⚡ electrical engineering

A Learning With Errors based encryption scheme for dynamic controllers that discloses residue signal for anomaly detection

This paper proposes a Learning With Errors (LWE) based homomorphic encryption scheme for dynamic controllers that preserves data confidentiality while automatically disclosing the residue signal to enable anomaly detection without requiring the secret key or re-encryption.

Original authors: Yeongjun Jang, Joowon Lee, Junsoo Kim, Takashi Tanaka, Hyungbo Shim

Published 2026-05-22

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yeongjun Jang, Joowon Lee, Junsoo Kim, Takashi Tanaka, Hyungbo Shim

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Locked Box" Problem

Imagine you have a highly sensitive control system, like a robot arm or a power grid, that needs to be managed over the internet. You want to keep all the data (like the robot's position or the grid's voltage) secret so hackers can't steal it or mess with it.

To do this, you put all the data inside a digital locked box (encryption). The computer doing the math (the controller) works entirely inside these locked boxes. It never opens them. This is great for privacy, but it creates a new problem: How do you know if the robot is being attacked?

Usually, to detect an attack, you look at a "residue signal"—a specific number that tells you if things are behaving normally. If the robot is being hacked, this number spikes. But if everything is inside a locked box, you can't see this number unless you have the master key. If you give the master key to the security guard (the anomaly detector) so they can check the numbers, you've just broken the privacy rule.

The Solution: A "Magic Window"

The authors of this paper propose a clever trick. They designed a new way to lock the boxes so that one specific window on the box remains clear, while the rest stays locked.

Through this window, the security guard can see the "residue signal" (the alarm bell) clearly. But they still cannot see the robot's position, the speed, or the secret commands. The guard can shout "ALARM!" if the signal spikes, without ever needing the master key to open the whole box.

How They Did It: The "Ghost" Trick

The paper uses a complex math technique called Learning With Errors (LWE). Think of this like sending a message in a noisy room. To hide your message, you add a lot of static noise (errors) to it. The receiver needs a special decoder to filter out the noise and hear the message.

In this new scheme, the authors realized they could manipulate the "noise" (which they call the masking term) so that it cancels itself out perfectly for the residue signal.

The Analogy: Imagine you are trying to hide a secret note in a pile of confetti. Usually, the note is buried deep. But the authors figured out how to arrange the confetti so that for one specific note (the residue), the confetti piles up in a way that leaves the note sitting right on top, perfectly visible. For all the other notes, the confetti remains thick and impenetrable.

They achieved this by studying the "zero-dynamics" of the system. Think of this as understanding the "ghost moves" of the system—movements that happen internally but don't show up on the outside. By carefully setting up the initial conditions (the starting position of the confetti), they ensured the "ghost" movements cancel out the noise for the residue signal, making it visible by default.

The Second Innovation: No More "Re-locking"

There was another problem with previous methods. If the controller needed to use its own output as a new input (a feedback loop), it usually had to:

Open the box (decrypt).
Do some math.
Lock the box again (re-encrypt).
Send it back.

This is slow and requires extra communication lines.

The authors' new method uses the visible residue signal (the one we just made clear) as that feedback input. Since the residue is already visible, the controller can grab it, use it for its next calculation, and keep everything else locked up.

The Analogy: Instead of opening the safe, taking a tool out, locking it again, and handing it back, the security guard just reaches through the clear window, grabs the tool, and hands it back immediately. No extra trips, no extra time.

Does It Stay Safe?

The paper proves that making this one window clear doesn't give hackers any new information.

The Analogy: Imagine a bank vault. The authors show that if you leave the "alarm light" visible, a thief learns nothing about the money inside that they didn't already know just by watching the alarm light. The rest of the vault remains just as secure as before.

The Real-World Test

The team tested this on a two-mass-spring system (basically two weights connected by a spring).

They set up the system with their new "magic window" encryption.
They simulated a hacker injecting a fake signal to mess up the system.
Result: The system detected the attack almost instantly using the visible residue signal, just as well as a system that wasn't encrypted at all. The encrypted system performed just as well as the unencrypted one, proving you don't have to sacrifice performance for security.

Summary

This paper presents a way to encrypt control systems so that:

Privacy is kept: All data stays locked.
Safety is kept: A specific "alarm signal" is automatically visible to security guards without them needing the master key.
Efficiency is kept: The system runs faster because it doesn't need to constantly unlock and re-lock data to keep the feedback loop going.

Technical Summary: A Learning With Errors based Encryption Scheme for Dynamic Controllers that Discloses Residue Signal for Anomaly Detection

Problem Formulation
The paper addresses a critical limitation in encrypted control systems: while homomorphic encryption (HE) ensures the confidentiality of control parameters and signals during transmission and computation, it simultaneously obscures the information required for anomaly detection. In standard encrypted control architectures, the residue signal (the deviation from expected behavior used to detect attacks like false data injection or denial-of-service) remains encrypted. Consequently, detecting anomalies requires either sharing the secret key with a network-side detector (introducing security risks) or performing computationally intensive comparisons in the encrypted domain followed by decryption. The authors frame the problem as designing an encryption scheme that automatically discloses the residue signal as a plaintext for anomaly detection while maintaining the confidentiality of all other system signals and the security guarantees of the underlying cryptosystem.

Methodology
The proposed solution builds upon the Learning With Errors (LWE) based encryption scheme, which ensures security by adding a random masking term to the message. The core methodology involves characterizing the "zero-dynamics" of the encrypted dynamic system defined over a finite field of integers ( $\mathbb{Z}_q$ ).

Zero-Dynamics Manipulation: The authors analyze the dynamics of the masking term ( $b_r(t)$ ) associated with the residue signal. They demonstrate that by appropriately manipulating the encrypted initial state and the sequence of encrypted inputs, the masking term can be forced to remain identically zero ( $b_r(t) \equiv 0$ ) for all time steps. This is achieved by canceling specific portions of the initial state and input sequence based on the system's zero-dynamics (derived via a coordinate transformation to Byrnes-Isidori normal form).
Automatic Disclosure: When the masking term is zero, the first component of the resulting ciphertext corresponds directly to the plaintext residue signal. This allows a network-side detector to read the residue signal directly without requiring the secret key or performing decryption.
Dynamic Controller Implementation over $\mathbb{R}$ : To apply this to real-world controllers operating over real numbers, the authors propose a method to convert the controller into an integer-based system over $\mathbb{Z}_q$ . Unlike previous approaches that require "re-encryption" (decrypting the controller output at the actuator, re-encrypting it, and feeding it back to convert the state matrix to integers), this scheme utilizes the disclosed residue signal directly as a feedback input. This eliminates the need for an additional communication link between the actuator and the controller.
Security Analysis: The paper provides a formal security analysis showing that the view of an adversary observing the modified ciphertexts is deterministically reconstructible from a view that includes the standard ciphertexts plus the disclosed residue signal. This proves that the scheme does not leak information beyond what is implied by the residue signal itself.

Key Contributions

Residue Signal Disclosure: The primary contribution is an LWE-based encryption scheme that automatically discloses the residue signal for anomaly detection without decryption, while keeping all other signals (states, inputs, outputs) confidential.
Elimination of Re-encryption: The paper presents a method to implement dynamic controllers with non-integer state matrices over encrypted data without the need for re-encryption. By using the disclosed residue signal as a feedback input, the scheme avoids the computational and communication overhead associated with previous re-encryption strategies.
Theoretical Guarantees: The authors establish conditions under which the encrypted controller preserves the performance of the unencrypted controller (bounded error) and prove that the security of the standard LWE scheme is not compromised beyond the intended disclosure.

Results
The authors validate their approach through numerical simulations on a two-mass-spring system.

Performance: The simulation compares the unencrypted controller against the proposed encrypted controller. Results show that the encrypted controller generates control inputs and residue signals that are virtually identical to the unencrypted case, satisfying the performance bounds derived in the theory.
Anomaly Detection: An attack scenario involving an additive signal injected into the sensor output was simulated. Both the unencrypted and encrypted controllers successfully detected the attack using a Cumulative Sum (CUSUM) based anomaly detector. The residue signals and CUSUM statistics were comparable, confirming that the disclosure of the residue signal does not hinder detection capabilities.
Efficiency: The proposed method avoids the additional communication link and decryption/encryption cycles at the actuator required by re-encryption methods, thereby reducing computational burden and latency.

Significance and Claims
The paper claims that its proposed scheme resolves the fundamental trade-off between data confidentiality and anomaly detectability in encrypted control systems. By leveraging the zero-dynamics of the system, it enables a network-side detector to monitor system health without access to the secret key. The authors emphasize that this is achieved without compromising the semantic security of the underlying LWE scheme. Furthermore, the ability to operate dynamic controllers over real numbers without re-encryption addresses a significant practical barrier in deploying encrypted control systems, offering a more efficient architecture for real-time operations. The work is positioned as a step toward secure, resilient networked control systems where privacy and safety (via anomaly detection) are not mutually exclusive.