⚡ electrical engineering

Secure Set-based State Estimation for Safety-Critical Applications under Adversarial Attacks on Sensors

This paper proposes a Secure Set-based State Estimation (S3E) algorithm that guarantees state inclusion certificates for safety-critical systems under sensor attacks by using constrained zonotopes to maintain the true state within the estimated set, detect and filter adversarial signals, and offer strategies to balance computational complexity with performance.

Original authors: M. Umar B. Niazi, Michelle S. Chong, Amr Alanwar, Karl H. Johansson

Published 2026-08-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: M. Umar B. Niazi, Michelle S. Chong, Amr Alanwar, Karl H. Johansson

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are the captain of a spaceship, but you can't see the stars or the instruments directly. Instead, you have a crew of sensors, each shouting out numbers about where the ship is and how fast it's going. In the world of cyber-physical systems—where computers control real-world things like power grids, self-driving cars, and robots—these sensors are the eyes and ears. But here's the scary part: a sneaky hacker can sneak into the ship's communication system and whisper fake numbers to the captain. If the captain believes the lies, the ship might crash into an asteroid or fly off a cliff.

For a long time, scientists tried to solve this by asking, "Can we trust the majority?" If more than half the sensors are telling the truth, we can ignore the liars. But what if the hacker is super smart and manages to trick more than half the sensors? Or what if the hacker is so subtle that the numbers look almost right, just slightly off? Traditional methods often fail here, or they get so paranoid that they stop the ship entirely to be safe. This paper dives into a different corner of science called "set-based estimation." Instead of guessing a single, exact location for the ship (like "we are at coordinate 5, 5"), this method draws a fuzzy, moving box around all the possible places the ship could be. It's like saying, "We know for a fact the ship is somewhere inside this glowing cloud." The goal is to keep the real ship inside that cloud, even when a hacker is trying to blow the cloud apart or make it disappear.

The authors of this paper, M. Umar B. Niazi and his team, have built a new, super-robust algorithm they call Secure Set-based State Estimation (S3E). Think of it as a magical detective game played with shapes. In their system, the computer doesn't just look at one sensor; it looks at every possible combination of sensors that could be telling the truth. It draws a small "agreement box" for each group. If a group of sensors is lying, their boxes won't fit together—they'll be disjointed or empty, like trying to fit a square peg in a round hole. The algorithm then throws away those broken groups.

Here is the cool part: the paper proves that as long as the remaining honest sensors are enough to reconstruct the ship's full state (a property called "redundant observability"), the algorithm can still find a group of sensors that agree with each other. It doesn't matter if the hacker has tricked all but one sensor, or all but a few, as long as that specific group of survivors can still mathematically "see" the whole ship. The algorithm builds a final "safety cloud" by combining the boxes from all the groups that do agree. This guarantees that the real state of the system is always hiding somewhere inside that cloud, no matter how hard the hacker tries to push it out.

The researchers also discovered a fascinating "trap" for the hacker. If the hacker tries to inject a huge, obvious lie, the math shows that the "agreement boxes" will instantly become empty, and the system will scream, "Something is wrong!" and throw that sensor's data away. To stay hidden, the hacker is forced to inject only tiny, whisper-quiet lies. But even then, the system keeps the safety cloud tight enough that the hacker can't steer the ship into danger without being noticed.

The team tested this idea with some fun simulations. First, they tried it on a simple math problem with three sensors, showing how the algorithm could spot when two were lying and still find the truth. Then, they took it to the real world by simulating a three-story building during an earthquake. They pretended a hacker was messing with the sensors measuring the building's shaking. Even when the hacker switched which sensor to attack every second, the algorithm kept the "safety cloud" around the building's true movement. The cloud got a little bigger or smaller, but it never let the building's actual position escape.

The paper suggests that this method is a game-changer for safety-critical systems because it doesn't need a "majority vote" to work. It can handle scenarios where a large number of sensors are compromised, provided the remaining safe sensors are sufficient to observe the system. However, the authors are honest about the trade-off: keeping track of all these different "agreement boxes" can get computationally heavy, like trying to juggle too many balls at once. They suggest strategies to simplify the juggling act, like merging overlapping boxes, to keep the system fast enough for real-time use. While the math is solid and the simulations look promising, the authors note that the ultimate test of how well this handles the most sneaky, complex attacks is still an open question for future research. But for now, they've handed us a new, incredibly sturdy shield for our digital eyes.

Technical Summary: Secure Set-based State Estimation for Safety-Critical Applications under Adversarial Attacks on Sensors

Problem Definition
The paper addresses the critical challenge of maintaining safety and security guarantees in cyber-physical systems (CPS) when sensor networks are subjected to adversarial false data injection attacks. Traditional secure state estimation (SSE) methods are predominantly point-based, providing a single state estimate with error bounds. These methods face fundamental limitations: they typically require that strictly fewer than half of the sensors remain uncompromised ( $q < p/2$ ) to guarantee bounded estimation errors. Furthermore, point-based methods cannot provide "state inclusion certificates," which are essential for the formal verification of safety constraints in safety-critical applications (e.g., power grids, autonomous vehicles). Existing set-based approaches for secure estimation often rely on restrictive assumptions, such as requiring every individual sensor to provide observability or assuming the system is bounded-input bounded-state stable, which limits their applicability to a narrow class of systems.

Methodology: The S3E Algorithm
The authors propose a Secure Set-based State Estimation (S3E) algorithm designed to maintain guaranteed state inclusion even when an adversary compromises up to $q$ sensors, where $q$ can be as high as $p-1$ (all but one sensor), provided the system remains observable from any subset of $c_J$ uncompromised sensors ( $c_J \leq p-q$ ).

The algorithm operates in discrete time steps and utilizes constrained zonotopes to represent sets of feasible states. The core procedure involves four sequential operations:

Time Update: Computes a predicted set of states based on system dynamics, known inputs, and bounded process noise.
Measurement Update: For each sensor $i$ , the predicted set is intersected with the set of states consistent with the sensor's measurement (accounting for measurement noise). This yields a set $\hat{Z}^i_k$ .
Agreement Protocol: The algorithm generates all possible combinations of $c_J$ sensors. For each combination (subset $J_h$ ), it computes the intersection of the corresponding measurement update sets ( $\mathcal{I}^h_k = \bigcap_{j \in J_h} \hat{Z}^j_k$ ). These intersections are termed "agreement sets."
Estimation: The final estimated set $\hat{X}_k$ is the union of all non-empty agreement sets.

Theoretical guarantees are established via induction, proving that if the initial set contains the true state and the system satisfies the redundant observability assumption, the true state $x(k)$ is guaranteed to be contained within $\hat{X}_k$ for all $k$ .

Key Contributions

Relaxed Assumptions: Unlike point-based methods requiring $q < p/2$ , the S3E algorithm functions correctly as long as at least one sensor is uncompromised ( $q \leq p-1$ ), provided the remaining safe sensors maintain observability.
State Inclusion Certificates: The method outputs a set (a collection of constrained zonotopes) rather than a point, providing a rigorous certificate that the true state lies within the estimated bounds. This is crucial for verifying safety constraints.
Attack Detection, Identification, and Filtering: The paper derives sufficient conditions for:
- Detection: If the intersection of all agreement sets is empty, an attack is detected.
- Identification: If a specific sensor's measurement update results in an empty set (due to inconsistency with the time update), that sensor is identified as compromised.
- Filtering: If an agreement set involving a specific sensor is empty, that sensor's data is effectively filtered out from that specific hypothesis.
Stealth Constraints: The analysis demonstrates that for an attacker to remain undetected (i.e., to keep all agreement sets non-empty), they must inject signals of sufficiently small magnitude. Large-magnitude attacks are automatically discarded by the algorithm, forcing the adversary to trade off attack impact for stealth.
Complexity Management: The authors acknowledge that the number of agreement sets can grow exponentially under stealthy attacks. They propose strategies to manage this, including removing empty sets, overbounding intersecting zonotopes, and applying zonotope reduction techniques to limit the number of generators.

Results and Evaluation
The efficacy of the S3E algorithm is demonstrated through numerical simulations:

Simple Linear System: A 1D system with 3 sensors and 2 compromised sensors ( $q=2, p=3$ ) illustrates that while the estimated set may consist of disjoint intervals (hypotheses), the true state is always included. The paper compares this to point-based methods, showing that point-based estimators fail or produce excessively conservative error bounds when $q \geq p/2$ .
Three-Story Building Model: A more realistic simulation of a building structure under seismic activity with 3 sensors (measuring displacement and velocity) and 1 compromised sensor ( $q=1$ ) demonstrates the algorithm's ability to track the true state despite attacks. The results show that the estimated set remains bounded and contains the true trajectory, even as the specific compromised sensor changes over time.
Complexity Reduction: Simulations on a 2D linear system with 4 sensors and 2 compromised sensors show that applying complexity reduction techniques (merging intersecting sets) effectively controls the growth of the estimated set with minimal loss in accuracy.

Significance and Claims
The paper claims that the S3E algorithm fundamentally relaxes the assumptions required by existing secure estimation methods, making it applicable to scenarios where adversaries can compromise a majority of sensors. By leveraging the geometric properties of set-based representations, the method ensures that safety verification remains possible even under active attacks. The authors emphasize that while the worst-case computational complexity may increase with stealthy attacks, the requirement for the attacker to possess perfect system knowledge and computational resources to maintain stealth acts as a natural barrier. The work positions set-based estimation as a necessary evolution for safety-critical systems where formal verification of state inclusion is non-negotiable, offering a robust alternative to point-based estimators that fail under high-sensor-compromise conditions.

More like this