Active Bayesian Inference for Robust Control under Sensor False Data Injection Attacks
arXiv:2604.11410v1 [cs.LG] 13 Apr 2026
Axel Andersson and György Dán Abstract— We present a framework for bridging the gap between sensor attack detection and recovery in cyber-physical systems. The proposed framework models modern-day, complex perception pipelines as bipartite graphs, which combined with anomaly detector alerts defines a Bayesian network for inferring compromised sensors. An active probing strategy exploits system nonlinearities to maximize distinguishability between attack hypotheses, while compromised sensors are selectively disabled to maintain reliable state estimation. We propose a threshold-based probing strategy and show its effectiveness via a simplified partially observable Markov decision process (POMDP) formulation. Experiments on an inverted pendulum under single and multi-sensor attacks show that our method significantly outperforms outlier-robust and prediction-based baselines, especially under prolonged attacks.
I. INTRODUCTION Cyber-Physical Systems (CPSs) integrate sensing, communication and physical processes, exposing attack surfaces in both the cyber and the physical domains. Sensor attacks, such as GPS spoofing [1], acoustic noise injection in gyroscopes [2] and electromagnetic interference on magnetometers [3], pose a serious threat to safety-critical CPSs such as unmanned aerial vehicles and autonomous cars. While progress has been made on detecting such attacks [4], [5], detection alone is insufficient. If the control system cannot appropriately respond to detections, the system remains vulnerable. Existing approaches to attack recovery typically fall into two categories. The first is switching to a separate, predesigned robust controller upon detection [6], [7], which can be overly conservative and might not generalize well to new attack scenarios. The second relies on outlier-robust state estimation [8] which scales the influence of suspicious measurements but does not explicitly identify compromised sensors. None of these approaches leverage the structural relationship between sensors and state estimates to isolate the attack. Furthermore, existing works overlook the complexity of modern state estimation pipelines that fuse heterogeneous sensors with different modalities and sampling rates, as exemplified by open-source flight controllers such as PX4 [9]. In this work, we propose a framework that bridges the gap between attack detection and recovery by maintaining a belief over sensor attack states to selectively disable compromised sensors to preserve accurate state estimation. A key observation is that modern CPSs rely on multiple This work was partially supported by the Wallenberg AI, Autonomous Systems and Software Program (WASP) funded by the Knut and Alice Wallenberg Foundation. Authors are with the Department of Network and Systems Engineering, School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Sweden {axander|gyuri}@kth.se
sensors of different modalities, whose measurements are fused through a perception pipeline. We model this pipeline as a bipartite graph that maps sensors to the components of the state estimate they influence. Combined with alerts from an existing anomaly detector, this graph structure defines a Bayesian network that enables inference over which sensors are compromised. Beyond the passive inference framework, we introduce an active probing strategy. By exploiting the non-linearity of the system dynamics, we design a probing control input that maximizes the distinguishability between state estimates obtained under different sensor configurations. We provide theoretical justification for the probing strategy by analyzing a simplified Partially Observable Markov Decision Process (POMDP) in which an agent must choose between a cheap and less accurate sensor and an expensive, more accurate one. We show that, under a Blackwell-dominance condition a probing policy based on a threshold structure in the belief state is a sensible choice. The system should probe when uncertainty about a sensor’s integrity is high. Our approach differs from dual control in stochastic systems [10], which seeks to simultaneously regulate the system while reducing parameter uncertainty. In contrast, we focus on identifying compromised sensors in adversarial settings. Additionally, the proposed framework incorporates a detailed model of the sensor processing pipeline. Our approach is related to active fault isolation for leakage localization in water distribution networks [11], but our approach differs in that we operate within a Bayesian belief framework over attack states, integrate the probing decision with a nominal tracking controller, and provide a theoretical analysis of when probing is optimal. The contributions of this paper are: • Perception graph model. We model the perception pipeline as a bipartite graph relating sensors to state estimate components, enabling Bayesian inference over sensor attack states based anomaly detector alerts. • Detection-to-recovery framework. We propose the LASE-AD algorithm, which maintains a belief over sensor attack states and selectively disables compromised sensors to preserve accurate state estimation, bridging the gap between attack detection and recovery. • Active probing for improved detection. We design an information-seeking control input that exploits system non-linearity to increase the distinguishability between competing attack hypotheses. We further provide theoretical justification for a threshold-based probing policy on the belief state.
The rest of the paper is organized as follows. Section II introduces the system model, attack model and problem formulation. Section III presents the Bayesian inference framework for interpreting anomaly detector alerts. Section IV introduces the active learning strategy for attack detection and a simplified POMDP model motivating a thresholdbased probing policy. Section V presents an evaluation on an inverted pendulum and Section VI concludes the paper. II. SYSTEM MODEL AND PROBLEM FORMULATION A. System Model We consider a general, non-linear system of the form xk+1 = f (xk ) + g(xk )uk + wk
(1)
where xk ∈ X ⊆ Rnx is the state, uk ∈ U ⊆ Rnu is the control input, and wk ∼ N (0, Q) is Gaussian process noise. A set of sensors is available, denoted by Z = {z1 , ..., zm }. Each sensor is associated with a measurement function, and we denote the set of measurement functions by H = {h1 , ..., hm }, where each measurement function maps the state to a sensor-specific observation space, hi : Rnx → Rpi . For example, hi may represent the mapping that produces an RGB-image from a camera mounted on a UAV. Sensor measurements are noisy; the raw measurement generated by sensor i at time step k is r yi,k = hi (xk ) + vi,k ,
vi,k ∼ N (0, Ri ),
(2)
where vi,k is the measurement noise and Ri is the noise covariance matrix of sensor zi . The collection of raw measurer r ments from all sensors is denoted by ykr = (y1,k , ..., ym,k )∈ Yr . We assume the existence of a perception pipeline P that r r processes the raw sensor measurements (y1,k , ..., ym,k ) and produces a preprocessed measurement, referred to as a soft r r measurement, yk = P(y1,k , ..., y1,k ) ∈ Y ⊆ Rnx . The relationship between the soft measurement and the system state is modeled as yk = Cxk + ϵk
(3)
where C is assumed invertible and ϵk represents the modeling error of P. The data flow in P is represented by a bipartite graph G = (Z ∪ Vy , E), where Vy is the set corresponding to the components of the soft measurement yk . An edge (zi , vj ) ∈ E exists if sensor zi contributes to the estimation of component j of yk . B. Attack Model We consider a powerful attacker that can alter the raw sensor measurement of any sensor, resulting in measurement a r yi,k = yi,k + bi,k
(4)
where bi,k is an attack vector of appropriate size. The attacker can alter the measurements of multiple sensors simultaneously, the collection of attack vectors will be denoted by bk =
{bi,k }m i=1 . We assume that the attacker cannot manipulate the control input uk or modify the system’s source code to disable the anomaly detection mechanism or the proposed framework. C. State Estimation and Anomaly Detector Different soft measurements can be constructed by selectively disabling sensors. Let PS denote a perception pipeline in which only the sensors in S ⊆ Z are enabled. For each S ∈ 2Z , the corresponding pipeline produces soft measurements ykS satisfying an equation on the form of (3). The pipeline that uses all sensors is denoted simply by P. State estimation is done with an extended Kalman filter (EKF) that is updated updated with the soft measurements, yk . An EKF-based anomaly detection algorithm D, such as that proposed in [5], is assumed to detect deviations in yk by comparing it to the filter output. The detector is modeled as a mapping D : Y × U → A = {0, 1}nx , which produces element-wise alerts for the soft measurement, ak = (a1,k , . . . , anx ,k ), where ai,k indicates an alert for component i of yk . let zi,k ∈ {0, 1} denote whether sensor zi is under attack at time k (i.e., bi,k ̸= 0 in eq. (4)). Similarly, let sj,k ∈ {0, 1} denote whether component j of yk is compromised at time k. We assume a conservative causal attack propagation model, sj,k = max zi,k i∈N (j)
(5)
where N (j) = {i : (i, j) ∈ E} denotes the set of neighbors to vertex j. That is, if any of the sensors that contribute to the estimation of component j is attacked, then the corresponding component is considered compromised. We model the alert generation process for each component as a two-state Markov process conditioned on the attack variable si,k . The anomaly detector D is assumed to satisfy the following transition probabilities: P(ai,k = 1|ai,k−1 = 0, si,k = 0) = ηi,0
(6a)
P(ai,k = 1|ai,k−1 = 1, si,k = 0) = ηi,1
(6b)
P(ai,k = 0|ai,k−1 = 0, si,k = 1) = ξi,0
(6c)
P(ai,k = 0|ai,k−1 = 1, si,k = 1) = ξi,1 .
(6d)
Equations (6a, 6b) characterize false alarm probabilities and (6c, 6d) the missed detection probabilities. The dependence on the previous alert ai,k−1 captures temporal correlations in detector outputs, which arise naturally in sequential detection methods such as CUSUM [12]. The false alarm probabilities ηi,0 and ηi,1 are assumed to be known, as they can be estimated by evaluating D on benign data. The missed detection probabilities are harder to estimate in lack of representative attack data. We therefore treat ξi,0 and ξi,1 as unknown, but 1 2 we assume a Beta distributed prior, ξi,· ∼ Beta(βi,· , βi,· ). The resulting model can be interpreted as a graphical model where the latent attack variable si,k influences the alert variable ai,k , while temporal correlation is captured through the Markovian dependence on ai,k−1 .
D. Problem Formulation We consider a control system described by (1), equipped with a set of sensors Z, a family of perception pipelines {PS : S ∈ 2Z } and an anomaly detection algorithm D. Our objective is to enable recovery from sensor attacks. We formulate this as a reference tracking problem in which a policy κ : A × Yr → 2Z maps alerts and raw measurements to a subset of trusted sensors. At each time step k, the policy κ selects a set of trustworthy sensors Sk and the corresponding perception pipeline PSk is used to construct the soft measurement. We want to solve the following problem: ∞ hX i ⊤ minE γ k (x⊤ M x + u M u ) (7a) x k u k k k κ
s.t
k=0
xk+1 = f (xk ) + g(xk )uk + wk
(7b)
E(xk ) ∈ Xsafe
(7c)
uk ∈ U
(7d)
∀k ∈ N,
where Mx ∈ Rnx ×nx , Mu ∈ Rnu ×nu and γ ∈ (0, 1) is the discount factor. Constraint (7c) ensures system safety in expectation and (7d) models hardware limitations by forcing the control input to belong to a bounded set, U. The reference signal should be tracked accurately, even in the event of a sensor attack of the form (4). We propose to address the problem in a Bayesian dual control framework: we maintain a belief over sensor attack states, and use an active learning strategy that excites the system to generate informative observations for belief refinement whenever beneficial. While (7) can be formulated as a partially observable Markov decision process (POMDP), solving it exactly is computationally intractable for realtime implementation. Our approach instead uses tractable approximations to retain the key benefits of dual control without the complexity of solving the full POMDP. III. BAYESIAN I NFERENCE FOR S ENSOR ATTACK I DENTIFICATION To address (7), we first establish a relationship between alerts generated by the anomaly detection system and the attack status of each sensor. Let πi,k := P(zi,k = 1) denote the prior belief that sensor zi is under attack at time k. For tractability, we assume that the attack status variables at a given time are independent, i.e., the joint probability of an attack zk = (z1,k , ..., zm,k ) factorizes as P(zk = z ′ ) =
m Y
z′
′
i πi,k (1 − πi,k )(1−zi ) .
(8)
i=1
The independence assumption is reasonable as a powerful attacker could target any sensor. Upon receiving a set of x alerts from the anomaly detector D, ak = {ai,k }ni=1 , the posterior belief πi,k (ak ) := P(zi,k = 1|ak , ak−1 ) can be computed by combining the causal relationship between sensor states and soft measurements in (5), with the detector performance characterized in (6a-6d). Note that (5) and (6a6d) together with the internal structure of P captured by
Fig. 1. Bayesian network of sensor attack status variables (zk ), state attack status variables (sk ), and alerts (ak , ak−1 ) for the cart-pole problem with a wheel encoder, a camera, and an IMU as sensors (c.f. Section V).
the graph G, define a Bayesian network (BN). An example of such a BN is shown in Fig. (1). The posterior πi,k (ak ) can be obtained from probabilistic inference on the Bayesian network, πi,k (ak ) := P(zi,k |ak , ak−1 ) = (9) πi,k P(ak |zi,k = 1, ak−1 ) , πi,k P(ak |zi,k = 1, ak−1 ) + (1 − πi,k )P(ak |zi,k = 0, ak−1 ) (10) where P(ak |zi,k = z ′ , ak−1 ) = X P(z−i,k )P(ak |zi,k = z ′ , z−i,k , ak−1 ), z−i,k ∈{0,1}m
and P(z−i,k ) is given by an expression similar to (8) but without the i:th component. Furthermore, from the Bayesian network we have P(ak |zk , ak−1 ) = P(ak = a|sk = s, ak−1 = a′ )P(sk = s|zk = z) = X 1[si =maxj∈N (i) zj ∀i∈{1,...,nx }] · s ( a nx Y ηi,ai ′ (1 − ηi,a′i )1−ai , R 1 i 1−ai 1 2 ξ (1 − ξi,a′i )ai Beta(βi,a ′ , βi,a′ )dξ, 0 i,a′i i=1
si,k = 1 si,k = 0 (11)
At every time step k the belief πk is computed based on alerts ak from the anomaly detector, using the posterior πi,k−1 as the prior to πi,k . IV. LEARNING-AUGMENTED STATE ESTIMATION FOR SENSOR ATTACK DETECTION Next, we design an active learning scheme that excites the system to accelerate the identification of attacked sensors. A. Information-Optimal Control Eqns. (8)-(11) allow us to estimate sensor attack probabilities πi,k based on alerts ak from the anomaly detector D. A complementary approach is to actively probe for attacks through the control input uk . In particular, consider two hypotheses, h0 and h1 , corresponding to different sensor
attack assumptions, resulting in state estimates x̂hk 0 and x̂kh1 obtained using two perception pipelines. The predicted system output and consequently the innovation of the EKF follows a different distribution under each hypothesis. The innovation at time k + 1 is given by rk+1 = yk+1 − C x̂k+1:k ,
(12)
where x̂k+1:k is the EKF state prediction at time k about the state at time k + 1. We design the probing control input to maximize the Kullback–Leibler (KL) divergence between the innovation distributions under the two hypotheses. Specifically, we consider KL(p(rk+1 |h0 )||p(rk+1 |h1 )), which measures the expected log-likelihood ratio under the null-hypothesis h0 . Maximizing this quantity makes the innovations as informative as possible for discriminating between the hypotheses. This connects directly to sequential hypothesis testing: a larger KL divergence implies faster accumulation of evidence, and thus quicker detection [12]. Since rk+1 is Gaussian under both h0 and h1 , the KL divergence admits a closed-form expression KL(p(rk+1 |h0 )||p(rk+1 |h1 )) = i 1 h h1 h0 h1 h0 ||rk+1 − rk+1 ||2(P h1 )−1 + c(Pk+1:k , Pk+1:k ) and 2 k+1:k (13) h1 h0 rk+1 − rk+1 = Fkh0 ,h1 + Ghk 0 ,h1 uk ,
(14)
The matrices are given by Fkh0 ,h1 = C(f (x̂hk 0 )−f (x̂hk 1 )) and Ghk 0 ,h1 = C(g(x̂hk 0 )−g(x̂hk 1 )). Note that if Ghk 0 ,h1 were not a function of xk , the control input uk would not have any influence on the innovation difference as Ghk 0 ,h1 = 0. ||·||P is the h1 h0 Mahalanobis norm with matrix P and c(Pk+1:k , Pk+1:k )= h1 h0 h1 −1 h0 tr((Pk+1:k ) Pk+1:k ) − ln |Pk+1:k |/|Pk+1:k | − nx ≈ 0 if the covariance matrices are similar. We thus solve the following optimization problem to obtain the probing control signal maxKL(p(rk+1 |h0 )||p(rk+1 |h1 ))
(15a)
f (x̂hk 0 ) + g(x̂hk 0 )uk ∈ Xsafe
(15b)
uk
s.t
f (x̂hk 1 ) + g(x̂hk 1 )uk ∈ Xsafe
(15c)
uk ∈ U.
(15d)
Problem (15) finds the control input that maximizes the KL divergence between the innovation distributions under the two hypotheses, while enforcing that the system remains within the safe set under both hypotheses when the input is applied. In practice, we assume the innovation covariance matrices are similar, in which case the KL divergence reduces to the Mahalanobis distance between the predicted innovation means. The null-hypothesis uses the nominal pipeline P, while probing sensor zi corresponds to the pipeline PZ\{zi } . A FIFO-buffer of length Tr stores past estimates and measureZ\{z } ments, allowing x̂k i to be reconstructed by re-running an EKF from x̂k−Tr under PZ\{zi } . We denote the state estimate produced this way using perception pipeline PS by x̂Sk .
The effect of applying the probing control input obtained from solving (15) can be exploited at the next time step to update the attack belief for sensor zi , using the likelihood ratio 1 1 , ≈ πi,k ← 1−πi,k P(yk |zi,k =0) 1−πi,k N (yk ;µh1 ,Σh1 ) 1 + πi,k P(yk |zi,k =1) 1 + πi,k N (yk ;µh ,Σh ) 0 0 (16) where (µh0 , Σh0 ) = (C x̂k:k−1 , C ⊤ Pk:k−1 C + R) and Z\{z } Z\{z } (µh1 , Σh1 ) = (C x̂k:k−1i , C ⊤ Pk:k−1i C + RZ\{zi } ). Here, the P -matrices denote EKF covariance matrices and R are the measurement noise covariance matrices. If sensor zi is not attacked, the likelihood-ratio in (16) should be close to one. However, if zi has been attacked for some time, the nominal state estimate x̂ may become contaminated, while x̂Z\{zi } remains unaffected. In this case, the likelihood ratio is small, leading to an increase of the attack belief. B. Inference-aware Control Scheduling Using the probing control input introduces a trade-off: while the objective in (7) is to minimize the control error, the nominal controller is designed to achieve this objective in the absence of attacks. Applying a probing input may temporarily deviate the system from its reference trajectory, but it can accelerate the identification of compromised sensors and improve state estimation, potentially outweighing the short-term performance degradation. Instead of reformulating problem (7) as a POMDP, we propose a threshold policy: probe sensor zi if πi,k ∈ (π, π) and use the nominal controller otherwise. This policy captures the intuition that probing is most informative when the uncertainty about a sensor’s integrity is highest. The pseudocode of the proposed Learning-Augmented State Estimation for Attack Detection (LASE-AD) algorithm is shown in Algorithm 1. In what follows, we justify the threshold policy via a simplified POMDP, where a binary Markov chain zk (analogous to sensor attack state zi,k ) is observed through either a cheap, less accurate sensor (nominal control input) or an expensive, more accurate one (active probing). The objective is to minimize misclassification cost plus sensor usage cost, serving as a surrogate to (7). We show that the optimal policy probes whenever a threshold policy does, establishing it as a conservative approximation. 1) Simplified POMDP Model of Active Sensing: Let {zk }k=0,1,2... be a time-homogeneous Markov chain on the binary state space Z = {0, 1} with transition matrix a00 a01 A= , aij = P(zk+1 = j|zk = i), (17) a10 a11 such that ai1 = 1 − ai0 for i = 0, 1. Furthermore, we have that a00 , a11 ∈ (0, 1) so that the Markov chain is ergodic. The state variables zk are not directly observable. At each time step k, an agent can select either a Cheap or an Expensive sensor sk ∈ {C, E} and receives a binary observation ok ∈ {0, 1}. The observation likelihoods are
parametrized by their false positive rate αs and true positive (detection) rate τs = 1 − βs , P(ok = 1|zk = 0, sk = s) = αs
(18a)
P(ok = 1|zk = 1, sk = s) = τs
(18b)
sufficient statistic for the entire history of observations and actions (see e.g Thm 7.6.1 in [15]). The instantaneous cost of using sensor s given belief π is the expected classification loss after the Bayesian update plus the sensor usage cost, i.e., C(π, s) = λ1{s=E} + Ls (π),
We make the following assumption on the sensors. Assumption IV.1. (Sensor ordering) Sensor E is strictly more informative than Sensor C in the sense that αE < αC
and
Ls (π) = p+ s min[Us (π, 1), 1 − Us (π, 1)]+ p− s min[Us (π, 0), 1 − Us (π, 0)]
Lemma IV.2. Assumption IV.1 is equivalent to Sensor C being a garbling of Sensor E. That is, there exists a stochastic matrix G such that OC = OE G, where Os is the observation matrix of sensor s with entries (Os )ij = P(ok = i|zk = j, sk = s). □
Proof. See Theorem 12.4.2 in [13].
Let πk := P(zk = 1|ok , sk , ..., o0 , s0 ) denote the posterior probability that the hidden state zk = 1, given all observations and sensor choices up until time k. The belief update can be done in two steps, using a Prediction step followed by an Update step (see e.g., [14]). Prediction Step. Given the posterior πk−1 from the previous step, the prediction belief before the observation is obtained at time k is πk− = T (πk−1 ) := a01 (1 − πk−1 ) + a11 πk−1 .
(19)
Note that T : [0, 1] → [0, 1] is an affine map, T (π) = a01 + (a11 − a01 )π. Update Step. After choosing sensor sk = s and observing ok = o, the posterior is − − τs π k − if o = 1 s (1−πk ) πk = Us (πk− , o) := τs πk +α(1−τ − s )πk if o = 0. − − (1−τs )πk +(1−αs )(1−πk ) (20) After obtaining the posterior πk , the agent declares a classification ẑk ∈ {0, 1}. Under a symmetric 0-1 loss, the optimal classifier is the maximum a posteriori (MAP) rule: ẑk = 1{πk ≥ 21 }
(21)
and the expected, instantaneous misclassification cost is c(πk ) = min(πk , 1 − πk )
(22)
We consider an infinite-horizon setting with discount factor γ ∈ (0, 1). Using the expensive sensor incurs an additive cost λ > 0 per use. The agent wants to minimize ∞ i hX J(π0 : µ) = Eµ γ k c(πk ) + λ1{sk =E} π0− = π0 , k=0
where
τE > τC
and both sensors are non-trivial: αs < τs for s ∈ {C, E}.
(23) where µ : [0, 1] → {C, E} is the sensor selection policy. The problem is a discounted infinite-horizon POMDP, thus the optimal policy is belief stationary, i.e., the belief, πk is a
(24)
(25)
is the expected posterior classification error, and p+ s = τs π + αs (1 − π) and p− s = (1 − τs )π + (1 − αs )(1 − π) are the observation probabilities. We use the instantaneous cost for defining a myopic policy. Definition 1 (Myopic policy). Let A(π) := LC (π) − LE (π) be the myopic advantage function, and Πs = {π : A(π) > λ} the expensive sensor region. The myopic policy selects the sensor minimizing the instantaneous cost, ( E π ∈ Πs (26) µm (π) = C otherwise. Note that, by definition, the expected (immediate) benefit of using the expensive sensor exceeds the immediate sensor cost whenever π ∈ Πs . Lemma IV.3. The expected posterior classification error, (0) Ls (π) is piecewise linear and has two breakpoints πs (0) (1) (1) and πs . The breakpoints satisfy πs < 1/2 < πs and consequently, the derivative of Ls (π) is (1) on (0, πs ) +1 dLs (0) (1) (27) = 1 − α s − τs on (πs , πs ) dπ (0) −1 on (πs , 1). Proof. We can use the definition of the posterior update map (20) and the observation probabilities to rewrite the expected posterior classification loss (25) and obtain Ls (π) = min[πτs , (1 − π)αs ]+ min[π(1 − τs ), (1 − π)(1 − αs )].
(28)
Observe that Ls (π) is piecewise linear in π and has two breakpoints, αs πτs = (1 − π)αs =⇒ π = =: πs(1) (29) τs + αs π(1 − τs ) = (1 − π)(1 − αs ) =⇒ 1 − αs π= =: πs(0) . (30) 2 − α s − τs Furthermore, by Assumption IV.1 we have that αs < τs , (1) (0) which means πs < 1/2 < πs . Taking the derivative on (0) (1) the intervals defined by πs and πs results in (27). □ In addition, by Assumption IV.1 we have that αE < αC and τE > τC , and hence the breakpoints are ordered as (1)
(1)
(0)
(0)
πE < πC < 1/2 < πC < πE .
(31)
(1)
(1)
(1)
To see that πE < πC , note that πs is decreasing in τs /αs (0) and Assumption IV.1 gives τE /αE > τC /αC . Similarly, πs is decreasing in (1 − τs )/(1 − αs ) and (1 − τE )/(1 − αE ) < (1 − τC )/(1 − αC ). We thus have the following. Theorem IV.4. (Threshold structure of Myopic policy). Under Assumption IV.1, the myopic advantage function A(π) is concave on [0, 1]. Consequently, the expensive sensor region Πs is either empty (if maxπ A(π) ≤ λ) or a single open interval (π λ , π λ ) ⊂ (0, 1). Proof. Using Lemma IV.3, we can conclude the myopic advantage function A(π) is piecewise linear with breakpoints (1) (1) (0) (0) at {πE , πC , πC , πE }. Using the ordering (31) and the slopes (27) we can determine the slope of A in all five (1) intervals. In the first interval π ∈ (0, πE ), both sensors ′ are in their left-most regime, so A = 1 − 1 = 0. In the (1) (1) second interval π ∈ (πE , πC ), Sensor E has passed its first breakpoint and is now in the middle regime with slope 1−αE −τE . Sensor C is still in its left-most region with slope +1. So A′ = 1 − (1 − αE − τE ) = αE + τE > 0. In the third (1) (0) interval π ∈ (πC , πC ), both sensors are now in the middle regime. This means A′ = 1 − αC − τC − (1 − αE − τE ) = (αE +τE )−(αC +τC ) which can be either positive, negative or zero. However, it satisfies A′ ≤ αE +τE (slope at Interval (0) (0) 2) since αC + τC > 0. In the fourth interval π ∈ (πC , πE ), Sensor C passed its second breakpoint and now has a slope of −1 while Sensor E is in its middle regime. This means A′ = −1 − (1 − αE − τE ) = αE + τE − 2 < 0. This satisfies A′ < (αE + τE ) − (αC + τC ) since (αC + τC ) < 2. In the (0) final interval (πE , 1), both sensors are in their right-most regime where the slope if Ls is −1, so A′ = −1−(−1) = 0. In summary the derivative of A(π) is (1) 0 on (0, πE ) (1) (1) αE + τE on (πE , πC ) (1) (0) A′ (π) = (αE + τE ) − (αC + τC ) on (πC , πC ) (0) 0) (αE + τE ) − 2 on (πC , πE ) (0) 0 on (πE , 1), (32) where the three interior intervals form a non-increasing sequence. A is strictly increasing on Interval 2 and strictly decreasing on interval 4. Furthermore, from the definition of Ls in (25) it follows that Ls (0) = Ls (1) = 0 for s ∈ (1) (0) {C, E}, which means A(π) = 0 on π ∈ [0, πE ) ∪ (πE , 1]. Consequently, A(π) is concave which implies that the superlevel set {A > λ} is convex, i.e., it is an interval. □ We can now state the following result. Theorem IV.5. Consider the POMDP in (23) with two actions corresponding to sensors E and C, where 1) The instantaneous cost C(π, s) is concave in π for each s. 2) Sensor E Blackwell-dominates Sensor C: There exists a stochastic matrix G such that OC = OE G (see Lemma IV.2).
Algorithm 1 LASE-AD in the Control Loop 1: S0 ← Z ▷ The set of trustworthy sensors 2: B ← FIFO(max len=Tr ) 3: while True do 4: ykr ← GetRawSensorValues() 5: yk ← PSk (ykr ) 6: x̂k:k−1 ← EKFPredict(x̂k−1 , uk−1 ) 7: ak ← D(yk , uk−1 ) 8: Update belief πk from (10) with ak ▷ Returns a 9: use probing, z ← DecideProbing(πk ) boolean and a sensor to probe 10: if use probing then 11: x̂Sk \{z} ← ReEstimateWithoutSensors(B, {z}) 12: Obtain uk by solving (15) 13: end if 14: if probing used last time then 15: Update belief πk with (16) and x̂Sk \{z} as alternative hypothesis 16: end if 17: Sk+1 ← DecideTrustableSensors(πk ) 18: if Sk ̸= Sk+1 then 19: x̂k ← ReEstimateWithoutSensors(B, Z \ Sk−1 ) 20: else 21: x̂k ← EKFUpdate(x̂k:k−1 , yk ) 22: end if 23: B.add((x̂k , yk )) 24: if !use probing then uk ← NominalController(x̂k ) 25: end if 26: Execute uk and let system (1) evolve. 27: probing used last time ← use probing 28: k ←k+1 29: end while
3) The transition probabilities of the hidden state are action-independent (the sensor choice does not affect how zk evolves). Let Πs = {π : C(π, E) < C(π, C)} be the set of beliefs where the expensive sensor has lower instantaneous cost. Then the optimal policy, µ∗ (π) which minimizes (23) satisfies µ∗ (π) = E for all π ∈ Πs . Proof. Condition 1 is satisfied since C(π, s) is a sum of a constant and Ls (π) which is defined as the minimum of affine functions (28) which is concave in π. Condition 2 is satisfied by Lemma IV.2 and Condition 3 is satisfied by construction. See Thm 14.7.1 in [15] for more details. □ This means that whenever the myopic policy chooses the expensive sensor, so does the optimal policy. The myopic policy may, however, be using the expensive sensor less frequently than the optimal policy. V. N UMERICAL R ESULTS A. Evaluation methodology We use an extended version of the CartPole environment for the evaluation [16], where the goal is to balance a
pole on a cart. The state xk = [pk , vk , θk , ωk ]⊤ contains cart position/velocity and pole angle/angular velocity [17], discretized via the RK4 method. The control input, uk ∈ [−10, 10] is a horizontal force applied to the cart. The system is equipped with |Z| = 3 sensors: a wheel encoder, an external camera and an IMU. The wheel encoder (E) outputs raw measurements of the position and velocity of r the cart, yE,k = (pE,k , vE,k ). The external camera (C) r produces raw measurements yC,k = (pC,k , θC,k ) and the r IMU (I) gives measurements yI,k = (v̇I,k , ωI,k ). The three sensors have covariance matrices Rz for z ∈ {E, C, I}. The perception pipeline P produces soft measurements yk = r r r P(yE,k , yC,k , yI,k ) from the raw measurements. It computes weighted averages between raw measurements and performs sensor fusion when needed. As an example, the soft measurement for the position psoft,k = wprE,k + (1 − w)prC,k is a weighted average of the raw measurements, w is set to the value yielding the smallest variance. The soft measurement for the velocity vsoft,k is computed as a weighted average between the raw measurement from the encoder and a fused estimate between the acceleration from the IMU and the previous estimate. The pipeline P produces soft measurements that satisfy equation (3) with C = I4×4 . The graph G corresponding to P is shown in Fig. 1. In the figure, z1,k is the encoder, z2,k the camera and z3,k the IMU; s1,k is the position, s2,k the velocity, s3,k the pole angle and s4,k the angular velocity. D is the CUSUM detector from [5], tuned on benign data to achieve a false positive rate of under 5%. The false negative rate used in (11) is set to 30%. The cost matrices in (7) are Mx = diag([1 1 20 2]) and Mu = 1. We explore two approaches for computing the thresholds for active learning. The first approach is to simulate attacks against sensors with a stochastic attacker. We set the attack transition probabilities to P(zi,k+1 = 1|zi,k = 0) = 0.01 and P(zi,k+1 = 1|zi,k = 1) = 0.99 and used fixed attack magnitudes. The thresholds are tested against the stochastic attacker and optimized with Bayesian optimization (BO). We call this approach LASE-AD-S(tochastic). The other approach is to optimize the thresholds with BO on benign data, denoted by LASE-AD-B(enign). The resulting thresholds from BO was to probe when π ∈ (0.5, 0.59) for LASE-AD-S and when π ∈ (0.499..., 0.5) for LASE-AD-B. This means LASE-AD-B will only use the passive part of LASE-AD and never probe. Baselines We compare our work against five baselines. All baselines use the same LQR as nominal controller as the LASE-AD variants. Normal: no defense, acts on attacked measurements. WoLF-IMQ, WoLF-MD, WoLFTMD: outlier-robust Kalman filter variants from [8], which scale the Kalman gain by a weighting function. The WoLFmethods have a hyperparameter and this is tuned for each attack scenario with BO. KalmanPred: upon CUSUM detection, this method ignores all sensor readings and relies on EKF prediction. An oracle signals when the attack ends, giving this baseline an advantage. Attack Scenarios We consider three attack scenarios. The scenario EncoderAttack(t) is an attack on the wheel encoder
Fig. 2. Task failure rate for 4 attack scenarios, computed over 50 simulations.
during t seconds. The attack is an additive term of 0.5 that is added to pE,k and vE,k coming from the encoder. The second scenario is called Encoder-IMUAttack, here the same bias is injected to the encoder when t ∈ [3.0, 6.0]. A bias is also injected to the IMU, an additive term of 0.9 is added to ωI,k and 0.2 is added to v̇I,k when t ∈ [4.0, 7.0]. This means the attacks overlap for 2.0 seconds. The final and most complex scenario is the E(ncoder)I(MU)C(amera)Attack where all sensors are compromised at some point. The encoder is attacked for t ∈ [3.0, 4.0], then the IMU for t ∈ [4.0, 6.0] and lastly the camera for t ∈ [6.0, 7.0]. The injected biases are the same as in EncoderAttack(t) and Encoder-IMUAttack for the encoder and IMU while the camera is attacked by adding 0.3 to pC,k and 0.15 to θC,k . We refer to the scenario without attack as NoAttack. The system is simulated for a total of 10 seconds and time is discretized by a step size of 5 ms. B. Experimental Results Fig. 2 shows the task failure rate for the LASE-AD variants and the baseline methods, computed over 50 evaluations. A task is considered failed if |θk | > 90◦ at any point during the simulation, i.e, if the pole falls. The failure rate is 0 for NoAttack using all methods, hence we omit the scenario in the figure. We observe that the two LASE-AD variants achieve a significantly lower failure rate than the baselines across all scenarios, and LASE-AD-S outperforms the passive LASE-AD-B variant, especially in the two multisensor scenarios. The gap widens with attack duration; under EncoderAttack(0.5) some baselines do not fail, but in the attack scenarios with longer duration, all baselines fail 100%. The baselines degrade because both the WoLF-methods and KalmanPred essentially rely on EKF predictions when measurements are deemed unreliable, and these predictions drift as the attacks persist. LASE-AD avoids this by identifying and excluding compromised sensors, allowing the filter to still benefit from trustworthy measurements. Fig. 3 shows the control cost distribution over non-failed evaluations. Methods not included had 100% failure rate for the respective scenario. Under benign conditions, we observe that LASE-AD does not result in increased control error compared to the baselines, i.e., it avoids failures without increased control error when there is no attack. An increase in control error can be seen in the multi-sensor attack scenarios compared to the others. This is partially attributed to the compromised sensors being relatively more difficult
Fig. 3. Control error distribution for 5 scenarios, for non-failed tasks. The boxes show median, inter-quartile range and extreme values.
bridge the gap between sensor attack detection and recovery. Experiments on a sensor-extended version of the CartPole environment showed that LASE-AD substantially outperforms existing robust state estimation baselines, particularly under prolonged and multi-sensor attacks where methods relying on EKF predictions show degraded performance. Important directions of future work include extending the framework to learn detector false negative rates online and explore adaptive probing strategies. Validation on real-world systems, such as unmanned aerial and ground vehicles, is also an interesting direction for future work. R EFERENCES
Fig. 4. Top: Average belief over time for the LASE-AD-S method. Middle: Average belief difference between LASE-AD-B and LASE-AD-S. Bottom: Rate of usage of the probing control signal for LASE-AD-S.
to distinguish, but also because the system acts on noisier measurements from perception pipelines using fewer sensors. Fig 4 illustrates the belief dynamics in the EncoderIMUAttack scenario. The top panel shows that LASE-ADS rapidly identifies both attacked sensors, though the IMU belief exhibits more variability due to ambiguity caused by overlapping attacks on sensors sharing state components (see Fig. 1). The middle and bottom panels show where active probing improves the belief. Between t = 6.0 and t = 7.0, after the encoder attack has ended, LASE-AD-B still assigns high attack probability to the encoder because alertbased inference alone cannot quickly distinguish between the ongoing IMU attack from a continued encoder attack. On the contrary, LASE-AD-S, which probes during the uncertain period (bottom panel), correctly lowers the encoder belief sooner. Recall that LASE-AD-B is a passive variant, so the comparison between the variants directly quantifies the marginal value of active probing. VI. CONCLUSIONS AND FUTURE WORK We have presented LASE-AD, a framework combining passive Bayesian alert interpretation with active learning to
[1] Harshad Sathaye, Martin Strohmeier, Vincent Lenders, and Aanjhan Ranganathan. An experimental study of GPS spoofing and takeover attacks on UAVs. In Proc. of USENIX Security, pages 3503–3520, Boston, MA, August 2022. USENIX Association. [2] Yunmok Son, Hocheol Shin, Dongkwan Kim, Youngseok Park, Juhwan Noh, Kibum Choi, Jungwoo Choi, and Yongdae Kim. Rocking drones with intentional sound noise on gyroscopic sensors. In USENIX Security, pages 881–896, Washington, D.C., August 2015. USENIX Association. [3] Yasser Shoukry, Paul Martin, Paulo Tabuada, and Mani Srivastava. Non-invasive spoofing attacks for anti-lock braking systems. In Proc. of Workshop on Cryptographic Hardware and Embedded Systems (CHES), page 55–72, 2013. [4] Hongjun Choi, Wen-Chuan Lee, Yousra Aafer, Fan Fei, Zhan Tu, Xiangyu Zhang, Dongyan Xu, and Xinyan Deng. Detecting attacks against robotic vehicles: A control invariant approach. In Proc. of ACM CCS, CCS ’18, page 801–816, New York, NY, USA, 2018. Association for Computing Machinery. [5] Raul Quinonez, Jairo Giraldo, Luis Salazar, Erick Bauman, Alvaro Cardenas, and Zhiqiang Lin. SAVIOR: Securing autonomous vehicles with robust physical invariants. In Proc. of USENIX Security, pages 895–912. USENIX Association, August 2020. [6] Pritam Dash, Guanpeng Li, Zitao Chen, Mehdi Karimibiuki, and Karthik Pattabiraman. Pid-piper: Recovering robotic vehicles from physical attacks. In IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pages 26–38, 2021. [7] Lin Zhang, Luis Burbano, Xin Chen, Alvaro A. Cardenas, Steven Drager, Matthew Anderson, and Fanxin Kong. Fast attack recovery for stochastic cyber-physical systems. In IEEE Real-Time and Embedded Technology and Applications Symp. (RTAS), pages 280–293, 2024. [8] Gerardo Duran-Martin, Matias Altamirano, Alexander Y. Shestopaloff, Leandro Sánchez-Betancourt, Jeremias Knoblauch, Matt Jones, François-Xavier Briol, and Kevin Murphy. Outlier-robust Kalman filtering through generalised Bayes. In Proc. of ICML, ICML’24. JMLR.org, 2024. [9] PX4 Development Team. PX4 Autopilot User Guide, 2026. Opensource autopilot documentation, licensed under CC BY 4.0. [10] Ali Mesbah. Stochastic model predictive control with active uncertainty learning: A survey on dual control. Annual Reviews in Control, 45:107–117, 2018. [11] Gert van Lagen, Edo Abraham, and Peyman Mohajerin Esfahani. A Bayesian approach for active fault isolation with an application to leakage localization in water distribution networks. IEEE Transactions on Control Systems Technology, 31(2):761–771, 2023. [12] Bernard C. Levy. Principles of Signal Detection and Parameter Estimation. Springer, 1st edition, 2008. [13] David Blackwell and Meyer A. Girshick. Theory of games and statistical decisions. John Wiley and Sons, 1954. [14] Stuart Russell and Peter Norvig. Artificial Intelligence: A Modern Approach. Prentice Hall, 3 edition, 2010. [15] Vikram Krishnamurthy. Partially observed Markov decision processes (POMDPs), page 147–178. Cambridge University Press, 2016. [16] Greg Brockman, Vicki Cheung, Ludwig Pettersson, Jonas Schneider, John Schulman, Jie Tang, and Wojciech Zaremba. Openai gym, 2016. [17] Andrew G. Barto, Richard S. Sutton, and Charles W. Anderson. Neuronlike adaptive elements that can solve difficult learning control problems, page 535–549. MIT Press, 1988.