[Paper Review] A Satisfiability Modulo Theory Approach to Secure State Reconstruction in Differentially Flat Systems Under Sensor Attacks

Yasser Shoukry, Pierluigi Nuzzo+4 more|arXiv (Cornell University)|Sep 10, 2015

Smart Grid Security and Resilience7 references3 citations

TL;DR

This paper proposes a Satisfiability Modulo Theory (SMT)-based approach for secure state reconstruction in differentially flat systems under sensor attacks, leveraging a generalized notion of $2\overline{s}$-observability to detect and reconstruct states despite up to $\overline{s}$ corrupted sensors. The method enables accurate, real-time state estimation in nonlinear systems like quadrotors, demonstrated by stable trajectory tracking under sensor attacks with estimation errors bounded at $10^{-2}$ m/s and average execution time of 16.1 ms.

ABSTRACT

We address the problem of estimating the state of a differentially flat system from measurements that may be corrupted by an adversarial attack. In cyber-physical systems, malicious attacks can directly compromise the system's sensors or manipulate the communication between sensors and controllers. We consider attacks that only corrupt a subset of sensor measurements. We show that the possibility of reconstructing the state under such attacks is characterized by a suitable generalization of the notion of s-sparse observability, previously introduced by some of the authors in the linear case. We also extend our previous work on the use of Satisfiability Modulo Theory solvers to estimate the state under sensor attacks to the context of differentially flat systems. The effectiveness of our approach is illustrated on the problem of controlling a quadrotor under sensor attacks.

Motivation & Objective

• To address secure state reconstruction in differentially flat systems where sensor measurements may be adversarially corrupted.
• To extend the concept of $s$-sparse observability from linear to nonlinear, differentially flat systems.
• To develop an efficient, SMT-based algorithm for detecting attacked sensors and reconstructing the true system state.
• To validate the approach on a real-world quadrotor control system under sensor attacks.
• To demonstrate real-time feasibility and robustness under model mismatch and bounded disturbances.

Proposed method

• Generalize $s$-sparse observability to nonlinear systems by introducing $2\overline{s}$-observability as a necessary and sufficient condition for state reconstruction under up to $\overline{s}$ sensor attacks.
• Use a first-order forward Euler discretization of the differentially flat system model to preserve flatness and enable SMT encoding.
• Formulate the attack detection and state reconstruction problem as a logical constraint satisfaction problem using Satisfiability Modulo Theory (SMT) solvers.
• Introduce a relaxed residual tolerance $\epsilon = 0.1$ to account for model mismatch and numerical errors in the SMT constraints.
• Implement the algorithm in Imhotep-SMT, which checks for consistent sensor subsets and identifies the minimal set of corrupted sensors.
• Integrate the reconstructed state into a real-time control loop with a 20 ms sampling time, ensuring low-latency operation.

Experimental results

Research questions

• RQ1 Can $2\overline{s}$-observability serve as a necessary and sufficient condition for secure state reconstruction in differentially flat systems under sensor attacks?
• RQ2 How can SMT solvers be effectively applied to detect and reconstruct states in nonlinear systems with adversarial sensor corruption?
• RQ3 To what extent can the proposed method maintain system stability and trajectory tracking under sensor attacks in a real-time control context?
• RQ4 How does model discretization and approximation error affect the accuracy and robustness of the state reconstruction?
• RQ5 What is the computational performance of the SMT-based algorithm in real-time applications?

Key findings

• The proposed $2\overline{s}$-observability condition is both necessary and sufficient for full state reconstruction in differentially flat systems under up to $\overline{s}$ sensor attacks.
• The Imhotep-SMT algorithm successfully reconstructed the quadrotor’s state with estimation error on vertical velocity bounded at $10^{-2}$ m/s despite sensor attacks.
• The algorithm achieved an average execution time of 16.1 ms on a standard desktop processor, which is below the 20 ms control sampling interval, enabling real-time operation.
• The quadrotor maintained stable trajectory tracking along a square path under attack, demonstrating robustness and control performance.
• The method remained effective even under model mismatch and numerical approximation errors, thanks to the relaxed residual tolerance $\epsilon = 0.1$.
• The SMT-based approach correctly identified the attacked sensor (vertical velocity IMU) and excluded its corrupted measurements from state estimation.