⚡ electrical engineering

On the Sharp Input-Output Analysis of Nonlinear Systems under Adversarial Attacks

This paper presents a sharp input-output analysis for learning general nonlinear dynamical systems under sparse, correlated, and nonzero-mean adversarial disturbances, demonstrating that an $\ell_2$ -norm estimator achieves optimal error bounds that decay with input memory length.

Original authors: Jihun Kim, Yuchen Fang, Javad Lavaei

Published 2026-06-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jihun Kim, Yuchen Fang, Javad Lavaei

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to learn the recipe for a complex dish by watching a chef cook. You see the ingredients they throw in (the inputs) and you taste the final result (the outputs). Your goal is to figure out the exact recipe (the system dynamics) so you can predict what the dish will taste like next time.

Usually, scientists assume the chef is cooking in a quiet kitchen with standard ingredients. But this paper asks: What happens if a saboteur is sneaking into the kitchen?

Here is the breakdown of the paper's findings using simple analogies:

1. The Saboteur (The Adversary)

In the real world, systems (like power grids, self-driving cars, or even biological processes) aren't just affected by random noise. Sometimes, a "saboteur" (an adversary) tries to mess things up.

The Old Way: Previous research assumed the saboteur was either blind (couldn't see what the chef was doing) or only added small, random sprinkles of salt.
The New Reality: This paper assumes the saboteur is smart. They can see everything the chef has done so far (the full history) and can add a massive, deliberate amount of poison to ruin the dish.
The Catch: The saboteur can't do this every single time. They are only allowed to strike occasionally. If they strike too often, the game is impossible to win. The paper proves that as long as the saboteur is "lazy" enough (attacking less than a specific frequency), we can still figure out the recipe.

2. The "Memory" Trick (Input Memory)

To figure out the recipe, the researchers don't just look at the last ingredient added. They look at a window of the last few ingredients (say, the last 5 steps).

They pretend the complex, non-linear cooking process is actually just a linear combination of "flavor profiles" (basis functions).
Think of it like this: Instead of trying to understand the chemistry of every single spice interaction, they say, "Let's just treat the last 5 ingredients as a single 'flavor block' and see how that block changes the taste."
This simplifies the problem from a chaotic mess into a math problem that can be solved, provided the "flavor blocks" are expressive enough.

3. The "L2-Norm" Detective

The paper tests different ways to guess the recipe.

Least Squares (The Naive Detective): This is the standard method used in most schools. It tries to minimize the average error. But if the saboteur adds one giant, massive error (a huge spike of poison), the average gets skewed, and the detective gets the wrong recipe.
The L2-Norm Estimator (The Smart Detective): The authors propose a specific mathematical tool (the $\ell_2$ $ℓ_{2}$ -norm estimator) that is much more robust.
- Analogy: Imagine the saboteur throws a giant rock into a pond. The "Naive Detective" tries to draw a line through the water ripples, but the rock distorts the whole picture. The "Smart Detective" realizes, "Ah, that rock is an outlier. I will ignore the massive splash and focus on the pattern of the smaller ripples."
- The paper proves that this "Smart Detective" can recover the true recipe even if the saboteur is smart and malicious, as long as they don't attack too frequently.

4. The "Sharp" Result (Optimality)

The paper doesn't just say, "This works." It says, "This is the best possible way it can work."

They proved a Lower Bound: They showed that no matter how clever you are, if the saboteur attacks with a certain frequency, there is a "floor" to how accurate you can be. You can't get perfect accuracy; there will always be a tiny bit of uncertainty.
They showed their method hits this floor exactly. It's like finding the fastest possible speed for a car on a specific road; you can't go faster, but this car goes exactly that fast.

5. Real-World Tests

The authors didn't just do math on paper. They tested their theory in two ways:

Synthetic Chaos: They created a fake, complex digital system (like a neural network) and let a computer program act as the saboteur. The "Smart Detective" successfully learned the system, while the standard method failed.
Power Grids: They simulated a real-world power grid (the kind that lights up your city). These grids are naturally complex and non-linear. They introduced "attacks" where a saboteur tried to mess with the power flow. Again, their method successfully identified how the grid behaved, while standard methods got confused.

Summary

The Core Message:
If you are trying to learn how a complex, non-linear system works (like a power grid or a robot), and a smart enemy is occasionally trying to trick you with big, malicious lies, you can still learn the truth. You just need to:

Look at a window of recent history (not just the last moment).
Use a specific mathematical tool (the $\ell_2$ -norm estimator) that ignores the massive outliers caused by the enemy.
Ensure the enemy isn't attacking too often (specifically, less than 1 in every $2 \times \text{window size}$ times).

If these conditions are met, you can learn the system's true "recipe" with the highest possible accuracy allowed by the laws of math.

Technical Summary: Sharp Input-Output Analysis of Nonlinear Systems under Adversarial Attacks

Problem Formulation
This paper addresses the challenge of identifying the input-output mapping of general nonlinear dynamical systems in the presence of adversarial disturbances. The system is modeled as a partially observed nonlinear dynamical system:
$x_{t+1} = f(x_t, u_t, w_t), \quad y_t = g(x_t, u_t)$
where $x_t$ is the state, $u_t$ is the control input, $w_t$ is an adversarial disturbance, and $y_t$ is the observation. Unlike existing literature which predominantly assumes Gaussian inputs, independent and identically distributed (i.i.d.) disturbances, or zero-mean noise, this work considers a significantly broader setting:

Non-Gaussian, Nonzero-Mean Inputs: Control inputs are not restricted to Gaussian distributions or zero means.
Correlated, Nonzero-Mean Adversarial Disturbances: The disturbance $w_t$ can be correlated with the system's full information history and possess a nonzero mean.
Partial Observability: The learner only observes $y_t$ , not the full state $x_t$ .

The primary objective is to learn the matrix $G^*$ that governs the mapping from a truncated input history $(u_t, \dots, u_{t-\tau})$ to the observation $y_t$ , despite the presence of these generalized disturbances.

Methodology
The authors propose a framework that reformulates the nonlinear system identification problem into a linearly parameterized estimation problem using a finite-memory approximation.

Linear Parameterization via Basis Functions: Leveraging the Stone-Weierstrass theorem and universal approximation properties, the nonlinear input-output behavior is approximated as a linear combination of basis functions $\Phi(\cdot)$ applied to the input history:
$y_t \approx G^* \cdot \Phi(u_t, \dots, u_{t-\tau}) + \text{residuals}$
The residuals include approximation errors, effects of "far" past states, and the cumulative effect of disturbances over the memory window.
Probabilistic Adversarial Attack Model: The paper introduces a specific constraint on the adversary. While the adversary can design $w_t$ using the full information history $\sigma\{x_0, \dots, x_t\}$ when an attack occurs, attacks are assumed to be sparse. Specifically, at any time $t$ , an attack occurs with probability $p$ , where $p < \frac{1}{2\tau}$ . This implies that with high probability, the system experiences a sequence of $\tau$ consecutive time steps without attacks, allowing the "clean" input-output dynamics to be observed.
$\ell_2$ -Norm Estimator: The authors propose estimating $G^*$ using an $\ell_2$ -norm minimization (least squares) estimator:
$\hat{G}_T = \arg \min_{G} \sum_{t=\tau}^{T-1} \| y_t - G \cdot \Phi(U^{(\tau)}_t) \|_2^2$
The analysis demonstrates that despite the presence of large-magnitude, nonzero-mean adversarial attacks, the $\ell_2$ -norm estimator can successfully recover $G^*$ provided the attack probability satisfies the sparsity condition.

Key Contributions and Results

Generalized Assumptions: The work extends system identification theory beyond linear systems and standard noise assumptions (Gaussian, zero-mean, i.i.d.) to include Lipschitz continuous nonlinear systems with non-Gaussian, nonzero-mean inputs and correlated adversarial disturbances.
Optimal Estimation Error Bound: The paper proves that the estimation error of the $\ell_2$ -norm estimator is bounded by $O(\rho^\tau)$ , where $\rho \in (0,1)$ is the contraction factor of the system dynamics $f$ . This bound decays exponentially with the input memory length $\tau$ .
Matching Lower Bound: To establish the sharpness of the result, the authors construct a problem instance where any estimator suffers from an error of $\Omega(\rho^\tau)$ . This proves that the derived upper bound is optimal and cannot be improved upon in the worst case under the given adversarial model.
Superiority of $\ell_2$ -Norm: The analysis shows that the $\ell_2$ -norm estimator achieves a tighter error bound compared to $\ell_1$ -norm or $\ell_\infty$ -norm estimators in this specific setting. Other norms introduce additional factors dependent on the observation dimension $r$ , whereas the $\ell_2$ -norm bound is independent of $r$ .
Experimental Validation: Numerical experiments on synthetic nonlinear systems and a real-world power grid swing dynamics model validate the theoretical findings. The results demonstrate that the $\ell_2$ -norm estimator converges to the true mapping, whereas standard least-squares (which assumes zero-mean noise) fails under adversarial conditions.

Significance and Claims
The paper claims to provide the first sharp input-output analysis for generic nonlinear and partially observed systems under significantly generalized assumptions regarding inputs and disturbances. Its primary significance lies in establishing optimal estimation error bounds for system identification under probabilistic adversarial attacks.

The authors emphasize that their work offers theoretical guarantees for improving the safety and resilience of learning complex nonlinear systems (such as power grids and autonomous vehicles) in realistic adversarial environments. By characterizing the class of problems where accurate identification is possible (specifically when attack probability is sparse relative to memory length), the paper bridges the gap between theoretical system identification and practical security requirements in cyber-physical systems. The work remains modest regarding future directions, noting that extending these results to non-parametric approaches involving infinite-dimensional optimization remains an open question.