Physics-Constrained Digital Twins for Sensor Integrity in Urban Pedestrian Flow: Detecting Stealthy False Data Injection with Conformal Guarantees

• The paper formalises stealthy false-data injection for city-scale pedestrian sensing.Source: Highlights · p. 2
• A street-graph conservation residual enters the detection score.Source: Highlights · p. 2
• The attack margin quantifies how much physics shrinks the set of stealthy attacks.Source: Highlights · p. 2

• Sparse sensors leave a severely rank-deficient observation map, while graph-wide flow conservation constrains even unmetered segments.The paper asks whether encoding this law measurably narrows stealthy attacks or only makes the twin look more physical.Source: §1 · p. 3
• The paper formalises stealthy injections under an access budget and defines the attack margin as the reduction in worst-case flow corruption attributable to a physical constraint.Source: §1 · p. 3
• The proposed twin estimates directed street-graph flows, assimilates counts through a learned graph-localised gain, and trains against a bounded-source-and-sink conservation residual.Detection combines the residual with the innovation, and evaluation uses a white-box adversary while matching baselines at a matched false-alarm rate.Source: §1 · pp. 3–4

2.1. Pedestrian Counting Infrastructure and Urban Digital Twins

• Urban counting supports economic nowcasting, flow modelling, and forecasting, but the cited infrastructure and twin literature treats counting error as accidental.The section also notes that pedestrian twins remain fragmented and deployment-specific.Source: §2.1 · p. 4

2.2. False Data Injection and Sensor Integrity in Cyber-Physical Systems

• Prior false-data-injection work studies stealth under physical equations, but pedestrian sensing has far greater rank deficiency and integer counts with heavy overdispersion.Water-network work also studies conservation-consistent attacks [1]; watermarking does not transfer to counters, and the resilient-estimation half-corruption bound is vacuous under rank-deficient C [14].Source: §2.2 · p. 4

2.3. Graph-Based and Physics-Constrained Anomaly Detection

• Graph anomaly detectors generally treat structure statistically, while existing physics-informed detection uses constraints to improve benign-fault accuracy rather than measure adversarial feasibility.The cited work does not ask whether a physical constraint removes degrees of freedom from an attacker.Source: §2.3 · p. 4

2.4. Calibrated Detection Thresholds and Honest Evaluation

• Conformal methods give alarm thresholds statistical meaning, while adaptive calibration addresses dependent series and evaluation work cautions against point-adjusted scores.The authors say they follow recommendations for evaluating detection rather than defending a headline score.Source: §2.4 · pp. 4–5

2.5. Adversarial Robustness of Learned Detectors

• Prior adversarial work optimises perturbations to evade learned detectors, but the cited literature does not measure how much a hard conservation constraint shrinks the defender-side feasible set.Source: §2.5 · p. 5

3.1. Sensing Substrate and Notation

• Fixed pedestrian counters map onto a directed walkable street graph, producing a wide, rank-deficient observation operator because deployed counters are far fewer than segments.Archival counters report the sum of both walking directions, leaving the directional split latent.Source: §3.1 · p. 5

3.2. The Digital Twin as a Constrained State-Space Model

• The twin is a synchronized state estimator that assimilates incoming counts, while a graph-wide conservation residual couples metered and unmetered segments.The conservation law applies to latent flows and is independent of learned parameters; junction sources and sinks are represented as a slowly varying latent quantity.Source: §3.2 · pp. 5–6
• The attack-free calibration window is assumed contiguous and representative of seasonal and weekly conditions, but that assumption is not verifiable and archive compromise can invalidate the guarantee.Operators can audit the archived window offline, but the assumption itself cannot be verified.Source: §3.2 · p. 6

3.3. Adversary Model

• The attacker may alter a bounded subset of sensor readings but cannot change the physical world or twin parameters; coordinated injections can remain internally coherent across sensors.The coordinated family motivates analysis of attacks that statistical-irregularity tests may miss.Source: §3.3 · p. 6

3.4. Detection Statistic and Calibrated Alarm Threshold

• The detector combines innovation and conservation residuals, with an adaptively conformal threshold addressing seasonal drift beyond the exchangeability-based finite-sample guarantee.Under exchangeability, the conformal construction guarantees a marginal false-alarm rate of at most α; the adaptive scheme treats that statement as an idealized target.Source: §3.4 · p. 6

3.5. Stealthy Attacks and the Attack Margin

• The attack margin measures the relative reduction in worst-case estimated-flow corruption attributable to the conservation constraint.The adversary is evaluated in flow space through approximate projected gradient ascent, yielding a conservative lower bound on worst-case impact.Source: §3.5 · p. 7
• With conservation enabled, stealthy perturbations must be divergence-free; dimension counting bounds the feasible geometry but cannot alone predict attack damage.The constraint removes at most rank(B) dimensions, while the removable fraction changes only from 0.410 at κ=1 to 0.409 at κ=20.Source: §3.5 · p. 7

3.6. Problem Statements

• The formulation sets three goals: synchronize the constrained twin, minimize detection delay subject to a false-alarm constraint, and characterize attack impact across access budgets.The authors distinguish operator-facing synchronization and monitoring from attack-surface characterization, which tests whether encoding physics is worthwhile.Source: §3.6 · p. 7

4.1. Pipeline Overview

• The pipeline replays archived counts chronologically, builds street-graph operators, updates the twin, calibrates alarms, and uses an adversary layer only for evaluation.The deployed system consists of the components upstream of the adversary layer.Source: §4.1 · p. 8, Figure 1 · p. 9

4.2. Data Preparation and Graph Construction

• The graph uses the largest weakly connected component of a simplified pedestrian-accessible network, with stable devices map-matched to both directed segments of their street.Devices are retained only if their positions remain unchanged and their data availability meets a coverage threshold; the directional split is identified through the conservation relation and line-graph prior.Source: §4.2 · p. 8

4.3. Twin Architecture and Assimilation

• A learned graph-localised gain assimilates observations into predicted flows, while a conservation residual contributes to detection and training constrains source and sink terms.The gain diffuses corrections across the line graph; the bounded sink term discourages explaining flow through invented sources.Source: §4.3 · p. 10

4.4. Training and Threshold Calibration

• Adaptive conformal calibration updates its nominal level from realised errors to target long-run false-alarm frequency under distribution shift, sacrificing the finite-sample guarantee at individual time steps.Thresholds are recalibrated for each conservation weight and baseline so comparisons use matched calibrated false-alarm rates.Source: §4.4 · p. 10

4.5. Adversary Layer

• Parametric attacks vary replay, ramp, and scaling patterns across compromised-device budgets, while projected gradient ascent searches for stealthy attacks through the differentiable twin.Projection enforces attack support, realisability, and stealth constraints; the local optimum makes the computed worst case a lower bound and the attack margin an estimate, not a certificate.Source: §4.5 · pp. 10–11

4.6. Baselines, Metrics and Protocol

• Baselines span classical, state-estimation, graph, reconstruction, foundation, and forecast-residual detectors, with shared inputs, outage masks, calibration windows, and validation-only tuning.Thresholds use the paper's calibration procedure rather than each method's published heuristic.Source: §4.6 · p. 11
• Detection delay at matched false-alarm rate is the primary security metric; the study also reports event-detection scores, twin fidelity, CRPS, and empirical coverage.Detection delay is reported as a median over attacks and averaged over seeds, alongside the fraction never detected within the horizon.Source: §4.6 · p. 11

5.1. Experimental Setup

• The evaluation uses hourly Melbourne counts from 2019–2024, with only 1.18% of walkable segments instrumented and chronological training, calibration, and test splits.The pandemic block is retained as a separate evaluation regime; attacks are injected only in the test period.Source: §5.1 · p. 12, Table 2 · p. 12

5.2. Twin Fidelity and Threshold Calibration

• Assimilation reduces MAE by 7.4%, while conservation costs 1.5% MAE and 0.006 coverage; withheld-counter MAE is 71.3 (2.4) versus 92.6 (3.1) for graph kriging.The twin is competitive but not dominant on clean-period accuracy and is better calibrated; its withheld-counter advantage falls to 6% at three hops and vanishes beyond four.Source: §5.2 · p. 12, Table 3 · p. 13
• Split conformal undercovers on the clean test period, so detection comparisons use separately recalibrated thresholds and a matched realized false-alarm rate of 0.011.The nominal rate is α=0.01; adaptive calibration recovers the target at the cost of a moving threshold.Source: §5.2 · p. 12, Table 4 · p. 13

5.4. The Attack Margin

• At κ=1, conservation cuts worst-case misattribution from 9.4% to 4.3%; at κ=20, corruption reaches 62.8%, with physics still removing twelve points.Figure 2 reports attack margin across access budgets; its shaded bands are bootstrap 95% intervals over twenty compromised sets. At λ=10, the margin rises from 0.00 to 0.39, while CRPS moves from 39.8 to 41.6.Source: Figure 2 · p. 13, §5.4 · pp. 13–14

5.3. Detection Performance

• At matched realized false-alarm rate 0.011, delays on A1–A3 are close to CATCH, while coordinated and optimized attacks sharply degrade statistical-irregularity detectors.Despite overlapping marginal results, the constrained detector is earlier than CATCH on the same episode in 71% of cases; Fawzi et al.’s recovery condition fails at 1.18% instrumentation.Source: §5.3 · pp. 12–13, Table 6 · p. 14, Table 5 · p. 14

5.5. Ablations and Non-Adversarial Shift

• Replacing the street graph with a geographic k-NN graph preserves much parametric-attack detection but collapses the attack margin; training and detection alone yield margins of 0.15 and 0.21 versus 0.39 together.Without the bounded source-and-sink envelope, the source term absorbs conservation violations and the residual goes quiet.Source: §5.5 · p. 14
• During the held-out pandemic regime without an injected attack, adaptive thresholds reabsorb the shift within three weeks, while fixed rules never do and learned baselines need two to three months.No method survives the first month; the sudden count drop is indistinguishable from a coordinated scaling attack using the available evidence.Source: §5.5 · p. 16, Table 7 · p. 16

5.6. Cost and Negative Results

• The 30-day ramp is effectively invisible within one week, and large-access margins fall below 0.2; the reported attack-margin results use one attacker, which a stronger algorithm could lower.Deployment is inexpensive, but attack-surface characterization is costly and is not run by operators.Source: §5.6 · p. 16

• The attack margin quantifies how the conservation constraint's size varies with adversary control, giving operators an exposure measure rather than a benchmark score.The discussion says the law is not a categorical defense.Source: §6 · p. 16
• The physical graph matters; calibration also matters because split conformal alarms on 68% of the first pandemic month, and sensor placement determines how much of ker(B) an adversary can reach.Optimizing placement for security is left for future work.Source: §6 · p. 16
• The study covers one city at hourly resolution, approximates source and sink limits from entrances and transit stops, tests one attack algorithm, and assumes the calibration archive remains uncompromised.The authors identify archive access as a threat to the guarantee.Source: §6 · p. 16

• Conservation-residual monitoring with conformal alarms removes roughly half of worst-case flow corruption with one device compromised and roughly a fifth with a third of the fleet compromised.For coordinated injections, it detects three times faster than the strongest runnable published detector at the same realized false-alarm rate; the constraint-off architecture does not.Source: §7 · p. 16
• Sensor placement could be optimized for attack margin, and the construction could extend to bicycle counts, transit boardings, and metered water.The authors frame placement as a security design objective.Source: §7 · p. 16

• The research received no external funding.Source: Funding · p. 16

• The City of Melbourne publishes pedestrian counts under CC BY 4.0 and sensor locations under CC BY 4.0; code and derived artifacts are openly available, with artifacts carrying their source licenses.The street network derives from OpenStreetMap under ODbL 1.0.Source: Data availability · p. 17

CRediT authorship contribution statement

• Fatemeh Ghasemi contributed methodology, software, formal analysis, the original draft, and visualization.She also contributed to conceptualization.Source: CRediT authorship contribution statement · p. 17
• Oscar Mogollon Gutierrez contributed conceptualization, validation, investigation, supervision, review and editing, and project administration.Source: CRediT authorship contribution statement · p. 17
• Mohammadhossein Homaei contributed methodology, validation, data curation, and review and editing.Source: CRediT authorship contribution statement · p. 17
• Andres Caro contributed supervision, resources, funding acquisition, and review and editing.Source: CRediT authorship contribution statement · p. 17
• Mar Avila contributed supervision, resources, and review and editing.Source: CRediT authorship contribution statement · p. 17