---
title: "DAST Catches 5G Network Attacks Without Any Training Data"
subtitle: "DAST uses a three-stage VLM-LLM-VLM pipeline to catch DoS and performance attacks across O-RAN interfaces — zero labeled data required, 0.91 F1-score achieved"
url: "https://alphasignal.ai/news/dast-catches-5g-network-attacks-without-any-training-data"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-06-04T00:00:00.000Z"
updated: "2026-06-12T02:08:12.284Z"
type: "Paper"
topics:
  - "Security"
  - "Development"
subtopics:
  - "Red Teaming"
upvotes: 1754
source_url: "https://arxiv.org/abs/2606.06261"
comments: 0
truncated: true
---

# DAST Catches 5G Network Attacks Without Any Training Data

> DAST uses a three-stage VLM-LLM-VLM pipeline to catch DoS and performance attacks across O-RAN interfaces — zero labeled data required, 0.91 F1-score achieved

Securing next-generation 5G and 6G networks just got a meaningful upgrade. A new paper introduces [DAST](https://arxiv.org/abs/2606.06261), a zero-shot multi-agent framework that chains vision-language models and large language models together to detect anomalies across the open interfaces of O-RAN , the disaggregated, multi-vendor radio access network architecture that is rapidly becoming the backbone of modern mobile infrastructure.

## The attack surface nobody talks about

O-RAN enables a disaggregated baseband stack with programmable functions that communicate over standardized open interfaces , and the same openness that enables multi-vendor composition also expands the attack surface across logically decoupled tiers. Think of it as breaking a traditionally monolithic cell tower into modular software components from different vendors, all talking to each other over documented protocols. That openness is the point , and also the problem.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [DAST: A VLM-LLM Framework for Cross-Interface Anomaly Detection in O-RAN](https://arxiv.org/abs/2606.06261)
- [DAST Paper HTML (full text)](https://arxiv.org/html/2606.06261v1)
- [Attacking O-RAN Interfaces: Threat Modeling, Analysis and Practical Experimentation](https://www.researchgate.net/publication/382485731_Attacking_O-RAN_Interfaces_Threat_Modeling_Analysis_and_Practical_Experimentation)
- [Can Multimodal LLMs Perform Time Series Anomaly Detection?](https://arxiv.org/html/2502.17812)
- [Harnessing Vision-Language Models for Time Series Anomaly Detection (VLM4TS)](https://arxiv.org/html/2506.06836)