# Between-Domain Instance Transition Via the Process of Gibbs Sampling in RBM

Hossein Shahabadi Farahani  APAC Research Group
Dept. Mechatronics
K.N.Toosi University of Technology
Tehran, Iran
<EMAIL_ADDRESS>Alireza Fatehi  APAC Research Group
Dept. of System And Control
K.N.Toosi University of Technology
Tehran, Iran
<EMAIL_ADDRESS>Mahdi Aliyari Sh  APAC Research Group
Dept. Mechatronics
K.N.Toosi University of Technology
Tehran, Iran
<EMAIL_ADDRESS>
###### Abstract

In this paper, we present a new idea for Transfer Learning (TL) based on Gibbs
Sampling. Gibbs sampling is an algorithm in which instances are likely to
transfer to a new state with higher possibility with respect to a probability
distribution. We find that such an algorithm can be employed to transfer
instances between domains. Restricted Boltzmann Machine (RBM) is an energy
based model that is very feasible for being trained to represent a data
distribution and also for performing Gibbs sampling. We used RBM to capture
data distribution of the source domain and use it in order to cast target
instances into new data with a distribution similar to the distribution of
source data. Using dataset that are commonly used for evaluation of TL
methods, we show that our method can successfully enhance target
classification by a considerable ratio. Additionally, the proposed method has
the advantage over common DA methods that it needs no target data during the
process of training of models.

###### Index Terms:

Gibbs Sampling, Transfer Learning, Energy Surface, Restricted Boltzmann
Machine

##  I Introduction

Human being is able to use the knowledge collected in learning a task to learn
other new tasks more efficiently. In this regard, the idea of TL is to imitate
such a ability in machine learning problems [1]. With the perspective of
machine learning, the discrepancy of tasks relies on the difference of the
data distribution. Therefore, TL algorithms helps to extract knowledge from a
domain of data and adapt it to another domain with different data distribution
[2]. The domain from which he knowledge is collected is called source domain
and the domain in which the knowledge is utilized is called target domain.

TL has raised large interest in machine learning community, since it is a
common practical challenge in many machine learning application that the
distribution of labeled data by which the models are trained is not the same
as the distribution of data to which the models are applied. In the context of
image processing, when the image background, color mode or orientation of
object in images are changed the models can not classify images accurately
anymore [3]. In robotic applications, it is challenging to apply policies and
controller learnt in simulation environment to real world robots due to the
difference in their perception or dynamics [4, 5]. Intelligent machine health
monitoring systems also suffers from the fact that machines’ behavior vary in
different working conditions [6]. All the mentioned problems has been tackled
to by TL algorithms.

TL algorithms can be categorized into three different groups. The most common
approaches of TL are parameter-based methods, which try to use parameters of a
model trained in the source domain, to make a relatively better model for the
target domain, usually by fine-tuning the model using limited available
labeled data from target [7]. Another group of TL methods are instance-based
methods. In this methods, source samples are weighted based on their
similarity to the target instances which is measured in a probabilistic sense.
Then this weights are used to train a model that is more adapted to the target
domain [8]. Finally, the most related to the method that is proposed in this
paper, are representation learning based methods which also called feature-
based methods.

In representation learning based TL techniques, the goal is to find a mapping
that minimizes the label predication risk in the source domain, while reducing
a notion of distance between the source and target domain [3]. Tzeng et al [9]
measured between domains distances of source and target samples via Maximum
Mean Discrepancy (MMD). This criterion is widely used in many other researches
later [10, 11]. In these methods, a neural networks is trained to minimize
label prediction cost while being penalized by MMD of features extracted from
the source and target data. Ben-David et al [12] show that the generalized
error of classification between the source and target samples can be
interpreted as a score of divergence of domains. It is theoretically proved
that assuming there exist a representation of source and target domain in
which their divergence is minimized, a classifier with a low error (known as
risk) for the source domain will have a better performance on target domain
relatively. In this regard, domain adversarial training methods tries to learn
a representation on which the source and target data are indistinguishable by
adversarial training of the feature extractor and a domain classifier [3]. All
these representation learning based TL techniques trains a feature extractor,
usually an Artificial Neural Network (ANN), that maps source and target data
into a mutual subspace in which their distribution are closed to each other.

The proposed method utilizes the RBM which is an energy based model that
represents a Joint Probability Distribution (JPD) over a set of variables
through its energy function. RBM is a restricted version of Boltzmann machine,
however it is highly capable for representing complex data distributions[13]
and there exit many efficient algorithms for training it [14]. Besides, it can
be easily employed to perform Gibbs sampling for getting sample from the
represented JPD. Gibbs sampling is a process in which instances are
transferred by influence of the gravity of energy minima of a energy surface.
In fact, Gibbs sampling leads a current state to a new sample with higher
portability with respect to a desired probability distribution.

Despite the fact that representation learning based TL methods transfer
instances into new domains using a deterministic model, In the proposed method
such a mapping happens via the process of Gibbs sampling. Employing Gibbs
sampling as a stochastic transition process for transferring samples among
different domains is a novel idea which is presented by this paper for the
first time. We suggest to train a RBM based on source data in order to use it
as a generative model that transfers target samples into the source domain.
Using the proposed method, we could perform pixel-level TL which has been
addressed by few researches [15]. Furthermore, in the proposed method, target
samples are not involved in the training of models and they are used only in
the prediction stage while DA techniques usually require huge amount of
unlabeled target data during training of the models. Consequently, our
assumption about the availability of data is far more restricted compere to
common DA problems which means our algorithm can be employed in more difficult
situations.

##  II Boltzmann Machine

A Boltzmann machine can be defined with different perspectives. For instance,
it can be defined as a stochastic Hopfield network or recurrent neural
networks with the point of view of ANNs [16]. For the best understanding of
how Boltzmann machine represents data distribution and its properties, it is
needed to look at it as a probabilistic graphical models. Therefore, in this
paper, we mostly look at this model as a Markov random field or undirected
probabilistic graphical model. In this section, the structure of Boltzmann
machine and RBM is introduced. Then it is explained that how RBM represents a
joint probability distribution. Finally, the concept of Gibbs Sampling is
clarified.

###  II-A General Boltzmann Machine

The general structure of Boltzmann machine is presented in the Fig. 1 [13].
This model is consisted of numbers of units or neurons whose values are 0 or
1. As shown in the figure, these units are divided into two groups, hidden
units and visible units, which is explained later. This is a fully connected
network which means in this model each unit is connected to all other units.
In fact, the structure shown in Fig. 1 is a graphical representation of a
Markov random field which represents JPD of all visible and hidden variables
through an energy function. More detail regarding the energy function and
representation of the model is provided in the next section.

Figure 1: The architecture of general Boltzmann machine[13].

###  II-B Restricted Boltzmann Machine

If all within connections of hidden units and all within connections of the
visible units of Boltzmann machine are removed, the new appeared structure is
like Fig. 2 and is called RBM [13]. Alternatively, RBM is a Boltzmann machine
in which no two hidden units and no visible units are connected.

According to the weights of units connection, $W$, and bias weights of visible
and hidden units, $b$ and $c$, the negative energy of RBM is calculated by
formula (1) given the value visible and hidden units, $v$ and $h$:

$\displaystyle-E\left(v,h\right)$
$\displaystyle=\underset{v}{\overset{{}}{\mathop{\sum}}}\,{{b}_{i}}{{v}_{i}}+\underset{h}{\overset{{}}{\mathop{\sum}}}\,{{c}_{i}}{{h}_{i}}+\underset{v,h}{\overset{{}}{\mathop{\sum}}}\,{{W}_{ij}}{{v}_{i}}{{h}_{j}}$
(1) $\displaystyle={{b}^{T}}v+{{c}^{T}}h+{{v}^{T}}Wh$

Briefly, the intuition behind the energy distribution is that the higher the
energy of a $(v,h)$ is the lower its probability will be.

Figure 2: The architecture of restricted Boltzmann machine [13].

Considering energy function (1) the JPD can be obtained from (2):

$\displaystyle
P\left(v,h\right)=\frac{1}{Z}\text{exp}\left(-E\left(v,h\right)\right)$ (2)
$\displaystyle
Z=\underset{v}{\overset{{}}{\mathop{\sum}}}\,\underset{h}{\overset{{}}{\mathop{\sum}}}\,\text{exp}\left(-E\left(v,h\right)\right)$

The term $Z$, which called partition function, is usually impractical to be
calculated, and so, it is estimated through Annealed Importance Sampling (AIS)
algorithm [17].

Visible variables, $v$, are related to features or variables of the dataset to
which the RBM is fitted, where the ultimate goal of the RBM is to represent
their distribution. The marginal probability distribution of visible
variables, $P(v)$, is calculated by (3):

$\displaystyle
P\left(v\right)=\underset{h}{\overset{{}}{\mathop{\sum}}}\,P\left(v,h\right)$
(3)

Actually, hidden variables are used to enrich the energy function so that the
model can represent the distribution of visible variables.

As mentioned before, it is hard to compute the value of the partition
function, $Z$, in the Boltzmann machine which is required for computing exact
probabilities, training of the model, inference and sampling. Nonetheless,
when the structure of Boltzmann machine is modified into RBM, many of the
practical problems about BM can be handled. As shown by (4), given the value
of hidden units, $h$, each visible variables, ${{v}_{i}}$, is conditionally
independent from other visible variables. Besides, these cumulative probably
functions CPDs can simply be calculated by a sigmoid function like (5).

$\displaystyle p(v|h)$ $\displaystyle=\prod\limits_{i=1}^{n}{p({{v}_{i}}|h)}$
(4)

Consequently, it is easy to sample from the this conditional probability.

$\displaystyle p({{v}_{i}}=1|h)=sigmoid({{b}_{i}}+{{W}_{i:}}h)$ (5)

In a similar way, given the value of visible units, the CPD of all the hidden
units can be computed using simple sigmoid functions independently.

The fact that RBM is very feasible for calculating CPDs and consequently,
getting sample from its units, have made it a popular model. Sampling from
these conditional dependencies is a basic step in almost all of the proposed
RBM learning algorithms. Furthermore, most of the applications of RBM are
based on sampling.

Training of RBM is an unsupervised learning algorithm, which means only
unlabeled data are used. In the training of a RBM, the goal is to adjust the
model parameters, $\\{W,b,c\\}$, such that the energy function (1) represents
a JPD, in which training data, ${v}^{(t)}$, have the maximum likelihood. The
log-likelihood function for training of RBM is as (6) [14].

$\displaystyle\ell(\\{W,b,c\\};{v}^{(t)})$
$\displaystyle=\sum\limits_{t=1}^{n}{\log
P({{v}^{(t)}})}=\sum\limits_{t=1}^{n}{\log\sum\limits_{h}{P({{v}^{(t)}},h)}}$
(6)
$\displaystyle=\sum\limits_{t=1}^{n}{\log\sum\limits_{h}{\exp\\{-E({{v}^{(t)}},h)\\}-n\log
Z}}$

Gradient descent algorithm can be employed to maximize
$\ell(\\{W,b,c\\};{v}^{(t)})$. However, the partition function, $Z$, in the
second term of this equation makes it impractical to compute the exact
gradients. All algorithms proposed for training of RBM, contribute to finding
a solution for this obstacle. Contrastive Divergence (CD) [18] and Persistent
Contrastive Divergence (PCD) [19] are most common approaches that are used for
training RBM. It is important to keep in mind that in CD algorithm, the energy
surface of the RBM is only modified in very close neighborhood of training
instance. Therefore, the energy function of a RBM that is trained by CD does
not represent the distribution of training data.

###  II-C Gibbs Sampling

Gibbs sampling is the process of a stochastic transition from an initial
state, $x^{t}$, to another state, $x^{t+1}$, regarding a desired JPD, $P(X)$,
through the Algorithm 1. As mentioned before, it is feasible to compute the
CPD of visible units of a RBM, $v$, given the value of hidden units, $h$ with
a sigmoid function and vice versa. Therefore, based on the Algorithm 1, given
an initial state,$(v^{t},h^{t})$, it is easy to Gibbs sample
$(v^{t+1},h^{t+1})$. As shown by Fig. 3, first of all, the updates of hidden
units are simultaneously sampled from $P(h|v^{t})$. Afterward, updates of all
visible units are sampled from $P(v|h^{t+1})$. Also, it is important to keep
in mind that when using a RBM for Gibbs sampling, the desired probability
distribution is the JPD, which is represented by the energy surface of the
RBM.

Algorithm 1 One step transition by Gibbs sampling

0: $(x^{t}_{1},...,x^{t}_{n})$, $P(X_{1},...,X_{n})$

0: $(x^{t+1}_{1},...,x^{t+1}_{n})$

1: for $i=1$ to $n$ do

2: Sample $x^{t+1}_{i}\sim P(X_{i}|x^{t}_{-1})$

3: end for

4: return $(x^{t+1}_{1},...,x^{t+1}_{n})$

Figure 3: Transition form $v^{t}$ to $v^{t}+1$ by one step Gibbs sampling in
RBM.

Actually, Gibbs sampling is among Markov Chain Monte Carlo (MCMC) algorithms
which are used to get sample from a desired probability distribution, $P(X)$
[20]. The general principle in these algorithms is to do a chain of
transitions, using an algorithm like Gibbs sampling, up until reaches to
thermal equilibrium [20]. In thermal equilibrium, the current state is a
sample from the desired probability distribution. For instance, RBM can
generate samples similar to its training data by using Gibbs sampling in chain
[13] [21]. In this paper, we do not go in details of the thermal equilibrium
and sampling from a desired distribution. However, for understanding of how
our proposed method works, it is important to have an intuition of what
happens in every single step of Gibbs sampling.

When RBM is used to perform one step Gibbs sampling, $E(v^{t+1},h^{t+1})$ is
probably lower than $E(v^{t},h^{t})$. It can be imagine that areas with lower
energy have higher gravity that attract samples during Gibbs sampling. For
example, when the current state of a RBM is near a local maximum energy, it is
very likely to escape to lower energy neighborhood areas after a step of Gibbs
sampling. On the contrary, when the current state is near the low energy
areas, it is very likely to preserve its state and would not probably transfer
to higher energy neighborhoods after Gibbs sampling. However, sampling is a
stochastic phenomenon, thus, transitions might not be in alliance with the
mentioned tendencies.

##  III Proposed Method

In this paper, the problem of TL is tackled to with novel perspective. In the
proposed method, samples are cast into a new domain via the process of Gibbs
sampling while DA methods usually align features extracted across domains
using a deterministic mopping, usually an ANN[3, 9, 11, 22]. Furthermore,
almost all DA methods require unlabeled target data for training domain
adaptive models. Nevertheless, the proposed methods needs no target data
during training of the models and instead it process target data during the
prediction stage which enables the method to be employed in more challenging
problems.

In this section, first, formulation of TL problem and assumptions are briefly
reviewed. Afterward, our proposed framework for TL is elaborated.

###  III-A Problem formulation

The source domain is defined as $D_{S}=\\{\chi_{S},P(X_{S})\\}$, where
$\chi_{S}$ is the feature space, $X_{S}=\\{x_{S1},…,x_{Sn}\\}$,
$x_{Si}\in\chi_{S}$ the data and $P(X_{S})$ the marginal distribution from
which the source samples are drawn. The corresponding ground truth is defined
as $Y_{S}=\\{y_{S1},…,y_{Sn}\\}$, $y_{Si}\in Y_{S}$, where $Y_{S}$ is the
label space. It is assumed that enough labeled data is available in the source
domain to find a $\hat{f}_{S}(x)$ that predicts labels, $y_{S}$, based on
$P_{S}(y|x)$. Actually, $\hat{f}_{S}(x)$ aims to approximate the optimal
function ${f}_{S}(x)$.

In a similar way, a target domain is defined as
$D_{T}=\\{\chi_{S},P(X_{T})\\}$, where $\chi_{T}=\chi_{S}$. The assumption is
that no labeled data from the target domain is available. On the other hand,
$\hat{f}_{S}(.)$ might not be an appropriate function for approximating
${f}_{T}(x)$, $x\in\chi_{T}$, since $P(X_{S})\neq P(X_{T})$. As a result, if
the models trained in the source domain be directly applied to the target
domain, it could not predict target labels accurately. In this regard, there
is a need for a TL method that extract knowledge from the source domain and
adapt it to the target domain.

###  III-B Between-domain instance transition via Gibbs sampling

The diagrammatic representation of the proposed method is shown in Fig. 4. We
train a classifier and a RBM using the source data. The classifier predicts
labels of given samples based on $P(Y_{S}|X_{S})$. The RBM which its energy
surface is fitted to the source data distribution, by some means understand
$P(X_{S})$ and is able to extract the concepts behind source samples. Also it
is able to generate samples from this distribution. The proposed framework
utilize the RBM as a generative model to produce source-like data out of
target samples. Next, newly cast samples, which are denoted as
$X^{\prime}_{T}$, are feed to source classifier for label predictions.

Figure 4: Diagram of the proposed TL framework using Gibbs sampling process in
RBM.

In TL problems, although the probability distribution of source and target
data is not equal, $P(X_{T})\neq P(X_{S})$, target samples are expected to
follow a distribution pattern similar to the source one. Therefore, target
instances are expected to be in a close neighborhood of source data in terms
of euclidean distance. We suggest to think of target data as source instances
whose value are altered. Therefore, target instances are assumed to be near
local minimums on energy surface of the RBM that is fitted to the source data.
As mentioned before, during the process of Gibbs sampling, the current state
is likely to transfer to nearby energy minima. Consequently, we deployed Gibbs
sampling in RBM in order to transfer target instances to energy minimum points
which are corresponding to source samples with the same label. Also, the
probability distribution of newly cast samples is close to the probability
distribution of source data, $P(X^{\prime}_{T})\simeq P(X_{S})$.

As mentioned before, CD algorithm do not contribute to computation of exact
gradients of the log-likelihood ,thus, models trained by this algorithm are
not complete density models. Since the RBM that we use in our method is better
to represents the source data distribution as accurately as possible, it is
strongly suggested to use PCD algorithm for training the RBM and avoid using
of CD algorithm.

##  IV Results and Discussion

In this part, we used the well-known hand-writing datasets that have been used
by TL researchers for evaluation of TL algorithms [3, 23, 24]. Hand-written
digit images [25], commonly referred to as MNIST, is the dataset that is used
as the source data, $X_{S}$. MNIST-M , which is used as target data, $X_{T}$,
is a set of data that is made by adding set of random background images to the
MNIST images. We used MNIST-M as the target domain. Some instances from these
two domains are depicted in Fig. 5.

Originally MNIST samples are images with black background and white digit. We
use a gray-scale version of the images in this example. On the other hand, a
black number in white background is similar to a white number in a black
background. So we concatenate the source data with the inversion of the same
data. In other words, we also have handwritten images that their background
and digit color are white and black respectively as shown in Fig. 5.

Figure 5: Examples of source and target images.

The size of images is 28*28, which means they consist of 784 pixels.
Therefore, the RBM is needed to have 784 units in visible layer. Also, 400
units are used in hidden layer. The RBM is trained by PCD algorithm in the
source domain.

A Convolutional Neural Network (CNN) is trained in the source domain in order
to predict the label of images. The CNN architecture includes one input layer,
one output layer, two convolutional layers, two polling layer and finally two
fully connected layers as Fig 6.

Figure 6: The architecture of the CNN used as classifier.

The classification accuracy of the model in the source domain is about 98%,
But when the model is applied directly to the MNIST-M target data without TL
it can only achieve 38% accuracy. So, we applied the proposed RBM-based TL.

Fig. 7 depicts examples of generated samples, $X^{\prime}_{T}$, as the result
of transition of target samples, $X_{T}$, via 1 and 3 steps of Gibbs sampling
using the RBM trained on the source domain. Using TL, classifier trained in
the source domain can classify this new images with 65% accuracy. In many
cases, the RBM can make new samples that are similar to source instances with
the same labels by transferring target instances to a point near to its
minimum energy. In this experience, it is demonstrated that the proposed
method can also perform pixel-level TL since the generated samples are quit
similar to MNIST images.

Figure 7: Transferring Target instates to a new domain by 1 and 3 steps Gibbs
sampling process with the RBM trained in the source domain.

Table I provides a comparison between different classifications accuracy to
illustrated that how our method have successfully performed TL. In this
problem, using our method, the classification accuracy in the MNIST-M
increased from 38% to 65%. In a case in which a classifier is trained with
labeled MNIST-M images, the best achieved classification accuracy is 94% which
shows that classification in the target domain is relatively more challenging
compering to the source domain with 98% accuracy, yet our method can apply the
knowledge achieved in the source domain to the target domain.

TABLE I: A comparison between classification accuracy in source and target domains under different conditions  Domain | Training | Classification accuracy
---|---|---
Source | Training the model in source domain | 0.98
Target | Using the source model without TL | 0.38
Target | Using the proposed method with TL | 0.65
Target | Training the model in target domain | 0.94

.

##  V Conclusion

Nowadays, researches have found transfer learning a breakthrough in the area
of machine learning which is evidenced by massive academic papers being
published in this field [2]. While most of the TL methods are based on
transferring the information based on the inherent properties of ANN models,
especially CNN, this paper proposes a novel method to transfer the information
from the source to the target through a restricted Boltzmann machine.

The basis of our method is to transfer target instances to source domain by
employing Gibbs sampling in an energy based model. The proposed methods is
evaluated using well-known MNIST and MNIST-M datasets that are used for TL
problems. It successfully improve the classification accuracy in the target
domain. Besides, the method have the advantage over common domain adaptation
methods that it needs no target data during the process of training of models.
Actually, the method process target instances and transfers the learned
information from source only during the prediction stage. Finally, the method
is also employed for pixel-level TL which is quit rare in TL researches.

## References

  * [1] S. J. Pan and Q. Yang, “A survey on transfer learning,” _IEEE Transactions on knowledge and data engineering_ , vol. 22, no. 10, pp. 1345–1359, 2009.
  * [2] K. Weiss, T. M. Khoshgoftaar, and D. Wang, “A survey of transfer learning,” _Journal of Big data_ , vol. 3, no. 1, p. 9, 2016.
  * [3] Y. Ganin, E. Ustinova, H. Ajakan, P. Germain, H. Larochelle, F. Laviolette, M. Marchand, and V. Lempitsky, “Domain-adversarial training of neural networks,” _The Journal of Machine Learning Research_ , vol. 17, no. 1, pp. 2096–2030, 2016.
  * [4] X. B. Peng, E. Coumans, T. Zhang, T.-W. Lee, J. Tan, and S. Levine, “Learning agile robotic locomotion skills by imitating animals,” 2020.
  * [5] C. Chen, Y. Miao, C. X. Lu, P. Blunsom, A. Markham, and N. Trigoni, “Transferring physical motion between domains for neural inertial tracking,” _arXiv preprint arXiv:1810.02076_ , 2018.
  * [6] S. Shao, S. McAleer, R. Yan, and P. Baldi, “Highly accurate machine fault diagnosis using deep transfer learning,” _IEEE Transactions on Industrial Informatics_ , vol. 15, no. 4, pp. 2446–2455, 2018.
  * [7] J. Donahue, Y. Jia, O. Vinyals, J. Hoffman, N. Zhang, E. Tzeng, and T. Darrell, “Decaf: A deep convolutional activation feature for generic visual recognition,” in _International conference on machine learning_ , 2014, pp. 647–655.
  * [8] D. Lin, X. An, and J. Zhang, “Double-bootstrapping source data selection for instance-based transfer learning,” _Pattern Recognition Letters_ , vol. 34, no. 11, pp. 1279–1285, 2013.
  * [9] E. Tzeng, J. Hoffman, N. Zhang, K. Saenko, and T. Darrell, “Deep domain confusion: Maximizing for domain invariance,” _arXiv preprint arXiv:1412.3474_ , 2014.
  * [10] W. Lu, B. Liang, Y. Cheng, D. Meng, J. Yang, and T. Zhang, “Deep model based domain adaptation for fault diagnosis,” _IEEE Transactions on Industrial Electronics_ , vol. 64, no. 3, pp. 2296–2305, 2016.
  * [11] M. Long, H. Zhu, J. Wang, and M. I. Jordan, “Deep transfer learning with joint adaptation networks,” in _Proceedings of the 34th International Conference on Machine Learning-Volume 70_. JMLR. org, 2017, pp. 2208–2217.
  * [12] S. Ben-David, J. Blitzer, K. Crammer, A. Kulesza, F. Pereira, and J. W. Vaughan, “A theory of learning from different domains,” _Machine learning_ , vol. 79, no. 1-2, pp. 151–175, 2010.
  * [13] R. Salakhutdinov and G. Hinton, “Deep boltzmann machines,” in _Artificial intelligence and statistics_ , 2009, pp. 448–455.
  * [14] A. Fischer and C. Igel, “Training restricted boltzmann machines: An introduction,” _Pattern Recognition_ , vol. 47, no. 1, pp. 25–39, 2014.
  * [15] J. Hoffman, E. Tzeng, T. Park, J.-Y. Zhu, P. Isola, K. Saenko, A. A. Efros, and T. Darrell, “Cycada: Cycle-consistent adversarial domain adaptation,” _arXiv preprint arXiv:1711.03213_ , 2017.
  * [16] A. Barra, A. Bernacchia, E. Santucci, and P. Contucci, “On the equivalence of hopfield networks and boltzmann machines,” _Neural Networks_ , vol. 34, pp. 1–9, 2012.
  * [17] R. M. Neal, “Annealed importance sampling,” _Statistics and computing_ , vol. 11, no. 2, pp. 125–139, 2001.
  * [18] G. E. Hinton, “Training products of experts by minimizing contrastive divergence,” _Neural computation_ , vol. 14, no. 8, pp. 1771–1800, 2002\.
  * [19] T. Tieleman, “Training restricted boltzmann machines using approximations to the likelihood gradient,” in _Proceedings of the 25th international conference on Machine learning_ , 2008, pp. 1064–1071.
  * [20] D. Koller and N. Friedman, _Probabilistic graphical models: principles and techniques_. MIT press, 2009.
  * [21] M. A. Keyvanrad and M. M. Homayounpour, “A brief survey on deep belief networks and introducing a new object oriented toolbox (deebnet),” _arXiv preprint arXiv:1408.3264_ , 2014.
  * [22] M. Ghifary, W. B. Kleijn, M. Zhang, D. Balduzzi, and W. Li, “Deep reconstruction-classification networks for unsupervised domain adaptation,” in _European Conference on Computer Vision_. Springer, 2016, pp. 597–613.
  * [23] J. Cao, O. Katzir, P. Jiang, D. Lischinski, D. Cohen-Or, C. Tu, and Y. Li, “Dida: Disentangled synthesis for domain adaptation,” _arXiv preprint arXiv:1805.08019_ , 2018.
  * [24] Y. Li, D. E. Carlson _et al._ , “Extracting relationships by multi-domain matching,” in _Advances in Neural Information Processing Systems_ , 2018, pp. 6798–6809.
  * [25] Y. LeCun, C. Cortes, and C. Burges, “Mnist handwritten digit database,” _ATT Labs [Online]. Available: http://yann.lecun.com/exdb/mnist_ , vol. 2, 2010.


# Sensor Security: Current Progress, Research Challenges, and Future Roadmap
(Invited Paper)

Anomadarshi Barua and Mohammad Abdullah Al Faruque  Department of Electrical
Engineering and Computer ScienceUniversity of California, IrvineCaliforniaUSA.
Email: {anomadab<EMAIL_ADDRESS>
(2022)

###### Abstract.

Sensors are one of the most pervasive and integral components of today’s
safety-critical systems. Sensors serve as a bridge between physical quantities
and connected systems. The connected systems with sensors blindly believe the
sensor as there is no way to authenticate the signal coming from a sensor.
This could be an entry point for an attacker. An attacker can inject a fake
input signal along with the legitimate signal by using a suitable spoofing
technique. As the sensor’s transducer is not smart enough to differentiate
between a fake and legitimate signal, the injected fake signal eventually can
collapse the connected system. This type of attack is known as the
transduction attack. Over the last decade, several works have been published
to provide a defense against the transduction attack. However, the defenses
are proposed on an ad-hoc basis; hence, they are not well-structured. Our work
begins to fill this gap by providing a checklist that a defense technique
should always follow to be considered as an ideal defense against the
transduction attack. We name this checklist as the Golden reference of sensor
defense. We provide insights on how this Golden reference can be achieved and
argue that sensors should be redesigned from the transducer level to the
sensor electronics level. We point out that only hardware or software
modification is not enough; instead, a hardware/software (HW/SW) co-design
approach is required to ride on this future roadmap to the robust and
resilient sensor.

transduction attack, golden reference for sensor defense

††copyright: acmcopyright††journalyear: 2022††doi:
XXXXXXX.XXXXXXX††conference: 41st International Conference on Computer-Aided
Design; 30 October–3 November, 2022; San Diego, CA††copyright: none††ccs:
Security and privacy Embedded systems security

##  1\. Introduction

Sensors work as the eyes and ears of any embedded system. Therefore, any
decision taken by a system depends upon the data coming from a sensor. Though
sensors are technically developed nowadays compared to their earlier
generation, from a security point of view, almost all sensors are still unsafe
and prone to intelligent attacks by an attacker. The reason behind this is
that the signals that a sensor measures in the surrounding environment are
analog signals, which are not encrypted in the environment. Therefore, sensors
cannot differentiate between a legitimate analog input and a fake analog input
provided by an attacker. As a result, the transducer of a sensor converts any
fake analog signal given as the input into a usable signal (e.g., an
electrical signal), which is then propagated to downstream of the signal path
and eventually arrives at the system controller. As the system controller does
not have any way to authenticate the signal coming from a sensor, it has to
blindly believe the sensor and then make decision based upon the sensor data.
As there is no hardware/software firewall present between the sensor and the
system interface, this could be an entry point for an attacker. An attacker
can noninvasively inject fake signals into sensors by using a suitable
spoofing technique (Barua and Al Faruque, 2020a; Yan et al., 2016; Zhang et
al., 2017; Wang et al., 2017) and may compromise the system availability and
integrity, causing a system failure and denial-of-service (DoS) attacks on
systems.

As the attack at hand fools the sensor’s transducer, this type of attack is
named as the transduction attack (Fu and Xu, 2018). There has been ongoing
research on the transduction attack for the last two decades. However, this
paper shows that defenses against this transduction attack are still not well-
structured, and little to no work is done in the sensor defense domain. We
point out that almost all defenses against the transduction attack are
proposed on an ad-hoc basis. Therefore, there is no systematic approach
present in the literature for defense. Our work begins to fill this gap by
providing a checklist of reference points that an ideal defense should always
follow to be considered as a successful defense against the transduction
attack. We name this checklist as the Golden reference for sensor defense.

This Golden reference is the roadmap to a secured sensor that every designer
should follow in the future before finally adopting a technique as a sensor
defense. We also provide insights on how to achieve the Golden reference. We
point out that the Golden reference for sensor defense can not be achieved
alone by only hardware or only software modification; instead, a
hardware/software (HW/SW) co-design approach is required in the sensor domain.
The sensors should be redesigned from the transducer level to the sensor
electronics level with the integration of smart hardware and software. We
believe that the defenses highlighted in this paper will be relevant soon when
sensors will pervade our lives.

##  2\. Background

###  2.1. Sensor physics

A sensor is an instrument that senses physical input signals from the
environment and converts the measured physical quantities into understandable
data that can be interpreted by either a human or a machine. For example, a
simple glass thermometer presents visual data, which can be interpreted by a
human, and an electronic pressure sensor can provide electronic data, which
can be interpreted by machines. There are a multitude of types of sensors and
the physics behind the conversion of physical input signals to understandable
data varies from one sensor to another. However, all sensors have a common
physics that is systematized below.

Sensing structure and transducer: The most common sensor physics is that all
the sensors use a sensing structure, which typically senses the physical input
signals and uses a transducer to convert the sensed physical input signals
into understandable data (see Fig. 1). For example, a pressure sensor has a
diaphragm as the sensing structure and uses a capacitor plate as the
transducer to convert the displacement of the diaphragm into an electrical
signal. The converted understandable data is ideally proportional to physical
input signals. Mathematically, if the sensed physical input signal is $S_{in}$
and the corresponding converted data from the transducer is $S_{con}$, we can
write $S_{con}$ as follows:

(1) $S_{con}=k\times f\\{S_{in}\\}$

where $k$ is a proportionality constant and $f\\{S_{in}\\}$ is a function of
the $S_{in}$. It is important to note that $f\\{S_{in}\\}$ can be a function
of any type. For example, for a Hall sensor, $f\\{S_{in}\\}$ is a linear
function of input magnetic fields and for a p-n junction temperature sensor,
$f\\{S_{in}\\}$ is an exponential function of input temperature $T$ (i.e.,
$e^{T}$).

Figure 1. A basic overview of the sensor physics.

###  2.2. Sensor electronics

Though sensing structure and transducer are common in all sensors, most
sensors have other additional electronics to improve the sensed signal quality
(see Fig. 1). The converted understandable data $S_{con}$ is typically an
analog signal, which is given as an input to a differential amplifier to
remove the common mode noise. A single or multiple stages of signal
conditioning filters are applied afterward, which is followed by an analog-to-
digital converter (ADC) for the data digitization. Filters are typically LPF
used to remove high-frequency noise signals from the measurement. Typically,
analog sensors output the analog signals from the differential amplifier or
filters directly, while digital sensors contain the LPF and ADC.

###  2.3. Operating region and saturation region

As mentioned in Sections 2.1 and 2.2, the shape of the data $S_{con}$ from the
transducer can be linear, exponential or any other types and is given as an
input to different filtration blocks (see Fig. 1). As these filters are
powered by a finite power supply, the maximum value of $S_{con}$ the filters
can handle is limited by the power supply. In fact, the output $S_{f}$ from
the filtration block will begin to flatten when the $S_{con}$ is too large and
the power supply limits are reached. The region, where the output $S_{f}$ is
not flattened, is known as the operating region of the sensor (see Fig. 2).
This region is typically linear between the signal $S_{con}$ and $S_{f}$. In
contrast, the region, where the output $S_{f}$ is flattened, is known as the
saturation region of the sensor. Please note that the exact value of the input
$S_{con}$ cannot be recovered while the filter output $S_{f}$ is in the
saturation region.

Figure 2. Operating and saturation region of a sensor. Table 1. Summary of the notable published work on sensor attack. (In-band = fake and legitimate signal share same frequency band; Out-band = fake and legitimate signal share different frequency band) Sl. |  Paper |  Year | Sensor type | Sensor | Injected signal | Injected signal pattern |  Industry
---|---|---|---|---|---|---|---
1 |  (Barua and Al Faruque, 2020a) |  2020 | Magnetic | Hall | Magnetic field | In-band, out-band |  Power grid
2 |  (Shoukry et al., 2013) |  2013 | Magnetic | Hall | Magnetic field | In-band |  Automotive
3 |  (Wang et al., 2017) |  2017 | Inertial | Accelerometer & Gyroscope | Ultrasound | Out-band resonant frequency |  AR/VR
4 |  (Son et al., 2015) |  2015 | Inertial | Gyroscope | Sound wave | Out-band resonant frequency |  Drone
5 |  (Trippel et al., 2017) |  2017 | Inertial | Accelerometer | Ultrasound | Out-band resonant frequency |  Smart device
6 |  (Tu et al., 2018) |  2018 | Inertial | Accelerometer & Gyroscope | Sound wave | Out-band resonant frequency |  Smart device
7 |  (Bolton et al., 2018) |  2018 | Inertial | Shock sensor | Sound wave | Out-band |  Hard disk
8 |  (Barua and Al Faruque, 2022a) |  2022 | Pressure | Pressure sensor | Sound wave | Out-band resonant frequency |  NPR
9 |  (Tu et al., 2021) |  2021 | Pressure | Pressure sensor | EMI | Out-band |  Inflation pump
10 |  (Park et al., 2016) |  2016 | Optical | Optical sensor | Infrared | Out-band |  Infusion pump
11 |  (Davidson et al., 2016) |  2016 | Optical | Camera & Lidar | Light | In-band |  UAV
12 |  (Shin et al., 2017) |  2017 | Optical | Lidar | Light | In-band |  Automotive
13 |  (Zhang et al., 2017) |  2017 | Acoustic | Microphone | Ultrasound | Out-band |  Smart device
14 |  (Yan et al., 2016) |  2016 | Acoustic | Ultrasound | Ultrasound | In-band |  Automotive
15 |  (Kune et al., 2013) |  2013 | Analog | Defibrillator | EMI | In-band |  Medical device

###  2.4. Sensor physics from security perspective

Entry point for an attacker: Over the last three decades, transducers and
sensing structures have been technically improved in terms of stability,
accuracy, and sensitivity; however, to the best of our knowledge, designers
still do not consider security as one of the fundamental requirements while
designing transducers and sensing structures of sensors. As a result, it is
noteworthy that all the transducers and sensing structures are naive, and they
cannot differentiate between legitimate input signals and malicious fake input
signals. As a consequence, if an adversary injects malicious fake input
signals into the sensing structure, the injected fake input signals are
converted into understandable data by transducers and then propagate up to the
system controller. The system controller blindly trusts signals coming from
sensors. Therefore, this can be an entry point for an attacker. An attacker
can noninvasively inject fake input signals to the transducers or sensing
structures and can fool the system controller, resulting in a catastrophic
failure, system shutdown, or disruption of the system’s normal behavior.

Systematization of the attack signal: We need to emphasize again that the only
reason that facilitates this attack is that the sensor structure and the
transducer cannot differentiate between the legitimate input signals and the
malicious fake input signals. Therefore, this type of attack is denoted by the
transduction attack (Fu and Xu, 2018; Yan et al., 2020). Let’s denote
malicious fake input signals by $S^{f}_{in}$. Therefore, the output $S_{con}$
from the transducer in Eqn. 1 can be written as:

(2) $S^{f}_{con}=k\times f\\{S_{in}+S^{f}_{in}\\}$

where $S^{f}_{con}$ is the output from the transducer after the injection of
the malicious fake input signals $S^{f}_{in}$. The term $S^{f}_{con}$ can
propagate from the transducer to the upper level as the existing sensor
electronics blindly believe what is coming from the transducer.

Scope of our work: We consider only those attacks that originate from the fake
signal injection into the sensing structures and transducers. Let us give an
example to clarify the scope of our work. A pressure sensor can measure room
pressure. If an attacker changes the room pressure by switching on/off the
heating, ventilation, and air conditioning (HVAC) unit of the room, the room
pressure changes. As a result, the pressure sensor measures a corrupted room
pressure. We are not considering this type of attack on the pressure sensor.
Instead, we are considering that type of attack, where the attacker directly
injects fake signals into the sensing structure (i.e., diaphragm) and
transducer of the pressure sensor.

##  3\. Sensor attack model

The basic components of the sensor attack model is explained below and also
shown in Fig. 3.

i. Attacker’s capability: The attacker may not get a long time to modify the
sensor like a lunch-time attack (Garman et al., 2016). Instead, the attacker
may get a brief access near the sensor to inject the fake input signal
$S^{f}_{in}$ from a close distance. The fake input signal $S^{f}_{in}$ is a
physical signal coming from the physical domain in different forms, such as
acoustics, ultrasound, infrared, visible light, magnetic field, and electric
field, and impacting the cyber domain (Chhetri et al., 2017) of the sensor and
connected systems.

ii. Noninvasive and stealthy attack: The attacker is not allowed to invasively
access and modify any hardware and software of the sensor using physical
tempering. This type of physical invasive attack is out of the scope of our
study. Instead, our attack considers a scenario where the attacker injects a
fake input signal to noninvasively perturb the sensor’s transducer in a
stealthy manner.

Figure 3. Basic components of the sensor attack model.

iii. Attack’s outcome: As mentioned in Section 2.3, a sensor has a linear
operating region and a flattened saturation region. The attacker can inject a
fake input signal $S^{f}_{in}$ to spoof the sensor output in its linear region
or drive the sensor output to its saturation region.

In the linear region, the attacker can force the sensor to work at a
particular operating point and can cause an adversarial control. For example,
an attacker can use magnetic fields to spoof a Hall sensor in its linear
region located in a solar inverter and can intentionally change the power of
the solar inverter (Barua and Al Faruque, 2020a, 2019, b).

In the saturation region, the input-output linear relationship of sensors gets
flattened, and sensors go completely blind to any variation of the input. This
may cause catastrophic failure in the normal operation of the connected
systems resulting in a DoS attack. Typically, the attacker requires a stronger
fake input signal to drive the sensor output to its saturation region (Barua
and Al Faruque, 2022c).

Table 2. Summary of the notable published work on sensor defense. (In-band = fake and legitimate signal share same frequency band; Out-band = fake and legitimate signal share different frequency band) Sl. |  Paper |  Year | Sensor type | Sensor | Defense technique | Research challenge
---|---|---|---|---|---|---
1 |  (Barua and Al Faruque, 2020a) |  2020 | Magnetic | Hall | Shielding | Not scalable, bulky
2 |  (Shoukry et al., 2013) |  2013 | Magnetic | Hall | PyCRA | Can be bypassed
3 |  (Wang et al., 2017) |  2017 | Inertial | Accelerometer & Gyroscope | Noise cancellation | Not for in-band signal, not for saturation
4 |  (Son et al., 2015) |  2015 | Inertial | Gyroscope | Sound wave | Not for in-band signal, not for saturation
5 |  (Trippel et al., 2017) |  2017 | Inertial | Accelerometer | Randomized and $180^{0}$ out-of-phase sampling | Not for in-band signal, DC attack signal
6 |  (Tu et al., 2018) |  2018 | Inertial | Accelerometer & Gyroscope | LPF and dampening | Not for in-band signal, not for saturation
7 |  (Bolton et al., 2018) |  2018 | Inertial | Shock sensor | Sensor fusion | Costly, redundant, not for saturation
8 |  (Barua and Al Faruque, 2022a) |  2022 | Pressure | Pressure sensor | LPF | Not for in-band signal
9 |  (Tu et al., 2021) |  2021 | Pressure | Pressure sensor | Transduction shield | Finite physical distance, not for saturation
10 |  (Park et al., 2016) |  2016 | Optical | Optical sensor | PyCRA | Can be bypassed
11 |  (Davidson et al., 2016) |  2016 | Optical | Camera & Lidar | Modified optical flow algorithm | Not applicable
12 |  (Shin et al., 2017) |  2017 | Optical | Lidar | Sensor fusion, redundancy | Costly, not for saturation
13 |  (Zhang et al., 2017) |  2017 | Acoustic | Microphone | Noise cancellation | Not for in-band signal
14 |  (Yan et al., 2016) |  2016 | Acoustic | Ultrasound | Acoustic noise reduction (ANR) | For acoustic only, Not for out-band signal
15 |  (Kune et al., 2013) |  2013 | Analog | Defibrillator | Adaptive filter, LPF | Not for saturation

##  4\. Current Progress

Sensor security is comparatively a new domain in the security community that
has ongoing research for the last two decades. However, over the last decades,
the research on sensor security has been accelerated due to the advent of the
smart sensing systems in autonomous vehicles (AV), internet-of-things (IoT),
and smart automation systems. Our paper broadly classifies the ongoing
research on sensor security into two categories: (i) current progress on
sensor attack and (ii) current progress on sensor defense.

###  4.1. Current progress on sensor attack

We discuss sensor attacks in the following broad categories. A summary of the
most notable published work on sensor attack is given in Table 1 with their
publication years.

Attack on magnetic sensors: Barua et al. (Barua and Al Faruque, 2020a)
demonstrated a noninvasive attack on Hall sensors located in a solar inverter
using a magnetic field from a close distance, resulting in a shutdown of a
weak micro-grid. Shoukry et al. (Shoukry et al., 2013) showed a disruptive
magnetic spoofing attack on a Hall sensor located in an anti-lock braking
system (ABS) of a vehicle, resulting in a possible brake failure.

Attack on inertial sensors: Wang et al. (Wang et al., 2017) used an ultrasonic
gun to spoof different inertial sensors, such as MEMS accelerometers and
gyroscopes, at their resonant frequencies to create havoc in the connected
systems. Son et al. (Son et al., 2015) used a powerful sound wave to spoof the
gyroscope of a drone at its resonance frequency, making the drone
uncontrollable. Trippel et al. (Trippel et al., 2017), and Tu et al. (Tu et
al., 2018) showed an adversarial control over MEMS accelerometers and
gyroscopes using acoustic signals at their resonant frequencies. Bolton et al.
(Bolton et al., 2018) showed how acoustic signal can compromise the MEMS shock
sensor located in a hard disk drive.

Attack on pressure sensors: Barua et al. (Barua and Al Faruque, 2022a)
demonstrated a spoofing attack on pressure sensors located in a negative
pressure room (NPR), using acoustic signal at the sensor’s resonant frequency.
Tu et al. (Tu et al., 2021) showed a deliberate electromagnetic interference
(EMI) attack on an inflation pump’s pressure sensor while impacting the
system’s actuation.

Attack on optical sensors: Park et al. (Park et al., 2016) used infrared to
spoof optical sensors of an infusion pump to deliver overdose to patients.
Davidson et al. (Davidson et al., 2016) reported how spoofing optical sensors
of an unmanned aerial vehicle (UAV) can compromise its complete control. Shin
et al. (Shin et al., 2017) showed a spoofing attack on Lidar to create
illusions of objects appearing closer in automotive systems.

Attack on acoustic sensors: Zhang et al. (Zhang et al., 2017) injected
inaudible commands into a microphone using ultrasonic carriers. Yan et al.
(Yan et al., 2016) showed an attack on ultrasonic sensors of a vehicle using
acoustic waves to impair vehicle safety.

Attack on other analog sensors: Kune et al. (Kune et al., 2013) spoofed
sensors by EMI to induce defibrillation shocks on cardiac devices.

It is just a matter of time before more attacks on sensors will emerge from
different attack surfaces as sensors are getting complex and sophisticated
nowadays without improving their security.

###  4.2. Current progress on sensor defense

We discuss sensor defense in the following broad categories. A summary of the
most notable sensor defenses is given in Table 2.

Defense for magnetic sensors: Barua et al. (Barua and Al Faruque, 2020a)
proposed strong magnetic shielding with a secure surrounding to prevent the
magnetic spoofing attack on Hall sensors. Shoukry et al. (Shoukry et al.,
2013) proposed PyCRA to randomize the transmission and reception of signals to
prevent magnetic spoofing attacks on ABS sensors of automotive. However, PyCRA
only works for active sensors (Shoukry et al., 2013).

Defense for inertial sensors: Trippel et al. (Trippel et al., 2017) proposed
randomized and $180^{0}$ out-of-phase sampling to nullify acoustic spoofing
signals injected into MEMS accelerometers. Son et al. (Son et al., 2015)
proposed resonance tuning using a feedback capacitor to prevent the out-band
resonant frequency. Wang et al. (Wang et al., 2017) proposed to use an
external microphone to detect the resonating sound and perform noise
cancellation. Tu et al. (Tu et al., 2018) proposed low-pass filtering (LPF)
along with the dampening of the injected ultrasound.

Defense for pressure sensors: Barua et al. (Barua and Al Faruque, 2022a) used
an LPF to filter out the sound wave from pressure sensors to prevent acoustic
spoofing on pressure sensors. Tu et al. (Tu et al., 2021) used a transduction
shield to measure the fake signal first and then subtract it from the
corrupted signal to recover the legitimate signal.

Defense for optical sensors: Park et al. (Park et al., 2016) measured the
light intensity to detect the attack and used PyCRA to prevent it. Shin et al.
(Shin et al., 2017) propose sensor fusion and redundancy to prevent the
optical attack on a lidar.

Defense for acoustic sensors: Zhang et al. (Zhang et al., 2017) used a
modulation - demodulation based noise canceling technique to cancel out the
injected ultrasound. Yan et al. (Yan et al., 2016) proposed shielding and
acoustic noise reduction (ANR) by emitting a sound with minor phase and
amplitude adjustment.

Defense for other analog sensors: Kune et al. (Kune et al., 2013) proposed
adaptive filtering to estimate the spoofing attack signal first and then
subtract the estimated attack signal from the original signal to clean up the
original signal.

##  5\. Research challenges

The defense techniques described in Section 4.2 have research challenges. A
summary of research challenges is given in Table 2.

Shielding and dampening: Barua et al. (Barua and Al Faruque, 2020a) and Tu et
al. (Tu et al., 2018) proposed shielding to dampen the injected fake magnetic
field and fake ultrasound, respectively. Though shielding is a cheap and quick
countermeasure for a few of the fake injected signals, such as sound wave,
ultrasound, and infrared, shielding might fail for other signals, such as
magnetic fields. For example, a strong shield again may fail to a stronger
magnetic field injected by an attacker. To increase the shielding property of
a shield so that it can work for a stronger attack signal, the designer may
need to increase the thickness of the shield. As even a thick shield can be
penetrated by a stronger magnetic field, there is no sweet spot for shielding
to claim that it can prevent a magnetic field of any strength. Therefore, only
shielding cannot be considered as a sole defense for sensors.

Randomization of transmission (PyCRA): Shoukry et al (Shoukry et al., 2015a)
proposed PyCRA; however, PyCRA only works for active sensors, not for passive
sensors. Moreover, Shin et al. (Shin et al., 2016) showed that the implemented
authentication mechanism of PyCRA can be successfully bypassed with a low-cost
circuit. This proves that there is currently no effective, robust and
generalizable defense scheme against active sensor spoofing attacks.

Randomized and $180^{0}$ out-of-phase sampling: These two techniques from
(Trippel et al., 2017) only work for out-band resonant frequency attack
signals. However, they do not work other than a specific resonant frequency,
for example, any attack frequency. Moreover, they do not work against a DC
forged signal because randomized sampling cannot filter out a DC signal. In
addition, they do not work when the sensor output is flattened in the
saturation region.

Adaptive filter and transduction shield: Both of these defense techniques from
(Kune et al., 2013; Tu et al., 2021) work similarly by estimating the spoofing
attack signal first and then subtracting the estimated attack signal from the
original signal to clean up the original signal. These techniques will fail in
the following two scenarios: (i) Because of the finite physical distance
between the adaptive filter or transduction shield and the compromised sensor,
the adaptive filter or transduction shield cannot measure the exact amplitude
of the external attack signals. This is why we can not simply subtract the
estimated attack signals from the original signals to recover the original
signal. (ii) They do not work when the sensor output is flattened in the
saturation region.

LPF and other filtering techniques: LPF and other filtering techniques in
(Barua and Al Faruque, 2022a; Kune et al., 2013) only work as a successful
defense when the fake attack signal has a predicable frequency spectrum and is
an out-band signal. If the injected fake signal shares the same frequency band
as the legitimate signal, LPF or other filtering techniques cannot accurately
filter out the fake attack signals. The reason behind this is that while
filtering the attack signals, they also filter out the same band of legitimate
signals.

Machine learning (ML) techniques: Machine learning (ML) techniques require
complex computations to converge for attack detection and recovery, requiring
powerful hardware resources. Therefore, they are not suitable for low-power
real-time sensor systems with constrained resources. In addition, they may not
work against a time-varying magnetic spoofing as a time-varying signal may
create oscillations between two safe states of the controller, and they are
incapable of handling these oscillations in real-time.

###  5.1. Area of focus

If we analyze all the notable defenses from Table 2 published throughout the
last decade, we can conclude the following points:

$\blacksquare$ The defenses were proposed on an ad-hoc basis. For example, the
researchers first find a security issue with the sensor and then try to come
up with a defense to overcome it. Researchers only focus on a specific
security issue rather than focusing on all the corner cases from all the
attack surfaces. Therefore, a proposed defense for a particular type of sensor
is not applicable to other types. For example, the randomized and $180^{0}$
out-of-phase sampling (Trippel et al., 2017), which are applicable for MEMS
inertial sensors to nullify out-band resonant attack frequency, is not
applicable for magnetic Hall sensors because Hall sensors can have in-band
attack frequency other than a specific out-band resonant frequency (Barua and
Al Faruque, 2020a).

$\blacksquare$ There is no defense technique exists in the literature that can
prevent sensors from going into the saturation region or recover information
from the sensor’s saturation region.

$\blacksquare$ There is no defense, which can contain a fake injected signal
having the same frequency as the legitimate signal.

$\blacksquare$ As PyCRA (Shoukry et al., 2015a) can be bypassed, there is no
defense in the literature for active sensors till to date.

Therefore, sensor security is still a malnourished domain, which requires more
attention from security researchers.

##  6\. Future roadmap

Sensor heterogeneity: The fundamental challenge of designing and modeling a
robust and secured sensor is the heterogeneity of sensor types. The
heterogeneity of sensors exists because of the sensor’s signal modality, which
differs from the sensor to sensor. For example, a Hall sensor handles magnetic
fields and a pressure sensor handles pressure waves as the signal modality. As
sensors differ from each other in terms of signal modality, the proper
selection of transducers and sensor electronics also differ from sensor to
sensor depending on the signal modality. Therefore, a single generalized
defense technique that is applicable to all sensors will be quite complicated.
However, it is still worth giving it a try from a sensor security research
point of view because the future days will be the days for smart sensors, and
security will be a big concern for them.

###  6.1. Golden reference for sensor defense

The next generation of research on sensor security should have to consider the
security from designing the transducer to the implementation of the sensor
electronics. Instead of implementing an ad-hoc defense, researchers must
ensure a checklist before finally adopting a technique as a sensor defense. We
name this checklist by the Golden reference for a sensor defense against a
transduction attack. This golden reference has the following points.

  1. (i)

The defense should simultaneously work for in-band and out-band fake injected
input signals.

  2. (ii)

The defense should prevent a sensor from going into the saturation region
because of the injection of fake input signals.

  3. (iii)

The defense should contain a fake injected signal even it has the same
frequency as the legitimate input signal.

  4. (iv)

The defense should work for active and passive sensors. If a single defense
does not simultaneously work for both sensors, there should be a defense
targeting an active sensor and another separate defense targeting a passive
sensor.

  5. (v)

The defense should be hard real-time.

  6. (vi)

The defense should not hamper the existing data processing speed or bandwidth
of the sensor.

###  6.2. Roadmap to achieve the Golden reference

The Golden reference for sensor defense can not be achieved alone by only
hardware or only software modification; instead, a hardware/software (HW/SW)
co-design approach is required in the sensor domain. The sensors should be
redesigned from the transducer level to the sensor electronics level. A smart
transducer should be built instead of a naive one, and an intelligent and low-
complexity algorithm should be adopted in the sensor electronics. We explain
the roadmap to achieve the Golden reference below.

####  6.2.1. Encrypted analog signal:

The main reason for sensor vulnerability is that the legitimate analog signal
$S_{in}$, which is going to be measured by the sensor, is not encrypted before
going into the transducer. Therefore, the attacker can use a fake signal
$S^{f}_{in}$ to corrupt the legitimate signal $S_{in}$. This problem can be
solved by encrypting the legitimate analog signal with a key in the analog
domain and decrypting the legitimate signal in the transducer side or in the
sensor electronics using the same key. The analog domain encryption can be
achieved using the following ways:

$\blacksquare$ First, an orthogonal noise can be padded with the legitimate
signal $S_{in}$ to hide the information from the attack surface. This method
is known as analog scrambling (Pichler, 1982).

$\blacksquare$ Second, the legitimate signal $S_{in}$ can be mapped into the
broad spectrum. This technique is known as frequency hopping spread spectrum
(Ipatov, 2005) and can be adopted in the sensor domain.

$\blacksquare$ Third, the legitimate signal $S_{in}$ can be encrypted in the
analog domain using a pseudo-noise, which is the original key. More keys can
be generated using the original key to decrypt the signal (Slimani and
Merazka, 2018).

Please note that encryption of the legitimate analog signal is the ultimate
solution for a robust sensor. This defense technique would achieve the points
i-iv of the Golden reference in Section 6.1; however, it may or may not hamper
the data processing speed (point v) and real-time requirement (point vi) of
the sensor depending upon the encryption complexity.

####  6.2.2. Modifying the transducer:

The transducer must be resilient enough to reject the injected fake signal
$S^{f}_{in}$. As a transducer is an entry point to the sensor, if a transducer
can reject the fake signal, this approach would diminish the burden of using a
complex encryption algorithm in the sensor hardware. Industry is adopting this
scheme nowadays where ever it is feasible. For example, Hall current sensors
use a Hall element as a transducer. Two Hall elements (see Fig. 4) are placed
inside of a Hall current sensor in a differential manner to reject common-mode
noise (Alexander, 2019). As the injected fake signal $S^{f}_{in}$ is common to
the differential Hall element, the injected fake signal $S^{f}_{in}$ can be
considered as common-mode noise and can be eliminated from the sensor at the
transducer level. Though this strategy is quite novel, it has its own
implementation challenge for all types of sensors. Research along this
direction would be influential in future for a secured sensor.

Figure 4. A basic overview of the differential sensing.

####  6.2.3. Preventing sensor saturation:

As mentioned in Section 3, if an attacker can drive the sensor to its
saturation region, the output gets flattened, and no information can be
retrieved, resulting in a DoS attack on sensors. This attack is known as
saturation attack (Barua and Al Faruque, 2022c). The core idea behind
preventing a saturation attack is to generate an internal signal, which has
the same strength but in opposite polarity to the injected fake signal, so
that the internal signal can nullify the injected fake signal. Barua et al.
(Barua and Al Faruque, 2022c) conceptualized and implemented this idea in the
context of Hall magnetic sensors by providing a defense named PreMSat. The
idea of PreMSat can be extended to other sensor types as well.

Figure 5. A basic overview of the improved algorithm (Barua and Al Faruque,
2022b).

####  6.2.4. Improving the adaptive filter and transduction shield:

The main bottleneck of using the adaptive filter and transduction shield is
the introduced error in the estimated attack signals for the physical distance
present between the sensor and the shield (see Section 5). This problem can be
solved by using an improved defense algorithm proposed by Barua et al. (Barua
and Al Faruque, 2022b). The main idea of this algorithm is that the difference
between the measured signal during the attack and before the attack gives the
amount of injected error after the attack. This algorithm tracks this
difference all the time and generates a feedback signal to nullify the
injected error by the attacker. The idea is illustrated in Fig. 5.

####  6.2.5. Context-aware anomaly detection:

An injected fake signal can be considered as an anomaly. Traditional anomaly
detection algorithms are not low-power and hence, they are not suitable for
sensor hardware. Therefore, a low-power and low- complexity algorithm may be
another feasible option to run on the sensor hardware to detect injected fake
signals. A low-power anomaly detection algorithm named as Hierarchical
Temporal Memory (HTM) can be evaluated to detect context aware anomaly
detection on the sensor data (Barua et al., 2020b, a). Moreover, the context-
aware sensor association method (Yasaei et al., 2020) can be evaluated further
as a defense technique for sensors.

####  6.2.6. Control-theoretic approach:

State estimation and state recovery based control-theoretic defense approaches
can be another option to recover a system controller after the transduction
attack. Shoukry et al. (Shoukry et al., 2015b) proposed reconstructing the
sensor state to recover from a sensor spoofing attack using the satisfiability
modulo theory (SMT). Wang et al. (Wang et al., 2014) demonstrated a graph-
based technique to track states in the system controller to detect an
intrusion. However, the correct direction will be to incorporate the sensor’s
physics and physical knowledge of the system with the control-theoretic
approach for accurate estimation of the states.

####  6.2.7. Sensor fusion based context aware:

Sensor fusion and redundancy (Shin et al., 2017; Wang et al., 2017; Xu et al.,
2018; Bolton et al., 2018) based approaches can be merged with ML algorithm to
create an appropriate context and abstraction of the sensor data. Therefore,
during an attack, the sensor data can be recovered from a proper context using
abstracted sensor data. The data abstraction can be made intelligent and
adaptive to tackle the continuous change of the sensor environment. However,
sensor fusion adds extra price and complexity to the system; therefore,
designers try to avoid this unless it is arguably required.

##  7\. Conclusion

In this paper, we present a notion of sensor security, whereby, we focus on
the importance of security measures that needs to be taken while designing a
sensor. We discuss that sensors are vulnerable to external fake signals and
give a summary of existing defenses in the sensor domain. We point out the
limitations of existing defense techniques and emphasize that very little to
no work exists in the sensor security domain. Therefore, we emphasize that the
next generation of research on sensor security should have to ensure a Golden
reference before finally adopting a technique as a sensor defense. We also
provide a roadmap on how to achieve the Golden reference checklist while
designing a robust and resilient sensor.

###### Acknowledgements.

This work was partially supported by the National Science Foundation (NSF)
under awards CMMI-1739503 and ECCS-2028269. Any opinions, findings,
conclusions, or recommendations expressed in this paper are those of the
authors and do not necessarily reflect the views of the funding agencies.

## References

  * (1)
  * Alexander (2019) Latham Alexander. 2019\.  _Common Mode Field Rejection in Coreless Hall-Effect Current Sensor ICs_.  https://www.allegromicro.com/-/media/files/application-notes/an269123-common-mode-field-rejection-in-coreless-current-sensor-ics.pdf. (Accessed: 03-22-2022).
  * Barua and Al Faruque (2019) Anomadarshi Barua and Mohammad Abdullah Al Faruque. 2019\.  _The Hall Sensor Security_.  Springer Berlin Heidelberg, Berlin, Heidelberg, 1–4.  https://doi.org/10.1007/978-3-642-27739-9_1652-1
  * Barua and Al Faruque (2020a) Anomadarshi Barua and Mohammad Abdullah Al Faruque. 2020a.  Hall Spoofing: A Non-Invasive DoS Attack on Grid-Tied Solar Inverter. In _29th USENIX Security Symposium (USENIX Security 20)_. USENIX Association, 1273–1290.  https://www.usenix.org/conference/usenixsecurity20/presentation/barua
  * Barua and Al Faruque (2020b) Anomadarshi Barua and Mohammad Abdullah Al Faruque. 2020b.  Special session: Noninvasive sensor-spoofing attacks on embedded and cyber-physical systems. In _2020 IEEE 38th International Conference on Computer Design (ICCD)_. IEEE, 45–48.
  * Barua and Al Faruque (2022a) Anomadarshi Barua and Mohammad Abdullah Al Faruque. 2022a.  A Wolf in Sheep’s Clothing: Spreading Deadly Pathogens Under the Disguise of Popular Music. In _29th ACM Conference on Computer and Communications Security (CCS)_.
  * Barua and Al Faruque (2022b) Anomadarshi Barua and Mohammad Abdullah Al Faruque. 2022b.  HALC: A Real-time In-sensor Defense against the Magnetic Spoofing Attack on Hall Sensors. In _25th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2022)_.
  * Barua and Al Faruque (2022c) Anomadarshi Barua and Mohammad Abdullah Al Faruque. 2022c.  PreMSat: Preventing Magnetic Saturation Attack on Hall Sensors. In _International Conference on Cryptographic Hardware and Embedded Systems (TCHES 2022)_.
  * Barua et al. (2020a) Anomadarshi Barua, Deepan Muthirayan, Pramod P Khargonekar, and Mohammad Abdullah Al Faruque. 2020a.  Hierarchical temporal memory based machine learning for real-time, unsupervised anomaly detection in smart grid: WiP abstract. In _2020 ACM/IEEE 11th International Conference on Cyber-Physical Systems (ICCPS)_. IEEE, 188–189.
  * Barua et al. (2020b) Anomadarshi Barua, Deepan Muthirayan, Pramod P Khargonekar, and Mohammad Abdullah Al Faruque. 2020b.  Hierarchical temporal memory based one-pass learning for real-time anomaly detection and simultaneous data prediction in smart grids.  _IEEE Transactions on Dependable and Secure Computing_ (2020).
  * Bolton et al. (2018) Connor Bolton, Sara Rampazzi, Chaohao Li, Andrew Kwong, Wenyuan Xu, and Kevin Fu. 2018\.  Blue note: How intentional acoustic interference damages availability and integrity in hard disk drives and operating systems. In _2018 IEEE Symposium on Security and Privacy (SP)_. IEEE, 1048–1062.
  * Chhetri et al. (2017) Sujit Rokka Chhetri, Jiang Wan, and Mohammad Abdullah Al Faruque. 2017\.  Cross-domain security of cyber-physical systems. In _2017 22nd Asia and South Pacific design automation conference (ASP-DAC)_. IEEE, 200–205.
  * Davidson et al. (2016) Drew Davidson, Hao Wu, Rob Jellinek, Vikas Singh, and Thomas Ristenpart. 2016.  Controlling UAVs with sensor input spoofing attacks. In _10th $\\{$USENIX$\\}$ Workshop on Offensive Technologies ($\\{$WOOT$\\}$ 16)_.
  * Fu and Xu (2018) Kevin Fu and Wenyuan Xu. 2018.  Risks of trusting the physics of sensors.  _Commun. ACM_ 61, 2 (2018), 20–23.
  * Garman et al. (2016) Christina Garman, Matthew Green, Gabriel Kaptchuk, Ian Miers, and Michael Rushanan. 2016.  Dancing on the lip of the volcano: Chosen ciphertext attacks on apple imessage. In _25th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 16)_. 655–672.
  * Ipatov (2005) Valeri P Ipatov. 2005\.  _Spread spectrum and CDMA: principles and applications_.  John Wiley & Sons.
  * Kune et al. (2013) Denis Foo Kune, John Backes, Shane S Clark, Daniel Kramer, Matthew Reynolds, Kevin Fu, Yongdae Kim, and Wenyuan Xu. 2013\.  Ghost talk: Mitigating EMI signal injection attacks against analog sensors. In _2013 IEEE Symposium on Security and Privacy_. IEEE, 145–159.
  * Park et al. (2016) Youngseok Park, Yunmok Son, Hocheol Shin, Dohyun Kim, and Yongdae Kim. 2016.  This ain’t your dose: Sensor spoofing attack on medical infusion pump. In _10th $\\{$USENIX$\\}$ Workshop on Offensive Technologies ($\\{$WOOT$\\}$ 16)_.
  * Pichler (1982) Franz Pichler. 1982\.  Analog scrambling by the general fast Fourier transform. In _Workshop on Cryptography_. Springer, 173–178.
  * Shin et al. (2017) Hocheol Shin, Dohyun Kim, Yujin Kwon, and Yongdae Kim. 2017\.  Illusion and dazzle: Adversarial optical channel exploits against lidars for automotive applications. In _International Conference on Cryptographic Hardware and Embedded Systems_. Springer, 445–467.
  * Shin et al. (2016) Hocheol Shin, Yunmok Son, Youngseok Park, Yujin Kwon, and Yongdae Kim. 2016.  Sampling Race: Bypassing $\\{$Timing-Based$\\}$ Analog Active Sensor Spoofing Detection on $\\{$Analog-Digital$\\}$ Systems. In _10th USENIX Workshop on Offensive Technologies (WOOT 16)_.
  * Shoukry et al. (2013) Yasser Shoukry, Paul Martin, Paulo Tabuada, and Mani Srivastava. 2013.  Non-invasive spoofing attacks for anti-lock braking systems. In _International Conference on Cryptographic Hardware and Embedded Systems_. Springer, 55–72.
  * Shoukry et al. (2015a) Yasser Shoukry, Paul Martin, Yair Yona, Suhas Diggavi, and Mani Srivastava. 2015a.  Pycra: Physical challenge-response authentication for active sensors under spoofing attacks. In _Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security_. 1004–1015.
  * Shoukry et al. (2015b) Yasser Shoukry, Pierluigi Nuzzo, Nicola Bezzo, Alberto L Sangiovanni-Vincentelli, Sanjit A Seshia, and Paulo Tabuada. 2015b.  Secure state reconstruction in differentially flat systems under sensor attacks using satisfiability modulo theory solving. In _2015 54th IEEE Conference on Decision and Control (CDC)_. IEEE, 3804–3809.
  * Slimani and Merazka (2018) Dalila Slimani and Fatiha Merazka. 2018.  Encryption of speech signal with multiple secret keys.  _Procedia computer science_ 128 (2018), 79–88.
  * Son et al. (2015) Yunmok Son, Hocheol Shin, Dongkwan Kim, Youngseok Park, Juhwan Noh, Kibum Choi, Jungwoo Choi, and Yongdae Kim. 2015\.  Rocking drones with intentional sound noise on gyroscopic sensors. In _24th USENIX Security Symposium (USENIX Security 15)_. 881–896.
  * Trippel et al. (2017) Timothy Trippel, Ofir Weisse, Wenyuan Xu, Peter Honeyman, and Kevin Fu. 2017.  WALNUT: Waging doubt on the integrity of MEMS accelerometers with acoustic injection attacks. In _2017 IEEE European symposium on security and privacy (EuroS &P)_. IEEE, 3–18.
  * Tu et al. (2018) Yazhou Tu, Zhiqiang Lin, Insup Lee, and Xiali Hei. 2018\.  Injected and delivered: Fabricating implicit control over actuation systems by spoofing inertial sensors. In _27th USENIX Security Symposium (USENIX Security 18)_. 1545–1562.
  * Tu et al. (2021) Yazhou Tu, Vijay Srinivas Tida, Zhongqi Pan, and Xiali Hei. 2021\.  Transduction Shield: A Low-Complexity Method to Detect and Correct the Effects of EMI Injection Attacks on Sensors. In _Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security_. 901–915.
  * Wang et al. (2014) Yong Wang, Zhaoyan Xu, Jialong Zhang, Lei Xu, Haopei Wang, and Guofei Gu. 2014\.  Srid: State relation based intrusion detection for false data injection attacks in scada. In _European Symposium on Research in Computer Security_. Springer, 401–418.
  * Wang et al. (2017) Zhengbo Wang, Kang Wang, Bo Yang, Shangyuan Li, and Aimin Pan. 2017.  Sonic gun to smart devices: Your devices lose control under ultrasound/sound.  _Black Hat USA_ (2017), 1–50.
  * Xu et al. (2018) Wenyuan Xu, Chen Yan, Weibin Jia, Xiaoyu Ji, and Jianhao Liu. 2018.  Analyzing and enhancing the security of ultrasonic sensors for autonomous vehicles.  _IEEE Internet of Things Journal_ 5, 6 (2018), 5015–5029.
  * Yan et al. (2020) Chen Yan, Hocheol Shin, Connor Bolton, Wenyuan Xu, Yongdae Kim, and Kevin Fu. 2020\.  Sok: A minimalist approach to formalizing analog sensor security. In _2020 IEEE Symposium on Security and Privacy (SP)_. IEEE, 233–248.
  * Yan et al. (2016) Chen Yan, Wenyuan Xu, and Jianhao Liu. 2016.  Can you trust autonomous vehicles: Contactless attacks against sensors of self-driving vehicle.  _DEF CON_ 24, 8 (2016), 109.
  * Yasaei et al. (2020) Rozhin Yasaei, Felix Hernandez, and Mohammad Abdullah Al Faruque. 2020\.  Iot-cad: context-aware adaptive anomaly detection in iot systems through sensor association. In _2020 IEEE/ACM International Conference On Computer Aided Design (ICCAD)_. IEEE, 1–9.
  * Zhang et al. (2017) Guoming Zhang, Chen Yan, Xiaoyu Ji, Tianchen Zhang, Taimin Zhang, and Wenyuan Xu. 2017\.  Dolphinattack: Inaudible voice commands. In _Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security_. 103–117.