# Vulnerability Analysis of Nonlinear Control Systems to Stealthy False Data
Injection Attacks

Amir Khazraei, and Miroslav Pajic This work is sponsored in part by the ONR
agreements N00014-17-1-2504 and N00014-20-1-2745, AFOSR award
FA9550-19-1-0169, and the NSF CNS-1652544 award, as well as the National AI
Institute for Edge Computing Leveraging Next Generation Wireless Networks,
Grant CNS-2112562. Some of preliminary results in this paper appeared in
[khazraei2022resiliencycdc].The authors are with the Department of Electrical
and Computer Engineering, Duke University, Durham, NC 27708 USA (e-mail:
<EMAIL_ADDRESS>, miroslav.pajic@duke.edu).

###### Abstract

In this work, we focus on analyzing vulnerability of nonlinear dynamical
control systems to stealthy false-data injection attacks on sensors. We start
by defining the _stealthiness_ notion in the most general form where an attack
is considered stealthy if it would be undetected by _any_ intrusion detector –
i.e., any intrusion detector could not do better than a random guess.
Depending on the level of attacker’s knowledge about the plant model,
controller, and the system states, two different attack models are considered.
For each attack model, we derive the conditions for which the system will be
vulnerable to stealthy impactful attacks, in addition to finding a methodology
for designing such sequence of false-data injection attacks. When the attacker
has complete knowledge about the system, we show that if the closed-loop
system is incrementally exponentially stable while the open-loop plant is
incrementally unstable, then the system is vulnerable to stealthy yet
impactful attacks on sensors. However, in the second attack model, with less
knowledge about the system, additional conditions need to be satisfied and the
level of stealthiness depends on the accuracy of attacker’s knowledge about
the system. We also consider the impact of stealthy attacks on state
estimation, and show that if the closed-loop control system including the
estimator is incrementally stable, then the state estimation in the presence
of attack converges to the attack-free estimates. Finally, we illustrate our
results on numerical case-studies.

##  I Introduction

Control systems have been shown to be vulnerable to a wide range of cyber and
physical attacks with severe consequences. (e.g., [1]). As part of the control
design and analysis, it is thus critical to identify early any vulnerability
of the considered system to impactful attacks, especially the ones that are
potentially stealthy to the deployed intrusion detection mechanisms.

Depending on the resources available to the attacker, different types of
stealthy impactful attacks have been proposed. For instance, for LTI systems
with strictly proper transfer functions, by compromising the control input,
the attacker can design effective stealthy attacks if the system has unstable
zero invariant; e.g., [2] where such attack is referred to as the zero
dynamics attack. However, when the transfer function is not strictly proper,
the attacker needs to compromise both plant’s inputs and outputs. When the
attacker compromises both the plant’s actuation and sensing, e.g., [3] derives
the conditions under which the system is vulnerable to stealthy attacks. Other
types of attacks that targets both input and output also exist for LTI systems
including replay attack [4, 5] and covert attack [6]. Specifically, the
authors in [5] show that replay attacks can bypass $\chi^{2}$ intrusion
detector (ID) for some class of LQG controllers in LTI systems and remain
stealthy.

On the other hand, sensor attacks, commonly referred to as false-data
injection attacks, have drawn a great deal of attention. For example,
vulnerability to false data injection attacks, of static state estimation in
systems such as power grids was considered in [7]; by adding values that lie
in the range of the observation matrix, such attack can bypass $\chi^{2}$
detectors and lead to incorrect state estimation. However, for dynamical
systems, merely inserting constant values in the range of the observation
matrix would not be stealthy and effective; for stealthiness, a false-data
injection attack needs to evolve with some dynamics to remain stealthy [8, 9,
10, 11, 12, 13].

Specifically, for linear time-invariant (LTI) systems with Gaussian noise, if
measurements from all sensors can be compromised, the plant’s (i.e., open-
loop) instability is a sufficient condition for an attacker being able to
significantly impact the system while remaining undetected (i.e., stealthy) by
a particular type of residual-based ($\chi^{2}$) IDs [8, 9, 10, 13]. These
works also show that to construct such attack sequences, the attacker needs to
have complete knowledge about the system, including the dynamical model of the
plant as well as the controller and Kalman filter gains. Yet, for LTI systems
with bounded noise, the plant’s instability is a necessary and sufficient
condition for the existence of impactful, stealthy attacks when all senors are
compromised [11, 12].

All these results [2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14] only address LTI
systems. Moreover, the notion of stealthiness is only characterized for a
_specific type_ of the employed ID (e.g., $\chi^{2}$-based detectors or RSE
detectors). The notion of attack stealthiness independent of the employed ID
(i.e., remaining stealthy for _all_ existing/potential IDs) for LTI systems is
studied in [15, 16, 14, 17, 18, 19]. One of the main differences of this work
is that our notion of stealthiness, initially introduced in [20], is stronger
than the one from [15, 16, 14, 17, 18, 19] where stealthiness depends on time;
i.e., stealthiness from [15, 16, 14, 17, 18, 19] requires that only for a
bounded time the attack is guaranteed to stay undetected by any ID. However,
the notion of stealthiness in our work is independent of time and the attack
is guaranteed to be stealthy for all time steps after initiating the attack.
Moreover, the performance degradation metric used in [15] is the error
covariance of a Kalman filter estimator as opposed in our work; we assume the
attacker’s goal is to cause deviation in the trajectories of the states.

To the best of our knowledge, no existing work provides _vulnerability
analysis for systems with nonlinear dynamics, while considering general
control and ID designs_ , as well as provide generative models for such
stealthy and impactful attacks. In [6], covert attacks are introduced as
stealthy attacks that can target a potentially nonlinear system. However, the
attacker needs to have perfect knowledge of the system’s dynamics and be able
to compromise _both_ the plant’s input and outputs. Even more importantly, as
the attack design is based on attacks on LTI systems, no guarantees are
provided for effectiveness and stealthiness of attacks on nonlinear systems.
In [21], attack design for nonlinear systems with an arbitrary but fixed ID
(the type of ID is known to the attacker) is framed as an optimization problem
in a discrete Markov decision system; however, no analysis is provided to
determine which classes of systems are vulnerable to stealthy impactful
attacks. Moreover, the design is based on discretizing the continuous state
space where the complexity of the problem increases for higher dimensions. On
the other hand, we show that if the condition on the existence of impactful
stealthy attacks holds, our generated attack sequence can bypass any ID and
the attacker does not need to know what type of ID is deployed.

More recently, [22] introduced stealthy attacks on a _specific class_ of
nonlinear systems with residual-based IDs, but provided effective attacks only
when _both_ plant’s inputs and outputs are compromised by the attacker. On the
other hand, in this work, we assume the attacker can only compromise the
plant’s sensing data and consider systems with _general_ nonlinear dynamics.
For systems with general nonlinear dynamics and residual-based IDs, machine
learning-based methods to design the stealthy attacks have been introduced
(e.g., [23]), but without any theoretical analysis and guarantees regarding
the impact of the stealthy attacks.

###  I-A Paper Contribution and Organization

To the best of our knowledge, this is the first work that considers existence
and design of _impactful_ sensor attacks on systems with general nonlinear
dynamics such that the attacks are also _stealthy_ for _any_ deployed ID. The
main contributions of this paper are summarized as follows.

First, we introduce two different attack models depending on the level of
system knowledge the attacker has. For each attack model, we provide
conditions that a nonlinear system is vulnerable to effective yet stealthy
attacks without limiting the analysis to any particular type of employed IDs.
Specifically, for the first attack model with a higher level of the system
knowledge, we show that if the closed-loop control system is incrementally
exponentially stable while the open-loop control system is incrementally
unstable, then the system is vulnerable to impactful attacks that can remain
stealthy from any ID. For the second attack model that requires less knowledge
about the system, additional conditions are imposed on the attacker; we show
that if the closed-loop system is incrementally input to state stable and the
open-loop system is incrementally input to state unstable, then the system is
vulnerable to impactful attacks and the level of stealthiness depends on the
accuracy of attacker’s knowledge about the system. We also show that for LTI
systems, if a certain subset of sensors are under attack, the closed-loop
system is asymptotically stable, and the open-loop system is unstable, then
the system is vulnerable to stealthy attacks independent of the deployed ID;
this is a generalization of results from [8, 9, 10, 13] showing that such
condition is sufficient for the stealthiness under only one class of IDs
($\chi^{2}$).

Second, for each attack model, we provide a general method to a sequence of
stealthy and impactful attack vectors. We show that as the dynamical model of
the system becomes ‘simpler’ (e.g., moving from highly nonlinear to LTI), the
attacker needs lower levels of system knowledge to generate the attack
sequence. In an extreme case, for LTI systems, we show that the attacker only
needs to have access to the the state transition and the observation matrices,
unlike [8, 9, 10, 13] that assume the attacker has access to the full plant
model information as well as the controller and Kalman filter gain.

Finally, we consider the impact of the proposed stealthy attacks on the
nonlinear state estimators. We show that if the closed-loop control system,
which includes the dynamics of the plant and the estimator, is incrementally
exponentially stable, then the state estimation in the presence of attack
converges exponentially to the attack free estimates.

The paper is organized as follows. In Section II, we introduce preliminaries,
whereas Section III presents the system and attack model, before formalizing
the notion of stealthiness in Section IV. Section V provides sufficient
conditions for existence of the impactful yet stealthy attacks. Section VI
provides the impact of such attacks on state estimation. Finally, in Section
VII, we illustrate our results on two case-studies, before concluding remarks
in Section VIII.

#### Notation

We use $\mathbb{R,Z},\mathbb{Z}_{\geq 0}$ to denote the sets of reals,
integers and non-negative integers, respectively, and $\mathbb{P}$ denotes the
probability for a random variable. For a square matrix $A$, $\lambda_{max}(A)$
denotes the maximum eigenvalue and if $A$ is symmetric, then $A\succ 0$
denoted the matrix is positive definite. For a vector $x\in{\mathbb{R}^{n}}$,
$||x||_{p}$ denotes the $p$-norm of $x$; when $p$ is not specified, the 2-norm
is implied. For a vector sequence, $x_{0}:x_{t}$ denotes the set
$\\{x_{0},x_{1},...,x_{t}\\}$. A function $f:\mathbb{R}^{n}\to\mathbb{R}^{p}$
is Lipschitz with constant $L$ if for any $x,y\in\mathbb{R}^{n}$ it holds that
$||f(x)-f(y)||\leq L||x-y||$. Finally, if $\mathbf{P}$ and $\mathbf{Q}$ are
probability distributions relative to Lebesgue measure with densities
$\mathbf{p}$ and $\mathbf{q}$, respectively, then the Kullback–Leibler (KL)
divergence between $\mathbf{P}$ and $\mathbf{Q}$ is defined as
$KL(\mathbf{P},\mathbf{Q})=\int\mathbf{p}(x)\log{\frac{\mathbf{p}(x)}{\mathbf{q}(x)}}dx$.

##  II Preliminaries

Let $\mathbb{X}\subseteq\mathbb{R}^{n}$ and
$\mathbb{D}\subseteq\mathbb{R}^{m}$. Consider a discrete-time nonlinear system
with an exogenous input, modeled as

$x_{t+1}=f(x_{t},d_{t}),\quad x_{t}\in\mathbb{X},\,\,t\in\mathbb{Z}_{\geq 0},$
(1)

where $f:\mathbb{X}\times\mathbb{D}\to\mathbb{X}$ is continuous. We denote by
$x(t,\xi,d)$ the trajectory (i.e., the solution) of (1) at time $t$, when the
system has the initial condition $\xi$ and is subject to the input sequence
$d=\\{d_{0}:d_{t-1}\\}$.

The following definitions are derived from [24, 25, 26].

###### Definition 1

The system (1) is incrementally exponentially stable (IES) in the set
$\mathbb{X}\subseteq\mathbb{R}^{n}$ if exist $\kappa>1$ and $\lambda<1$ that

$\|x(t,\xi_{1},d)-x(t,\xi_{2},d)\|\leq\kappa\|\xi_{1}-\xi_{2}\|\lambda^{t},$
(2)

holds for all $\xi_{1},\xi_{2}\in\mathbb{X}$, any $d_{t}\in\mathbb{D}$, and
$t\in\mathbb{Z}_{\geq 0}$. When $\mathbb{X}=\mathbb{R}^{n}$, the system is
referred to as globally incrementally exponentially stable (GIES).

###### Definition 2

The system (1) is incrementally input to state stable (IISS) in the set
$\mathbb{X}\subseteq\mathbb{R}^{n}$ if there exists a function
$\gamma\in\mathcal{K}_{\infty}$, $\kappa>1$, and $\lambda<1$ such that for any
$t\in\mathbb{Z}_{\geq 0}$

$\|x(t,\xi_{1},d^{1})-x(t,\xi_{2},d^{2})\|\leq\kappa\|\xi_{1}-\xi_{2}\|\lambda^{t}+\gamma(\|d^{1}-d^{2}\|_{\infty}),$
(3)

holds for all $\xi_{1},\xi_{2}\in\mathbb{X}$, any
$d_{t}^{1},d_{t}^{2}\in\mathbb{D}$, and $t\in\mathbb{Z}_{\geq 0}$, where
$\|d^{1}-d^{2}\|_{\infty}=\sup_{t\geq 0}{\|d_{t}^{1}-d_{t}^{2}\|_{\infty}}$.
When $\mathbb{X}=\mathbb{R}^{n}$, the system is referred to as globally
incrementally input to state stable (GIISS).

By replacing $d^{1}=d^{2}$ in (3), one can verify that if the system is IISS,
then it is also IES.

###### Definition 3

The system (1) is incrementally unstable (IU) in the set
$\mathbb{X}\subseteq\mathbb{R}^{n}$ if for all $\xi_{1}\in\mathbb{X}$ and any
$d_{t}\in\mathbb{D}$, there exists an $\xi_{2}$ arbitrarily close to $\xi_{1}$
such that for any $M>0$,

$\|x(t,\xi_{1},d)-x(t,\xi_{2},d)\|\geq M,$ (4)

holds for all $t\geq t^{\prime}$, for some $t^{\prime}\in\mathbb{Z}_{\geq 0}$.

###### Definition 4

The system (1) is incrementally input to state unstable (IISU) in the set
$\mathbb{X}\subseteq\mathbb{R}^{n}$ if for all $\xi_{1}\in\mathbb{X}$ and any
$d_{t}^{1},d_{t}^{2}\in\mathbb{D}$ satisfying
$\|d_{t}^{1}-d_{t}^{2}\|\leq\delta$ for all $t\in\mathbb{Z}_{\geq 0}$, there
exists an $\xi_{2}$ such that for any $M>0$,

$\|x(t,\xi_{1},d^{1})-x(t,\xi_{2},d^{2})\|\geq M,$ (5)

holds for all $t\geq t^{\prime}$, for some $t^{\prime}\in\mathbb{Z}_{\geq 0}$.

Similarly, by replacing $d^{1}=d^{2}$ in (3), one can verify that if the
system is IISU, then it is also IU.

Now, we present some properties of Kullback–Leibler (KL) divergence known as
_monotonicity_ and _chain-rule_ [27].

###### Lemma 1

[27] (Monotonicity): Let $P_{X,Y}$ and $Q_{X,Y}$ be two distributions for a
pair of variables $X$ and $Y$, and $P_{X}$ and $Q_{X}$ be two distributions
for variable $X$. Then,

$KL(Q_{X}||P_{X})\leq KL(Q_{X,Y}||P_{X,Y})$ (6)

###### Lemma 2

[27] (Chain rule): Let $P_{X,Y}$ and $Q_{X,Y}$ be two distributions for a pair
of variables $X$ and $Y$. Then,

$KL(Q_{X,Y}||P_{X,Y})=KL(Q_{X}||P_{X})+KL(Q_{Y|X}||P_{Y|X}),$ (7)

where $KL(Q_{Y|X}||P_{Y|X})$ is defined as

$KL(Q_{Y|X}||P_{Y|X})=\mathbb{E}_{x\sim Q_{X}}\\{KL(Q_{Y|X=x}||P_{Y|X=x})\\}.$
(8)

###### Lemma 3

[27] Let $P_{X}$ and $Q_{X}$ be two Gaussian distributions with the same
covariance $\Sigma$ and different means of $\mu_{P}$ and $\mu_{Q}$,
respectively. Then, it holds that

$KL(Q_{X}||P_{X})=\mu_{Q}^{T}\Sigma^{-1}\mu_{P}.$ (9)

###### Lemma 4

Let $Q_{X}$ be a distribution for a random variable $X$ and we have $X\leq M$
for some $M>0$. Then,

$\mathbb{E}_{Q_{X}}\\{X\\}\leq M$ (10)

###### Proof:

The proof directly follows from the definition of expectation and some
properties of integral. ∎

##  III System and Attack Model

In this section, we introduce the considered system and attack model, allowing
us to formally capture the problem addressed in this work. We consider the
setup from Fig. 1 where each of the components is modeled as follows.

####  III-1 Plant

We assume that the states of the system evolve following a general nonlinear
discrete-time dynamics that can be captured in the state-space form as

$\begin{split}{x}_{t+1}&=f(x_{t},u_{t})+w_{t},\\\
y_{t}&=h(x_{t})+v_{t};\end{split}$ (11)

here, $x\in{\mathbb{R}^{n}}$, $u\in{\mathbb{R}^{m}}$, $y\in{\mathbb{R}^{p}}$
are the state, input and output vectors of the plant, respectively. We assume
that $h$ is Lipschitz with a constant $L_{h}$. The plant output vector
captures measurements from the set of plant sensors $\mathcal{S}$. Further,
$w\in{\mathbb{R}^{n}}$ and $v\in{\mathbb{R}^{p}}$ are the process and
measurement noises that assumed to be i.i.d Gaussians with zero mean, and
$\mathbf{R}_{w}\succ 0$ and $\mathbf{R}_{v}\succ 0$ covariance matrices,
respectively. We also assume the system starts operating at time $-T$ with
initial state $x_{-T}$.

As we show later, it will be useful to consider the input to state relation of
the dynamics (11); if we define
$U=\begin{bmatrix}u^{T}&w^{T}\end{bmatrix}^{T}$, the first equation in (11)
becomes

$x_{t+1}=f_{u}(x_{t},U_{t}).$ (12)

Figure 1: Control system architecture considered in this work, in the presence
of network-based attacks on sensing data.

####  III-2 Control Unit

The controller, illustrated in Fig. 1, is equipped with a feedback controller
in the most general form, as well as an intrusion detector (ID). In what
follows, we provide more details on the controller design. Intrusion detector
will be discussed after introducing the attack model.

##### Controller

Due to their robustness to uncertainties, closed-loop controllers are utilized
in most control systems. In the most general form, a feedback controller can
be captured in the state-space form as

$\begin{split}\mathpzc{X}_{t}&=f_{c}(\mathpzc{X}_{t-1},y_{t}^{c}),\\\
u_{t}&=h_{c}(\mathpzc{X}_{t},y_{t}^{c}),\end{split}$ (13)

where $\mathpzc{X}$ is the internal state of the controller, and $y^{c}$
captures the sensor measurements received by the controller. Thus, without
malicious activity, it holds that $y^{c}=y$.111We assume that the
communication network is reliable (e.g., wired). Note that the control model
(13) is general, capturing for instance nonlinear filtering followed by a
classic nonlinear controller (e.g., $f_{c}$ can model an extended Kalman
filter and $h_{c}$ any full-state feedback controller). Here, we assume that
the function $f_{c}$ is Lipschitz with a constant $L_{f_{c}}$. We also assume
$\mathpzc{X}_{-T}$ is obtained deterministically by the system operator.222The
result of the chapter holds even when such initial condition is chosen
randomly. We discuss more about this in the proof of Theorem 2.

The dynamics of the closed-loop system can be captured as

$\mathbf{X}_{t+1}=F(\mathbf{X}_{t},\mathbf{W}_{t}).$ (14)

with the full state of the closed-loop system
$\mathbf{X}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}\begin{bmatrix}{x}_{t}^{T}&{\mathpzc{X}}_{t}^{T}\end{bmatrix}^{T}$,
and exogenous disturbances
$\mathbf{W}_{t}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}\begin{bmatrix}w_{t}^{T}&{v}_{t+1}^{T}&{v}_{t}^{T}\end{bmatrix}^{T}$.
Therefore, the functions $f_{c}$ and $h_{c}$ are designed such that the
closed-loop system states satisfy some desired properties.

####  III-3 Attack Model

We consider a sensor attack model where, for sensors from a set
$\mathcal{K}\subseteq{\mathcal{S}}$, the information delivered to the
controller differs from the non-compromised sensor measurements. The attacker
can achieve this via e.g., noninvasive attacks such sensor spoofing (e.g.,
[28]) or by compromising information-flow from the sensors in $\mathcal{K}$ to
the controller (e.g., as in network-based attacks [29, 30]). In either cases,
the attacker can launch false-date injection attacks, inserting a desired
value instead of the current measurement of a compromised sensor.333We refer
to sensors from $\mathcal{K}$ as compromised, even if a sensor itself is not
directly compromised but its measurements may be altered due to e.g., network-
based attacks.

Thus, assuming that the attack starts at time $t=0$, the sensor measurements
delivered to the controller for $t\in\mathbb{Z}_{\geq 0}$ can be modeled as

$y^{c,a}_{t}=y_{t}^{a}+a_{t};$ (15)

here, $a_{t}\in{\mathbb{R}^{p}}$ denotes the attack signal injected by the
attacker at time $t$ via the compromised sensors from $\mathcal{K}$,
$y_{t}^{a}$ is the true sensing information (i.e., before the attack is
injected at time $t$) – we use the superscript a to differentiate all signals
of the attacked system. In the rest of the paper, we assume
$\mathcal{K}=\mathcal{S}$; for some systems, we will discuss how the results
can be generalized for the case when $\mathcal{K}\subset\mathcal{S}$. Now,
with different levels of runtime knowledge about the plant and its states we
consider two different attack models as follows.

Attack model i@: The attacker has perfect knowledge about the system states
and the control input, as well as the functions $f$ and $h$ in (11).

Attack model ii@: The attacker has only some imperfect knowledge about the
system states. The attacker imperfectly reconstructs the states by using
either the system’s sensor measurements or its own set of external sensors.
Moreover, the attacker has knowledge about the controller functions $f_{c}$
and $h_{c}$ in (13) and the functions $f$ and $h$ in (11) but does not have
access to control input $u_{t}$.

Consider the system with plant (11), controller (13) and an ID that we define
in the next subsection. We denote such system with _attack model i@_ and
_attack model ii@_ as $\Sigma_{\text{\@slowromancap i@}}$ and
$\Sigma_{\text{\@slowromancap ii@}}$, respectively. Note that since the
controller uses the received sensing information to compute the input $u_{t}$,
the compromised sensor values affect the evolution of the system and
controller states. Hence, we add the superscript $a$ to denote any signal
obtained from a compromised system – e.g., thus, $y_{t}^{a}$ is used to denote
before-attack sensor measurements when the system is under attack in (15), and
we denote the closed-loop plant and controller state when the system is
compromised as
$\mathbf{X}^{a}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}\begin{bmatrix}{x^{a}}\\\
{{\mathpzc{X}^{a}}}\end{bmatrix}$. Since the attack starts at time zero, it
takes one time step to affect the states and actual output; therefore, we have
$y_{0}^{a}=y_{0}$ and $x_{0}^{a}=x_{0}$.

As discussed in the attack models, in this work, we consider the commonly
adopted threat model as in majority of existing stealthy attack designs, e.g.,
[4, 8, 6, 11, 9], where the attacker has full knowledge of the system, its
dynamics and employed architecture. In addition, the attacker has the required
computational power to calculate suitable attack signals to be injected, while
planning ahead as needed.

Finally, the _attack goal_ is to design an attack signal $a_{t}$,
$t\in\mathbb{Z}_{\geq 0}$, such that it always remains _stealthy_ – i.e.,
undetected by an employed ID – while _maximizing control performance
degradation_. The notions of _stealthiness_ and _control performance
degradation_ depend on the employed control architecture, and thus will be
formally defined after both the controller and ID have been introduced.

####  III-4 Intrusion Detector (ID)

To detect system attacks (and anomalies), we assume that an ID is employed,
analyzing the received sensor measurements. Specifically, by defining
$Y\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}{y^{c}}$, as
well as
$Y^{a}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}{y^{c,a}}$
when the system is under attack, we assume that the ID has access to a
sequence of values $Y_{-T}:Y_{t}$ (all observations since the system starts
operating until time $t$)444It should be noted that $-T$ in this notation does
not have its mathematical meaning. Here, we used it to show the initial time
of the system. and solves the binary hypothesis checking

$H_{0}$: normal condition (the ID receives $Y_{-T}:Y_{t}$);

$H_{1}$: abnormal behaviour (the ID receives
$Y_{-T}^{-1},Y_{0}^{a}:Y_{t}^{a}$),555Since the attack starts at $t=0$, we do
not use superscript $a$ for the system evolution for $t<0$, as the
trajectories of the non-compromised and compromised systems do not differ
before the attack starts.

where we denote $Y_{-T}^{-1}=Y_{-T}:Y_{-1}$. Given a sequence of received data
denoted by $\bar{Y}^{t}=\bar{Y}_{-T}:\bar{Y}_{t}$, it is either extracted from
the $H_{0}$ hypothesis with the joint distribution denoted as
$\mathbf{P}(Y_{-T}:Y_{t})$, or from the alternate hypothesis with a joint
(_unknown_) distribution denoted by
$\mathbf{Q}(Y_{-T}^{-1},Y_{0}^{a}:Y_{t}^{a})$;666With some abuse of the
notation, we just use $\mathbf{P}$ or $\mathbf{Q}$ to refer to these joint
distributions. note that the joint distribution $\mathbf{Q}$ is controlled by
the injected attack signal and is thus unknown.

We define the intrusion detector $D$ as the mapping

$D:\bar{Y}^{t}\to\\{0,1\\},$ (16)

where the output $0$ is associated with $H_{0}$ and output 1 with $H_{1}$. It
should be noted that ID in the above format is general as there is no
assumption on the mapping $D$, and the output measurements are the only
information that is accessible to the system to detect the abnormalities. Any
other signal including $\mathpzc{X}$ (consequently the input control $u_{t}$)
can be obtained using the sequence of sensor measurements $\bar{Y}^{t}$ where
such mapping can be captured in mapping $D$.

Let us define
$p_{t}^{TD}(D)=\mathbb{P}(D(\bar{Y}^{t})=1|\bar{Y}^{t}\sim\mathbf{Q})$ as the
probability of true detection, and
$p_{t}^{FA}(D)=\mathbb{P}(D(\bar{Y}^{t})=1|\bar{Y}^{t}\sim\mathbf{P})$ as the
probability of false alarm for the detector $D$. Let also consider the random
guess-based ID (defined by $D_{RG}$). For such random guess-based ID we have

$\begin{split}p^{FA}(D_{RG})\overset{\text{\small(a)}}{=}&\mathbb{P}(D_{RG}(\bar{Y}^{t})=1|\bar{Y}^{t}\sim\mathbf{P})\overset{\text{\small(b)}}{=}\mathbb{P}(D_{RG}(\bar{Y}^{t})=1)\\\
\overset{\text{\small(c)}}{=}&\mathbb{P}(D_{RG}(\bar{Y}^{t})=1|\bar{Y}^{t}\sim\mathbf{Q})\overset{\text{\small(d)}}{=}p^{TD}(D_{RG}),\end{split}$

where (a) and (d) hold according to the definition of true detection and false
alarm probabilities; (b) and (c) hold because in random guess the detection is
independent of the distribution of the observation. Hence, for random guess
detectors, the probability of true detection and false alarm are equal.

###### Definition 5

An ID (defined by $D$) is better than a random guess ID (defined by $D_{RG}$)
if $p^{FA}(D)<p^{TD}(D)$.

###### Remark 1

Note that although we assumed the ID has access to the measurement data from
time $-T$ to the current time $t$, it does not mean that the system only
should individually process each observation at each time step. The ID can
combine all the observation until current time step to decide if the system is
in normal condition.

We now formalize the notion of stealthy attacks.

##  IV Formalizing Stealthiness and Attack Objectives

This section captures the conditions that an attack sequence is stealthy from
_any_ ID. Specifically, we define an attack to be strictly stealthy if _there
exists no detector that can perform better than a random guess between the two
hypothesis_ (Definition 5). However, reaching such stealthiness guarantees may
not be possible in general. Thus, we also define the notion of
$\epsilon$-_stealthiness_ , which as we will show later, is attainable for a
large class of nonlinear systems. Formally, we define the notions of _strict
stealthiness_ and _$\epsilon$ -stealthiness_ as follows.

###### Definition 6

Consider the system from (11). An attack sequence, denoted by
$\\{a_{0},a_{1},...\\}$, is _strictly stealthy_ if there exists no detector
for which $p_{t}^{TD}-p_{t}^{FA}>0$ holds, for any $t\geq 0$. An attack is
$\epsilon$-_stealthy_ if for a given $\epsilon>0$, there exists no detector
such that $p_{t}^{TD}-p_{t}^{FA}>\epsilon$ holds, for any $t\geq 0$.

The following theorem uses Neyman-Pearson lemma to capture the condition for
which the received sensor measurements satisfy the stealthiness condition in
Definition 6.

######  Theorem 1 ([20, 31])

An attack sequence is

  * •

strictly stealthy if and only if
$KL\big{(}\mathbf{Q}(Y_{-T}^{-1},Y_{0}^{a}:Y_{t}^{a})||\mathbf{P}(Y_{-T}:Y_{t})\big{)}=0$
for all $t\in\mathbb{Z}_{\geq 0}$.

  * •

is $\epsilon$-stealthy if the observation sequence $Y_{0}^{a}:Y_{t}^{a}$
satisfies

$KL\big{(}\mathbf{Q}(Y_{-T}^{-1},Y_{0}^{a}:Y_{t}^{a})||\mathbf{P}(Y_{-T}:Y_{t})\big{)}\leq\log(\frac{1}{1-\epsilon^{2}}).$

###### Remark 2

The $\epsilon$-stealthiness condition from [16] requires

$\lim_{t\to\infty}\frac{KL\big{(}\mathbf{Q}(Y_{0}^{a}:Y_{t}^{a})||\mathbf{P}(Y_{0}:Y_{t})\big{)}}{t}\leq\epsilon.$

This allows for the KL divergence to linearly increase over time for any
$\epsilon>0$, and as a result, after large-enough time period the attack will
be detected. On the other hand, our definition of $\epsilon$-stealthy only
depends on $\epsilon$ and is fixed for any time $t$; thus, it introduces a
stronger notion of attack stealthiness.

#### Formalizing Attack Goal

The attacker intends to _maximize_ control performance degradation.
Specifically, the attack goal is to cause deviation in the system’s
trajectory. In other words, if we assume the attack starts at $t=0$, and
denote the states of the attack-free and under attack systems as $x_{t}$ and
$x_{t}^{a}$, respectively for $t\in\mathbb{Z}_{\geq 0}$, then the attack
objective is to achieve

$\|x_{t^{\prime}}^{a}-x_{t^{\prime}}\|\geq\alpha.$ (17)

for some $t^{\prime}\in\mathbb{Z}_{\geq 0}$. In other words, the attacker
wants to cause deviation in the trajectory of states with respect to system’s
own desired unattacked trajectory. Moreover, the attacker wants _to remain
stealthy (i.e., undetected by the intrusion detector)_ , as formalized below.

###### Definition 7

An attack sequence is referred to as $(\epsilon,\alpha)$-_successful_ attack
if exists $t^{\prime}\in\mathbb{Z}_{\geq 0}$ such that
$\|x_{t^{\prime}}^{a}-x_{t^{\prime}}\|\geq\alpha$ and the attack is
$\epsilon$-stealthy for all $t\in\mathbb{Z}_{\geq 0}$. When such sequence
exists for a system, the system is called $(\epsilon,\alpha)$-_attackable_.
When the system is $(\epsilon,\alpha)$-attackable for arbitrarily large
$\alpha$, the system is referred to as _perfectly attackable_.

Now, the problem considered in this work can be formalized as capturing the
potential impact of stealthy attacks on the considered system. Specifically,
in the next section, we derive conditions for existence of a _stealthy_ yet
_effective_ attack sequence $a_{0},a_{1},...$ resulting in
$\|x_{t}^{a}-x_{t}\|\geq\alpha$ for some $t\in\mathbb{Z}_{\geq 0}$ – i.e., we
find conditions for the system to be $(\epsilon,\alpha)$-attackable. Here, for
an attack to be stealthy, we focus on the $\epsilon-$stealthy notion; i.e.,
that even the best ID could only improve the detection probability by
$\epsilon$ compared to the random-guess baseline detector.

##  V Vulnerability Analysis of Nonlinear Systems to Stealthy Attacks

In this section, we derive the conditions such that the nonlinear system (11)
with closed-loop dynamics (14) is vulnerable to effective stealthy attacks
formally defined in Section IV.

###  V-A Vulnerability Analysis of Nonlinear Systems
$\Sigma_{\text{\@slowromancap i@}}$

First, we derive the condition such that the system
$\Sigma_{\text{\@slowromancap i@}}$ is vulnerable to stealthy attacks.

###### Theorem 2

The system $\Sigma_{\text{\@slowromancap i@}}$ is
($\epsilon,\alpha$)-attackable for arbitrarily small $\epsilon$ and
arbitrarily large $\alpha$, if the closed-loop system (14) is IES and the
system (12) is IU.

###### Proof:

Assume that the trajectory of the system and controller states for
$t\in\mathbb{Z}_{<0}$ is denoted by $\mathbf{X}_{-T}:\mathbf{X}_{-1}$.
Following the attack start at $t=0$, let us consider the evolution of the
system with and without attacks during $t\in\mathbb{Z}_{\geq 0}$. For the
system under attack, starting at time zero, the trajectory
$\mathbf{X}_{0}^{a}:\mathbf{X}_{t}^{a}$ of the system and controller states is
governed by

$\begin{split}x_{t+1}^{a}=&f(x_{t}^{a},u_{t}^{a})+w_{t}^{a},\quad
y_{t}^{c,a}=h(x_{t}^{a})+v_{t}^{a}+a_{t}\\\
\mathpzc{X}_{t}^{a}=&f_{c}(\mathpzc{X}^{a}_{t-1},y_{t}^{c,a}),\quad
u_{t}^{a}=h_{c}(\mathpzc{X}^{a}_{t},y_{t}^{c,a}).\\\ \end{split}$ (18)

On the other hand, if the system was not under attack during
$t\in\mathbb{Z}_{\geq 0}$, we denote the plant and controller state evolution
by $\mathbf{X}_{0}:\mathbf{X}_{t}$. Hence, it is a continuation of the system
trajectories $\mathbf{X}_{-T}:\mathbf{X}_{-1}$ if hypothetically no data-
injection attack occurs during $t\in\mathbb{Z}_{\geq 0}$. Since the system and
measurement noises are independent of the state, we can assume that
$w_{t}^{a}=w_{t}$ and $v_{t}^{a}=v_{t}$. In this case, the dynamics of the
plant and controller state evolution satisfies

$\begin{split}x_{t+1}=&f(x_{t},u_{t})+w_{t},\quad y_{t}^{c}=h(x_{t})+v_{t},\\\
\mathpzc{X}_{t}=&f_{c}(\mathpzc{X}_{t-1},y_{t}^{c}),\quad
u_{t}=h_{c}(\mathpzc{X}_{t},y_{t}^{c}),\\\ \end{split}$ (19)

captured in the compact form (14), with
$\mathbf{X}_{0}=\begin{bmatrix}x_{0}\\\ \mathpzc{X}_{0}\end{bmatrix}$.

Now, consider the sequence of attack vectors injected in the system (18),
constructed by the attacker using the dynamics

$\begin{split}s_{t+1}&=f(x_{t}^{a},u_{t}^{a})-f(x_{t}^{a}-s_{t},u_{t}^{a})\\\
a_{t}&=h(x_{t}^{a}-s_{t})-h(x_{t}^{a}),\end{split}$ (20)

for $t\in\mathbb{Z}_{\geq 0}$, and with some arbitrarily chosen nonzero
initial value of $s_{0}$. By injecting the above attack sequence into the
sensor measurements, we can verify that
$y_{t}^{c,a}=h(x_{t}^{a})+v_{t}+a_{t}=h(x_{t}^{a}-s_{t})+v_{t}$. After
defining777Superscript $f$ is the initial of the word ‘fake’ as we will show
later how the attacker fool the system to believe $x^{f}$ represents as the
systems state.

$x_{t}^{f}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}x_{t}^{a}-s_{t},$
(21)

and combining (20) with (18), the dynamics of $x_{t}^{f}$ and the controller,
as well as the corresponding input and output satisfy

$\begin{split}x_{t+1}^{f}=&f(x_{t}^{f},u_{t}^{a})+w_{t},\quad
y_{t}^{c,a}=h(x_{t}^{f})+v_{t},\\\
\mathpzc{X}_{t}^{a}=&f_{c}(\mathpzc{X}^{a}_{t-1},y_{t}^{c,a}),\quad\,\,\,\,\,\,\,u_{t}^{a}=h_{c}(\mathpzc{X}^{a}_{t},y_{t}^{c,a}),\end{split}$
(22)

with the initial condition $x_{0}^{f}=x_{0}^{a}-s_{0}$.

Now, if we define $\mathbf{X}^{f}_{t}=\begin{bmatrix}x_{t}^{f}\\\
\mathpzc{X}_{t}^{a}\end{bmatrix}$, it holds that

$\mathbf{X}^{f}_{t+1}=F(\mathbf{X}^{f}_{t},\mathbf{W}_{t}).$ (23)

with $\mathbf{X}^{f}_{0}=\begin{bmatrix}x_{0}^{f}\\\
\mathpzc{X}_{0}^{a}\end{bmatrix}$. Since we have that $x_{0}^{a}=x_{0}$, it
holds that $\mathbf{X}_{0}-\mathbf{X}^{f}_{0}=\begin{bmatrix}s_{0}\\\
\mathpzc{X}_{0}-\mathpzc{X}_{0}^{a}\end{bmatrix}$. Since the functions $f_{c}$
and $h$ are Lipschitz with constants $L_{f_{c}}$ and $L_{h}$, respectively, we
have

$\begin{split}\|\mathpzc{X}_{0}-\mathpzc{X}_{0}^{a}\|&\leq\|f_{c}(\mathpzc{X}_{-1},y^{c}_{0})-f_{c}(\mathpzc{X}_{-1},y^{c,a}_{0})\|\leq
L_{f_{c}}\|y^{c}_{0}-y^{c,a}_{0}\|\\\ &\leq
L_{f_{c}}\|h(x_{0})+v_{0}-h(x_{0}-s_{0})-v_{0}\|\\\ &\leq
L_{f_{c}}L_{h}\|s_{0}\|.\end{split}$

Therefore, we get
$\|\mathbf{X}_{0}-\mathbf{X}^{f}_{0}\|\leq(1+L_{f_{c}}L_{h})\|s_{0}\|$.

On the other hand, since both (23) and (14) have the same function and
argument $\mathbf{W}_{t}$, the closed-loop system (23) is IES, and it also
follows that

$\begin{split}\|\mathbf{X}(t,\mathbf{X}_{0},\mathbf{W})-\mathbf{X}^{f}(t,\mathbf{X}^{f}_{0},\mathbf{W})\|&\leq\kappa\|\mathbf{X}_{0}-\mathbf{X}^{f}_{0}\|\lambda^{t}\\\
&=\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{t},\end{split}$ (24)

for some nonnegative $\lambda<1$. Therefore, the trajectories of $\mathbf{X}$
(i.e., the system without attack) and $\mathbf{X}^{f}$ converge to each other
exponentially fast.

Now, by defining $\mathbf{Z}_{t}=\begin{bmatrix}x_{t}\\\
y_{t}^{c}\end{bmatrix}$ and $\mathbf{Z}_{t}^{f}=\begin{bmatrix}x_{t}^{f}\\\
y_{t}^{c,a}\end{bmatrix}$, it holds that

$\begin{split}KL\big{(}&\mathbf{Q}(Y_{-T}^{-1},Y_{0}^{a}:Y_{t}^{a})||\mathbf{P}(Y_{-T}:Y_{t})\big{)}\\\
&\leq
KL\big{(}\mathbf{Q}(\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f})||\mathbf{P}(\mathbf{Z}_{-T}:\mathbf{Z}_{t})\big{)},\end{split}$
(25)

where we applied the monotonicity property of the KL-divergence from Lemma 1
to get the above inequality. Then, we apply the chain-rule property of KL-
divergence on the right-hand side of (25) to obtain the following

$\begin{split}&KL\big{(}\mathbf{Q}(\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f})||\mathbf{P}(\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}:\mathbf{Z}_{t})\big{)}\\\
&=KL\big{(}\mathbf{Q}(\mathbf{Z}_{-T}^{-1})||\mathbf{P}(\mathbf{Z}_{-T}^{-1})\big{)}+\\\
&\quad\quad\quad\quad
KL\big{(}\mathbf{Q}(\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f}|\mathbf{Z}_{-T}^{-1})||\mathbf{P}(\mathbf{Z}_{0}:\mathbf{Z}_{t}|\mathbf{Z}_{-T}^{-1})\big{)}\\\
&=KL\big{(}\mathbf{Q}(\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f}|\mathbf{Z}_{-T}^{-1})||\mathbf{P}(\mathbf{Z}_{0}:\mathbf{Z}_{t}|\mathbf{Z}_{-T}^{-1})\big{)};\end{split}$
(26)

here, we used the fact that the KL-divergence of two identical joint
distributions (i.e., $\mathbf{Q}(\mathbf{Z}_{-T}^{-1})$ and
$\mathbf{P}(\mathbf{Z}_{-T}^{-1})$ since the system is not under attack for
$t<0$) is zero.

Applying the chain-rule property of KL-divergence to (26)

$\begin{split}&KL\big{(}\mathbf{Q}(\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f}|\mathbf{Z}_{-T}^{-1})||\mathbf{P}(\mathbf{Z}_{0}:\mathbf{Z}_{t}|\mathbf{Z}_{-T}^{-1})\big{)}\\\
&=\sum_{k=0}^{t}\Big{\\{}KL\big{(}\mathbf{Q}(x_{k}^{f}|\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f})||\mathbf{P}(x_{k}|\mathbf{Z}_{-T}:\mathbf{Z}_{k-1})\big{)}\\\
&+KL\big{(}\mathbf{Q}(y_{k}^{c,a}|x_{k}^{f},\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f})||\mathbf{P}(y_{k}|x_{k},\mathbf{Z}_{-T}:\mathbf{Z}_{t-1})\big{)}\Big{\\}}.\end{split}$
(27)

Given $\mathbf{Z}_{-T}:\mathbf{Z}_{k-1}$, the distribution of $x_{k}$ is a
Gaussian with mean $f(x_{k-1},u_{k-1})$ and covariance $\mathbf{R}_{w}$.
Similarly given
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f}$, and the fact
that $s_{0}$ is a deterministic value, the distribution of $x_{k}^{f}$ is a
Gaussian with mean $f(x_{k-1}^{f},u_{k-1}^{a})$ and covariance
$\mathbf{R}_{w}$. According to (19) and (22), it holds that
$f(x_{k-1},u_{k-1})-f(x_{k-1}^{f},u_{k-1}^{a})=x_{k}-x_{k}^{f}$. On the other
hand, in (24), we showed that
$\|x_{k}-x_{k}^{f}\|\leq\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{k}$ holds
for $k\in\mathbb{Z}_{\geq 0}$. Therefore, for all $0\leq k\leq t$, it holds
that

$\displaystyle KL\big{(}\mathbf{Q}(x_{k}^{f}|$
$\displaystyle\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f})||\mathbf{P}(x_{k}|\mathbf{Z}_{-T}:\mathbf{Z}_{k-1})\big{)}$
$\displaystyle\stackrel{{\scriptstyle(i)}}{{=}}$
$\displaystyle\mathbb{E}_{\mathbf{Q}(\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f})}\\{(x_{k}-x_{k}^{f})^{T}\mathbf{R}_{w}^{-1}(x_{k}-x_{k}^{f})\\}$
$\displaystyle\stackrel{{\scriptstyle(ii)}}{{\leq}}$
$\displaystyle\kappa^{2}\|s_{0}\|^{2}\lambda^{2k}(1+L_{f_{c}}L_{h})^{2}\lambda_{max}(\mathbf{R}_{w}^{-1}),$
(28)

where we used Lemma 3 to get equality $(i)$ and using the boundedness of
$(x_{k}-x_{k}^{f})^{T}\mathbf{R}_{w}^{-1}(x_{k}-x_{k}^{f})$ followed by
applying Lemma 4, we get the inequality $(ii)$, with
$\lambda_{max}(\mathbf{R}_{w}^{-1})$ being the maximum eigenvalue of the
matrix $\mathbf{R}_{w}^{-1}$.

Now, it holds that
$\mathbf{Q}(y_{k}^{c,a}|x_{k}^{f},\mathbf{Z}_{-T}:\mathbf{Z}^{f}_{k-1})=\mathbf{Q}(y_{k}^{c,a}|x_{k}^{f})$
and
$\mathbf{P}(y_{k}|x_{k},\mathbf{Z}_{-T}:\mathbf{Z}_{k-1})=\mathbf{P}(y_{k}|x_{k})$;
also, from (19) and (22) it holds that given $x_{k}$ and $x_{k}^{f}$,
$\mathbf{P}(y_{k}|x_{k})$ and $\mathbf{Q}(y_{k}^{c,a}|x_{k}^{f})$ are both
Gaussian with mean $h(x_{k})$ and $h(x_{k}^{f})$, respectively and covariance
$\mathbf{R}_{v}$. Thus, it follows that

$\displaystyle KL\big{(}\mathbf{Q}$
$\displaystyle(y_{k}^{c,a}|x_{k}^{f})||\mathbf{P}(y_{k}|x_{k})\big{)}$
$\displaystyle=\mathbb{E}_{\mathbf{Q}(x_{k}^{f})}\\{\big{(}h(x_{k})-h(x_{k}^{f})\big{)}^{T}\mathbf{R}_{v}^{-1}\big{(}h(x_{k})-h(x_{k}^{f})\big{)}\\}$
$\displaystyle\leq
L_{h}^{2}(x_{k}-x_{k}^{f})^{T}\mathbf{R}_{v}^{-1}(x_{k}-x_{k}^{f})$
$\displaystyle\leq
L_{h}^{2}(1+L_{f_{c}}L_{h})^{2}\kappa^{2}\|s_{0}\|^{2}\lambda^{2k}\lambda_{max}(\mathbf{R}_{v}^{-1}),$
(29)

where we used again Lemmas 2, 3 and 4 to get the above inequality. Combining
(25)-(V-A) results in

$\begin{split}&KL\big{(}\mathbf{Q}(Y_{-T}^{-1},Y_{0}^{a}:Y_{t}^{a})||\mathbf{P}(Y_{-T}:Y_{t})\big{)}\leq\\\
&\sum_{k=0}^{t}\kappa^{2}\|s_{0}\|^{2}\lambda^{2k}\lambda_{max}(\mathbf{R}_{w}^{-1})+L_{h}^{2}\kappa^{2}\|s_{0}\|^{2}\lambda^{2k}\lambda_{max}(\mathbf{R}_{v}^{-1})\\\
&\leq\frac{\kappa^{2}(1+L_{f_{c}}L_{h})^{2}\|s_{0}\|^{2}}{1-\lambda^{2}}\big{(}\lambda_{max}(\mathbf{R}_{w}^{-1})+L_{h}^{2}\lambda_{max}(\mathbf{R}_{v}^{-1})\big{)}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}b_{\epsilon}.\end{split}$
(30)

Finally, with $b_{\epsilon}$ defined as in (30) and using Theorem 1 the attack
sequence defined in (20) satisfies the $\epsilon$-stealthiness condition with
$\epsilon=\sqrt{1-e^{-b_{\epsilon}}}$.

We now show that the proposed attack sequence is effective; i.e., there exists
$t^{\prime}\in\mathbb{Z}_{\geq 0}$ such that
$\|x_{t^{\prime}}^{a}-x_{t^{\prime}}\|\geq\alpha$ for arbitrarily large
$\alpha$. To achieve this, consider the two dynamics from (18) and (22) for
any $t\in\mathbb{Z}_{\geq 0}$

$\begin{split}x_{t+1}^{a}=&f(x_{t}^{a},u_{t}^{a})+w_{t}=f_{u}(x_{t}^{a},U_{t}^{a})\\\
x_{t+1}^{f}=&f(x_{t}^{f},u_{t}^{a})+w_{t}=f_{u}(x_{t}^{f},U_{t}^{a})\end{split}$
(31)

with $U_{t}^{a}=\begin{bmatrix}{u_{t}^{a}}^{T}&w_{t}^{T}\end{bmatrix}^{T}$,
for $t\in\mathbb{Z}_{\geq 0}$. Since we assumed that the open-loop system (12)
is IU, it holds that for all $x_{0}^{a}=x_{0}$, there exits a nonzero $s_{0}$
such that for any $M>0$

$\|x^{a}(t,x_{0}^{a},U^{a})-x^{f}(t,x_{0}^{a}-s_{0},U^{a})\|\geq M$ (32)

holds in $t\geq t^{\prime}$, for some $t^{\prime}\in\mathbb{Z}_{\geq 0}$.

On the other hand, we showed in (24) that
$\|x(t,x_{0},U)-x^{f}(t,x_{0}^{a}-s_{0},U^{a})\|\leq\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{t}$.
Combining this with (32) results in

$\begin{split}&\|x^{a}(t,x_{0}^{a},U^{a})-x(t,x_{0}-s_{0},U)\|=\\\
&\|x^{a}(t,x_{0}^{a},U^{a})-x^{f}(t,x_{0}^{a}-s_{0},U^{a})+x^{f}(t,x_{0}^{a}-s_{0},U^{a})\\\
&-x(t,x_{0}-s_{0},U)\|\geq\|x^{a}(t,x_{0}^{a},U^{a})-x^{f}(t,x_{0}^{a}-s_{0},U^{a})\|\\\
&-\|x^{f}(t,x_{0}^{a}-s_{0},U^{a})-x(t,x_{0}-s_{0},U)\|\\\
&\qquad\qquad\qquad\qquad\geq
M-\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{t}\\\
&\Rightarrow\|x^{a}(t,x_{0}^{a},U^{a})-x(t,x_{0}-s_{0},U)\|\\\ &\geq
M-\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{t}\geq
M-\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|.\end{split}$ (33)

Since $M$ is a free parameter, we can choose it to satisfy
$M>\alpha+\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|$, for arbitrarily large $\alpha$.
Thus, the system is $(\epsilon,\alpha)$-attackable. ∎

From (22), the false sensor measurements are generated by the evolution of
$x_{t}^{f}$. Therefore, intuitively, the attacker wants to deceive the system
into believing that $x_{t}^{f}$ is the actual state of the system instead of
$x_{t}^{a}$. Since $x_{t}^{f}$ and $x_{t}$ (i.e., the system state if no
attack occurs during $t\in\mathbb{Z}_{\geq 0}$) converge to each other
exponentially fast, the idea is that the system almost believes that $x_{t}$
is the system state (under attack), while the actual state $x_{t}^{a}$ becomes
arbitrarily large (see Fig. 2). On the other hand, $s_{t}=x_{t}^{a}-x_{t}^{f}$
denotes the deviation between the actual state $x_{t}^{a}$ and fake state
$x_{t}^{f}$, and since we have
$\|x_{t}^{f}-x_{t}\|\leq\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{t}$, we can
derive $\|x_{t}^{a}-x_{t}\|\geq\|s_{t}\|-\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|$
using the same procedure as in (33). Thus, for an $s_{0}$ with very a small
norm, $s_{t}$ can represent the deviation between the under attack $x_{t}^{a}$
and attack-free $x_{t}$ states. This shows that to have an impactful attack,
the dynamics of the $s_{t}$ needs to be unstable.

Figure 2: The trajectories of the system states $x_{t}$ without attack (black
line), of the ‘fake ’states $x_{t}^{f}$ (blue dash line), and the system
states $x_{t}^{a}$ after the attack starts (red line).

Moreover, all parameters $\kappa$, $\lambda$, $L_{h}$, $L_{f_{c}}$,
$\mathbf{R}_{w}$, and $\mathbf{R}_{v}$ in (30) are some constants that depend
either on system properties ($L_{h}$, $\mathbf{R}_{w}$, and $\mathbf{R}_{v}$)
or are determined by the controller design ($L_{f_{c}}$, $\kappa$, $\lambda$).
However, $s_{0}$ is set by the attacker, and _it can be chosen arbitrarily
small to make $\epsilon$ arbitrarily close to zero_. Yet, $s_{0}$ cannot be
equal to zero; in that case (32) would not hold – i.e., the attack would not
be impactful. Therefore, as opposed to attack methods targeting the prediction
covariance in [16] where the attack impact linearly changes with $\epsilon$,
here arbitrarily large $\alpha$ (high impact attacks) can be achieved even
with an arbitrarily small $\epsilon$; it may only take more time to get to
$\|x^{a}_{t^{\prime}}-x_{t^{\prime}}\|\geq\alpha$.

#### Discussion on Incremental Stability

The notion of incremental stability from Definition 1 determines how fast the
system ‘forgets’ the impact of the initial condition [24]. For example,
consider an LTI state space model $x_{t+1}=Ax_{t}+Bd_{t}$. If the matrix $A$
has all eigenvalues inside the unit circle then the system is IES according to
Definition 1. Alternatively, we can look at the solution of states at time $t$
as

$x_{t}=A^{t}x_{0}+\sum\nolimits_{k=0}^{t-1}A^{t-k-1}Bd_{k},$

where the term $A^{t}x_{0}$ captures the impact of the initial condition and
the second term capturing the impact of the input sequence $d_{0}:d_{t-1}$ on
the system. If all eigenvalues of the matrix $A$ are inside the unit the
circle, then the term $A^{t}x_{0}$ will approach to zero exponentially for any
given initial condition. This means the system will ‘forget’ the impact of
initial condition if the matrix $A$ is stable.

Hence, IES means the impact of initial condition converges to zero
exponentially fast. Similar notion also exists with an asymptotic behaviour
where the system is called incrementally asymptotically stable if the impact
of initial condition approaches to zero asymptotically. If we replace the IES
condition in Theorem 2 by incrementally asymptotically stability, one can
still show that the system will be $(\epsilon,\alpha)$-attackable; yet, the
upper bound obtained in (30) will be looser. Additional discussion is provided
in Appendix VIII-A.

###### Remark 3

In case that either $w=0$ or $v=0$ (i.e., when there is no process or
measurement noise), one can still get a similar bound on the KL-divergence
only as a function of the nonzero noise covariance by applying the
monotonicity and data-processing inequalities. However, ensuring stealthiness
requirement is not possible if both $w=0$ and $v=0$ (i.e., for a noiseless
system), as the system would be completely deterministic, and thus
theoretically any small perturbation to the sensor measurements could be
detected.

###  V-B Vulnerability Analysis of Nonlinear Systems
$\Sigma_{\text{\@slowromancap ii@}}$

As discussed in Section III, for the system $\Sigma_{\text{\@slowromancap
ii@}}$ the attacker does not have perfectly access to the system states. Here,
we consider two possible methods for estimating the states.

Case 1: The attacker designs an estimator $\mathcal{E}$ that takes the
sequence of system measurements
$y_{-\mathcal{T}}:y_{-1},y_{0}^{a}:y_{t-1}^{a}$ to estimate the states

$\hat{x}_{t}^{a}=\mathcal{E}_{t}(y_{-\mathcal{T}}:y_{-1},y_{0}^{a}:y_{t-1}^{a})$
(34)

where $\mathcal{E}$ is a nonlinear mapping that can represent any nonlinear
filtering such as extended Kalman filter (EKF). We assume that the attacker
uses the measurements of $\mathcal{T}$ (with $-T<-\mathcal{T}$) time step
before the attack initiation to estimate the states. It is also adssumed that
the estimation error $\zeta=\hat{x}-x$ is bounded; i.e., $\|\zeta_{t}\|\leq
b_{\zeta}$ for all $t\in\mathbb{Z}_{>0}$.

Case 2: The attacker uses its own set of sensors $y^{\prime}_{t}$ to
imperfectly measure the states as
$y^{\prime}_{t}=h^{\prime}(x_{t})+v^{\prime}_{t}$ where $v^{\prime}$ is i.i.d
noise independent of $w$ and $v$. Such measurements are used in a filter or
fusion model to extract the state estimate as

$\hat{x}_{t}^{a}=\mathcal{E}^{\prime}_{t}(y^{\prime}_{-\mathcal{T}}:y^{\prime}_{-1},{y^{\prime
a}_{0}}:{y^{\prime a}_{t}}),$ (35)

with $\zeta_{t}=\hat{x}_{t}^{a}-x_{t}^{a}$. Moreover, it is assumed that
$\zeta_{t}$ is bounded by $b^{\prime}_{\zeta}$ for all $t\in\mathbb{Z}_{>0}$.

###### Remark 4

Since the system and measurement noises are modeled by Gaussian distribution,
theoretically it might not be possible to provide a bound on the estimation
error with probability one for case 1. However, we assume $b_{\zeta}$ is
chosen high enough that the estimation error is bounded by $b_{\zeta}$ during
the attack run-time with probability of almost one.

Now, the following theorem captures the conditions such that the system
$\Sigma_{\text{\@slowromancap ii@}}$ is vulnerable to stealthy attacks.

###### Theorem 3

Assume that the function $h_{c}$ is Lipschitz with a constant $L_{h_{c}}$. The
system $\Sigma_{\text{\@slowromancap ii@}}$ is ($\epsilon,\alpha$)-attackable
for arbitrarily large $\alpha$, if the closed-loop system (14) is IISS, the
controller dynamics (13) is IES, and the system (12) is IISU.

###### Proof:

As in Theorem 2, let us consider the trajectory of the system and controller
states for $t\in\mathbb{Z}_{<0}$ is denoted by
$\mathbf{X}_{-T}:\mathbf{X}_{-1}$. Following the attack start at $t=0$,
consider the evolution of the system with and without attacks during
$t\in\mathbb{Z}_{\geq 0}$. For the system under attack, starting at $t=0$, the
trajectory $\mathbf{X}_{0}^{a}:\mathbf{X}_{t}^{a}$ of the system and
controller states satisfies

$\begin{split}x_{t+1}^{a}=&f(x_{t}^{a},u_{t}^{a})+w_{t},\quad
y_{t}^{c,a}=h(x_{t}^{a})+v_{t}+a_{t}\\\
\mathpzc{X}_{t}^{a}=&f_{c}(\mathpzc{X}^{a}_{t-1},y_{t}^{c,a}),\quad\quad\,u_{t}^{a}=h_{c}(\mathpzc{X}^{a}_{t},y_{t}^{c,a}).\\\
\end{split}$ (36)

On the other hand, if the system were not under attack during
$t\in\mathbb{Z}_{\geq 0}$, we denote the plant and controller state evolution
by $\mathbf{X}_{0}:\mathbf{X}_{t}$. Hence, it is a continuation of the system
trajectories $\mathbf{X}_{-T}:\mathbf{X}_{-1}$ if hypothetically no data-
injection attack occurs during $t\in\mathbb{Z}_{\geq 0}$. Since the system and
measurement noises are independent of the state, we can assume that
$w_{t}^{a}=w_{t}$ and $v_{t}^{a}=v_{t}$. In this case, the dynamics of the
plant and controller state evolution satisfies

$\begin{split}x_{t+1}=&f(x_{t},u_{t})+w_{t},\quad y_{t}^{c}=h(x_{t})+v_{t},\\\
\mathpzc{X}_{t}=&f_{c}(\mathpzc{X}_{t-1},y_{t}^{c}),\quad\quad
u_{t}=h_{c}(\mathpzc{X}_{t},y_{t}^{c}),\\\ \end{split}$ (37)

captured in the compact form (14), with
$\mathbf{X}_{0}=\begin{bmatrix}x_{0}^{T}&\mathpzc{X}_{0}^{T}\end{bmatrix}^{T}$.

Now, consider the sequence of attack vectors injected in the system from (18),
which are constructed by the attacker using the following dynamical model

$s_{t+1}=f(\hat{x}_{t}^{a},u_{t}^{s})-f(\hat{x}_{t}^{a}-s_{t},u_{t}^{s})$
(38a) $a_{t}=h(\hat{x}_{t}^{a}-s_{t})-h(\hat{x}_{t}^{a}),$ (38b)
$\mathpzc{X}_{t}^{s}=f_{c}(\mathpzc{X}_{t-1}^{s},y_{t}^{c,a}),$ (38c)
$u_{t}^{s}=h_{c}(\mathpzc{X}_{t}^{s},y_{t}^{c,a})$ (38d)

for $t\in\mathbb{Z}_{\geq 0}$, and with some arbitrarily chosen nonzero
initial value of $s_{0}$ and $\mathpzc{X}_{0}^{s}$. By injecting the above
attack sequence into the sensor measurements, we can verify that

$y_{t}^{c,a}=h(x_{t}^{a})+v_{t}+a_{t}=h(x_{t}^{a})-h(\hat{x}_{t}^{a})+h(\hat{x}_{t}^{a}-s_{t})+v_{t}.$
(39)

After defining

$x_{t}^{f}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}x_{t}^{a}-s_{t},$
(40)

and combining (20) with (18), the dynamics of $x_{t}^{f}$ and the controller,
and the corresponding input and output satisfy

$\begin{split}x_{t+1}^{f}=&f(x_{t}^{a},u_{t}^{a})-f(\hat{x}_{t}^{a},u_{t}^{s})+f(\hat{x}_{t}^{a}-s_{t},u_{t}^{s})+w_{t}\\\
=&f(x_{t}^{f},u_{t}^{a})-f(x_{t}^{f},u_{t}^{a})+f(x_{t}^{a},u_{t}^{a})-f(\hat{x}_{t}^{a},u_{t}^{s})\\\
&+f(x_{t}^{f}+\zeta_{t},u_{t}^{s})+w_{t}=f(x_{t}^{f},u_{t}^{a})+w_{t}+\sigma_{t},\end{split}$
(41a)
$\begin{split}y_{t}^{c,a}=&h(x_{t}^{a})+v_{t}-h(\hat{x}_{t}^{a})+h(\hat{x}_{t}^{a}-s_{t})\\\
=&h(x_{t}^{f})+h(x_{t}^{f}+\zeta_{t})-h(x_{t}^{f})+h(x_{t}^{a})-h(\hat{x}_{t}^{a})+v_{t}\\\
=&h(x_{t}^{f})+v_{t}+\sigma^{\prime}_{t}\end{split}$ (41b)

with the initial condition $x_{0}^{f}=x_{0}^{a}-s_{0}$, where we also added
and subtracted $f(x_{t}^{f},u_{t}^{a})$ and $h(x_{t}^{f})$ from (41a) and
(41b), respectively. We also define
$\sigma_{t}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}f(x_{t}^{f}+\zeta_{t},u_{t}^{s})-f(x_{t}^{f},u_{t}^{a})+f(x_{t}^{a},u_{t}^{a})-f(\hat{x}_{t}^{a},u_{t}^{s})$
and
$\sigma^{\prime}_{t}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}h(x_{t}^{f}+\zeta_{t})-h(x_{t}^{f})+h(x_{t}^{a})-h(\hat{x}_{t}^{a})$.
Since the controller dynamics (13) is IES and the exogenous input to (38c) and
(36) is the same (i.e., $y_{t}^{c,a}$), we have
$\|\mathpzc{X}_{t}^{a}-\mathpzc{X}_{t}^{s}\|\leq\kappa_{s}\lambda_{s}^{t}\|\mathpzc{X}_{0}^{a}-\mathpzc{X}_{0}^{s}\|$
for $t\in\mathbb{Z}_{\geq 0}$. Since the function $h_{c}$ is Lipschitz, we get
$\|u_{t}^{a}-u_{t}^{s}\|\leq
L_{h_{c}}\kappa_{s}\lambda_{s}^{t}\|\mathpzc{X}_{0}^{a}-\mathpzc{X}_{0}^{s}\|$
for $t\in\mathbb{Z}_{\geq 0}$.

Now, using the assumption that the functions $f$ and $h$ are Lipschitz, we can
find a bound on the norm of $\sigma$ and $\sigma^{\prime}$ as

$\begin{split}\|\sigma_{t}\|&\leq\|f(x_{t}^{f}+\zeta_{t},u_{t}^{s})-f(x_{t}^{f},u_{t}^{a})+f(x_{t}^{a},u_{t}^{a})-f(\hat{x}_{t}^{a},u_{t}^{s})\|\\\
&\leq
2L_{f}(\|\zeta_{t}\|+L_{h_{c}}\kappa_{s}\lambda_{s}^{t}\|\mathpzc{X}_{0}^{a}-\mathpzc{X}_{0}^{s}\|)\end{split}$
(42a)
$\|\sigma^{\prime}_{t}\|\leq\|h(x_{t}^{f}+\zeta_{t})-h(x_{t}^{f})+h(x_{t}^{a})-h(\hat{x}_{t}^{a})\|\leq
2L_{h}\|\zeta_{t}\|$ (42b)

Now, if we define $\mathbf{X}^{f}_{t}=\begin{bmatrix}x_{t}^{f}\\\
\mathpzc{X}_{t}^{a}\end{bmatrix}$, it holds that

$\mathbf{X}^{f}_{t+1}=F(\mathbf{X}^{f}_{t},\mathbf{W}^{\prime}_{t}).$ (43)

with $\mathbf{X}^{f}_{0}=\begin{bmatrix}x_{0}^{f}\\\
\mathpzc{X}_{0}^{a}\end{bmatrix}$ and
$\mathbf{W}^{\prime}_{t}=\begin{bmatrix}w_{t}+\sigma_{t}\\\
v_{t}+\sigma^{\prime}_{t}\end{bmatrix}$. Since $x_{0}^{a}=x_{0}$, it holds
that $\mathbf{X}_{0}-\mathbf{X}^{f}_{0}=\begin{bmatrix}s_{0}\\\
\mathpzc{X}_{0}-\mathpzc{X}_{0}^{a}\end{bmatrix}$ and similar to Theorem 2, we
have $\|\mathbf{X}_{0}-\mathbf{X}^{f}_{0}\|\leq(1+L_{f_{c}}L_{h})\|s_{0}\|$.
On the other hand, since the closed-loop system (23) is IISS, we have

$\begin{split}\|\mathbf{X}&(t,\mathbf{X}_{0},\mathbf{W})-\mathbf{X}^{f}(t,\mathbf{X}^{f}_{0},\mathbf{W}^{\prime})\|\leq\kappa\|\mathbf{X}_{0}-\mathbf{X}^{f}_{0}\|\lambda^{t}\\\
&+\gamma(\|\mathbf{W}-\mathbf{W}^{\prime}\|_{\infty})\leq\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{t}\\\
&+\gamma(\|\sigma_{t}\|_{\infty}+\|\sigma^{\prime}_{t}\|_{\infty})\leq\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{t}\\\
&+\gamma(2(L_{f}+L_{h})\|\zeta_{t}\|+2L_{f}L_{h_{c}}\kappa_{s}\lambda_{s}^{t}\|\mathpzc{X}_{0}^{a}-\mathpzc{X}_{0}^{s}\|),\end{split}$
(44)

where the term $\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{t}$ converges
exponentially fast to zero. For simplicity of the notation, we denote the
$\gamma$ function above simply by $\gamma(t)$ as it is a function of time. The
term $\gamma(t)$ has positive value and will approach to zero as both
$\|\zeta_{t}\|$ and $\|\mathpzc{X}_{0}^{a}-\mathpzc{X}_{0}^{s}\|)$ approach to
zero. Therefore, the trajectories of $\mathbf{X}$ (i.e., the system without
attack) and $\mathbf{X}^{f}$ are within a bounded distance from each other. We
now use these results to show that the generated attack sequence satisfies the
$\epsilon$-stealthiness condition. Due to the space limit, we only show here
the stealthiness for state estimation method using Case 1. The proof for Case
2 can be found in Appendix.

Before finishing the proof, we introduce the lemma (proof in Appendix), and
define $\mathbf{Z}_{t}=\begin{bmatrix}x_{t}\\\ y_{t}^{c}\end{bmatrix}$ and
$\mathbf{Z}_{t}^{f}=\begin{bmatrix}x_{t}^{f}\\\ y_{t}^{c,a}\end{bmatrix}$.

###### Lemma 5

Assume the sequence of
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}^{f}_{0}:\mathbf{Z}^{f}_{t}$ is given for any
$t\geq 0$ and $s_{0}$, $\mathpzc{X}_{-T}$ and $\mathpzc{X}_{0}^{s}$ are chosen
deterministically. Then, the signals $u_{t}^{a}$, $u_{t}^{s}$, $y_{t}^{a}$,
$\hat{x}_{t+1}^{a}$ and $s_{t+1}$ are also uniquely (deterministically)
obtained.

Now, using the monotonicity property of the KL-divergence from Lemma 1 it
holds that

$\begin{split}KL\big{(}&\mathbf{Q}(Y_{-T}^{-1},Y_{0}^{a}:Y_{t}^{a})||\mathbf{P}(Y_{-T}:Y_{t})\big{)}\\\
&\leq
KL\big{(}\mathbf{Q}(\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f})||\mathbf{P}(\mathbf{Z}_{-T}:\mathbf{Z}_{t})\big{)},\end{split}$
(45)

Then, we apply the chain-rule property of KL-divergence on the right-hand side
of (45) to obtain the following

$\begin{split}&KL\big{(}\mathbf{Q}(\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f})||\mathbf{P}(\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}:\mathbf{Z}_{t})\big{)}\\\
&=KL\big{(}\mathbf{Q}(\mathbf{Z}_{-T}^{-1})||\mathbf{P}(\mathbf{Z}_{-T}^{-1})\big{)}+\\\
&\quad\quad\quad\quad
KL\big{(}\mathbf{Q}(\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f}|\mathbf{Z}_{-T}^{-1})||\mathbf{P}(\mathbf{Z}_{0}:\mathbf{Z}_{t}|\mathbf{Z}_{-T}^{-1})\big{)}\\\
&=KL\big{(}\mathbf{Q}(\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f}|\mathbf{Z}_{-T}^{-1})||\mathbf{P}(\mathbf{Z}_{0}:\mathbf{Z}_{t}|\mathbf{Z}_{-T}^{-1})\big{)};\end{split}$
(46)

where we used the fact that the KL-divergence of two identical distributions
(i.e., $\mathbf{Q}(\mathbf{Z}_{-T}^{-1})$ and
$\mathbf{P}(\mathbf{Z}_{-T}^{-1})$ is zero.

Applying the chain-rule property of KL-divergence to (26) results in

$\begin{split}&KL\big{(}\mathbf{Q}(\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f}|\mathbf{Z}_{-T}^{-1})||\mathbf{P}(\mathbf{Z}_{0}:\mathbf{Z}_{t}|\mathbf{Z}_{-T}^{-1})\big{)}\\\
&=\sum_{k=0}^{t}\Big{\\{}KL\big{(}\mathbf{Q}(x_{k}^{f}|\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f})||\mathbf{P}(x_{k}|\mathbf{Z}_{-T}:\mathbf{Z}_{k-1})\big{)}\\\
&+KL\big{(}\mathbf{Q}(y_{k}^{c,a}|x_{k}^{f},\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f})||\mathbf{P}(y_{k}|x_{k},\mathbf{Z}_{-T}:\mathbf{Z}_{k-1})\big{)}\Big{\\}}.\end{split}$
(47)

Given $\mathbf{Z}_{-T}:\mathbf{Z}_{k-1}$, the distribution of $x_{k}$ is a
Gaussian with mean $f(x_{k-1},u_{k-1})$ and covariance $\mathbf{R}_{w}$. On
the other hand, using (41a) and (40) we have

$\begin{split}x_{k}^{f}=&f(x_{k-1}^{f}+s_{k-1},u_{k-1}^{a})-f(\hat{x}_{k-1}^{a},u_{k-1}^{s})\\\
&+f(\hat{x}_{k-1}^{a}-s_{k-1},u_{k-1}^{s})+w_{k-1}.\end{split}$ (48)

Using Lemma 5, given
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f}$ and the fact
that $s_{0}$, $\mathpzc{X}_{-T}$ and $\mathpzc{X}_{0}^{s}$ are deterministic,
$\hat{x}_{k-1}^{a}$, $s_{k-1}$, $u_{k-1}^{s}$ and $u_{k-1}^{a}$ can be
deterministically obtained. Therefore, the distribution of $x_{k}^{f}$ given
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f}$ is a Gaussian
with mean
$f(x_{k-1}^{f}+s_{k-1},u_{k-1}^{a})-f(\hat{x}_{k-1}^{a},u_{k-1}^{s})+f(\hat{x}_{k-1}^{a}-s_{k-1},u_{k-1}^{s})$
and covariance $\mathbf{R}_{w}$. Using (37) and (48), it holds that

$\begin{split}x_{k}^{f}-x_{k}=&f(x_{k-1}^{f}+s_{k-1},u_{k-1}^{a})-f(\hat{x}_{k-1}^{a},u_{k-1}^{s})\\\
&+f(\hat{x}_{k-1}^{a}-s_{k-1},u_{k-1}^{s})-f(x_{k-1},u_{k-1}),\end{split}$
(49)

for all $0\leq k\leq t$. Now, according to Lemmas 2, 3, 4 and equation (49),
for all $0\leq k\leq t$ we have

$\begin{split}&KL\big{(}\mathbf{Q}(x_{k}^{f}|\mathbf{Z}_{-T}:\mathbf{Z}_{k-1}^{f})||\mathbf{P}(x_{k}|\mathbf{Z}_{-T}:\mathbf{Z}_{k-1})\big{)}\\\
&=\mathbb{E}_{\mathbf{Q}(x_{k}^{f},\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f})}\bigg{\\{}(x_{k}-x_{k}^{f})^{T}\mathbf{R}_{w}^{-1}(x_{k}-x_{k}^{f})\bigg{\\}}\\\
&\leq\lambda_{max}(\mathbf{R}_{w}^{-1})\|x_{k}-x_{k}^{f}\|^{2}.\end{split}$
(50)

Given $x_{k}$, the distribution of $y_{k}$ is a Gaussian with mean $h(x_{k})$
and covariance $\mathbf{R}_{v}$. On the other hand, from Lemma 5, we conclude
that given
$x_{k}^{f},\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f}$ is
Gaussian with mean $h(x_{k}^{f})+\sigma^{\prime}_{k}$ and covariance
$\mathbf{R}_{v}$. Thus, using Lemmas 2, 3, 4 and (49), for all $0\leq k\leq t$
we have

$\begin{split}&KL\big{(}\mathbf{Q}(y_{k}^{c,a}|x_{k}^{f},\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f})||\mathbf{P}(y_{k}|x_{k})\big{)}\\\
&\quad=\mathbb{E}_{\mathbf{Q}(x_{k}^{f},\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f})}\Big{\\{}\big{(}h(x_{k}^{f})+\sigma^{\prime}_{k}-h(x_{k})\big{)}^{T}\\\
&\quad\quad\times\mathbf{R}_{v}^{-1}\big{(}h(x_{k}^{f})+\sigma^{\prime}_{t}-h(x_{k})\big{)}\Big{\\}}\leq\lambda_{max}(\mathbf{R}_{v}^{-1})\\\
&\quad\quad\times\Big{(}L_{h}^{2}\|x_{k}-x_{k}^{f}\|^{2}+2L_{h}^{2}b_{\zeta}\|x_{k}-x_{k}^{f}\|+L_{h}^{2}b_{\zeta}^{2}\Big{)}.\end{split}$
(51)

Combining (45)-(51) results in

$\begin{split}KL&\big{(}\mathbf{Q}(Y_{-T}^{-1},Y_{0}^{a}:Y_{t}^{a})||\mathbf{P}(Y_{-T}:Y_{t})\big{)}\\\
\leq&\sum_{k=0}^{t}\Big{\\{}\lambda_{max}(\mathbf{R}_{w}^{-1})\|x_{k}-x_{k}^{f}\|^{2}+\lambda_{max}(\mathbf{R}_{v}^{-1})\\\
&\,\times\Big{(}L_{h}^{2}\|x_{k}-x_{k}^{f}\|^{2}+2L_{h}^{2}b_{\zeta}\|x_{k}-x_{k}^{f}\|+L_{h}^{2}b_{\zeta}^{2}\Big{)}\Big{\\}}.\end{split}$

It is straightforward to verify that

$\begin{split}&\sum_{k=0}^{t}\|x_{k}-x_{k}^{f}\|^{2}\leq\sum_{k=0}^{t}\big{(}\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{k}+\gamma(k)\big{)}^{2}\\\
&=\sum_{k=0}^{t}\Big{(}\kappa^{2}(1+L_{f_{c}}L_{h})^{2}\|s_{0}\|^{2}\lambda^{2k}\\\
&\qquad\qquad+2\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{k}\gamma(k)+\gamma^{2}(k)\Big{)}\\\
&\quad\leq\frac{\kappa^{2}(1+L_{f_{c}}L_{h})^{2}\|s_{0}\|^{2}}{1-\lambda^{2}}+2\frac{\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\gamma(0)}{1-\lambda}\\\
&\qquad\qquad+\sum_{k=0}^{t}\gamma^{2}(k);\end{split}$ (52)

$\begin{split}\sum_{k=0}^{t}\|x_{k}-x_{k}^{f}\|\leq&\sum_{k=0}^{t}\big{(}\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|\lambda^{k}+\gamma(k)\big{)}\\\
\leq&\frac{\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|}{1-\lambda}+\sum_{k=0}^{t}\gamma(k).\end{split}$

Therefore, we get

$\begin{split}K&L\big{(}\mathbf{Q}(Y_{-T}^{-1},Y_{0}^{a}:Y_{t}^{a})||\mathbf{P}(Y_{-T}:Y_{t})\big{)}\leq\\\
&\frac{\kappa^{2}(1+L_{f_{c}}L_{h})^{2}\|s_{0}\|^{2}}{1-\lambda^{2}}\big{(}\lambda_{max}(\mathbf{R}_{w}^{-1})+L_{h}^{2}\lambda_{max}(\mathbf{R}_{v}^{-1})\big{)}+\\\
&\frac{\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|}{1-\lambda}\big{(}2\gamma(0)\lambda_{max}(\mathbf{R}_{w}^{-1})+L_{h}^{2}\lambda_{max}(\mathbf{R}_{v}^{-1})(2\gamma(0)+b_{\zeta})\big{)}\\\
&+\sum_{k=0}^{t}\gamma^{2}(k)\big{(}\lambda_{max}(\mathbf{R}_{w}^{-1})+L_{h}^{2}\lambda_{max}(\mathbf{R}_{v}^{-1})\big{)}\\\
&+\sum_{k=0}^{t}\gamma(k)\big{(}2L_{h}^{2}b_{\zeta}\lambda_{max}(\mathbf{R}_{v}^{-1})\big{)}+\sum_{k=0}^{t}b_{\zeta}^{2}L_{h}^{2}\lambda_{max}(\mathbf{R}_{v}^{-1}).\end{split}$
(53)

Denoting the right-hand side of the above inequality by $b_{\epsilon}$ and
using Theorem 1, the system $\Sigma_{\text{\@slowromancap ii@}}$ will be
$\epsilon$-stealthy attackable with $\epsilon=\sqrt{1-e^{-b_{\epsilon}}}$.

Now, we show that the attack (38a) is also $\alpha$-impactful. Using (36) and
(41a) we have

$\begin{split}x_{t+1}^{a}&=f(x_{t}^{a},u_{t}^{a})+w_{t}=f_{u}(x_{t}^{a},U_{t}^{a})\\\
x_{t+1}^{f}&=f(x_{t}^{f},u_{t}^{a})+w_{t}+\sigma_{t}=f_{u}(x_{t}^{f},{U^{\prime}}_{t}^{a})\end{split}$
(54)

with $U_{t}^{a}=\begin{bmatrix}{u_{t}^{a}}^{T}&w_{t}^{T}\end{bmatrix}^{T}$and
${U^{\prime}}_{t}^{a}=\begin{bmatrix}{u_{t}^{a}}^{T}&(w_{t}+\sigma_{t})^{T}\end{bmatrix}^{T}$,
for $t\in\mathbb{Z}_{\geq 0}$. Using the assumption that the system is IISU,
there exists a nonzero $s_{0}$ such that
$\|x^{a}(t,x_{0}^{a},U^{a})-x^{f}(t,x_{0}^{a}-s_{0},{U^{\prime}}^{a})\|\geq M$
holds for any $M>0$ in $t\geq t^{\prime}$ for some $t^{\prime}$ given
$\|{U}_{t}^{a}-{U^{\prime}}_{t}^{a}\|\leq\|\sigma_{t}\|\leq
2L_{f}(b_{\zeta}+L_{h_{c}}\kappa_{s}\lambda_{s}^{t}\|\mathpzc{X}_{0}^{a}-\mathpzc{X}_{0}^{s}\|)$
for all $t\in\mathbb{Z}_{\geq 0}$. Following the same procedure as in Theorem
2, we can show that it holds that

$\|x^{a}(t,x_{0}^{a},U^{a})-x(t,x_{0}-s_{0},U)\|\geq
M-\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|-\gamma(0),$

where by choosing $M\geq\alpha+\kappa(1+L_{f_{c}}L_{h})\|s_{0}\|+\gamma(0)$,
the attack will be $\alpha$-impactful. Therefore, the system is
($\epsilon$,$\alpha$)-attackable. ∎

Unlike Theorem 2 where the ‘fake’ state converges exponentially fast to the
attack-free state, under the conditions of Theorem 3, the ‘fake’ state will be
within a bounded distance from the attack-free states. Intuitively, depending
on the magnitude of deviation $\gamma$, different levels of stealthiness
guarantees will be obtained, where for smaller values of $b_{\zeta}$ in Case 1
(or $b^{\prime}_{\zeta}$ in Case 2), $\lambda_{s}$ and
$\|\mathpzc{X}_{0}^{s}-\mathpzc{X}_{0}^{a}\|$, the deviation is smaller and
thus, the attack will have stronger stealthier guarantees. The IES condition
in Theorem 3 ensures the estimated input control $u_{t}^{s}$ converges to
actual input control $u_{t}^{a}$ exponentially fast.

The stealthiness can also be verified directly with the right-hand side of the
inequalities (53) and (79) in Theorem 3, respectively. These terms indicate
$b_{\epsilon}$ for $\epsilon=\sqrt{1-e^{-b_{\epsilon}}}$ for each of Cases 1
and 2. As long as the attacker’s estimate of states is more accurate (i.e.,
$b_{\zeta}$ or $b^{\prime}_{\zeta}$ is smaller), then $\epsilon$ is smaller.
However, there is no guarantee that $\epsilon$ approaches to zero when the
estimation error is large. On the other hand, having the initial condition
$\mathpzc{X}_{0}^{s}$ close to $\mathpzc{X}_{0}^{a}$ would help the attack be
stealthier as the function $\gamma(k)$ would be smaller. Ideally, when $s_{0}$
can be chosen arbitrarily close to zero and both $b_{\zeta}$ (or
$b^{\prime}_{\zeta}$ ), $\|\mathpzc{X}_{0}^{s}-\mathpzc{X}_{0}^{a}\|$ approach
to zero, then $\epsilon$ will be close to zero.

We can also observe that having larger noise covariance $\mathbf{R}_{w}$ and
$\mathbf{R}_{v}$ would help the attacker to have a stealthier attack as
$\lambda_{max}(\mathbf{R}_{w}^{-1})$ and $\lambda_{max}(\mathbf{R}_{v}^{-1})$
would be smaller. However, if the attacker only relies on the system’s sensor
measurements for state estimation $\hat{x}_{t}^{a}$ (i.e., Case 1), having
larger levels of noise would also cause larger $b_{\zeta}$ that has negative
impact on attack stealthiness. To avoid this problem, the attacker might use
the side information (Case 2) to have smaller estimation error independent of
system’s noise profile.

###  V-C Vulnerability of Nonlinear, Input Affine Systems

The model (11) is very general and as a result it requires the attacker to
have knowledge about the states and input control (system
$\Sigma_{\text{\@slowromancap i@}}$) or their estimates (system
$\Sigma_{\text{\@slowromancap ii@}}$) to design the stealthy attacks. However,
as we show in this section, ‘simpler’ dynamical models result in some
relaxations on the required knowledge for the attacker to design stealthy
attacks.

For example, consider the plants that can be modeled as888With some abuse of
the notation we again use $f$ as state transition function.

$x_{t+1}=f(x_{t})+Bu_{t}+w_{t}.$ (55)

where $x$, $u$ and $w$ are defined as before and $B\in\mathbb{R}^{m\times n}$.
Such formulation can include systems where the impact of the control input on
states is weighted by a constant matrix or systems with format of
$x_{t+1}=f(x_{t})+g(x_{t})u_{t}+w_{t}$ where the function $g(x)$ has very
small Lipschitz constant.

Let consider the system $\Sigma_{\text{\@slowromancap i@}}$ with plant model
(55). Therefore, when the conditions of Theorem 2 holds such system will be
($\epsilon,\alpha$) attackable. However, generating the attack sequence using
(20) for such system will be as

$\begin{split}s_{t+1}&=f(x_{t}^{a})+Bu_{t}^{a}-f(x_{t}^{a}-s_{t})-Bu_{t}^{a}\\\
&=f(x_{t}^{a})-f(x_{t}^{a}-s_{t})\\\
a_{t}&=h(x_{t}^{a}-s_{t})-h(x_{t}^{a}),\end{split}$ (56)

which means the attacker does not need to have access to input control during
the attack ($u_{t}^{a}$) and such requirement in attack model i@ can be
relaxed. Moreover, the attacker does not need to have knowledge about the
matrix $B$. Similarly, for system $\Sigma_{\text{\@slowromancap ii@}}$ with
input affine plant model (55), the attack sequence generation (38a) in Theorem
3 will also be relaxed as

$\begin{split}s_{t+1}&=f(\hat{x}_{t}^{a})+Bu_{t}^{s}-f(\hat{x}_{t}^{a}-s_{t})-Bu_{t}^{s}\\\
&=f(\hat{x}_{t}^{a})-f(\hat{x}_{t}^{a}-s_{t})\\\
a_{t}&=h(\hat{x}_{t}^{a}-s_{t})-h(\hat{x}_{t}^{a}),\end{split}$ (57)

Therefore, the attacker does not need to have access to the estimate of input
($u_{t}^{s}$), which as a result relaxes the assumption on having the
knowledge about the controller dynamics in attack model ii@ and the matrix
$B$. Moreover, since the estimated input control is not needed, the IES
assumption on the controller dynamics (13) can be removed from Theorem 3.

On the other hand, for such system the upper bound on $\|\sigma_{t}\|$ ((42a)
in Theorem 3) will be smaller as we get $\|\sigma_{t}\|\leq
2L_{f}\|\zeta_{t}\|$. This will help the attacker to have smaller bound on
$\epsilon$ and as a result have stealthier attack.

###  V-D Vulnerability Analysis of LTI Systems

We now derive sufficient conditions for ($\epsilon,\alpha$)-successful attacks
on LTI systems, with (11) and (13) simplified as

$\begin{split}{x}_{t+1}&=Ax_{t}+Bu_{t}+w_{t},\quad y_{t}=Cx_{t}+v_{t},\\\
\mathpzc{X}_{t}&=A_{c}\mathpzc{X}_{t-1}+B_{c}y_{t}^{c},\quad
u_{t}=C_{c}\mathpzc{X}_{t}.\end{split}$ (58)

LTI systems with any linear controller (e.g., LQG controllers) can be captured
in the above form. The following lemma provides the conditions for IES and IU
for the above LTI system.

###### Lemma 6

Consider an LTI dynamical system in the form of $x_{t+1}=Ax_{t}+Bd_{t}$. The
system is IES if and only if all eigenvalues of the matrix $A$ are inside the
unit circle. The system is IU if and only if $A$ has an unstable eigenvalue.

###### Proof:

Let consider two trajectories $x(t,\xi_{1},d)$ and $x(t,\xi_{2},d)$ with
initial conditions $\zeta_{1}$ and $\zeta_{2}$, respectively, and the input
sequence of $d=d_{0}:d_{t-1}$. Now, let define $\Delta
x_{t}=x(t,\xi_{1},d)-x(t,\xi_{2},d)$, which has the dynamics $\Delta
x_{t+1}=A\Delta x_{t}$ with initial condition $\Delta x_{0}=\xi_{1}-\xi_{2}$.
Hence, $\Delta x_{t}$ converge exponentially to zero if and only if the matrix
$A$ has all eigenvalues inside the unit circle. Now, let assume the matrix $A$
is unstable and for any trajectory $x(t,\xi_{1},d)$ consider another
trajectory $x(t,\xi_{2},d)$ with $\xi_{2}=\xi_{1}+cq_{i}$ where $c$ is a
constant and $q_{i}$ is the unstable eigenvector associate with unstable
eigenvalue $\lambda_{i}$ of the matrix $A$. Now, we get $\Delta
x_{t}=A^{t}\Delta x_{0}=c\lambda_{i}^{t}q_{i}$. Since $|\lambda_{i}|>1$, for
any $M>0$, there exists a time step $t^{\prime}$ such that $\|\Delta
x_{t^{\prime}}\|>M$. It is also straightforward to show the converse
direction. ∎

This allows us to directly capture conditions for stealthy yet effective
attacks on LTI systems.

###### Corollary 1

The LTI system (58) is ($\epsilon,\alpha$)-attackable for arbitrarily large
$\alpha$ if the matrix $A$ is unstable and the closed-loop control system is
asymptotically stable.

###### Proof:

The proof is directly obtained by combining Theorem 2 and Lemma 6. ∎

Asymptotic stability of the closed-loop system is not a restrictive assumption
as stability is commonly the weakest required performance guarantee for a
control system. Matrix $A$ being unstable is a sufficient condition for
satisfying ($\epsilon,\alpha$)-attackability when any set of sensors can be
compromised. Note that the ($\epsilon,\alpha$)-attackability condition for LTI
systems with an optimal detector complies with the results from [8, 9] where
LQG controllers with residue based detectors (e.g., $\chi^{2}$ detectors) are
considered.

In this case, the false-data injection attack sequence design method from (20)
reduces into a simple dynamical model

$\begin{split}s_{t+1}&=Ax_{t}^{a}+Bu_{t}^{a}-(A(x_{t}^{a}-s_{t})+Bu_{t}^{a})=As_{t}\\\
a_{t}&=C(x_{t}^{a}-s_{t})-C(x_{t}^{a})=-Cs_{t},\end{split}$ (59)

which only requires knowledge of the matrices $A$ and $C$ unlike the works [8,
9, 10, 13] that assume the attacker has access to the full plant model
information as well as the controller and Kalman filter gain. Similarly, the
attack sequence generated using the attack model ii@ in (38a) for LTI systems
would have the same form as above. As a result, the attacker does not need to
have access to states, input control (or their estimates) and therefore, both
attack models fall into the same attack model where the attacker only needs to
know the matrices $A$ and $C$.

As discussed, $s_{t}$ is a measure of the distance between $x_{t}^{a}$ and
$x_{t}$; thus, for impactful attacks, $s_{t}$ in (59) needs to dynamically
grow over time, and $s_{0}$ needs to be in the subspace of unstable
eigenvectors of matrix $A$. For example, if $q_{i}$ is the eigenvector
associated with unstable eigenvalue $\lambda_{i}$, for $s_{0}=cq_{i}$ we get
$s_{t}=c\lambda_{i}^{t}q_{i}$, where $c$ can be chosen by the attacker. Using
Theorem 2 we have $\|x_{t}^{a}-x_{t}\|\geq
c\lambda_{i}^{t}q_{i}-(1+\|A_{c}\|\|C\|)c\|q_{i}\|$ resulting in large
deviation in states for arbitrarily large time steps.

On the other hand, if the condition of Corollary 1 holds and the attack is
generated using (59), then the attack is $\epsilon$-stealthy. From Theorem 2,
we have $\epsilon=\sqrt{1-e^{-b_{\epsilon}}}$ with

$b_{\epsilon}=\frac{c^{2}\|q_{i}\|^{2}}{1-\lambda_{c}^{2}}\big{(}\lambda_{max}(\mathbf{R}_{w}^{-1})+\|C\|^{2}\lambda_{max}(\mathbf{R}_{v}^{-1})\big{)}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}b_{\epsilon},$

where we used $s_{0}=cq_{i}$, and $\lambda_{c}$ is the decay rate of the
closed-loop system and all parameters are defined as before. Since all
parameters above are characterized by the system except $c$, the attacker can
choose the scalar $c$ arbitrarily close to zero to have arbitrarily nonzero
small $\epsilon$.

###### Remark 5

We initially assumed that $\mathcal{K}=\mathcal{S}$; i.e., the attacker can
compromise all sensors. However, when the system is LTI, the minimum subset of
compromised sensors can be obtained as
$\min_{q_{i}\in\\{q_{1},...,q_{f}\\}}\|\text{supp}(Cq_{i})\|_{0}$, where
$\\{q_{1},...,q_{f}\\}$ denotes the set of unstable eigenvectors of the matrix
$A$, and supp denotes the set of nonzero elements of the vector.

##  VI The Impact of Stealthy Attack

In this section, we evaluate the impact of the stealthy attack from (20) on
state estimation. Here, as an example we consider EKF; however, the results
can be extended to any other nonlinear Luenberger type observer. When the
sensors are attack free, the state estimates of (11) are updated as

$\begin{split}\hat{x}_{t|t-1}&=f(\hat{x}_{t-1},{u}_{t-1}),\\\
\hat{x}_{t}&=\hat{x}_{t|t-1}+L(y_{t}^{c}-h(\hat{x}_{t|t-1})),\end{split}$ (60)

where $L$ is the observer gain that is assumed in steady state. We assume that
the control input $u_{t}$ is obtained by the state estimate $\hat{x}_{t}$ as
$u_{t}=K(\hat{x}_{t})$. Thus, the estimation dynamics is

$\hat{x}_{t}=f(\hat{x}_{t-1},K(\hat{x}_{t-1}))+L(y_{t}^{c}-h(f(\hat{x}_{t-1},K(\hat{x}_{t-1})))),$

which is a special form of (13). Now, the dynamics of the closed-loop system
can be captured as

$\mathbf{X}_{t+1}^{\prime}=F^{\prime}(\mathbf{X}_{t}^{\prime},\mathbf{W}_{t})$
(61)

where we define the full state of the closed-loop system as
$\mathbf{X}^{\prime}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}\begin{bmatrix}{x}_{t}^{T}&\hat{x}_{t}^{T}\end{bmatrix}^{T}$,
and exogenous disturbances as
$\mathbf{W}_{t}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}\begin{bmatrix}w_{t}^{T}&{v}_{t+1}^{T}&v_{t}^{T}\end{bmatrix}^{T}$
similar defined as in (14). In what follows, we provide the condition such
that there exists a sequence of $(\epsilon,\alpha)$-attacks for which the
estimate of states during the attack converges exponentially fast to attack
free case.

###### Theorem 4

If the closed-loop system (61) with attack model i@ is IES and the open loop
system (12) is IU, then there exists a sequence of $(\epsilon,\alpha)$-attacks
such that

$\|\hat{x}_{t}^{f}-\hat{x}_{t}\|\leq\eta\lambda^{t}$

for some positive $\lambda<1$ and some $\eta>0$.

###### Proof:

In the proof of Theorem 2, we showed that if the closed-loop system (61) is
IES and the open-loop system (12) is IU, then the system is
($\epsilon,\alpha$-attackable), i.e., a sequence of attacks generated by (20)
will cause $\alpha$ deviation in the states while remaining
$\epsilon$-stealthy. Now, we will show the impact of such attack on the state
estimation.

Similar to Theorem 2, by defining
$x_{t}^{f}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}x_{t}^{a}-s_{t}$
we get

$\begin{split}x_{t+1}^{f}=&f(x_{t}^{f},K(\hat{x}_{t}^{f}))+w_{t}^{a},\quad
y_{t}^{c,a}=h(x_{t}^{f})+v_{t}^{a},\\\
\hat{x}_{t}^{f}=&f(\hat{x}_{t-1}^{f},K(\hat{x}_{t-1}^{f}))+L(y_{t}^{c,a}-h(f(\hat{x}_{t-1},K(\hat{x}_{t-1}))))\end{split}$
(62)

On the other hand, if the system were not under attack during
$t\in\mathbb{Z}_{\geq 0}$, the plant and the state estimation evolution would
satisfy

$\begin{split}x_{t+1}=&f(x_{t},K(\hat{x}_{t}))+w_{t},\quad
y_{t}^{c}=h(x_{t})+v_{t},\\\
\hat{x}_{t}=&f(\hat{x}_{t-1},K(\hat{x}_{t-1}))+L(y_{t}^{c}-h(f(\hat{x}_{t-1},K(\hat{x}_{t-1}))))\end{split}$
(63)

Since the system and measurement noises are independent of the state, we can
assume that $w_{t}^{a}=w_{t}$ and $v_{t}^{a}=v_{t}$. By defining
$\mathbf{X}^{\prime
f}_{t}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}\begin{bmatrix}({x}_{t}^{f})^{T}&(\hat{x}_{t}^{f})^{T}\end{bmatrix}^{T}$,
the dynamics (62) and (63) can be written as $\mathbf{X}_{t+1}^{\prime
f}=F^{\prime}(\mathbf{X}_{t}^{\prime f},\mathbf{W}_{t})$ and
$\mathbf{X}_{t+1}^{\prime}=F^{\prime}(\mathbf{X}_{t}^{\prime},\mathbf{W}_{t})$.
Since both these dynamics are subject to the same input and the system
dynamics is IES, there exist $\kappa>1$ and $\lambda<1$ such that

$\begin{split}\|\mathbf{X}_{t}^{\prime
f}-\mathbf{X}_{t}^{\prime}\|\leq\kappa\|\mathbf{X}_{0}^{\prime
f}-\mathbf{X}_{0}^{\prime}\|\lambda^{t}\end{split}$ (64)

with $\mathbf{X}_{0}^{\prime
f}-\mathbf{X}_{0}^{\prime}=\begin{bmatrix}x_{0}^{f}-x_{0}\\\
\hat{x}_{0}^{f}-\hat{x}_{0}\end{bmatrix}=\begin{bmatrix}s_{0}\\\
\hat{x}_{0}^{f}-\hat{x}_{0}\end{bmatrix}$; thus, we have

$\begin{split}\hat{x}_{0}^{f}-\hat{x}_{0}=L(y^{c,a}_{0}-y_{0}^{c})=L(h(x_{0}-s_{0})-h(x_{0}))\end{split}$
(65)

where we used the fact that attack starts at $t=0$; i.e.,
$\hat{x}^{f}_{-1}=\hat{x}_{-1}$ and $x_{0}^{a}=x_{0}$. Therefore, we get
$\|\mathbf{X}_{0}^{\prime
f}-\mathbf{X}_{0}^{\prime}\|\leq(1+\|L\|L_{h})\|s_{0}\|$. As a result we get

$\begin{split}\|\hat{x}_{t}^{f}-\hat{x}_{t}\|\leq\|\mathbf{X}_{t}^{\prime
f}-\mathbf{X}_{t}^{\prime}\|\leq\kappa(1+\|L\|L_{h})\|s_{0}\|\lambda^{t},\end{split}$
(66)

and finally, for $\eta=\kappa(1+\|L\|L_{h})\|s_{0}\|$, it holds that
$\|\hat{x}_{t}^{f}-\hat{x}_{t}\|\leq\eta\lambda^{t}$. ∎

For LTI plants where a linear Kalman filter is used for state estimation and
the LQR controller is used to control the plant, the closed-loop system
satisfies

$\displaystyle{x}_{t+1}$ $\displaystyle=Ax_{t}+Bu_{t}+w_{t},\quad
y_{t}=Cx_{t}+v_{t},$ $\displaystyle\hat{x}_{t}$
$\displaystyle=A\hat{x}_{t-1}+Bu_{t-1}+L(y_{t}^{c}-C(A\hat{x}_{t-1}+Bu_{t-1})),$
$\displaystyle u_{t}$ $\displaystyle=K\hat{x}_{t};$ (67)

here, $K$ and $L$ are obtained by solving algebraic Riccati equations. When
the system is observable and controllable, the obtained $K$ and $L$ are
stabilizing the closed-loop system [32].

###### Corollary 2

Consider the closed-loop system (VI) with pairs $(A,B)$ and $(A,C)$
controllable and observable, respectively. If matrix $A$ is unstable, then
there exists a sequence of $(\epsilon,\alpha)$-attacks such that
$\|\hat{x}_{t}^{f}-\hat{x}_{t}\|\leq\eta\lambda^{t}$ for some positive
$\lambda<1$ and some $\eta>0$.

###### Proof:

Since the system is controllable and observable, $K$ and $L$ in the LQG
controller are stabilizing the closed-loop system (VI); thus, from Lemma 6 the
closed-loop system is IES. The rest of the proof follows the proof of Theorem
4. ∎

Hence, for LTI systems with LQG controllers, the attack generated by (59)
causes the state estimation during the attack to converge exponentially fast
to attack-free state estimates. This result is important as it shows the
changes in estimation of states are small due to the attack and the defender
cannot detect the presence of attack by observing the state estimates.

##  VII Simulation Results

We illustrate and evaluate our methodology for vulnerability analysis of
nonlinear control systems on two case studies, cart-pole and unmanned aerial
vehicles (UAVs).

###  VII-A Cart-pole

We use the dynamics of the cart-pole system [33]

$\begin{split}\ddot{\theta}&=\frac{g\sin\theta+\cos\theta\big{(}\frac{-F-M_{p}l\dot{\theta}^{2}\sin\theta}{M_{c}+M_{p}}\big{)}}{l\big{(}\frac{4}{3}-\frac{M_{p}\cos^{2}\theta}{M_{c}+M_{p}}\big{)}}\\\
\ddot{x}&=\frac{F+M_{p}l(\dot{\theta}^{2}\sin\theta-\ddot{\theta}\cos\theta)}{M_{c}+M_{p}};\end{split}$
(68)

here, $\theta$ is the pendulum angle from vertical, $x$ is the cart position
along the track, and $F$ is the control torque applied to the pivot, $g=9.81$
is the acceleration due to gravity, $M_{c}=1~{}\textit{Kg}$ is the mass of the
cart and $M_{p}=0.1~{}\textit{Kg}$ is the mass of the pole. The length of the
pole is $2l=1~{}\textit{m}$. We assume that only $x$ and $\theta$ are directly
measured and the system is equipped with an EKF to estimate system states.

The system and measurement noise are $\mathbf{R}_{w}=\sigma^{2}I$ and
$\mathbf{R}_{v}=\sigma^{2}I$ where $I$ is identity matrix with suitable
dimension. Moreover, a feedback full state controller that uses estimated
states by the EKF was used to keep the pendulum inverted around $\theta=0$ and
$x=0$ equilibrium point. To detect the presence of attack, we consider two
standard widely-used IDs – i.e., $\chi^{2}$ and cumulative sum (CUSUM)
detectors [34]. For each ID, the residue is obtained by comparing the current
received sensor measurement and the expected measurement. We set the
thresholds for both these detectors to $p^{FA}=0.002$.

(a)

(b)

Figure 3: (a) The angle of the pendulum rod over time while the LTI-based
attack starts at time zero. (b) The alarm rate for LTI-based attack on Cart-
pole system over 5000 experiments.

Fig. 3 shows ineffectiveness of LTI attacks on Cart-pole system with actual
nonlinear dynamics (68) and $\sigma^{2}=0.001$. The LTI attack was designed
according to (59), where $A$ was obtained by linearizing the nonlinear
dynamics (68) around the equilibrium point at zero. The attack starts at $t=0$
with initial condition $\|s_{0}\|=10^{-7}$. Fig. 3(a) shows the evolution of
rod’s angle over time, while Fig. 3(b) shows the average alarm rate for the
CUSUM detector under the LTI-based attack. The zoomed area highlights that
when the rod’s angle starts deviating from zero, the the alarm rate of the ID
increases over time. Specifically, for $0.4\,rad=22.9^{\circ}$, $p^{TD}$ is
almost ten times larger than $p^{FA}$. This demonstrates the limitation of the
LTI-based attacks as the LTI approximation of a nonlinear model is only valid
for the region around the equilibrium point and as the system moves away from
equilibrium point, the approximation error significantly increases.

For the attack model i@, we used the attack sequence (20). Fig. 4(a) shows
$\epsilon$ versus different norm values of the initial condition $s_{0}$ for
fixed $\sigma^{2}=0.001$. By increasing the norm of the initial condition,
$\epsilon$ also increases making the attack likelier to be detected. However,
choosing the initial condition close to zero (i.e., with a very small norm)
has a side effect that it takes more time until the attack becomes effective
as illustrated in Fig. 4(b). Hence, there is a trade-off between attack
stealthiness and time before it becomes effective. The impact of noise
variance on attack stealthiness is also considered, in Fig. 4(c) where for a
fixed $\|s_{0}\|=10^{-8}$, we show that increasing the noise power
$\sigma^{2}$ decreases the value of $\epsilon$.

In Fig. 4(d) and 4(e), we considered the impact of attacker’s state estimation
error, $b_{\zeta}$ in attack model ii@, on the detection rate of CUSUM and
$\chi^{2}$ detectors when $\|s_{0}\|=10^{-8}$. Having inaccurate estimate with
$b_{\zeta}=0.5$ can result in attack detection, while more accurate estimate
($b_{\zeta}=0.05$) improves attack stealthiness. Fig. 4(f) shows the evolution
of rod’s angle over time for different values of $b_{\zeta}$ – after
initiating the attack at $t=0$, the rod angle increases over time in both
cases.

(a)

(b)

(c)

(d)

(e)

(f)

Figure 4: (a,b) $\epsilon$ and falling time of the pendulum rod versus
$\|s_{0}\|$, for $\sigma^{2}=10^{-3}$. (c) The impact of system and
measurement noise power $\sigma^{2}$ on attack stealthiness $\epsilon$ for
$\|s_{0}\|=10^{-8}$; (d,e) The alarm rate for CUSUM and $\chi^{2}$ intrusion
detectors before and after the attack (attack starts at time $t=0$) for
different values of $b_{\zeta}$ over 5000 experiments for $\|s_{0}\|=10^{-8}$
and $\sigma^{2}=10^{-3}$; (f) The trajectories of the pendulum rod angle
versus time for different values of $b_{\zeta}$.

###  VII-B Unmanned Aerial Vehicles

We also considered a quadrotor with complex highly nonlinear model from [35]
that has 12 states
$\begin{bmatrix}x,\,y,\,z,\,\dot{x},\,\dot{y},\,\dot{z},\,\phi,\,\theta,\,\psi,\,\dot{\phi},\,\dot{\theta},\,\dot{\psi}\end{bmatrix}^{T}$;
$x$, $y$ and $z$ represent the quadrotor position along the $X$, $Y$ and $Z$
axis, respectively, while $\dot{x}$, $\dot{y}$ and $\dot{z}$ are their
velocity. $\phi$, $\theta$ and $\psi$ are pitch, roll and yaw angles
respectively, and $\dot{\phi}$, $\dot{\theta}$ and $\dot{\psi}$ represent
their corresponding angular velocity. The system was discretized using Euler
method with $T_{s}=0.01s$. The states
$\begin{bmatrix}x,\,y,\,z,\,\phi,\,\theta,\,\psi,\dot{\phi},\,\dot{\theta},\,\dot{\psi}\end{bmatrix}^{T}$
were measured with zero-mean Gaussian noise with the covariance matrix
$\mathbf{R}_{v}=0.001I$.

We assumed standard disturbance on the input modeled by system noise with zero
mean Gaussian with the covariance matrix $\mathbf{R}_{w}=0.001I$. The system
employs an EKF to estimate the states and a PID controller to control the
drone. To detect the presence of any abnormal behaviour, CUSUM and $\chi^{2}$
IDs were deployed with the threshold fixed to $p^{FA}=0.002$.

We considered the position control task [35], where the drone takes off from
(0,0,0) in global coordinate and reaches to predefined point in the space
$(0,0,10m)$ and stays there (see the black line trajectory in Fig. 6). Once
the drone reaches to that point, the attack starts (it should be noted that
there is no limitation for the attacker on the starting time of the attack and
our assumption here is just to illustrate the results better).

For attack model i@ with generated attack sequence as (20), Fig. 5(a) shows
the impact of $\|s_{0}\|$ on attack stealthiness. The results again show that
a larger norm of the initial condition $s_{0}$ results in an increased attack
detection rate. For the attack model i@ where the attacker generates attack
sequence by (38) using case 1 and $\|s_{0}\|=10^{-5}$ from $t=0$, Fig. 5(a)
shows the alarm rate of CUSUM and $\chi^{2}$ IDs for 50 seconds.

We also showed that by fixing $\|s_{0}\|=10^{-5}$, and changing the nonzero
elements of the $s_{0}$ the attacker can control the direction of the drone’s
deviation (see Fig. 6). Assuming that the attack starts at the red square,
Fig. 6(a) shows that by placing a positive nonzero value on the element
$s_{0}$ associated with pitch angle ($\phi$) causes the drone to deviate
$20~{}m$ in negative $Y$-axis in $50~{}s$. Such negative $s_{0}$ results on
the drone’s deviation in the positive direction of $Y$ axis. It also shows
that putting the nonzero element in roll angle can cause the deviation along
with $X$ axis. However, if the attacker uses the combination of both, the
drone deviates in both $X$ and $Y$ axis ( Fig. 6(b)).

(a)

(b)

(c)

Figure 5: (a) $\epsilon$ versus $\|s_{0}\|$, for $\sigma^{2}=10^{-3}$ in UAV
case study. (b,c) The alarm rate for CUSUM and $\chi^{2}$ intrusion detectors
before and after the attack start time ($t=0$) for case 1 (the attacker uses
system’s sensors to estimate the states) over 5000 experiments for
$\|s_{0}\|=10^{-5}$ and $\sigma^{2}=10^{-3}$.

(a)

(b)

Figure 6: (a,b) The trajectory of the drone for different initial conditions
on $s$ with the attack starting at red square.

##  VIII Conclusion

In this paper, we focused on vulnerability analysis for nonlinear control
systems with Gaussian noise, when attacker can compromise sensor measurements
from any subset of sensors. Notions of strict stealthiness and
$\epsilon$-stealthiness were defined, and we showed that these notions are
independent of the deployed intrusion detector. Using the KL-divergence, we
presented conditions for the existence of stealthy yet effective attacks.
Specifically, we defined the $(\epsilon,\alpha)$-successful attacks where the
goal of the attacker is to be $\epsilon$-stealthy while causing deviation in
the trajectory of states with respect to system’s own desired unattacked
trajectory, determined by the parameter $\alpha$. Depending on the level of
attacker’s knowledge about the plant model, controller, and the system states,
two different attack models are considered and for each attack model, we then
derived a condition for which there exists a sequence of such
$(\epsilon,\alpha)$-successful false-data injection attacks. We also provided
the results for LTI systems, showing that they are compatible with the
existing results for LTI systems and $\chi^{2}$-based detectors. Finally, we
considered the impact of stealthy attacks on state estimation, and showed that
if the the closed-loop control system including the estimator is incrementally
stable, then the state estimation in the presence of attack converges to the
attack-free estimates.

## References

  * [1] T. Chen and S. Abu-Nimeh, “Lessons from stuxnet,” _Computer_ , vol. 44, no. 4, pp. 91–93, 2011.
  * [2] A. Teixeira, I. Shames, H. Sandberg, and K. H. Johansson, “Revealing stealthy attacks in control systems,” in _2012 50th Annual Allerton Conference on Communication, Control, and Computing (Allerton)_. IEEE, 2012, pp. 1806–1813.
  * [3] T. Sui, Y. Mo, D. Marelli, X. Sun, and M. Fu, “The vulnerability of cyber-physical system under stealthy attacks,” _IEEE Transactions on Automatic Control_ , vol. 66, no. 2, pp. 637–650, 2020.
  * [4] Y. Mo and B. Sinopoli, “Secure control against replay attacks,” in _2009 47th Annual Allerton Conference on Communication, Control, and Computing (Allerton)_. IEEE, 2009, pp. 911–918.
  * [5] Y. Mo, R. Chabukswar, and B. Sinopoli, “Detecting integrity attacks on scada systems,” _IEEE Transactions on Control Systems Technology_ , vol. 22, no. 4, pp. 1396–1407, 2013.
  * [6] R. S. Smith, “Covert misappropriation of networked control systems: Presenting a feedback structure,” _IEEE Control Systems Magazine_ , vol. 35, no. 1, pp. 82–92, 2015.
  * [7] Y. Liu, P. Ning, and M. K. Reiter, “False data injection attacks against state estimation in electric power grids,” _ACM Transactions on Information and System Security (TISSEC)_ , vol. 14, no. 1, pp. 1–33, 2011.
  * [8] Mo, Yilin and Sinopoli, Bruno, “False data injection attacks in control systems,” in _First workshop on Secure Control Systems_ , 2010, pp. 1–6.
  * [9] I. Jovanov and M. Pajic, “Relaxing integrity requirements for attack-resilient cyber-physical systems,” _IEEE Transactions on Automatic Control_ , vol. 64, no. 12, pp. 4843–4858, Dec 2019.
  * [10] C. Kwon, W. Liu, and I. Hwang, “Analysis and design of stealthy cyber attacks on unmanned aerial systems,” _Journal of Aerospace Information Systems_ , vol. 11, no. 8, pp. 525–539, 2014.
  * [11] A. Khazraei and M. Pajic, “Attack-resilient state estimation with intermittent data authentication,” _Automatica_ , vol. 138, p. 110035, 2022.
  * [12] A. Khazraei and M. Pajic, “Perfect attackability of linear dynamical systems with bounded noise,” in _2020 American Control Conference (ACC)_ , 2020, pp. 749–754.
  * [13] T.-Y. Zhang and D. Ye, “False data injection attacks with complete stealthiness in cyber–physical systems: A self-generated approach,” _Automatica_ , vol. 120, p. 109117, 2020.
  * [14] J. Shang and T. Chen, “Optimal stealthy integrity attacks on remote state estimation: The maximum utilization of historical data,” _Automatica_ , vol. 128, p. 109555, 2021.
  * [15] C.-Z. Bai, F. Pasqualetti, and V. Gupta, “Data-injection attacks in stochastic control systems: Detectability and performance tradeoffs,” _Automatica_ , vol. 82, pp. 251–260, 2017.
  * [16] C.-Z. Bai, V. Gupta, and F. Pasqualetti, “On kalman filtering with compromised sensors: Attack stealthiness and performance bounds,” _IEEE Trans. Automatic Control_ , vol. 62, no. 12, pp. 6641–6648, 2017.
  * [17] C. Fang, Y. Qi, J. Chen, R. Tan, and W. X. Zheng, “Stealthy actuator signal attacks in stochastic control systems: Performance and limitations,” _IEEE Trans. on Automatic Control_ , vol. 65, no. 9, pp. 3927–3934, 2019\.
  * [18] Q. Zhang, K. Liu, Y. Xia, and A. Ma, “Optimal stealthy deception attack against cyber-physical systems,” _IEEE transactions on cybernetics_ , vol. 50, no. 9, pp. 3963–3972, 2019.
  * [19] J. Shang, H. Yu, and T. Chen, “Worst-case stealthy attacks on stochastic event-based state estimation,” _IEEE Transactions on Automatic Control_ , vol. 67, no. 4, pp. 2052–2059, 2021.
  * [20] A. Khazraei, H. Pfister, and M. Pajic, “Attacks on perception-based control systems: Modeling and fundamental limits,” _arXiv preprint arXiv:2206.07150_ , 2022.
  * [21] H. Sasahara, T. Tanaka, and H. Sandberg, “Attack impact evaluation by exact convexification through state space augmentation,” in _2022 IEEE 61st Conference on Decision and Control (CDC)_ , 2022, pp. 7084–7089.
  * [22] K. Zhang, C. Keliris, T. Parisini, and M. M. Polycarpou, “Stealthy integrity attacks for a class of nonlinear cyber-physical systems,” _IEEE Transactions on Automatic Control_ , 2021.
  * [23] A. Khazraei, S. Hallyburton, Q. Gao, Y. Wang, and M. Pajic, “Learning-based vulnerability analysis of cyber-physical systems,” _International Conference on Cyber-Physical Systems (ICCPS)_ , 2022.
  * [24] D. Angeli, “A lyapunov approach to incremental stability properties,” _IEEE Trans. on Automatic Control_ , vol. 47, no. 3, pp. 410–421, 2002.
  * [25] D. N. Tran, B. S. Rüffer, and C. M. Kellett, “Convergence properties for discrete-time nonlinear systems,” _IEEE Transactions on Automatic Control_ , vol. 64, no. 8, pp. 3415–3422, 2018.
  * [26] D. N. Tran, B. S. Rüffer, and C. M. Kellett, “Incremental stability properties for discrete-time systems,” in _2016 IEEE 55th Conference on Decision and Control (CDC)_. IEEE, 2016, pp. 477–482.
  * [27] Y. Polyanskiy and Y. Wu, “Information theory: From coding to learning,” 2022.
  * [28] A. J. Kerns, D. P. Shepard, J. A. Bhatti, and T. E. Humphreys, “Unmanned aircraft capture and control via gps spoofing,” _Journal of Field Robotics_ , vol. 31, no. 4, pp. 617–636, 2014.
  * [29] V. Lesi, I. Jovanov, and M. Pajic, “Network scheduling for secure cyber-physical systems,” in _2017 IEEE Real-Time Systems Symposium (RTSS)_ , Dec 2017, pp. 45–55.
  * [30] V. Lesi, I. Jovanov, and M. Pajic, “Integrating security in resource-constrained cyber-physical systems,” _ACM Trans. Cyber-Phys. Syst._ , vol. 4, no. 3, May 2020.
  * [31] A. Khazraei, H. Pfister, and M. Pajic, “Resiliency of perception-based controllers against attacks,” in _4th Annual Learning for Dynamics and Control Conference_ , vol. 168. PMLR, 23–24 Jun 2022, pp. 713–725.
  * [32] J. B. Burl, _Linear optimal control: H (2) and H (Infinity) methods_. Addison-Wesley Longman Publishing Co., Inc., 1998.
  * [33] R. V. Florian, “Correct equations for the dynamics of the cart-pole system,” _Center for Cognitive and Neural Studies (Coneural)_ , 2007.
  * [34] D. Umsonst, H. Sandberg, and A. A. Cárdenas, “Security analysis of control system anomaly detectors,” in _2017 American Control Conference (ACC)_. IEEE, 2017, pp. 5500–5506.
  * [35] S. Bouabdallah and R. Siegwart, “Full control of a quadrotor,” in _2007 IEEE Int. Conf. on Intelligent Robots and Systems_ , 2007, pp. 153–158.

## Appendix

Proof of Lemma 5:

###### Proof:

According to (38c) and (38d), $\mathpzc{X}_{0}^{s}$ and
$y_{0}^{c,a}:y_{i}^{c,a}$ are sufficient to determine $u_{i}^{s}$ for any
$i\geq 0$ as rewrite $u_{i}^{s}$ as

$u_{i}^{s}=F_{u_{i}^{s}}(\mathpzc{X}_{0}^{s},y_{0}^{c,a}:y_{i}^{c,a}),$ (69)

where $F_{u_{i}^{s}}$ is an deterministic mapping. Therefore, given
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}^{f}_{0}:\mathbf{Z}^{f}_{t}$ we can determine
$u_{i}^{s}$ for any $0\leq i\leq t$. Similarly, using (36) and (19),
$\mathpzc{X}_{-T}$, $y_{-T}^{c}:y_{-1}^{c}$ and $y_{0}^{c,a}:y_{i}^{c,a}$ are
sufficient to determine $u_{i}^{a}$ for any $i\geq 0$. Alternatively, for some
deterministic mapping $F_{u_{i}^{a}}$ we have

$u_{i}^{a}=F_{u_{i}^{a}}(\mathpzc{X}_{-T},y_{-T}^{c}:y_{-1}^{c},y_{0}^{c,a}:y_{i}^{c,a}).$
(70)

This means if $\mathbf{Z}_{-T}^{-1},\mathbf{Z}^{f}_{0}:\mathbf{Z}^{f}_{t}$ are
given, then $u_{i}^{a}$ will also be directly obtained for any $0\leq i\leq
t$.

Using (34), we have
$\hat{x}^{a}_{0}=\mathcal{E}_{0}(y_{-\mathcal{T}}^{c}:y_{-1}^{c})$ which means
that if we have $y_{-\mathcal{T}}^{c}:y_{-1}^{c}$, then we can determine
$\hat{x}_{0}$. On the other hand, using (39) we have

$y_{t}^{a}=y_{t}^{c,a}+h(\hat{x}_{t}^{a})-h(\hat{x}_{t}^{a}-s_{t}).$ (71)

Thus, given $y_{0}^{c,a}$ and $\hat{x}_{0}^{a}$ and $s_{0}$, we can determine
$y_{0}^{a}$. Since we already showed $y_{-\mathcal{T}}^{c}:y_{-1}^{c}$
determines $\hat{x}_{0}^{a}$, therefore, $y_{0}^{a}$ will be determined by
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}^{f}_{0}:\mathbf{Z}^{f}_{t}$ – this sequence
includes $y_{-\mathcal{T}}^{c}:y_{-1}^{c}$. Now, according to (38a), $s_{1}$
is determined by $s_{0}$, $\hat{x}_{0}$ and $u_{0}^{s}$, and since all these
signal are determined by
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}^{f}_{0}:\mathbf{Z}^{f}_{t}$, therefore,
$s_{1}$ is also determined. Now, since $y_{0}^{a}$ is determined by this
sequence, using
$\hat{x}^{a}_{1}=\mathcal{E}_{1}(y_{-\mathcal{T}}^{c}:y_{-1}^{c},y_{0}^{a})$
we can determine $\hat{x}^{a}_{1}$. This process can continue by induction
until time $t$ for which $y_{t}^{a}$, $s_{t+1}$ and $\hat{x}_{t+1}^{a}$ will
be determined by $\mathbf{Z}_{-T}^{-1},\mathbf{Z}^{f}_{0}:\mathbf{Z}^{f}_{t}$.
∎

Proof of Case 2 in Theorem 3:

We start by introducing the following lemma.

###### Lemma 7

Assume the sequence of
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}^{f}_{0}:\mathbf{Z}^{f}_{t},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t}$
are given for any $t\geq 0$ and $s_{0}$, $\mathpzc{X}_{-T}$ and
$\mathpzc{X}_{0}^{s}$ are chosen deterministically. Then, the signals
$u_{t}^{a}$, $u_{t}^{s}$, $\hat{x}_{t}^{a}$ and $s_{t+1}$ are also uniquely
(deterministically) obtained.

###### Proof:

We already proved in Lemma 5 that given
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}^{f}_{0}:\mathbf{Z}^{f}_{t}$, we can determine
$u_{t}^{a}$, $u_{t}^{s}$. Now, using (34), we have
$\hat{x}^{a}_{0}=\mathcal{E}^{\prime}_{0}(y^{\prime}_{-\mathcal{T}}:y^{\prime}_{-1},{y^{\prime
a}_{0}})$ where $y^{\prime}_{k}=h^{\prime}(x_{k})+v^{\prime}_{k}$ for any
$-\mathcal{T}\leq k\leq-1$ and $y^{\prime
a}_{0}=h^{\prime}(x_{0})+v^{\prime}_{0}$. Given
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}^{f}_{0}$ and
$v^{\prime}_{-\mathcal{T}}:v^{\prime}_{0}$, then
$y^{\prime}_{-\mathcal{T}}:y^{\prime}_{-1},{y^{\prime a}_{0}}$ are determined
and therefore, $\hat{x}^{a}_{0}$ is determined. Using (38a) and the fact that
$s_{0}$ and $u_{0}^{s}$ are deterministic, we can conclude that $s_{1}$ is
also deterministic. For
$\hat{x}^{a}_{1}=\mathcal{E}^{\prime}_{0}(y^{\prime}_{-\mathcal{T}}:y^{\prime}_{-1},{y^{\prime
a}_{0}},{y^{\prime a}_{1}})$, we have ${y^{\prime
a}_{1}}=h^{\prime}(x_{1}^{a})+v^{\prime}_{1}=h^{\prime}(x_{1}^{f}+s_{1})+v^{\prime}_{1}$.
Therefore, given $s_{1}$ deterministic and having
$\mathbf{Z}^{f}_{1},v^{\prime}_{1}$, then $y^{\prime}_{1}$ will be
deterministic. As a result, $\hat{x}_{1}$ is deterministic. This process can
continue until time $t$ where we can conclude $\hat{x}_{t}^{a}$ and $s_{t+1}$
are deterministic given the sequence in Lemma 7. ∎

Using the monotonicity property of the KL-divergence from Lemma 1 it holds
that

$\begin{split}K&L\big{(}\mathbf{Q}(Y_{-T}^{-1},Y_{0}^{a}:Y_{t}^{a})||\mathbf{P}(Y_{-T}:Y_{t})\big{)}\\\
\leq&KL\big{(}\mathbf{Q}(\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})||\mathbf{P}(\mathbf{Z}_{-T}:\mathbf{Z}_{t},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})\big{)}.\end{split}$
(72)

Then, we apply the chain-rule property of KL-divergence on the right-hand side
of (45) to obtain the following

$\begin{split}&KL\big{(}\mathbf{Q}(\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})||\mathbf{P}(\mathbf{Z}_{-T}:\mathbf{Z}_{t},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})\big{)}\\\
&=KL\big{(}\mathbf{Q}(\mathbf{Z}_{-T}^{-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})||\mathbf{P}(\mathbf{Z}_{-T}^{-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})\big{)}+\\\
&KL\big{(}\mathbf{Q}(\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f}|\mathbf{Z}_{-T}^{-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})||\mathbf{P}(\mathbf{Z}_{0}:\mathbf{Z}_{t}|\mathbf{Z}_{-T}^{-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})\big{)}=\\\
&KL\big{(}\mathbf{Q}(\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f}|\mathbf{Z}_{-T}^{-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})||\mathbf{P}(\mathbf{Z}_{0}:\mathbf{Z}_{t}|\mathbf{Z}_{-T}^{-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})\big{)};\end{split}$
(73)

where we used the property that the KL-divergence of two identical
distributions (i.e.,
$\mathbf{Q}(\mathbf{Z}_{-T}^{-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})$
and
$\mathbf{P}(\mathbf{Z}_{-T}:\mathbf{Z}_{t},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})$
is zero. Now, we apply the chain-rule property of KL-divergence to (73) and
get

$\displaystyle
KL\big{(}\mathbf{Q}(\mathbf{Z}_{0}^{f}:\mathbf{Z}_{t}^{f}|\mathbf{Z}_{-T}^{-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})||\mathbf{P}(\mathbf{Z}_{0}:\mathbf{Z}_{t}|\mathbf{Z}_{-T}^{-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})\big{)}$
$\displaystyle=\sum_{k=0}^{t}\Big{\\{}KL\big{(}\mathbf{Q}(x_{k}^{f}|\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})$
$\displaystyle\qquad\qquad\qquad||\mathbf{P}(x_{k}|\mathbf{Z}_{-T}:\mathbf{Z}_{k-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})\big{)}$
$\displaystyle\qquad+KL\big{(}\mathbf{Q}(y_{k}^{c,a}|x_{k}^{f},\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})$
$\displaystyle\qquad\qquad\qquad||\mathbf{P}(y_{k}|x_{k},\mathbf{Z}_{-T}:\mathbf{Z}_{k-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})\big{)}\Big{\\}}.$
(74)

Given $\mathbf{Z}_{-T}:\mathbf{Z}_{k-1}$ and the fact that $w_{k-1}$ is
independent of $v^{\prime}_{-\mathcal{T}}:v^{\prime}_{k}$, the distribution of
$x_{k}$ is a Gaussian with mean $f(x_{k-1},u_{k-1})$ and covariance
$\mathbf{R}_{w}$. On the other hand, using equations (41a) and (40) we have

$\begin{split}x_{k}^{f}=&f(x_{k-1}^{f}+s_{k-1},u_{k-1}^{a})-f(\hat{x}_{k-1}^{a},u_{k-1}^{s})\\\
&+f(\hat{x}_{k-1}^{a}-s_{k-1},u_{k-1}^{s})+w_{k-1}\end{split}$ (75)

Using Lemma 7, given
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t}$
and the fact that $s_{0}$, $\mathpzc{X}_{-T}$ and $\mathpzc{X}_{0}^{s}$ are
deterministic, $\hat{x}_{k-1}^{a}$, $s_{k-1}$, $u_{k-1}^{s}$ and $u_{k-1}^{a}$
are also determined. Therefore, the distribution of $x_{k}^{f}$ given
$\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t}$
is a Gaussian with mean
$f(x_{k-1}^{f}+s_{k-1},u_{k-1}^{a})-f(\hat{x}_{k-1}^{a},u_{k-1}^{s})+f(\hat{x}_{k-1}^{a}-s_{k-1},u_{k-1}^{s})$
and covariance $\mathbf{R}_{w}$. Using (37) and (75), it holds that

$\begin{split}x_{k}^{f}-x_{k}=&f(x_{k-1}^{f}+s_{k-1},u_{k-1}^{a})-f(\hat{x}_{k-1}^{a},u_{k-1}^{s})\\\
&+f(\hat{x}_{k-1}^{a}-s_{k-1},u_{k-1}^{s})-f(x_{k-1},u_{k-1}),\end{split}$
(76)

for all $0\leq k\leq t$. Now, according to Lemmas 2, 3, 4 and equation (49),
for all $0\leq k\leq t$ we have

$\displaystyle
KL\big{(}\mathbf{Q}(x_{k}^{f}|\mathbf{Z}_{-T}:\mathbf{Z}_{k-1}^{f},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})||\mathbf{P}(x_{k}|\mathbf{Z}_{-T}:\mathbf{Z}_{k-1},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})\big{)}$
$\displaystyle=\mathbb{E}_{\mathbf{Q}(x_{k}^{f},\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{t})}\bigg{\\{}(x_{k}-x_{k}^{f})^{T}\mathbf{R}_{w}^{-1}(x_{k}-x_{k}^{f})\bigg{\\}}$
$\displaystyle\leq\lambda_{max}(\mathbf{R}_{w}^{-1})\|x_{k}-x_{k}^{f}\|^{2}.$
(77)

Moreover, given $x_{k}$, the distribution of $y_{k}$ is a Gaussian with mean
$h(x_{k})$ and covariance $\mathbf{R}$.Using Lemma 7, given
$x_{k}^{f},\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{k}$
then $y_{k}$ is Gaussian with mean $h(x_{k}^{f})+\sigma^{\prime}_{k}$ and
covariance $\mathbf{R}$. Therefore, combining Lemmas 2, 3, 4 and equation
(49), for all $0\leq k\leq t$ we get

$\displaystyle
KL\big{(}\mathbf{Q}(y_{k}^{c,a}|x_{k}^{f},\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{k})||\mathbf{P}(y_{k}|x_{k})\big{)}$
$\displaystyle~{}~{}=\mathbb{E}_{\mathbf{Q}(x_{k}^{f},\mathbf{Z}_{-T}^{-1},\mathbf{Z}_{0}^{f}:\mathbf{Z}_{k-1}^{f},v^{\prime}_{-\mathcal{T}}:v^{\prime}_{k})}\Big{\\{}\big{(}h(x_{k}^{f})+\sigma^{\prime}_{k}-h(x_{k})\big{)}^{T}$
$\displaystyle\quad\times\mathbf{R}_{v}^{-1}\big{(}h(x_{k}^{f})+\sigma^{\prime}_{t}-h(x_{k})\big{)}\Big{\\}}\leq\lambda_{max}(\mathbf{R}_{v}^{-1})$
$\displaystyle\quad\times\Big{(}L_{h}^{2}\|x_{k}-x_{k}^{f}\|^{2}+2L_{h}^{2}b^{\prime}_{\zeta}\|x_{k}-x_{k}^{f}\|+L_{h}^{2}{b^{\prime}_{\zeta}}^{2}\Big{)}.$
(78)

As in Case 1, we combine (72)-(Appendix), (Appendix) and (Appendix) to get

$\begin{split}K&L\big{(}\mathbf{Q}(Y_{-T}^{-1},Y_{0}^{a}:Y_{t}^{a})||\mathbf{P}(Y_{-T}:Y_{t})\big{)}\leq\\\
&\frac{\kappa^{2}\|s_{0}\|^{2}}{1-\lambda^{2}}\big{(}\lambda_{max}(\mathbf{R}_{w}^{-1})+L_{h}^{2}\lambda_{max}(\mathbf{R}_{v}^{-1})\big{)}\\\
&+\frac{\kappa\|s_{0}\|}{1-\lambda}\big{(}2\gamma(0)\lambda_{max}(\mathbf{R}_{w}^{-1})+L_{h}^{2}\lambda_{max}(\mathbf{R}_{v}^{-1})(2\gamma(0)+b^{\prime}_{\zeta})\big{)}\\\
&+\sum_{k=0}^{t}\gamma^{2}(k)\big{(}\lambda_{max}(\mathbf{R}_{w}^{-1})+L_{h}^{2}\lambda_{max}(\mathbf{R}_{v}^{-1})\big{)}\\\
&+\sum_{k=0}^{t}\gamma(k)\big{(}2L_{h}^{2}b^{\prime}_{\zeta}\lambda_{max}(\mathbf{R}_{v}^{-1})\big{)}+\sum_{k=0}^{t}{b^{\prime}_{\zeta}}^{2}L_{h}^{2}\lambda_{max}(\mathbf{R}_{v}^{-1}).\end{split}$
(79)

Again, similar to Case 1, if we denote the right-hand side of the above
inequality by $b_{\epsilon}$ and use Theorem 1, the system
$\Sigma_{\text{\@slowromancap ii@}}$ will be $\epsilon$-stealthy attackable
with $\epsilon=\sqrt{1-e^{-b_{\epsilon}}}$.

###  VIII-A Discussion on Incremental Stability

As previously discussed, the notions of incremental stability and contraction
theory are well-defined [24, 25, 26] and going over their satisfying
conditions is beyond the scope of this paper. However, to provide some useful
intuition, we start with the following example.

###### Example 1

Consider the system

$x_{t+1}=x_{t}+ax_{t}^{3}+bu_{t}+w_{t},$

where $a>0$ and $w$ is a Gaussian noise with zero mean and variance
$\mathbf{R}_{w}$. Also, consider the feedback controller

$u_{t}=-\frac{a}{b}x_{t}^{3}-\frac{1}{2b}x_{t}.$

With such control input, the closed-loop system becomes

$x_{t+1}=0.5x_{t}+w_{t}.$ (80)

The above system is GIES since the difference between any two trajectories of
(80) with the same noise $w_{0}:w_{t-1}$ and different initial conditions
($\xi_{1}$ and $\xi_{2}$), defined as $\Delta
x_{t}=x(t,\xi_{1},w)-x(t,\xi_{2},w)$, has the dynamics $\Delta
x_{t+1}=.5\Delta x_{t}$ with the nonzero initial condition $\Delta
x_{0}=\xi_{1}-\xi_{2}$. Hence, $\Delta x_{t}$ converge exponentially to zero
and the closed-loop control system is exponentially stable.

Now, let us consider

$x_{t+1}=x_{t}+ax_{t}^{3}+d_{t},$ (81)

with $d_{t}=bu_{t}+w_{t}$. The difference between two trajectories with the
same input $\\{d_{0},...,d_{t-1}\\}$ and different initial condition
($\xi^{\prime}_{1}$ and $\xi^{\prime}_{2}$) is $\Delta
x^{\prime}_{t}=x(t,\xi^{\prime}_{1},d)-x(t,\xi^{\prime}_{2},d)$. Therefore,
the difference dynamics becomes $\Delta x^{\prime}_{t+1}=\Delta
x^{\prime}_{t}+a(x^{3}(t,\xi^{\prime}_{1},d)-x^{3}(t,\xi^{\prime}_{2},d))$.
One can use Lyapunov function method by defining $V_{t}={\Delta
x_{t}^{\prime}}^{2}$ and verify that

$\begin{split}V_{t+1}&-V_{t}={\Delta{x^{\prime}}^{2}_{t+1}}-{\Delta
x^{\prime}_{t}}^{2}=2a{\Delta
x^{\prime}_{t}}^{2}\Big{(}x^{2}(t,\xi^{\prime}_{1},d)\\\
&+x^{2}(t,\xi^{\prime}_{2},d)+x(t,\xi^{\prime}_{1},d)x(t,\xi^{\prime}_{2},d)\Big{)}+a^{2}{\Delta
x^{\prime}_{t}}^{2}\times\\\
&\Big{(}x^{2}(t,\xi^{\prime}_{1},d)+x^{2}(t,\xi^{\prime}_{2},d)+x(t,\xi^{\prime}_{1},d)x(t,\xi^{\prime}_{2},d)\Big{)}.\end{split}$

Since
$x^{2}(t,\xi^{\prime}_{1},d)+x^{2}(t,\xi^{\prime}_{2},d)+x(t,\xi^{\prime}_{1},d)x(t,\xi^{\prime}_{2},d)>0$
and $V_{0}>0$, it holds that $V_{t+1}-V_{t}>0$ for all $t\in\mathbb{Z}_{\geq
0}$; thus, $\Delta x^{\prime}_{t}$ diverges and (81) is globally incrementally
unstable.