Source-linked AI summary
Anomaly Score Preserving Data Poisoning Attacks on Data-Driven Controller Design
Motoharu Tsuboi, Hampei Sasahara, Iori Takaki, Hideaki Ishii
TL;DR
Data poisoning can undermine controllers designed from collected data, while manipulation magnitude alone does not guarantee evasion of the defender’s detector. The paper characterizes affine transformations that preserve the Mahalanobis-based anomaly score and designs an attack over the orthogonal group. Experiments show the attack can degrade closed-loop performance while preserving that score.
Problem
Norm-based stealthiness checks may not establish evasion of the defender’s detection statistic, and attacks requiring the full dataset do not fit sequential manipulation of previously unseen sensor data.
Source: §I · p. 1Method
The paper characterizes score-preserving affine transformations under suitable prior-knowledge assumptions, then optimizes attacks over the orthogonal group using Riemannian gradient methods.
Source: §I · p. 1, §III · p. 3Results
The proposed method reaches a closed-loop spectral radius of 2.674 with anomaly score 2.34×10^-23, while an existing method reaches 1.234 and score 2.21×10^4 with comparable manipulation.
Source: §I · p. 2Takeaways & Limitations
The characterized transformation can be applied sequentially to previously unseen data while guaranteeing anomaly-score preservation independently of the data used for attack optimization.
Source: §I · p. 2The attack scenario assumes the attacker knows the true system model and can manipulate sensor state data during collection.
Source: §I · p. 1
Abstract
from arXiv · showhide
This paper investigates stealthy data poisoning attacks against data-driven controller synthesis and develops an attack generation method. During data collection, an attacker can sequentially manipulate state measurements, while the defender attempts to detect such manipulation using a residual-based anomaly score based on the Mahalanobis distance. Under suitable assumptions on the defender's prior knowledge, we characterize the class of time-varying affine transformations that preserve the anomaly score for arbitrary data and parameterize this class by the orthogonal group. Based on this characterization, we formulate attack design under the stealthiness condition as an optimization problem over the orthogonal group and propose a Riemannian gradient method. Numerical experiments demonstrate that the proposed attack can degrade closed-loop performance while remaining stealthy.
I. INTRODUCTION
Data-driven controllers depend critically on collected data, making poisoning attacks a threat; norm-bounded manipulation alone does not ensure evasion of the defender’s detection statistic. This paper develops a sequential attack framework whose transformations preserve that statistic while degrading closed-loop performance.
I. INTRODUCTION
- Norm-based stealthiness measures may miss substantial manipulations that leave the defender’s detection statistic unchanged, while whole-dataset attack methods do not suit sequential manipulation of unseen data.The paper argues stealthiness should be defined in relation to the statistic actually used by the defender.Source: §I · p. 1
- The attack framework assumes the attacker knows the true system model and manipulates state data sequentially during collection to degrade the resulting controller while remaining stealthy.The attacker compromises the sensor channel; the designer’s input signals are not manipulated.Source: §I · p. 1
- The paper defines S-invariant stealthiness as preserving the anomaly score for arbitrary data and characterizes qualifying affine transformations under suitable assumptions on prior knowledge.It formulates attack generation over the orthogonal group and proposes Riemannian gradient optimization; a regularizer suppresses excessive manipulation.Source: §I · p. 1
- The proposed method raises the closed-loop spectral radius to 2.674 while keeping the anomaly score at 2.34×10^-23; an existing method reaches 1.234 and raises the score to 2.21×10^4.The comparison uses a comparable amount of data manipulation.Source: §I · p. 2
A. Controller Design
- Data-based controller design may identify a system model before controller design or construct a controller directly from data; both map collected data to a feedback gain.The controller depends on data collected from a system whose true matrices are not completely known to the designer.Source: A. Controller Design · p. 2
B. Anomaly Detection
The defender scores data by minimizing a covariance-weighted residual over candidate models. The attack formulation seeks to degrade closed-loop performance while preserving that score for arbitrary finite-length data.
B. Anomaly Detection
- The anomaly score is the infimum, over candidate models, of the residual magnitude measured with the process-noise covariance’s Mahalanobis distance.A dataset is declared anomalous when its score exceeds the prescribed threshold η.Source: B. Anomaly Detection · p. 2
- Under Gaussian noise, the anomaly score can be interpreted as the minimum negative log-likelihood over candidate models.The detection method evaluates whether collected data are consistent with the designer’s prior knowledge.Source: B. Anomaly Detection · p. 2
C. Formulation of Data Poisoning Attacks
- The attacker manipulates sensor state data during collection, while the designer’s predetermined input signals remain unaltered and the attack ends before controller implementation.The attacker is assumed to know the true system matrices.Source: C. Formulation of Data Poisoning Attacks · p. 3
- S-invariant stealthiness requires a transformation to preserve the anomaly score for every finite-length dataset, matching an attacker’s need to manipulate previously unseen data sequentially.The attacker seeks to degrade the true system’s closed-loop performance; the setting assumes white-box knowledge of the controller design, score, candidate sets, and covariance.Source: C. Formulation of Data Poisoning Attacks · p. 3
T Jatk(K (T (D));A,B)
Under Assumptions 1 and 2, the paper characterizes exactly which affine transformations preserve the anomaly score for arbitrary data. The characterization requires a time-invariant linear map, covariance invariance, and preservation of the candidate-model set.
T Jatk(K (T (D));A,B)
- The attack-design expression is constrained to transformations that are S-invariant stealthy.Source: T Jatk(K (T (D));A,B) · p. 3
III. S-INVARIANT STEALTHY ATTACKS
- Under Assumptions 1 and 2, S-invariant stealthy affine transformations are exactly those meeting the theorem’s three conditions.These require a time-invariant linear map, covariance invariance, and invariance of the prior-knowledge set.Source: §III · pp. 3, 5
- The prior-knowledge conditions hold for a broad class of sets, including common convex uncertainty sets under mild conditions.One condition requires matrices with eigenvalues of geometric multiplicity at most m + 1 to be dense in the set of system matrices.Source: §III · p. 5
- The transformation makes manipulated data consistent with the apparent system eA = TxAT^-1 and eB = TxB; choosing Tx = -I reverses the LQR feedback-gain sign.The paper interprets this as spoofing the system model perceived by the designer.Source: §III · p. 5
A. Formulation as Optimization over Riemannian Manifold
The section parameterizes score-preserving transformations with orthogonal matrices, turning attack design into optimization over the orthogonal group. A Riemannian gradient method solves this constrained problem, while score preservation on previously unseen data does not guarantee attack effectiveness there.
A. Formulation as Optimization over Riemannian Manifold
- Theorem 1 transformations can be parameterized by orthogonal matrices, so attack design selects Θ ∈ O(n) to maximize the attacker’s objective while preserving S-invariant stealthiness.The parameterization is Tx = Ψ−1ΘΨ, with Ψ the Cholesky factor of Σ−1.Source: A. Formulation as Optimization over… · p. 5
- The attack objective is optimized over the orthogonal group, with manipulated data formed by applying Tx(Θ) to X and Z while leaving U unchanged.The problem is equivalent to the S-invariant stealthy attack design problem under the stated prior-knowledge assumptions.Source: A. Formulation as Optimization over… · p. 6
- The transformation preserves the anomaly score on previously unseen data, but its attack effectiveness on those data is not necessarily guaranteed.The transformation is score-invariant independently of the collected data, whereas the attack objective depends on the dataset used for optimization.Source: A. Formulation as Optimization over… · p. 6
- A Riemannian gradient method projects the Euclidean gradient onto the orthogonal group's tangent space, then retracts the update back onto the group.The retraction uses the nearest orthogonal matrix from the updated point's singular value decomposition.Source: A. Formulation as Optimization over… · p. 6
B. Extension to Attacks Close to the Original Data
This subsection adds a regularization term to the attack objective to reduce manipulation magnitude. The regularization changes the objective but retains S-invariant stealthiness.
B. Extension to Attacks Close to the Original Data
- The regularized objective adds a term intended to reduce the magnitude of data manipulation.Moving Tx(Θ) closer to the identity matrix is expected to make manipulated data closer to the original data.Source: B. Extension to Attacks Close to the… · p. 6
- S-invariant stealthiness remains preserved for Θ ∈ O(n) with or without regularization, so the same orthogonal-group gradient method applies.The regularized objective replaces Φ with Φγ.Source: B. Extension to Attacks Close to the… · p. 6
V. NUMERICAL EXAMPLES
The numerical experiments compare the proposed attack with random noise and I-DGSM on a suspension-system model. They evaluate closed-loop spectral radius, anomaly score, and manipulation magnitude across attack settings.
V. NUMERICAL EXAMPLES
- The experiments compare the proposed method with independent uniform noise and I-DGSM, whose manipulations are constrained by a bound on the maximum norm.I-DGSM uses a projected gradient method; random noise is added independently to each state-data entry.Source: §V · p. 6
- The target is a suspension-system model with (n,m) = (4,2), and the original-data controller has closed-loop spectral radius 0.924.The data length is T = 15, and the anomaly-score weighting matrix is Σ = 10−2I.Source: §V · p. 6
- The evaluation metrics are closed-loop spectral radius, anomaly score, and manipulation magnitude relative to the original data.The experiment varies I-DGSM's manipulation bound, random-noise amplitude, and the proposed method's regularization parameter γ; Table I covers SS attack results and Table II covers the regularization trade-off.Source: §V · pp. 6–7, Table I · p. 7, Table II · p. 7
1) Representative Results for SS Model:
For the suspension-system model, the proposed attack destabilizes the closed loop while keeping the anomaly score nearly zero. At comparable manipulation magnitudes, it achieves greater attack effectiveness than random noise and I-DGSM.
1) Representative Results for SS Model:
- 2.674 is the proposed method's closed-loop spectral radius, with anomaly score 2.34 × 10−23; I-DGSM at comparable manipulation reaches 1.234 and anomaly score 2.21 × 104.Random noise at a comparable manipulation magnitude leaves the spectral radius below 1 and raises the anomaly score to 6.02×104.Source: 1) Representative Results for SS Model · p. 7
- The proposed method can cause instability while remaining undetected by the anomaly score, and it has higher attack effectiveness than the other methods at comparable manipulation magnitudes.I-DGSM with ε = 1×10−2 also destabilizes the system, with spectral radius 1.143, but its anomaly score is 3.01×103.Source: 1) Representative Results for SS Model · p. 7
2) Effect of Regularization Parameter:
The section examines how manipulation magnitude relates to attack effectiveness and how regularization trades effectiveness against data deviation. I-DGSM is more effective at small manipulation magnitudes, while the proposed method is more effective at larger magnitudes.
2) Effect of Regularization Parameter:
- Varying regularization parameter γ reveals a clear trade-off between attack effectiveness and manipulation magnitude.Large deviations from the original data appear in the unregularized examples.Source: 2) Effect of Regularization Parameter · p. 7
- The SS-model figure shows attacked-data examples, with I-DGSM results plotted for ε = 1×10−2.Source: Figure 2 · p. 7
- At small manipulation magnitudes I-DGSM yields a larger closed-loop spectral radius, but at larger magnitudes the proposed method does.The proposed method behaves differently when the spectral radius is below 1 versus above 1, where the system is destabilized.Source: 2) Effect of Regularization Parameter · p. 7
VI. CONCLUSION
The paper characterizes transformations that preserve the anomaly score and uses that characterization to construct an attack optimization method. Numerical experiments show that the method can degrade closed-loop performance while preserving the score.
VI. CONCLUSION
- Under the paper’s assumptions, time-invariant weighted orthogonal transformations are the necessary and sufficient form of transformations that preserve the anomaly score.Source: §VI · p. 7
- The authors develop an attack optimization method over the orthogonal group based on that characterization.Source: §VI · p. 7
- Numerical experiments demonstrate that the proposed method degrades closed-loop performance while preserving the anomaly score.Future work includes attacks on subsets of sensors, more restrictive prior knowledge, and improved optimization on the orthogonal group.Source: §VI · p. 7
APPENDIX
The appendix gives sufficient conditions for a density requirement by characterizing a polynomial test for membership in C_p. It proves density under three set conditions and identifies examples of sets satisfying them.
APPENDIX
- A nonzero polynomial Ψ_p(A) characterizes membership in C_p through A ∈ C_p if and only if Ψ_p(A) > 0.The polynomial is formed by summing squares of coefficients from the controllability-matrix minors.Source: APPENDIX · p. 8
- Under conditions (M1)–(M3), A ∩ C_p is dense in A.The conditions require a containing connected real-analytic submanifold that intersects C_p.Source: APPENDIX · p. 8
- The stated conditions hold for common convex uncertainty sets and symmetric matrices, provided A ∩ C_p is nonempty.Examples include entrywise interval uncertainty, ellipsoidal uncertainty, and the set of symmetric matrices.Source: APPENDIX · p. 8