PaperlayerView exact revision on arXiv

Source-linked AI summary

Model-Free Generative Stealthy Attacks on Safety-Critical Vehicle Cyber-Physical Systems

Qazi Mairaj ud din, Sidra Ghayour Bhatti, Qadeer Ahmed

arXiv:2610.31864v1eess.SYcs.SY

TL;DR

Stealthy attacks commonly assume privileged knowledge of the target, while this paper develops a model-free attack policy from nominal measurements. The resulting generator produces a hazardous lane departure and truck speed deviation while evading detection.

Abstract

from arXiv · show

Existing stealthy attacks presuppose white- or grey-box access to the target system, unrealistic in practice. This paper develops a model-free stealthy attack framework that learns an attack policy directly from nominal measurement data, without knowledge of the system dynamics, estimator, or detector. We establish a certified residual-impact bound and an observable stealth budget around a stealth-consistent anchor, and show that recurrence and context conditioning are structural necessities for closed-loop, multivariate cyber-physical systems (CPS). The resulting attack generator, trained against a Wasserstein critic under a stealth-constrained impact objective, induces a hazardous 2.51 m lane departure while evading five intrusion detection systems, and, in real-time hardware-in-the-loop tests, a speed deviation of approximately 8 km/h while staying below the detection threshold. Results show that safety-critical CPS remain exposed without attacker access to privileged information, motivating offense-informed defenses.

I. INTRODUCTION

The introduction identifies privileged system knowledge and narrow validation settings as gaps in stealthy-attack research, then motivates a model-free framework. The system model describes nonlinear sensing, recursive state estimation, feedback control, and residual-based detection.

I. INTRODUCTION

  • Early stealthy attacks required plant, estimator, observer-gain, and noise knowledge,, while later work reduced—but did not eliminate—privileged-information requirements.Domain-specific frameworks remained white-box, and subsequent work shifted toward grey-box and data-driven approaches.Source: §I · p. 1
  • Existing frameworks rely on privileged knowledge or narrow benchmarks, limiting their transfer to heterogeneous, dynamic CPS with correlated multivariate measurements.The identified gaps also include reliance on prolonged offline access and evaluation under narrowly varying, quasi-static conditions.Source: §I · p. 1
  • The paper formalizes residual-based detectability through an observer-induced measurement manifold and proposes a model-free attack framework grounded in nominal data.Its stated contributions include a certified residual-impact bound, an observable stealth budget, and a recurrent, context-conditioned generator.Source: §I · p. 1

II. SYSTEM DEFINITION AND ATTACK MODEL

  • Section II formalizes a general nonlinear CPS architecture and attack model.Source: §II · p. 2

A. System Model

  • The system model combines discrete-time state dynamics and nonlinear, Lipschitz-continuous sensing with recursive state estimation and feedback control.The estimator produces state estimates and innovation residuals, which the intrusion detection system monitors.Source: A. System Model · p. 2
  • The attack targets a residual-energy test, with alarms triggered when the statistic exceeds a threshold calibrated from nominal data.The paper uses a non-parametric percentile threshold to accommodate non-Gaussian heavy-tailed sensor data.Source: A. System Model · pp. 2–3

B. Attack Model

The attack model gives the adversary access to a compromised sensor subset while leaving other measurements available as context. Its objective is to increase state-estimation error without crossing the residual detector’s threshold.

B. Attack Model

  • The attacker can add an injection to compromised sensor measurements while leaving uncompromised context channels unchanged.The sensor set is partitioned into target and context channels, and the estimator and controller receive both.Source: B. Attack Model · p. 3
  • The model assumes the attacker can read and overwrite network frames and passively record nominal operation, with deployment matching the nominal distribution.The attack requires no plant model, sensing map, Jacobians, estimator internals, or detector parameters.Source: B. Attack Model · p. 3
  • The attacker seeks to maximize induced state-estimation error while remaining below the residual detector’s alarm threshold.Impact degrades closed-loop performance, while stealth means avoiding an alarm when the innovation statistic exceeds its threshold.Source: B. Attack Model · p. 3

III. PROPOSED METHODOLOGY

The framework makes stealth and impact objectives observable from nominal data, then realizes them with an anchor-based budget and a recurrent, context-conditioned attack law. Its certificate links residual size to a lower bound on estimation error, while its closed-loop analysis shows how small residual deviations can accumulate under specific plant conditions.

A. Model-Free Attack Framework

  • In nonlinear closed-loop systems, the reachable measurement set is a curved manifold, so linear range and offset-recursion conditions do not generally yield exact state-shifted measurements.A local first-order approximation recovers linear structure near each operating point and motivates manifold-aligned attack design.Source: A. Model-Free Attack Framework · p. 3
  • The model-free formulation replaces unobservable objectives with an observable impact proxy and stealth budget, requiring a history-dependent attack law and conditioning on uncompromised context channels.Partial compromise pins the context block of the residual deviation, so perturbations must reflect joint nominal statistics.Source: A. Model-Free Attack Framework · p. 3

B. Framework Realization

  • The attack generator emits a bounded displacement about a frozen anchor, using strictly-past target history and available context.The architecture is shown in Fig. 2.Source: Figure 2 · p. 4, B. Framework Realization · p. 4
  • A Lipschitz measurement map and bounded noise yield a residual–impact certificate: raising the observable residual above the noise floor establishes a lower bound on true estimation error.The bound is non-vacuous only when the residual level exceeds the noise floor, and the thresholded proxy certifies feasibility rather than achievable impact magnitude.Source: B. Framework Realization · p. 4
  • On marginal modes, residual deviations can accumulate into unbounded impact while detector mean shift remains horizon-independent; this accumulation result is for the linear specialization.The impact-to-detectability ratio grows without bound when a unit-circle mode is excited; stable modes saturate, while maintaining constant residual deviation on unstable modes forfeits stealth.Source: B. Framework Realization · pp. 4–5
  • For past-measurable residual deviations, the innovation covariance is fixed by the Riccati recursion; below the nominal innovation floor, a detector retains its calibrated false-alarm rate.For deterministic injection, covariance is preserved exactly and only the mean shifts.Source: B. Framework Realization · pp. 4–5
  • A stealth-consistent anchor turns the detector test into a bound on the attacker's observable displacement; displacements within the isotropic budget are certified stealthy in every direction.Displacements outside the ball may still satisfy the detector level set, but are not certified by this norm bound.Source: B. Framework Realization · p. 5
  • The anchor budget uses a residual threshold calibrated to a nominal-data quantile, placing its surrogate at the same false-alarm operating point.The attacker substitutes an empirical quantile for a model-dependent innovation covariance.Source: B. Framework Realization · p. 5

1) Autoencoder as a stealth-consistent manifold anchor:

A nominal-data-trained autoencoder provides a practical surrogate for the measurement manifold and a reference point for assessing residuals. Under regularization, its reconstruction residual estimates displacement from that manifold.

1) Autoencoder as a stealth-consistent manifold anchor:

  • A nominal-data-trained autoencoder serves as a data-driven surrogate for the measurement manifold; in the linear setting, it coincides with projection onto the data’s principal subspace.For nominal measurements following y = Hx + v, that subspace is col(H), and reconstruction error is Euclidean distance to the manifold.Source: 1) Autoencoder as a stealth-consistent… · p. 5
  • As the regularization scale approaches zero, the reconstruction residual estimates the nominal measurement-density score and points toward higher-density regions.The reconstruction map preserves directions tangent to the manifold while suppressing sensitivity in orthogonal directions.Source: 1) Autoencoder as a stealth-consistent… · p. 6
  • The reconstruction residual visualizes the geometry: nominal measurements lie on the manifold, while off-manifold measurements are pulled back toward it along the manifold normal.The anchor’s output is the reference point for residual assessment, and its fixed set is the nominal-consistent manifold.Source: 1) Autoencoder as a stealth-consistent… · p. 6
  • To leading order in the regularization scale, the trained autoencoder’s fixed set coincides with the nominal-consistent manifold, and its residual estimates displacement from that manifold.Nominal measurements therefore produce near-zero residuals.Source: 1) Autoencoder as a stealth-consistent… · p. 6

2) AE Bottleneck dimension and the observability limit:

The autoencoder and generator bottleneck should reflect the dimension of the measurement manifold reachable from the available sensors. That dimension is limited by what the sensor set makes observable.

2) AE Bottleneck dimension and the observability limit:

  • The bottleneck target is the intrinsic dimension of the measurement manifold reachable from the target and context sensors, which coincides with the observable dimension when the output map is an immersion.Full rank of the Hermann–Krener observability co-distribution is a sufficient condition for local weak observability; generically, the converse holds.Source: 2) AE Bottleneck dimension and the… · p. 6
  • A sensor set that leaves nx − nM state directions unobservable cannot support their recovery by any encoder; that gap measures structural invisibility, not an autoencoder deficiency.A bottleneck larger than nM recovers no additional state information, while one smaller than nM discards observable structure.Source: 2) AE Bottleneck dimension and the… · p. 6
  • Because nM is unavailable in closed form, the paper estimates it model-free from nominal target-and-context windows and checks it against a reconstruction-error plateau over bottleneck sizes.Both procedures are used to set the bottleneck at the observable dimension.Source: 2) AE Bottleneck dimension and the… · p. 6

C. Structure of the Attack Law

The attack law must be recurrent and context-conditioned: temporal history and uncompromised sensor context are needed to shape an attack that preserves joint residual statistics while accumulating impact. The generator learns stochastic displacements around a nominal-data anchor.

C. Structure of the Attack Law

  • A memoryless law based only on the current measurement cannot generally realize the history-dependent compensation needed to keep recursive residuals stealthy as state deviation accumulates.A constant state offset is dynamically stealthy only in the unit-eigenvalue subspace; otherwise it must evolve with the plant dynamics.Source: C. Structure of the Attack Law · p. 6
  • When target and context channels share state information, their residuals are cross-correlated, so target-channel-only attacks cannot generally preserve the joint residual statistics.The attack must depend on context to compensate for that correlation.Source: C. Structure of the Attack Law · p. 7
  • The attack must shape its injection against the joint residual and use context history because impact accumulation perturbs the residual over time.Requirements R1 and R2 specify what the generator optimizes, while R3 and R4 specify its structure.Source: C. Structure of the Attack Law · pp. 6–7
  • The generator is recurrent and context-conditioned, producing stochastic displacements around a frozen, nominal-data-trained anchor rather than generating raw measurements.Its recurrent state supplies memory, context supplies conditioning, and a latent variable makes the attack a distribution; the anchor recenters the output space onto the nominal manifold.Source: C. Structure of the Attack Law · p. 7
  • The anchor residual regularizes the learned displacement toward zero, keeping generator exploration in a compact, stealth-consistent neighborhood of the measurement manifold.The parameterization recovers the static displacement, so the network learns the stealth-consistent correction rather than the full attack.Source: C. Structure of the Attack Law · p. 7
  • A conditional Wasserstein critic trained on nominal joint target-and-context data drives generated joint distributions toward nominal conditional distributions.The Wasserstein form supplies usable gradients when the distributions have limited overlap, as expected within the narrow stealth-consistent neighborhood.Source: C. Structure of the Attack Law · p. 7

D. Assembled Training Objective

The assembled objective combines an observable impact proxy with a residual-based stealth budget and a distributional constraint. It trains the recurrent, context-conditioned generator to maximize impact within that budget.

D. Assembled Training Objective

  • The impact objective uses an observable proxy that induces a certified lower bound on the true, unobservable state-estimation error.The proxy is identified as the attacker’s optimization target.Source: D. Assembled Training Objective · p. 7
  • The stealth penalty enforces an observable budget on the residual measured against the anchor.The objective also includes a conditional Wasserstein critic term because a pointwise budget alone does not preserve joint target-and-context statistics.Source: D. Assembled Training Objective · p. 7
  • The recurrent, context-conditioned generator is trained to maximize impact within the stealth budget, with λs weighting stealth against impact.Algorithm 1 covers offline training on recorded nominal data and online deployment of the trained generator.Source: D. Assembled Training Objective · pp. 7–8

IV. EXPERIMENTAL VALIDATION

The framework is evaluated in simulation, on recorded heavy-vehicle data, and in real-time hardware-in-the-loop deployment, testing hazard, evasion, and feasibility.

IV. EXPERIMENTAL VALIDATION

  • The three evaluation settings are MiL with known dynamics, offline evaluation on real heavy-vehicle CAN data, and real-time HiL deployment.MiL and HiL exercise the full offline-train/online-deploy pipeline; the CAN-data setting is offline only.Source: §IV · p. 8
  • Together, the settings test whether the model-free generator is hazardous in closed loop, evasive against deployed IDSs, and realizable on real-time hardware.Source: §IV · p. 8
  • The benchmark setting uses known dynamics as ground truth, while the CAN-data setting tests transfer beyond simulation.Source: §IV · p. 8

A. Model-in-the-loop validation

The Model-in-the-Loop benchmark provides a known vehicle model for validating the framework, with lateral-offset sensor compromise targeting lateral control.

A. Model-in-the-loop validation

1) Validating AE-Anchor design:

The AE anchor is set to the measured three-channel observable dimension, and the recurrent context-AE closely tracks the nominal EKF innovation.

1) Validating AE-Anchor design:

  • The estimated effective observable dimension is 3, matching the independent measured channels and the AE reconstruction-error plateau.The bottleneck sweep spans latent dimensions 1–6; both diagnostics support setting the AE bottleneck to 3.Source: 1) Validating AE-Anchor design · p. 8
  • The recurrent context-AE reaches corr(δ, rEKF) = 0.97 and Var(δ) = 0.42, versus 0.25 and 6.05 for memoryless reconstruction.Its residual variance is within 8% of the Kalman innovation variance (SAE/SKalman = 1.08).Source: 1) Validating AE-Anchor design · p. 8
  • At a 1% target false-alarm rate, nominal AE residual calibration gives σAE = 0.1186 and τAE = 0.304 scaled units.τAE is used as the stealth regularizer in the training objective.Source: 1) Validating AE-Anchor design · p. 8

2) Validating residual–impact coupling under stealth constraint:

Under the stealth constraint, the observed injection and estimation error follow the certified residual–impact floor. In closed-loop deployment, the attack drives a hazardous lane departure while residual statistics remain nominal; ablations show stealth and impact objectives are both needed.

2) Validating residual–impact coupling under stealth constraint:

  • Every stealthy sample lies on or above the certified injection-magnitude floor, with estimation error rising linearly as the injection magnitude grows.The tested setting uses L = 1.0, √σv = 0.05, p = 3, and τr = 0.137; the bound holds for essentially all samples.Source: 2) Validating residual–impact coupling… · pp. 8–9

3) Closed-loop deployment and impact validation:

4) Ablation Study:

The study reports stealthy physical impact from nominal data across benchmark, real-vehicle, and real-time hardware-in-the-loop settings. Its detector evaluation and ablation distinguish multivariate sensitivity from attack stealth and show the roles of recurrence and context.

4) Ablation Study:

  • 2.51 m peak and 0.77 m sustained offsets came from Ladv+Limpact+Lstealth under nominal alarms; MLPs diverged and were detected, while context removal stayed stealthy at reduced impact.The ablation identifies recurrence as necessary for the attack's impact and context channels as contributing to impact while preserving stealth.Source: 4) Ablation Study · p. 9

5) Evaluation Against SOTA IDSs:

  • At 1% FPR, CANet and INDRA were evaded entirely (0.1%), while multivariate detectors retained ≈25% sensitivity; supervised GNBs still missed ≈75%.The multivariate detectors' residual sensitivity reflects cross-channel correlation and impact-induced drift, not loss of stealth.Source: Table IV · p. 9, 5) Evaluation Against SOTA IDSs · p. 9

B. Validation on real vehicle data

  • On held-out Kenworth CAN segments, offline attacks tracked the nominal manifold within the AE stealth band while carrying a controlled offset; no plant or detector ran in-loop.This tests transfer from the synthetic benchmark to real sensor data.Source: B. Validation on real vehicle data · p. 10

C. Real-time hardware-in-the-loop validation

  • 7.7 km/h vehicle-response deviation at 965 sec occurred with the attacked residual within threshold τ = 0.191 and exceedance 0.0043, statistically indistinguishable from the nominal false-alarm rate.The real-time deployment was feasible under real bus timing, quantization, and closed-loop dynamics.Source: Figure 8 · p. 10, C. Real-time hardware-in-the-loop… · p. 10

V. CONCLUSION

  • 2.51 m lane departure and ≈8 km/h truck speed deviation were achieved at nominal residual false-alarm level using nominal measurements only.The conclusion also identifies cross-channel consistency as defensive leverage and points to sensor placement and channel partitioning as security decisions.Source: §V · p. 10

Related papers

Loading 2610.31864v1…