The receiver (white ship) doesn't know its own position — it only measures pseudoranges, the apparent distance to each satellite, and solves for its location by finding the point that best fits all of them (a small Gauss-Newton least-squares solve, run live every frame). Normally those distances are honest and the computed fix (red dot) sits right on top of the true position (green dot). A GPS spoofer is a ground transmitter that broadcasts its own fabricated satellite-like signals at higher power than the real constellation. If the spoofed signal is strong enough, the receiver's tracking loop locks onto it instead of the genuine one for that satellite — and starts feeding the position solver a corrupted range that quietly grows over time, walking the computed fix away from reality without ever making the receiver report a fault.
rho_i = |sat_i − x| + b + noise (honest satellite)
rho_i = |sat_i − x| + b + drift·t (captured by spoofer)
x̂ = argmin Σ (rho_i − |sat_i − x̂| − b̂)² ← Gauss-Newton, 4 iterations/frame
- Spoofer power — capture probability per satellite each second; low power only threatens satellites already near the horizon (weak real signal), high power can override the whole constellation.
- Drift rate — how fast the fabricated pseudorange pulls away once a satellite is captured; this is the "walk-off" that drags the fix toward wherever the attacker wants the target to think it is.
- Satellites in view — more satellites give better geometry and more redundancy for detecting an outlier, but also more channels the spoofer can try to capture.
- Receiver noise — ordinary thermal/atmospheric measurement noise, always present even with zero spoofing.
RAIM (Receiver Autonomous Integrity Monitoring) is the real countermeasure this models: with 5+ satellites the solver has spare equations, so it can flag a fix as unreliable when the residual error of the best fit grows too large — exactly what a partial spoofing capture produces.