[Paper Review] Controller Synthesis for Linear Time-varying Systems with Adversaries

Zhenqi Huang, Yu Wang+2 more|arXiv (Cornell University)|Jan 18, 2015

Smart Grid Security and Resilience22 references3 citations

TL;DR

This paper presents a sound and complete controller synthesis algorithm for discrete-time linear time-varying systems under adversarial attacks, using a novel decomposition that separates adversary-induced uncertainty from nominal system dynamics. By modeling the adversary’s actions via an L2-norm budget and leveraging SMT solvers with second-order cone programming, the method enables efficient synthesis of adversary-resilient controllers for systems up to 16 dimensions, with experimental validation on reach-avoid problems and attack synthesis capabilities.

ABSTRACT

We present a controller synthesis algorithm for a discrete time reach-avoid problem in the presence of adversaries. Our model of the adversary captures typical malicious attacks envisioned on cyber-physical systems such as sensor spoofing, controller corruption, and actuator intrusion. After formulating the problem in a general setting, we present a sound and complete algorithm for the case with linear dynamics and an adversary with a budget on the total L2-norm of its actions. The algorithm relies on a result from linear control theory that enables us to decompose and precisely compute the reachable states of the system in terms of a symbolic simulation of the adversary-free dynamics and the total uncertainty induced by the adversary. With this decomposition, the synthesis problem eliminates the universal quantifier on the adversary's choices and the symbolic controller actions can be effectively solved using an SMT solver. The constraints induced by the adversary are computed by solving second-order cone programmings. The algorithm is later extended to synthesize state-dependent controller and to generate attacks for the adversary. We present preliminary experimental results that show the effectiveness of this approach on several example problems.

Motivation & Objective

• To develop a sound and complete controller synthesis algorithm for linear time-varying systems under adversarial influence, particularly in safety-critical cyber-physical systems.
• To model adversarial actions—such as sensor spoofing, actuator intrusion, and controller corruption—as bounded L2-norm inputs to the system.
• To eliminate the universal quantifier over adversary choices by decomposing reachable states into nominal trajectories and adversary-induced uncertainty.
• To enable synthesis of controllers that guarantee reach-avoid objectives under all possible adversary actions within a given budget.
• To extend the framework to analyze system vulnerability and synthesize effective adversarial attacks for security assessment.

Proposed method

• The method decomposes the reachable set of the system into a nominal trajectory (adversary-free) and an adversary-induced uncertainty set, leveraging a key result from linear control theory.
• It formulates the safe and goal sets as modified constraints using second-order cone programs (SOCPs) to compute the total uncertainty induced by the adversary’s bounded actions.
• The controller synthesis problem is reduced to a quantifier-free linear SMT formula by eliminating the universal quantification over adversary inputs through symbolic decomposition.
• The algorithm uses CVXOPT for solving SOCPs and Z3 for SMT solving, enabling efficient and precise synthesis of controller strategies.
• For attack synthesis, the method constructs a state-space cover and uses SMT solving to identify vulnerable state regions where an adversary can force system violation.
• The approach supports both state-independent and state-dependent controller synthesis, with sound approximations for general convex compact sets via polytopic over-approximation.

Experimental results

Research questions

• RQ1 Can a controller be synthesized that guarantees reach-avoid objectives for linear time-varying systems under all possible bounded L2-norm adversary actions?
• RQ2 How can the universal quantifier over adversary choices be eliminated in the synthesis problem to enable effective use of SMT solvers?
• RQ3 What is the maximum adversary budget for which a safe controller still exists, and how can this be algorithmically determined?
• RQ4 Can the framework be extended to synthesize realistic adversarial attacks that exploit system vulnerabilities?
• RQ5 How can the proposed method be applied to analyze the vulnerability of system states under different adversary capabilities?

Key findings

• The algorithm successfully synthesizes adversary-resilient controllers for a 4-dimensional system over 320 time steps and a 16-dimensional system over 15 time steps, both within minutes.
• The method achieves sound and complete synthesis by precisely decomposing reachable sets into nominal dynamics and adversary-induced uncertainty, avoiding over-approximation.
• The use of SOCPs enables exact computation of the uncertainty set induced by the adversary, improving accuracy over conservative bounds.
• The framework supports the generation of adversarial look-up tables that identify vulnerable state regions, visualized as dark blue zones in 2D projections of high-dimensional state spaces.
• The approach enables analysis of system vulnerability by determining the minimal adversary budget that renders safe control infeasible.
• Experimental results confirm the effectiveness of the method in synthesizing controllers and attacks, with visualizations showing precise correlation between state regions and attack susceptibility.