Data Poisoning Attacks on Informativity for Observability: Invariance-Based Synthesis

1. Problem Statement

The paper addresses a critical vulnerability in data-driven control systems, specifically those relying on data informativity for system analysis (e.g., observability, controllability) and controller synthesis.

• Context: In data-driven control, system properties are verified directly from measured time-series data without identifying a specific parametric model. The "informativity" of data determines if the available data is sufficient to guarantee properties like strong observability (the ability to uniquely determine the initial state from output trajectories).
• The Threat: The authors consider an adversary who can perform data poisoning by applying an invertible linear transformation to the pre-training dataset.
• The Goal: The attacker aims to render the transformed data non-informative for strong observability. Specifically, the attacker wants to inject a non-zero state into the data-driven weakly unobservable subspace.
• Constraints:
  • The attack must be stealthy: The transformation must be nonsingular (invertible) so that the rank and persistency of excitation of the data are preserved, avoiding trivial detection.
  • The attack should be minimal: The paper seeks the "minimum-norm" attack, quantifying the smallest data distortion required to break the observability certificate.

2. Methodology and Theoretical Framework

A. Mathematical Formulation

The system is modeled as a Linear Time-Invariant (LTI) system with noise. The authors utilize an affine model set $\Sigma(\mathcal{D})$ derived from data matrices ($X_-, X_+, U_-, Y_-$).

• Strong Observability Condition: Data $\mathcal{D}$ is informative for strong observability if and only if the maximum weakly unobservable coefficient space $J^*(\mathcal{D})$ is a subset of the kernel of the state matrix $P(\mathcal{D})$ (i.e., $J^*(\mathcal{D}) \subseteq \ker P(\mathcal{D})$).
• Attack Mechanism: The attacker applies a block-diagonal linear map $\Phi_a$ to the data matrices. The goal is to find a transformation such that for the new data $\tilde{\mathcal{D}}$, there exists a non-zero vector $v \in J^*(\tilde{\mathcal{D}})$ where $P(\tilde{\mathcal{D}})v \neq 0$. This implies the existence of a non-zero initial state that produces zero output, violating strong observability.

B. Constructive Attack Design (Algorithm 1)

The authors propose a constructive method to design the attack matrix $\Phi_a$:

1. Target Selection: The attacker selects a target eigenpair $(\tilde{\lambda}, \tilde{x}_0)$ from a "malicious" model $(A_{mal}, B, C, D)$ that is weakly unobservable.
2. Trajectory Generation: Using the malicious model, the attacker defines target vectors for the transformed data ($\tilde{x}_0, \tilde{x}_1, \tilde{u}_0, \tilde{y}_0$) that satisfy the system dynamics of the malicious model.
3. Transformation Synthesis: The authors derive a rank-1 update formula for the transformation matrices $\Phi_Z$ (for each data block $Z$).
   • The transformation maps the original data trajectory in a specific direction $v$ to the malicious target trajectory.
   • Crucially, the transformation is designed to leave the original weakly unobservable coefficient space $J^*(\mathcal{D})$ invariant. This ensures that the data appears statistically similar to the original in most directions, enhancing stealthiness.
4. Feasibility Conditions: The paper establishes geometric and dimensional conditions (Proposition 1) under which such an invertible transformation exists. Specifically, the dimension of the output space generated by the original unobservable coefficients must be strictly less than the rank of the data matrix.

C. Minimum-Norm Attack Formulation

To quantify the vulnerability, the authors formulate an optimization problem to find the attack with the minimum Frobenius norm (smallest data distortion).

• Objective: Minimize $\|\Delta \mathcal{D}\|_F$, where $\Delta \mathcal{D}$ is the perturbation.
• Optimization: The problem is reduced to optimizing the eigenpair $(\tilde{\lambda}, v)$ and the transformation vector $\xi$.
• Key Insight: The objective function naturally incorporates the Hautus test matrix $(\lambda X_- - X_+ + BU_-)$. This links the attack directly to the distance of the system from the boundary of observability.
• Theorem 2: The minimum perturbation required is bounded by the distance of the affine model set to the set of unobservable systems ($d_{UNOBS}$). If the original data is already close to being uninformative, the required attack energy is near zero.

3. Key Contributions

1. Novel Attack Vector: The paper identifies a new class of attacks where an adversary uses invertible linear transformations to manipulate the invariant subspaces of data-driven models, rather than simply adding noise or deleting data.
2. Constructive Synthesis: It provides a step-by-step algorithm (Algorithm 1) to synthesize these attacks, proving that an attacker can embed a specific malicious mode into the data-driven weakly unobservable subspace while preserving the data's rank.
3. Vulnerability Metric: The authors derive a minimum-norm attack formulation. This serves as a quantitative metric for the robustness of data-driven certification. A small minimum-norm value indicates that the system's observability certificate is fragile and easily broken.
4. Theoretical Bounds: The paper establishes a theoretical lower bound on the attack energy, showing it is proportional to the system's inherent distance from unobservability.

4. Results and Numerical Examples

• Simulation Setup: The authors tested their method on a 5-state linear dynamical network with a line topology, where only the first two nodes are measured.
• Attack Success: The algorithm successfully generated an invertible transformation that made the data non-informative for strong observability.
• Stealthiness: The attack required a very small relative error ($\epsilon \approx 0.37\%$) in the data matrix $X_+$.
• Localization: The analysis revealed that the attack energy was highly localized. Approximately 96.4% of the perturbation was concentrated on the rows corresponding to nodes 2 and 3.
• Interpretation: This localization aligns with network topology: nodes closer to the measured outputs (fewer "hops") require less perturbation to break observability. This suggests that in networked control systems, nodes with short paths to sensors are critical vulnerabilities.

5. Significance and Implications

• Security of Data-Driven Control: The paper challenges the assumption that data-driven methods are inherently robust because they rely on "rich" data. It demonstrates that even rank-preserving, invertible transformations can completely invalidate safety and stability certificates.
• Defense Strategy: By providing a metric for the "distance to non-informativity," the paper offers a way to assess system vulnerability. It suggests that defense mechanisms must focus on protecting the specific data trajectories (and network nodes) that are most critical for maintaining observability.
• Future Directions: The authors note that while this work focuses on observability, the framework can be extended to controllability and stabilizability. Furthermore, developing detection methods for such structured, low-norm transformations is a crucial next step for resilient control systems.

In summary, this paper rigorously demonstrates that data informativity is not a static property but can be actively destroyed by sophisticated, low-energy adversaries, necessitating new robustness metrics and defense strategies for data-driven control systems.