Paper deep dive
Distributed Physical Layer Authentication and Collaborative RSMA in Non-Terrestrial Networks via Graph Reinforcement Learning
Parsa Rajabi, Mohammad Mirzaee, Mohammad Reza Abedi, Nader Mokari, Paeiz Azmi
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 9/10/2026, 2:51:43 AM
Summary
This paper proposes SAFA-MZ, a secure adaptive federated authentication framework for multi-zone Non-Terrestrial Networks (NTNs) using High-Altitude Platform Stations (HAPS). It integrates distributed physical-layer authentication (PLA) with collaborative multi-layer Rate-Splitting Multiple Access (RSMA). The system employs Group Differential Privacy (GDP) to protect authentication tags and Artificial Noise (AN) to enhance secrecy. The optimization problem maximizes Secrecy Spectral Efficiency (SSE) by jointly optimizing HAPS placement, user association, and power allocation, solved via a Repair-based Cross-Entropy Method (RCEM) and a Graph-aware Advantage Actor-Critic (GA2C) algorithm.
Entities (9)
Relation Signals (9)
SAFA-MZ → improves → SSE
confidence 95% · proposed method improves average SSE by up to 135% over single-connect transmission
GA2C → scales → Linearly
confidence 95% · GA2C scales linearly and achieves scalable, low-latency inference
SAFA-MZ → solvedby → GA2C
confidence 95% · The resulting problem is solved using ... a graph-aware advantage actor-critic algorithm (GA2C)
SAFA-MZ → uses → RSMA
confidence 95% · embed group-level authentication tags into a collaborative multi-layer rate-splitting multiple access (RSMA) transmission structure
SAFA-MZ → uses → AN
confidence 95% · artificial noise (AN) is used to reduce information leakage
SAFA-MZ → uses → GDP
confidence 95% · group differential privacy (GDP) protects tag information against inference attacks
SAFA-MZ → optimizes → HAPS
confidence 90% · optimizing high-altitude platform station (HAPS) placement
RCEM → scales → Quadratically
confidence 90% · RCEM scales quadratically with the number of users
SAFA-MZ → →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Existing physical-layer authentication (PLA) schemes for non-terrestrial networks (NTNs) often rely on single-anchor verification, lack joint authentication-transmission design, and ignore tag privacy leakage under eavesdropping. In this paper, we consider passive, location-aware, static eavesdroppers without access to legitimate channel state information (CSI). Under this threat model, we propose secure adaptive federated authentication for multi-zone NTN systems (SAFA-MZ) that maximizes secrecy spectral efficiency (SSE) while ensuring authentication reliability, power limits, and coverage constraints. The main idea is to embed group-level authentication tags into a collaborative multi-layer rate-splitting multiple access (RSMA) transmission structure. Private and common signals are jointly beamformed, artificial noise (AN) is used to reduce information leakage, and group differential privacy (GDP) protects tag information against inference attacks. In addition, users are grouped by semantic priority to allocate SSE based on information importance. We formulate a joint SSE maximization problem under authentication reliability and probabilistic secrecy constraints, optimizing high-altitude platform station (HAPS) placement, user association, and RSMA power allocation. The resulting problem is solved using a repair-based cross-entropy method (RCEM) and a graph-aware advantage actor-critic algorithm (GA2C). RCEM scales quadratically with the number of users, while GA2C scales linearly and achieves scalable, low-latency inference. Simulation results under both colluding and non-colluding eavesdroppers show that the proposed method improves average SSE by up to 135% over single-connect transmission and 21% over the scheme without AN. These results confirm SAFA-MZ offers a scalable and secure solution for dynamic NTN environments.
Tags
Links
- Source: https://arxiv.org/abs/2609.09475v1
- Canonical: https://arxiv.org/abs/2609.09475v1
Trouble viewing inline? Open PDF directly →
Full Text
96,020 characters extracted from source content.
Expand or collapse full text
Distributed Physical Layer Authentication and Collaborative RSMA in Non-Terrestrial Networks via Graph Reinforcement Learning Parsa Rajabi Mohammad Mirzaee Mohammad Reza Abedi Nader Mokari Paeiz Azmi †thanks: This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible.†thanks: P. Rajabi, M. Mirzaee, MR. Abedi, N. Mokari, and P. Azmi are with the Department of Electrical and Computer Engineering, Tarbiat Modares University, Tehran, 14115-111, Iran (e-mail: parsa_rajabi@modares.ac.ir; mirzaee.m@modares.ac.ir; Mohammadreza_abedi@modares.ac.ir; nader.mokari@modares.ac.ir; pazmi@modares.ac.ir). Abstract Existing physical-layer authentication (PLA) schemes for non-terrestrial networks (NTNs) often rely on single-anchor verification, lack joint authentication-transmission design, and ignore tag privacy leakage under eavesdropping. In this paper, we consider passive, location-aware, static eavesdroppers without access to legitimate channel state information (CSI). Under this threat model, we propose secure adaptive federated authentication for multi-zone NTN systems (SAFA-MZ) that maximizes secrecy spectral efficiency (SSE) while ensuring authentication reliability, power limits, and coverage constraints. The main idea is to embed group-level authentication tags into a collaborative multi-layer rate-splitting multiple access (RSMA) transmission structure. Private and common signals are jointly beamformed, artificial noise (AN) is used to reduce information leakage, and group differential privacy (GDP) protects tag information against inference attacks. In addition, users are grouped by semantic priority to allocate SSE based on information importance. We formulate a joint SSE maximization problem under authentication reliability and probabilistic secrecy constraints, optimizing high-altitude platform station (HAPS) placement, user association, and RSMA power allocation. The resulting problem is solved using a repair-based cross-entropy method (RCEM) and a graph-aware advantage actor-critic algorithm (GA2C). RCEM scales quadratically with the number of users, while GA2C scales linearly and achieves scalable, low-latency inference. Simulation results under both colluding and non-colluding eavesdroppers show that the proposed method improves average SSE by up to 135% over single-connect transmission and 21% over the scheme without AN. These results confirm SAFA-MZ offers a scalable and secure solution for dynamic NTN environments. Index Terms: Physical Layer Authentication, Non-Terrestrial Network, Group Differential Privacy, Rate-Splitting Multiple Access, Graph Reinforcement Learning. I Introduction Non-terrestrial networks (NTNs) integrate satellites and aerial platforms such as high-altitude platform stations (HAPSs) and unmanned aerial vehicles (UAVs) with terrestrial infrastructure, but long links, mobility, Doppler, and time-varying topologies pose security challenges [1]. In multi-HAPS NTNs, physical-layer authentication (PLA) is critical. PLA verifies transmitters via physical-layer characteristics and is either passive (using inherent fingerprints) or active (embedding explicit tags) [2]. Conventional cryptographic authentication add overhead and latency and does not address physical-layer attacks such as spoofing and pilot contamination [3]. In contrast, PLA exploits physical randomness or embedded tags [4]. Passive PLA often uses geometry or channel features with statistical tests or machine learning (ML) fusion; e.g., [5] proposes a CSI-based statistic for better separability at low SNRs. Fingerprint has been explored in millimeter-wave MIMO via beam patterns [6], and covert authentication during beam alignment has been studied [7]. For active PLA, tag embedding and hypothesis testing are common, including challenge–response (CR) designs [8], message-aware and cancellation-based receivers [9, 10], and fading-aware tag power control [11]. Authentication assisted by reconfigurable intelligent surface (RIS) has been investigated via tag construction and CR [12, 13]. In [14], a CR scheme was proposed where a receiving base station randomly configures RIS to verify the legitimacy of the transmitted message. Phase–tag is another option, where a key-dependent component is superimposed for hypothesis-based detection [15]. Recent surveys summarize progress in learning-based and tag-based PLA under time-varying channels [16, 17]. Generative AI (GAI) has been utilized to enhance adaptive PLA in dynamic environments [18]. The study in [19] reviewed various GAI models for physical layer security applications. In [20], GAI integration with PLA was presented. PLA has also been integrated with reinforcement learning (RL) for trust evaluation [21]. In [3], a deep learning (DL) method was proposed for millimeter wave communications against pilot contamination. Model-driven learning reduces mismatch while preserving detector structure [22]. DL-based joint authentication and localization is proposed in [23], and PLA in satellite channels via DL is investigated in [24]. We focus on active PLA due to its controllability and higher reliability in NTNs, where line-of-sight (LoS) dominance and mobility degrade passive fingerprints. Beyond typical Rician fading in NTN [25], we incorporate probabilistic LoS realization, elevation dependence, and atmospheric attenuation to capture adversarial link conditions. Distributed PLA (DPLA) improve robustness via multi-anchor fusion, but existing designs typically do not address collaborative transmission in multi-transmitter networks [26]. Multi-HAPS NTNs with multi-connectivity require distributed multi-point authentication. Rate-splitting multiple access (RSMA) divides messages into common and private parts [27]. Unlike conventional RSMA, our scheme jointly optimizes private, common, and artificial noise (AN) power splitting under group authentication and secrecy constraints. Unlike relay-based cooperative RSMA [28], our collaborative RSMA uses parallel multi-HAPS transmission with joint beamforming. We use a multi-layer structure where common streams carry group authentication tags and private streams carry user data. Despite multi-layer RSMA [27], its integration with distributed authentication is underexplored. A key challenge is protecting shared authentication tags. Differential privacy (DP) noise creates a privacy–reliability trade-off [29]. Local DP is explored in [30] for data analytics and verifiable mechanisms to mitigate output poisoning attacks in aggregation. DP quantifies privacy leakage under data changes and naturally extends to group-level protection. Group DP (GDP) is introduced in [31], and the effect of changing multiple records jointly is studied in [32]. GDP provides subgroup protection [33]. Perturbation timing and noise mechanism affect utility; later-stage and analytic Gaussian mechanisms improve accuracy [34, 32]. Related developments include DP for large language models (LLM) [29], adaptive privacy-preserving DL [35], generative adversarial networks (GANs) [36], and wireless systems [37]. Unlike cryptographic data-level privacy, we use the physical layer and the Gaussian mechanism for common-tag generation against eavesdroppers. We consider passive external eavesdroppers without signal injection, access to legitimate CSI, or beamforming vectors, attempting tag inference under colluding and non-colluding settings. To further enhance secrecy, we also employ AN. Most existing PLA works are point-to-point and do not integrate multi-HAPS and scalable graph-based framework. Graph-based learning has been applied to distributed throughput optimization in cell-free massive MIMO [38], subgraph-based method for anomaly detection [39], satellite-assisted networks [40], and simultaneously transmitting and reflecting-RIS (STAR-RIS) [41]. Graph neural networks (GNNs) enable distributed resource allocation in cell-free massive multiple-input multiple-output (MIMO) systems with reduced overhead [38], fairness-aware satellites [40], and heterogeneous-graph modeling for STAR-RIS [41]. Leveraging the natural graph structure of NTNs, GNN message passing offers scalability; nevertheless, information leakage from distributed training in dynamic graphs necessitates edge-level DP and resilience against subgraph inference attacks [42]. Moreover, RL is well-suited to sequential decisions under evolving topology, and graph policies improve scalability [43, 44, 45]. However, these studies overlook authentication, privacy, and adversarial robustness. Therefore, joint transmission and authentication in multi-HAPS NTNs remains underexplored. In this paper, secure adaptive federated authentication for multi-zone (SAFA-MZ) addresses these gaps by integrating distributed tag-based PLA, multi-layer RSMA, GDP-protected tags, AN-assisted secrecy, and graph-based RL in a unified secrecy- and fairness-aware NTN framework. Our design jointly optimizes HAPS placement, user association, and power allocation leading to a nonconvex problem. The resulting optimization problem is to maximize spectral secrecy efficiency (SSE) subject to authentication reliability, coverage, and probabilistic secrecy constraints in a multi-HAPS NTN with eavesdroppers. To solve the problem, we propose a repair-based cross-entropy method (RCEM) as a derivative-free baseline for mixed-integer constrained optimization, and a method based on advantage actor–critic (A2C), called graph-aware A2C (GA2C), which combines A2C with a graph autoencoder (GAE) to encode the multi-HAPS topology into permutation-invariant features for topology-aware learning and scalable inference. The main contributions are summarized as follows: • We develop a PLA framework with multiple HAPSs and a group-based scheme where users share a common tag while keeping private streams, supported by collaborative multi-layer RSMA. The collaboration means signals are transmitted from multiple HAPSs to improve robustness, coverage, and SSE. The multi-layer part allows transmitting both group-common and private signals at the same time. Semantic grouping further allocates SSE based on information importance. • We apply GDP with the Gaussian mechanism to group authentication tags to protect tag information even under eavesdropping. In addition, AN is injected into the null space of legitimate users to reduce information leakage. • We study both colluding and non-colluding eavesdropper models and formulate a joint optimization problem that considers secrecy, fairness, HAPS placement, user association, power allocation, and authentication constraints. • We develop RCEM as an evolutionary algorithm and GA2C for scalable learning. Graph modeling enables node addition or removal without network redesign. The remainder of this paper is organized as follows. Section I describes the system model. Section I presents the problem formulation. Section IV introduces the proposed SAFA-MZ framework and the corresponding solution algorithms. Section V analyzes the computational complexity and scalability of the proposed methods. Section VI provides numerical results and performance evaluations. Finally, Section VII concludes the paper. Mathematical Notation Bold lower- and upper-case letters denote vectors and matrices, respectively. (⋅)(·) T and (⋅)(·) H denote transpose and Hermitian transpose; (⋅)−1(·)^-1 and (⋅)†(·) denote inverse and Moore–Penrose pseudoinverse. ∥⋅∥2\|·\|_2 is the Euclidean norm, and |⋅||·| absolute value. nI_n is the n×n× n identity matrix. [⋅]E[·], ⋅I\·\, and ⊙ are expectation, indicator, and Hadamard product. (,)CN( μ, ) denotes a circularly symmetric complex Gaussian distribution with mean μ and covariance . ℝR, ℂC, and ℝ+R_+ denote reals, complex numbers, and non-negative reals. [x]+≜max(0,x)[x]^+ (0,x) ensures non-negativity. ≜ means definition, and log2(⋅) _2(·) is base-22 logarithm. For matrix A, []i,j[A]_i,j is its (i,j)(i,j)-th entry, with (i,:)A(i,:) and (:,j)A(:,j) as its i-th row and j-th column. (⋅)O(·) denotes asymptotic upper bound, and Θ(⋅) (·) a tight bound. Finally, |||A| is the cardinality of set A. I System Model As illustrated in Fig. 1, we consider NTN comprising a set of K HAPSs, a set of U single-antenna ground users, and a set of ℰE passive eavesdroppers. The corresponding index sets are defined as =k1,k2,…,k||K=\k_1,k_2,…,k_|K|\, =u1,u2,…,u||U=\u_1,u_2,…,u_|U|\, and ℰ=e1,e2,…,e|ℰ|E=\e_1,e_2,…,e_|E|\. Each HAPS k transmits a superimposed signal consisting of private, common, and AN components. Let k∈ℂ|k|×MH_k ^|U_k|× M denote the aggregated channel matrix from HAPS k to its associated users, where M is the number of transmit antennas per HAPS, |k||U_k| is the number of users associated with HAPS k. Hence, k=[k,u1,k,u2,…,k,u|k|]TH_k=[h_k,u_1,h_k,u_2,…,h_k,u_|U_k|]^T, where k,u∈ℂM×1h_k,u ^M× 1. The channel vector between HAPS k and user u is denoted by k,uh_k,u. Furthermore, the user set U is partitioned into |||G| disjoint groups based on semantic tags to allocate SSE according to information importance, where g⊆U_g represents the set of users in group g. Groups are denoted by =g1,…,g||G=g_1,…,g_|G|, with Ng≜|g|N_g |U_g| users in group g, and kG_k is the set of groups served by HAPS k. These tags facilitate resource allocation, clustering, and multi-layer transmission in NTNs. Eavesdropper locations are assumed known (e.g., via spoofing signals) to estimate success probability, though the system remains functional without this assumption. Fig. 1: System model. I-A Geometry and Placement The regularized zero-forcing (RZF) precoder is given by ~k=kH(kkH+λk|k|)−1,~k∈ℂM×|k|, P_k=H_k^H\! (H_kH_k^H+ _kI_|U_k| )^-1, P_k ^M×|U_k|, (1) where λk∈ℝ+ _k _+ is the regularization parameter and |k|I_|U_k| is the |k|×|k||U_k|×|U_k| identity matrix. The normalized private beamformer associated with user u∈ku _k is obtained as the corresponding column of ~k P_k: k,u=~k(:,u)∥~k(:,u)∥,k,u∈ℂM×1,p_k,u= P_k(:,u)\| P_k(:,u)\|, _k,u ^M× 1, (2) where ~k(:,u) P_k(:,u) denotes the u-th column of ~k P_k. Let k,g≜k∩gU_k,g _k _g denote the set of users in group g associated with HAPS k. The common beamformer at HAPS k for group g is designed via maximum ratio transmission (MRT) as c,k,g=∑u∈k,gαk,uk,u‖∑u∈k,gαk,uk,u‖,w_c,k,g= _u _k,g _k,u\,h_k,u \| _u _k,g _k,u\,h_k,u \|, (3) where αk,u≥0 _k,u≥ 0 are weighting coefficients. To enhance confidentiality, each HAPS injects AN into the null space of its served users’ channels. The null-space projection matrix is defined as ⟂,k=M−kH(kkH)−1k=M−kk†,P_ ,k=I_M-H_k^H (H_kH_k^H )^-1H_k=I_M-H_kH_k , (4) where ⟂,k∈ℂM×MP_ ,k ^M× M is an idempotent projection matrix and k†H_k denotes the Moore–-Penrose pseudoinverse of kH_k. The AN vector is constructed as k=⟂,kkv_k=P_ ,kz_k , where k∈ℂM×1v_k ^M× 1 and k∼(,M)z_k (0,I_M) is a standard complex Gaussian random vector of dimension M×1M× 1. Each HAPS k is located at k=[qk1,qk2,qk3]∈ℝ3×1q_k=[q_k1,q_k2,q_k3] T ^3× 1, where qk1,qk2q_k1,q_k2 denote horizontal coordinates and qk3>0q_k3>0 is the altitude (in meters). Each ground user u∈u is located at u=[qu1,qu2,0]∈ℝ3×1q_u=[q_u1,q_u2,0] T ^3× 1, and each eavesdropper e∈ℰe is positioned at e=[qe1,qe2,0]∈ℝ3×1q_e=[q_e1,q_e2,0] T ^3× 1. The 3D Euclidean distance between HAPS k and user u is dk,u=∥k−u∥d_k,u= _k-q_u , where dk,u∈ℝ+d_k,u _+. The elevation angle is θk,u=arcsin(qk3dk,u) _k,u= \! ( q_k3d_k,u ), where θk,u∈[0,π2] _k,u∈[0, π2]. We adopt a probabilistic LoS model in which the LoS probability increases with the elevation angle. A generic parametric form is PLoS(θk,u)=11+alexp(−bl(θk,u−θ0)),P_LoS( _k,u)= 11+a_l (-b_l( _k,u- _0) ), (5) where al,bl∈ℝ+a_l,b_l _+ are environment-dependent constants, and θ0∈ℝ _0 is a reference elevation angle. In (5), PLoS(θk,u)∈[0,1]P_LoS( _k,u)∈[0,1]. For each pair (k,u)(k,u), the LoS event is realized by a Bernoulli trial with parameter PLoS(θk,u)P_LoS( _k,u). Conditioned on LoS or NLoS, the large-scale attenuation is βk,u=C0dk,u−αs 10−Sk,u/10Latm(dk,u),βk,u∈ℝ+, _k,u=C_0\,d_k,u^- _s\,10^-S_k,u/10\,L_atm(d_k,u), _k,u _+, (6) where C0∈ℝ+C_0 _+ is a frequency-dependent constant, αs∈ℝ+ _s _+ is the path-loss exponent, Sk,u∼(0,σS2)S_k,u (0, _S^2) is the log-normal shadowing variable in dB, and Latm(dk,u)≥1L_atm(d_k,u)≥ 1 is the atmospheric attenuation factor. For LoS links, a Rician fading model is considered; otherwise, Rayleigh fading applies. The M×1M× 1 channel vector from HAPS k to user u is k,u=βk,u(κrκr+1k,uLoS+1κr+1k,uNLoS),LoS,βk,uk,uNLoS,NLoS.h_k,u= cases _k,u ( _r _r+1\,h^LoS_k,u+ 1 _r+1\,h^NLoS_k,u ),&LoS,\\[6.0pt] _k,u\,h^NLoS_k,u,&NLoS. cases (7) In the above, k,uh_k,u, k,uNLoS∼(,M)h^NLoS_k,u (0,I_M), k,uLoS∈ℂM×1h^LoS_k,u ^M× 1 are the deterministic array steering vectors (functions of azimuth and elevation), and κr∈ℝ+ _r _+ denotes the Rician κr _r-factor. I-B Transmit Model and Association Each HAPS serves up to UperRB∈ℤ+U_perRB _+ users per resource block (RB). The set of users served by k is derived as k=u∈∣au,k=1U_k=\u a_u,k=1\, where the binary association indicator au,ka_u,k equals 11 if user u is associated with HAPS k, and 00 otherwise. Two association modes are considered. In the exclusive association mode, ∑k∈au,k=1 _k a_u,k=1 for all u∈u , meaning that each user is associated with exactly one HAPS. In the multi-connect association mode, ∑k∈au,k≥1 _k a_u,k≥ 1 for all u∈u , allowing a user to be simultaneously associated with multiple HAPSs. Moreover, the per-HAPS serving capacity is constrained by ∑u∈au,k≤UperRB _u a_u,k≤ U_perRB. Thus, the transmit signal from HAPS k is expressed as k= _k= (8) Pt,k(ρb,k∑u∈k,ubu+∑g∈kρc,k,gc,k,gcg+ρd,kk), P_t,k( _b,k _u _kp_k,ub_u+ _g _k _c,k,gw_c,k,gc_g+ _d,kv_k), where k∈ℂM×1x_k ^M× 1 denotes the transmit signal vector, Pt,k∈ℝ+P_t,k _+ is the transmit power, k,u∈ℂM×1p_k,u ^M× 1 is the normalized private precoder for user u, and bu∈ℂb_u is the private information symbol of user u with unit average power, i.e., [|bu|2]=1E[|b_u|^2]=1. Furthermore, c,k,g∈ℂM×1w_c,k,g ^M× 1 is the common precoder, cg∈ℂc_g is the common information symbol of group g with unit average power, i.e., [|cg|2]=1E[|c_g|^2]=1. This ensures that the total transmit power is only controlled by the allocation coefficients. The coefficients ρb,k,ρc,k,g,ρd,k∈ℝ+ _b,k, _c,k,g, _d,k _+ are power-splitting factors. Additionally, k⊆G_k denotes the set of groups that are served by HAPS k. We use GDP for common symbol cg=c~g+nDPc_g= c_g+n_DP, where nDP∼(0,σDP2)n_DP (0, _DP^2) and c~g c_g is common symbol without DP. Here, cgc_g carries both data and authentication tag information; the injected DP noise therefore obfuscates the tag component while preserving data utility. Let ScS_c denote the ℓ2 _2-sensitivity of the mapping from group data to the common symbol c~g c_g. Lemma 1 (Gaussian Mechanism). Let the common-symbol mapping be sc(D)s_c(D) with ℓ2 _2-sensitivity Sc≜maxD∼D′‖sc(D)−sc(D′)‖2,S_c _D D \|s_c(D)-s_c(D )\|_2, (9) where D∼D′D D denotes neighboring datasets differing in one element. Consider s~c=sc(D)+DP s_c=s_c(D)+z_DP, where DP∼(0,σDP2)z_DP (0, _DP^2I). If σDP≥Sc2ln(1.25/δ′)ϵ′ _DP≥ S_c 2 (1.25/δ )ε , then the mechanism is (ϵ′,δ′)(ε ,δ )-DP. Proposition 1 (GDP Scaling [32]). If a mechanism is (ϵ′,δ′)(ε ,δ )-DP for a single group change, then for datasets differing in at most NgN_g elements it satisfies (ϵ,δ)=(Ngϵ′,Ngδ′)(ε,δ)=(N_gε ,\,N_gδ ). The proofs are provided in Appendix A-A and A-B. In the above, ϵε and δ are privacy budget and failure probability, respectively. In this paper, we consider D and D′D are obtained by c~g c_g. Moreover, DPz_DP and s~c s_c can be replaced by nDPn_DP and cgc_g. Hence, the Gaussian mechanism guarantees (ϵ,δ)(ε,δ)-GDP for groups of size NgN_g if σDP≥NgSc2ln(1.25Ng/δ)ϵ. _DP\;≥\; N_gS_c\, 2 (1.25N_g/δ)ε. (10) The DP noise is generated once per group symbol and remains constant over the LsL_s chips of the spreading block. Theorem 1 (Advanced Composition [32]). Suppose the perturbed common symbol is generated independently over T slots, each satisfying (ϵ,δ)(ε,δ)-DP. Then, for any δ¯>0 δ>0, the T-slot mechanism satisfies (ϵT,δT)( _T, _T)-DP with ϵT _T =2Tln(1/δ¯)ϵ+Tϵ(eϵ−1), = 2T (1/ δ)\,ε+Tε(e^ε-1), (11) δT _T =Tδ+δ¯. =Tδ+ δ. (12) The parameter δ¯ δ is a constant that can be optimized by the analyst to balance the composed privacy budget. In our subsequent analysis, we fix δ¯=δ δ=δ to obtain a closed-form expression without loss of generality. This theorem reveals that privacy degrades with repeated releases and the proof is provide in Appendix A-C. Each independent DP release adds fresh noise, and the cumulative privacy loss grows with the number of slots T as ϵT=O(Tϵ+Tϵ2) _T=O( Tε+Tε^2). Hence, longer operation weakens privacy guarantees. It is a trade-off that should be considered by adjusting T, ϵε, and δ. More detailed theorems and their complete proofs can be found in [32]. The received signal at user u∈u is expressed as yu=∑k∈k,uHk+nu,y_u= _k h_k,u^Hx_k+n_u, (13) where nu∼(0,σ2)n_u (0,σ^2) is the additive white Gaussian noise (AWGN). The common stream contribution at user u given by yucom=∑k∈uPt,kρc,k,gk,uHc,k,gcg.y_u^com= _k _u P_t,k _c,k,g\,h_k,u^Hw_c,k,g\,c_g. (14) Based on the association indicators, we define the set of HAPSs serving user u as u≜k∈∣au,k=1K_u \k a_u,k=1\. Similarly, the contribution of the private stream for user u is given by yupri=∑k∈uPt,kρb,kk,uHk,ubu.y_u^pri= _k _u P_t,k\, _b,k\,h_k,u^Hp_k,u\,b_u. (15) The SINR of the common stream for user u∈gu _g is γc,u=∑k∈uPt,kρc,k,g2|k,uHc,k,g|2Iupri+IuAN+σ2, _c,u= Σ _k _uP_t,k _c,k,g^2 |h_k,u^Hw_c,k,g |^2I_u^pri+I_u^AN+σ^2, (16) where the interference from private streams is given by Iupri=∑k∈uPt,kρb,k2∑u′∈k|k,uHk,u′|2.I_u^pri= _k _uP_t,k _b,k^2 _ subarraycu _k subarray |h_k,u^Hp_k,u |^2. (17) Furthermore, the interference caused by AN is expressed as IuAN=∑k∈Pt,kρd,k2‖⟂,kHk,u‖22.I_u^AN= _k P_t,k _d,k^2 \|P_ ,k^Hh_k,u \|_2^2. (18) Under perfect CSI assumptions, the null-space AN does not interfere with legitimate users. However, in practice, residual leakage may occur due to channel estimation errors. Accordingly, the AN interference at user u is modeled as IuAN≈0I_u^AN≈ 0. This modeling choice corresponds to the assumption that the signals transmitted from different HAPSs are not phase-synchronized, so that their received powers add non-coherently. In contrast, the coherent case with perfectly aligned phases would require the modulus to be taken after summation. Accordingly, the achievable common rate is Rc,g=minu∈glog2(1+γc,u).R_c,g= _u _g _2\! (1+ _c,u ). (19) The SINR of the private stream for user u∈u is given by γp,u=∑k∈uPt,kρb,k2|k,uHk,u|2IuMUI+IuAN+σ2, _p,u= Σ _k _uP_t,k _b,k^2 |h_k,u^Hp_k,u |^2I_u^MUI+I_u^AN+σ^2, (20) where the multi-user interference (MUI) is defined as IuMUI=∑k∈uPt,kρb,k2∑u′∈ku′≠u|k,uHk,u′|2.I_u^MUI= _k _uP_t,k _b,k^2 _ subarraycu _k\\ u ≠ u subarray |h_k,u^Hp_k,u |^2. (21) Thus, the achievable private rate for user u is Rp,u=log2(1+γp,u).R_p,u= _2\! (1+ _p,u ). (22) The received SINR at eavesdropper e∈ℰe when attempting to decode the signal of user u from HAPS k is expressed as γe,u=∑k∈uPt,kρb,k2|k,ek,u|2IeMUI+IeC+IeAN+σ2. _e,u= Σ _k _uP_t,k _b,k^2 |h_k,e Hp_k,u |^2I_e^MUI+I_e^C+I_e^AN+σ^2. (23) where k,e∈ℂM×1h_k,e ^M× 1 denotes the channel vector between HAPS k and eavesdropper e. Moreover, IeMUII_e^MUI, IeCI_e^C, and IeANI_e^AN denote the multi-user interference, the common stream interference, and the AN observed at the eavesdropper, respectively. IeCI_e^C is given by IeC=∑k∈Pt,kρc,k,g2|k,eHc,k,g|2.I_e^C= _k P_t,k\, _c,k,g^2\, |h_k,e^Hw_c,k,g |^2. (24) The multi-user interference (MUI) at eavesdropper e is IeMUI=∑k∈Pt,kρb,k2∑u′∈ku′≠u|k,eHk,u′|2.I_e^MUI= _k P_t,k\, _b,k^2 _ subarraycu _k\\ u ≠ u subarray |h_k,e^Hp_k,u |^2. (25) The AN observed at eavesdropper e is IeAN=∑k∈Pt,kρd,k2‖⟂,kHk,e‖22.I_e^AN= _k P_t,k\, _d,k^2 \|P_ ,k^Hh_k,e \|_2^2. (26) Non-Colluding Eavesdroppers. When the eavesdroppers act independently, the secrecy rate of user u is given by Rs,unc=[Rp,u−maxe∈ℰRe,u]+,R_s,u^nc= [R_p,u- _e R_e,u ]^+, (27) where Re,u=log2(1+γe,u)R_e,u= _2 (1+ _e,u ) is the achievable rate of eavesdropper e for decoding the signal of user u. Colluding Eavesdroppers. If the eavesdroppers cooperate by combining their received signals, the secrecy rate for user u is Rs,uc=[Rp,u−log2(1+∑e∈ℰγe,u)]+.R_s,u^c= [R_p,u- _2 (1+ _e _e,u ) ]^+. (28) I-C Fairness in Authentication Fairness in authentication systems is essential for ensuring reliability and equal treatment of all users. Unequal resource distribution can compromise system security by leaving weaker users vulnerable. Despite its importance, fairness is often neglected in many frameworks. We measure fairness across users using Jain’s fairness index: ()=(∑u∈Rp,u)2||∑u∈Rp,u2.J(R)= ( _u R_p,u )^2|U| _u R_p,u^2. (29) Here, ≜[Rp,u]u∈ℝ+||R [\,R_p,u\,]_u _+^|U| represents the per-user achievable rates. Therefore, =1J=1 indicates perfect equality, while →1/||J→ 1/|U| indicates extreme unfairness. I Problem Formulation In this section, we aim to formulate our problem to maximize a secrecy- and fairness-aware network utility. I-A Graph-Regularized HAPS Placement and Group Cohesion We introduce two regularizers: a graph-regularized layout term that keeps coupled HAPSs close, and a group-cohesion term that ensures users in the same group receive signals from similar HAPSs as much as possible. Graph-Regularized HAPS Layout Stack the HAPS coordinates as =[1;…;||]∈ℝ||×3Q\!=\![q_1 T;…;q_|K| T] ^|K|× 3. Let ∈ℝ||×||W ^|K|×|K| be a symmetric, zero-diagonal edge-weight matrix whose (i,j)(i,j)-entry for i≠ji≠ j is chosen as a monotonically increasing function of an inter-HAPS metric Ri,jhhR^h_i,j. It denotes a symmetric inter-HAPS affinity metric that reflects the potential rate coupling between HAPS i and HAPS j, which can be defined, for example, based on backhaul capacity, inter-beam interference, or spatial proximity. In this work, Ri,jhhR^h_i,j is treated as a known scalar obtained from large-scale channel statistics (design choice). A convenient rate-based choice is []i,j=exp(αRi,jhh+Rj,ihh2),[]i,i=0,[W]_i,j= \! (α\, R^h_i,j+R^h_j,i2 ), [W]_i,i=0, (30) where α>0α>0 is a scaling parameter and Ri,jhhR^h_i,j denotes a rate-related inter-HAPS metric. Let 1 denote the all-ones vector. Define =diag()D=diag(W1) and the combinatorial Laplacian =−L=D-W. The layout regularizer is Jl=tr(),J_l\;=\;tr\! (Q TLQ ), (31) which penalizes large distance between strongly connected HAPS pairs. The detailed derivation is provided in Appendix A-D. To normalize the edge weights to [0,1][0,1], we use W~i,j=[]i,j∑i′<j′[]i′,j′,i≠j,W~i,i=0. W_i,j= [W]_i,j _i <j [W]_i ,j , i≠ j, W_i,i=0. (32) Then, normalize the weighted squared distances by the maximum feasible separation dmaxd_ : J~l=∑i<jW~i,j‖i−j‖22dmax2∈[0,1]. J_l= _i<j W_i,j\,\|q_i-q_j\|_2^2d_ ^2\;∈\;[0,1]. (33) Group (Tag) Cohesion Regularizer We consider two association models: hard association, where au,k∈0,1a_u,k∈\0,1\, and soft association, where binary indicators are replaced by continuous weights πu,k∈[0,1] _u,k∈[0,1]. Moreover, hard association can operate in single-connect or multi-connect mode. Hard association. In single-connect mode, each user is served by exactly one HAPS (∑k∈au,k=1 _k a_u,k=1) and we define pg,k≜∑u∈gau,kNgp_g,k _u _ga_u,kN_g. For multi-connect case that users connect to multiple HAPSs (∑k∈au,k≥1 _k a_u,k≥ 1), we normalize the group association weights as pg,k≜1Ng∑u∈gau,k∑k′∈au,k′.p_g,k 1N_g _u _g a_u,k _k a_u,k . (34) The concentration index for group g is ϕg≜∑k∈pg,k2, _g _k p_g,k^2, and the cohesion penalty is Jtag≜∑g∈(1−ϕg),J_tag _g (1- _g ), (35) where pg,kp_g,k is defined according to the considered association mode. A small JtagJ_tag indicates that users’ authentication tags are concentrated on few HAPSs. This lowers security and makes the system vulnerable to attacks on just one HAPS, which could compromise the whole group. Soft association. Under soft association, au,k∈0,1a_u,k∈\0,1\ is replaced by πu,k∈[0,1] _u,k∈[0,1], and we set pg,k≜1Ng∑u∈gπu,kp_g,k 1N_g _u _g _u,k. The definitions of ϕg _g and JtagJ_tag remain the same but are computed from πu,k _u,k. In the simulation, we use pg,kp_g,k as in (34) and1 normalize J¯tag≜∑g∈1−ϕg1−1/Ng. J_tag _g 1- _g1-1/N_g. (36) I-B Secrecy- and Fairness-Aware Objective We now formalize the constrained optimization problem. Due to limited radio resources, some users may remain unserved in a given time slot. Hence, we define the set of served users as srv≜u∈|∑k∈au,k≥1U^srv \u \; |\; _k a_u,k≥ 1 \. Accordingly, the network coverage ratio is defined as ξcov≜|srv|||∈[0,1] _cov |U^srv||U|∈[0,1]. Based on the definitions, the problem is formulated as min _ J~l+λtagJ¯tag−ηJ() J_l+ _tag J_tag- _JJ(R) (37) s.t. .t. C1: ∥˙k∥2≤vmax,∀k∈, 1: \| q_k\|_2≤ v_ , 8.50012pt∀ k , C2: ∥i−j∥2≥dmin,∀i≠j,i,j∈, 2: \|q_i-q_j\|_2≥ d_ , 8.50012pt∀ i≠ j,\ i,j , C3: Pr(∑e∈ℰγe,u>γeth,c)≤ϵc,∀u∈, 3: \! ( _e _e,u> _e^th,c )≤ _c, 8.50012pt∀ u , C4: Pr(maxe∈ℰγe,u>γeth,nc)≤ϵnc,∀u∈, 4: \! ( _e _e,u> _e^th,nc )≤ _nc, 8.50012pt∀ u , C5: Rp,u≥Rmin,∀u∈, 5: R_p,u≥ R_ , 8.50012pt∀ u , C6: ∑u∈au,k≤UperRB,∀k∈, 6: _u a_u,k≤ U_perRB, 8.50012pt∀ k , C7: 0≤ρb,k,ρc,k,g,ρd,k≤1,∀k,g, 7: 0≤ _b,k, _c,k,g, _d,k≤ 1, 8.50012pt∀ k,g, C8: ξcov≥ξreq, 8: _cov≥ _req, C9: ρb,k2+∑g∈kρc,k,g2+ρd,k2≤1,∀k∈, 9: _b,k^2+ _g _k _c,k,g^2+ _d,k^2≤ 1, 8.50012pt∀ k , C10: Rctot>∑g∈wc,gRc,g 10: R_c^tot> _g w_c,gR_c,g Here, the optimization variable set is defined as ≜(k,au,k,k,u,c,k,g,ρb,k,ρc,k,g,ρd,k) (\q_k\,\a_u,k\,\p_k,u\,\w_c,k,g\,\ _b,k\,\ _c,k,g\,\ _d,k\ ). Moreover, λtag,ηJ≥0 _tag, _J≥ 0 are weighting coefficients, and ξreq∈(0,1] _req∈(0,1] denotes the minimum required coverage ratio. γeth,c _e^th,c and γeth,nc _e^th,nc denote the target eavesdropper SINR thresholds for the colluding and non-colluding models, respectively, and ϵc _c and ϵnc _nc are the corresponding maximum allowable violation probabilities. We consider a discrete-time mobility model with step Δt t, where ˙k q_k is the velocity of HAPS k. (C1) limits the maximum velocity to vmaxv_ , while (C2) enforces a minimum safety distance dmind_ . (C3) and (C4) impose secrecy reliability requirements for colluding and non-colluding eavesdroppers, respectively. (C5) guarantees QoS via a per-user private rate threshold RminR_ . (C6) restricts the number of users served per HAPS per resource block. (C7) ensures RSMA power-splitting feasibility. (C8) enforces a minimum network-wide coverage ratio ξreq _req. (C9) represents the total power limitation. Finally, (C10) defines the total rate RctotR_c^tot as the weighted sum of the common signal rate Rc,gR_c,g. wc,gw_c,g sets group priority, e.g., assigning higher weights to emergency communications. IV SAFA-MZ Framework and Algorithms Problem (37) is a non-convex mixed-integer program due to coupled HAPS placement, association, and power allocation. Furthermore, the probabilistic secrecy constraints (C3) and (C4) rely on stochastic channels, making gradient-based methods inapplicable. We address these challenges via two strategies: (i) a derivative-free RCEM algorithm, and (i) a scalable graph RL enhanced by GAE. In both, precoders follow RZF and MRT rules in section I-A, reducing the decision variables. We enforce the probabilistic secrecy constraints (C3)–(C4) in (37), via a Monte Carlo (MC) approximation. In our simulation, the secrecy constraints are enforced in a worst-case sense over all users. Define the colluding and non-colluding worst-case eavesdropper SINRs as Zc() Z_c( ) ≜max∑e∈ℰu∈γe,u(), _u _e _e,u( ), (38) Znc() Z_nc( ) ≜maxu∈maxe∈ℰγe,u(). _u _e _e,u( ). (39) Enforcing Pr(Zc()>γeth,c)≤ϵc (Z_c( )> _e^th,c)≤ _c and similarly for ZncZ_nc conservatively approximates per-user constraints (C3)–(C4), since Zc()>γeth,c=⋃u∈∑e∈ℰγe,u()>γeth,c,\Z_c( )> _e^th,c\= _u \ _e _e,u( )> _e^th,c\, which implies that if the worst-case constraint holds, then all per-user constraints are simultaneously satisfied. Accordingly, the violation probabilities of (C3)–(C4) are pc() p_c( ) ≜Pr(Zc()>γeth,c), \! (Z_c( )> _e^th,c ), (40) pnc() p_nc( ) ≜Pr(Znc()>γeth,nc). \! (Z_nc( )> _e^th,nc ). (41) Using NmcN_mc independent and identically distributed (i.i.d.) channel realizations, we estimate them as p^c() p_c( ) ≜1−1Nmc∑n=1NmcZc(n)()<γeth,c, 1- 1N_mc _n=1^N_mcI\! \Z_c^(n)( )< _e^th,c \, (42) p^nc() p_nc( ) ≜1−1Nmc∑n=1NmcZnc(n)()<γeth,nc, 1- 1N_mc _n=1^N_mcI\! \Z_nc^(n)( )< _e^th,nc \, (43) where Zc(n)()Z_c^(n)( ) and Znc(n)()Z_nc^(n)( ) are computed from the n-th randomized channel realization. Hence, (C3)–(C4) are approximated by p^c()≤ϵc p_c( )≤ _c and p^nc()≤ϵnc p_nc( )≤ _nc, respectively. IV-A RCEM RCEM solves a static instance of (37) by iteratively updating a sampling distribution towards feasible solutions without gradient information. Let ∈ℝD θ ^D denote the concatenated decision vector excluding precoders, where D is the total dimensionality of continuous variables and logits. θ comprises k\q_k\, ρb,k,ρc,k,g,ρd,k\ _b,k, _c,k,g, _d,k\, and au,k\a_u,k\. At iteration t, NsN_s candidate solutions are independently sampled from a diagonal multivariate Gaussian distribution i(t)∼((t),(t)) θ_i^(t) \! ( μ^(t), ^(t) ), where i=1,…,Nsi=1,…,N_s and the covariance matrix is parameterized as (t)=diag(r(t)⊙r(t)) ^(t)=diag\! ( σ_r^(t) σ_r^(t) ). Each sampled vector is mapped to a feasible decision tuple i(t) _i^(t) as follows: • Clipping: Continuous variables are clipped to their admissible ranges, e.g., 0≤ρb,k,ρc,k,g,ρd,k≤10≤ _b,k, _c,k,g, _d,k≤ 1. • Association binarization: The association logits are thresholded to obtain au,k∈0,1a_u,k∈\0,1\. • Capacity repair (C6): If ∑u∈au,k>UperRB _u a_u,k>U_perRB for some k, only the UperRBU_perRB users with the largest instantaneous channel gains to HAPS k are retained. • Coverage repair (C8): If the achieved coverage ratio ξcov=1||∑u∈∑k∈au,k≥1 _cov= 1|U| _u I\! \ _k a_u,k≥ 1 \ is below ξreq _req, additional unserved users are greedily associated to their best available HAPSs (subject to C6) until ξcov≥ξreq _cov≥ _req or no feasible assignment remains. • Rate repair (C10): Constraint C10 is satisfied within tolerance εC10 _C10. If |Rctot−wc,gRc,g|>εC10 |R_c^tot-w_c,gR_c,g |> _C10, the rate variables are adjusted to restore feasibility. This feasibility repair projects onto (C6), (C8), and (C10). The remaining constraints, including probabilistic secrecy via MC approximations, are handled by assigning large penalties to infeasible samples to prevent their selection as elites. For each repaired candidate, the objective value is computed according to (37) and the sample reward is defined as J()≜J~l+λtagJ¯tag−ηJ().J( ) J_l+ _tag J_tag- _JJ(R). (44) The top NeN_e elite samples with the smallest objective values J()J( ) are selected, and Gaussian parameters are updated as (t+1) μ^(t+1) =1Ne∑i∈ℐelite(t)i(t), = 1N_e _i _elite^(t) θ_i^(t), (45) r(t+1) σ_r^(t+1) =1Ne∑i∈ℐelite(t)(i(t)−(t+1))⊙2+ϵRCEM, = 1N_e _i _elite^(t) ( θ_i^(t)- μ^(t+1) ) 2+ _RCEM, (46) where ϵRCEM>0 _RCEM>0 is a numerical stability constant added to prevent premature variance collapse. ℐelite(t)I_elite^(t) denotes the index set of the NeN_e samples with the smallest objective values J(i(t))J( _i^(t)) at iteration t. Here, i(t) _i^(t) represents the repaired feasible decision tuple corresponding to the sampled vector i(t) θ_i^(t) at iteration t. Additionally, (t)∈ℝD μ^(t) ^D and r(t)∈ℝ+D σ_r^(t) _+^D are the mean and element-wise standard deviation, respectively. Since RCEM optimizes a static decision vector, it must be rerun for each snapshot and does not generalize across topologies. Algorithm 1 RCEM 1: NsN_s,NeN_e,NiterN_iter,Nmc,(0),r(0),γeth,c,γeth,nc,ϵc,ϵnc,Rmin,ξreqN_mc, μ^(0), σ_r^(0), _e^th,c, _e^th,nc, _c, _nc,R_ , _req 2: Optimized decision vector ⋆ θ 3: Initialize ←(0) μ← μ^(0), r←r(0) σ_r← σ_r^(0) 4: for t=1t=1 to NiterN_iter do 5: Sample i∼(,diag(r2)) θ_i ( μ,diag( σ_r^2)), i=1,…,Nsi=1,…,N_s 6: for i=1i=1 to NsN_s do 7: Map i→i θ_i→ _i 8: Clip ρb,k,ρc,k,g,ρd,k∈[0,1] _b,k, _c,k,g, _d,k∈[0,1] 9: Binarize association logits →au,k→ a_u,k 10: Enforce (C6), (C8) and (C10) via repair 11: Estimate p^c(i),p^nc(i) p_c( _i), p_nc( _i) using NmcN_mc 12: Apply penalty if (C1)–(C5) or (C9) are violated 13: Compute Rp,uR_p,u and ()J(R) and evaluate J(i)J( _i) 14: end for 15: Select ℐeliteI_elite (smallest NeN_e objective values) 16: Calculate (t+1) μ^(t+1) and r(t+1) σ_r^(t+1) 17: end for 18: return ⋆=(t+1) θ = μ^(t+1) IV-B GA2C Directly applying actor-critic to raw features in large-scale NTNs is inefficient and sensitive to node ordering. We employ a GAE to encode the HAPS interaction graph into a compact, permutation-invariant embedding. Fusing this topology-aware representation with observations improves stability, convergence, and generalization across network sizes and configurations. Accordingly, we design GA2C that learns a policy mapping each NTN snapshot to the joint decisions k\q_k\, au,k\a_u,k\, and ρb,k,ρc,k,g,ρd,k\ _b,k, _c,k,g, _d,k\. IV-B1 Graph Construction and Normalization At time step t, the RL state is defined as t≜(t,t)S_t (o_t,G_t), where t≜(t,t)G_t (X_t,W_t) and to_t denotes the environment observation vector, including k\q_k\, au,k\a_u,k\, ρb,k,ρc,k,g,ρd,k\ _b,k, _c,k,g, _d,k\, and large-scale channel statistics. Moreover, user-side information (user locations, tag identities, and HAPS–user large-scale channel features) is included in to_t and fed into a separate encoder in the actor to produce new association decisions. This design keeps permutation invariance over HAPS nodes while still allowing user-dependent associations. The graph tG_t represents HAPS interactions. The node-feature matrix t∈ℝ||×dxX_t ^|K|× d_x, where dxd_x is the node-feature dimension, contains per-HAPS attributes including k\q_k\, the number of served users, and power indicators. The weighted adjacency matrix t∈ℝ||×||W_t ^|K|×|K| encodes inter-HAPS coupling metrics in (30), is symmetric, and has zero diagonal. Appendix A-E proves the permutation equivariance and the pooling operator’s invariance, ensuring scalability and independence from node indexing. Let ˘t W_t be the element-wise min–max normalization of tW_t into [0,1][0,1] (for stable reconstruction loss), with zero diagonal. The symmetrically normalized adjacency is defined as ^t=t−1/2(˘t+||)t−1/2,t=diag((˘t+||)), A_t=D_t^-1/2( W_t+I_|K|)D_t^-1/2, _t=diag(( W_t+I_|K|)1), (47) where ^t A_t is the symmetrically normalized adjacency used as the GNN propagation operator and ∈ℝ||1 ^|K| is the all-ones vector. The GNN encoder follows GCN propagation rule: enc,t(ℓ+1)=σf(^tenc,t(ℓ)(ℓ)),H_enc,t^( +1)= _f\! ( A_t\,H_enc,t^( )W^( ) ), (48) where enc,t(ℓ)∈ℝ||×dℓH_enc,t^( ) ^|K|× d_ is the node-embedding matrix at layer ℓ , with enc,t(0)=tH_enc,t^(0)=X_t, dℓd_ the hidden dimension, (ℓ)∈ℝdℓ×dℓW^( ) ^d_ × d_ a learnable weight, and σf(⋅) _f(·) a nonlinear activation. To obtain topology-aware representations, we employ a GAE operating on (t,^t)(X_t, A_t). The encoder produces node embeddings that are mean-pooled to yield a graph-level embedding g∈ℝdzz_g ^d_z. Hence, the encoder maps tG_t to a graph-level embedding g∈ℝdzz_g ^d_z. The decoder reconstructs the normalized adjacency matrix and pooled features, yielding W^ij W_ij and X. The adjacency reconstruction loss is ℒadj=−∑i,j(W˘ijlogW^ij+(1−W˘ij)log(1−W^ij)),L_adj=- _i,j ( W_ij W_ij+(1- W_ij) (1- W_ij) ), (49) where W^ij W_ij is obtained via a sigmoid activation to match W˘ij∈[0,1] W_ij∈[0,1]. For brevity, the time index t is omitted in W˘ij W_ij and W^ij W_ij. Hence, the GA2C auxiliary objective at time t is ℒGA2C=αadjℒadj+αx‖¯t−^t‖22,L_GA2C= _adj\,L_adj+ _x\, \| X_t- X_t \|_2^2, (50) where ¯t≜1||∑k∈t(k,:) X_t 1|K| _k X_t(k,:) is the mean-pooled vector, ^t∈ℝdx X_t ^d_x its reconstruction from gz_g, and αadj,αx≥0 _adj, _x≥ 0 weight adjacency and feature reconstruction terms. IV-B2 Actor–Critic Learning We adopt an A2C architecture. The actor outputs Gaussian policies for continuous actions (HAPS motion and power coefficients) and Bernoulli policies for binary associations au,k\a_u,k\ derived from user-dependent logits. The critic estimates the state value V(t)V(S_t). The TD target and advantage are yt=rt+γrlV(t+1),At=yt−V(t),y_t=r_t+ _rlV(S_t+1), A_t=y_t-V(S_t), (51) where γrl _rl is the discount factor. Let ta_t denote the joint action at time t (continuous motion/power variables and binary associations), and π(t|t)π(a_t|S_t) the joint policy. The A2C loss is ℒA2C=−logπ(t|t)At+cv(yt−V(t))2−ceℋ(π(⋅|t)),L_A2C=- π(a_t|S_t)\,A_t+c_v (y_t-V(S_t) )^2-c_eH\! (π(·|S_t) ), (52) where ℋ(π(⋅|t))H(π(·|S_t)) is the policy entropy, and cv≥0c_v≥ 0, ce≥0c_e≥ 0 are the value-loss and entropy-regularization coefficients. Let t _t denote the decision tuple induced by action ta_t at state tS_t. To align training with the constrained problem in (37), the instantaneous reward is defined as rt=− r_t=- (J~l+λtagJ¯tag−ηJ()) ( J_l+ _tag J_tag- _JJ(R) ) −λR∑u∈[Rmin−Rp,u]+−λξ[ξreq−ξcov]+ - _R _u [R_ -R_p,u ]^+- _ξ [ _req- _cov ]^+ −λp[p^c(t)−ϵc]+−λnc[p^nc(t)−ϵnc]+ - _p [ p_c( _t)- _c ]^+- _nc [ p_nc( _t)- _nc ]^+ −λU∑k∈[∑u∈au,k−UperRB]+ - _U _k [ _u a_u,k-U_perRB ]^+ −λg(Rctot−∑g∈wc,gRc,g), - _g (R_c^tot- _g w_c,gR_c,g ), (53) where p^c(t) p_c( _t) and p^nc(t) p_nc( _t) are the MC-estimated violation probabilities of (C3)–(C4). The non-negative penalty coefficients λR _R, λξ _ξ, λp _p, λnc _nc, λU _U, and λg _g control enforcement of minimum-rate, coverage, colluding-secrecy, non-colluding-secrecy, and per-HAPS capacity constraints, the priority adjustment in C10, respectively. The overall objective combines policy and topology-aware losses via ℒ=ℒA2C+λGA2CℒGA2CL=L_A2C+ _GA2CL_GA2C, where λGA2C≥0 _GA2C≥ 0. Parameters are updated via stochastic gradient descent with gradient clipping. Algorithm 2 GA2C 1: γrl _rl, λGA2C _GA2C, αadj,αx _adj, _x, λR,λξ,λp,λnc,λU\ _R, _ξ, _p, _nc, _U\, NmcN_mc, TmaxT_ 2: Trained policy π _ ω and value function V_ ψ 3: Initialize actor ω, critic ψ, GA2C parameters ϕ φ 4: for each episode do 5: Observe initial state 0=(0,0)S_0=(o_0,G_0) 6: for t=0t=0 to Tmax−1T_ -1 do 7: Construct normalized adjacency ^t A_t from tG_t 8: Encode graph via GA2C →g _g 9: Sample action t∼π(⋅|t,g)a_t π(·|S_t,z_g) 10: Execute ta_t and obtain t _t 11: Estimate p^c(t),p^nc(t) p_c( _t), p_nc( _t) using NmcN_mc 12: Compute reward rtr_t 13: Observe next state t+1S_t+1 14: Compute TD target and advantage in (51) 15: Update ℒA2CL_A2C and ℒGA2CL_GA2C 16: end for 17: end for 18: return ,,ϕ ω, ψ, φ V Computational Complexity Analysis In this section, we compare RCEM and GA2C computational complexity. As both evaluate identical physical quantities, the dominant cost is the MC enforcement. Let NmcN_mc denote the number of MC realizations and K¯≜1||∑u∈|u| K 1|U| _u |K_u| be the average number of serving HAPSs per user. RCEM Per iteration, RCEM samples NsN_s decision vectors of dimension D, applies feasibility repair, and performs MC-based secrecy evaluation. The per-sample physical-layer evaluation cost is (NmcK¯|||ℰ|M)O\! (N_mc\, K\,|U|\,|E|\,M ). The overall runtime over NiterN_iter iterations is therefore (NiterNs[D+|‖|log||+NmcK¯|‖ℰ|M])O\! (N_iter\,N_s [D+|K||U| |U|+N_mc\, K\,|U|\,|E|\,M ] ). Using the dominant terms and K¯=(||) K=O(|K|), the asymptotic scaling becomes (|‖ℰ|)O\! (|U|\,|K|\,|E| ) and reduces to (||2||)O\! (|U|^2|K| ) if |ℰ|∼|||E| |U|. GA2C GA2C separates offline training and online inference. In training, per environment step, the cost includes GNN message passing and MC secrecy evaluation and is derived as (L|ℰg|dℓ2+|‖|dℓ+NmcK¯|‖ℰ|M)O\! (L|E_g|d_ ^2+|U||K|d_ +N_mc\, K\,|U|\,|E|\,M ), where L is the number of GNN layers. The total training cost scales linearly with the number of interaction steps. In inference, after training, online inference requires only a forward pass and is derived as (L|ℰg|dℓ2+||||dℓ)O\! (L|E_g|d_ ^2+|U||K|d_ ). Let |ℰg||E_g| is the number of edges in the HAPS interaction graph. For dense graphs with |ℰg|=Θ(||2)|E_g|= (|K|^2) and fixed (L,dℓ)(L,d_ ), this reduces to (||||)O\! (|U||K| ) in typical NTN where ||≫|||U| |K|. Comparison The comparison highlights the different scalability behaviors of RCEM and GA2C. As shown in Table I, RCEM exhibits quadratic growth with respect to |||U|, whereas GA2C scales linearly, which makes it more suitable for large-scale and dynamic NTN deployments. TABLE I: Comparison of Computational Complexity Metric RCEM GA2C (Inference) Complexity order (||2||)O\! (|U|^2|K| ) (||||)O\! (|U||K| ) V-A A Size Bound on the GA2C Graph Online Inference Time. Using the per-slot expression, we upper bound the online GA2C compute cost by Cinf≤c1L|ℰg|dℓ2+c2||||dℓ+c3||dℓ2,C_inf≤ c_1\,L\,|E_g|\,d_ ^2+c_2\,|U|\,|K|\,d_ +c_3\,|K|\,d_ ^2, (54) where c1,c2,c3>0c_1,c_2,c_3>0 capture implementation-dependent constants. Let BinfB_inf denote the maximum allowable per-slot inference budget; feasibility requires Cinf≤BinfC_inf≤ B_inf. We investigate it for both dense and sparse graphs. For a dense undirected graph, |ℰg|≤||(||−1)2≤||22|E_g|≤ |K|(|K|-1)2≤ |K|^22, and (54) implies a||2+b||≤Binfa|K|^2+b|K|≤ B_inf, with a≜c12Ldℓ2a c_12Ld_ ^2 and b≜c2||dℓ+c3dℓ2.b c_2|U|d_ +c_3d_ ^2. From this inequality, we obtain ||≤−b+b2+4aBinf2a.|K|≤ -b+ b^2+4aB_inf2a. (55) For a sparse graph, where the interaction graph has bounded degree k0k_0 (e.g., k0k_0-nearest-neighbor construction), then |ℰg|≤k02|||E_g|≤ k_02|K|, and the budget constraint gives the linear bound ||≤Binfc12Lk0dℓ2+c2||dℓ+c3dℓ2.|K|≤ B_inf c_12Lk_0d_ ^2+c_2|U|d_ +c_3d_ ^2. (56) Hence, under fixed L, dℓd_ , and |||U|, the |||K| scales as (Binf)O( B_inf) for dense graphs and linearly in BinfB_inf for sparse graphs. Memory constraint. Let BmemB_mem be the available memory for storing edge weights, and let beb_e be the memory footprint per stored edge (including indices/weight, depending on the representation). Requiring be|ℰg|≤Bmemb_e|E_g|≤ B_mem yields ||≤2Bmembe(dense),||≤2Bmembek0(sparse).|K|≤ 2B_memb_e\ (dense), |K|≤ 2B_memb_ek_0\ (sparse). (57) Thus, the graph size is jointly limited by BinfB_inf and BmemB_mem. V-B An Embedding-Capacity Bound on the Number of HAPSs We bound the number of losslessly distinguishable HAPS nodes by the graph embedding gz_g. With nbitsn_bits effective bits per coordinate, the number of distinct embeddings is at most 2nbitsdz2^n_bitsd_z (e.g., due to quantization/finite-precision). Assume further that each undirected edge weight in the interaction graph is stored using q bits. Then, over a graph with |ℰg||E_g| edges, the number of distinct quantized adjacency patterns is at most 2q|ℰg|2^q|E_g|. A necessary condition for a collision-free encoding over this quantized family is q|ℰg|≤nbitsdz.q|E_g|≤ n_bitsd_z. Given |ℰg|=12||(||−1)|E_g|= 12|K|(|K|-1), the condition q2||(||−1)≤nbitsdz q2|K|(|K|-1)≤ n_bitsd_z is derived. For fixed (dz,nbits,q)(d_z,n_bits,q), the maximum |||K| for unique worst-case representation is given by ||≤12(1+1+8nbitsdzq).|K|≤ 12 (1+ 1+ 8n_bitsd_zq ). (58) Finally, |||K| is bounded by the minimum of (56), (57) and (58). VI Simulation Results This section evaluates RCEM and GA2C against baselines, examining the impacts of AN, GDP, and multi-HAPS connectivity under identical parameters. Simulation settings are in Table I, which specifies default values of |||K|, |||U|, |||G|, and |ℰ||E|; specific values are noted when these parameters vary. TABLE I: Simulation Parameters Parameter Value Number of iterations (RCEM) 5050 Number of training episodes (GA2C) 5050 Number of test episodes (GA2C) 1010 Discount factor (γ) 0.980.98 Learning rate (η) 3×10−43× 10^-4 Number of HAPSs (|||K|) 44 Number of users (|||U|) 2020 Number of eavesdroppers (|ℰ||E|) 5050 Number of groups (|||G|) 33 Priority of groups wc,gw_c,g for g=1,2,3g=1,2,3 0.60.6, 0.30.3, 0.10.1 Horizontal area x,y∈[−5000,5000]x,y∈[-5000,5000] m HAPS altitude z∈[18000,22000]z∈[18000,22000] m Minimum distance (dmind_ ) 20002000 m Maximum velocity (vmaxv_ ) 5050 m/s Time step (Δt t) 11 s LoS parameters (al,bla_l,b_l) 5.0, 0.15.0,\;0.1 Elevation threshold (θ0 _0) 15∘15 Path-loss constant (C0C_0) (0.154π)2 ( 0.154π )^2 Path-loss exponent (LoS/NLoS) 2.0/3.52.0/3.5 Shadowing std. (σS _S) 66 dB Number of antennas (M) 6464 Rician factor (κr _r) 1010 Wavelength 0.150.15 m Antenna spacing 0.0750.075 m Transmit power per HAPS (Pt,kP_t,k) 1010 W Noise power (σ2σ^2) 4×10−144× 10^-14 RB capacity (UperRBU_perRB) 88 users DP parameters (ϵ,δε,δ) 50, 10−550,\;10^-5 In addition to the parameters summarized in Table I, the GA2C framework employs a GAE and an A2C architecture with the following configurations. The GNN encoder has L=2L=2 graph convolutional layers, hidden dimension dℓ=64d_ =64, graph-level embedding size dz=32d_z=32, and ReLU activation. The actor is a two-layer MLP with 256256 hidden units and tanh(⋅) (·) activation, while the critic is a four-layer MLP with 256256 hidden units and tanh activation. ReLU in the GCN encoder reduces vanishing gradients, and tanh(⋅) (·) in actor–critic keeps outputs bounded for numerical stability and reliable RL performance. Continuous actions follow a Gaussian policy with fixed standard deviation σa=0.5 _a=0.5,, and binary associations use Bernoulli policies. All networks are trained with Adam at learning rate 3×10−43× 10^-4. Value-loss and entropy coefficients are cv=0.5c_v=0.5 and ce=10−3c_e=10^-3, respectively. GA2C uses loss weight λGA2C=1.0 _GA2C=1.0, adjacency weight αadj=1.0 _adj=1.0, feature weight αx=1.0 _x=1.0, and gradient norm clipping to 1.01.0. RCEM employs a diagonal Gaussian sampling with elite size NeN_e and stability constant ϵRCEM>0 _RCEM>0. RCEM performs per-snapshot evolutionary optimization, but GA2C uses a trained policy for inference. This contrasts iterative search with learned decision mapping. VI-A Spreading and Matched Filtering We evaluate authentication reliability by simulating tag transmission and detection under GDP. In the simulation, each group symbol is spread over LsL_s chips using a unit-modulus QPSK spreading sequence g=[sg[1],…,sg[Ls]]s_g=[s_g[1],…,s_g[L_s]] T, where |sg[l]|=1|s_g[l]|=1. The transmitted chip is xg[l]=cgLssg[l],l=1,…,Ls.x_g[l]= c_g L_s\,s_g[l], l=1,…,L_s. (59) Due to the unit modulus spreading sequence, total symbol energy remains constant while chip-level energy decreases by 1/Ls1/L_s, enhancing robustness against noise. According to the GDP in Section I, the same cgc_g is used across all spreading chips of that symbol duration. The GDP noise variance is given by (10), which satisfies the (ϵ,δ)(ε,δ)-GDP guarantee. For transmissions over multiple intervals, cumulative privacy leakage is bounded via composition in Theorem 1. For authentication evaluation, we model the common-stream detection over an equivalent flat-fading link from each serving HAPS k∈uk _u. The effective complex gain is assumed constant over the LsL_s chips within one spreading block. Detection is performed in two stages. For authentication in the simulation stage, the received chip from HAPS k is modeled as yu,k[l]=hu,kxg[l]+wu,k[l],y_u,k[l]=h_u,kx_g[l]+w_u,k[l], where hu,kh_u,k denotes the equivalent flat-fading channel gain and wu,k[l]∼(0,σ2)w_u,k[l] (0,σ^2) denote i.i.d. chip-level noise samples. First, maximum-ratio combining (MRC) across serving HAPSs is the SNR-optimal linear receiver under perfect CSI in flat-fading AWGN channels, given by x^u[l]=∑k∈uhu,k∗yu,k[l]∑k∈u|hu,k|2. x_u[l]= _k _uh_u,k^*y_u,k[l] _k _u|h_u,k|^2. (60) Second, despreading correlates the combined chips with the known spreading sequence to obtain the decision statistic ru=1Ls∑l=1Lsx^u[l]sg∗[l],r_u= 1L_s _l=1^L_s x_u[l]\,s_g^*[l], (61) which is then mapped to the nearest QPSK constellation point to yield the detected authentication symbol c^u c_u. AWGN samples are independent across chips, so despreading reduces noise variance by 1/Ls1/L_s. GDP is injected once and replicated, so spreading improves robustness against channel noise but does not average out the privacy perturbation. Finally, the authentication probability is computed as Pc=Prc^u=c~gP_c= \ c_u= c_g\ in the MC simulation, where c~g c_g denotes the original (non-perturbed) QPSK authentication symbol. VI-B Training Dynamics: Evolution versus Learning We compare the convergence of RCEM and GA2C. Fig. 2a shows RCEM converges quickly in early iterations. Fig. 2b shows GA2C’s return increases over episodes, confirming effective learning. RCEM searches per snapshot, but GA2C requires offline training and enables fast inference via a reusable policy, making it more suitable for large-scale networks where repeated optimization is costly. (a) (b) Fig. 2: (a) RCEM objective evolution. (b) GA2C return. VI-C HAPS, Group, and User-Level SSE and Fairness Fig. 3a summarizes SSE at HAPS and group levels under colluding and non-colluding models. At the HAPS level, sum SSE represents the sum of HAPS SSEs, mean SSE captures the average SSE of HAPSs, and minimum SSE indicates robustness via the worst-performing HAPS. GA2C achieves higher sum, mean, and minimum SSE due to its graph-aware policy. Additionally, RCEM’s snapshot-based search may cause load imbalance and lower minimum SSE. Moreover, non-colluding models achieve higher SSE, as expected. At the group level (Fig. 3b), SSE reflects tag confidentiality, where sum and mean represent total and average SSE per tag, and minimum SSE denotes group robustness. GA2C outperforms RCEM in minimum group-level SSE by jointly considering topology and user-tag distributions to ensure uniform protection. Furthermore, in Fig. 3c, SSE for each group is shown separately, where SSE is allocated among groups according to priority weights. It is observed that groups with higher priorities achieve higher SSE, which is also consistent with the results in Table I. RCEM shows lower errors in G0 (2.07%) and G1 (2.73%), but a slightly higher error in G2 (4.20%). This difference can be attributed to the higher accuracy of the evolutionary algorithm in satisfying the constraints. Fig. 3d illustrates per-user SSE. Colluding eavesdroppers reduce SSE compared to the non-colluding case. Importantly, per-user SSE demonstrates that secrecy gains are not limited to aggregate metrics, but also improve individual user performance, supporting the minimum-rate constraint in (37). TABLE I: Error Comparison for RCEM and GA2C Methods Group RCEM GA2C Target Error (%) RCEM GA2C G0 0.5876 0.6276 0.6 2.07 4.60 G1 0.3082 0.2954 0.3 2.73 1.53 G2 0.1042 0.0770 0.1 4.20 23.00 (a) (b) (c) (d) Fig. 3: SSE results: (a) per HAPS; (b) per group (methods); (c) per group (priorities); (d) per user, where colluding and non-colluding are denoted by C and NC in the figure, respectively. Fig. 4a illustrates ()J(R) based on Rp,uR_p,u. The curves reflect how each method maintains rate equality. Fig. 4b shows fairness generally increases with |||K| due to improved spatial diversity, multi-connect transmission, and load balancing. GA2C achieves higher ()J(R) in larger networks due to its topology-aware policy. In smaller networks, RCEM can achieve higher fairness by extensively searching the solution space through evolutionary optimization. (a) (b) Fig. 4: Fairness analysis. (a) Fairness evolution over 10 test episodes. (b) Jain’s fairness index versus |||K| with ||=16|U|=16, ||=4|G|=4, and |ℰ|=50|E|=50. VI-D Comparison between Methods and Scalability Analysis For fair comparison, both methods were evaluated over 10 identical test episodes. Fig. 5 shows the average SSE across these episodes, comparing the proposed scheme against two baselines: (i) w/o AN, where AN is disabled, and (i) single, where users are restricted to single-HAPS connectivity without collaborative transmission. GA2C consistently outperforms RCEM in larger network configurations due to its ability to generalize with topology awareness. The results clearly highlight the benefits of AN injection and multi-HAPS collaborative RSMA transmission, which significantly enhance secrecy performance compared to the baseline schemes. Table IV shows the multiplicative SSE gains over the baseline methods. Results confirm AN provides at least a 21%21\% improvement, emphasizing its role in reinforcing secrecy. Collaborative RSMA yields at least a 135%135\% gain over single-connect transmission, highlighting the importance of spatial diversity. Additionally, GA2C outperforms RCEM across configurations, as shown in Fig. 5 and Table IV. Fig. 6 shows per-user SSE versus baselines, confirming AN’s role, collaborative RSMA gains via spatial diversity and coordinated transmission. As shown in Fig. 7, connectivity and HAPS locations differ between methods since positioning is an optimization variable. Fig. 5: Average SSE over 10 test episodes. TABLE IV: SSE gain over w/o AN and single-HAPS. RCEM GA2C Scenario w/o AN single w/o AN single Non-Colluded 1.222 17.69 1.232 2.39 Colluded 1.223 17.70 1.211 2.35 (a) RCEM (b) GA2C Fig. 6: Per-user SSE under colluding and non-colluding eavesdroppers. Fig. 7: Comparison between the two methods. The relative advantage depends on network scale. Fig. 8a shows SSE versus |||U|. As |||U| increases, MUI and limited resources reduce SSE for both methods. However, GA2C maintains better performance in larger networks by capturing user–HAPS relations and generalizing in high-dimensional spaces. In contrast, RCEM becomes less efficient due to the expanding decision space, remaining competitive only in smaller networks. Fig. 8b presents SSE versus |||K|. Increasing |||K| enhances spatial diversity, interference coordination, and multi-connect gains. Fig. 8c indicates that increasing |||G| reduces SSE, since the common-stream power is divided among more group tags. Finally, Fig. 8d shows that increasing |ℰ||E| tightens secrecy constraints and decreases SSE. (a) (b) (c) (d) Fig. 8: SSE vs. (a) |||U|, (b) |||K|, (c) |||G|, and (d) |ℰ||E|. For each case: (a) ||=4|K|=4, ||=4|G|=4, |ℰ|=50|E|=50; (b) ||=16|U|=16, ||=4|G|=4, |ℰ|=50|E|=50; (c) ||=16|U|=16, ||=3|K|=3, |ℰ|=20|E|=20; (d) ||=16|U|=16, ||=3|K|=3, ||=4|G|=4. For each case, locations are uniformly random, and users are evenly grouped. VI-E Authentication Reliability under GDP (a) PcP_c vs. ϵε (different NgN_g and LsL_s) (b) PcP_c vs. NgN_g (different ϵε, Ls=32L_s=32) Fig. 9: Authentication reliability under GDP: (a) impact of ϵε, NgN_g, and LsL_s; (b) impact of NgN_g under different ϵε. MC simulations evaluate the authentication probability PcP_c versus ϵε, NgN_g, and LsL_s. As shown in Fig. 9a, PcP_c increases monotonically with ϵε because larger ϵε reduces the DP noise variance, improving detection reliability. Smaller groups (e.g., Ng=4N_g=4) achieve near-perfect detection with moderate ϵε, whereas larger groups require higher privacy budgets since the GDP noise power scales with Ng2N_g^2. Increasing LsL_s enhances robustness against channel noise through despreading gain, but it does not mitigate GDP distortion, as the DP noise is added per symbol and replicated across chips. Fig. 9b shows that PcP_c decreases with NgN_g for fixed ϵε, due to stronger DP perturbation in larger groups. For small ϵε, authentication remains low and nearly insensitive to NgN_g, indicating privacy-dominated operation. For larger ϵε, the group-size effect becomes pronounced. The results correspond to two users from similar groups served by three HAPSs. These results confirm the GDP privacy–reliability trade-off. Appendix A-F provides a closed-form PcP_c expression and monotonicity proof. VII Conclusion This paper proposes SAFA-MZ, a distributed and secrecy-aware framework for multi-HAPS NTN systems, where authentication and transmission are jointly designed. A DPLA scheme verifies users from multiple directions, and a group-based tag enables shared authentication within semantic groups. The groups are prioritized according to semantic importance while keeping independent data streams. A multi-layer collaborative RSMA superposes private, group-common, and AN signals to enhance SSE and fairness. GDP is incorporated to provide privacy guarantees for tag protection. A unified secrecy- and fairness-aware optimization problem jointly considers HAPS placement, user association, RSMA power allocation, and authentication constraints. It is solved via RCEM as a non-learning baseline and GA2C as a graph-aware RL approach. GA2C offers scalability and low-latency online decisions. Simulations demonstrate significant secrecy gains: GA2C improves SSE by at least 135%135\% over single-connect transmission and about 21%21\% over the without AN scheme, while RCEM also outperforms simplified baselines. In terms of complexity, RCEM scales quadratically with the number of users, whereas GA2C scales linearly, offering superior computational efficiency. Overall, SAFA-MZ provides a scalable and privacy-aware architecture in NTN. Appendix A Proofs A-A Gaussian Mechanism Proof. For D∼D′D D , define the privacy loss L(x)=lnPr[s~c(D)=x]Pr[s~c(D′)=x].L(x)= [ s_c(D)=x] [ s_c(D )=x]. For the Gaussian perturbation above, L(x)L(x) is an affine function of a Gaussian random variable with mean bounded by ‖sc(D)−sc(D′)‖222σDP2≤Sc22σDP2 \|s_c(D)-s_c(D )\|_2^22 _DP^2≤ S_c^22 _DP^2 and variance bounded by ‖sc(D)−sc(D′)‖22σDP2≤Sc2σDP2 \|s_c(D)-s_c(D )\|_2^2 _DP^2≤ S_c^2 _DP^2. Applying the standard Gaussian tail bound yields Pr[L(x)>ϵ]≤δ [L(x)>ε]≤δ whenever σDP≥Sc2ln(1.25/δ)ϵ _DP≥ S_c 2 (1.25/δ)ε, which proves (ϵ,δ)(ε,δ)-DP. ∎ A-B GDP Scaling Proof. Let D and D′D differ in at most N′N groups and construct a chain D0=D,D1,…,DN′=D′D_0=D,D_1,…,D_N =D where each adjacent pair differs in exactly one group. Applying (ϵ′,δ′)(ε ,δ )-DP sequentially along the chain and summing the δ′δ terms gives Pr[ℳ(D)∈S]≤eN′ϵ′Pr[ℳ(D′)∈S]+N′δ′ [M(D)∈ S]≤ e^N ε [M(D )∈ S]+N δ , which is the claim. ∎ A-C Advanced Composition over T Slots Proof. The cumulative privacy loss LT=∑t=1TLtL_T= _t=1^TL_t over T independent DP releases is bounded via a Chernoff bound with slack δ¯ δ. ∎ A-D Layout Regularizer Proof. Expanding the Laplacian =−L=D-W and substituting []k,k=∑j[]k,j[D]_k,k= _j[W]_k,j yields Jl=12∑k∑j[]k,j‖k−j‖2J_l= 12 _k _j[W]_k,j\|q_k-q_j\|^2. Since W increases with the link rate in (30), minimizing JlJ_l penalizes large distances between strongly connected HAPS. ∎ A-E Permutation Equivariance Recall the graph encoder in (48) that was enc,t(ℓ+1)=σf(^tenc,t(ℓ)(ℓ))H_enc,t^( +1)= _f\! ( A_t\,H_enc,t^( )\,W^( ) ), where enc,t(0)=tH_enc,t^(0)=X_t and σf(⋅) _f(·) is element-wise. Let be any permutation matrix and define t′=tX _t= _t and ^t′=^t A _t= A_t T. Moreover, mean-pooling g=1||∑k∈enc,t(L)(k,:)z_g= 1|K| _k H_enc,t^(L)(k,:) is permutation-invariant. Therefore, the encoder in (48) is permutation-equivariant, meaning enc,t(ℓ)(t′,^t′)=enc,t(ℓ)(t,^t)H_enc,t^( )(X _t, A _t)= \,H_enc,t^( )(X_t, A_t), where ℓ≥0 ≥ 0. Proof. By induction on ℓ . The base case holds since enc,t(0)=tH_enc,t^(0)=X_t. Assume the claim for ℓ ; then ^t′′(ℓ)=^t(ℓ) A _tH ( )= A_tH^( ) and σf()=σf() _f( )= _f(Y), yielding the ℓ+1 \!+\!1 case. For mean pooling, invariance follows from =1 T =1 T. ∎ A-F Privacy–Reliability Trade-Off under GDP We consider c~g c_g is unit-energy QPSK. After MRC over uK_u and despreading of length LsL_s, the decision statistic is ru=c~g+nDP+nchr_u= c_g+n_DP+n_ch , where nch∼(0,σch2)n_ch (0, _ch^2). Post-processing noise variance is given by σch2=σ2Ls∑k∈u|hu,k|2 _ch^2= σ^2L_s _k _u|h_u,k|^2. Define σtot2≜σDP2+σch2 _tot^2 _DP^2+ _ch^2. Then Pc=Prc^u=c~g=(1−Q(1σtot))2P_c= \ c_u= c_g\=(1-Q\!( 1 _tot))^2, where Q(x)=12π∫x∞e−t2/2dtQ(x)= 1 2π _x^∞e^-t^2/2\,dt. Lemma 2. For any fixed σch2>0 _ch^2>0, PcP_c is strictly decreasing in σDP2 _DP^2. Proof. Let ν≜1/σtotν 1/ _tot, so Pc=(1−Q(ν))2P_c=(1-Q(ν))^2. It yields that dPcdν=2(1−Q(ν))(−Q′(ν))>0 dP_cdν=2(1-Q(ν))(-Q (ν))>0 since Q′(ν)<0Q (ν)<0. Also ν=(σDP2+σch2)−1/2ν=( _DP^2+ _ch^2)^-1/2 is strictly decreasing in σDP2 _DP^2, hence dPcdσDP2<0 dP_cd _DP^2<0 by the chain rule. ∎ References [1] D. Sharma, V. Tilwari, and S. Pack (2025) An overview for designing 6g networks: technologies, spectrum management, enhanced air interface, and ai/ml optimization. IEEE Internet of Things Journal 12 (6), p. 6133–6157. External Links: Document Cited by: §I. [2] N. Xie, Z. Li, and H. Tan (2020) A survey of physical-layer authentication in wireless communications. IEEE Communications Surveys & Tutorials 23 (1), p. 282–310. Cited by: §I. [3] X. Zeng, C. Wang, Z. Li, L. Jin, D. W. K. Ng, D. Niyato, K. J. Kim, and N. Al-Dhahir (2026) Intelligent physical layer authentication based on complex-valued neural networks: defending against pilot contamination and clone attacks. IEEE Transactions on Wireless Communications 25 (), p. 14486–14502. External Links: Document Cited by: §I, §I. [4] J. Zhang, F. Ardizzon, M. Piana, G. Shen, and S. Tomasin (2025) Physical layer-based device fingerprinting for wireless security: from theory to practice. arXiv preprint arXiv:2506.09807. Cited by: §I. [5] Z. Ji and D. Li (2025) Physical layer authentication based on channel variance normalization and difference exponential amplification. In Proceedings of the 2025 IEEE 101st Vehicular Technology Conference (VTC2025-Spring), p. 1–7. External Links: Document Cited by: §I. [6] P. Zhang, Y. Teng, M. Niu, X. Jiang, and F. Xiao (2025) Physical layer authentication utilizing beam pattern features in millimeter-wave MIMO systems. IEEE Transactions on Dependable and Secure Computing 22 (3), p. 2563–2578. External Links: Document Cited by: §I. [7] Y. Teng, P. Zhang, K. Han, X. Jiang, Y. Shen, and F. Xiao (2026) CovertAuth: joint covert communication and authentication in mmwave systems. IEEE/ACM Transactions on Networking 34, p. 1421–1436. External Links: Document Cited by: §I. [8] Y. Zhang, R. Jäntti, Z. Yan, Y. Dang, M. Kaveh, and Z. Han (2026) Physical layer challenge-response authentication between ambient backscatter devices. IEEE Transactions on Information Forensics and Security 21, p. 1512–1527. External Links: Document Cited by: §I. [9] Z. Gu, H. Chen, P. Xu, Y. Li, and B. Vucetic (2020) Physical layer authentication for non-coherent massive SIMO-enabled industrial IoT communications. IEEE Transactions on Information Forensics and Security 15, p. 3722–3733. Cited by: §I. [10] L. Yao, B. He, and S. Wang (2025) Physical-layer authentication via series cancellation. In 2025 IEEE/CIC International Conference on Communications in China (ICCC), p. 1–6. External Links: Document Cited by: §I. [11] E. Gencsek, P. Mégret, and V. Moeyaert (2025) Tag-based physical layer authentication over a nakagami-m block-flat fading channel: theory and gnu radio simulations for iiot. In 2025 8th International Conference on Advanced Communication Technologies and Networking (CommNet), p. 1–8. Cited by: §I. [12] Pan Wang et al. (2025) IRS-assisted challenge-response physical layer authentication scheme considering power budget. In IEEE Wireless Communications and Networking Conference (WCNC), p. 1–6. External Links: Document Cited by: §I. [13] P. Zhang, Y. Teng, Y. Shen, X. Jiang, and F. Xiao (2023) Tag-based phy-layer authentication for RIS-assisted communication systems. IEEE Transactions on Dependable and Secure Computing 20 (6), p. 4778–4792. Cited by: §I. [14] A. V. Guglielmi, L. Crosara, and S. Tomasin (2026) Design of physical layer challenge response authentication with RIS and multiple-antenna devices. IEEE Transactions on Information Forensics and Security 21 (), p. 3677–3688. External Links: Document Cited by: §I. [15] Z. Chang, W. Xiong, N. Xie, and D. Niyato (2025) Improving wireless security with phase-tag physical-layer authentication. IEEE Transactions on Mobile Computing 24 (6), p. 4716–4732. External Links: Document Cited by: §I. [16] T. M. Hoang, A. Vahid, H. D. Tuan, and L. Hanzo (2024) Physical layer authentication and security design in the machine learning era. IEEE Communications Surveys & Tutorials 26 (3), p. 1830–1860. External Links: Document Cited by: §I. [17] R. Meng, B. Xu, X. Xu, M. Sun, B. Wang, S. Han, S. Lv, and P. Zhang (2024) A survey of machine learning-based physical-layer authentication in wireless communications. arXiv preprint arXiv:2411.09906. Cited by: §I. [18] X. Cheng, R. Meng, X. Xu, H. Gao, P. Zhang, and D. Niyato (2026) APEG: adaptive physical layer authentication with channel extrapolation and generative AI. IEEE Transactions on Information Forensics and Security 21 (), p. 1257–1272. External Links: Document Cited by: §I. [19] C. Zhao, H. Du, D. Niyato, J. Kang, Z. Xiong, D. I. Kim, X. Shen, and K. B. Letaief (2025) Generative AI for secure physical layer communications: a survey. IEEE Transactions on Cognitive Communications and Networking 11 (1), p. 3–26. External Links: Document Cited by: §I. [20] R. Meng, X. Cheng, S. Gao, X. Xu, C. Dong, G. Nan, X. Tao, P. Zhang, and T. Q. S. Quek (2026) Generative AI for physical-layer authentication. IEEE Wireless Communications (), p. 1–9. External Links: Document Cited by: §I. [21] G. Han, Y. Hu, Y. He, T. Zhang, and F. Li (2026) Multi-source trust evaluation using physical layer authentication and reinforcement learning for distributed AUV swarms in underwater data collection. IEEE Transactions on Cognitive Communications and Networking. External Links: Document Cited by: §I. [22] J. Zhang, Y. Guo, Y.-W. P. Hong, and S. Tomasin (2026) Model-driven learning-based physical layer authentication for mobile wi-fi devices. IEEE Transactions on Information Forensics and Security 21, p. 1497–1511. External Links: Document Cited by: §I. [23] X. Qiu, X. Ma, J. Yu, and M. Xu (2025) Deep complex network architecture for multi-user physical layer authentication in wireless communication. IEEE Communications Letters. Cited by: §I. [24] G. Oligeri, S. Sciancalepore, S. Raponi, and R. Di Pietro (2022) PAST-AI: physical-layer authentication of satellite transmitters via deep learning. IEEE Transactions on Information Forensics and Security 18, p. 274–289. Cited by: §I. [25] M. A. Ahmadabadi, S. Mohammad Razavizadeh, and V. Jamali (2025) Integrated sensing, communication, and powering (ISCAP) for IoT: a joint beamforming design. In 2025 IEEE 36th International Symposium on Personal, Indoor and Mobile Radio Communications (PIMRC), Vol. , p. 1–6. External Links: Document Cited by: §I. [26] T. Zhang, Y. Huo, L. Ma, and E. Guo (2024) Distributed physical layer authentication: overview and opportunities. IEEE Communications Magazine 62 (1), p. 134–140. External Links: Document Cited by: §I. [27] Y. Mao, O. Dizdar, B. Clerckx, R. Schober, P. Popovski, and H. V. Poor (2022) Rate-splitting multiple access: fundamentals, survey, and future research trends. IEEE communications surveys & tutorials 24 (4), p. 2073–2126. Cited by: §I. [28] J. Lu, X. Li, H. Zhang, and V. C. M. Leung (2026) Semantic information assignment and relay selection for green cooperative RSMA networks. IEEE Internet of Things Journal (), p. 1–1. External Links: Document Cited by: §I. [29] Z. Liu, J. Lou, W. Bao, Y. Hu, W. Wang, Z. Qin, and K. Ren (2026) Differentially private zeroth-order methods for scalable large language model fine-tuning. IEEE Transactions on Information Forensics and Security (), p. 1–1. External Links: Document Cited by: §I. [30] Z. Zhou, L. Xu, and L. Zhu (2026) VPrivKV: verifiable local differential privacy for key-value data. IEEE Transactions on Information Forensics and Security 21 (), p. 105–120. External Links: Document Cited by: §I. [31] C. Dwork (2006) Differential privacy. In International colloquium on automata, languages, and programming, p. 1–12. Cited by: §I. [32] C. Dwork and A. Roth (2014) The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science 9 (3–4), p. 211–407. External Links: Document Cited by: §I, §I-B, Proposition 1, Theorem 1. [33] B. Palanisamy, C. Li, and P. Krishnamurthy (2017) Group differential privacy-preserving disclosure of multi-level association graphs. In 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), Vol. , p. 2587–2588. External Links: Document Cited by: §I. [34] M. Selvarathnam, R. Ragel, C. C. Reyes-Aldasoro, and M. Rajarajan (2023) Privacy vs utility analysis when applying differential privacy on machine learning classifiers. In 2023 19th International Conference on Wireless and Mobile Computing, Networking and Communications (WiMob), p. 306–311. Cited by: §I. [35] Y. Zhao, H. Song, and K. Xu (2024) Deep learning research based on adaptive differential privacy and gradient security. In 2024 6th International Conference on Frontier Technologies of Information and Computer (ICFTIC), Vol. , p. 85–88. External Links: Document Cited by: §I. [36] H. Wang, Z. Wan, Y. Hou, Z. Chen, and T. Tao (2024) Differential privacy generative adversarial networks based on dynamic learning rate constrained adaptive gradient algorithm. In 2024 Cross Strait Radio Science and Wireless Technology Conference (CSRSWTC), Vol. , p. 1–3. External Links: Document Cited by: §I. [37] S. P. Sanon, C. Lipps, and H. D. Schotten (2023) Preserving privacy in the age of wireless evolution: differential privacy in 5g, beyond 5g, and 6g. In 2023 International Conference on Future Communications and Networks (FCN), p. 1–6. Cited by: §I. [38] N. X. Tung, T. Van Chien, H. Q. Ngo, and W. J. Hwang (2025) Distributed graph neural network design for sum ergodic spectral efficiency maximization in cell-free massive MIMO. IEEE Transactions on Vehicular Technology 74 (3), p. 5181–5186. External Links: Document Cited by: §I. [39] G. Zhang, Z. Yang, J. Wu, P. Jiao, J. Yang, H. Peng, and X. Lin (2026) Learning subgraph-based normality for interpretable graph-level anomaly detection. IEEE Transactions on Information Forensics and Security 21 (), p. 288–303. External Links: Document Cited by: §I. [40] T. Van Chien, N. T. A. Thu, N. H. Lam, H. Q. Ngo, S. Chatzinotas, and H. T. T. Binh (2025) Fairness designs for load balancing optimization in satellite-cell-free massive MIMO systems. IEEE Transactions on Aerospace and Electronic Systems 61 (6), p. 16343–16356. External Links: Document Cited by: §I. [41] H. A. Le, T. Van Chien, and W. Choi (2025) Graph neural network-based active and passive beamforming for distributed STAR-RIS-assisted multi-user MISO systems. IEEE Transactions on Communications 73 (10), p. 9299–9312. External Links: Document Cited by: §I. [42] N. Xuan Tung, L. Tung Giang, B. Duc Son, S. Geun-Jeong, T. Van Chien, L. Hanzo, and W. Hwang (2026) Graph neural networks for next-generation-IoT: recent advances and open challenges. IEEE Communications Surveys & Tutorials 28 (), p. 2226–2262. External Links: Document Cited by: §I. [43] Y. Cao, S. Lien, Y. Liang, D. Niyato, and X. Shen (2023) Collaborative computing in non-terrestrial networks: a multi-time-scale deep reinforcement learning approach. IEEE Transactions on Wireless Communications 23 (5), p. 4932–4949. Cited by: §I. [44] J. Huang, Y. Yang, J. Lee, D. He, and Y. Li (2023) Deep reinforcement learning-based resource allocation for RSMA in LEO satellite-terrestrial networks. IEEE Transactions on Communications 72 (3), p. 1341–1354. Cited by: §I. [45] M. Yang, D. Zhai, R. Zhang, B. Li, L. Cai, and F. R. Yu (2024) Joint admission and power control for massive connections via graph neural network. IEEE Transactions on Vehicular Technology 73 (8), p. 11806–11820. Cited by: §I.