PaperlayerView exact revision on arXiv

Source-linked AI summary

LogiC-Diff: Embedding Security Properties Into AI-Enabled Cyber-Physical Systems

Ziyan An, John Stankovic, Meiyi Ma

arXiv:2609.38381v1cs.CRcs.AI

TL;DR

Small adversarial or anomalous inputs can distort CPS forecasts and lead to unsafe downstream actions. LOGIC-DIFF conditions a two-stage diffusion pipeline on temporal logic specifications; across evaluated attacks, it improves forecasting error and specification compliance, with lower median MSE than the strongest baseline as attack strength increases.

  • Problem

    In high-stakes CPS, small adversarial or anomalous input perturbations can distort sensor signals, propagate through forecasting, and trigger unsafe downstream actions.

    Source: §1 · p. 1

  • Method

    LOGIC-DIFF uses Signal Temporal Logic specifications as conditioning signals for diffusion-based input repair and output refinement during forecasting.

    Source: §1 · p. 2, §3 · p. 4

  • Results

    Across two real-world CPS datasets, the method reduces forecasting error and improves specification compliance; across eight attack settings, its median MSE is lowest, outperforming the strongest baseline by 7.3%–28.8%.

    Source: §1 · p. 2, §4.3 · p. 9

  • Takeaways & Limitations

    Embedding formal security properties into CPS forecasting offers a specification-aware generative-modeling direction, with evaluated benefits spanning accuracy, compliance, robustness, and cross-attack generalization.

    Source: §1 · p. 2, §6 · p. 12

    Evaluation covers two attack families, and clean-data-learned STL specifications encode domain assumptions whose miscalibration or incompleteness could bias predictions downstream.

    Source: §4.4 · p. 11

Abstract

from arXiv · show

AI-enabled Cyber-Physical Systems (CPS) are highly vulnerable to adversarial and anomalous inputs, where small perturbations can induce cascading errors and unsafe control actions. Existing approaches, such as rule-based filtering, training-time regularization, or diffusion-based reconstruction, either operate outside the model or lack mechanisms to incorporate formal security specifications into the prediction process. In this paper, we take the first step toward embedding security properties directly into AI-enabled CPS, enabling predictive models to enforce system-level constraints during inference rather than relying on external defenses. We introduce a logic-conditioned bi-stage diffusion framework that integrates Signal Temporal Logic (STL) specifications into forecasting. STL serves as a first-class conditioning signal that guides both an input repair stage and an output refinement stage, allowing the model to jointly mitigate adversarial perturbations and enforce desired temporal behaviors to satisfy security-critical properties. We evaluate our approach on two real-world multivariate CPS forecasting datasets under a diverse set of physical sensor and cyber attacks. Across sensor faults, gradient-based attacks, adaptive attacks, and varying attack strengths, our method consistently improves robustness and specification compliance, degrades more gracefully as attack strength increases, and generalizes better to unseen attacks. Ablation studies on specification coverage and quality further show that embedding logical security properties yields gains unattainable by reconstruction-based methods alone, highlighting a new direction for integrating formal methods with generative models in secure CPS.

1 Introduction

CPS forecasting models lack built-in mechanisms for enforcing system-level security properties, while existing reconstruction and rule-based defenses do not jointly address inference-time robustness and temporal constraints. LogiC-Diff embeds STL guidance into a bi-stage diffusion process and improves forecasting robustness, specification compliance, and generalization across evaluated datasets and attacks.

1 Introduction

  • Learning-based forecasting models lack built-in guarantees of safety, temporal consistency, or system-level requirements, leaving security properties unenforced during prediction.The introduction identifies corrupted inputs and propagating prediction errors as a route to cascading failures.Source: §1 · p. 1
  • Reconstruction defenses use distributional information but lack explicit safe-behavior constraints, while rule-based approaches commonly act as regularizers or post-hoc monitors.The paper notes that these approaches do not mitigate adversarial perturbations during inference.Source: §1 · p. 2
  • LogiC-Diff conditions diffusion-based forecasting on STL specifications to shape forecasts toward security constraints while maintaining robustness.The framework places logic conditioning within the prediction process rather than relying only on external defenses.Source: §1 · p. 2
  • The framework uses logic-informed projections and a learnable gate to balance diffusion reconstruction with projected signals, training the pipeline end-to-end.Its training objective covers three defense desiderata.Source: §1 · p. 2
  • Across two CPS domains and diverse attacks, LOGIC-DIFF consistently improves forecasting error, specification compliance, and generalization across attack strengths.The evaluation includes physical sensor, gradient-based, adaptive, sparse indirect, and unseen attack settings; ablations indicate gains depend on embedded logic guidance.Source: §1 · p. 2

2 Background and Problem Statement

The paper frames CPS forecasting defense as producing accurate trajectories that also satisfy system-level specifications despite runtime attacks. It builds on diffusion repair and STL semantics to define input- and output-side requirements.

2 Background and Problem Statement

  • DDPMs provide the basis for input repair by denoising corrupted observations toward the clean data manifold before forecasting.The forecasting model then processes the reconstructed input to approximate its clean-input forecast.Source: §2 · p. 3
  • STL specifies bounded temporal requirements over continuous signals, with qualitative satisfaction and quantitative measures of satisfaction or violation.Its operators include always, eventually, and until requirements over bounded intervals.Source: §2 · p. 3
  • Runtime threats include black-box sensor attacks that freeze, replay, spoof, or mix sensor readings, and gradient-based white-box attacks bounded by an ℓ2 perturbation budget.The paper lists PGD, MIM, CW, and AutoAttack among the gradient-based attacks.Source: §2 · p. 3
  • The defense seeks a repaired input close to the clean trajectory and satisfying input-side STL rules, plus an accurate final forecast satisfying output-side rules.The formal goal also requires the forecast to approximate the clean-input forecast.Source: §2 · p. 3

3 Method: LogiC-Diff

LogiC-Diff projects CPS security specifications into guidance signals and uses them in diffusion-based repair before forecasting and refinement afterward. Its end-to-end objective balances reconstruction, forecast accuracy, and specification compliance.

3 Method: LogiC-Diff

  • The pipeline projects STL specifications into a logic-consistent signal, then uses input-stage diffusion before forecasting and output-stage diffusion to refine forecast residuals.The diffusion estimate is blended with the projection at both stages to encourage data-plausible and specification-consistent behavior.Source: §3 · p. 4, Figure 1 · p. 4

3.1 STL Guidance Signal

  • STL guidance uses a closest satisfying trace in ℓ1 distance; operator-level projections handle predicates and temporal or Boolean rules compositionally.The specification set can combine multiple rules, with separate rule sets for input reconstruction and output-side residual repair.Source: §3.1 · pp. 4–5

3.2 Logic-Conditioned Diffusion Reconstruction

  • At the input stage, a conditioned reverse diffusion estimate is blended with the logic projection using a learnable weight; the output stage repeats this pattern on the initial forecast.The output projection uses output-side rules, and its conditioned diffusion estimate is blended with that projection to produce the refined forecast.Source: §3.2 · pp. 5–6

3.3 End-to-End Training and Inference

  • End-to-end training combines reconstruction and STL-robustness losses at both stages with a forecasting loss on the final blended forecast.The objective encourages repaired inputs to stay close to clean signals and refined forecasts to remain accurate while satisfying their respective specifications.Source: §3.3 · p. 6

4 Evaluation

The evaluation spans smart-city traffic and air-quality forecasting and UAV telemetry, testing physical and cyber attacks, transfer, and specification ablations. LOGIC-DIFF improves performance across attack settings, but misleading specifications can degrade it.

4.2 Robustness Across Various CPS Attack Models

  • Under Dropout and Replay, MSE falls from 0.468 to 0.246 and 0.438 to 0.207; under PGD, it falls from 0.226 to 0.197 versus AT-Madry, with higher Sat% (86.9% vs. 85.3%).The physical-attack table reports MSE and STL Sat% as mean±95% confidence intervals; the cyber-attack table covers gradient-based attacks.Source: Table 2 · p. 7, §4.2 · pp. 7–8, Table 3 · p. 8
  • Under Proj.-PGD, LOGIC-DIFF records 0.2005 MSE versus 0.2304 for the best baseline; it also leads sparse-indirect settings by 28–30% on smart-city data and 11–12% on the benchmark.The sparse-indirect comparisons cover deterministic and probabilistic variants and all reported sparsity levels.Source: §4.2 · pp. 8–9, Table 3 · p. 8, Table 4 · p. 9

4.3 Generalizability Across Attack Severity, Access, and CPS Domains

  • Across eight PGD and Mixed attack-budget settings, LOGIC-DIFF has the lowest median MSE, outperforming the strongest baseline by 7.3%–28.8%.Its margin reaches 14.0% at the largest PGD budget and rises from 14.3% to 28.8% across Mixed attacks; the CDFs show the pattern across the test distribution.Source: Figure 2 · p. 9, §4.3 · p. 9
  • On unseen attacks, LOGIC-DIFF reaches 0.213 and 0.205 MSE on MIM-ℓ2 and PGD-ℓ2, and reduces physical Replay and Dropout MSE by 52.7% and 44.7% versus the best AT baseline.Cross-attack evaluation trains on the opposite attack within each category.Source: Table 5 · p. 10, §4.3 · p. 10
  • On ALFA UAV, LOGIC-DIFF has the lowest MSE in six of eight attacked settings; gains are largest on Replay (1.139 to 0.332), Mixed (0.554 to 0.220), and Dropout (0.296 to 0.180), but are not uniform.Differences from AT-Madry are small and confidence intervals overlap under FDI and CW.Source: Table 5 · p. 10, §4.3 · p. 10

4.4 Understanding the Sources of Robustness

  • Removing input repair raises Dropout MSE from 0.246 to 0.496; output conditioning and STL loss add gains, while Stability helps across attacks and relational rules matter more for PGD and CW.The component ablation reports mean±95% confidence intervals.Source: §4.4 · pp. 10–11, Table 6 · p. 11
  • Widening bounds or removing some rules has little effect, but overly tight, mismatched, or contradictory specifications noticeably degrade performance; very limited calibration data also hurts.Performance recovers quickly with more calibration samples, and missing guidance is less harmful than misleading guidance.Source: §4.4 · p. 11

4.2 Robustness Across Various CPS Attack Models

  • Across fixed-budget attacks, increasing budgets, component ablations, and cross-attack generalization, LOGIC-DIFF improves performance and degrades less drastically as attack strength rises.The discussion also reports more robust generalization to unseen attacks and meaningful contributions from each rule type.Source: §4.4 · p. 11

5 Related Work

Prior CPS defenses address robustness through reconstruction or encode requirements through logic-aware constraints, but these directions are often separated. LOGIC-DIFF uses logic as semantic guidance within diffusion repair, targeting trajectories that are both data-plausible and consistent with CPS security specifications.

5 Related Work

  • Diffusion defenses such as DiffPure [Nie et al., 2022] use denoising to improve robustness but rely mainly on distributional plausibility rather than CPS semantics.Generative defenses move corrupted inputs toward the clean data distribution.Source: §5 · p. 11
  • CPS attacks span sensing, communication, and learning, and mixtures of physical and cyber attacks can make single-family defenses insufficient.Prior defenses include CPS-level detection and resilient control as well as ML adversarial training and randomized smoothing.Source: §5 · p. 11
  • Logic-aware methods use training regularization, output filtering, or verification to incorporate prior knowledge and constrain security-related predictions.The cited approaches use logic to constrain training, verify outputs, or filter predictions.Source: §5 · p. 12
  • LOGIC-DIFF bridges these directions by using logic as semantic guidance within diffusion repair, steering reconstruction toward data-plausible, specification-consistent trajectories.The framework addresses physical-layer sensor attacks and cyber-layer gradient attacks under a unified defense.Source: §5 · pp. 11–12

6 Conclusion

The paper embeds formal specifications into a two-stage diffusion framework for CPS forecasting and evaluates it across more than one hundred specifications. Results indicate gains in robustness and predictive performance, more graceful degradation under stronger attacks, and better transfer to unseen attacks.

6 Conclusion

  • Across more than one hundred specifications, results indicate improved robustness and predictive performance, more graceful degradation as attacks strengthen, and better transfer to unseen attacks.The evaluation also examines specification compliance, component and rule ablations, and cross-attack generalization.Source: §6 · p. 12
  • The framework embeds formal specifications before forecasting through input-side repair and after forecasting through output-side refinement.The paper identifies a broad set of security properties for incorporation into both stages.Source: §6 · p. 12
  • The paper concludes that logic-guided repair has potential to extend to a broader range of CPS domains.Future work may formally specify and incorporate additional security properties within the same framework.Source: §6 · p. 12

A General Information

The paper provides code and reports its experimental computing resources. It frames the work as defensive security research for safety-critical CPS, while noting that specification errors and over-reliance on one defense pose risks.

A General Information

  • The code is available at the stated anonymous repository, and experiments used a machine with 128 GB RAM, an AMD Ryzen Threadripper Pro 7975WX CPU, and an NVIDIA RTX 6000 Ada GPU.The supplied repository address is https://anonymous.4open.science/r/rpc-817A/.Source: A General Information · p. 15
  • The work targets forecasting applications in transportation infrastructure, air-quality monitoring, and autonomous mobility, where prediction errors can propagate to physical control actions.The paper describes these as domains with real-world consequences.Source: A General Information · p. 15
  • The framework is reported to reduce unsafe-downstream-behavior risk under physical sensor faults and adaptive cyber attacks, while degrading more gracefully as attack strength increases.The paper also reports better generalization than adversarial training to attacks not seen during training.Source: A General Information · p. 15
  • Miscalibrated or biased specifications could distort predictions and propagate to control decisions, especially for underrepresented subpopulations.The paper also cautions that no defense provides absolute guarantees and warns against relying on a single robustness mechanism.Source: A General Information · p. 15

B Notations

Table 7 lists core notations used in the paper.

B Notations

  • Table 7 contains the paper’s core notations.The passage does not provide the notation entries themselves.Source: B Notations · p. 15

C Signal Temporal Logic Semantics

The section defines STL’s Boolean satisfaction and quantitative robustness semantics, then describes physical attacks that perturb multivariate time-series inputs. These foundations support monitoring, optimization, and threat-model specification.

C Signal Temporal Logic Semantics

  • STL formulas combine predicates, negation, conjunction, bounded temporal operators, and until to express properties over time.The semantics include bounded eventuality, always, and until operators.Source: C Signal Temporal Logic Semantics · p. 15
  • STL’s qualitative semantics evaluate whether a signal trace satisfies a formula, while robustness semantics measure the signed strength of satisfaction or violation.Positive robustness indicates satisfaction and negative robustness indicates violation; the robustness function is smoothed for gradient-based optimization in STL training losses.Source: C Signal Temporal Logic Semantics · pp. 15–16

D Background on Physical Attack Models

  • Physical attacks perturb multivariate spatiotemporal inputs to induce prediction errors and violations of task-specific logic constraints.The threat model distinguishes feature-wise attacks on selected channels from coordinated global attacks across all features.Source: D Background on Physical Attack Models · p. 17

E Dataset Preparation

The datasets are prepared as multivariate forecasting windows from smart-city measurements, UAV telemetry, and a traffic benchmark adaptation. Their preprocessing and evaluation use distinct splitting and calibration protocols.

E Dataset Preparation

  • All three prepared datasets use seven channels, 24-step inputs, six-step forecasts, and stride-one windows.The smart-city windows are assigned to splits by the final forecast target timestamp; the standardizer is fitted across all imputed source files, using aggregate statistics beyond the training period and leaving no gap between adjacent splits.Source: E Dataset Preparation · p. 17
  • The smart-city dataset combines hourly traffic and air-quality records into seven channels, with station matching and channel-specific imputation for missing values.Traffic records use station-specific hour-of-day means; air-quality values are forward- and backward-filled before remaining gaps are filled with station-specific hour-of-day means.Source: E Dataset Preparation · p. 17
  • The ALFA UAV dataset contains 47 flight sequences, aligned to a 4 Hz grid, with recording sessions assigned wholly to one split.Standardization is fitted on clean training input windows; 840 test windows at or after recorded fault onset are stored separately from clean-window synthetic-attack evaluation.Source: E Dataset Preparation · p. 17
  • The traffic benchmark uses seven correlated lane-occupancy series selected from 862 series, then splits the sequence chronologically before windowing.The sparse attack targets lane_039 while perturbing a subset of the other six series.Source: E Dataset Preparation · pp. 17–18
  • Extended attacks use fixed subsets of test windows and offline reference-based calibration, including clean-reference input bounds and pooled held-out target information.Attack columns with different subset sizes are not controlled rankings of attack strength; the calibration protocol is not training-only and assumes clean references unavailable under deployment-time attack.Source: E Dataset Preparation · p. 18

F Attack Implementation and Settings

The attack suite spans physical sensor faults, gradient-based perturbations, query-based attacks, and sparse indirect attacks. Evaluation also specifies how defended pipelines are attacked and notes where projection may fail to preserve joint feasibility.

F Attack Implementation and Settings

  • The evaluation groups attacks into black-box physical sensor faults and white-box gradient-based attacks, with the latter targeting the defended inference pipeline using BPDA for non-differentiable repairs.Attack strength is parameterized by ε, whose precise meaning varies by attack family.Source: F Attack Implementation and Settings · pp. 18–19
  • Physical attacks include false data injection, temporal replay, dropout, and mixed samples that randomly draw among the three attack types.Dropout uses ε to control both sensor-failure probability and outage duration, with failure probability saturating at ε ≥3.Source: F Attack Implementation and Settings · p. 18
  • Gradient-based attacks maximize prediction MSE under hard ℓp budgets, with PGD, MIM, and APGD implemented for ℓ2 and ℓ∞ and CW for ℓ2.The described PGD and MIM variants use 20 iterations; APGD uses 100 iterations and five random restarts.Source: F Attack Implementation and Settings · pp. 18–19
  • BPDA uses the true non-differentiable repair in the forward pass and an identity approximation in the backward pass; EOT averages gradients across stochastic forward passes.LogiC-Diff uses deterministic one-shot inference without injected diffusion noise in the BPDA/EOT comparison, while DiffPure and randomized smoothing use stochastic inference.Source: F Attack Implementation and Settings · p. 19
  • Proj.-PGD alternates loss ascent with logic repair and budget projection, but the final budget projection can undo logic feasibility.The procedure therefore does not guarantee that its final input belongs to both constraint sets; the saved experiment uses 186 attacker-side constraints.Source: F Attack Implementation and Settings · p. 19
  • Sparse indirect attacks perturb auxiliary series to increase forecast error on protected target channels, with deterministic and probabilistic support-selection solvers.The smart-city setup protects flow, occupancy, and speed while allowing at most two or four air-quality channels to be perturbed; the traffic setup protects lane_039.Source: F Attack Implementation and Settings · p. 20

G Framework Implementation Notes

The implementation combines input repair, forecasting, and output refinement, with STL-projected signals conditioning both diffusion stages. The accompanying logic formulas cover system-consistency properties and describe adversarial behaviors without enforcing those attack-pattern formulas as constraints.

G Framework Implementation Notes

  • LOGIC-DIFF uses an input-stage diffusion U-Net to repair attacked windows, a sequence-to-sequence transformer to forecast, and an output-stage U-Net to refine the forecast.The implementation uses seven features, an input window of 24, and a forecast horizon of six.Source: G Framework Implementation Notes · pp. 21–22
  • Both diffusion stages use a one-dimensional DDPM-style U-Net, with ten diffusion steps and a single-step estimate at fixed step n⋆ = 5.The noisy latent and STL conditioning signal are concatenated when logic conditioning is enabled; the input and output U-Nets operate on lengths 24 and six, respectively.Source: G Framework Implementation Notes · pp. 21–22
  • At each diffusion stage, an STL projection produces a logic-feasible signal used both as conditioning and as the reference in a learnable blend with the U-Net estimate.Straight-through estimation propagates gradients through the non-differentiable projection during adversarial-training inner loops.Source: G Framework Implementation Notes · p. 22

H Security-Oriented Logic Formulas

  • The adversarial-behavior formulas describe patterns such as suppression, replay, false data injection, spoofing, bounded perturbation, and backdoor poisoning, but are not enforced as constraints.They are used to describe and reason about adversarial signal manipulations.Source: H Security-Oriented Logic Formulas · p. 23
  • The system-consistency formulas encode stability, smoothness, cross-sensor consistency, flow conservation, temporal sampling, and post-disturbance recovery properties.Examples include bounded physical ranges, limits on temporal variation, and measurement arrival within intervals.Source: H Security-Oriented Logic Formulas · p. 23

I Training Configurations and Hyperparameters

The evaluated models use shared training defaults for optimization, training duration, and early stopping, with adversarial-training settings varying by mode. LOGIC-DIFF’s total loss combines diffusion supervision, STL penalties, and prediction error.

I Training Configurations and Hyperparameters

  • All models use AdamW with an initial learning rate of 2 × 10−4 and weight decay of 1 × 10−4, with the learning rate held constant.Source: I Training Configurations and… · p. 24
  • Default training uses batch size 128 and 50 epochs on CUDA, or batch size 64 and 20 epochs on CPU.More epochs can be selected through the corresponding training option.Source: I Training Configurations and… · p. 24
  • LOGIC-DIFF’s total loss combines diffusion supervision for x̂ and ŷ, softplus penalties on negative STL robustness, and MSE on the final blended forecast.The loss is defined in Section 3.Source: I Training Configurations and… · p. 24
  • Training stops after 10 consecutive epochs without validation-MSE improvement, and evaluation uses the checkpoint with the lowest validation MSE.Source: I Training Configurations and… · p. 24
  • Adversarial training supports data-level, PGD-AT, MIM-AT, and TRADES modes, with mode-specific injection probabilities and inner-loop budgets.Default budgets include ε = 0.1 for PGD/MIM, 7 steps at relative step size 0.3, and TRADES β = 6.0 with 10 steps; data-level attacks sample from the physical-attack suite.Source: I Training Configurations and… · p. 24
  • Transformer baselines share LOGIC-DIFF’s optimizer, batch size, epoch budget, and early-stopping policy, while their training and inference setups differ by baseline.For cross-attack generalization, LOGIC-DIFF uses the same adversarial-training recipe as the AT methods.Source: I Training Configurations and… · p. 24

Related papers

Loading 2609.38381v1…