Paper: Secure Cyber-Physical Systems against Intent-Inference Attacks
Authors: Ling Yao, Xiangyun Rao, Chongrong Fang, Guangsheng Feng, Jianping He
Status: Submitted to ACC 2027
Role: First author
Why control behavior can reveal intent
A controller does more than stabilize a system. Its behavior also reflects design preferences: which states matter most, how aggressively inputs are used, and what trade-offs the designer considers acceptable. For a linear-quadratic regulator, these preferences are encoded in the cost weights.
An observer who records state and input trajectories can use inverse optimal control to work backward from behavior to those hidden objectives. This creates an intent-inference attack: even when the controller and its parameters are not directly exposed, normal system operation can reveal them.
Our central question is:
How can a cyber-physical system limit what an observer can infer about its control objective while retaining stability and useful closed-loop performance?
Two attackers, two defense points
The amount of data available to an attacker changes the nature of the problem. We therefore separate two observation regimes and defend different stages of the inference chain.
Scheme A: finite observations
With a limited trajectory, the attacker must first estimate the feedback gain from data. We derive a rank condition for when that gain is uniquely identifiable, then design input perturbations that shape the observed trajectory into a lower-dimensional subspace. The goal is to increase recovery error while respecting a finite-horizon performance budget.
This is a data-to-gain defense: it acts before the attacker can accurately reconstruct the deployed controller.
Scheme B: asymptotic observations
With sufficiently long observation, an attacker may recover the feedback gain accurately. The remaining ambiguity lies between that gain and the control objective that generated it. Multiple cost parameters can be inverse-optimal for the same gain.
We exploit this structure by searching for a stable camouflage gain whose inverse-optimal equivalence class stays separated from the true intent. Stability, recoverability, and performance constraints are enforced during the search.
This is a gain-to-intent defense: even if the apparent controller is identified, the underlying design objective remains ambiguous.
Theoretical structure
The paper introduces two complementary notions of protection:
- error-based unidentifiability for finite observations, where every candidate returned by the attacker remains sufficiently far from the true intent;
- probability-based unidentifiability for asymptotic observations, where the attacker’s probability of recovering the true objective is explicitly limited.
The analysis connects trajectory rank, controller identifiability, inverse-optimal equivalence classes, stability, and performance loss. Rather than adding noise without a model of the attacker, each defense is placed at the stage where that attacker’s uncertainty actually remains.
Main findings
Simulation studies illustrate both mechanisms:
- finite-data perturbation can make feedback-gain recovery ambiguous while satisfying the selected performance-loss constraint;
- camouflage-gain design can move the entire inverse-optimal equivalence class away from the true objective rather than hiding only one candidate estimate;
- protection has to be evaluated together with stability and closed-loop cost, because an unusable controller is not a meaningful defense.
My contribution
As first author, I led the research and manuscript development, including the attack formulation, the two-regime defense framework, theoretical analysis, numerical implementation, and evaluation, with guidance from Prof. Jianping He and collaboration from the co-authors.
Connection to my broader research
This work addresses the Protect side of my research question. Information in an autonomous system is not limited to sensor messages or packets exchanged over a network. The system’s own actions can reveal what it values. Secure decision-making therefore requires reasoning about both performance and the information exposed through behavior.
Availability
The manuscript is currently under review. A public paper link will be added after release is permitted.