# Cyber-Physical Security of Vehicles:
Zero Dynamics Attacks Against Vehicle's Lateral Dynamics

Ghadeer Shaaban, Hassen Fourati, Alain Kibangou, Christophe Prieur, and Mohammad Pirani

***Abstract***— Modern vehicles have evolved from mechanical systems to complex and connected ones. While this development has improved their efficiency, it also brings new potential risks, particularly cyber-attacks. The vehicle's lateral dynamics are crucial for maintaining stability and control during turns and maneuvers, making them a key focus of research. However, only a few recent studies have specifically investigated the security of lateral dynamics. This paper explores the potential for zero dynamics attacks on the vehicle's lateral dynamics, where the attacker can remain undetected by leaving no trace on the system's outputs. Three scenarios are studied: when the output includes yaw rate, lateral acceleration, and their combination. These two critical measurements of a vehicle's lateral motion are accessible through the inertial measurement units (IMU) in every vehicle. For each scenario, the impact of zero dynamics attacks on system performance is analyzed and illustrated through simulations. Finally, the paper provides recommendations for securing vehicles' lateral dynamics against such attacks.

***Index Terms***— Zero dynamics attack, lateral dynamics, cyber-physical security, vehicle security.

## I. INTRODUCTION

### A. Motivation

Modern vehicles have become complex, with many control units, sensors, and actuators connected through internal networks. While enabling advanced functionality, this also introduces security vulnerabilities. Attackers can access the internal network, intercept messages, and manipulate sensor and control signals. As these threats endanger human safety, vehicle security has become a critical research focus in both academia and industry.

### B. Literature review

The research on Cyber-Physical Systems (CPS) security focuses on designing and defending systems against one of the three main types of cyber attacks: denial of service attacks (DoS), replay attacks, and false data injection (FDI) attacks [4]. In [11], [18], [21], FDI and spoofing attacks against vehicle sensors attacks are studied.

Fundamental vehicle dynamics are the lateral dynamics, which describe the vehicle's lateral movement. Lateral dynamics involve the lateral velocity and yaw rate dynamics,

with two inputs: the steering angle, which is an input by the driver, and the yaw moment, which can be generated by independent in-wheel motors. The yaw moment plays a vital role in enhancing vehicle stability and controllability. The yaw rate can be directly measured by IMU sensors, but lateral velocity lacks direct measurement. Instead, it is estimated based on the dynamic model, inputs and other sensors' measurements, such as yaw rate measurements [12], [14], lateral acceleration measurements [5], or a combination of both [2], [3]. Due to the importance of lateral dynamics, extensive research has focused on control methods [1], [9], [23], [24], as well as on estimation and observation techniques for the lateral model [5], [6], [12], [14]. On the other hand, only few and recent works have focused on the security of lateral model. Attacks that modify sensor signals to cause damage in the lateral control have been proposed in [7]. In [15], security measures are proposed to protect against attackers who aim to infer lateral controller gains' values. In [13], the lateral model is compromised by attacking the braking system and continuously varying the longitudinal slip of the wheels.

One class of FDI attacks that target system inputs is the zero dynamics attacks, where the attacker exploits the invariant zeros of the system to perform attacks leaving no trace on the system's outputs, making these attacks undetectable [16], [17]. It is proven in [20] that the zero dynamics attacks are disruptive, i.e. puts the system on high risk, if the attacks excite unstable invariant zeros of the system.

### C. Contributions

To the best of the authors' knowledge, zero dynamics attacks have not been studied for vehicle lateral dynamics. In the current work, we study and analyze the invariant zeros of the vehicle's lateral model, and show how the attacker can exploit these zero dynamics to perform undetectable attacks, leaving no trace to the system's outputs, namely lateral acceleration and yaw rate. We study three cases of output, when the output consists only of yaw rate measurements, when it consists only of lateral acceleration measurements, and when it consists of a combination of both. Additionally, we exploit the relationship between the system's invariant zeros and its strong observability and detectability properties to analyze these characteristics in the lateral dynamics model. The main contributions of this work are:

1. **Attacks Design:** Study the existence of invariant zeros of the vehicle's lateral dynamics, design zero dynamics attacks and explore their potential to be disruptive.

2. **Attacks Prevention:** Suggest measures to protect the lateral dynamics against zero dynamics attacks.

Ghadeer Shaaban, Hassen Fourati, Alain Kibangou, and Christophe Prieur are with Univ. Grenoble Alpes, CNRS, Inria, Grenoble-INP, GIPSA-LAB, Grenoble, France. Alain Kibangou is also with the Faculty of Science, University of Johannesburg (Auckland Park Campus), Johannesburg 2006, South Africa. Mohammad Pirani is with the Department of Mechanical Engineering, University of Ottawa, Ottawa, ON K1N 6N5, Canada. (e-mails: ghadeer.shaaban@gipsa-lab.fr; hassen.fourati@gipsa-lab.fr; alain.kibangou@gipsa-lab.fr; christophe.prieur@gipsa-lab.fr; mpi-rani@uottawa.ca)
3) **Observability Under Attacks:** Investigate the strong observability and detectability properties of the lateral dynamics model by examining its invariant zeros.

The remainder of this paper is as follows: Section II provides preliminaries on the vehicle lateral model, invariant zeros, zero dynamics attacks, and the problem statement. Section III studies the existence of invariant zeros, designs and analyzes the zero dynamics attacks for the three cases of output. Section IV provides some simulations to illustrate the findings. Finally, Section V concludes the paper.

## II. PRELIMINARIES AND PROBLEM STATEMENT

### A. Vehicle's linear lateral model

The two-degrees-of-freedom bicycle model is a widely used approach for analyzing vehicle lateral dynamics, describing the dynamics of lateral velocity, $v_y$, and yaw rate, $r = \psi$ [8], [19], where $\psi$ is the vehicle's yaw (heading) angle. The vehicle's bicycle model with front-wheel steering is shown in Fig. 1. The body frame which is attached to the vehicle, has its origin in the vehicle's center of gravity (CG), its x-axis and y-axis are aligned with the longitudinal and lateral axes, respectively. The distances from CG to the front and rear axles are denoted by $a$ and $b$, respectively. The steering angle, which is a command by the driver is denoted by $\delta$. In addition to the steering angle $\delta$, a control input $M_z$, representing the yaw moment, is designed to stabilize the lateral motion. The following linear state space model

<figure><img src="image_1.png" /><figcaption>Fig. 1: Plan view of vehicle dynamics model.</figcaption></figure>

describes the vehicle lateral motion dynamics [8], [19]:

$$ \dot{\mathbf{x}} = \mathbf{A}\mathbf{x} + \mathbf{B}M_z + \mathbf{E}\delta, \quad (1) $$

where $\mathbf{x} = [v_y \ r]^T$ is the state vector, and the matrices $\mathbf{A}$, $\mathbf{B}$ and $\mathbf{E}$ are the state matrix, the input matrix for the yaw moment, and the input matrix for the steering angle, respectively, and have the following forms:

$$ \mathbf{A} = \begin{bmatrix} a_{11} & a_{12} \\ a_{21} & a_{22} \end{bmatrix}, \quad \mathbf{B} = \begin{bmatrix} 0 \\ b_2 \end{bmatrix}, \quad \mathbf{E} = \begin{bmatrix} e_1 \\ e_2 \end{bmatrix}, \quad (2) $$

and $a_{11} = -2\frac{C_f+C_r}{v_x m}$, $a_{12} = 2\frac{bC_r-aC_f}{v_x m} - v_x$, $a_{21} = 2\frac{bC_r-aC_f}{v_x I_z}$, $a_{22} = -2\frac{a^2C_f+b^2C_r}{v_x I_z}$, $b_2 = \frac{1}{I_z}$, $e_1 = \frac{2C_f}{m}$ and $e_2 = \frac{2aC_f}{I_z}$. The parameters $C_f$, $C_r$, $v_x$, $m$, $I_z$ are the front and rear wheels' cornering stiffness, the vehicle's

longitudinal velocity, the vehicle's total mass, and the vehicle's moment of inertia around z-axis, respectively.

**Remark:** Although the bicycle model is relatively simple and relies on certain assumptions to yield a linear representation of the system, it effectively captures key lateral vehicle dynamics. Its effectiveness in practical applications validates its use in control design and analysis [8], [19].

There is no direct measurement of the vehicle's lateral velocity, and it is estimated using the dynamic model (1) and knowledge of the system inputs $M_z$ and $\delta$, and measurement of yaw rate [12], [14], lateral acceleration [5], or both [2], [3]. These measurements are feasible by using an IMU. We describe hereafter the output model in each case of measurements. The first case concerns yaw rate as output, thus $y_1 = r$, the output matrix is:

$$ \mathbf{C}_1 = [0 \ 1], \quad (3) $$

The second case concerns lateral acceleration as output, thus $y_2 = a_y = \dot{v}_y + v_x r$. From the dynamic model (1) we have $y_2 = a_{11}v_y + a_{12}r + e_1\delta + v_x r = [a_{11} \ a_{12} + v_x] \mathbf{x} + e_1\delta$, the output matrix is:

$$ \mathbf{C}_2 = \begin{bmatrix} a_{11} & a_{12} + v_x \end{bmatrix}. \quad (4) $$

In the third case, the output consists of the two measurements, and the output model is given by $\mathbf{y}_3 = [r \ a_y]^T = \mathbf{C}_3\mathbf{x} + [0 \ e_1]^T\delta$, where the output matrix $\mathbf{C}_3$ is:

$$ \mathbf{C}_3 = \begin{bmatrix} 0 & 1 \\ a_{11} & a_{12} + v_x \end{bmatrix}. \quad (5) $$

The following equation summarizes the output model for the three cases of measurements:

$$ \mathbf{y}_i = \mathbf{C}_i\mathbf{x} + \mathbf{D}_i^\delta\delta, \quad (6) $$

where $i \in \{1, 2, 3\}$, $\mathbf{D}_1^\delta = 0$, $\mathbf{D}_2^\delta = e_1$, and $\mathbf{D}_3^\delta = [0 \ e_1]^T$.

### B. Zero dynamics attacks

This subsection defines the undetectable attack [16], [17], and its relation with the existence of invariant zeros. It further presents the connection between zero dynamics attacks and strong observability and detectability properties.

1) **Undetectable zero dynamics attacks:** We adapt the definition of undetectable attacks which is defined in [16], [17] for the vehicle lateral model. Recalling the linear vehicle lateral dynamics (1) and the output model (6):

$$ \begin{gathered} \dot{\mathbf{x}} = \mathbf{A}\mathbf{x} + \mathbf{B}M_z + \mathbf{E}\delta, \\ \mathbf{y}_i = \mathbf{C}_i\mathbf{x} + \mathbf{D}_i^\delta\delta. \end{gathered} \quad (7) $$

We assume that the attacker injects signal $M_z^a$ to the input $M_z$, without altering the input $\delta$ as it is a mechanical command by the driver.

**Definition 2.1:** [Undetectable attacks [16], [17]] Consider the linear system (7), and let $\mathbf{y}_i(\mathbf{x}^\alpha(t_0), M_z^a, t)$ be the system's output at time $t \ge t_0$, given an initial state $\mathbf{x}^\alpha(t_0)$ and the presence of an injection of attack signal $M_z^a$, the attacks are considered undetectable if there exists an initial
state $\mathbf{x}^{\beta}(t_0)$ such that $\mathbf{y}_i(\mathbf{x}^{\alpha}(t_0), M_z^a, t) = \mathbf{y}_i(\mathbf{x}^{\beta}(t_0), 0, t)$.

Note that, because of the linearity of (7), the attack undetectability condition as presented in Definition 2.1 is equivalent to finding initial condition $\mathbf{x}(t_0)$ resulting $\mathbf{y}_i(\mathbf{x}(t_0), M_z^a, t) = \mathbf{0}$, specifically $\mathbf{x}(t_0) = \mathbf{x}^{\alpha}(t_0) - \mathbf{x}^{\beta}(t_0)$, for the following model:

$$ 
\begin{aligned}
\dot{\mathbf{x}} &= \mathbf{A}\mathbf{x} + \mathbf{B}M_z^a, \\
\mathbf{y}_i &= \mathbf{C}_i\mathbf{x}.
\end{aligned}
\qquad (8) $$

The resulting dynamics of (8) after applying the attack signal $M_z^a$, which makes the output equal to zero, is called zero dynamics, and the attack signal is called zero dynamics attacks. By applying Laplace transformation on (8) and setting the output to zero, we get:

$$ 
\begin{aligned}
s\mathbf{x} &= \mathbf{A}\mathbf{x} + \mathbf{B}M_z^a, \\
\mathbf{0} &= \mathbf{C}_i\mathbf{x},
\end{aligned}
 $$

thus:

$$ \begin{bmatrix} s\mathbf{I} - \mathbf{A} & -\mathbf{B} \\ \mathbf{C} & \mathbf{0} \end{bmatrix} \begin{bmatrix} \mathbf{x} \\ M_z^a \end{bmatrix} = \mathbf{0}. $$

The matrix $\mathbf{P}(s) = \begin{bmatrix} s\mathbf{I} - \mathbf{A} & -\mathbf{B} \\ \mathbf{C} & \mathbf{0} \end{bmatrix}$ is called the Rosenbrock matrix associated with the system (8). The complex values $s_0 \in \mathbb{C}$ satisfying $\mathrm{Rank}(\mathbf{P}(s_0)) < \dim[\mathbf{x}^\alpha] = 3$ are called invariant zeros. The following lemma presents necessary and sufficient conditions for the existence of zero dynamics for the model (8).

**Lemma 2.2:** [[17]] Consider the linear state space model (8), the system has zero dynamics iff it has invariant zeros, i.e. there exist complex value $s_0 \in \mathbb{C}$ satisfying $\mathrm{Rank}(\mathbf{P}(s_0)) < \dim[\mathbf{x}^\alpha] = 3$.

**Definition 2.3:** [Disruptive zero dynamics attack [20]] The zero dynamics attacks are called disruptive if the associated invariant zero is unstable, i.e. the resulting zero dynamics is unstable.

2) Connection with strong observability and detectability properties: The existence of invariant zeros is related to the properties of strong observability and detectability in linear systems, as explained in the following theorem.

**Theorem 2.4:** [[22]] A linear dynamic system is strongly observable iff it has no invariant zeros, and strongly detectable iff its invariant zeros are stable.

The zero dynamics attacks are injection attacks into the input, and this injection is unknown to the system.

**Case 1:** If the system is strongly observable, it means that the system can uniquely reconstruct the state based on the output, without having any information about the unknown attack signal. Therefore, the attacker cannot perform zero dynamics attacks on a strongly observable system.

**Case 2:** If the system is not strongly observable, it means that there can be two different states for the same output, specifically, one state belongs to a system under zero dynamics attacks and one state belongs to an attack-free system. The system which is not strongly observable can be strongly detectable (Case 2.1) or not (Case 2.2).

**Case 2.1:** If the system is strongly detectable, the attacked system's state will converge to the attack-free system's state over time.

**Case 2.2:** If the system is not strongly detectable, the attacker can perform zero dynamics attacks that cause the state to diverge while the output is identical to an attack-free system.

### C. Problem statement

The objective of this paper is to answer the following questions:

* Do the linear lateral dynamics have invariant zeros?

* How can an attacker exploit these invariant zeros to perform zero dynamics attacks?

* Are these attacks disruptive?

These questions are answered in Propositions 3.1, 3.2, and 3.3. Finally, this paper proposes measures to protect the vehicle's lateral dynamics from zero dynamics attacks.

## III. ZERO DYNAMICS ATTACKS AGAINST VEHICLE'S LATERAL DYNAMICS

The following three subsections consider the output scenarios: yaw rate, lateral acceleration, and their combination.

### A. Exclusive yaw rate output

**Proposition 3.1:** Consider the linear state space model (8), with an output containing only yaw rate, the system has invariant zero $s_0 = a_{11}$, and the zero dynamics attacks $M_z^a = -\frac{a_{21}}{b_2}v_y$ excite this invariant zero, resulting in stable zero dynamics:

$$ \dot{v}_y = a_{11}v_y. \qquad (9) $$

*Proof:* For the case where the output is only the yaw rate, the output matrix is given by (3). The Rosenbrock matrix in this case is given by:

$$ \begin{bmatrix} s\mathbf{I} - \mathbf{A} & -\mathbf{B} \\ \mathbf{C}_1 & \mathbf{0} \end{bmatrix} = \begin{bmatrix} s - a_{11} & -a_{12} & 0 \\ -a_{21} & s - a_{22} & -b_2 \\ 0 & 1 & 0 \end{bmatrix}, $$

which is a square matrix with a determinant of $b_2(s - a_{11})$, thus the Rosenbrock matrix is rank-deficient when $s = a_{11}$. Therefore, $s_0 = a_{11}$ is an invariant zero of the system. Note that $a_{11} = -2\frac{C_f+C_r}{v_{x,m}}$ is negative and the invariant zero is stable. Now we find the input that excites the zero dynamics, the output is zero for any $t > t_0$, where $t_0$ is the onset of the attacks, thus $\forall t > t_0$, $r = 0$ and $\dot{r} = 0$. Substituting in the dynamics of (8) gives:

$$ 
\begin{aligned}
\begin{bmatrix} \dot{v}_y \\ \dot{r} \end{bmatrix} &= \begin{bmatrix} a_{11} & a_{12} \\ a_{21} & a_{22} \end{bmatrix} \begin{bmatrix} v_y \\ r \end{bmatrix} + \begin{bmatrix} 0 \\ b_2 \end{bmatrix} M_z^a, \\
\begin{bmatrix} \dot{v}_y \\ \mathbf{0} \end{bmatrix} &= \begin{bmatrix} a_{11}v_y \\ a_{21}v_y + b_2 M_z^a \end{bmatrix},
\end{aligned}
 $$

thus the attack signal $M_z^a = -\frac{a_{21}}{b_2}v_y$ excites the invariant zero of the system, and the system dynamics become $\dot{v}_y = a_{11}v_y$. ■

**Remark:** The zero dynamics (9) shows that under zero dynamics attacks, the vehicle experiences lateral sliding
without any rotational motion. These zero dynamics are stable dynamics, where the invariant zero $a_{11}$ is stable. Consequently, based on Theorem 2.4, the system is not strongly observable but is strongly detectable; this means that although the output remains identically zero, the state is not zero but converges to zero over time. As a result, zero dynamics attacks exist, and these attacks are not disruptive, i.e. the resulting zero dynamics are stable. Although the lateral velocity converges to zero over time, it can still be dangerous for the system to have lateral movement without being observed. For instance, the system may believe that the vehicle is moving forward, while lateral movement is occurring.

## B. Exclusive lateral acceleration output

**Proposition 3.2:** Consider the linear state space model (8), with an output containing only lateral acceleration, the system has invariant zero $s_0 = \frac{a_{11}v_x}{a_{12}+v_x}$, and the zero dynamics attack

$$M_z^a = -\frac{1}{b_2(a_{12} + v_x)} ((a_{11}^2 + a_{21}(a_{12} + v_x))v_y + (a_{11}a_{12} + (a_{12} + v_x)a_{22})r), \quad (10)$$

excites this invariant zero, resulting in the following zero dynamics:

$$\begin{aligned} \dot{v}_y &= \frac{a_{11}v_x}{a_{12} + v_x}v_y = s_0v_y, \\ \dot{r} &= \frac{a_{11}v_x}{a_{12} + v_x}r = s_0r, \end{aligned} \quad (11)$$

which are stable if and only if $aC_f - bC_r < 0$.

*Proof:* For the case where the output is only the lateral acceleration, the output matrix is given by (4). The Rosenbrock matrix becomes in this case:

$$\begin{bmatrix} s\mathbf{I} - \mathbf{A} & -\mathbf{B} \\ \mathbf{C}_2 & \mathbf{0} \end{bmatrix} = \begin{bmatrix} s - a_{11} & -a_{12} & 0 \\ -a_{21} & s - a_{22} & -b_2 \\ a_{11} & a_{12} + v_x & 0 \end{bmatrix},$$

which is a square matrix with a determinant of $b_2((a_{12} + v_x)s - a_{11}v_x)$, thus the Rosenbrock matrix is rank-deficient when $s = \frac{a_{11}v_x}{a_{12}+v_x}$. Therefore, $s_0 = \frac{a_{11}v_x}{a_{12}+v_x}$ is an invariant zero of the system. Substituting $a_{11} = -2\frac{C_f+C_r}{v_x m}$, and $a_{12} = 2\frac{bC_r-aC_f}{v_x m} - v_x$, gives:

$$s_0 = \frac{C_f + C_r}{aC_f - bC_r} v_x. \quad (12)$$

The sign of $s_0$, i.e. the stability of the invariant zero, is determined by the sign of the term $aC_f - bC_r$. Generally, the stability of matrix $\mathbf{A}$ does not impose a condition on the sign of this term. The stability condition of the matrix $\mathbf{A}$, ensuring the eigenvalues of $\mathbf{A}$ have negative real parts, is [8], [10]:

$$(a+b)^2 - \frac{m(aC_f - bC_r)}{C_r C_f} v_x^2 > 0. \quad (13)$$

The term $aC_f - bC_r$ could be positive while the condition (13) is still satisfied. Now we find the input that excites the zero dynamics, the output (the lateral

acceleration) is zero thus $a_y = a_{11}v_y + (a_{12} + v_x)r = 0$, and the initial conditions $r_0$ and $v_{y0}$ should satisfy $a_{11}v_{y0} + (a_{12} + v_x)r_0 = 0$, and the derivatives $\dot{v}_y$ and $\dot{r}$ should satisfy $a_{11}\dot{v} + (a_{12} + v_x)\dot{r} = 0$, substituting the dynamics $\dot{v}_y$ and $\dot{r}$:

$$a_{11}(a_{11}v_y + a_{12}r) + (a_{12} + v_x)(a_{21}v_y + a_{22}r + b_2M_z^a) = 0,$$

thus, the attack signal that excites the invariant zero is given by (10), and the output is identical to zero $a_{11}v_y + (a_{12} + v_x)r = 0$, thus $r = -\frac{a_{11}v_y}{a_{12}+v_x}$, substituting in the dynamics $\dot{v}_y = a_{11}v_y + a_{12}r$ gives $\dot{v}_y = \frac{a_{11}v_x}{a_{12}+v_x}v_y = s_0v_y$, thus $\dot{r} = \frac{a_{11}v_x}{a_{12}+v_x}r = s_0r$, which concludes the proof of the proposition. ■

Fig. 2 presents the phase plane illustrating the system's behavior under zero dynamics attacks, the state evolves along the zero-output manifold: 1) The state follows the green dashed line when the attacks target the yaw rate, setting it to zero; the invariant zero is stable, and the state converges to zero. 2) The state follows the blue closed-dots line when the attacks target the lateral acceleration, setting it to zero with a stable invariant zero, leading to convergence. 3) The state follows the red dotted line when the attacks target the lateral acceleration, setting it to zero with an unstable invariant zero, causing the state to diverge.

<figure><img src="image_2.png" /><figcaption>Fig. 2: System behavior under zero dynamics attacks for the three cases.</figcaption></figure>

**Remark:** The zero dynamics (11) show that under zero dynamics attacks, the vehicle experiences lateral and rotational motion. According to Proposition 3.2, the invariant zero could be stable or unstable depending on the sign of the term $aC_f - bC_r$. Based on Theorem 2.4, the system is not strongly observable, and it could be not strongly detectable if $aC_f - bC_r > 0$, in such case, the state diverges to infinity while the output remains at zero. There are threats associated with zero dynamics attacks, and we impose the condition

$$aC_f - bC_r < 0 \quad (14)$$

to prevent them, making the system strongly detectable, and thus ensuring the zero dynamics attacks are not disruptive.
**Remark, zero dynamics attacks can be detected using lateral and longitudinal acceleration.** The attacker performs zero dynamics attacks making the lateral acceleration (the output) equal to zero, thus $a_y = a_{11}v_y + (a_{12} + v_x)r = 0$, while both lateral velocity and yaw rate are nonzero. The longitudinal acceleration, $a_x$ is given by $a_x = \dot{v}_x - v_yr$, which under the assumption of constant longitudinal velocity becomes $a_x = -v_yr$. Note that, for a time window, the longitudinal acceleration can not be equal to zero while both $v_y$ and $r$ are nonzero. Thus, longitudinal acceleration measurements serve as a detector for zero dynamics attacks that target the lateral acceleration output.

**C. Output combines both yaw rate and lateral acceleration**

**Proposition 3.3:** Consider the linear state space model (8), with an output that combines both yaw rate and lateral acceleration, the system has no invariant zeros.

*Proof:* For the case where the output includes both yaw rate and lateral acceleration, the output matrix is given by (5). The Rosenbrock matrix becomes in this case:

$$ \begin{bmatrix} sI - A & -B \\ C_3 & 0 \end{bmatrix} = \begin{bmatrix} s - a_{11} & -a_{12} & 0 \\ -a_{21} & s - a_{22} & -b_2 \\ 0 & 1 & 0 \\ a_{11} & a_{12} + v_x & 0 \end{bmatrix}, $$

the three columns of the Rosenbrock matrix are linearly independent regardless of the value of $s$, thus the matrix has a rank of 3 and the system has no invariant zeros. This can be seen also by trying to set the output to zero:

$$ \begin{bmatrix} r \\ a_y \end{bmatrix} = \begin{bmatrix} 0 & 1 \\ a_{11} & a_{12} + v_x \end{bmatrix} \begin{bmatrix} v_y \\ r \end{bmatrix}, \\ 0 = \begin{bmatrix} 0 \\ a_{11}v_y \end{bmatrix}, $$

thus, both $r$ and $v_y$ (along with their derivatives) are zero, resulting in no zero dynamics.

<figure><img src="image_3.png" /></figure>

**Remark:** Proposition 3.3 indicates that there is no threat of zero dynamics attacks when the output combines both yaw rate and lateral acceleration. Based on Theorem 2.4, the system is strongly observable, indicating that the system's states can be fully reconstructed from the output.

Table I shows a summary of the findings.

<table><caption>TABLE I: Summary of findings. The sign ✓ means the existence, while × means the non-existence</caption><thead><tr><th>Output measurements</th><th>Additional condition</th><th>Threat of zero dynamics attack?</th><th>Disruptive attack?</th></tr></thead><tbody><tr><td>r</td><td>-</td><td>✓</td><td>×</td></tr><tr><td>a<sub>y</sub></td><td>aC<sub>f</sub> - bC<sub>r</sub> > 0</td><td>✓</td><td>✓</td></tr><tr><td>a<sub>y</sub></td><td>aC<sub>f</sub> - bC<sub>r</sub> < 0</td><td>✓</td><td>×</td></tr><tr><td>a<sub>y</sub>, a<sub>x</sub></td><td>-</td><td>×</td><td>×</td></tr><tr><td>r, a<sub>y</sub></td><td>-</td><td>×</td><td>×</td></tr></tbody></table>

## IV. SIMULATIONS

The vehicle's parameters used in these simulations are real parameters belonging to a Sports Utility Vehicle (SUV) [10], as shown in Table II.

<table><caption>TABLE II: SUV paremeters</caption><thead><tr><th>Parameter</th><th>Value</th><th>Description</th></tr></thead><tbody><tr><td>m</td><td>2270 (kg)</td><td>Vehicle mass</td></tr><tr><td>I<sub>z</sub></td><td>4600 (kg.m<sup>2</sup>)</td><td>Moment of inertia</td></tr><tr><td>a</td><td>1.421 (m)</td><td>Front axle to CG</td></tr><tr><td>b</td><td>1.438 (m)</td><td>Rear axle to CG</td></tr><tr><td>C<sub>α<sub>f</sub></sub></td><td>69800 (N/rad)</td><td>Front cornering stiffness</td></tr><tr><td>C<sub>α<sub>r</sub></sub></td><td>69600 (N/rad)</td><td>Rear cornering stiffness</td></tr></tbody></table>

### A. Exclusive yaw rate output

We consider zero dynamics attacks that aim to maintain $r$ equal to zero, as stated in Proposition 3.1. For this simulation, we assume longitudinal velocity $v_x$ is equal to 25 m/s and that the attacks occur at the initial time when lateral velocity $v_y$ is equal to 5 m/s. Fig. 3 shows $v_y$ and $r$ for a duration of 1 second. $r$ remains equal to zero while $v_y$ is not. These attacks are undetectable but not disruptive, as $v_y$ converges to zero.

<figure><img src="image_4.png" /><figcaption>Fig. 3: Lateral velocity $v_y$ and yaw rate $r$ when the zero dynamics attacks aim to maintain $r$ equal to zero.</figcaption></figure>

**Note:** Although the attacks are not disruptive, i.e. the lateral velocity is converging, having a lateral movement that is not observed by the system can still be dangerous in practical situations, on the highway for instance.

### B. Exclusive lateral acceleration output

We consider zero dynamics attacks that aim to maintain $a_y$ equal to zero, as stated in Proposition 3.2. The invariant zero, given in (12) has large value considering the parameters in Table II, thus we consider longitudinal velocity 5 m/s, and the value of the invariant zero, in this case, is $s_0 = -775.3 \ 1/s$, which is stable and causes the zero dynamics to converge quickly. For this simulation, we assume that the attacks occur at the initial time when the yaw rate is equal to 1 rad/s and the lateral velocity is equal to $6.4 \times 10^{-3} \ m/s$. Fig. 4 shows the lateral velocity, yaw rate, and lateral acceleration. The lateral acceleration remains zero while the lateral velocity and yaw rate are not, however, they converge to zero.

Now, we consider a vehicle where the condition (14) is not satisfied, e.g. the front axle to CG distance is $a = 1.521 \ m$, the invariant zero will have the value $s_0 = 114.6 \ 1/s$, which is unstable; while the eigenvalues of the matrix A, in this
<figure><img src="image_5.png" /><figcaption>Fig. 4: Lateral velocity $v_y$, yaw rate $r$, and lateral acceleration $a_y$ when the zero dynamics attacks aim to maintain $a_y$ equal to zero, in the case of stable invariant zero.</figcaption></figure>

case, are $(-23.5, -27.6)$, indicating its stability. Fig. 5 shows that the lateral acceleration remains zero, while the lateral velocity and yaw rate diverge. It is important to mention that, the linear model is not guaranteed to be valid when the vehicle enters the unstable mode.

<figure><img src="image_6.png" /><figcaption>Fig. 5: Lateral velocity $v_y$, yaw rate $r$, and lateral acceleration $a_y$ when the zero dynamics attacks aim to maintain $a_y$ equal to zero, in the case of unstable invariant zero.</figcaption></figure>

## V. CONCLUSION

This paper studies the linear vehicle lateral dynamics and identifies the three types of outputs. It demonstrates how zero dynamics attacks can exploit the invariant zeros of a linear system to perform undetectable attacks. For each case of the lateral model output, the system's invariant zeros are studied and analyzed. This paper recommends that the output consists of both yaw rate and lateral acceleration to prevent zero dynamics attacks, and it recommends using longitudinal acceleration measurements as a detector for zero dynamics attacks when only accelerometers are available. Future works will consider model nonlinearities and saturations, sensors' noises and more realistic simulations.

## REFERENCES

[1] X.-H. Chang, Y. Liu, and M. Shen. Resilient control design for lateral motion regulation of intelligent vehicle. *IEEE/ASME Trans. Mechatronics*, 24(6):2488-2497, 2019.

[2] F. Cheli, E. Sabbioni, M. Pesce, and S. Melzi. A methodology for vehicle sideslip angle identification: comparison with experimental data. *Veh. Syst. Dyn.*, 45(6):549-563, 2007.

[3] B.-C. Chen and F.-C. Hsieh. Sideslip angle estimation using extended Kalman filter. *Veh. Syst. Dyn.*, 46(sup1):353-364, 2008.

[4] M. S. Chong, H. Sandberg, and A. M. Teixeira. A tutorial Introduction to security and privacy for cyber-physical systems. In *2019 18th IEEE Eur. Control Conf.*, pages 968-978, Naples, Italy, 2019.

[5] P. Dixon, M. Best, and T. Gordon. An extended adaptive Kalman filter for real-time state estimation of vehicle handling dynamics. *Veh. Syst. Dyn.*, 34(1):57-75, 2000.

[6] M. Doumiati, A. C. Victorino, A. Charara, and D. Lechner. Onboard real-time estimation of vehicle lateral tire-road forces and sideslip angle. *IEEE/ASME Trans. Mechatronics*, 16(4):601-614, 2011.

[7] F. Farivar, M. S. Haghighi, A. Jolfaei, and S. Wen. Covert attacks through adversarial learning: Study of lane keeping attacks on the safety of autonomous vehicles. *IEEE/ASME Trans. Mechatronics*, 26(3):1350-1357, 2021.

[8] T. Gillespie. *Fundamentals of vehicle dynamics, 2nd edition*. SAE Internationals, Warrendale, 2nd edition, 2021.

[9] Haiping Du, Nong Zhang, and Guangming Dong. Stabilizing vehicle lateral dynamics with considerations of parameter uncertainties and control saturation through robust yaw control. *IEEE Trans. Veh. Technol.*, 59(5):2593-2597, 2010.

[10] E. Hashemi, M. Pirani, A. Khajepour, and A. Kasaiezadeh. A comprehensive study on the stability analysis of vehicle dynamics with pure/combined-slip tyre models. *Veh. Syst. Dyn.*, 54(12):1736-1761, 2016.

[11] Z. Hong, X. Li, Z. Wen, L. Zhou, H. Chen, and J. Su. ESP spoofing: Covert Acoustic attack on MEMS gyroscopes in vehicles. *IEEE Trans. Inf. Forensics Security*, 17:3734-3747, 2022.

[12] U. Kiencke and A. Daiß. Observation of lateral vehicle dynamics. *Control Eng. Pract.*, 5(8):1145-1150, 1997.

[13] A. Mohammadi, H. Malik, and M. Abbaszadeh. Vehicle lateral motion dynamics under braking/ABS cyber-physical attacks. *IEEE Trans. Inf. Forensics Security*, 18:4100-4115, 2023.

[14] K. Nam, S. Oh, H. Fujimoto, and Y. Hori. Estimation of sideslip and roll angles of electric vehicles using lateral tire force sensors through RLS and Kalman filter approaches. *IEEE Trans. Ind. Electron.*, 60(3):988-1000, 2013.

[15] E. Nekouei, M. Pirani, H. Sandberg, and K. H. Johansson. A randomized filtering strategy against inference attacks on active steering control systems. *IEEE Trans. Inf. Forensics Security*, 17:16-27, 2022.

[16] F. Pasqualetti, F. Dorfler, and F. Bullo. Attack detection and identification in cyber-physical systems. *IEEE Trans. Autom. Control*, 58(11):2715-2729, 2013.

[17] F. Pasqualetti, F. Dorfler, and F. Bullo. Control-theoretic methods for cyberphysical security: Geometric principles for optimal cross-layer resilient control systems. *IEEE Control Syst.*, 35(1):110-127, 2015.

[18] Z. Peng, Y. Zhang, G. Wen, J. Wang, and T. Huang. Security analysis for autonomous ground vehicle under stealthy sensor attacks. *IEEE Trans. Veh. Technol.*, pages 1-12, 2024.

[19] R. Rajamani. *Vehicle dynamics and control*. Mechanical engineering series. Springer, New York, 2nd ed. edition, 2012.

[20] H. Shim, J. Back, Y. Eun, G. Park, and J. Kim. *Zero-Dynamics Attack, Variations, and Countermeasures*, pages 31-61. Springer International Publishing, Cham, 2022.

[21] Y. Shoukry, P. Martin, P. Tabuada, and M. Srivastava. Non-invasive spoofing attacks for anti-lock braking systems. In G. Bertoni and J.-S. Coron, editors, *Cryptographic Hardware and Embedded Systems - CHES 2013*, volume 8086, pages 55-72. Springer Berlin Heidelberg, Berlin, Heidelberg, 2013. Series Title: Lecture Notes in Computer Science.

[22] S. Sundaram. Fault-tolerant and secure control systems, 2012. Univ. Waterloo, Waterloo, ON, Canada, Lecture Notes, 2012.

[23] H. Zhang and J. Wang. Vehicle lateral dynamics control through AFS/DYC and robust gain-scheduling approach. *IEEE Trans. Veh. Technol.*, 65(1):489-494, 2016.

[24] H. Zhang, X. Zhang, and J. Wang. Robust gain-scheduling energy-to-peak control of vehicle lateral dynamics stabilisation. *Veh. Syst. Dyn.*, 52(3):309-340, 2014.