Adversarial Observability and Performance Trade-offs in Optimal Control

1. Problem Statement

The paper addresses the challenge of designing feedback controllers for linear dynamical systems that operate in adversarial environments.

• The Conflict: An autonomous system operator aims to stabilize the system to the origin with optimal performance (minimizing a standard Linear Quadratic Regulator cost). However, an adversary possesses partial state measurements (via a sensing matrix $C$) and attempts to reconstruct the system's state or predict its intent.
• The Goal: The operator seeks to design a control law $u(t) = Kx(t)$ that simultaneously:
  1. Stabilizes the system near-optimally (minimizing deviation from the standard LQR cost).
  2. Minimizes the observability of the system from the adversary's perspective, thereby hindering state reconstruction.
• Constraints: The solution must adhere to a "hard" constraint on performance degradation. The controller cannot simply switch modes randomly (which causes transients) but must operate within a single, continuous feedback architecture.

2. Methodology

A. Mathematical Formulation

The authors model the system as a continuous-time linear system $\dot{x} = Ax + Bu$ with full state feedback available to the operator, but only partial output $y = Cx$ available to the adversary.
To quantify observability, the paper utilizes Observability Gramians ($W$) rather than binary rank tests. Two specific metrics are proposed:

1. Average Observability ($J_{o1}$): The trace of the Gramian, $\text{tr}(WV)$. This captures the average energy released through the sensors across all state directions.
2. Worst-Case Observability ($J_{o2}$): The negative trace of the inverse Gramian, $-\text{tr}(W^{-1}V^{-1})$. This metric is skewed toward the least observable directions. Minimizing this (or maximizing the trace of the inverse) pushes the system toward the boundary of unobservability (singularity of $W$).

The problem is cast as a constrained optimization where the observability metric is minimized subject to a performance budget $\lambda$:
$$J_s(K) - J_s(K^*) \leq \lambda$$
where $K^*$ is the optimal LQR gain and $\lambda$ represents the allowable performance trade-off.

B. Theoretical Analysis

The authors derive theoretical lower bounds on the achievable observability metrics as a function of the performance trade-off parameter $\lambda$.

• They establish that smaller performance losses ($\lambda$) yield a sharper decrease in the trace of the Gramian ($J_{o1}$).
• Conversely, larger performance losses allow for steeper improvements in the inverse Gramian metric ($J_{o2}$), as the system can approach singularity more closely.
• They also analyze robustness, proving that if the operator only knows a superset of the adversary's sensors, the resulting controller provides a certified upper bound on the adversary's observability.

C. Algorithmic Solutions

The paper proposes two distinct algorithms to solve the optimization problems:

1. Exact Solution for Average Observability (Problem 1):

   • The problem of minimizing $\text{tr}(WV)$ subject to performance constraints is reformulated as a Semidefinite Program (SDP).
   • By using a change of variables ($X = KS$) and the Schur complement, the bilinear constraints are convexified.
   • Algorithm 1 solves this SDP exactly to find the optimal gain $K$.

2. Approximate Solution for Worst-Case Observability (Problem 2):

   • Minimizing the trace of the inverse Gramian is non-convex because the inverse becomes singular when the system is unobservable.
   • The authors introduce a regularization parameter $\epsilon$ to the Lyapunov equation to ensure $W$ remains positive definite.
   • They transform the problem into a Difference of Convex (DC) program.
   • Algorithm 2 uses a Sequential SDP approach based on the Convex-Concave Procedure (CCP). It iteratively linearizes the concave parts of the constraints to converge to a stationary point.

3. Key Contributions

• Continuous Observability Metrics: Moving beyond binary "observable/unobservable" classifications, the paper introduces continuous metrics based on the trace and inverse trace of the observability Gramian to quantify adversarial observability.
• Fundamental Trade-off Bounds: The derivation of theoretical lower bounds linking the degree of performance degradation ($\lambda$) to the achievable reduction in observability. This characterizes the fundamental limits of the trade-off.
• Convex Reformulations:
  • Proving that minimizing the average observability metric is equivalent to a convex SDP, allowing for exact global solutions.
  • Developing a sequential SDP algorithm to handle the non-convex inverse Gramian metric via regularization and convex-concave procedures.
• Robustness Certification: Demonstrating that controllers designed with knowledge of a superset of adversary sensors still guarantee reduced observability for the actual (unknown) sensor configuration.

4. Results

The proposed methods were validated through numerical simulations:

• Intuitive 2D Example:
  • The system was designed such that specific feedback could decouple states to hide them from the adversary.
  • Results: As $\lambda$ increased, the algorithm successfully forced the closed-loop matrix entries to decouple the states, significantly reducing observability while maintaining near-optimal performance. The empirical results matched the derived theoretical lower bounds.
• ADMIRE Aircraft Simulation:
  • A 5-state, 7-input aircraft model was used. The adversary could measure 3 specific states.
  • Algorithm 1 (Trace Minimization): Successfully reduced the average observability by targeting the larger eigenvalues of the Gramian. It increased estimation errors across all states with negligible performance loss.
  • Algorithm 2 (Inverse Trace Maximization): Successfully drove the minimum eigenvalue of the Gramian close to zero. This made the system nearly unobservable in specific directions (specifically the 4th state), causing the adversary's estimation error for that state to become unreliable, while keeping the overall system stable.
  • Performance: In both cases, the controllers achieved significant degradation in the adversary's ability to reconstruct the state (Luenberger observer errors increased) with only a small, controlled sacrifice in the LQR cost.

5. Significance

This work provides a rigorous framework for Moving Target Defense (MTD) without the need for discrete mode switching, which often introduces instability.

• Security vs. Performance: It quantifies the exact cost of security, allowing operators to tune the level of "stealth" based on how much performance degradation they can tolerate.
• Practical Applicability: By formulating the problem as SDPs, the approach is computationally tractable for real-world systems (demonstrated on an aircraft model).
• Adversarial Awareness: It shifts the paradigm from simply stabilizing a system to actively designing the system's evolution to confuse potential observers, a critical capability for autonomous systems in contested environments (e.g., military aviation, satellite operations).

In summary, the paper bridges the gap between optimal control theory and adversarial security, offering mathematically grounded tools to design controllers that are both high-performing and inherently difficult to observe.