# Controller confidentiality for nonlinear systems under sensor attacks

Michelle S. Chong M. Chong is with the Control Systems Technology section at
the Department of Mechanical Engineering, Eindhoven University of Technology.
<EMAIL_ADDRESS>
###### Abstract

Controller confidentiality under sensor attacks refers to whether the internal
states of the controller can be estimated when the adversary knows the model
of the plant and controller, while only having access to sensors, but not the
actuators. We show that the controller’s state can be estimated accurately
when the nonlinear closed-loop system is detectable. In the absence of
detectability, controller confidentiality can still be breached with a
periodic probing scheme via the sensors under a robust observability
assumption, which allows for the controller’s state to be estimated with
arbitrary accuracy during the probing period, and with bounded error during
the non-probing period. Further, stealth can be maintained by choosing an
appropriate probing duration. This study shows that the controller
confidentiality for nonlinear systems can be breached by balancing the
estimation precision and the stealthiness of the adversary.

##  I Introduction

The cyber security of dynamical systems have gained traction in recent years
as cyber-physical systems become increasingly interconnected, see [1] and [2]
for a tutorial overview. While the connectivity improves performance and
enhances the capabilities of cyber-physical systems, it also exposes
vulnerabilities which can be exploited maliciously. The objective of the
adversary is to gather data in order to launch an attack to disrupt operation,
while avoiding detection by the system operator.

Although there are many vulnerable points in cyber-physical systems, the
vulnerability of sensors has been widely studied thus far. In this setup, a
subset of the sensor measurements can be read and manipulated by an adversary
and various attack strategies have been investigated to avoid detection in
works by [3, 4, 5] to name a few, and to then still provide good estimates of
the system states in works by [6, 7, 8, 9] and more. Underlying the attack
strategies mentioned earlier is the adversary’s knowledge of the controller’s
state, which motivated a line of work investigating the confidentiality of
control systems [10, 11, 12, 13]. In all these works, control systems with
only linear dynamics is considered.

In this paper, we analyse the controller confidentiality of nonlinear systems.
Precisely, we provide rigorous analysis on whether the states of the
controller can be estimated when the adversary can read and manipulate the
sensors. We consider plant and controllers models with a general nonlinear
structure, which already has some inherent stability properties, as all well
designed control systems possess. The adversary knows the plant and controller
models and has access to the sensors, but not the actuators. We show that if
the closed-loop system is detectable (assumed in [10]), then the adversary
only needs to read the sensors and not manipulate them to reconstruct the
controller’s state exactly. In the absence of closed-loop detectability, the
adversary needs to manipulate the sensors, which we call the act of probing,
such that the controller’s states can be estimated within a bounded margin of
error. As the adversary now needs to probe the closed-loop system, this could
raise alarms as anomaly detection schemes are typically employed in well
designed control systems. In this scenario, we show that stealth can be
maintained when the adversary employs a dual-mode probing scheme.

First, we assume that the closed-loop system is semiglobal asymptotically
stable and has a robust observability property. With these assumptions, the
estimation of the controller’s state (with bounded error) and stealth
(semiglobal practical stability of the closed-loop system) can be achieved. To
do so, the adversary probes the closed-loop system via the sensors
periodically for a short period. During which, a fast estimator can
reconstruct the controller’s state with desired precision. After which, the
probing signal is turned off for a specified time interval to preserve the
semiglobal practical stability of the closed loop system (maintain stealth),
while still keeping the estimated controller’s state within a neighborhood of
the true controller’s state. During the non-probing interval, the estimator is
turned off and the estimate of the controller’s state is held until the end of
the non-probing interval. This scheme is reminiscent of the time-sharing
strategies in [14] and [15] for sampled-data output feedback for nonlinear
systems and Wiener systems, respectively. This paper focuses only on
confidentiality breaching strategies. Hence, future work will involve
developing defense strategies which involve the introduction of uncertainties
known to the system operator, but not known to the adversary, for example.

Our paper is organised as follows. Preliminaries are introduced in Section II
and the problem is motivated and formulated in Section III. A non-invasive
breach of controller confidentiality is analysed in Section IV. Next, an
invasive strategy is proposed in Section V where a dual-mode time shared
probing strategy is proposed. The invasive strategy is shown to achieve the
aim of stealthy estimation in Section VI. We conclude the paper with Section
VII and proofs are provided in the Appendix.

##  II Preliminaries

Let $\mathbb{R}=(-\infty,\infty)$, $\mathbb{R}_{\geq 0}=[0,\infty)$,
$\mathbb{R}_{>0}=(0,\infty)$. Let $\mathbb{N}_{\geq i}=\\{i,i+1,i+2,\dots\\}$.
A finite set of integers $\\{i,i+1,i+2,\dots,i+k\\}$ is denoted as
$\mathbb{N}_{[i,i+k]}$. The identity matrix of dimension $n$ is denoted by
$\mathbb{I}_{n}$. A diagonal matrix with matrices $d_{i}$,
$i\in\mathbb{N}_{[1,n]}$ is denoted by
$\textrm{diag}(d_{1},d_{2},\dots,d_{n})$. Given a symmetric matrix $P$, its
maximum (minimum) eigenvalue is denoted by $\lambda_{\max}(P)$
$(\lambda_{\min}(P))$. The infinity norm of a vector $x\in\mathbb{R}^{n}$, is
denoted $|x|:=\underset{i\in\mathbb{N}_{[1,n]}}{\max}\left|x_{i}\right|$ and
for a matrix $A\in\mathbb{R}^{n\times n}$,
$|A|:=\underset{i\in\mathbb{N}_{[1,n]}}{\max}\underset{j\in\mathbb{N}_{[1,n]}}{\sum}|a_{ij}|$,
where $a_{ij}$ is the row $i$-th and column $j$-th element of matrix $A$.

A continuous function $\alpha:\mathbb{R}_{\geq 0}\to\mathbb{R}_{\geq 0}$ is a
class $\mathcal{K}$ function, if it is strictly increasing and $\alpha(0)=0$;
additionally, if $\alpha(r)\to\infty$ as $r\to\infty$, then $\alpha$ is a
class $\mathcal{K}_{\infty}$ function. A continuous function
$\beta:\mathbb{R}_{\geq 0}\times\mathbb{R}_{\geq 0}\to\mathbb{R}_{\geq 0}$ is
a class $\mathcal{KL}$ function, if: (i) $\beta(.,s)$ is a class $\mathcal{K}$
function for each $s\geq 0$; (ii) $\beta(r,.)$ is non-increasing and (iii)
$\beta(r,s)\to 0$ as $s\to\infty$ for each $r\geq 0$.

##  III Motivation and problem formulation

###  III-A Plant and controller models

We consider nonlinear systems of the form

$\displaystyle\Sigma_{p}:\qquad\dot{x}_{p}$ $\displaystyle=f_{p}(x_{p},u),$
(1) $\displaystyle y$ $\displaystyle=h(x_{p})+a,$ (2)

where $x_{p}\in\mathbb{R}^{n_{p}}$ is the system’s state,
$u\in\mathbb{R}^{n_{u}}$ is the input, $y\in\mathbb{R}^{n_{y}}$ is the output
and $a:\mathbb{R}_{\geq 0}\to\mathbb{R}^{n_{y}}$ is an attack signal,
respectively. The functions $f_{p}$ is locally Lipschitz and $h$ is
sufficiently smooth.

We consider controllers with a general nonlinear structure taking the
following form

$\displaystyle\Sigma_{c}:\qquad\dot{x}_{c}$
$\displaystyle=f_{c}(x_{c},y),\qquad u=\kappa(x_{c},y),$ (3)

where $x_{c}\in\mathbb{R}^{n_{c}}$ is the controller’s state, the locally
Lipschitz function $\kappa:\mathbb{R}^{n_{c}}\to\mathbb{R}^{n_{u}}$ is the
control law and the function
$f_{c}:\mathbb{R}^{n_{c}}\times\mathbb{R}^{n_{y}}\to\mathbb{R}^{n_{c}}$ is
locally Lipschitz such that for all initial conditions
$x(0)\in\mathbb{R}^{n_{p}}$ and $x_{c}(0)\in\mathbb{R}^{n_{c}}$, the
trajectories of (1), (2) and (3) exist for all time $t\geq 0$.

The controller model in (3) captures both state and output feedback schemes.
In the case where state feedback is employed to stabilise the plant (1), the
plant output (2) is $h(x_{p})=x_{p}$ (in the absence of sensor attacks) and
the controller model in (3) becomes $f_{c}(x_{c},y)=0$, $x_{c}(0)=0$ and
$\kappa(x_{c},y)=\kappa(0,h(x_{p}))$. When an output feedback stabilisation
scheme is used, then the controller model (3) takes the role of a state
observer of the plant (1) with $\kappa(x_{c},y)$ being the control law.

In this paper, we focus on control schemes (3) which render the closed-loop
system composed of (1), (2) and (3) semiglobally asymptotically stable in the
absence of sensor attacks ($a(t)=0$, for all $t\geq 0$) as stated in the
assumption below.

######  Assumption 1 (Closed-loop system is SG-AS)

Let $x:=(x_{p},x_{c})$. The closed loop system from (1), (2) and (3) with the
following dynamics for all $t\geq 0$,

$\displaystyle\dot{x}$
$\displaystyle=\left(\begin{array}[]{c}f_{p}(x_{p},\kappa(x_{c},h(x_{p})))\\\
f_{c}(x_{c},h(x_{p}))\end{array}\right)=:f(x,y),$ (6)

with $a(t)=0$, is asymptotically stable, i.e., there exist a class
$\mathcal{KL}$ function $\beta_{z}$ such that

$|x(t)|\leq\beta_{x}(|x(0)|,t),\;\forall t\geq 0.$ (7)

When (7) holds for $|x(0)|\leq\Delta_{x}$, where $\Delta_{x}>0$, we say that
the closed-loop system (6) is semiglobal asymptotically stable (SG-AS). $\Box$

Control schemes (3) for nonlinear systems which involve output feedback
results in a closed-loop system that is SG-AS for certain classes of systems,
see [16, 17, 18, 19, 20], for example. For linear plant and controllers, this
problem is well studied and Assumption 1 holds thanks to the well-known
separation principle which yields a controller (3) that results in a closed
loop system that is globally exponentially stable.

###  III-B Adversary model and objectives

We assume that the adversary has knowledge of the plant and controller models,
but not their initial conditions $x(0)$ and $x_{c}(0)$. The adversary can
manipulate the sensors $y$, but does not have access to the actuators $u$.
Precisely, the adversary operates under the following conditions.

######  Assumption 2 (Adversary model)

  1. 1.

The adversary can manipulate the sensor readings $h(x_{p})$ via an attack
signal $a$, modelled by (2).

  2. 2.

The adversary knows the functions $f_{p}$, $h$, $f_{c}$ and $\kappa$ from (1),
(2), (3).

  3. 3.

The adversary does not know the control input $u$, nor the initial state of
the plant and controller models $x(0)$.

$\Box$

The objectives of the adversary are to obtain an estimate of the controller’s
states $x_{c}$ under the operating conditions stated in Assumption 2 without
letting the state of the closed loop system $x(t)$ become unbounded in finite
time, in the sense that $\underset{t\to T}{\lim}|x(t)|=\infty$, for
$T<\infty$. We state these two objectives precisely below.

######  Objective 1 (Estimation of the controller’s state $x_{c}$)

The estimate of the controller’s state (3) denoted by $\hat{x}_{c}$ converges
to a neighbourhood of the controller’s state $x_{c}$. $\Box$

######  Objective 2 (Maintaining stealth)

The closed loop system (6) is semiglobal practically stable, i.e. for any
$K_{x}\geq\Delta_{x}>0$ , the solution to the closed loop system (6) satisfies

$|x(0)|\leq\Delta_{x}\implies|x(t)|\leq K_{x},\;\forall t\geq 0.$ (8)

$\Box$

When both of the aforementioned objectives are achieved, we say that the
adversary has achieved stealthy estimation of the controller’s state. In other
words, the confidentiality of the control system has been breached. Figure 1
illustrates the problem setup

Figure 1: Problem setup

In the sections that follow, we describe how an adversary can achieve these
goals. The stealthy estimation of the controller’s state $x_{c}$ can be
realised without manipulating the sensor measurements when the closed-loop
system (6) is detectable in Section IV and by using the sensor measurements
$y$ to probe the closed-loop system in a time-shared manner in Section V.

##  IV Closed-loop system (6) is detectable

We first consider the case where the closed-loop system (6) is detectable,
which is defined as follows.

######  Definition 1 (Detectability)

The closed-loop system (6) is detectable if there exists a function
$l:\mathbb{R}^{n_{y}}\to\mathbb{R}^{n_{x}+n_{c}}$ with $l(0)=0$, such that the
estimate $\hat{x}:=(\hat{x}_{p},\hat{x}_{c})$ is the solution to the following
system with dynamics given by

$\displaystyle\dot{\hat{x}}$
$\displaystyle=f(\hat{x},y)+l(y-\hat{y}),\qquad\hat{y}=h(\hat{x}_{p}),$ (9)

and the closed-loop system (6) satisfy

$\displaystyle|\hat{x}(t)-x(t)|\leq\beta_{\hat{x}}(|\hat{x}(0)-x(0)|,t)+\gamma_{x}\left(\underset{s\in[0,t]}{\sup}|a(s)|\right),$
(10)

for all $t\geq 0$, for all initial conditions $\hat{x}(0)$,
$x(0)\in\mathbb{R}^{n_{x}+n_{c}}$, $\beta_{x}\in\mathcal{KL}$ and
$\gamma_{x}\in\mathcal{K}$. $\Box$

The function $l(\hat{y}-y)$ is known as an output injection term and the
system (9) whose solution $\hat{x}$ provides the estimate of $x$ is known in
the literature as a nonlinear observer. According to Definition 1, observers
(9) with property (10) are known as input-to-state (ISS) observers with
respect to the attack signal $a$. The design of observers (9) for detectable
systems (6) according to Definition 1 is done for specific classes of systems,
which exploits the inherent structure of the system, see [21] for an overview.
The following linear time-invariant system

$\dot{x}=Ax+By,\qquad y=\left[\begin{array}[]{cc}C&0\end{array}\right]x,$ (11)

with matrices $A$, $B$ and $C$ of the appropriate dimensions, which are
$\left(A,\left[\begin{array}[]{cc}C&0\end{array}\right]\right)$ detectable in
the sense of Definition 1 coincide with the detectability notion for linear
systems [22, Section 16.3]. In which case, the observer (9) for linear system
(11) takes the form

$\dot{\hat{x}}=A\hat{x}+L(y-\hat{y}),\qquad\hat{y}=\left[\begin{array}[]{cc}C&0\end{array}\right]\hat{x},$
(12)

and the detectability of the pair
$\left(A,\left[\begin{array}[]{cc}C&0\end{array}\right]\right)$ implies the
existence of a linear function $l(y-\hat{y})=L(y-\hat{y})$ where $L$ is a
matrix (also known as the observer gain matrix), such that property (10)
holds. The observer (12) is also known as the Luenberger observer.

Hence, if the closed-loop system (6) is detectable, the adversary can estimate
the controller’s state $x_{c}$ (Objective 1) by only monitoring the sensor
measurements $y$ without manipulating them (i.e., $a(t)=0$ for all $t\geq 0$)
and thereby remaining stealthy (Objective 2) under Assumption 1. We summarise
this in Proposition 1 below.

###### Proposition 1

Consider the closed-loop system (6) and adversary model under Assumptions 1
and 2, respectively. If the closed-loop system (6) is detectable, then the
adversary achieves Objectives 1 and 2 using (9) with $a(t)=0$, for all $t\geq
0$, in the sense that

$\displaystyle|\hat{x}(t)-x(t)|$
$\displaystyle\leq\beta_{\hat{x}}(|\hat{x}(0)-x(0)|,t),$ (13)
$\displaystyle|x(t)|$
$\displaystyle\leq\beta_{x}(|\hat{x}(0)-x(0)|,t),\;\forall t\geq 0,$ (14)

for all initial conditions $\hat{x}(0)$, $x(0)\in\mathbb{R}^{n_{x}+n_{c}}$
satisfying $|\hat{x}(0)|\leq\Delta_{x}$ and $|x(0)|\leq\Delta_{x}$, and
$\beta_{\hat{x}}\in\mathcal{KL}$ and $\beta_{x}\in\mathcal{KL}$ comes from
Definition 1 and Assumption 1, respectively. $\Box$

As seen in (13), the adversary performs better than the stated objectives by
achieving asymptotic convergence of the estimates $\hat{x}_{c}$ to the
controller’s state $x_{c}$ and the closed-loop system (6) preserves the
inherent SG-AS property from Assumption 1.

This setup was studied in discrete-time for an LTI closed-loop system in [10]
in the presence of Gaussian process and measurement noise where a time-varying
Kalman filter is proposed as the optimal controller’s state estimator. Here,
we do not consider the presence of noise, but leveraging noise to preserve the
confidentiality of the controller will be an important future endeavour of
this work.

The crucial assumption in [10] is the detectability of the closed-loop system.
To the best of our knowledge, no results exist in the literature for when the
closed-loop system (6) is not detectable according to Definition 1. Hence, the
novelty of this work is in showing that controller confidentiality can be
breached in the absence of closed-loop detectability. The rest of the paper is
dedicated to this unexplored aspect.

##  V Closed-loop system (6) is NOT detectable

When the closed-loop system (6) is NOT detectable, the stealthy estimation of
the controller’s state $x_{c}$ can be achieved through manipulating the sensor
measurement $y$ by way of the attack signal $a$, modelled by (2). The
compromised sensor $y$ is used to probe the closed-loop system (6)
periodically within the time interval $[kT,(k+1)T]$, $k\in\mathbb{N}_{\geq
0}$, for a short period of time $t^{*}>0$ such that the controller’s state
$x_{c}$ can be estimated within some desired margin of error during the
probing interval of $[kT,kT+t^{*}]$ and with bounded error for the remainder
of the interval. The probing however, may lead to detection by the operator,
and hence is only held sufficiently long, such that the closed-loop system (6)
remains practically stable, i.e., stealth is maintained according to (8).

To this end, we require a modification of an observability notion first
introduced in [14] where we need to apply an open-loop probing signal $y^{*}$
for the closed-loop system (6) within a finite time interval such that its
states can be estimated. Adopting the same terminology as in [14], such an
observability notion is defined as follows:

######  Definition 2 (Robust observabilty)

System (6), (2) is semiglobal $q$-robust observable (SG$q$-RO) for
$t\in[0,t^{*}]$, $t^{*}>0$, if, for each $\Delta_{x}\geq 0$, there exist an
integer $q\in\mathbb{N}_{\geq 1}$, a $\mathcal{C}^{q+1}$ function
$y^{*}:[0,t^{*}]\to\mathbb{R}^{n_{y}}$ and a function
$\Psi:\mathbb{R}^{2(q+1)n_{y}}\to\mathbb{R}^{n_{x}}$ such that for the probed
system

$\dot{x}=f(x,y^{*})=\left(\begin{array}[]{c}f_{p}(x_{p},\kappa(x_{c},y^{*}))\\\
f_{c}(x_{c},y^{*})\end{array}\right),\;y=h(x_{p}),$ (15)

with initial condition $|x(0)|\leq\Delta_{x}$, the following is satisfied for
$t\in[0,t^{*}]$,

  * •

the solution $x(t)$ to (15) exists,

  * •

the function $\Psi$ maps the measurement $h(x_{p})$ and the probing signal
$y^{*}$ as well as their derivatives to the solution $x(t)$ as follows

$x(t)=\Psi(Y(t),Y^{*}(t)),$

where $Y:=(h(x_{p}),L_{f_{p}}{h}(x_{p}),\dots,L_{f_{p}}h^{(q)}(x_{p}))$ and
$Y^{*}:=(y^{*},\dot{y}^{*},\dots,{y^{*}}^{(q)})$, where
$L_{f_{p}}h^{(q)}(x_{p})$ denotes the $q$-th time derivative of $h(x_{p})$,

  * •

there exists $\rho_{\Psi}\in\mathcal{K}_{\infty}$ such that

$\left|\Psi(\widehat{Y},Y^{*})-\Psi(Y,Y^{*})\right|\leq\rho_{\Psi}\left(\left|\widehat{Y}-Y\right|\right).$

$\Box$

For examples of systems which are SG$q$-RO and on how to construct the probing
signal $y^{*}$, the reader is referred to the origin of this observability
notion in [14]. A consequence of the SG$q$-RO property of system (6), (2) is
that the sensor measurement $h(x_{p})$ needs to be sufficiently smooth. For
the proposed adversarial scheme to work, we further require the following.

###### Assumption 3

Suppose that the closed-loop system (6) is SG$q$-RO. For a given $t^{*}>0$,
there exist compact sets $\mathcal{H}_{q}$ and $\mathcal{H}_{q+1}$ such that
for all $t\in[0,t^{*}]$,

$\displaystyle\left(L_{f_{p}}{h}(x_{p}(t)),\dots,L_{f_{p}}h^{(q)}(x_{p}(t)))\right)$
$\displaystyle\in\mathcal{H}_{q},\textrm{ and }$ $\displaystyle
L_{f_{p}}h^{(q+1)}(x_{p}(t)))$ $\displaystyle\in\mathcal{H}_{q+1}.$ (16)

$\Box$

The proposed adversarial strategy which ensures that the adversary’s estimate
of the controller state $\hat{x}_{c}$ converges to a neighborhood of the
controller’s state $x_{c}$ and the closed-loop system (6) is semiglobal
practical stable (maintaining stealth), takes the following form under the
assumption that the closed-loop system (6) is SG$q$-RO.

First, a probing duration $t^{*}>0$ is chosen and then a suitable total
duration $T>t^{*}$ is selected. Then each time interval $[kT,(k+1)T]$, for
$k\in\mathbb{N}_{\geq 0}$, is subdivided into a probing interval
$\mathcal{T}_{k}:=[kT,kT+t^{*})$ and non-probing interval
${\overline{\mathcal{T}}}_{k}:=[kT+t^{*},(k+1)T)$. During the probing interval
$\mathcal{T}_{k}$, the adversary probes the system for a short duration
$t^{*}>0$ by compromising the sensor measurements $y$ via the attack signal
$a$. After which, the adversary stops probing to maintain stealth during
$\overline{\mathcal{T}}_{k}$ such that,

$y(t)=\left\\{\begin{array}[]{ll}y^{*}(t-kT),&t\in\mathcal{T}_{k},\\\
h(x_{p}(t)),&t\in\overline{\mathcal{T}}_{k},\end{array}\right.$ (17)

and the resulting closed-loop system is

$\dot{x}(t)=\left\\{\begin{array}[]{ll}f(x(t),y^{*}(t-kT)),&t\in\mathcal{T}_{k},\\\
f(x(t),h(x_{p}(t))),&t\in\overline{\mathcal{T}}_{k}.\end{array}\right.$ (18)

By the probing procedure of (17), the controller’s state estimate
$\hat{x}_{c}$ is obtained via

$\displaystyle\dot{\widehat{Y}}(t)$
$\displaystyle=\left\\{\begin{array}[]{ll}\widehat{A}\widehat{Y}(t)+\theta\Delta_{\theta}\widehat{H}\left(h(x_{p}(t))-\widehat{C}\widehat{Y}(t)\right),&t\in\mathcal{T}_{k},\\\
0,&t\in\overline{\mathcal{T}}_{k},\end{array}\right.$ (21)

where $\widehat{Y}\in\mathbb{R}^{(q+1)n_{y}}$,
$\widehat{C}=\left[\begin{array}[]{cc}\mathbb{I}_{n_{y}}&0_{n_{y}\times(q+1)n_{y}}\end{array}\right]$,
$\widehat{H}=\left[\begin{array}[]{cccc}a_{1}\mathbb{I}_{n_{y}}&a_{2}\mathbb{I}_{n_{y}}&\dots&a_{q+1}\mathbb{I}_{n_{y}}\end{array}\right]^{T}$
with $a_{i}$ chosen such that the polynomial
$s^{q+1}+a_{1}s^{q}+a_{2}s^{q-1}+\dots+a_{q+1}$ is Hurwitz,
$\Delta_{\theta}=\textrm{diag}\left(\mathbb{I}_{n_{y}},\theta\mathbb{I}_{n_{y}},\theta^{2}\mathbb{I}_{n_{y}},\dots,\theta^{q}\mathbb{I}_{n_{y}}\right)$
with a constant tuning parameter $\theta\geq 1$, and
$\widehat{A}=\left[\begin{array}[]{cc}0_{qn_{y}\times
n_{y}}&\mathbb{I}_{qn_{y}}\\\ 0_{n_{y}\times n_{y}}&0_{n_{y}\times
qn_{y}}\end{array}\right].$

The initialisation of (21) is chosen to be

$\widehat{Y}(kT)\in\mathcal{Y}(h(x_{p}(kT))),$ (22)

where
$\mathcal{Y}(r):=\left\\{\widehat{Y}\in\mathbb{R}^{(q+1)n_{y}}:\left|\widehat{Y}-r\right|\leq\epsilon_{y},\epsilon_{y}>0\right\\}$.

The adversary can then obtain an estimate of the controller’s state as follows

$\displaystyle\hat{x}(t)=\left(\begin{array}[]{c}\hat{x}_{p}(t)\\\
\hat{x}_{c}(t)\end{array}\right)=\Psi\left(\widehat{Y}(t),Y^{*}(t-kT)\right),t\in\mathcal{T}_{k}\cup\bar{\mathcal{T}}_{k},$
(25)

where $q$, and $\Psi$ come from the assumption that the closed-loop system is
SG$q$-RO as defined in Definition 2. The probing duration $t^{*}>0$ is
dictated by the robustness of the closed-loop system (6) such that it is
semiglobally practically stable (Objecive 2: maintaining stealth).

##  VI Main result

The proposed probing scheme was inspired by the dual mode sampled-data output
feedback control strategy in [14]. Consequently, elements of the proof of
Theorem 1 follow that of [14] and [23] with some modifications as our
resulting closed-loop system (6), (2) does not have a sample-and-hold input.
The adversary’s estimate of the controller’s state does employ a sample-and-
hold observer (21), (22), (25), but is not employed in the closed-loop system
(6).

In the sequel, we will pave the way towards our main result (Theorem 1) in
Section VI-C by addressing the fulfillment of Objective 1 and 2 in Sections
VI-A and VI-B, respectively.

###  VI-A Objective 1: controller’s state estimation

###### Proposition 2

Given $t^{*}>0$, consider the closed-loop system (18), (17) that is SG$q$-RO
and satisfies Assumption 1 and 3, the adversary model under Assumption 2, the
estimator (21), (22) and the controller’s state estimate (25). For all
$K_{\tilde{x}}>0$, there exist $\theta\geq 1$ and
$\sigma_{\tilde{x}}\in\mathcal{K}_{\infty}$ such that for all
$k\in\mathbb{N}_{\geq 0}$,

$\displaystyle|\hat{x}(kT+t^{*})-x(kT+t^{*})|\leq K_{\tilde{x}},$
$\displaystyle|\hat{x}(t)-x(t)|\leq\sigma_{\tilde{x}}(\Delta_{e,k}\theta^{q-1}),$
$\displaystyle\forall t\in\mathcal{T}_{k},$ (26)

where
$\Delta_{e,k}:={\max}\\{|Y_{a}-Y_{b}|,\,Y_{a},Y_{b}\in\mathcal{Y}(h(x_{p}(kT))\\}$.
Further, suppose $|x(kT+t^{*})|\leq{\Delta_{x}}$. Then, there exists
$\overline{\sigma}_{\tilde{x}}\in\mathcal{K}_{\infty}$ such that

$\displaystyle|\hat{x}(t)-x(t)|$ $\displaystyle\leq
K_{\tilde{x}}+\Delta_{x}+\overline{\sigma}_{\tilde{x}}(\Delta_{x}),$
$\displaystyle\forall t\in\overline{\mathcal{T}}_{k},$ (27)

and for all $\epsilon_{\tilde{x}}>0$, there exists $T>0$ such that

$\displaystyle|\hat{x}((k+1)T)-x((k+1)T)|$ $\displaystyle\leq
K_{\tilde{x}}+\Delta_{x}+\epsilon_{\tilde{x}}.$ (28)

$\Box$

The proof of Proposition 2 employs the following two lemmas, each addressing
the conditions needed and the convergence guarantees obtained for the probing
interval $\mathcal{T}_{k}$ and the non-probing interval
$\overline{\mathcal{T}}_{k}$ within each time interval $[kT,(k+1)T]$, for
$k\in\mathbb{N}_{\geq 0}$. For clarity, the lemmas will be written for the
case where $k=0$, and the results carry over straightforwardly to
$k\in\mathbb{N}_{\geq 1}$ which we state in a remark that follows each lemma.
The proofs of the lemmas can be found in the Appendix.

######  Lemma 1 (the probing interval $\mathcal{T}_{0}$)

Under the same hypothesis as Proposition 2 for $t\in\mathcal{T}_{0}$, for all
$K_{\tilde{x}}>0$, there exist $\theta\geq 1$ and
$\sigma_{\tilde{x}}\in\mathcal{K}_{\infty}$ such that

$\displaystyle|\hat{x}(t^{*})-x(t^{*})|$ $\displaystyle\leq K_{\tilde{x}},$
$\displaystyle|\hat{x}(t)-x(t)|$
$\displaystyle\leq\sigma_{\tilde{x}}(\Delta_{e,0}\theta^{q-1}),\qquad\forall
t\in\mathcal{T}_{0},$ (29)

where
$\Delta_{e,0}:=\max\left\\{\left|\widehat{Y}_{a}-\widehat{Y}_{b}\right|:\widehat{Y}_{a},\widehat{Y}_{b}\in\mathcal{Y}(h(x_{p}(0)))\right\\}$.
$\Box$

###### Remark 1

Given $T>0$, Lemma 1 also holds true for subsequent probing intervals
$\mathcal{T}_{k}$, $k\in\mathbb{N}_{\geq 0}$, where (1) becomes

$\displaystyle|\hat{x}(kT+t^{*})-x(kT+t^{*})|$ $\displaystyle\leq
K_{\tilde{x}},$ $\displaystyle|\hat{x}(t)-x(t)|$
$\displaystyle\leq\sigma_{\tilde{x}}(\Delta_{e}\theta^{q-1}),\;\forall
t\in\mathcal{T}_{k},$ (30)

where
$\Delta_{e,k}:={\max}\left\\{\left|\widehat{Y}_{a}-\widehat{Y}_{b}\right|:\widehat{Y}_{a},\widehat{Y}_{b}\in\mathcal{Y}(h(x_{p}(kT)))\right\\}$.
$\Box$

######  Lemma 2 (the non-probing interval $\overline{\mathcal{T}}_{0}$)

Under the same hypothesis as Proposition 2 for
$t\in\overline{\mathcal{T}}_{0}$, suppose $|x(t^{*})|\leq{\Delta_{x}}$. Then,
there exists $\bar{\sigma}_{\tilde{x}}\in\mathcal{K}_{\infty}$ such that

$\left|\hat{x}(t)-x(t)\right|\leq
K_{\tilde{x}}+\Delta_{x}+\overline{\sigma}_{\tilde{x}}(\Delta_{x}),\qquad\forall
t\in\overline{\mathcal{T}}_{0},$ (31)

and for all $\epsilon_{\tilde{x}}>0$, there exists $T>0$ such that

$\left|\hat{x}(T)-x(T)\right|\leq
K_{\tilde{x}}+\Delta_{x}+\epsilon_{\tilde{x}}.$ (32)

$\Box$

###### Remark 2

For subsequent non-probing intervals $\overline{T}_{k}$, where
$k\in\mathbb{N}_{\geq 0}$, the estimation error bounds in (31) and (32) become

$\left|\hat{x}(t)-x(t)\right|\leq
K_{\tilde{x}}+\Delta_{x}+\overline{\sigma}_{\tilde{x}}(\Delta_{x}),\qquad\forall
t\in\overline{\mathcal{T}}_{k},$ (33) $\left|\hat{x}(kT)-x(kT)\right|\leq
K_{\tilde{x}}+\Delta_{x}+\epsilon_{\tilde{x}}.$ (34)

$\Box$

The periodic interval $T>0$ is chosen a-priori based on the desirable margin
of estimation error which can be made small up to $K_{\tilde{x}}+\Delta_{x}$,
which is the sum of the error margin at the end of the probing period and the
size of the initial condition of the non-probed closed loop system (6), (2).

###  VI-B Objective 2: maintaining stealth

The analysis that allows the adversary to maintain stealth hinges on the fact
that the uncompromised closed-loop system (6) is inherently semiglobal
asymptotically stable (Assumption 1), which by application of a converse
Lyapunov theorem (see [24, Theorem 4.14], for instance), there exists a
$C^{1}$ closed-loop control Lyapunov function
$V:\mathbb{R}^{n_{p}+n_{c}}\to\mathbb{R}_{\geq 0}$ such that there exist
$\alpha_{1}$, $\alpha_{2}$ $\alpha_{3}\in\mathcal{K}_{\infty}$ where

  1. (C1)

$\alpha_{1}\left(|x|\right)\leq V(x)\leq\alpha_{2}\left(|x|\right)$,

  2. (C2)

$\langle\nabla V(x),f(x,h(x_{p}))\rangle\leq-\alpha_{3}(V(x))$, for
$x\in\mathcal{V}(R)$, with $R:=\alpha_{1}(\Delta_{x})$,

where we define $\mathcal{V}(r,R):=\\{x\in\mathbb{R}^{n_{p}+n_{c}}:r\leq
V(x)\leq R\\}$ and denote $\mathcal{V}(-\infty,R)$ by $\mathcal{V}(R)$.

By straightforward application of [24, Lemma 4.4] and the comparison lemma
[24, Lemma 3.4], a consequence of (C2) is stated below,

  1. (C2’)

there exists $\beta_{V}\in\mathcal{KL}$ such that
$V(x(t))\leq\beta_{V}(V(x(0)),t)$, for all $t\geq 0$, for
$x\in\mathcal{V}(R)$, with $R:=\alpha_{2}(\Delta_{x})$.

We will use this closed-loop control Lyapunov function $V$ to show that the
probed closed-loop system (18) is semiglobally practically stable. To do so,
the given control Lyapunov function $V$ and the vector field $f$ of the probed
closed-loop system (18) have to possess the following properties.

###### Assumption 4

  1. (V1)

There exists $\rho\in\mathcal{K}_{\infty}$ such that
$|V(x)-V(w)|\leq\rho(|x-w|)$ for all $x$, $w\in\mathcal{V}(R,R+R_{m})$, for
some $R_{m}>0$.

  2. (V2)

There exists a constant $F^{*}>0$ such that $|f(x,y^{*})|\leq F^{*}$, for all
$x\in\mathcal{V}(R+R_{m})$.

  3. (V3)

There exists a constant $F>0$ such that $|f(x,h(x_{p}))|\leq F$, for all
$x\in\mathcal{V}(R+R_{m})$.

We employ a key lemma in showing an $\mathcal{L}_{1}$-type robustness with
respect to additive disturbance for the first interval $[0,T]$. The results
carry over to subsequent intervals $[kT,(k+1)T]$ which will be stated in a
remark below. The proof of the lemma below is inspired by [23] and can be
found in the Appendix.

###### Lemma 3

Consider the closed-loop system (6) under Assumption 1 and (V1) of Assumption
4. Given $T>0$ and $0<r<R$, consider

$\dot{x}(t)=f(x(t),h(x_{p}(t)))+d(t),\;\forall t\in[0,T],$ (35)

and for all $x(0)\in\mathcal{V}(R)$. Let $\sigma\in[0,R-r)$. If $d(t)$
satisfies

$\underset{t\in[0,T)}{\max}\left|\int_{0}^{T}d(s)ds\right|\leq\rho^{-1}(\sigma)e^{-\bar{L}T},$
(36)

where $\bar{L}:=l_{x}+l_{y}l_{h}>0$, where $l_{x}>0$ and $l_{y}>0$ are the
Lipschitz constants of the function $f$ with respect to each of its
arguments333Since the functions $f_{p}$, $f_{c}$ and $\kappa$ are all locally
Lipschitz in their arguments, the function $f$ is also locally Lipschitz in
its arguments , respectively, and $l_{h}>0$ is the Lipschitz constant of the
function $h$. Then the solution $x(t)$ to (35) exists and satisfies

$V(x(t))\leq\beta_{V}(V(x(0),t)+\sigma,\;\forall t\in[0,T],$ (37)

and for all $x(0)\in\mathcal{V}(R)$. $\Box$

###### Remark 3

The result of Lemma 3 is applicable to subsequent time intervals
$[kT,(k+1)T]$, where (38) is replaced with

$V(x(t))\leq\beta_{V}(V(x(kT),t-kT)+\sigma,$ (38)

for all $t\in[kT,(k+1)T]$ and $x(kT)\in\mathcal{V}(R)$. $\Box$

Rewriting our probed closed-loop system (18) in perturbed form, we get the
perturbed system (35) for
$t\in\mathcal{T}_{k}\cup\bar{\mathcal{T}}_{k}=[kT,(k+1)T]$, with

$d(t)=\left\\{\begin{array}[]{cc}f(x(t),y^{*}(t))-f(x(t),h(x_{p}(t))),&t\in\mathcal{T}_{k},\\\
0,&t\in\bar{\mathcal{T}}_{k}.\end{array}\right.$ (39)

To apply Lemma 3, we observe that

$\displaystyle\underset{t\in[kT,(k+1)T)}{\max}$
$\displaystyle\left|\int_{kT}^{(k+1)T}d(s)ds\right|$
$\displaystyle\leq\left|\int_{kT}^{kT+t^{*}}f(x(s),y^{*}(s))-f(x(s),h(x_{p}(s))ds\right|$
$\displaystyle\leq\int_{kT}^{kT+t^{*}}|f(x,y^{*})|+|f(x,h(x_{p}))|ds$
$\displaystyle\leq(F^{*}+F)t^{*},$ (40)

where we got the last inequality using (V2) and (V3).

Therefore, with (41) in Proposition 3 below, the hypothesis of Lemma 3 is
fulfilled. We can then apply Lemma 3 to prove the following proposition.

###### Proposition 3

Consider the probed closed-loop system (18) under Assumption 1, 2, 4. Given
$T>0$, suppose there exist $t^{*}<T$ and $r\in(0,R)$ satisfying

$r\leq\beta_{V}(R,t^{*}),\qquad(F+F^{*})t^{*}\leq\rho^{-1}(\sigma)e^{-\bar{L}T},$
(41)

with $\sigma\in[0,R-r)$ and $\bar{L}>0$ is as defined in Lemma 3. Then, the
solution $x(t)$ to the probed closed-loop system (18) exists and satisfies the
following for all $t\in[kT,(k+1)T)$, $k\in\mathbb{N}_{\geq 0}$,

$\displaystyle V(x(t))\leq\beta_{V}(V(x(kT)),t-kT)+\sigma,$ $\displaystyle
V(x(kT+t^{*}))\leq R,\qquad\forall x(kT)\in\mathcal{V}(R).$ (42)

$\Box$

###  VI-C Achieving Objective 1 and 2: stealthy estimation

We are now ready to state our main result.

###### Theorem 1

Suppose the closed-loop system (6) and (2) is SG$q$-RO (Defnition 2) and
satisfies Assumptions 1, 3, and the adversarial model satisfies Assumption 2.
Then, the adversary can employ the probing scheme of (17), (18), (25), (21)
initialised according to (22) to achieve stealthy estimation, if

  1. (i)

Assumption 4 holds, and

  2. (ii)

For any $\Delta_{x}>0$, $K_{\tilde{x}}>0$ and $\epsilon_{\tilde{x}}>0$, there
exist $t^{*}>0$, $T>t^{*}$ and $r\in(0,R)$ satisfying (41) and (61) with
$R:=\alpha_{1}(\Delta_{x})$, $\sigma\in[0,R-r)$, $\beta_{V}\in\mathcal{KL}$
from (C2’), $\rho\in\mathcal{K}_{\infty}$, $F>0$, $F^{*}>0$ from Assumption 4.

Stealthy estimation is achieved in the sense that the objectives are fulfilled
in the following manner:

  * •

_Objective 1 (estimation of the controller’s state)_ : there exist $\theta\geq
1$ (chosen according to (56) and (58)), $\sigma_{\tilde{x}}$,
$\overline{\sigma}_{\tilde{x}}\in\mathcal{K}_{\infty}$ such that for all
$t\in[kT,(k+1)T)$, $k\in\mathbb{N}_{\geq 0}$,

$\displaystyle|\hat{x}(t)-x(t)|$
$\displaystyle\qquad\leq\max\\{\sigma_{\tilde{x}}(\Delta_{e,k}\theta^{q-1}),K_{\tilde{x}}+\Delta_{x}+\bar{\sigma}_{\tilde{x}}(\Delta_{x})\\},$
$\displaystyle|\hat{x}(kT+t^{*})-x(kT+t^{*})|\leq K_{\tilde{x}},$
$\displaystyle|\hat{x}(kT)-x(kT)|\leq
K_{\tilde{x}}+\Delta_{x}+\epsilon_{\tilde{x}},$ (43)

with
$\Delta_{e,k}:={\max}\left\\{\left|\widehat{Y}_{a}-\widehat{Y}_{b}\right|:\widehat{Y}_{a},\widehat{Y}_{b}\in\mathcal{Y}(h(x_{p}(kT)))\right\\}$.

  * •

Objective 2 (maintaining stealth): there exists $K_{x}=K_{x}(\Delta_{x})>0$
such that for all $t\in[kT,(k+1)T)$, $k\in\mathbb{N}_{\geq 0}$,

$|x(t)|\leq K_{x}.$ (44)

$\Box$

###### Proof:

Let $k\in\mathbb{N}_{\geq 0}$ and $t\in[kT,(k+1)T)$. We will employ
Proposition 2 and 3. Since (41) and (61) hold, we first apply Proposition 3 to
obtain (3). From the first inequality of (3) and using (C1), we obtain

$\displaystyle\alpha_{1}(|x(t)|)\leq\beta_{V}(R,0)+R-r$
$\displaystyle\implies|x(t)|\leq\alpha_{1}^{-1}(\beta_{V}(R,0)+R).$ (45)

Since $R:=\alpha_{1}(\Delta_{x})$, we achieve (44) with
$K_{x}:=\alpha_{1}^{-1}(\beta_{V}(\alpha_{1}(\Delta_{x}),0)+\alpha_{1}(\Delta_{x}))$.

Next, we see that condition requiring $|x(kT+t^{*})|\leq\Delta_{x}$ in
Proposition 2 is fulfilled with the second inequality of (3) using (C1). By
applying Proposition 2, we obtain (• ‣ 1) as desired. ∎

##  VII Conclusion and future work

We have shown that the confidentiality of the controller’s states can easily
be breached stealthily when the closed-loop system is detectable. In this
scenario, the adversary merely needs to gather measurement data from the
sensors. In the absence of a detectable closed-loop system, but under a
relaxed robust observability property, the adversary may employ a time-shared
probing scheme by manipulating the sensor data to estimate the controller’s
state within a desired margin of error during the probing period and with
bounded error during the non-probing period. Additionally, stealth is
maintained in the sense that the closed-loop system remain semiglobally
practically stable. Future work includes devising defence mechanisms to
obfuscate the adversary’s estimate of the controller’s state.

###  -A Proof of Lemma 1

Let $t\in\mathcal{T}_{0}$. A key observation is that systems which are
SG$q$-RO have the following dynamics in the $Y$-coordinate.

$\dot{Y}=\widehat{A}Y+\widehat{B}L_{f_{p}}h^{(q+1)}(x_{p}(t))),$ (46)

where $\widehat{A}$ is as defined for the estimator (21) and
$\widehat{B}=(0_{qn_{y}\times n_{y}}^{T},\mathbb{I}_{n_{y}}^{T})^{T}$. In
fact, this observation induces the estimator design in (21). From (46) and
(21) The dynamics of the estimator mismatch $e:=\hat{Y}-Y$ is

$\dot{e}=(\widehat{A}+\theta\Delta_{\theta}\widehat{H}\widehat{C})e-\widehat{B}L_{f_{p}}h^{(q+1)}(x_{p}(t))).$
(47)

We rescale the estimator mistmatch as $z=\Delta_{\theta}^{-1}e$, which has the
dynamics

$\displaystyle\dot{z}$ $\displaystyle=$
$\displaystyle(\Delta_{\theta}^{-1}\widehat{A}\Delta_{\theta}-\theta\widehat{H}\widehat{C}\Delta_{\theta})z-\Delta_{\theta}^{-1}L_{f_{p}}h^{(q+1)}(x_{p}(t)))$
(48) $\displaystyle=$
$\displaystyle\theta\left(\widehat{A}-\widehat{H}\widehat{C}\right)z-\Delta_{\theta}^{-1}L_{f_{p}}h^{(q+1)}(x_{p}(t))),$

where due to the structure of the $\widehat{A}$, $\widehat{C}$ and
$\Delta_{\theta}$, we have used
$\Delta_{\theta}^{-1}\widehat{A}\Delta_{\theta}=\theta\widehat{A}$ and
$\widehat{C}\Delta_{\theta}=\widehat{C}$ to obtain the resulting dynamics of
the scaled estimation mismatch system $z$.

Since the matrix $\widehat{A}-\widehat{H}\widehat{C}$ is Hurwitz, there exist
a matrix $P=P^{T}>0$ and scalar $\nu>0$ satisfying

$P\left(\widehat{A}-\widehat{H}\widehat{C}\right)+\left(\widehat{A}-\widehat{H}\widehat{C}\right)^{T}P\leq-\nu\mathbb{I}_{(q+1)n_{y}}.$
(49)

Using a candidate Lyapunov function $W(z):=z^{T}Pz$ with $P$ satisfying (49),
its time derivative along the solutions to (48) is

$\displaystyle\dot{W}(z)=$ $\displaystyle\theta
z^{T}\left(P\left(\widehat{A}-\widehat{H}\widehat{C}\right)+\left(\widehat{A}-\widehat{H}\widehat{C}\right)^{T}P\right)z$
$\displaystyle+2z^{T}P\Delta_{\theta}^{-1}L_{f_{p}}h^{(q+1)}(x_{p}(t))).$ (50)

We note that the last term satisfies
$z^{T}P\Delta_{\theta}^{-1}L_{f_{p}}h^{(q+1)}(x_{p}))\leq|z||P\Delta_{\theta}^{-1}L_{f_{p}}h^{(q+1)}(x_{p}))|$.
Under Assumption 3, we obtain $|L_{f_{p}}h^{(q+1)}(x_{p}))|\leq\bar{\phi}$,
where $\bar{\phi}>0$. Hence,
$|P\Delta_{\theta}^{-1}L_{f_{p}}h^{(q+1)}(x_{p}))|\leq\frac{\bar{\lambda}\bar{\phi}}{\theta^{q}}$,
where $\bar{\lambda}:=\lambda_{\max}(P)$ Therefore, in conjuction with (49),
the time derivative of $W(z)$ is

$\displaystyle\dot{W}(z)\leq$
$\displaystyle-\theta\nu|z|^{2}+\frac{2\bar{\lambda}\bar{\phi}}{\theta^{q}}|z|.$
(51)

Hence, if
$\frac{2\bar{\lambda}\bar{\phi}}{\theta^{q}}\leq\frac{\theta\nu}{2}|z|$, then

$\displaystyle\dot{W}(z)\leq$
$\displaystyle-\frac{\theta\nu}{2}|z|^{2}\leq-\frac{\theta\nu}{2\underline{\lambda}}W(z),$
(52)

where we have used the following fact to obtain the ultimate bound:

$\underline{\lambda}|z|^{2}\leq W(z)\leq\bar{\lambda}|z|^{2},$ (53)

where $\underline{\lambda}:=\lambda_{\min}(P)$.

By the comparison principle, we obtain from (52) that

$W(z(t))\leq\exp\left(-\frac{\theta\nu}{2\underline{\lambda}}t\right)W(z(0)).$
(54)

Applying (53), we conclude that

$|z(t)|\leq c\exp\left(-\frac{\theta\nu}{4\underline{\lambda}}t\right)|z(0)|,$
(55)

when $|z|\geq\frac{4\bar{\lambda}\bar{\phi}}{\nu\theta^{q+1}}$, where
$c:=\sqrt{\bar{\lambda}/\underline{\lambda}}$.

From (55), we will choose the estimator parameter $\theta\geq 1$ such that

  1. (E1)

when
$z(0)\not\in\left\\{z:|z|\leq\frac{4\bar{\lambda}\bar{\phi}}{\nu\theta^{q+1}}\right\\}=:\Omega$,
$z(t)$ converges to $\Omega$ within finite time and then remains there.

  2. (E2)

when $z(0)\in\Omega$, $z(t)$ remains in
$\tilde{\Omega}:=\left\\{z\in\mathbb{R}^{(q+1)n_{y}}:|z|\leq\rho_{\Psi}^{-1}\left(K_{\tilde{x}}\right)\right\\}$,
where $\rho_{\Psi}\in\mathcal{K}_{\infty}$ comes from the SG$q$-RO property
and $K_{\tilde{x}}>0$ is given.

We first address (E1). In this case, we choose $\theta$ as follows to ensure
that $z(t)$ converges to $\Omega$ by $t=t^{*}$, where $t^{*}>0$ is assumed to
be given. In this case, we choose $\theta\geq 1$ that satisfies

$\exp\left(-\frac{\theta\nu}{4\underline{\lambda}}t^{*}\right){\Delta_{e,0}}\leq\frac{4\bar{\lambda}\bar{\phi}}{\theta^{q-1}\nu}.$
(56)

where $\Delta_{e,0}>0$ as defined in Lemma 1 exists since $\widehat{Y}(0)$ is
initialised according to (22). Notice that by choosing $\theta\geq 1$ to
satisfy (56), we see from (55) that although $z(0)\not\in\Omega$,
$|z(0)|\leq\Delta_{e,0}/\theta$. Therefore,

$|z(t^{*})|\leq
c\exp\left(-\frac{\theta\nu}{4\underline{\lambda}}t^{*}\right)\Delta_{e,0}\leq
c\frac{4\bar{\lambda}\bar{\phi}}{\theta^{q}\nu}.$ (57)

Next, we address (E2). In this case, we choose $\theta\geq 1$ to satisfy

$\frac{c4\bar{\lambda}\bar{\phi}}{\theta\nu}\leq\rho_{\Psi}^{-1}\left(K_{\tilde{x}}\right).$
(58)

With this choice, we see that when $z(0)\in\Omega$, from (55),

$|z(t)|\leq
c|z(0)|\leq\frac{c4\bar{\lambda}\bar{\phi}}{\nu\theta^{q+1}}\leq\frac{\rho_{\Psi}^{-1}\left(K_{\tilde{x}}\right)}{\theta^{q}},$
(59)

where we obtain the last bound due to our choice of $\theta\geq 1$ according
to (58).

Therefore, by choosing $\theta\geq 1$ according to (56) and (58), we ensure
that
$|z(t^{*})|\leq\frac{\rho_{\Psi}^{-1}\left(K_{\tilde{x}}\right)}{\theta^{q}}$
and $|z(t)|\leq c|z(0)|\leq c\Delta_{e,0}/\theta$.

Next, since $e=\Delta_{\theta}z$, we get $|e|\leq\theta^{q}|z|$ and obtain

$|e(t^{*})|\leq\rho_{\psi}^{-1}\left(K_{\tilde{x}}\right),\;|e(t)|\leq
c\Delta_{e,0}\theta^{q-1}.$ (60)

Finally, by the SG$q$-RO property of (6), (2), the state estimation error
satisfies $|\hat{x}(t)-x(t)|\leq\rho_{\Psi}(|e(t)|)$ for
$t\in\mathcal{T}_{0}$. Hence, we obtain (1) as desired with
$\sigma_{\tilde{x}}(r):=cr$. $\Box$

###  -B Proof of Lemma 2

Given $\Delta_{x}$, $\epsilon_{\tilde{x}}$, $t^{*}>0$, choose $T>0$ such that

$\beta_{x}(\Delta_{x},T-t^{*})\leq\epsilon_{\tilde{x}},$ (61)

where $\beta_{x}\in\mathcal{KL}$ comes from Assumption 1, that the closed loop
system (6) with (2) semiglobally asymptotically stable for $t\geq t^{*}$.

Let $t\in\overline{\mathcal{T}}_{0}$. The closed-loop system and state
estimate are

$\displaystyle\dot{x}$ $\displaystyle=f(x,h(x_{p})),\;y=h(x_{p}),$ (62)
$\hat{x}(t)=\Psi\left(\widehat{Y}(t^{*}),Y^{*}(t^{*})\right).$ (63)

The state estimation error satisfies

$\displaystyle|\hat{x}(t)-x(t)|$
$\displaystyle\leq|\hat{x}(t)-x(t^{*})+x(t^{*})-x(t)|$
$\displaystyle\leq|\hat{x}(t)-x(t^{*})|+|x(t^{*})-x(t)|.$ (64)

A bound on the first term is obtained by the SG$q$-RO property of the closed-
loop system (62) at $t=t^{*}$, when the probing signal $y^{*}(t^{*})$ and
observability map $\Psi$ exist. Hence, by Lemma 2,

$|\hat{x}(t)-x(t^{*})|\leq K_{\tilde{x}}.$ (65)

The second term of (-B) is bounded as follows

$|x(t^{*})-x(t)|\leq|x(t^{*})|+|x(t)|\leq\Delta_{x}+\beta_{x}(\Delta_{x},t-t^{*}),$
(66)

where we have used the assumption that $|x(t^{*})|\leq\Delta_{x}$ and
$\beta_{x}\in\mathcal{KL}$ comes from Assumption 1 to obtain the final bound.

Therefore, using (65) and (66) in (-B), we obtain

$|\hat{x}(t)-x(t)|\leq
K_{\tilde{x}}+\Delta_{x}+\beta_{x}(\Delta_{x},t-t^{*}).$ (67)

We then obtain (31) with $\overline{\sigma}_{\tilde{x}}(r):=\beta_{x}(r,0)$
and (32) with (61), respectively. $\Box$

###  -C Proof of Lemma 3

Let $t\in[0,T]$ and consider a nominal system

$\dot{w}=f(w,h(w_{p})),\;w(0)\in\mathcal{V}(R),$ (68)

and the perturbed system (35) with $w(0)=x(0)$. The solutions to (68) and (35)
are

$\displaystyle x(t)$
$\displaystyle=x(0)+\int_{0}^{t}f(x(s),h(x_{p}(s)))ds+\int_{0}^{t}d(s)ds$
$\displaystyle w(t)$ $\displaystyle=w(0)+\int_{0}^{t}f(w(s),h(w_{p}(s)))ds.$
(69)

Therefore,

$\displaystyle|x(t)$ $\displaystyle-w(t)|$
$\displaystyle\leq\int_{0}^{t}|f(x(s),h(x_{p}(s)))-f(w(s),h(w_{p}(s)))|ds$
$\displaystyle\qquad+\left|\int_{0}^{t}d(s)ds\right|,$ (70)

and by the Lipshitz property of $f$ (see footnote 3) and $h$, we have $l_{x}$,
$l_{y}>0$ such that

$\displaystyle|f(x,h(x_{p}))$ $\displaystyle-f(w,h(w_{p}))|$
$\displaystyle\leq l_{x}|x-w|+l_{y}|h(x_{p})-h(w_{p})|$ $\displaystyle\leq
l_{x}|x-w|+l_{y}l_{h}|x_{p}-w_{p}|$ $\displaystyle\leq\bar{L}|x-w|,$ (71)

where we obtain the last inequality due to $|x_{p}-w_{p}|\leq|x-w|$ and
$\bar{L}$ is as defined in Proposition 3.

Let $\bar{d}:=\underset{t\in[0,T)}{\max}\left|\int_{0}^{T}d(s)ds\right|$.
Then,

$|x(t)-w(t)|\leq\int_{0}^{t}\bar{L}|x(s)-w(s)|ds+\bar{d}.$ (72)

By Gronwall-Bellman’s lemma [24, Pg. 651], we get

$\displaystyle|x(t)-w(t)|$
$\displaystyle\leq\bar{d}e^{\bar{L}t}\leq\bar{d}e^{\bar{L}T},$ (73)

where we get the last inequality because we consider the time interval
$[0,T]$. Since (36) holds, we obtain

$|x(t)-w(t)|\leq\rho^{-1}(\sigma).$ (74)

We then obtain (38) using (C2’), (V1), (74) and $x(0)=w(0)$ using the argument
below

$\displaystyle V(x(t))$ $\displaystyle=V(w(t))+V(x(t))-V(w(t))$
$\displaystyle\leq\beta_{V}(V(w(0)),t)+\rho(|v(t)-w(t)|)$
$\displaystyle\leq\beta_{V}(V(x(0)),t)+\sigma.$ (75)

$\Box$

## References

  * [1] H. Sandberg, S. Amin, and K. H. Johansson, “Cyberphysical security in networked control systems: An introduction to the issue,” IEEE Control Systems Magazine, vol. 35, pp. 20–23, Feb 2015.
  * [2] M. S. Chong, H. Sandberg, and A. M. H. Teixeira, “A tutorial introduction to security and privacy for cyber-physical systems,” in 2019 18th European Control Conference (ECC), pp. 968–978, June 2019.
  * [3] A. A. Cárdenas, S. Amin, Z.-S. Lin, Y.-L. Huang, C.-Y. Huang, and S. Sastry, “Attacks against process control systems: risk assessment, detection, and response,” in Proceedings of the 6th ACM symposium on information, computer and communications security, pp. 355–366, 2011.
  * [4] C. Murguia and J. Ruths, “On model-based detectors for linear time-invariant stochastic systems under sensor attacks,” IET Control Theory & Applications, vol. 13, no. 8, pp. 1051–1061, 2019.
  * [5] Z. Guo, D. Shi, K. H. Johansson, and L. Shi, “Worst-case stealthy innovation-based linear attack on remote state estimation,” Automatica, vol. 89, pp. 117–124, 2018.
  * [6] L. An and G.-H. Yang, “Secure state estimation against sparse sensor attacks with adaptive switching mechanism,” IEEE Transactions on Automatic Control, vol. 63, no. 8, pp. 2596–2603, 2017.
  * [7] Y. Shoukry, M. Chong, M. Wakaiki, P. Nuzzo, A. Sangiovanni-Vincentelli, S. Seshia, J. Hespanha, and P. Tabuada, “SMT-based observer design for cyber-physical systems under sensor attacks,” ACM Transactions on Cyber-Physical Systems, vol. 2, no. 1, p. 5, 2018.
  * [8] J. Kim, C. Lee, H. Shim, Y. Eun, and J. H. Seo, “Detection of sensor attack and resilient state estimation for uniformly observable nonlinear systems having redundant sensors,” IEEE Transactions on Automatic Control, vol. 64, no. 3, pp. 1162–1169, 2018.
  * [9] M. S. Chong, H. Sandberg, and J. P. Hespanha, “A secure state estimation algorithm for nonlinear systems under sensor attacks,” in 2020 59th IEEE Conference on Decision and Control (CDC), pp. 5743–5748, 2020.
  * [10] D. Umsonst and H. Sandberg, “On the confidentiality of controller states under sensor attacks,” Automatica, vol. 123, p. 109329, 2021.
  * [11] S. M. Dibaji, M. Pirani, A. M. Annaswamy, K. H. Johansson, and A. Chakrabortty, “Secure control of wide-area power systems: Confidentiality and integrity threats,” in 2018 IEEE Conference on Decision and Control (CDC), pp. 7269–7274, IEEE, 2018.
  * [12] M. Xue, W. Wang, and S. Roy, “Security concepts for the dynamics of autonomous vehicle networks,” Automatica, vol. 50, no. 3, pp. 852–857, 2014.
  * [13] Y. Yuan and Y. Mo, “Security in cyber-physical systems: Controller design against known-plaintext attack,” in 2015 54th IEEE Conference on Decision and Control (CDC), pp. 5814–5819, IEEE, 2015.
  * [14] H. Shim and A. R. Teel, “Asymptotic controllability and observability imply semiglobal practical asymptotic stabilizability by sampled-data output feedback,” Automatica, vol. 39, no. 3, pp. 441–454, 2003.
  * [15] D. Nesic, “Output feedback stabilization of a class of wiener systems,” IEEE Transactions on Automatic Control, vol. 45, no. 9, pp. 1727–1731, 2000\.
  * [16] H. Khalil and F. Esfandiari, “Semiglobal stabilization of a class of nonlinear systems using output feedback,” IEEE Transactions on Automatic Control, vol. 38, no. 9, pp. 1412–1415, 1993.
  * [17] A. Teel and L. Praly, “Global stabilizability and observability imply semi-global stabilizability by output feedback,” Systems & Control Letters, vol. 22, no. 5, pp. 313–325, 1994.
  * [18] A. N. Atassi and H. K. Khalil, “A separation principle for the stabilization of a class of nonlinear systems,” IEEE Transactions on Automatic Control, vol. 44, no. 9, pp. 1672–1687, 1999.
  * [19] B. Yang and W. Lin, “Semi-global stabilization of nonlinear systems by nonsmooth output feedback,” International Journal of Robust and Nonlinear Control, vol. 24, no. 16, pp. 2522–2545, 2014.
  * [20] W. Lin, “When is a nonlinear system semiglobally asymptotically stabilizable by digital feedback?,” IEEE Transactions on Automatic Control, vol. 65, no. 11, pp. 4584–4599, 2019.
  * [21] G. Besançon, Nonlinear observers and applications, vol. 363.  Springer, 2007.
  * [22] J. P. Hespanha, Linear systems theory.  Princeton university press, 2018.
  * [23] C. M. Kellett, H. Shim, and A. R. Teel, “Further results on robustness of (possibly discontinuous) sample and hold feedback,” IEEE Transactions on Automatic Control, vol. 49, no. 7, pp. 1081–1089, 2004.
  * [24] H. K. Khalil, Nonlinear Systems.  Prentice Hall, third ed., 2002.