A Memory-Safe eBPF/GPU Data Plane for Adaptive 5G Backdoor Detection

Abstract The evolution of 5G towards cloud-native deployments exposes the User Plane Function (UPF) to persistent host-resident implants, of which the BPFDoor backdoor is a documented telecommunications-sector example. This work presents a tiered, memory-safe detection data plane that couples in-kernel extended Berkeley Packet Filter (eBPF/XDP) filtering with a memory-safe Graphics Processing Unit (GPU) Cloud-Native Network Function (CNF) written in NVIDIA cuTile-Rust. The proposed data plane is evaluated against adversarial Large Language Model (LLM) agents on a live six-node Open5GS/UERANSIM testbed. A Red Agent autonomously mutates the implant while a Blue Agent hunts it; the presented behavioral invariant, which requires a functional passive backdoor to hold an AF_PACKET/ETH_P_ALL/iface=0 socket, is shown to be a kernel fact that the attacker cannot mutate away. A GPU mutation-space sweep evaluates the full space of 2,555,904 signature variants, over which a static signature is evaded in approximately all cases while the invariant is evaded by none. The proposed placement is measured rather than assumed: eBPF/XDP reaches a hard verifier ceiling, whereas the memory-safe CNF reaches parity with hand-written CUDA C at moderate arithmetic intensity and, at higher intensity, outperforms a straightforward hand-written CUDA C implementation, at an edge power envelope of about 66 W. Across six adversarial memory-safety bug classes the cuTile detector reports zero sanitizer errors, and the invariant holds at 25/25 under three distinct attacker LLMs.