<figure><img src="image_1.png" /></figure>

HAL
open science

# Active Defense Strategy in Cyber-Physical Systems: Misleading Unauthorized Observers

Ghadeer Shaaban, Hassen Fourati, Alain Kibangou, Christophe Prieur

► To cite this version:

Ghadeer Shaaban, Hassen Fourati, Alain Kibangou, Christophe Prieur. Active Defense Strategy in Cyber-Physical Systems: Misleading Unauthorized Observers. IEEE Transactions on Control of Network Systems, 2025, pp.1-12. 10.1109/TCNS.2025.3570931. . hal-05068150

HAL Id: hal-05068150

https://hal.science/hal-05068150v1

Submitted on 14 May 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Active Defense Strategy in Cyber-Physical Systems: Misleading Unauthorized Observers

Ghadeer Shaaban, Hassen Fourati, Alain Kibangou, and Christophe Prieur

**Abstract**—Securing Cyber-Physical Systems (CPS) is a critical concern, extensively explored in the literature. Traditional approaches involve developing detectors to identify cyber-attacks or implementing passive defense strategies such as encrypting communication channels and using firewalls. Differently, in this paper, we address the challenge of securing CPS against unauthorized observers, which aims to estimate the system states by eavesdropping on system input and output. An active defense strategy, called Misleading Unauthorized Observer (MUO), that modifies input-output signals in order to mislead the unauthorized observer, is introduced. These modifications are additional signals undetectable by innovation or residual-based detectors and designed with the aim of arbitrarily increasing the estimation error at the unauthorized observer side. For this purpose, system properties required for guaranteeing the existence of such a defense strategy are stated. Then the design of these additional signals is formulated as an optimization problem with undetectability constraints. The effectiveness of the proposed approach is validated through simulations of a moving body in the XY plane, demonstrating how the active defending system successfully misleads the unauthorized observer.

**Index Terms**— Cyber-physical systems, unauthorized observer, eavesdropping attack, active defense.

## I. INTRODUCTION

The security problem in Cyber-Physical Systems (CPS) is essentially a game between attackers and defenders [1]. Attackers always try to develop new attacks, while defenders create new security strategies. As a consequence, attackers need to develop new ways to overcome these defense strategies. But what if the attacker believes its attack is successfully completing its mission, while actually it is not? As an example, if an attacker attempts to steal information from a system, but the system instead allows the attacker to steal modified data that appears correct, the attacker may falsely believe they have successfully obtained the information. This could discourage them from developing new methods for information theft. Our main result provides a strategy that makes attackers believe they are successfully completing their missions, while in fact, they are not.

Ghadeer Shaaban, Hassen Fourati, Alain Kibangou, and Christophe Prieur are with Univ. Grenoble Alpes, CNRS, Inria, Grenoble INP, GIPSA-lab, Grenoble, France. Alain Kibangou is also with the Faculty of Science, University of Johannesburg (Auckland Park Campus), Johannesburg 2006, South Africa (e-mails: ghadeer.shaaban@gipsa-lab.fr; hassen.fourati@gipsa-lab.fr; alain.kibangou@gipsa-lab.fr; christophe.prieur@gipsa-lab.fr)

Research on cyber attack design typically focuses on three main types: denial of service (DoS) [2], replay [3], and false data injection attacks (FDI). In an FDI attack, the attacker injects false data into system input or output to degrade control system performance or state estimation [4]–[7]. An FDI is undetectable if the input signal to the attack detector remains unchanged. In [8], [9], an undetectable attack called a zero-dynamics attack is designed by injecting false data solely into the input channels. The undetectable attack is achieved in [10], [11] by injecting false data into both input and output, and known as covert attack [12]. Numerous studies explore cyber attack detection in parallel with state estimation using the Kalman filter theory [13]. In the Kalman filter, two types of resulting signals can serve as input for detectors: the innovation, which is the difference between the actual output and the predicted one [6], [14], and the residual, which is the difference between the actual output and the estimated one [15]. Another type of attack is eavesdropping attack [16], which compromises confidentiality by accessing private information without affecting system functionality [17], [18]. They can serve as a precursor to replay and FDI attacks or pose a standalone threat by exposing sensitive data. In industrial control systems, attackers may gather critical production data, while in healthcare, they can access patient records. Common defenses include encryption and firewalls [19]–[21].

In this paper, we introduce the term “unauthorized observation” as an attack in which the attacker aims to perform remote state observation based on the knowledge of the system model and eavesdropping on input-output signals. To locate the unauthorized observation between other attack types, we use the cyber-physical attack space, which was proposed in [22], then has been widely used in the literature [1], [16], [23]. Figure 1 shows the three-dimensional cyber-physical attack space, the three dimensions are: 1) disclosure resources quantify the attacker’s access to read the transmitted data, 2) disruption resources quantify the attacker’s access to modify the transmitted data, 3) the model knowledge refers to how much the attacker knows about the system model. In unauthorized observation, the attackers are assumed to be able to read all transmitted input-output signals and have full knowledge of the system dynamics. The unauthorized observation attack extends beyond traditional eavesdropping by incorporating knowledge of the system model. Addressing this type of attack is crucial, as knowledge of the CPS model is common for attackers [1], and has been studied for other types of attack, like FDI attacks, but not for eavesdropping attacks.
<figure><img src="image_3.png" /><figcaption>Fig. 1. Unauthorized observation in the cyber-physical attack space.</figcaption></figure>

The defense against an unauthorized observation can be similar to defenses against eavesdropping attacks, such as using encryption and firewalls, which prevent the unauthorized observer from accessing input-output signals. However, these conventional defenses might motivate the attackers to improve themselves, attempting to bypass encryption or firewalls. To address this, we propose defense strategy that remains undetectable to the unauthorized observer as a potential solution. The proposed defense strategy can be used independently or in conjunction with encryption and firewalls, ensuring that the system remains protected even if the attacker bypasses them.

The objective of this paper is then to design an active defense strategy, called Misleading Unauthorized Observer (MUO), by modifying the input-output signals before being read by the unauthorized observer. These modifications involve smart additional terms, which we call misleading injections, ensuring that the modified input-output signals remain consistent with each other and with the history of estimations. In other words, within the framework of Kalman filter theory, these modifications are undetectable by innovation or residual-based methods. Additionally, it is important to consider the possibility that the unauthorized observer may also verify that the obtained input-output signals fall within certain bounds and satisfy other characteristics defined by the physical nature of these signals. For example, in an autonomous vehicle system, the acceleration and velocity signals must not exceed the mechanical limits of the vehicle. Similarly, in power grid systems, voltage and current measurements need to stay within the operational limits. In the case of a moving vehicle, the velocity should change gradually, without abrupt jumps, and the position should not show sudden, unrealistic jumps from one location to another. These bounds and other characteristics impose conditions on the modified input-output signals, which can be represented mathematically as constraints.

An important concern is that the defending system might not only aim to introduce errors in the unauthorized observer's state estimation but also to deliberately mislead it by steering the estimation along a specific trajectory. For instance, if the

unauthorized observer is observing the system state, and wants to make an action, i.e., physical attack, if it observes the system state outside a specific safe area, then the defending system aims to mislead the unauthorized observer, making it believe that the system is still inside the safe area while the system is outside. Additionally, in order to consider the input-output signals bounds and characteristics, we propose to design the misleading injections as solutions to an optimization problem, where the objective is to maximize the unauthorized observer's estimation error, subject to undetectability conditions and constraints on the modified input-output signals.

The concept of modifying input-output signals undetectably, where the effects of the changes on input and output signals cancel each other out, has been previously employed to design covert attacks [10]–[12]. Building on this, we introduce an active defense strategy, reversing attacker-defender roles, which opens opportunities for active defenses, and encourages the community to focus on similar contributions rather than relying solely on passive defenses. The adage “the best defense is a good offense” has been widely discussed in military strategy literature [24], but this is not established in the research community of CPS. Unlike covert attacks that focus on introducing estimation errors, our method misleads attackers by guiding them to follow a defender-defined trajectory. The concept of MUO is similar to the military concept of deception, where modified representations of reality are used to gain an advantage [25]. Additionally, our approach incorporates input-output signals verifications alongside undetectability by innovation or residual-based detectors. The contributions of this paper are as follows:

* Define a new type of cyber-physical attack, which is the unauthorized observation, where the attacker aims to perform a remote state observation based on the knowledge of the system model and eavesdropping on input-output signals.

* Introduce the concept of active defense by misleading the unauthorized observer, which differs from the traditional passive defense in cyber-physical systems.

* Formulate the conditions for undetectability by the innovation and residual-based detectors as a dynamic model of the estimation error caused by the misleading injections. These constraints can be utilized within an optimization problem.

* State properties that the system must have and find stronger properties required for the system to mislead the unauthorized observer's estimation into following a specific trajectory.

The remainder of this paper is structured as follows: Section II presents preliminaries on the system and the unauthorized observer. Section III defines misleading and undetectable modifications along with the problem formulation. Section IV describes the scenarios in which the MUO defense protects against the unauthorized observer and outlines the overall architecture of the problem and its solution. Section V states the conditions for undetectable modifications on the input-output signals. Section VI provides required system properties in order to perform specific types of active defense by
misleading. Section VII presents an optimization problem-based solution for the design of the misleading injections. Section VIII exposes simulations demonstrating MUO in the case of a moving body in the XY plane. Finally, Section IX concludes this paper.

## II. PRELIMINARIES

Matrices, vectors, and scalars are represented with bold upper-case, bold lower-case, and lower-case symbols, respectively. The symbols $\mathbb{R}$, $\mathbb{N}$, $\mathbb{E}$, $\mathbf{I}$, and $\mathbf{0}$ stand for the real numbers field, the natural numbers field, the expectation operator, the identity matrix, and the all-zero matrix, respectively. For a matrix $\mathbf{M}$, we denote the $i^{th}$ row by $\mathbf{M}(\mathbf{i})$, and for a vector $\mathbf{v}$ we denote the $i^{th}$ component by $\mathbf{v}(\mathbf{i})$.

In this section, we first introduce the mathematical model of the CPS subject to unauthorized observation. Next, we describe the legit observer, the unauthorized observer, and the innovation and residual-based detectors.

### A. System Model

Consider the following discrete-time linear system model $\Sigma$, which is commonly adopted in the literature for CPS modelling [1], [4], [26]:

$$ \mathbf{x}_k = \mathbf{A}\mathbf{x}_{k-1} + \mathbf{B}\mathbf{u}_{k-1} + \mathbf{w}_{k-1}, \quad (1) $$

$$ \mathbf{y}_k = \mathbf{C}\mathbf{x}_k + \mathbf{v}_k, \quad (2) $$

where for any time step $k \in \mathbb{N}$, $\mathbf{x}_k \in \mathbb{R}^{n_x}$, $\mathbf{u}_k \in \mathbb{R}^{n_u}$, and $\mathbf{y}_k \in \mathbb{R}^{n_y}$ are the system state, input, and output, respectively. The matrices $\mathbf{A} \in \mathbb{R}^{n_x \times n_x}$, $\mathbf{B} \in \mathbb{R}^{n_x \times n_u}$, and $\mathbf{C} \in \mathbb{R}^{n_y \times n_x}$ are the state, input, and output matrices, respectively. The process noise $\mathbf{w}_k \in \mathbb{R}^{n_x}$, and the measurement noise $\mathbf{v}_k \in \mathbb{R}^{n_y}$ are assumed to be uncorrelated zero-mean white random Gaussian signals with positive definite covariance matrices $\mathbf{Q}_k$ and $\mathbf{R}_k$, respectively. Since unauthorized observation attacks concern system observation, we assume that the system described in (1)-(2) is observable.

**Assumption 1.** The pair $(\mathbf{A}, \mathbf{C})$ is observable.

### B. Legit Observer

The legit observer estimates the system state based on the input-output signals. We consider the case of the Kalman filter, as it is optimal in the sense of minimum mean square error for linear systems with uncorrelated zero-mean white process and measurement noises [13], which is the case of system (1)-(2).

1) Kalman Filter: At each time step, the Kalman filter performs prediction and correction. The prediction uses the dynamic model and the input signal:

$$ \hat{\mathbf{x}}_{k|k-1} = \mathbf{A}\hat{\mathbf{x}}_{k-1} + \mathbf{B}\mathbf{u}_{k-1}, $$

$$ \mathbf{P}_{k|k-1} = \mathbf{A}\mathbf{P}_{k-1}\mathbf{A}^T + \mathbf{Q}_{k-1}, $$

where $\hat{\mathbf{x}}_{k|k-1}$ and $\mathbf{P}_{k|k-1}$ are the predicted state and the prediction error covariance matrix, respectively, while $\hat{\mathbf{x}}_{k-1}$ and $\mathbf{P}_{k-1}$ are the previous estimated state and the estimation

error covariance matrix. The correction uses the output function and the output signal:

$$ \mathbf{K}_k = \mathbf{P}_{k|k-1}\mathbf{C}^T(\mathbf{C}\mathbf{P}_{k|k-1}\mathbf{C}^T + \mathbf{R}_k)^{-1}, $$

$$ \tilde{\mathbf{y}}_k = \mathbf{y}_k - \mathbf{C}\hat{\mathbf{x}}_{k|k-1}, $$

$$ \hat{\mathbf{x}}_k = \hat{\mathbf{x}}_{k|k-1} + \mathbf{K}_k\tilde{\mathbf{y}}_k, $$

$$ \mathbf{P}_k = \mathbf{P}_{k|k-1} - \mathbf{K}_k\mathbf{C}\mathbf{P}_{k|k-1}, $$

$$ \tilde{\mathbf{r}}_k = \mathbf{y}_k - \mathbf{C}\hat{\mathbf{x}}_k, $$

where $\hat{\mathbf{x}}_k$ is the estimated state, $\mathbf{K}_k$ is the Kalman gain, $\tilde{\mathbf{y}}_k$ is the innovation, which is the difference between the actual output and the predicted output, and $\tilde{\mathbf{r}}_k$ is the residual, which is the difference between the actual and the estimated output. The legit observer can be summarized as follows:

$$ [\hat{\mathbf{x}}_k, \mathbf{P}_k, \tilde{\mathbf{y}}_k, \tilde{\mathbf{r}}_k] = \mathbf{K}\mathbf{F}((\mathbf{u}_i)_{i<k}, (\mathbf{y}_i)_{i \le k}, \Sigma, \hat{\mathbf{x}}_0, \mathbf{P}_0), \quad (3) $$

where $\mathbf{K}\mathbf{F}(\cdot)$ stands for the Kalman filter, $\hat{\mathbf{x}}_0$ is the initial estimate, and $\mathbf{P}_0$ is the initial estimation error covariance matrix.

### C. Unauthorized Observer

The unauthorized observer remotely estimates the system state based on the modified input-output signals obtained through a network, denoted by $\mathbf{u}_k^m$ and $\mathbf{y}_k^m$, respectively. The superscript ($^m$) denotes that the signals are modified. The unauthorized observer is assumed to implement a Kalman filter equipped with a detector based on innovation or residual. The use of the Kalman filter is widely adopted in the CPS literature, even under possible input-output signals modifications (e.g., those caused by FDI attacks), which result in a loss of its optimality [1], [4], [26].

**Remark 1.** The innovation or residual signals indicate the consistency between the input-output signals and the system model. If signal modifications preserve this consistency, i.e., they pass the innovation, or residual-based detectors, they are likely, intuitively, to pass other types of detectors as well.

Additionally, the unauthorized observer may verify that the input-output signals are within some bounds and satisfy other characteristics defined by the physical nature of these signals. Mathematically, this can be expressed by general constraint functions:

$$ \begin{aligned} \mathbf{g}_k^{\min} &\le \mathbf{g}_k(\mathbf{u}_k^m) \le \mathbf{g}_k^{\max}, \\ \mathbf{h}_k^{\min} &\le \mathbf{h}_k(\mathbf{y}_k^m) \le \mathbf{h}_k^{\max}, \end{aligned} \quad (4) $$

where $\mathbf{g}_k$ and $\mathbf{h}_k$ are bounded functions. One basic and essential constraint is that any physical signal has minimum and maximum bounds, in this case, the constraint function in (4) can be written as:

$$ \begin{aligned} \mathbf{u}_k^{\min} &\le \mathbf{u}_k^m \le \mathbf{u}_k^{\max}, \\ \mathbf{y}_k^{\min} &\le \mathbf{y}_k^m \le \mathbf{y}_k^{\max}. \end{aligned} \quad (5) $$

If some of these constraints are not satisfied, it indicates that the input-output signals have been compromised.

The worst-case attack scenario is commonly considered in the CPS literature [1], as successfully defending against such scenarios ensures the system's ability to defend against less
severe cases. This approach is further inspired by Shannon's maxim (1948), "The enemy knows the system," which is a restatement of Kerckhoffs's principle in military ciphers (1883) [27]. Accordingly, we adopt Assumptions 2, 3, and 4 to address the worst-case security problem.

**Assumption 2.** The unauthorized observer has perfect knowledge of the system model $\Sigma$, i.e. it knows the matrices $A$, $B$, and $C$, and the noises covariance matrices $Q_k$ and $R_k$.

**Assumption 3.** The unauthorized observer knows the initial estimate $\hat{x}_0$ and its estimation error covariance matrix $P_0$, which are used by the legitimate observer.

**Assumption 4.** The unauthorized observer has knowledge of the physical bounds, i.e, $u_k^{min}, u_k^{max}, y_k^{min}, y_k^{max}$ expressed in (5), and other characteristics of the input-output signals of the system, i.e, $g_k(\cdot), h_k(\cdot)$ and their bounds $g_k^{min}, g_k^{max}, h_k^{min}, h_k^{max}$ expressed in (4).

Assumption 2 indicates that the unauthorized observer knows the system dynamics and the noise covariance matrices. This is widely adopted in the literature of CPS [1]. Regarding Assumption 3, as the system is observable, in the absence of signal modifications, both the unauthorized and legitimate observers' estimates will converge to the true state, and the covariance matrices will converge to the same value. Thus, this assumption represents the worst-case scenario. Finally, the resulting signals of the unauthorized observer can be summarized as follows:

$$[\hat{\mathbf{x}}_k^m, \mathbf{P}_k^m, \tilde{\mathbf{y}}_k^m, \tilde{\mathbf{r}}_k^m] = K F ((\mathbf{u}_i^m)_{i<k}, (\mathbf{y}_i^m)_{i\le k}, \mathbf{\Sigma}, \hat{\mathbf{x}}_0, \mathbf{P}_0), \quad (6)$$

Assumption 4 is justified by the fact that the characteristics and bounds of input-output signals often stem from physical properties, which are not confidential.

### D. Detection Scheme

The concept of innovation or residual-based detectors involves performing statistical tests on the innovation or residual signals. In the absence of input-output signals modifications, the innovation and residual are equal to the one of the legitimate observer described in Section II-B.1. Thus, we explain hereafter the innovation and residual-based detectors applied to the resulting signals of the legitimate observer.

**1) Innovation-Based Detector:** The general idea of the innovation-based detector is that the detector triggers an alarm when a remarkable difference in the innovation happens. The innovation of the legitimate observer is:

$$\begin{aligned} \tilde{\mathbf{y}}_k &= \mathbf{y}_k - \mathbf{C}\hat{\mathbf{x}}_{k|k-1}, \\ &= \mathbf{C}\mathbf{x}_k + \mathbf{v}_k - \mathbf{C}\hat{\mathbf{x}}_{k|k-1}, \\ &= \mathbf{C}(\mathbf{A}\mathbf{x}_{k-1} + \mathbf{B}\mathbf{u}_{k-1} + \mathbf{w}_{k-1}) \\ &\quad + \mathbf{v}_k - \mathbf{C}(\mathbf{A}\hat{\mathbf{x}}_{k-1} + \mathbf{B}\mathbf{u}_{k-1}), \\ &= \mathbf{C}\mathbf{A}\mathbf{e}_{k-1} + \mathbf{C}\mathbf{w}_{k-1} + \mathbf{v}_k, \end{aligned} \quad (7)$$

where $\mathbf{e}_{k-1} = \mathbf{x}_{k-1} - \hat{\mathbf{x}}_{k-1}$ is the estimation error in the previous time step.

To illustrate the idea, we explain one innovation-based detector, which is the $\chi^2$ detector, as it is the most used in the

literature. The innovation (7) is zero mean Gaussian signal with known covariance matrix $\tilde{\mathbf{R}}_k = \mathbf{C}\mathbf{A}\mathbf{P}_{k-1}\mathbf{A}^T\mathbf{C}^T + \mathbf{C}\mathbf{Q}_{k-1}\mathbf{C}^T + \mathbf{R}_k$. The signal $s_k = \tilde{\mathbf{y}}_k^T\tilde{\mathbf{R}}_k^{-1}\tilde{\mathbf{y}}_k$ follows a $\chi^2$ distribution with $n_y$ degree of freedom, i.e. $\mathbb{E}(s_k) = n_y$. At each time step, the signal $s_k$ is compared with a predefined threshold $s^{th}$, which defines the probability of a false alarm [28]. Exceeding this threshold indicates that the input-output signals have been modified. The $\chi^2$ detector is summarized as follows:

$$\begin{cases} \text{Alarm not triggered} & \text{if, } s_k \le s^{th}, \\ \text{Alarm triggered} & \text{if, } s_k > s^{th}. \end{cases}$$

**2) Residual-Based Detector:** The idea is similar to the case of innovation-based detectors, the detector triggers an alarm when a remarkable difference in the residual happens. The residual of the legitimate observer is:

$$\begin{aligned} \tilde{\mathbf{r}}_k &= \mathbf{y}_k - \mathbf{C}\hat{\mathbf{x}}_k = \mathbf{C}\mathbf{x}_k + \mathbf{v}_k - \mathbf{C}\hat{\mathbf{x}}_k, \\ &= \mathbf{C}\mathbf{e}_k + \mathbf{v}_k, \end{aligned} \quad (8)$$

this residual is a zero mean Gaussian signal, with a covariance matrix $\mathbf{S}_k = \mathbb{E}(\tilde{\mathbf{r}}_k \tilde{\mathbf{r}}_k^T)$:

$$\mathbf{S}_k = \mathbf{C}\mathbf{P}_k\mathbf{C}^T + \mathbf{R}_k + \mathbf{C}\mathbb{E}(\mathbf{e}_k\mathbf{v}_k^T) + \mathbb{E}(\mathbf{v}_k\mathbf{e}_k^T)\mathbf{C}^T, \quad (9)$$

the estimation error $\mathbf{e}_k$ is given by:

$$\mathbf{e}_k = \mathbf{x}_k - \hat{\mathbf{x}}_k = \mathbf{x}_k - \hat{\mathbf{x}}_{k|k-1} - \mathbf{K}_k \tilde{\mathbf{y}}_k,$$

we substitute the dynamic model and the prediction, in addition to the innovation from (7):

$$\begin{aligned} \mathbf{e}_k &= \mathbf{x}_k - \hat{\mathbf{x}}_k, \\ &= \mathbf{A}\mathbf{x}_{k-1} + \mathbf{B}\mathbf{u}_{k-1} + \mathbf{w}_{k-1} - \mathbf{A}\hat{\mathbf{x}}_{k-1} - \mathbf{B}\mathbf{u}_{k-1} \\ &\quad - \mathbf{K}_k (\mathbf{C}(\mathbf{A}\mathbf{e}_{k-1} + \mathbf{w}_{k-1}) + \mathbf{v}_k), \\ &= (\mathbf{I} - \mathbf{K}_k \mathbf{C})(\mathbf{A}\mathbf{e}_{k-1} + \mathbf{w}_{k-1}) - \mathbf{K}_k \mathbf{v}_k, \end{aligned} \quad (10)$$

thus, $\mathbb{E}(\mathbf{e}_k\mathbf{v}_k^T) = -\mathbf{K}_k\mathbf{R}_k$, we substitute in (9):

$$\mathbf{S}_k = \mathbf{C}\mathbf{P}_k\mathbf{C}^T + \mathbf{R}_k - \mathbf{C}\mathbf{K}_k\mathbf{R}_k - \mathbf{R}_k\mathbf{K}_k^T\mathbf{C}^T, \quad (11)$$

finally, the signal $z_k = \tilde{\mathbf{r}}_k^T\mathbf{S}_k^{-1}\tilde{\mathbf{r}}_k$ follows a $\chi^2$ distribution with $n_y$ degree of freedom, i.e. $\mathbb{E}(z_k) = n_y$. At each time step, the signal $z_k$ is compared with a predefined threshold $z^{th}$. Exceeding this threshold indicates that the input-output signals have been modified.

### III. MISLEADING UNAUTHORIZED OBSERVER AND PROBLEM FORMULATION

The defending system is assumed to be able to modify the input-output signals that the unauthorized observer is receiving, specifically, for time step $k$:

$$\mathbf{u}_k^m = \mathbf{u}_k + \zeta_k^u, \quad (12)$$

$$\mathbf{y}_k^m = \mathbf{y}_k + \zeta_k^y, \quad (13)$$

where $\zeta_k^u$ and $\zeta_k^y$ are misleading injections to input-output signals, respectively.

The unauthorized observer estimation error caused by input-output signals modifications is denoted by $\mathbf{e}_k^m$, i.e. $\hat{\mathbf{x}}_k - \hat{\mathbf{x}}_k^m = \mathbf{e}_k^m$. In the following, we define the undetectable input-output signals modifications and the Misleading Unauthorized
Observer (MUO) in Definitions 1 and 2, respectively. More specific types of MUO are defined in Definitions 3, 4, and 5.

**Definition 1** (Undetectable input-output signals modifications). The input-output signals modifications are considered undetectable if the resulting innovation $\tilde{\mathbf{y}}_k^m$ and residual $\tilde{\mathbf{r}}_k^m$ of the unauthorized observer's Kalman filter (6), which are input to the innovation and residual-based detectors, are identical to the ones of the legit observer's Kalman filter (3), i.e. $\tilde{\mathbf{y}}_k = \tilde{\mathbf{y}}_k^m$ and $\tilde{\mathbf{r}}_k = \tilde{\mathbf{r}}_k^m$.

**Definition 2** (MUO). The defending system is considered to be performing an MUO defense strategy by input-output signals modifications, if these modifications are undetectable (see Definition 1) and degrade the unauthorized observer state estimation, i.e. for $k \ge 0$, $\tilde{\mathbf{y}}_k = \tilde{\mathbf{y}}_k^m$, $\tilde{\mathbf{r}}_k = \tilde{\mathbf{r}}_k^m$, and $\mathbf{e}_k^m \neq \mathbf{0}$.

**Definition 3** (State-i MUO). An MUO is called to be state-i MUO if, for any time step $k \ge n_x$, the defending system is able to achieve $\mathbf{e}_k^m(i) \neq \mathbf{0}$.

**Definition 4** (State-i strongly MUO). A state-i MUO is called to be state-i strongly MUO if for any time step $k \ge n_x$, and any desired estimation error $\mathbf{e}_k^{d,i} \in \mathbb{R} \setminus \{\mathbf{0}\}$, the defending system is able to achieve $\mathbf{e}_k^m(i) = \mathbf{e}_k^{d,i}$.

**Definition 5** (Strongly MUO). An MUO is called to be strongly MUO if $\forall i \in \{1, 2, ..., n\}$, it is State-i strongly MUO.

This paper has two objectives. The first objective is to design $(\zeta_k^u)_{k \in \mathbb{N}}$ and $(\zeta_k^y)_{k \in \mathbb{N}}$ in order to perform an MUO defense strategy, and study and analyze the property that the system should have to enable the different kinds of MUO listed in Definitions 3, 5, and 4. The first objective is achieved in Section VI. The second objective is to design $(\zeta_k^u)_{k \in \mathbb{N}}$ and $(\zeta_k^y)_{k \in \mathbb{N}}$ so that the unauthorized observer estimation error is maximized while these injections are undetectable, and the modified input-output signals satisfy the input-output signals bounds and characteristics. The second objective is achieved in Section VII. Conditions for undetectable input-output signals modifications are derived in Section V. The architecture of the MUO defense strategy is presented in Section IV.

## IV. MUO ARCHITECTURE

There are two possible scenarios in which the proposed MUO can be effective in defending against an unauthorized observer. The first scenario occurs when the unauthorized observer gains unauthorized access to the input-output signals transmission lines connecting the sensors and actuators on one side and the control unit on the other side. The control unit is responsible for state estimation (the legit observer) and computing control commands. An example of this scenario is a vehicle, where all sensors, actuators, and the control unit are connected through Controller Area Network (CAN) bus [29]. The defending system operates similarly to an encryption/decryption method [20], where the system encrypts the message before transmission and decrypts it upon arrival. In this case, however, instead of encrypting, the defending system injects misleading terms into the transmitted signal and subtracts them upon arrival. This ensures that the communication between the sensors, actuators, and control unit

remains secure, while the obtained signals by the unauthorized observer are modified. It is worth noting that the injection and subtraction of misleading terms can be performed separately when the misleading error trajectory is designed in advance and known by both components of the defending system. The design of misleading injections depends solely on the misleading error trajectory and is independent of the true trajectory or the input-output signals, as illustrated in (14) in Theorem 1. This first scenario is illustrated in Fig. 2.

<figure><img src="image_4.png" /><figcaption>Fig. 2. The first scenario of MUO defense: the input **u** represents either sensor measurements or actuator commands, while the output **y** always represents sensor measurements. The defending system injects misleading terms into the signals before transmission and subtracts them upon arrival. The authorized observer receives the modified signals through the network.</figcaption></figure>

The second scenario occurs when the unauthorized observer installs hidden sensors on the system at an earlier time with the purpose of tracking it. These sensors transmit measured signals using a transmitter installed alongside them. For example, an unauthorized observer might install a GPS sensor on a moving car to track its position. Once the system detects these unauthorized sensors, the defending system modifies the transmitted signals received by the unauthorized observer. In this scenario, the system does not necessarily use these measurements for its own observation or control. The second scenario is illustrated in Fig. 3.

The architecture of the MUO defense strategy, including the legit observer and the unauthorized observer, is depicted in Fig. 4. This diagram is intended to clarify the overall
<figure><img src="image_5.png" /><figcaption>Fig. 3. The second scenario of MUO defense: the input and output signals are sensor measurements. The defending system injects misleading terms into the signals before they are transmitted to the unauthorized observer.</figcaption></figure>

problem and solution, rather than representing a real-world scenario. Note that the legit observer may be a conceptual observer introduced to illustrate the idea, as the system might use different sensor measurements than those accessed by the unauthorized observer, as explained in the second scenario.

## V. UNDETECTABLE MISLEADING INJECTIONS

Theorem 1 states the sufficient and necessary conditions to make modifications to the input-output signals undetectable by innovation and residual-based detectors.

**Theorem 1.** Consider the discrete-time linear system model defined by (1)-(2) being subject to an unauthorized observer through eavesdropping on its input-output signals, and the defending system aims to mislead the unauthorized observer by modifying the received input-output signals as in (12)-(13). The misleading injections $(\zeta_k^u)_{k \ge 0}$ and $(\zeta_k^y)_{k \ge 0}$ in (12)-(13) are undetectable by innovation and residual-based detectors if and only if they satisfy the following conditions:

$$ 
\begin{aligned}
e_{k+1}^m &= A e_k^m - B \zeta_k^u, \\
\zeta_k^y &= -C e_k^m,
\end{aligned} 
\quad (14) 
$$

for all $k \ge 0$.

*Proof.* The unauthorized observer applies the Kalman filter for state estimation based on the modified input-output signals. Thus the prediction step is as follows:

$$ 
\begin{aligned}
\hat{\mathbf{x}}_{k|k-1}^m &= A\hat{\mathbf{x}}_{k-1}^m + B\mathbf{u}_{k-1}^m, \\
&= A\hat{\mathbf{x}}_{k-1}^m + B\mathbf{u}_{k-1} + B\zeta_{k-1}^u.
\end{aligned} 
$$

The innovation in the presence of the misleading injections is as follows:

$$ 
\begin{aligned}
\tilde{\mathbf{y}}_k^m &= \mathbf{y}_k^m - C\hat{\mathbf{x}}_{k|k-1}^m = \mathbf{y}_k + \zeta_k^y - C\hat{\mathbf{x}}_{k|k-1}^m, \\
&= C\mathbf{x}_k + \mathbf{v}_k + \zeta_k^y - C(A\hat{\mathbf{x}}_{k-1}^m + B\mathbf{u}_{k-1} + B\zeta_{k-1}^u), \\
&= C(A(\mathbf{x}_{k-1} - \hat{\mathbf{x}}_{k-1}^m) + \mathbf{w}_{k-1}) + \mathbf{v}_k + \zeta_k^y - C B \zeta_{k-1}^u, \\
& \qquad (15)
\end{aligned} 
$$

the term $\mathbf{x}_{k-1} - \hat{\mathbf{x}}_{k-1}^m$ is the estimation error in the previous time step, we can rewrite it as follows: $\mathbf{x}_{k-1} - \hat{\mathbf{x}}_{k-1}^m = \mathbf{x}_{k-1} - \hat{\mathbf{x}}_{k-1} + \hat{\mathbf{x}}_{k-1} - \hat{\mathbf{x}}_{k-1}^m = \mathbf{e}_{k-1} + \mathbf{e}_{k-1}^m$, we remind that $\mathbf{e}_{k-1}$

<figure><img src="image_6.png" /><figcaption>Fig. 4. Architecture of an MUO defense strategy: The defending system injects misleading data $\zeta^u$ and $\zeta^y$, into the input and output signals, respectively, which are read by the unauthorized observer. The unauthorized observer uses a Kalman filter for remote state estimation and applies two detection steps: first, by verifying that the obtained input-output signals satisfy certain characteristics; and second, by using innovation or residual-based detectors.</figcaption></figure>

is the estimation error of the legit observer, substituting in the innovation (15):

$$ 
\begin{aligned}
\tilde{\mathbf{y}}_k^m &= C(A\mathbf{e}_{k-1} + \mathbf{w}_{k-1}) + \mathbf{v}_k \\
&\quad + \zeta_k^y - C B \zeta_{k-1}^u + C A \mathbf{e}_{k-1}^m,
\end{aligned} 
\quad (16) 
$$

by comparing the innovation equations of the unauthorized observer (16) with the one of the legit observer (7), we find $\tilde{\mathbf{y}}_k^m = \tilde{\mathbf{y}}_k + \zeta_k^y - C B \zeta_{k-1}^u + C A \mathbf{e}_{k-1}^m$, and we conclude that the misleading injections are not detectable by the innovation-based detector i.e. $\tilde{\mathbf{y}}_k^m = \tilde{\mathbf{y}}_k$ if and only if the following condition is satisfied:

$$ \zeta_k^y - C B \zeta_{k-1}^u + C A \mathbf{e}_{k-1}^m = 0. \quad (17) $$

To find the term $\mathbf{e}_{k-1}^m$, we start by writing the equation of the state estimation after the correction step, assuming that the
condition (17) is satisfied, and we substitute it in (16), thus we obtain $\tilde{\mathbf{y}}_k^m = \mathbf{C}(\mathbf{A}\mathbf{e}_{k-1} + \mathbf{w}_{k-1}) + \mathbf{v}_k$, then we find the estimation after correction:

$$ 
\begin{aligned}
\hat{\mathbf{x}}_k^m &= \hat{\mathbf{x}}_{k|k-1}^m + \mathbf{K}_k \tilde{\mathbf{y}}_k^m, \\
&= \mathbf{A} \hat{\mathbf{x}}_{k-1}^m + \mathbf{B} \mathbf{u}_{k-1} + \mathbf{w}_{k-1} - \mathbf{A} \hat{\mathbf{x}}_{k-1}^m - \mathbf{B} \mathbf{u}_{k-1} \\
&\quad - \mathbf{B} \zeta_{k-1}^u - \mathbf{K}_k (\mathbf{C}(\mathbf{A}\mathbf{e}_{k-1} + \mathbf{w}_{k-1}) + \mathbf{v}_k) \\
&= \mathbf{A} (\mathbf{x}_{k-1} - \hat{\mathbf{x}}_{k-1}^m) + \mathbf{w}_{k-1} - \mathbf{B} \zeta_{k-1}^u \\
&\quad - \mathbf{K}_k (\mathbf{C}(\mathbf{A}\mathbf{e}_{k-1} + \mathbf{w}_{k-1}) + \mathbf{v}_k) \\
&\quad + \mathbf{A} \mathbf{e}_{k-1}^m - \mathbf{B} \zeta_{k-1}^u,
\end{aligned}
\quad (18) $$

and the estimation error:

$$ 
\begin{aligned}
\mathbf{x}_k - \hat{\mathbf{x}}_k^m &= \mathbf{A}\mathbf{x}_{k-1} + \mathbf{B}\mathbf{u}_{k-1} + \mathbf{w}_{k-1} - \mathbf{A}\hat{\mathbf{x}}_{k-1}^m - \mathbf{B}\mathbf{u}_{k-1} \\
&\quad - \mathbf{B}\zeta_{k-1}^u - \mathbf{K}_k(\mathbf{C}(\mathbf{A}\mathbf{e}_{k-1} + \mathbf{w}_{k-1}) + \mathbf{v}_k) \\
&= \mathbf{A}(\mathbf{x}_{k-1} - \hat{\mathbf{x}}_{k-1}^m) + \mathbf{w}_{k-1} - \mathbf{B}\zeta_{k-1}^u \\
&\quad - \mathbf{K}_k(\mathbf{C}(\mathbf{A}\mathbf{e}_{k-1} + \mathbf{w}_{k-1}) + \mathbf{v}_k) \\
&\quad + \mathbf{A}\mathbf{e}_{k-1}^m - \mathbf{B}\zeta_{k-1}^u,
\end{aligned}
\quad (19) $$

we substitute (10):

$$ \mathbf{x}_k - \hat{\mathbf{x}}_k^m = \mathbf{e}_k + \mathbf{A}\mathbf{e}_{k-1}^m - \mathbf{B}\zeta_{k-1}^u, \quad (19) $$

thus we get:

$$ \mathbf{e}_k^m = \mathbf{A}\mathbf{e}_{k-1}^m - \mathbf{B}\zeta_{k-1}^u, \quad (20) $$

by comparing (17) and (20), we conclude:

$$ \zeta_k^y = -\mathbf{C}\mathbf{e}_k^m, \quad (21) $$

thus the conditions (14) are sufficient and necessary conditions for the undetectable misleading injections by the innovation-based detector. Now, we prove that these misleading injections are undetectable by the residual-based detector. The residual of the unauthorized observer's Kalman filter is:

$$ 
\begin{aligned}
\tilde{\mathbf{r}}_k^m &= \mathbf{y}_k^m - \mathbf{C}\hat{\mathbf{x}}_k^m = \mathbf{C}\mathbf{x}_k + \mathbf{v}_k + \zeta_k^y - \mathbf{C}\hat{\mathbf{x}}_k^m, \\
&= \mathbf{C}\mathbf{e}_k + \mathbf{v}_k + \zeta_k^y + \mathbf{C}\mathbf{e}_k^m,
\end{aligned}
\quad (22) $$

substituting the condition (20):

$$ \tilde{\mathbf{r}}_k^m = \mathbf{C}\mathbf{e}_k + \mathbf{v}_k, $$

which is identical to the residual (8), thus, these injections are undetectable by the residual-based detector. ■

**Remark 2.** Conditions (14) represent a linear state-space model of the unauthorized observer's estimation error, where its input corresponds to the misleading injections to the system input, and its output corresponds to the misleading injections to the system output. These injections can be designed to cause estimation errors based on the system properties addressed in Theorem 2 and Theorem 3 in Section VI. These conditions can also be incorporated into an optimization problem, as outlined in Proposition 1 in Section VII, making the conditions effective for designing the misleading injections.

## VI. SYSTEM PROPERTIES FOR EXISTENCE OF AN MUO DEFENSE STRATEGY

The purpose of this section is to study and analyze the properties that a system must possess to be defended against unauthorized observers through misleading injections (14) in the three defenses strategies: state-i MUO, strongly MUO, and state-i strongly MUO.

**Theorem 2.** The defending system is able to perform state-i MUO defense strategy on a system defined by (1)-(2), if and only if the $i^{th}$ row of the controllability matrix $\mathbf{C} = [\mathbf{A}^{n_x-1}\mathbf{B} \dots \mathbf{A}\mathbf{B}\mathbf{B}]$ differs from zero.

*Proof.* At time step $k \ge n_x$, the unauthorized observer estimation error caused by misleading injections (see (14)):

$$ 
\begin{aligned}
\mathbf{e}_k^m &= \mathbf{A}\mathbf{e}_{k-1}^m - \mathbf{B}\zeta_{k-1}^u, \\
&= \mathbf{A}^2\mathbf{e}_{k-2}^m - \mathbf{A}\mathbf{B}\zeta_{k-2}^u - \mathbf{B}\zeta_{k-1}^u, \\
&= -[\mathbf{A}^{k-1}\mathbf{B} \dots \mathbf{A}\mathbf{B}\mathbf{B}] \begin{bmatrix} \zeta_0^u \\ \vdots \\ \zeta_{k-2}^u \\ \zeta_{k-1}^u \end{bmatrix}.
\end{aligned}
$$

Note that $\mathbf{e}_0^m = \mathbf{0}$, as the unauthorized observer knows the initial estimate of the legit observer $\hat{\mathbf{x}}_0$, as stated in Assumption 3. We denote the matrix $[\mathbf{A}^{k-1}\mathbf{B} \dots \mathbf{A}\mathbf{B}\mathbf{B}]$ by $\mathcal{C}_k$ (which is equal to the controllability matrix $\mathcal{C}$ when $k = n_x$), its $i^{th}$ row by $\mathcal{C}_k(i)$, and the vector $[\zeta_0^u \ T \ \dots \ \zeta_{k-2}^u \ \zeta_{k-1}^u \ T]^{T}$ by $\zeta_{<k}^u$, thus $\mathbf{e}_k^m(i) = \mathcal{C}_k(i)\zeta_{<k}^u$. We analyze two cases, if $\mathcal{C}_k(i) = \mathbf{0}$, then $\mathbf{e}_k^m(i) = \mathbf{0}$ regardless of the value of $\zeta_{<k}^u$. Conversely, if $\mathcal{C}_k(i) \ne \mathbf{0}$, then we can find $\zeta_{<k}^u$ so that $\mathbf{e}_k^m(i) \ne \mathbf{0}$.

We prove that, $\forall k \ge n_x$, $\mathcal{C}_k(i) = \mathbf{0}$ if and only if $\mathcal{C}(i) = \mathbf{0}$, where $\mathcal{C}(i)$ is the $i^{th}$ row of the controllability matrix $\mathcal{C}$. The first implication is straightforward: if $\mathcal{C}(i) \ne \mathbf{0}$, then $\mathcal{C}_k(i) \ne \mathbf{0}$. Conversely, if $\mathcal{C}(i) = \mathbf{0}$, it means that all $i^{th}$ rows of the terms $\mathbf{A}^l\mathbf{B}$ are zeros for all $l < n_x$. Applying the Cayley-Hamilton theorem [30, Section 2.4.3] to the square matrix $\mathbf{A}$, we can express $\mathbf{A}^l$ for $l \ge n_x$ as a linear combination of $\mathbf{I}, \mathbf{A}, \dots, \mathbf{A}^{n_x-1}$. Consequently, the term $\mathbf{A}^l\mathbf{B}$ for $l \ge n_x$ can be expressed as a linear combination of $\mathbf{B}, \mathbf{A}\mathbf{B}, \dots, \mathbf{A}^{n_x-1}\mathbf{B}$, which have the $i^{th}$ rows equal to zero. Thus, the terms $\mathbf{A}^l\mathbf{B}$ have the $i^{th}$ rows equal to zero for all $l \ge n_x$, thereby proving the second implication. ■

**Theorem 3.** A defending system can perform a strongly MUO by misleading injections on a system defined by (1)-(2) if and only if the pair $(\mathbf{A}, \mathbf{B})$ is controllable. Otherwise, it can perform a state-i strongly MUO defense if the state component $i$ belongs to the controllable subspace of the system.

*Proof.* Given (14), the error dynamics is a system driven by $\zeta_k^u$ with controllability depending on the pair $(\mathbf{A}, \mathbf{B})$. From Definition 5, driving the error $\mathbf{e}_k^m$ to arbitrary trajectory $\mathbf{e}_k^d$, means controlling $\mathbf{e}_k^m$, the state of system (14). This is achieved if and only if $(\mathbf{A}, \mathbf{B})$ is controllable. Otherwise, based on the notions of controllable subspaces [31], state-i strongly MUO is achieved if the $i^{th}$ component of the state belongs to the controllable subspace. ■

The importance of strongly MUO (discussed in Theorem 3) comes from a crucial point that the defending system may not only need to introduce an error in the unauthorized observer's estimation (even if the error is large), but it may have the purpose of directing the unauthorized observer's estimation along a specific trajectory. For instance, in the case of a moving car, the defending system might aim to mislead the
unauthorized observer into believing that the car is following a trajectory inside a specific area while the car is outside.

Theorem 2 is important for uncontrollable systems, where even if some states are not controllable, the defending system is still able to cause an error in the unauthorized observer estimation for these states. For example, for the system model defined by (1)-(2), where its matrices are:

$$A = \begin{pmatrix} 0 & 1 & 0 \\ 0 & 0 & 1 \\ 1 & 0 & 0 \end{pmatrix}, \quad B = \begin{pmatrix} 1 \\ 1 \\ 1 \end{pmatrix}, \quad C = \begin{pmatrix} 1 & 0 & 0 \end{pmatrix},$$

the observability matrix is:

$$O = \begin{pmatrix} 1 & 0 & 0 \\ 0 & 1 & 0 \\ 0 & 0 & 1 \end{pmatrix},$$

the observability matrix has the rank of 3, and the system is observable, satisfying Assumption 1. The controllability matrix is:

$$C = \begin{pmatrix} 1 & 1 & 1 \\ 1 & 1 & 1 \\ 1 & 1 & 1 \end{pmatrix},$$

it has a rank of 1, thus the pair $(A, B)$ is not controllable, and the defending system can not mislead the unauthorized observer to follow a specific trajectory. However, all rows of the controllability matrix differ from zeros, thus the defending system by misleading injections (14) can cause unauthorized observer estimation error for all states, and this error could be unbounded (and still undetectable by innovation and residual-based detectors), for instance by choosing $\zeta_k^u = 1$ for all $k$, and the injections on output $\zeta_k^y$ satisfy (14).

## VII. DESIGN OF MISLEADING DATA INJECTIONS FOR AN OPTIMAL MUO DEFENSE STRATEGY

In Proposition 1, a solution is proposed to design the undetectable misleading injections so that the unauthorized observer estimation error is maximized and the modified input-output signals satisfy the input-output signals characteristics.

**Proposition 1.** Consider the discrete-time linear system model defined by (1)-(2), subject to an unauthorized observer through eavesdropping on its input-output signals, and the defending system is able to modify the received input-output signals as in (10)-(11). The defending system misleads the unauthorized observer by injecting $\zeta_k^u$ and $\zeta_{k+1}^y$ which are the solution of the following optimization problem:

$$\max_{\zeta_k^u, \dots, \zeta_{k+N-1}^u, \zeta_{k+1}^y, \dots, \zeta_{k+N}^y} \sum_{i=1}^{N} e_{k+i}^{mT} W e_{k+i}^m$$

s.t.

$$\begin{align*}
e_{k+i+1}^m &= A e_{k+i}^m - B \zeta_{k+i}^u, & i &= 0, \dots, N-1 \\
\zeta_{k+i}^y &= -C e_{k+i}^m, & i &= 1, \dots, N \\
g_{k+i}^{min} &\le g_{k+i}(u_{k+i}^m) \le g_{k+i}^{max}, & i &= 0, \dots, N-1 \\
h_{k+i}^{min} &\le h_{k+i}(y_{k+i}^m) \le h_{k+i}^{max}. & i &= 1, \dots, N \tag{23}
\end{align*}$$

where $W$ is a weight matrix, and $N$ is the time window on which the optimization problem is solved.

The optimization problem (23) involves maximizing a quadratic convex function subject to constraints. The quadratic cost function is commonly used in the literature for expressing estimation error, e.g. it aligns with the properties of the optimal Kalman filter [13]. The first two constraint equations are the sufficient and necessary conditions to ensure that the input-output signals modifications remain undetectable by innovation and residual-based detectors, these conditions are stated in Theorem 1 in Section V. The third and fourth constraints aim that the modified input-output signals satisfy the input-output signals characteristics. In order to illustrate the concept of misleading unauthorized observer, and more specifically Proposition 1, Section VIII shows a study case where the defending system applies Proposition 1 in order to mislead the unauthorized observer. For a general and in-depth understanding of optimization theory, see [32].

## VIII. SIMULATIONS

In these simulations, we consider a defending system that is a moving body in the $XY$ plane, capable of free movement in both $X$ and $Y$ directions. The system is equipped with two sensors: a GPS to measure the position and an accelerometer to measure the acceleration. This scenario illustrates an interesting case where the moving body seeks to defend itself by misleading the unauthorized observer, while the unauthorized observer believes that the body is being accurately monitored. This example illustrates both scenarios where the MUO defense can protect against the unauthorized observer, as explained in Section IV. In both cases, the input consists of acceleration measurements, and the output consists of GPS measurements. In the first scenario, the unauthorized observer gains access to the system network, as illustrated in Fig. 5. In the second scenario, the unauthorized observer has previously installed a GPS and an accelerometer, which the system later detects and modifies, as illustrated in Fig. 6. In the second scenario, the legitimate observer is a conceptual observer.

<figure><img src="image_7.png" /><figcaption>Fig. 5. First scenario: The unauthorized observer has unauthorized access to the internal network of the vehicle, which transmits modified accelerometer and GPS measurements.</figcaption></figure>
<figure><img src="image_8.png" /><figcaption>Fig. 6. Second scenario: The unauthorized observer installs a tracking unit containing an accelerometer and GPS, equipped with a transmitter. The defending system detects this tracking unit and, instead of removing or damaging it, modifies its measurements to mislead the unauthorized observer.</figcaption></figure>

The system state consists of four components, the position on X and Y axes, and the velocity on X and Y axes, i.e. $\mathbf{x}_k = [p_k^x, p_k^y, v_k^x, v_k^y]^T$. The output vector is the GPS measurement vector, i.e. $\mathbf{y}_k = [p_k^{x,GPS}, p_k^{y,GPS}]^T$. The input vector is the acceleration measurement vector on X and Y axes, i.e. $\mathbf{u}_k = [a_k^x, a_k^y]^T$. The system's discrete-time model is given as follows:

$$ \mathbf{x}_k = \begin{pmatrix} 1 & 0 & dt & 0 \\ 0 & 1 & 0 & dt \\ 0 & 0 & 1 & 0 \\ 0 & 0 & 0 & 1 \end{pmatrix} \mathbf{x}_{k-1} + \begin{pmatrix} 0 & 0 \\ 0 & 0 \\ dt & 0 \\ 0 & dt \end{pmatrix} \mathbf{u}_{k-1} + \mathbf{w}_{k-1}, \quad (24) $$

$$ \mathbf{y}_k = \begin{pmatrix} 1 & 0 & 0 & 0 \\ 0 & 1 & 0 & 0 \end{pmatrix} \mathbf{x}_k + \mathbf{v}_k, \quad (25) $$

where $dt$ is the sampling time, $\mathbf{w}_k = [0, 0, w_k^{a_x} dt, w_k^{a_y} dt]^T$, and $\mathbf{v}_k = [v_k^{x,GPS}, v_k^{y,GPS}]^T$. The noises $w_k^{a_x}, w_k^{a_y}$ are the accelerometer measurements noise, and $v_k^{x,GPS}, v_k^{y,GPS}$ are the GPS measurements noise. All of these noises are assumed to be uncorrelated zero-mean white random Gaussian signals with known covariance matrices.

## A. Simulation Setup

The simulation is done for sampling time $dt = 0.1$ s, and for $N^s = 100$ discrete time steps. We assume a circular true trajectory for one turn, by considering these true accelerations:

$$ a_k^x = 30 \cos\left(\frac{2\pi}{N^s} k\right), $$

$$ a_k^y = 30 \sin\left(\frac{2\pi}{N^s} k\right). $$

The true state is calculated using the dynamic model while setting the noises to zero and starting from initial state $\mathbf{x}_0 = [-30 (\frac{N^s dt}{2\pi})^2, 0, 0, -30 (\frac{N^s dt}{2\pi})^2]^T$ in order to have a circular trajectory. We assume the worst-case security scenario, where the initial state is known by the unauthorized observer. The process noise comes from the accelerometer noise, which

is set to have a standard deviation of $0.1m.s^{-2}$, and the measurement noise comes from the GPS, which is set to have a standard deviation of $4m$.

In this simulation, the signals modifications start in the middle of simulation time, to show how the unauthorized observer correctly estimates the state until the mid-time and then starts to diverge. The optimization problem is solved with undetectability constraints, ensuring that the signals modifications are not detectable by innovation or residual-based detectors, and includes input-output signals verifications. Two types of input-output signals verifications are performed in the following subsections.

The optimization problem (23) involves maximizing a quadratic convex function subject to linear constraints. Therefore, instead of using a general nonlinear solver, we employ disciplined convex-concave programming (DCCP) [33], which is built on top of CVXPY, a domain-specific language for convex optimization embedded in Python. The weight matrix is chosen to be identity $W = I$, in order to have the same weight for all states. The defender solves the optimization problem for a time window of $N = 20$, we choose this value inspired by the literature of the model predictive control (MPC), e.g. [34].

## B. Bounds Verification Constraints

In this subsection, the defender adds constraints on the bounds of the accelerometer measurements. We assume that both the defender and the unauthorized observer know that the moving body can not have acceleration more than $30m.s^{-2}$ in any direction, thus, these constraints are added when solving the optimization problem:

$$ -30 \le a_k^x \le 30, $$

$$ -30 \le a_k^y \le 30. $$

The results of this simulation are shown in Figs. 7, 8, 9, and 10. Fig. 7 shows the true trajectory and the estimated trajectory by the unauthorized observer in the XY plane. The unauthorized observer can estimate the first half of the trajectory before the defending system begins signals modifications. Afterward, the observer's estimations start to diverge, achieving the goal of the defending system. Fig. 8 shows the true and estimated velocity estimation, demonstrating that the unauthorized observer correctly estimates the velocity in the first half of the time, and diverges after activating the defense system. Fig. 9 shows the received (the modified) acceleration measurements by the unauthorized observer, where these measurements respect the acceleration bounds. We consider in this simulation that the unauthorized observer is using a $\chi^2$ detector, and based on the innovation. Fig. 10 shows the $\chi^2$ signal and the 99% confidence interval used as a threshold to decide if there are modifications. The value of the confidence interval can be found in $\chi^2$ tables by locating the desired confidence level corresponding to the degrees of freedom [28], while in this simulation, the $\chi^2$ signal has 2 degrees of freedom (output dimension). Fig. 10 shows that the $\chi^2$ signal does not exceed the threshold, thus the detector does not trigger an alarm. Moreover, the $\chi^2$ signal has the same behaviour
before and after starting signals modifications. This $\chi^2$ signal corresponds to one realization; in another simulation, the signal will differ but maintain the same distribution characteristics. This variation occurs because each simulation run involves different realizations of sensors' noises. We observe non-smooth velocity estimates in Fig. 8, and discontinuities in the acceleration measurements at the midpoint in Fig. 9, which may indicate unusual behaviour. Therefore, in the next subsection, additional constraints on the evolution of the modified accelerometer measurements are incorporated into the optimization problem.

<figure><img src="image_9.png" /><figcaption>Fig. 7. True trajectory and estimated trajectory by the unauthorized observer in the XY plane. The misleading injections are undetectable with bound constraints on the modified accelerometer measurements.</figcaption></figure>

<figure><img src="image_10.png" /><figcaption>Fig. 8. True velocity and estimated velocity by the unauthorized observer. The misleading injections are undetectable with bound constraints on the modified accelerometer measurements.</figcaption></figure>

### C. Bounds and Evolution Verification constraints

In this subsection, the defender adds constraints on both bounds and the evolution of accelerometer measurements. The additional constraints are:

$$-3 \le a_{k+1}^x - a_k^x \le 3,$$

$$-3 \le a_{k+1}^y - a_k^y \le 3.$$

The results of this simulation are shown in Figs. 11, 12, 13, and 14. These results demonstrate that adding constraints on the evolution of modified acceleration ensures the unauthorized observer's velocity estimates remain smooth and the received

<figure><img src="image_11.png" /><figcaption>Fig. 9. The modified accelerometer measurements, with bound constraints.</figcaption></figure>

<figure><img src="image_12.png" /><figcaption>Fig. 10. $\chi^2$ test output for one realization. The misleading injections are undetectable with bound constraints on the modified accelerometer measurements.</figcaption></figure>

acceleration data remains continuous. Additionally, the undetectability criterion is still satisfied by the $\chi^2$ detector, as shown in Fig. 14. These results demonstrate the benefits of solving the optimization problem for signals modifications. Constraints can be added to address any undesired behaviour in the modified input-output signals. Additionally, the defending system can prioritize misleading the unauthorized observer about specific states by assigning more weight to those states.

## IX. CONCLUSION

This paper addressed the challenge of securing Cyber-Physical Systems (CPS) against unauthorized observers who aim to estimate system states by eavesdropping on input-output signals. An active defense strategy is proposed, that involves modifications to input-output signals in order to mislead the unauthorized observer. The modifications should remain undetectable by innovation or residual-based detectors. Additionally, this paper addressed the properties that the system must have to perform three specific types of misleading unauthorized observers: state-i misleading unauthorized observer, strongly misleading unauthorized observer, and state-i strongly misleading unauthorized observer. The modifications were found as solutions to an optimization problem constrained by the conditions that the modifications are undetectable and
<figure><img src="image_13.png" /><figcaption>Fig. 11. True trajectory and estimated trajectory by the unauthorized observer in the XY plane. The misleading injections are undetectable with bound and evolution constraints on the modified accelerometer measurements.</figcaption></figure>

<figure><img src="image_14.png" /><figcaption>Fig. 12. True velocity state and estimated velocity state by the unauthorized observer. The misleading injections are undetectable with bound and evolution constraints on the modified accelerometer measurements.</figcaption></figure>

<figure><img src="image_15.png" /><figcaption>Fig. 13. The modified accelerometer measurements, with bound and evolution constraints.</figcaption></figure>

<figure><img src="image_16.png" /><figcaption>Fig. 14. $\chi^2$ test output for one realization. The misleading injections are undetectable with bound and evolution constraints on the modified accelerometer measurements.</figcaption></figure>

that the input-output signals received by the unauthorized observer are within certain bounds and satisfy the physical characteristics of these signals. The proposed solution was validated through simulations involving a moving body in the XY plane. The simulation results demonstrated that the defending system can successfully mislead the unauthorized observer, thereby enhancing the security of CPS against such threats. This research opens new research directions and encourages further work on active defense mechanisms against cyber attacks.

## REFERENCES

[1] H. Sandberg, V. Gupta, and K. H. Johansson, "Secure networked control systems," *Annu. Rev. Control. Robot. Auton. Syst.*, vol. 5, no. 1, pp. 445–464, 2022.

[2] C. De Persis and P. Tesi, "Input-to-state stabilizing control under denial-of-service," *IEEE Trans. Autom. Control*, vol. 60, no. 11, pp. 2930–2944, 2015.

[3] Y. Mo and B. Sinopoli, "Secure control against replay attacks," in *IEEE 47th Annu. Allert. Conf. Commun. Control Comput. (Allerton)*, (Monticello, IL, USA), pp. 911–918, 2009.

[4] Y. Chen, S. Kar, and J. M. F. Moura, "Optimal attack strategies Subject to detection constraints against cyber-physical systems," *IEEE Trans. Control Netw. Syst.*, vol. 5, no. 3, pp. 1157–1168, 2018.

[5] Y. Mo and B. Sinopoli, "On the performance degradation of Cyber-physical systems under stealthy integrity attacks," *IEEE Trans. Autom. Control*, vol. 61, no. 9, pp. 2618–2624, 2016.

[6] Z. Guo, D. Shi, K. H. Johansson, and L. Shi, "Optimal linear cyber-attack on remote state estimation," *IEEE Trans. Control Netw. Syst.*, vol. 4, no. 1, pp. 4–13, 2017.

[7] Z. Guo, D. Shi, K. H. Johansson, and L. Shi, "Worst-case innovation-based integrity attacks with side information on remote state estimation," *IEEE Trans. Control Netw. Syst.*, vol. 6, no. 1, pp. 48–59, 2019.

[8] F. Pasqualetti, F. Dorfler, and F. Bullo, "Attack detection and identification in cyber-physical systems," *IEEE Trans. Autom. Control*, vol. 58, no. 11, pp. 2715–2729, 2013.

[9] G. Shaaban, H. Fourati, A. Kibangou, C. Prieur, and M. Pirani, "Cyber-physical security of vehicles: Zero dynamics attacks against vehicle's lateral dynamics," in *IEEE 23rd Eur. Control Conf. (ECC)*, (Thessaloniki, Greece), 2025.

[10] C. Kwon, W. Liu, and I. Hwang, "Analysis and design of stealthy cyber attacks on unmanned aerial systems," *J. Aerosp. Inf. Syst.*, vol. 11, no. 8, pp. 525–539, 2014.

[11] C. Kwon, S. Yantek, and I. Hwang, "Real-time safety assessment of unmanned aircraft systems against stealthy cyber attacks," *J. Aerosp. Inf. Syst.*, vol. 13, no. 1, pp. 27–45, 2016.

[12] R. S. Smith, "A decoupled feedback structure for covertly appropriating networked control systems," *IFAC Proc. Vol.*, vol. 44, no. 1, pp. 90–95, 2011.

[13] R. E. Kalman, "A new approach to linear filtering and prediction problems," *J. Basic Eng.*, vol. 82, no. 1, pp. 35–45, 1960.

[14] A. Chattopadhyay and U. Mitra, "Security against false data-injection attack in cyber-physical systems," *IEEE Trans. Control Netw. Syst.*, vol. 7, no. 2, pp. 1015–1027, 2020.

[15] M. Ghaderi, K. Gheitasi, and W. Lucia, "A blended active detection strategy for false data injection attacks in cyber-physical systems," *IEEE Trans. Control Netw. Syst.*, vol. 8, no. 1, pp. 168–176, 2021.

[16] M. S. Chong, H. Sandberg, and A. M. Teixeira, "A tutorial introduction to security and privacy for cyber-physical systems," in *IEEE 18th Eur. Control Conf. (ECC)*, (Naples, Italy), pp. 968–978, 2019.
[17] Y. Liu and Y. Morgan, "Security against passive attacks on network coding system - A survey," *Comput. Netw.*, vol. 138, pp. 57-76, 2018.

[18] J. Ning, J. Xu, K. Liang, F. Zhang, and E.-C. Chang, "Passive attacks against searchable encryption," *IEEE Trans. Inf. Forensics Secur.*, vol. 14, no. 3, pp. 789-802, 2019.

[19] A. Khazraei and M. Pajic, "Attack-resilient state estimation with intermittent data authentication," *Automatica*, vol. 138, p. 110035, 2022.

[20] F. Farokhi, I. Shames, and N. Batterham, "Secure and private control using semi-homomorphic encryption," *Control Eng. Pract.*, vol. 67, pp. 13-20, 2017.

[21] Y. Lu and M. Zhu, "Privacy preserving distributed optimization using homomorphic encryption," *Automatica*, vol. 96, pp. 314-325, 2018.

[22] A. Teixeira, D. Pérez, H. Sandberg, and K. H. Johansson, "Attack models and scenarios for networked control systems," in *ACM 1st Int. Conf. High Confidence Networked Systems (HiCoNS)*, (Beijing China), pp. 55-64, 2012.

[23] A. Teixeira, I. Shames, H. Sandberg, and K. H. Johansson, "A secure control framework for resource-limited adversaries," *Automatica*, vol. 51, pp. 135-148, 2015.

[24] G. Washington, *The papers of George Washington. 4: 5. Retirement series April - December 1799 / W. W. Abbot, ed.* Charlottesville, Va: Univ. Press of Virginia, 1. publ ed., 1999.

[25] D. C. Daniel and K. L. Herbig, "Propositions on military deception," *J. Strateg. Stud.*, vol. 5, no. 1, pp. 155-177, 1982.

[26] Y. Mo, R. Chabukswar, and B. Sinopoli, "Detecting integrity attacks on SCADA systems," *IEEE Trans. Control Syst. Technol.*, vol. 22, no. 4, pp. 1396-1407, 2014.

[27] H. C. A. Van Tilborg and S. Jajodia, eds., *Encyclopedia of Cryptography and Security*. Boston, MA: Springer US, 2011.

[28] B. Brumback and M. Srath, "A Chi-square test for fault-detection in Kalman filters," *IEEE Trans. Autom. Control*, vol. 32, no. 6, pp. 552-554, 1987.

[29] F. Fakhfakh, M. Tounsi, and M. Mosbah, "Cybersecurity attacks on CAN bus based vehicles: a review and open challenges," *Library Hi Tech*, vol. 40, no. 5, pp. 1179-1203, 2022.

[30] R. Horn and C. Johnson, *Matrix Analysis*. Cambridge University Press, 2012.

[31] E. Evangelisti, ed., *Controllability and Observability*. Berlin, Heidelberg: Springer Berlin Heidelberg, 2011.

[32] S. Boyd and L. Vandenberghe, *Convex Optimization*. Cambridge University Press, 2004.

[33] X. Shen, S. Diamond, Y. Gu, and S. Boyd, "Disciplined convex-concave programming," in *IEEE 55th Conf. Decis. Control (CDC)*, (Las Vegas, NV, USA), pp. 1009-1014, 2016.

[34] A. Bemporad, M. Morari, V. Dua, and E. N. Pistikopoulos, "The explicit linear quadratic regulator for constrained systems," *Automatica*, vol. 38, no. 1, pp. 3-20, 2002.

<figure><img src="image_17.png" /></figure>

**Hassen Fourati** Hassen Fourati, PhD, is currently an associate professor of the electrical engineering and computer science at the University of Grenoble Alpes, Grenoble, France, and a member of the Dynamics and Control of Networks Team (DANCE), affiliated to the Pôle Automatique et Diagnostic (PAD) of the GIPSA-Lab. He earned his bachelor of engineering degree in electrical engineering at the National Engineering School of Sfax (ENIS), Tunisia; master's degree in automated systems and control

at the University of Claude Bernard (UCBL), Lyon, France; and PhD degree in automatic control at the University of Strasbourg, France, in 2006, 2007, and 2010, respectively. His research interests include nonlinear filtering, estimation and multisensor fusion with applications in navigation, motion analysis, mobility and traffic management. He has published several research papers in scientific journals, international conferences, book chapters and books.

<figure><img src="image_18.png" /></figure>

**Alain Kibangou** Alain Y. Kibangou is an Associate Professor at the University Grenoble Alpes and a researcher at Gipsa-Lab. He earned his Ph.D. in control, signal, and image processing jointly from the University of Nice Sophia Antipolis, France, and Cadi Ayyad University of Marrakesh, Morocco, in 2005. Following his doctorate, he held postdoctoral positions at the I3S Laboratory in Sophia Antipolis, LAAS in Toulouse, and GIPSA-Lab in Grenoble. In 2009, he joined the University Grenoble Alpes as an

Associate Professor under the "CNRS-Higher Education chairs" program. Since 2022, He has been an Associate Visiting Professor at the Faculty of Sciences of the University of Johannesburg. At the University Grenoble Alpes, he serves as the deputy director of the Mathematics, Sciences, and Technologies of Information and Communication research department. His research interests include network systems, distributed estimation, urban mobility, nonlinear filtering, cyberphysical security, and system identification. He is member of the editorial board of the IEEE Transactions on Control of Network Systems.

<figure><img src="image_19.png" /></figure>

**Ghadeer Shaaban** Ghadeer Shaaban is currently a Ph.D. student in automatic control at the University Grenoble Alpes, France, and is affiliated with CNRS, Inria, Grenoble INP, and GIPSA-lab. He earned a Master's degree from ENSE3, Grenoble-INP, France, in 2022, and a Bachelor's degree from the Higher Institute for Applied Sciences and Technology, Damascus, Syria, in 2018. His research interests include Estimation, Navigation, Kalman Filtering, Sensor Fusion, and Cyber-Physical Security.

<figure><img src="image_20.png" /></figure>

**Christophe Prieur** (Fellow, IEEE) Christophe Prieur joined the Gipsa-lab, Grenoble, France in 2010 where he is currently a senior researcher of the CNRS. He has been an associate editor of several journals including the IEEE Trans. on Automatic Control, the European J. of Control, the IEEE Trans. on Control Systems Technology, the SIAM Journal of Control and Optimization and the Mathematics of Control, Signals, and Systems. He has been a senior editor of the IEEE Control Systems Letters, and he is currently an

editor of the IMA Journal of Mathematical Control and Information. He is an IMA Fellow, and an IEEE Fellow. His current research interests include nonlinear control theory, hybrid systems, and control of partial differential equations, with applications including navigation and object tracking, fluid dynamics, and fusion control.