How Sensor Attacks Transfer Across Lie Groups

1. Problem Statement

Sensor spoofing in Cyber-Physical Systems (CPS) is a critical threat. While the theoretical foundations for such attacks in linear state spaces (Euclidean geometry) are well-established, they rely on the assumption that additive sensor offsets transfer trivially across different operating conditions.

However, many safety-critical systems (e.g., autonomous vehicles, drones, robots) operate on non-Euclidean manifolds, specifically Lie groups (such as $SE(2)$, $SE(3)$, and $SO(3)$). In these spaces:

• Non-commutativity: Group operations do not commute. A sensor attack that is "stealthy" (undetectable) during straight-line motion may become detectable during complex maneuvers (e.g., turns) because the system's dynamics distort the attack vector.
• The Gap: Existing literature focuses on detectability in linear spaces or general nonlinear systems but fails to characterize the specific algebraic symmetries of Lie groups that govern whether an attack learned in one scenario can be successfully transferred to another.

Core Question: Under what algebraic conditions does a sensor attack, learned in a nominal operating condition, retain its dynamical impact and stealthiness when transferred to a different trajectory or state on a Lie group?

---

2. Methodology

The authors develop a unified geometric and algebraic framework based on Lie group theory to analyze attack transferability.

• System Modeling: The system is modeled on a Lie group $G$ with left-invariant dynamics. The state evolves as $\dot{x} = f(x, u)$, where the dynamics are invariant under left translation.
• Attack Modeling: Attacks are modeled as right translations (body-frame displacements) applied to sensor measurements. An attacker learns an observation action $\tilde{T}_a$ from a dataset and attempts to replay it on a victim system.
• Detection Framework: The system uses an Equivariant Observer (e.g., Invariant Extended Kalman Filter). This observer computes innovations based on invariant state errors, ensuring that detection logic respects the geometry of the manifold.
• Key Mathematical Tools:
  • Lie Bracket $[ \cdot, \cdot ]$: Used to determine commutativity between the system dynamics and the attack vector.
  • Adjoint Action $Ad_g$: Describes how tangent vectors (attack directions) transform under the flow of the system dynamics.
  • Invariant Subspace ($\Delta_{f_e}$): The kernel of the Lie bracket with the nominal dynamics, representing the set of attacks that commute with the system motion.

---

3. Key Contributions

A. Formalization of Attack Equivalence and Transferability

The paper defines transferability as the ability of an attack to induce the same dynamical impact and stealth profile across different trajectories. It establishes that in Lie groups, transferability is not automatic but is a strict geometric constraint.

B. Lie-Algebraic Characterization of Transferability

The authors prove that for an attack to be transferable, it must satisfy a Lie bracket condition:
$$[f_e, \xi] = 0$$
Where $f_e$ is the nominal dynamics generator and $\xi$ is the attack displacement.

• Result: Transferable attacks are confined to the invariant subspace $\Delta_{f_e} = \ker([f_e, \cdot])$.
• Implication: If an attack lies outside this subspace, the system's non-commutative dynamics will rotate/distort the attack vector, causing it to become detectable or altering its physical impact.

C. Decomposition Theorem for Imperfect Attacks

Recognizing that attackers cannot perfectly compute $\Delta_{f_e}$ due to noise and model uncertainty, the paper introduces a decomposition of the realized attack $\hat{\xi}$ into:

1. Ideal Component ($\xi$): Lies within $\Delta_{f_e}$ (transferable).
2. Residual Component ($\rho$): Lies outside $\Delta_{f_e}$ (non-transferable).

The theorem reveals a fundamental asymmetry in how these residuals affect the system:

• Dynamical Impact: The physical deviation is amplified by the Adjoint action ($Ad_{g_{k-1}}$) of the system flow. Large maneuvers can significantly amplify the physical error caused by the residual.
• Stealthiness: The detector innovation (stealth metric) is shielded by the equivariant observer structure. The residual's effect on the detector is linear and does not undergo the same kinematic amplification as the physical state.
• Conclusion: An attacker can make small errors in the "wrong" direction (violating the bracket condition) that cause massive physical deviations but remain within the detection threshold ($\tau$-stealthy).

D. Moving Target Defense via Subspace Collapse

The paper demonstrates that defenders can manipulate the system's operating conditions (e.g., changing velocity or turning) to collapse the dimension of the invariant subspace $\Delta_{f_e}$.

• Example: In a Dubins car, straight-line motion allows lateral attacks to be transferable. However, during a turn, the only transferable attacks are those strictly aligned with the trajectory. This forces attackers into a "detectable direction" if they attempt to spoof laterally.

---

4. Results and Numerical Validation

The theory is validated using a Dubins Unicycle model ($SE(2)$) with GPS and LIDAR sensors.

• Scenario: An attacker learns a lateral spoofing attack during straight-line motion (where $\Delta_{f_e}$ includes lateral directions).
• Transfer: The attacker attempts to replay this attack on a victim performing a curved trajectory.
• Findings:
  • Ideal Case: Attacks strictly along the trajectory (commuting with dynamics) transfer perfectly and remain stealthy.
  • Imperfect Case: When the attacker injects a lateral residual (non-commuting) during a turn:
    • The physical error is rotated and scaled by the Adjoint operator but remains bounded by $\epsilon \|Ad_{g}\|$.
    • The detector innovation remains small because the equivariant observer cancels the global frame rotation.
  • Simulation: Even with a lateral residual error ($\epsilon=0.44$) and large translational parameters, the realized deviation stayed within the theoretical bound and never breached the detection threshold ($\tau = 5.0$ m). This confirms that the "loophole" allows attackers to hijack estimators undetected even with imperfect knowledge.

---

5. Significance and Implications

• Theoretical Shift: Moves sensor attack analysis from linear assumptions to rigorous geometric constraints. It proves that non-commutativity is a double-edged sword: it can expose attacks, but it also creates specific invariant subspaces where attacks are "invisible" to geometry-aware detectors.
• Security Insight: The discovery of the structural asymmetry (physical amplification vs. stealth shielding) is critical. It suggests that defenders cannot rely solely on the magnitude of physical deviation to detect attacks; they must monitor the geometric consistency of the attack vector relative to the system's flow.
• Defense Strategy: The paper proposes Moving Target Defense strategies. By actively varying control inputs to minimize the dimension of $\Delta_{f_e}$ (e.g., forcing complex maneuvers), defenders can structurally eliminate the "safe" directions for attackers, forcing any spoofing attempt to violate the Lie bracket condition and become detectable.
• Practical Application: The framework provides a method to calculate the theoretical bounds of attack impact and stealth, allowing for the design of more robust equivariant observers and intrusion detection systems for autonomous vehicles and robotics.

In summary, the paper establishes that transferability on Lie groups is a kinematic constraint determined by the centralizer of the system's dynamics. It reveals that while complex maneuvers can distort attacks, they also create a geometric "blind spot" where imperfect attacks can cause significant physical harm while remaining mathematically undetectable by standard equivariant filters.