sum of one. Following the standard covertness criterion [4, 5], the transmission is called $\epsilon$-covert, for a prescribed $0<\epsilon<1$, if $\xi^{\star}(\mathbf{p}_{W})\ge1-\epsilon$ for every $\mathbf{p}_{W}\in\mathcal{A}_{W}$. Covertness therefore requires Willie’s optimal detector to perform close to a blind decision, rather than requiring zero received signal energy. Since (26) is additive over the blocks, we express guarantees through bounds on $\ln\left(1+\chi_{\mathrm{sess}}^2\right)$. Any nonnegative $C$ satisfying

guarantees

By (29), requiring $\frac{1}{2}\sqrt{e^{C}-1}\le\epsilon$ guarantees $\epsilon$-covertness, equivalently,

Next, we bound the leakage over the continuous location region.

Leakage Envelope over Willie’s Uncertainty Region

Willie’s position enters (23) only through the leakage coefficients $\mu_{\tau,r}(\mathbf{p}_{W})$. To account for the unknown position, we therefore seek upper bounds on $\lvert\mu_{\tau,r}(\mathbf{p}_{W})\rvert$ that hold throughout $\mathcal{A}_{W}$. A single bound over the whole region would be loose, since Willie’s channel varies considerably across a region of tens of kilometers. We therefore partition $\mathcal{A}_{W}$ into $Q$ cells $\{\mathcal{W}_{q}\}_{q\in\mathcal{Q}}$, with $\mathcal{Q}=\{1,\ldots,Q\}$ and $\bigcup_{q\in\mathcal{Q}}\mathcal{W}_{q}=\mathcal{A}_{W}$, and bound the channel variation within each cell. Each cell is enclosed by a ball of radius $r_q$ centered at $\mathbf{p}_q$, i.e.,

The cells partition $\mathcal{A}_{W}$, while their enclosing balls can overlap. The balls are used only to bound channel variation within each cell, thus their overlap does not affect the guarantee.

For transmission block $\tau$, let $d_{\tau,q}$, $\nu_{\tau,q}$, and $\beta_{\tau,q}$ denote the slant range, the direction cosine, and the channel amplitude at the cell center $\mathbf{p}_q$, where $\beta_{\tau,q}$ is computed from (3) using $\mathbf{G}_{W}$. Since $\lvert\mu_{\tau,r}(\mathbf{p}_{W})\rvert=\beta_{\tau,r}(\mathbf{p}_{W})\lvert\widetilde{\mathbf{a}}^{H}(\nu_{\tau,r}(\mathbf{p}_{W}))\mathbf{v}_{\tau,r}\rvert$, Willie’s position affects the leakage through two factors, the channel amplitude and the array response, which we bound in turn. From the reverse triangle inequality, the slant range of every location in $\mathcal{W}_q$ satisfies $d_{W,\tau}(\mathbf{p}_{W})\ge d_{\tau,q}-r_q$. Since $\beta$ is inversely proportional to the slant range in (3), and assuming $r_q<d_{\tau,q}$ and worst-case antenna gains and losses within the cell, the channel amplitude is bounded by

Next, we bound the variation of the array response. Intuitively, a displacement of at most $r_q$, observed from a distance of at least $d_{\tau,q}-r_q$, can change the LoS direction by at most $r_q/(d_{\tau,q}-r_q)$. Formally, the unit LoS vector $\mathbf{q}(\mathbf{p})=(\mathbf{p}-\mathbf{p}_{s,\tau})/\lVert\mathbf{p}-\mathbf{p}_{s,\tau}\rVert$ in (1) has a Jacobian of norm $1/\lVert\mathbf{p}-\mathbf{p}_{s,\tau}\rVert\le1/(d_{\tau,q}-r_q)$ within the enclosing ball. Since $\nu$ is the projection of $\mathbf{q}$ on the unit array axis, every direction cosine in $\mathcal{W}_q$ lies within

of $\nu_{\tau,q}$, i.e., in the interval $[\nu_{\tau,q}^{-},\nu_{\tau,q}^{+}]$ with $\nu_{\tau,q}^{-}=\max\{-1,\nu_{\tau,q}-\Delta\nu_{\tau,q}\}$ and $\nu_{\tau,q}^{+}=\min\{1,\nu_{\tau,q}+\Delta\nu_{\tau,q}\}$. To translate this interval into a bound on the array response, we use the phase-centered steering vector

The centering does not change $\lvert\widetilde{\mathbf{a}}^{H}(\nu)\rvert$, but it minimizes the norm of the derivative, which becomes $\pi\sqrt{(N^2-1)}/12$, so that the resulting bound is tighter. Evaluating the response only at the cell center would require a margin covering the whole interval. Instead, we evaluate it at $I_a\ge2$ equally spaced anchors

so that every point of the interval lies within $\Delta\nu_{\tau,q}^{\mathrm{res}}=(\nu_{\tau,q}^{+}-\nu_{\tau,q}^{-})/[2(I_a-1)]$ of some anchor. The mean-value inequality then gives

where the value 2 follows from the unit norm of the steering vectors. Thus, $\delta_{\tau,q}^{a}$ bounds how much the steering vector can change between any admissible direction and its nearest anchor.

Combining (32) and (36) with the triangle and Cauchy–Schwarz inequalities, for every $\mathbf{p}_{W}\in\mathcal{W}_q$,

If Willie’s channel includes an additional error that is fixed within each block and has norm at most $\delta_{\tau,q}^{\mathrm{mod}}$ within the cell, (37) still holds, by the triangle inequality, after adding $\delta^{\mathrm{mod}}_{\tau,q}\lVert\mathbf{v}_{\tau,r}\rVert$ to $A_{\tau,r,q}$. Finally, using the lower bound $\sigma^2_{w,\min}$ on Willie’s noise variance, the normalized leakage envelope

satisfies

Finite-Session Covertness Certificate

The envelope (41) bounds the magnitude of each leakage coefficient over a cell, whereas (25) depends on the products $\mu^*_{\tau,r}\mu_{\tau,t}$ of every pair of patterns, including their unknown phases. To combine the two, we bound the kernel $\Phi_M$ by a function of the magnitudes only. We therefore seek a bound in the form of a product of a term for $r$ and a term for $t$, so that the weighted double sum in (25) factorizes into the square of a single sum, which is linear in the probabilities.

Proof. The proof is presented in Appendix B.

The hyperbolic-sine bound is tighter than the exponential bound and is attained for QPSK when $t_1=t_2$ and $z=t_1$. The two bounds are asymptotically equivalent as $t_1,t_2 \to0$. Lemma 2 applies directly to every term of (25). For $p_W \in\mathcal{W}_q$, the envelope (41) gives $|\mu^*_{\tau,r}\mu_{\tau,t}|^2/\sigma_w^4 \le\rho_{\tau,r,q}\rho_{\tau,t,q}$, which is the condition of the lemma with $t_1=\rho_{\tau,r,q}$ and $t_2=\rho_{\tau,t,q}$. The resulting product bounds factorize the double sum, which motivates the probability-weighted leakage measures

Both are averages of a per-pattern leakage term over the pattern distribution, and $M^{\mathrm{sinh}}_{\tau,q} \le M_{\tau,q}$ by Lemma 2. The following theorem uses these measures to bound the divergence of each block over every cell and, by accumulating the blocks, provides session certificates that hold throughout the uncertainty region.

Proof. The proof is presented in Appendix C.

The certificates are valid at arbitrary leakage levels. The maximum over cells is taken after accumulating the transmission blocks because Willie occupies one fixed location throughout the session. We optimize $C_E$, since $e^\rho-1$ admits an exact exponential-cone representation, whereas $\sinh(\rho)$ does not. For small leakage, $e^\rho-1$ and $\sinh(\rho)$ are nearly equal, so optimizing $C_E$ instead of $C_{\mathrm{sinh}}$ has only a minor effect on the resulting design. Evaluating $C_{\mathrm{sinh}}\le C_E$ for the optimized design provides an additional, tighter post-design covertness guarantee.

Low-Leakage Interpretation and Comparison with a Separable Bound

Covertness requires the leakage received by Willie to be weak, so the regime of practical interest is that of small leakage. In this regime, the exact expression (25) and the proposed certificate admit simple expansions, which reveal how shaping reduces Willie’s distinguishability and how tight the certificate is. Fix a transmission block and a Willie location, and let $\varrho_{\tau,r}=|\mu_{\tau,r}(p_W)|^2/\sigma^2_w$ denote the SNR at Willie for pattern $r$, with $\varrho_\tau^{\max}=\max_r\varrho_{\tau,r}$. For every $M$ divisible by four, $\Phi_M(z)=1+|z|^2+O(|z|^4)$. Hence, (25) yields

Thus, in the low-leakage regime, Willie’s distinguishability is dominated by the mean SNR at Willie over the pattern distribution, which shaping can reduce by favoring patterns with lower leakage. The phases of the leakage coefficients, and hence the pairwise interactions in (25), affect only higher-order terms. For the proposed measures, $\sinh(\rho)=\rho+O(\rho^3)$ and $e^\rho-1=\rho+O(\rho^2)$ give

where $\rho_{\tau,q}^{\max}=\max_r\rho_{\tau,r,q}$. When both the spatial envelope and the noise lower bound are exact, $\rho_{\tau,r,q}=\varrho_{\tau,r}$, so both measures in (50) reproduce the leading term of (49).

A simpler alternative to the proposed certificates bounds the kernel by $\Phi_M(z)\le e^{|z|^2}$ and then separates the pattern indices through $ab\le(a^2+b^2)/2$. The resulting certificate and its relation to $C_{\mathrm{sinh}}$ are given next.

Proof: The proof is presented in Appendix D.

To interpret the difference from the proposed certificates, consider the same low-leakage regime with exact spatial envelopes and noise lower bound. Then,

Thus, the simpler bound incurs a leading penalty for the variation of the leakage across patterns, whereas the proposed measures reproduce the squared mean-leakage term without this penalty. This variation is precisely what shaping exploits, since it assigns different probabilities to patterns with different leakage. Moreover, $C_{\sinh}$ is never looser than $C_{\mathrm{S}}$, at any leakage level, by Proposition 2. The certificate $C_{\mathrm{E}}$, which is used for the optimization, does not share this property. For equal leakages $\rho>0$, $\bar{d}_{\tau,q}=\rho^{2}$, whereas $M_{\tau,q}^{2}=(e^{\rho}-1)^{2}>\rho^{2}$.

Joint Precoding and Shaping Design

The certificate $C_{\mathrm{E}}$ of Section III is an explicit function of the precoding vectors and the pattern distributions, and can therefore serve directly as a design objective. Section IV-A formulates its minimization under communication, power, and entropy constraints, and Section IV-B develops an alternating optimization with convex subproblems. Section IV-C discusses initialization, convergence, and complexity, while Section IV-D presents the benchmark designs.

Session Entropy and Problem Formulation

The precoding tables and pattern distributions are designed for the scheduled transmission blocks. During each block, the probabilities remain fixed, while the selected precoding vector changes with the instantaneous relative pattern. Minimizing the leakage alone would concentrate the probability on the few patterns with the lowest leakage, and the multiuser input would then carry little information. Therefore, we prescribe an average relative-pattern entropy $\bar{H}$ over the session, which by Lemma 1 corresponds to an average input entropy of $\log_{2}\mathcal{M}+\bar{H}$ bits per channel use. Prescribing the average rather than the entropy of each block allows entropy to be allocated across blocks as the geometry changes. A per-block floor $H_{\mathrm{floor}}$, with $0\le H_{\mathrm{floor}}\le\bar{H}\le\log_{2}R$, limits the concentration of each relative-pattern distribution when positive and setting $H_{\mathrm{floor}}=0$ disables this additional restriction. Finally, a probability floor $0<\pi_{\min}<1/R$ ensures that every symbol vector can still be transmitted.

Define $\mathcal{V}_{\tau}=[\mathbf{v}_{\tau,1},\ldots,\mathbf{v}_{\tau,R}]$ and the collections $\mathcal{V}=\{\mathcal{V}_{\tau}\}_{\tau\in\mathcal{T}}$ and $\boldsymbol{\pi}=\{\boldsymbol{\pi}_{\tau}\}_{\tau\in\mathcal{T}}$. Introducing an auxiliary variable $C$ for the worst cell in (45), the proposed PS-SLP design minimizes $C_{\mathrm{E}}$ in epigraph form as

Unless otherwise indicated, indices range over $k\in\mathcal{K}$, $n\in\mathcal{N}$, $\tau\in\mathcal{T}$, and $r\in\mathcal{R}$. Constraint $C_{1}$ enforces robust CI, while $C_{2}$ makes equal to $C_{\mathrm{E}}$ at the optimum. Constraint $C_{3}$ collects the power and energy limits, $C_{4}$ defines the admissible pattern distributions, and $C_{5}$ and $C_{6}$ impose the session entropy requirement and the per-block entropy floor.

Let $\mathcal{S}^{n_{\mathrm{obs}}}$ denote the sequence of all $n_{\mathrm{obs}}$ multiuser symbol vectors. Independence across channel uses and Lemma 1 imply

This is an input-entropy requirement, not a coded-throughput guarantee. Minimizing $C$ improves the detection-error guarantee in (29). It does not directly optimize Willie’s exact detection error. The structure of (P1) also reveals how the certificate depends on the session length.

Remark 1: Let $T$, the geometry, the entropy requirements, and the power limits be fixed, with $E_{\mathrm{sess}}\propto n_{\mathrm{obs}}=TL$. Then the constraints of (P1) do not depend on $L$, since $L$ cancels in the energy and session-entropy constraints, whereas the objective is proportional to $L$ through $C_{2}$. Hence, the same design is optimal for every $L$ and needs to be computed only once, and

where $c$ is evaluated at this design and does not depend on $L$. The same proportionality holds for $C_{\sinh}$. Let $\epsilon_{\min}^{\mathrm{cert}}=\frac{1}{2}\sqrt{e^{C_{\mathrm{E}}}-1}$ denote the smallest covertness level certified by $C_{\mathrm{E}}$ through (30). Consequently,

and the largest session length certifiable for a target $\epsilon$ is

Alternating Optimization

Problem (P1) is jointly nonconvex, since the probabilities multiply precoding-dependent terms in the covertness constraint C$_2$ and in the average-power and energy constraints. However, it is convex in each block of variables when the other is fixed. We therefore alternate between precoding and probability optimization.

Precoding update

1) Precoding update: At iteration $i$, fix $\boldsymbol{\pi}=\boldsymbol{\pi}^{(i)}$ and consider

Constraints C$_4$–C$_6$ involve only the probabilities and are satisfied by $\boldsymbol{\pi}^{(i)}$. For fixed probabilities, the remaining difficulty lies in the covertness constraint C$_2$. Its left-hand side is convex in the precoding vectors, but it composes a maximum over reference directions, a square, an exponential, and a weighted sum, which conic solvers cannot handle directly. Therefore, we express C$_2$ through two standard cones, namely the exponential cone and the rotated second-order cone,

where the dimension of $\boldsymbol{z}$ is determined by the cone argument. To this end, we introduce nonnegative auxiliary variables $a_{\tau,r,q}$, $b_{\tau,r,q}$, $w_{\tau,r,q}$, and $t_{\tau,q}$, which represent the leakage amplitude, the normalized leakage power, the exponential leakage term, and the probability-weighted leakage measure, respectively, and let $\boldsymbol{t}_q=[t_{1,q},\ldots,t_{T,q}]^{T}$.

Proposition 3: For fixed probabilities $\boldsymbol{\pi}^{(i)}$, the covertness constraint C$_2$ holds if and only if there exist nonnegative $a_{\tau,r,q}$, $b_{\tau,r,q}$, $w_{\tau,r,q}$, and $t_{\tau,q}$ such that

Proof: The proof is presented in Appendix E. $\blacksquare$

Consequently, (P1-V) is equivalent to the convex problem

whose constraints are second-order and exponential cones, since C$_1$ combines affine terms with $\lVert\boldsymbol{v}_{\tau,r}\rVert$ and C$_3$ is convex quadratic for fixed probabilities.

Probability update

2) Probability update: This optimization updates the block-wise pattern distributions during the design procedure. It is not performed at the symbol rate. During transmission, the data bits of each block can be mapped to pattern sequences with the optimized composition by distribution matching [28], which requires no online optimization. For the updated precoding vectors $\mathcal{V}^{(i+1)}$, define

The probability update considers

For fixed precoding vectors, $M_{\tau,q}=\sum_{r}\pi_{\tau,r}f_{\tau,r,q}^{(i+1)}$ is linear in the probabilities, so the covertness constraints are convex quadratics. Let $\boldsymbol{M}_q^{(i+1)}(\boldsymbol{\pi})$ denote the $T$-dimensional vector with entries $M_{\tau,q}$. The entropy constraints C$_5$ and C$_6$ are convex but, like C$_2$, not directly in conic form. We therefore introduce real auxiliary variables $h_{\tau,r}$, which represent the entropy terms $\pi_{\tau,r}\ln\pi_{\tau,r}$.

Proposition 4: Constraints C$_5$ and C$_6$ hold if and only if there exist real $h_{\tau,r}$ such that

Proof: The proof is presented in Appendix F. $\blacksquare$

Consequently, (P1-P) is equivalent to the convex problem

whose constraints are affine, second-order, and exponential cones. Both updates admit exact convex reformulations and are solved numerically to the prescribed tolerance, without successive approximation of the subproblems. Beyond its tractability, the probability update also reveals the structure of the optimal shaping.

Remark 2: For fixed precoding vectors, suppress the iteration superscript in (60). Since (P1-P) is convex, Karush–Kuhn–Tucker (KKT) multipliers exist at its optimum under Slater’s condition, which holds, e.g., if $\bar{H}<\log_2 R$ and the uniform distribution satisfies the average-power and energy constraints. At such an optimum, define

where $\lambda_{C,q}$, $\lambda_{n,\tau}$, and $\lambda_E$ are the nonnegative multipliers of the cell-covertness, average-power, and session-energy constraints, respectively, and $M_{\tau,q}=\sum_r\pi_{\tau,r}f_{\tau,r,q}$. Let $\lambda_H$ and $\lambda_{H,\tau}$ be the nonnegative multipliers of C$_5$ and C$_6$, written in $\le0$ form, and set $\vartheta_{\tau}=(\lambda_H+\lambda_{H,\tau})/\ln2$. For $\vartheta_{\tau}>0$, KKT stationarity gives

Algorithm 1: Alternating PS-SLP Design

Input: Channels, cell envelopes, CI and power requirements, $\bar{H}$, $H_{\mathrm{floor}}$, $\pi_{\min}$, tolerance $\eta> 0$, and iteration limit $I_{\max}$.

Initialize: A feasible $(\mathcal{V}^{(0)},\boldsymbol{\pi}^{(0)})$, with $C^{(0)} = C_{\mathrm{E}}(\mathcal{V}^{(0)},\boldsymbol{\pi}^{(0)})$ and $i = 0$.

1. Solve (P2-V) for $\mathcal{V}^{(i+1)}$.

2. Form (69) and solve (P2-P) for $\boldsymbol{\pi}^{(i+1)}$.

3. Evaluate $C^{(i+1)} = C_{\mathrm{E}}(\mathcal{V}^{(i+1)},\boldsymbol{\pi}^{(i+1)})$ and check all constraints in (P1). Accept the update only if all constraints hold and the objective does not increase, within the solver tolerances. Otherwise, return the last accepted pair.

4. Stop if $\lvert C^{(i+1)}-C^{(i)}\rvert/\max\{C^{(i)},10^{-12}\} \le\eta$ or $i+1 = I_{\max}$. Otherwise increment $i$ and repeat.

Output: The last accepted pair, $C_{\mathrm{E}}$, $C_{\mathrm{sinh}}$, and the corresponding guarantees from (31).

Thus, patterns above the probability floor follow an exponential law in their marginal leakage-and-power cost, analogous to Maxwell–Boltzmann shaping [27]. The parameter $\vartheta_{\tau}$, set by the entropy constraints, plays the role of a temperature. A stricter entropy requirement flattens the distribution, which becomes uniform for $\bar{H} = \log_{2} R$. If the per-block floor $C_{6}$ is inactive, then $\lambda_{H,\tau} = 0$ and $\vartheta_{\tau} = L\lambda_{H}/\ln2$ is common to all blocks. The blocks then differ only in their costs, and the session constraint $C_{5}$ allocates entropy according to the block geometry.

Initialization, Convergence, and Complexity

The alternating optimization requires a feasible starting point. The uniform distribution $\pi_{\tau,r} = 1/R$ satisfies the probability and entropy constraints and is used as a first initialization for (P1-V). Since the average-power and energy constraints depend on the probabilities, (P1-V) may be infeasible for this choice, in which case a few other admissible distributions are tried. Algorithm 1 summarizes the procedure once a feasible pair has been obtained. With each update solved exactly and the previous iterate remaining feasible for the next subproblem, the objective of Algorithm 1 is nonincreasing. Being bounded below by zero through $C_{2}$, it converges to a finite limit.

The partition of $\mathcal{A}_{W}$ contains many cells, and including all of them in every conic solve would be costly. We therefore use constraint generation: each solve includes only a subset of $Q_{a}$ active cells, the solution is then checked over all $Q$ cells, and any violating cells are added before solving again. Since the reduced problem is a relaxation of the full one, a solution that satisfies all cells is also optimal for the full subproblem. For $Q_{a}$ active cells and $I_{a}$ reference directions per cell, the precoding update has $2TRN$ real variables, $2KTR$ robust CI inequalities, $NT$ peak-power, $NT$ average-power, and one energy constraint. Its conic representation in Proposition 3 adds $O(TRQ_{a})$ auxiliary variables and exponential cones and $O(I_{a}TRQ_{a})$ second-order cones for the leakage envelopes. The probability update has $TR$ probabilities, $TR$ entropy-lifting variables, and $Q_{a}$ quadratic convexity constraints.

Let $T_{\mathcal{V}}(Q_{a})$ and $T_{\pi}(Q_{a})$ denote the costs of the two conic solves, which depend on sparsity and solver accuracy. With $I$ alternating iterations and at most $G$ constraint-generation rounds per update, the cost per initialization is

where the last term accounts for checking the certificates over all cells. The main scaling limitations are $R = M^{K-1}$ and the $TRQ$ spatial-envelope terms. With $S$ initializations, the total design cost is $S$ times the above cost. The resulting SLP tables require $O(TRN)$ complex storage. During transmission, selecting and rotating a stored vector costs $O(N)$ operations per channel use, excluding pattern generation, giving $O(n_{\mathrm{obs}}N)$ online cost per session. No conic optimization is performed at the symbol rate.

Proposed Designs and Benchmarks

The proposed PS-SLP and PS-BLP designs are compared with their uniform-probability benchmarks, uniform symbol-level precoding (U-SLP) and uniform block-level precoding (U-BLP), under the same channel, CI, power, and energy requirements. PS-SLP jointly optimizes all precoding vectors and the pattern probabilities, as in (P1). PS-BLP jointly optimizes the probabilities and a common linear precoder per transmission block, restricting

Since $\mathbf{s}_{\tau,\ell} = \zeta_{\tau,\ell}\mathbf{u}_{r,\ell}$, the transmitted signal becomes $\mathbf{x}_{\tau,\ell} = \mathbf{W}_{\tau}\mathbf{s}_{\tau,\ell}$, i.e., block-level linear precoding designed under the same robust pattern-wise CI requirements. Thus, PS-BLP retains interference exploitation, consistent with CI-based block-level precoding [31]. Its distinction from PS-SLP is the common linear mapping across all relative patterns. This reduces the precoding variables to $TNK$ complex coefficients while retaining all relative-pattern constraints. Since (78) is linear in $\mathbf{W}_{\tau}$, the precoding update remains convex and Algorithm 1 applies unchanged. U-SLP and U-BLP fix $\pi_{\tau,r} = 1/R$ and optimize only the precoding vectors of the respective designs. Comparing each proposed design with its uniform counterpart isolates the benefit of shaping, whereas comparing U-SLP with U-BLP assesses the benefit of independent pattern-wise precoding over a common CI-constrained linear precoder.

Finally, to isolate the benefit of allocating entropy across blocks, we consider a per-block entropy benchmark, which replaces $C_{5}$ and $C_{6}$ by $H(\boldsymbol{\pi}_{\tau}) \ge\bar{H}$ for every block. Each block must then meet the entropy requirement on its own, so entropy cannot be shifted from blocks with unfavorable geometry to blocks with favorable geometry. Since it is feasible set is contained in that of (P1) when $H_{\mathrm{floor}} \le\bar{H}$, it cannot achieve a lower optimal $C_{\mathrm{E}}$.

Numerical Results

This section evaluates the proposed designs and certificates. We first describe the simulation setup, then compare the certificates with the exact mixture, and finally examine the effects of the communication requirements, the uncertainty, the input entropy, the satellite elevation, the power budget, and the session length.

We use $\mathcal{M}=4$ (QPSK), which is employed in the low-SNR modes of DVB-S2 [32]. Unless otherwise stated, the simulation parameters are $N=24$, $K=3$, $T=3$, and $L=10$, giving $R=16$ relative patterns and $n_{\mathrm{obs}}=30$ active channel uses. The satellite altitude is 600 km and the carrier frequency is 20 GHz, consistent with the LEO Ka-band scenario in [3]. The bandwidth is 20 MHz, with $T_s=50$ ns. The satellite element gain is $10\log G_s=6$ dBi, while the receive-antenna gains are $10\log G_k=10\log G_W=36.7$ dBi. The additional propagation loss is $\Lambda_{u,\tau}=2$ dB for every link and transmission block. The receiver-noise variances are $\sigma_k^2=\sigma_w^2=6.69\times10^{-14}$ W, and we set $\sigma_{w,\min}^2=\sigma_w^2$.

The satellite follows a northbound circular pass along the meridian through the ground-coordinate origin, with the array axis $\mathbf{o}_{a,\tau}$ parallel to its instantaneous velocity. Its position at the session midpoint is specified by the elevation angle $\theta_{\mathrm{el}}^{\mathrm{mid}}$, measured from the local horizon at the origin, with $90^\circ$ corresponding to the satellite directly overhead. The nominal value is $\theta_{\mathrm{el}}^{\mathrm{mid}}=60^\circ$, with the satellite north of the origin, and the block centers are separated by 2 s. Thus, each block lasts $LT_s=0.5\ \mu\mathrm{s}$, so the session consists of short bursts distributed over the pass. Such short transmissions are inherent in covert signaling, since the square-root law limits the number of channel uses that can remain covert [5], as also quantified for the proposed certificates in Remark 1 and Figure 7. The Bobs’ local east–north coordinates, in kilometers, are $(-30,-105)$, $(20,-25)$, and $(-10,105)$. Willie’s uncertainty region is centered at $(70,35)$ and has dimensions $50\alpha_W\times40\alpha_W\ \mathrm{km}^2$. It is partitioned into $1\times1$ km cells on a grid aligned with the region center, with boundary cells extended to full cells, giving $Q=520$, 2000, and 4560 for $\alpha_W=0.5$, 1, and 1.5, respectively. The leakage envelope of each cell uses $I_a=4$ reference directions.

The nominal design parameters are $\gamma_{\mathrm{req}}=4$ dB, $\kappa_B=2\%$, $\bar{H}/\log_2R=0.75$, $H_{\mathrm{floor}}=0$, $\pi_{\min}=10^{-3}$, and $\alpha_W=1$. All RF chains share the same limits, $P_n^{{\rm pk}}=P_{\rm pk}^{{\rm pk}}=0.5$ W and $P_{n,\tau}^{\rm av}=P_{\rm av}=P_{\rm pk}/2$. The session energy budget is $E_{\mathrm{sess}}=\beta_E N n_{\mathrm{obs}}T_sP_{\rm av}$, with $\beta_E=1$ unless otherwise stated. For $\beta_E=1$, the energy constraint is implied by the per-RF-chain average-power constraints, whereas $\beta_E<1$ imposes an additional session-wide limitation.

The optimization is implemented in MATLAB using CVX and MOSEK, with three probability initializations. Across each parameter sweep, previously obtained designs are also used to initialize subsequent operating points whenever they remain feasible under the new parameter values. Except for the certificate comparison in Figure 2, the figure reports $\epsilon_{\min}^{\mathrm{cert}}$, defined in Remark 1, which is computed from $C_E$ at the retained feasible solution. A smaller value gives a stronger certified detection-error guarantee. Values above 1 are omitted, and the horizontal line at $\epsilon=1$ marks the limit beyond which the certificate is vacuous. The tighter certificate $C_{\mathrm{sinh}}$ provides an additional post-design guarantee, illustrated in Figure 2.

Figure 2 compares the certificates of Section III for the same PS-SLP designs. The proposed certificate $C_E$ is 17–28% tighter than $C_S$ over the entire range, in line with the low-leakage analysis, since it avoids the variance penalty of the simpler bound. Evaluating $C_{\mathrm{sinh}}$ for the same designs tightens the certificate by a further 5–14%, with the largest improvement at low QoS thresholds. To assess how conservative the certificates are, the figure also evaluates the same designs, without any reoptimization, through the exact divergence of Proposition 1, maximized over an $81\times65$ grid of Willie locations. At these locations, the resulting $\epsilon$ is 2.1 to 4.9 times lower than the one certified by $C_E$. Hence, the actual covertness of the proposed designs is considerably better than what the certificate guarantees. This margin is the price of guaranteeing covertness at every position of the continuous region rather than at sampled points, and it narrows as the QoS threshold increases. All curves increase with $\gamma_{\mathrm{req}}$, since stricter CI requirements leave less freedom for suppressing leakage toward Willie.

Figure 3 shows $\epsilon_{\min}^{\mathrm{cert}}$ versus the CI QoS threshold for $\kappa_B\in\{0\%,2\%,5\%\}$. Higher thresholds require larger received margins at the Bobs, which leaves less freedom to suppress leakage toward Willie. Bob-channel uncertainty has the same effect, since the CI requirements must hold for every channel error. PS-SLP achieves the lowest certified level in all cases. At the nominal point ($\gamma_{\mathrm{req}}=4$ dB, $\kappa_B=2\%$), it certifies $\epsilon=0.034$, compared with 0.078 for U-SLP, 0.045 for PS-BLP, and 0.090 for U-BLP. Comparing each shaped design with its uniform counterpart shows that shaping reduces the certified level by about half for both precoding structures. Notably, PS-BLP outperforms U-SLP over the whole range, i.e., in this setting, shaping alone yields a larger gain than symbol-level precoding alone. Shaping also extends the range of thresholds that can be certified. For $\kappa_B = 5\%$, U-SLP reaches the vacuous level $\epsilon= 1$ above 7 dB, whereas PS-SLP still certifies $\epsilon\approx0.26$ at 8 dB.

Figure 4 shows the effect of the normalized entropy requirement for $\alpha_W \in\{0.5, 1, 1.5\}$, i.e., Willie uncertainty regions of $25 \times20$, $50 \times40$, and $75 \times60\ \mathrm{km}^2$. A larger $\bar{H}$ forces the probabilities closer to uniform and leaves less freedom to favor low-leakage patterns, so the certified level of the shaped designs increases. At $\bar{H} / \log_2 R = 1$, only the uniform distribution is feasible, and each shaped design coincides with its uniform counterpart, whose certified level does not depend on $\bar{H}$. A larger uncertainty region raises the certified level, since the precoding vectors must suppress leakage over more locations. However, the benefit of shaping grows with the region. At the nominal entropy, PS-SLP reduces the certified level relative to U-SLP by 40% for $\alpha_W = 0.5$, 56% for $\alpha_W = 1$, and 63% for $\alpha_W = 1.5$. When spatial suppression alone becomes harder, making the high-leakage patterns rare becomes increasingly valuable.

Figure 5 reveals how this benefit arises by showing the optimized pattern probabilities of the nominal PS-SLP design versus their costs $\psi_{\tau,r}$ in (62). In every block, the probabilities above the floor lie on a straight line in logarithmic scale and match the prediction of Remark 2. Patterns that are inexpensive to deliver with low leakage are used most often, with probabilities up to about 0.4, whereas the most expensive ones are driven to the floor $\pi_{\min}$, which is reached by two patterns in block 2 and four in block 3. For comparison, the uniform design assigns probability $1/16 \approx0.06$ to every pattern. The three lines are parallel, i.e., all blocks share the same temperature $\vartheta$, as expected from Remark 2 when only the session entropy constraint $C_5$ is active. The blocks therefore differ only in their costs, which are determined by the geometry. The patterns of block 3 are more expensive overall, so this

block is assigned a more concentrated distribution, with entropy 2.72 bits, compared to 3.20 and 3.08 bits for blocks 1 and 2. These values average exactly to $\bar{H} = 3$ bits, so the session constraint allocates entropy to the blocks where its impact on the covertness certificate is smallest. This also explains the trend in Figure 4, since relaxing $\bar{H}$ lowers $\vartheta$, steepens the lines, and makes the expensive patterns even rarer.

Table 1 quantifies the effect of additional constraints on the nominal PS-SLP design, where $H_\tau= H(\pi_\tau)$ is the entropy of block $\tau$ in bits and $E_{\mathrm{used}}$ is the expected transmit energy. Each case changes one setting of the nominal design, which uses $\beta_E = 1$, $H_{\mathrm{floor}} = 0$, and $\delta_{\tau,q}^{\mathrm{mod}} = 0$, and reoptimizes it. Setting $H_{\mathrm{floor}} = \bar{H} = 3$ bits yields the per-block entropy benchmark of Section IV-D. It forces block 3, whose geometry is the least favorable, to 3 bits and increases $\epsilon_{\min}^{\mathrm{cert}}$ by about 2%, which quantifies the benefit of allocating entropy across blocks. Halving the energy budget ($\beta_E = 0.5$) makes the energy constraint active and increases $\epsilon_{\min}^{\mathrm{cert}}$ by about 6%. Finally, a channel-model error with $\delta_{\tau,q}^{\mathrm{mod}} = 10^{-3}\beta_{\tau,q}^{\mathrm{mod}}$, i.e., 0.1% of Willie’s channel amplitude, increases $\epsilon_{\min}^{\mathrm{cert}}$ by about 13%. Since the corresponding margin grows with $\lVert\mathbf{v}_{\tau,r}\rVert$, the design also lowers its energy use, from 82% to 78% of the budget. All cases remain feasible and the certified level changes only moderately.

Case	$\epsilon_{\min}^{\mathrm{cert}}$	$E_{\mathrm{used}}/E_{\mathrm{sess}}$	$H_1$	$H_2$	$H_3$
Nominal	0.03422	0.822	3.195	3.084	2.721
Reduced energy	0.03623	1.000	3.278	3.025	2.697
Per-block entropy	0.03498	0.826	3.000	3.000	3.000
Channel-model error	0.03855	0.780	3.252	3.007	2.742

Figure 6 shows the effect of the satellite elevation at the session midpoint, from $60^\circ$ to $80^\circ$, for $\gamma_{\mathrm{req}} \in\{2,5,8\}$ dB, with the precoding vectors redesigned at each elevation. A higher elevation shortens slant ranges, which reduces the power needed to serve the Bobs but also strengthens Willie’s channel. In this deployment, it also increases the separation between the Bobs and Willie’s region in direction cosine, improving leakage suppression. This improved spatial discrimination and the reduced transmit-power requirement outweigh Willie’s stronger channel, so the certified level decreases with elevation for all thresholds. The decrease is strongest at $\gamma_{\mathrm{req}}=8$ dB, where the certified level drops from 0.14 to 0.020 for PS-SLP and from 0.42 to 0.026 for U-SLP between $60^\circ$ and $80^\circ$. PS-SLP outperforms U-SLP at every elevation, with the largest gain at low elevation, where spatial discrimination is weakest. At $60^\circ$, it reduces the certified level by 58–66% across the three thresholds. At $80^\circ$, the reduction is about 10% for $\gamma_{\mathrm{req}}\in\{2,5\}$ dB but 24% for $\gamma_{\mathrm{req}}=8$ dB. Shaping is therefore most valuable when the geometry alone does not separate the Bobs from Willie and when the QoS requirement is strict.

Figure 7 shows the certified level versus the number of active channel uses for $P^{\mathrm{pk}}\in\{0.15,0.30,0.80\}$ W, with $P_{\mathrm{av}}=P^{\mathrm{pk}}/2$. Here, $T=3$ and the block centers are fixed, while $L$ varies from 1 to 30, i.e., $n_{\mathrm{obs}}=3L$ between 3 and 90, and the energy budget scales with $n_{\mathrm{obs}}$. The certified level increases as Willie accumulates observations and, as predicted by Remark 1, follows exactly the curve $\frac{1}{2}\sqrt{e^{c n_{\mathrm{obs}}}-1}$, since the same design is optimal for every $L$. For the nominal design ($P^{\mathrm{pk}}=0.5$ W), $c\approx1.6\times10^{-4}$, so by (59) sessions of up to about 250 channel uses can be certified for $\epsilon=0.1$, and up to about 1970 for $\epsilon=0.3$. A larger power budget lowers the certified level, since it leaves more freedom to satisfy the CI requirements while suppressing leakage. As the budgets are upper limits, this does not require more transmit power, and the benefit diminishes beyond 0.30 W. The gain of shaping is largest when power is scarce. At $n_{\mathrm{obs}}=30$, PS-SLP reduces the certified level relative to U-SLP by 71% for $P^{\mathrm{pk}}=0.15$ W, and by about 57% for 0.30 and 0.80 W.

Conclusion

This paper investigated covert multiuser LEO satellite downlinks, where a passive warden at an unknown but fixed ground location accumulates observations as the satellite moves. We proposed the PS-SLP and PS-BLP designs, which jointly optimize the precoding and the probabilities of relative multiuser patterns, while every legitimate user still observes uniformly distributed PSK symbols. We derived the exact chi-square divergence of the warden’s observation over the complete session and, by bounding the leakage over a continuous location uncertainty region, obtained covertness certificates that hold at every warden position. The certified covertness level was minimized under robust CI, power, and entropy constraints through an alternating optimization whose updates are equivalent to convex conic problems. The optimized probabilities were shown to follow a Maxwell–Boltzmann-type law, which allocates the session entropy across blocks according to the satellite geometry. Numerical results showed that shaping substantially reduces the certified covertness level of both precoding structures, and that its benefit is largest when precoding alone has limited freedom to suppress the leakage, i.e., under large location uncertainty, at low elevation, under strict QoS requirements, and under scarce power. These findings establish the symbol statistics as a design resource for covertness in their own right. A covert LEO transmitter should therefore control not only where its signal is radiated but also how often each multiuser symbol combination is sent.

Appendix A: Proof of Proposition 1

Expanding the square in (24) and using $\int_{\mathcal{C}}p_{1,\tau}(y)\,\mathrm{d}y=\int_{\mathcal{C}}p_0(y)\,\mathrm{d}y=1$ gives $D_\tau=\int_{\mathcal{C}}p_{1,\tau}^2(y)/p_0(y)\,\mathrm{d}y$. For the Gaussian densities in (22), completing the square yields

Substituting (23), we obtain

For each $v\in\mathcal{S}$, exactly $\mathcal{M}$ of the $\mathcal{M}^2$ pairs $(\zeta_1,\zeta_2)$ satisfy $\zeta_1^*\zeta_2=v$. Thus, with $z=\mu_{\tau,r}^*\mu_{\tau,t}/\sigma_w^2$,

Substitution proves (25).

Appendix B: Proof of Lemma 2

Since $\mathcal{M}$ is divisible by four, the PSK rotations can be grouped into $D_{\mathrm{rot}}=\mathcal{M}/4$ QPSK quadruples, giving

where the auxiliary QPSK kernel is

For $w=x+\mathrm{j}y$, the identity $\cosh(2x)=1+2\sinh^2x$ yields $\Phi_4(w)-1=\sinh^2x+\sinh^2y\ge0$. The power series of $\sinh^2(\cdot)$ has nonnegative even-order coefficients. Since $x^{2\ell}+y^{2\ell}\le(x^2+y^2)^\ell$ for every integer $\ell\ge1$, applying this inequality term-wise gives $\Phi_4(w)-1\le\sinh^2\left(\sqrt{x^2+y^2}\right)=\sinh^2(|w|)$. All rotated arguments in (69) have modulus $|z|$. Averaging and using $|z|^2\le t_1t_2$ therefore yield

Using the power series of $\sinh$ and the Cauchy–Schwarz inequality,

Squaring (72) and combining it with (71) proves the hyperbolic-sine bound. For $\mathcal{M}=4$, it is attained when $t_1=t_2$ and $z=t_1$. Finally, $e^t-1-\sinh(t)=\cosh(t)-1\ge0$ for $t\ge0$, which proves the exponential bound.

Appendix C: Proof of Theorem 1

We apply Lemma 2 to every term of (23), accumulate the blocks through (26), and take the worst cell. For fixed $\tau$ and $\mathbf{p}_{W}\in\mathcal{W}_q$, let $z_{r,t}=\mu_{\tau,r}^{*}(\mathbf{p}_{W})\mu_{\tau,t}(\mathbf{p}_{W})/\sigma_w^2$. From (39), $|z_{r,t}|^2\le\rho_{\tau,r,q}\rho_{\tau,t,q}$. Since $\sum_{r,t}\pi_{\tau,r}\pi_{\tau,t}=1$, applying Lemma 2 with $t_1=\rho_{\tau,r,q}$ and $t_2=\rho_{\tau,t,q}$ to (23) gives

where the last inequality is the last one in (40). This proves (43).

Moreover, every $\mathbf{p}_{W}\in\mathcal{A}_{W}$ lies in some cell $\mathcal{W}_q$, since the cells cover $\mathcal{A}_{W}$. For this cell, (26) and (73) give

Finally, $\ln(1+x)\le x$ for $x\ge0$ and $M_{\tau,q}^{\sinh}\le M_{\tau,q}$ give $C_{\sinh}\le C_E$, which proves (46).

Appendix D: Proof of Proposition 2

We first establish the per-block bound, then its session counterpart, and finally the ordering $C_{\sinh}\le C_S$.

For $w=x+\mathrm{j}y$, the auxiliary kernel $\Phi_4$ defined in (70) satisfies

where the inequality follows from $2^{2\ell-1}\ell!\le(2\ell)!$ and $x^{2\ell}+y^{2\ell}\le(x^2+y^2)^\ell$ for every integer $\ell\ge1$. Applying (75) to each term of (69), with $D_{\mathrm{rot}}=\mathcal{M}/4$, yields

For $\mathbf{p}_{W}\in\mathcal{W}_q$, (39) gives $|\mu_{\tau,r}^{*}\mu_{\tau,t}|^2/\sigma_w^4\le\rho_{\tau,r,q}\rho_{\tau,t,q}$. Substituting into (23),

where the second inequality uses $ab\le(a^2+b^2)/2$. Taking logarithms proves (49). Accumulating the blocks and maximizing over the cells gives the corresponding session bound.

To show $C_{\sinh}\le C_S$, let $\mathbb{E}[\cdot]$ denote the average over $\pi_\tau$ and write $\rho=\rho_{\tau,q}$. By the Cauchy–Schwarz inequality, $\mathbb{E}[\cosh\rho]^2=\mathbb{E}[e^\rho]\mathbb{E}[e^{-\rho}]\ge1$. Thus, $1+(M_{\tau,q}^{\sinh})^2\le(\mathbb{E}[\cosh\rho])^2$. Since $\cosh\rho\le e^{\rho^2/2}$,

Summing over the blocks and maximizing over the cells gives $C_{\sinh}\le C_S$. Together with Theorem 1, this proves (51).

Appendix E: Proof of Proposition 3

First, assume that (59) holds. Since (59a) is imposed at every reference direction, it implies $A_{\tau,r,q}\le a_{\tau,r,q}$, including the channel-model margin when present. The rotated cone (59b) is equivalent to $a_{\tau,r,q}^2\le\sigma_{w,\min}^2b_{\tau,r,q}$, so that $\rho_{\tau,r,q}=A_{\tau,r,q}^2/\sigma_{w,\min}^2\le b_{\tau,r,q}$. The exponential cone (59c) is equivalent to $e^{b_{\tau,r,q}}-1\le w_{\tau,r,q}$, and since $e^x$ is increasing, $e^{\rho_{\tau,r,q}}-1\le w_{\tau,r,q}$. As the probabilities are nonnegative, (59d) then gives

Finally, (59e) is equivalent to $\lVert\mathbf{t}_q\rVert^2\le C$. Since $0\le M_{\tau,q}\le t_{\tau,q}$, this yields $L\sum_\tau M_{\tau,q}^2\le C$ for every $q$, i.e., $C_2$. Conversely, assume that C$_2$ holds and choose $a_{\tau,r,q}=A_{\tau,r,q}$, $b_{\tau,r,q}=\rho_{\tau,r,q}$, $w_{\tau,r,q}=e^{\rho_{\tau,r,q}}-1$, and $t_{\tau,q}=M_{\tau,q}$. These choices are nonnegative and satisfy (59a)–(59d), with equality in (59a) for the maximizing reference direction, while (59e) reduces to C$_2$. This completes the proof.

Appendix F: Proof of Proposition 4

Since $\pi_{\tau,r}\geq\pi_{\min}>0$, the definition (61) shows that (61a) is equivalent to $\pi_{\tau,r}e^{-h_{\tau,r}/\pi_{\tau,r}}\leq1$, i.e., to $h_{\tau,r}\geq\pi_{\tau,r}\ln\pi_{\tau,r}$. First, assume that (61) holds. Combining this inequality with (61b) and (61c) gives

Since $H(\boldsymbol{\pi}_{\tau})=-\sum_{r}\pi_{\tau,r}\ln\pi_{\tau,r}/\ln2$, these are exactly C$_5$ and C$_6$. Conversely, if C$_5$ and C$_6$ hold, choosing $h_{\tau,r}=\pi_{\tau,r}\ln\pi_{\tau,r}$ satisfies (61a) with equality, and (61b) and (61c) reduce to C$_5$ and C$_6$. This completes the proof.