Technical Summary: TinyML-Driven Cybersecurity for Autonomous Spacecraft

1. Problem Statement

Autonomous spacecraft operate in contested radio-frequency (RF) environments where adversaries can disrupt, spoof, or manipulate Telemetry, Tracking, and Command (TT&C) links. The Space Attack Research and Tactic Analysis (SPARTA) framework categorizes these threats into specific tactics, including uplink jamming, signal spoofing, payload manipulation, ground-segment compromise, and unauthorized command injection.

While deep learning has been applied to RF signal classification, its computational cost renders it unsuitable for onboard spacecraft processors, which face strict constraints on latency, memory, and power. Conversely, lightweight "TinyML" models must operate within microsecond-to-millisecond inference budgets. This creates a fundamental tension: models with high expressive power (e.g., Random Forests, MLPs) often violate latency budgets, while lightweight linear models (e.g., Logistic Regression) satisfy real-time constraints but may lack the robustness to detect subtle, non-linear attacks.

The paper addresses the need to evaluate the latency–accuracy trade-offs of classical, TinyML-compatible models specifically for detecting SPARTA-aligned cyber-RF threats in an onboard autonomy context.

2. Methodology

A. Physics-Informed System Model

The authors establish a unified baseband signal model to simulate SPARTA threats. The received signal $r(t)$ is modeled as:
$$r(t) = h(t) * s(t) + a(t) + n(t)$$
Where $s(t)$ is the legitimate uplink, $h(t)$ is the channel impulse response, $n(t)$ is thermal noise, and $a(t)$ represents the adversarial perturbation specific to the threat mode.

B. Threat Injection and Dataset Generation

The study generates adversarial RF spectrograms based on six classes (one benign, five threats):

1. Benign: Nominal operation ($a(t)=0$).
2. Uplink Jamming: Modeled as high-power noise ($a_{jam}(t)$), causing broadband masking or sub-band erasure.
3. Fake-NR / Spoofing: Injection of counterfeit NR-like control structures ($a_{fakeNR}(t)$), creating structured spectral stripes.
4. Payload Manipulation: Minimal RF energy alteration ($a_{payload}(t) \approx 0$), relying on subtle metadata or timing deviations.
5. Ground-Segment Compromise: Valid waveforms with abnormal timing offsets ($a_{rogue}(t)$).
6. Unauthorized Command Injection: Valid modulation with semantic/dangerous content ($a_{inj}(t)$).

The dataset is constructed by computing Short-Time Fourier Transforms (STFT) to generate spectrograms, which are then sliced into fixed-size patches for classification. Corruption modes such as BandErasure, FakeNR, and NoiseBurst are used to simulate these threats.

C. Models Evaluated

Four classical machine learning models, compatible with TinyML constraints, are analyzed:

• Logistic Regression (LR): Linear decision boundary, probabilistic output.
• Linear Support Vector Machine (SVM): Linear boundary maximizing geometric margin.
• Random Forest (RF): Ensemble of decision trees modeling non-linear boundaries.
• Multi-Layer Perceptron (MLP): One-hidden-layer network with non-linear activation.

D. Analysis Framework

The evaluation combines:

1. Theoretical Analysis: Derivation of computational complexity (MAC operations), VC dimension, Lipschitz continuity, and decision-boundary geometry.
2. Empirical Evaluation: Measurement of inference latency, accuracy, and class-wise F1-scores on the generated spectrogram dataset.

3. Key Contributions

The paper claims the following specific contributions:

• Physics-Informed RF System Model: A unified model capturing the mathematical manifestation of five SPARTA threat modes in baseband signals and spectrograms.
• Rigorous Mathematical Analysis: New theoretical results regarding the computational complexity, VC dimension, and Lipschitz continuity of TinyML models, providing a principled understanding of their latency–accuracy trade-offs.
• Comprehensive Empirical Benchmarking: A systematic evaluation of LR, SVM, RF, and MLP across the SPARTA threat spectrum using adversarial spectrograms.
• Identification of Structural Limitations: The discovery that classical TinyML models exhibit a fundamental weakness in detecting payload manipulation due to low separability in the RF domain.
• Design Guidelines: Concrete recommendations for onboard spacecraft cybersecurity architectures based on the observed trade-offs.

4. Results

A. Latency vs. Accuracy Trade-offs

• Logistic Regression (LR): Achieves microsecond-level inference with the lowest computational complexity ($O(d)$). It incurs only a 1% accuracy drop relative to Random Forests, making it the most effective baseline for real-time onboard autonomy where latency is critical.
• Random Forest (RF): Delivers the highest accuracy by capturing non-linear distortions (e.g., rogue ground station timing anomalies). However, its inference cost scales as $O(K \cdot d_t)$, often violating strict TinyML latency budgets.
• SVM and MLP: SVMs offer improved robustness to structured interference (like Fake-NR) via margin maximization but share linear limitations. MLPs can model complex patterns but require aggressive quantization or pruning to meet latency constraints.

B. Threat-Specific Performance

• Easy/Moderate Detection: Uplink Jamming and Fake-NR Spoofing are relatively easy to detect due to high-energy or structured spectral artifacts.
• Hard Detection: Payload Manipulation, Ground-Segment Compromise, and Command Injection are significantly harder. Specifically, Payload Manipulation shows the lowest separability because it induces minimal RF energy distortion, relying on subtle statistical deviations that classical linear and shallow models struggle to distinguish.

5. Significance and Claims

The paper positions itself as the first work to provide a physics-informed theoretical and empirical analysis of TinyML models specifically for SPARTA RF and cyber threat detection.

• Practical Impact: The study concludes that Logistic Regression offers the optimal balance for onboard spacecraft cybersecurity, providing microsecond inference with negligible accuracy loss compared to more complex models.
• Theoretical Insight: It highlights that while complex models (RF, MLP) offer higher theoretical capacity, their computational overhead makes them less viable for strict real-time autonomy compared to linear models for many threat classes.
• Future Direction: The authors identify a critical gap in detecting payload manipulation, suggesting that future advancements in spacecraft cybersecurity must focus on richer feature encoders and multi-timescale learning architectures rather than simply scaling model complexity.

The authors maintain a modest tone regarding the limitations of current classical models, explicitly noting that all evaluated models exhibit persistent weaknesses in detecting payload manipulation, thereby framing the results as a baseline for future research in edge intelligence and trustworthy AI for space systems.