model-free-stealthy-attack-cps

---
license: mit
tags:
  - cyber-physical-systems
  - adversarial-attacks
  - autonomous-vehicles
  - security
  - false-data-injection
  - generative-adversarial-networks
---

Model-Free Stealthy False Data Injection Attacks on Autonomous Vehicle CPS

A model-free stealthy false data injection (FDI) attack framework for safety-critical cyber-physical systems (CPS), demonstrated on autonomous vehicle sensor systems. The attack learns strategies directly from nominal measurement data — no knowledge of system dynamics required — and produces perturbations that evade intrusion detection while degrading vehicle behavior.

Figure 1: Typical CPS architecture and proposed stealthy attack model — closed-loop control (feedback controller, plant/ECUs/sensors, state estimator, intrusion detection) with the attack model (eavesdropping → training the attack generator [autoencoder + conditional Wasserstein GAN] → attack injection) intercepting the communication network.

Status: paper under review at IEEE Transactions on Intelligent Transportation Systems (T-ITS). No citation available yet. Code: github.com/OSU-CAR-MSL/model_free_stealthy_attack (MIT license)

Role & Attribution

Sidra Ghayour Bhatti — supervisory/co-advising role on methodology and evaluation. Primary implementation and lead authorship: Qazi Mairaj ud din. PI: Qadeer Ahmed. OSU Center for Automotive Research (Mobility Systems Lab).

Method

Three components work together:

• Autoencoder anchor — learns the nominal measurement manifold from historical sensor data, defining what "normal" looks like.
• Recurrent generator network — produces bounded attack perturbations conditioned on past measurements, so the attack adapts in closed loop rather than injecting a fixed static offset.
• Wasserstein critic — enforces a distributional stealth constraint, keeping the perturbed measurement distribution close to nominal so statistical intrusion detectors don't flag it.

The training objective jointly balances three competing goals: stealth (staying under detection thresholds), impact (maximizing deviation in vehicle dynamics), and closed-loop consistency (context-conditioning so the attack remains coherent over time rather than acting pointwise).

Theoretical grounding

The attack design is motivated by three propositions: R1 (reflection direction) characterizes the perturbation direction that stays stealthy under the detector's residual statistics; R2 (residual-impact coupling) characterizes how a stealthy residual still couples into an observable impact on vehicle dynamics; R3 formalizes impact maximization subject to staying near the nominal (anchor) manifold. Together these turn "stay stealthy while maximizing impact" from a heuristic training objective into a constraint with a theoretical justification — consistent with grounding empirical attack performance in provable structure rather than purely empirical tuning.

Evaluation

Validated across four settings represented in the repo structure:

• Real vehicle validation — tested on measurements from a physical truck, not simulation-only data.
• Hardware-in-the-loop (HiL) — a high-fidelity Scania truck model run on a dSPACE SCALEXIO platform; the attack drove the vehicle to a hazardous state while remaining below the detector's threshold.
• Ablation studies — systematically remove each objective term (stealth, impact, recurrence/context-conditioning) and architecture variation to isolate which component is responsible for the attack's effectiveness, rather than reporting only the full-system result.
• IDS evaluation — tested against five different intrusion detection systems to check that stealth generalizes across detector types, not just the one the attack was tuned against.

Results

• Up to 2.51 m lane departure induced in the target vehicle while evading detection.
• 8 km/h speed deviation achieved in HiL testing, again remaining below the detector's alarm threshold.
• Stealth holds across five distinct IDS methods in IDS_eval/, not just a single detector the attack was fit to.
• Findings are corroborated on real vehicle sensor data, not simulation alone — strengthening the practical relevance of the attack surface being exposed.

Citation

Manuscript under review at IEEE T-ITS; citation to be added upon acceptance.