⚡ electrical engineering

Deception Against Data-Driven Linear-Quadratic Control

This paper proposes a deception strategy for data-driven linear-quadratic control where a defender with full system knowledge injects deceptive inputs to mislead an adversary into learning a suboptimal attack, a problem solved numerically using a block successive over-relaxation algorithm that guarantees convergence.

Original authors: Filippos Fotiadis, Aris Kanellopoulos, Kyriakos G. Vamvoudakis, Ufuk Topcu

Published 2026-02-20

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Filippos Fotiadis, Aris Kanellopoulos, Kyriakos G. Vamvoudakis, Ufuk Topcu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a high-stakes game of chess, but instead of a board, the game is played on a complex machine like an airplane.

The Players:

The Defender (The Pilot): They know exactly how the plane works. They have the manual, the blueprints, and they know every lever and button.
The Adversary (The Hacker): They want to crash the plane. But they are blind. They don't have the manual. They have to figure out how to break the plane just by watching it fly and recording the data. They are trying to "learn" the perfect way to sabotage the system.

The Problem:
If the hacker watches the plane long enough, they will eventually figure out the perfect move to make the plane spin out of control. The defender knows this is coming.

The Solution: The "Magic Mirror" Deception
Instead of just hiding the data, the defender decides to play a trick. They realize that if they can change the environment just a tiny bit while the hacker is watching, they can trick the hacker into learning the wrong lesson.

Think of it like a magician. If a magician wants to teach an apprentice how to make a rabbit disappear, but they don't want the apprentice to learn the real trick (which is dangerous), the magician sets up a fake stage. They put a mirror in a specific spot. When the apprentice watches, they see the rabbit disappear, but they learn a completely different, harmless method to do it.

In this paper, the "magician" (the defender) injects a deceptive signal into the plane's controls.

The Setup: The defender knows the plane's true physics. The hacker is trying to learn the "Optimal Sabotage" (the move that causes the most damage).
The Trick: The defender subtly tweaks the plane's behavior. To the hacker, it looks like the plane is flying normally, but the data is slightly "spoofed."
The Result: The hacker studies this fake data and learns a "Sabotage Strategy." But because the data was fake, the strategy they learn is actually harmless. It's like the hacker learning how to gently tap the brakes instead of how to cut the engine.

How Do They Find the Perfect Trick?
The defender can't just guess. They need to solve a massive, complex math puzzle to find the exact amount of "fake data" to inject.

The paper describes this puzzle as a tangled knot of equations (Riccati and Lyapunov equations).
Solving this knot by hand is nearly impossible.
So, the authors invented a special step-by-step calculator (called a "Block Successive Over-Relaxation algorithm"). Imagine it like a GPS that doesn't just give you a route, but constantly corrects your path, saying, "You're close, but turn a little left, then a little right," until it finds the perfect spot where the hacker learns the safest possible mistake.

The Real-World Test
The authors tested this on a digital model of a real fighter jet (the ADMIRE aircraft).

Scenario: A hacker tries to learn how to destabilize the jet.
Outcome: Without the trick, the hacker would learn a move that crashes the jet. With the trick, the hacker learns a move that barely nudges the jet. The jet stays safe, and the hacker thinks they are being clever, but they are actually being guided toward a harmless outcome.

Why This Matters
In the past, if you wanted to stop a hacker, you had to build a stronger wall (better firewalls). This paper suggests a smarter approach: Misdirection. If you can't stop them from learning, you can trick them into learning something that doesn't hurt you. It turns the hacker's own intelligence against them, guiding them down a path that looks like a victory but is actually a dead end.

In a Nutshell:
The paper teaches us how to build a "honey trap" for data-driven hackers. By carefully manipulating the data they see, defenders can force attackers to learn a "safe" version of a dangerous attack, keeping the system secure without the attacker even realizing they've been tricked.

1. Problem Statement

The paper addresses the security vulnerability of data-driven linear-quadratic (LQ) control systems against adversarial attacks.

The Adversary: An external attacker attempts to learn the optimal linear-quadratic attack policy for a dynamical system. Crucially, the attacker does not know the system dynamics (matrices $A$ , $B_u$ ) and must rely on observed state and input data to learn the optimal attack gain ( $K^\star$ ) via system identification or direct data-driven methods.
The Defender: The system defender possesses full knowledge of the system dynamics and the adversary's objective (the cost function matrices $Q$ and $R$ ).
The Goal: The defender aims to inject a deceptive feedback input ( $u(t) = \Lambda x(t)$ ) into the system. This input distorts the data the adversary observes, forcing the adversary's learning algorithm to converge to a pre-selected, suboptimal attack gain ( $\bar{K}$ ) that is less damaging (or benign) compared to the true optimal attack $K^\star$ .

The core challenge is to design the deception gain $\Lambda$ such that it minimizes the distance between the learned attack and the target $\bar{K}$ , while ensuring the system remains stable and the deception effort is minimal.

2. Methodology

A. Mathematical Formulation

The problem is modeled as a constrained optimization problem. The defender seeks to minimize a cost function $J(\Lambda, P_u)$ :
$\inf_{\Lambda, P_u} \left( \|K_u(\Lambda) - \bar{K}\|_F^2 + \text{tr}(\Lambda^T \Gamma \Lambda) \right)$
Subject to:

Spoofed Algebraic Riccati Equation (ARE): The adversary learns a gain $K_u(\Lambda)$ derived from the minimal positive definite solution $P_u$ of a modified ARE, where the system dynamics are altered by the deceptive gain $\Lambda$ :
$(A + B_u\Lambda)^T P_u + P_u(A + B_u\Lambda) + Q + P_u B_a R^{-1} B_a^T P_u = 0$
Stability Constraints: The closed-loop system must remain stable.

The term $\text{tr}(\Lambda^T \Gamma \Lambda)$ acts as a regularization term to prevent excessively large deception inputs that could destabilize the nominal system.

B. Characterization of the Solution

Using Karush–Kuhn–Tucker (KKT) conditions, the authors derive that the optimal deception gain $\Lambda^\star$ is the root of a coupled system of matrix equations:

An Algebraic Riccati Equation (ARE) for $P_u$ .
A Lyapunov Equation (LE) for a symmetric matrix $\Pi$ (the Lagrange multiplier associated with the ARE constraint).
An explicit update rule for $\Lambda$ involving $P_u$ and $\Pi$ .

These equations are highly coupled and nonlinear, making analytical solutions intractable.

C. Numerical Algorithm: Block Successive Over-Relaxation (SOR)

To solve the coupled equations numerically, the authors propose Algorithm 1, a Block Successive Over-Relaxation (SOR) iterative method:

Initialize a deception gain $\Lambda_0$ .
Solve ARE: Compute $P_u$ for the current $\Lambda_i$ .
Solve Lyapunov: Compute $\Pi$ using the updated $P_u$ .
Update Gain: Calculate a new $\Lambda_{GS}$ and apply an over-relaxation step: $\Lambda_{i+1} = \Lambda_i + \omega(\Lambda_{GS} - \Lambda_i)$ .
Iterate until convergence.

D. Convergence Analysis

The paper provides a rigorous theoretical proof (Theorem 2) that Algorithm 1 converges to a stationary point of the optimization problem.

The authors interpret the iterative update as a gradient descent step on a generalized cost function $\tilde{J}(\Lambda)$ .
They prove that under specific conditions (related to the distance between the target gain $\bar{K}$ and the true optimal gain $K^\star$ , and the regularization weight $\Gamma$ ), the gradient is globally Lipschitz on the feasible set.
This guarantees that the algorithm does not diverge and converges to a minimum.

3. Key Contributions

Novel Deception Framework: Unlike "Moving Target Defense" (which changes dynamics to hide them) or "Poisoning" (which corrupts data randomly), this work explicitly steers the adversary's learning process toward a specific, pre-defined suboptimal policy.
Theoretical Characterization: The authors characterize the optimal deception policy as the solution to a coupled ARE and Lyapunov equation, a formulation not previously established for data-driven deception.
Provable Convergence: They develop a Block SOR algorithm and provide the first theoretical convergence guarantees for this specific deception design problem, addressing the instability often found in fixed-point iterations.
Robustness Analysis: The paper analyzes the scenario where the defender has imperfect knowledge of the adversary's cost matrices ( $Q, R$ ), showing that the deception remains effective even with parameter mismatches.
Extension to Minimizing Regulators: The framework is shown to apply to the dual problem of deceiving a defender learning a minimizing LQ regulator, which is mathematically simpler due to convexity.

4. Simulation Results

The proposed method was validated on a linearized ADMIRE benchmark aircraft model.

Case 1 (Performance-Degrading Attack):
- The adversary aimed to learn an optimal attack with $R=0.6I$ .
- The defender successfully forced the adversary to learn a gain close to zero ( $\bar{K}=0$ ).
- Result: The learned attack was significantly suppressed. The state energy of the system under the deceived attack was orders of magnitude lower than under the nominal optimal attack.
- Robustness: Even when the adversary's actual cost matrices differed from the defender's assumptions, the deception remained effective.
Case 2 (Destabilizing Attack):
- The adversary's optimal attack was destabilizing (due to a small $R$ ).
- The defender successfully deceived the adversary into learning a stable, benign attack.
- Result: The closed-loop system remained stable under the deceived attack, whereas the nominal attack would have caused instability.
Algorithm Performance: The SOR algorithm converged to a stationary point (demonstrated by decreasing cost functions in Figures 2 and 3), validating the theoretical convergence analysis.

5. Significance

This paper represents a significant advancement in cyber-physical system security and control theory:

Proactive Defense: It shifts the paradigm from reactive defense (detecting and mitigating attacks) to proactive deception, where the defender actively manipulates the learning environment to neutralize threats.
Data-Driven Security: It specifically targets the vulnerabilities of modern data-driven control systems, which are increasingly used when system models are unknown or uncertain.
Theoretical Rigor: By providing convergence guarantees for the deception design algorithm, the work moves beyond heuristic approaches, offering a reliable tool for engineers to implement deception strategies in safety-critical systems like aviation and autonomous vehicles.
Information Asymmetry: It effectively leverages the defender's information advantage (knowledge of dynamics) to exploit the adversary's information disadvantage (reliance on data), turning the adversary's learning mechanism against them.