Resilient Distributed Parameter Estimation with Heterogeneous Data

TL;DR

This paper introduces SAGE, a resilient distributed estimator that guarantees convergence to the true parameter despite measurement attacks, even with heterogeneous and partially unobservable local models.

Contribution

The paper proposes SAGE, a novel distributed estimator resilient to measurement attacks, effective with heterogeneous data and independent of network topology.

Findings

SAGE guarantees convergence under a bound on compromised streams.

Resilience does not depend on communication network topology.

Numerical examples demonstrate SAGE's effectiveness.

Abstract

This paper studies resilient distributed estimation under measurement attacks. A set of agents each makes successive local, linear, noisy measurements of an unknown vector field collected in a vector parameter. The local measurement models are heterogeneous across agents and may be locally unobservable for the unknown parameter. An adversary compromises some of the measurement streams and changes their values arbitrarily. The agents' goal is to cooperate over a peer-to-peer communication network to process their (possibly compromised) local measurements and estimate the value of the unknown vector parameter. We present SAGE, the Saturating Adaptive Gain Estimator, a distributed, recursive, consensus+innovations estimator that is resilient to measurement attacks. We demonstrate that, as long as the number of compromised measurement streams is below a particular bound, then, SAGE guarantees that all of the agents' local estimates converge almost surely to the value of the parameter. The resilience of the estimator -- i.e., the number of compromised measurement streams it can tolerate -- does not depend on the topology of the inter-agent communication network. Finally, we illustrate the performance of SAGE through numerical examples.

Equations

$$y_n(t)=H_n{\theta }^{\ast }+w_n(t),$$

$$\mathbf{y}_{t}=\left[\begin{array}[]{ccc}y_{1}^{\intercal}(t)&\cdots&y_{N}^{\intercal}(t)\end{array}\right]^{\intercal}=\mathcal{H}\theta^{*}+\mathbf{w}_{t},$$

$${\mathbf{w}}_t$$

$$\mathcal{H}$$

$$\mathbf{y}_{t}=\left[\begin{array}[]{c}\left.\begin{array}[]{c}y^{(1)}(t)\\ \vdots\\ y^{(P_{1})}(t)\end{array}\right\}y_{1}(t)\\ \vdots\\ \left.\begin{array}[]{c}y^{(\overline{P}_{n}+1)}(t)\\ \vdots\\ y^{(\overline{P}_{n}+P_{n})}(t)\end{array}\right\}y_{n}(t)\\ \vdots\\ \left.\begin{array}[]{c}y^{(\overline{P}_{N}+1)}(t)\\ \vdots\\ y^{(P)}(t)\end{array}\right\}y_{N}(t)\end{array}\right],$$

$$\mathcal{H}=\left[\begin{array}[]{ccc}h_{1}&\cdots&h_{P}\end{array}\right]^{\intercal},$$

$$\mathcal{D}{y}_n(t)=\mathcal{D}{H}_n{\theta }^{\ast }+\mathcal{D}{w}_n(t),$$

$$\mathcal{D}=\mathrm{diag}\left({\Vert h_{\overline{P_n}+1}\Vert }_2^{-1},\dots ,{\Vert h_{\overline{P_n}+P_n}\Vert }_2^{-1}\right).$$

$$\displaystyle\mathcal{H}_{\mathcal{X}}=\left[\begin{array}[]{ccc}h_{p_{1}}&\cdots&h_{p_{\left\lvert\mathcal{X}\right\rvert}}\end{array}\right]^{\intercal}.$$

$${\mathcal{G}}_{\mathcal{X}}={\mathcal{H}}_{\mathcal{X}}^{⊺}{\mathcal{H}}_{\mathcal{X}}=\sum _{p\in \mathcal{X}}{h}_p{h}_p^{⊺}$$

$$y_n(t)=H_n{\theta }^{\ast }+w_n(t)+a_n(t).$$

$$\mathcal{A}=\left\{p\in\mathcal{P}\Big{|}\exists t=0,1,\dots,\>a^{(p)}(t)\neq 0\right\},$$

$${\mathcal{G}}_{\mathcal{P}\setminus \mathcal{X}}={\mathcal{H}}_{\mathcal{P}\setminus \mathcal{X}}^{⊺}{\mathcal{H}}_{\mathcal{P}\setminus \mathcal{X}}=\sum _{p\in \mathcal{P}\setminus \mathcal{X}}{h}_p{h}_p^{⊺}.$$

$${\overline{y}}_n(t)=\frac{t}{t+1}{\overline{y}}_n(t-1)+\frac{1}{t+1}{y}_n(t),$$

$${\overline{y}}^{(p)}(t)=h_p^{⊺}{\theta }^{\ast }+{\overline{w}}^{(p)}(t),$$

$$\begin{array}{rl}{x}_n(t+1)=& x_n(t)-{\beta }_t\sum _{l\in {\Omega }_n(t)}\left(x_n(t)-x_l(t)\right)\\ & +{\alpha }_t{H}_n^{⊺}{K}_n(t)\left({\overline{y}}_n(t)-H_n{x}_n(t)\right),\end{array}$$

$$K_n(t)=\mathrm{diag}\left(k_{{\overline{P}}_n+1}(t),\dots k_{{\overline{P}}_n+P_n}(t)\right),$$

$$k_p(t)=\min \left(1,{\gamma }_t{\left|{\overline{y}}_n^{\left(p\right)}(t)-h_p^{⊺}{x}_n(t)\right|}^{-1}\right),$$

$${\alpha }_t=\frac{a}{(t+1{)}^{{\tau }_1}},{\beta }_t=\frac{b}{(t+1{)}^{{\tau }_2}},$$

$${\gamma }_t=\frac{\Gamma }{(t+1{)}^{{\tau }_{\gamma }}},$$

$${\mathcal{G}}_{\mathcal{N}}=\sum _{p\in \mathcal{N}}{h}_p{h}_p^{⊺},$$

$${\lambda }_{\min }\left({\mathcal{G}}_{\mathcal{N}}\right)>{\Delta }_{\mathcal{A}},$$

$${\Delta }_{\mathcal{A}}=\underset{v\in {\mathbb{R}}^{|\mathcal{A}|},{\Vert v\Vert }_{\infty }\le 1}{\max }{\Vert {\mathcal{H}}_{\mathcal{A}}^{⊺}v\Vert }_2,$$

$$\mathbb{P}\left(\underset{t\to \infty }{\lim }{\left(t+1\right)}^{{\tau }_0}{\Vert x_n(t)-{\theta }^{\ast }\Vert }_2=0\right)=1,$$

$${\lambda }_{\min }\left({\mathcal{G}}_{\mathcal{N}}\right)>\left|\mathcal{A}\right|.$$

$$\mathcal{V}=\bigcup _{p\in \mathcal{P}}\left\{h_p\right\},$$

$$y_n(t)={\theta }^{\ast }+a_n(t).$$

$${\mathbf{x}}_t$$

$${\overline{\mathbf{y}}}_t$$

$${\mathbf{K}}_t$$

$$D_H$$

$${\overline{\mathbf{x}}}_t$$

$${\hat{\mathbf{x}}}_t$$

Full text

I Introduction

The continued growth of the Internet of Things (IoT) has introduced numerous applications featuring networks of devices cooperating toward a common objective. IoT devices instrument smart cities to monitor traffic patterns or air pollution [1], convoys of driverless cars cooperate to navigate through hazardous weather conditions [2, 3], and teams of reconnaisance drones form ad-hoc networks to extend their coverage areas [4]. These applications require distributed algorithms to locally process measurements collected at each individual device for actionable insight. For example, connected autonomous vehicles need to estimate the global state of traffic from their local sensor measurements for safe and efficient path planning, without transmitting their raw measured data to the cloud.

IoT devices, however, are vulnerable to malicious cyber attacks, and, in particular, adversaries may pathologically corrupt a subset of the devices’ (or agents’) measurements [5]. Attackers may create false traffic obstacles for a driverless car by spoofing its LIDAR [6], or they may arbitrarily control vehicles by manipulating its onboard sensor measurements [7, 8]. In IoT setups, attacks on individual devices propagate over the network and affect the behavior of other devices [9, 10, 11, 5]. Without proper countermeasures, IoT will be compromised with possibly dangerous consequences.

In this paper, we address the following question: how can an IoT or network of agents resiliently estimate an unknown (vector) parameter while an adversary manipulates a subset of their measurements? Consider a set of agents or devices, connected by a communication network of arbitrary topology, each making a stream of measurements of an unknown parameter $\theta^{*}$. For example, in air quality monitoring applications, $\theta^{*}$ represents the field of pollutant concentrations throughout a city, and each device makes successive measurements of a few components of the parameter, corresponding to pollutant concentrations in specific locations. An adversary manipulates a subset of the local measurement streams. The agents’ goal is to ensure that all agents resiliently estimate the field or (vector) parameter $\theta^{*}$. This paper presents SAGE, the Saturating Adaptive Gain Estimator, a recursive distributed estimator, that guarantees that, under a sufficient condition on the number of compromised measurement streams, all of the agents’ local estimates are (statistically) strongly consistent, i.e., they converge to $\theta^{*}$ almost surely (a.s.).

I-A Literature Review

We briefly review related literature, and we start with the Byzantine Generals problem, which demonstrates the effect of adversaries in distributed computation [12]. In this problem, a group of agents must decide whether or not to attack an enemy city by passing messages to each other over an all-to-all communication network. A subset of adversarial agents transmits malicious messages to prevent the remaining agents from reaching the correct decision. Reference [12] shows that a necessary and sufficient condition for any distributed protocol to recover the correct decision is that less than one third of the agents be adversarial. Like [12], reference [13] also studies resilient consensus (i.e., reaching agreement among the agents) over all-to-all communication networks. Unlike the consensus problem, which does not incorporate measurements, we study, in this paper, resilient distributed estimation, where agents must process their local measurement streams.

Byzantine attacks also affect performance of decentralized inference algorithms. In decentralized inference, a team of devices measures an unknown parameter and transmits either their measurements or their local decisions to a fusion center, which then processes all data simultaneously to recover the value of the parameter. Adversarial (Byzantine) devices transmit falsified data to the fusion center to disrupt the inference process. References [14] and [15] address hypothesis testing under Byzantine attack (where the parameter may only take discrete values), and references [16] and [17] address estimation (where the parameter may take continuous values). The work on resilient decentralized inference in [14, 15, 16, 17] restrict the adversary to follow probabilistic attack strategies and use this restriction to design resilient processing algorithms. In this paper, we consider a stronger class of adversaries who may behave arbitrarily, unlike the restricted adversaries from [14, 15, 16, 17] who must adhere to probabilistic strategies.

While [12] and [13] study resilient computation over fully-connected, all-to-all networks, in general, distributed computation in IoT involves sparse communications, where each device only communicates with a small subset of the other devices. The authors of [18] propose an algorithm for resilient Byzantine consensus of local agent states over sparse communication networks that guarantees that the non-adversarial agents resiliently reach consensus in the presence of Byzantine adversaries as long as the graph satisfies conditions that restrict topology of the communication network. Reference [19] extends the algorithm in [18] to address distributed estimation. The estimator in [19] is resilient to Byzantine agents (i.e., all nonadversarial agents resiliently estimate the unknown parameter) but requires that a known subset of the agents be guaranteed, a priori, to be nonadversarial. In this paper, we do not assume that any agent is impervious to adversaries; any subset of the agents may fall under attack.

A popular method to cope with Byzantine agents is to deploy algorithms that explicitly detect and identify adversaries [20, 21, 22, 11]. Reference [20] studies multi-task distributed estimation, where, instead of estimating a single parameter, the agents may be interested in estimating different parameters. The authors of [20] propose a distributed algorithm for each agent to identify the neighbors that are interested in estimating the same parameter and ignore information from neighbors that are interested in estimating different parameters. If all adversaries behave as though they measure a different parameter, then, the algorithm from [20] successfully identifies them. Byzantine agents in general, however, are not required to behave as though they measure and estimate a different parameter; they may send arbitrary information to their neighbors. The algorithm from [20] is only able to identify one type of Byzantine behavior (i.e., where byzantine agents behave as though they measure a different parameter) but not all Byzantine behaviors in general.

The authors of [21] develop distributed algorithms to detect and identify adversarial agents. In [21], each device must know the structure of the entire network and the consensus algorithm dynamics (i.e., how each agent updates their local state), which is then leveraged to design attack detection and identification filters. In general, attack identification is computationally expensive. Even in centralized settings, where a fusion center has access to all of the agents’ measurements, identifying attacks is a combinatorial problem (in the number of measurements) [23, 24, 25]. Reference [22] also requires each agent to know the topology of the entire network, and it designs algorithms to detect and identify adversaries in distributed function calculation. The techniques from [21] and [22] become burdensome in terms of memory, communication, and computation requirements as the number of agents and the size of the network grows. To avoid this high computational cost, we develop a resilient distributed estimator that does not depend on expliclitly detecting nor on identifying the attack. We emphasize that not requiring the explicit detection and identification of compromised streams is a feature, not a limitation, of our approach that is very useful in many practical scenarios.

In our previous work [11], we designed a method to detect the presence of adversaries in distributed estimation that applies to general communication network topologies and only requires each agent to know who its local neighbors are. Our algorithm guaranteed that, in the presence of adversaries, the uncompromised agents will either almost surely recover the value of the unknown parameter or detect the presence of Byzantine agents. Unlike [11], this paper presents a distributed estimation algorithm that copes with attacks on measurement streams without explicitly detecting the attack. The estimator in this paper ensures that all of the agents, not just the uncompromised agents (like in [11]), resiliently recover the value of the unknown parameter.

Instead of explicitly detecting and identifying attacks as in [21, 22, 11], other methods cope with adversaries implicitly. Implicit countermeasures aim to ensure that the agents achieve their collective objective (e.g., in distributed estimation, the agents’ objective is to recover the value of the unknown parameter) without explicitly detecting and identifying the adversary’s actions. References [26, 10] present distributed diffusion algorithms for multi-task estimation, where, like in [20], the agents measure and are interested in estimating different parameters. In [10] and [26], to cope with neighbors who are interested in estimating different parameters, each agent applies adaptive weights to data received from their neighbors. Over time, the agents learn to ignore information that is irrelevant to their estimation tasks. Multi-task distributed estimation algorithms [26, 10] may cope with adversaries who behave as though they measure a different parameter but fail to cope with Byzantine agents in general. Reference [27] shows how a single Byzantine agent may prevent distributed diffusion algorithms ([10, 20, 26]) from correctly estimating the unknown parameter.

Our previous work [5] presented an algorithm for distributed parameter recovery that we demonstrate analytically to be implicitly resilient against measurement attacks (i.e., attacks that manipulate the agents’ local measurement streams). In [5], each agent’s measurement was noiseless and homogeneous. That is, in the absence of attacks, every agent had the same, noiseless measurement model. This paper, unlike [5], addresses agents with possibly different or heterogeneous measurement models that are corrupted by noise. A survey and overview of both explicit and implicit security countermeasures for resilient computation in decentralized and distributed IoT architectures is found in our previous work [9].

I-B Summary of Contributions

This paper studies resilient distributed estimation under measurement attacks. A team of IoT devices (or agents) makes noisy, heterogeneous measurements of an unknown, static parameter $\theta^{*}$. The devices share information with their neighbors over a communication network and process locally their measurement streams to estimate $\theta^{*}$. An adversary attacks some of the measurements – a compromised measurement takes arbitrary value as determined by the adversary. Our goal is to ensure that all of the agents, even those with compromised measurements, consistently estimate $\theta^{*}$. To this end, we present SAGE, the Saturating Adaptive Gain Estimator.

SAGE is a consensus+innovations type estimator where each agent maintains and updates its estimate as a weighted sum of its current estimate, its current measurement, and the estimates of its neighbors (see, e.g.,  [28, 29, 30, 31]). Each agent applies an adaptive gain to its measurement in the estimate update procedure to limit the impact of aberrant, compromised measurements. We design this gain and establish a sufficient condition on the maximum number of measurement streams that may be compromised, under which SAGE guarantees that all of the agents resiliently estimate the parameter of interest. Specifically, as long as the sufficient condition is satisfied, then, SAGE ensures that all of the agents’ estimates are strongly consistent, i.e., the estimate of each (local) agent converges almost surely to the value of the parameter. We will compare this sufficient condition against theoretical bounds of resilience established for centralized (or cloud) estimators, where a single processor has access to all of the measurements [23, 24, 25].

Although SAGE shares similar ideas with the Saturated Innovations Update (SIU) algorithm from [5], a resilient distributed parameter recovery algorithm for setups where the agents all make the same (homogeneous), noiseless measurement of the parameter $\theta^{*}$, SAGE addresses resilient distributed estimation when

1. the agents make different (heterogeneous) measurements and
2. the measurements are corrupted by measurement noise. The first extension allows for agents or sensors of different types to cooperate, a more realistic and practical condition. The second makes the analysis of SAGE much more intricate than the analysis of SIU.

With measurement noise, it is more difficult to distinguish compromised measurements from normal measurements, since a strategic adversary may hide the effect of the measurement attacks within the noise. So, SAGE and the agents must simultaneously cope with the natural disturbance from the noise as well as the artificial disturbance from the attack. With SIU and noiseless settings [5], the agents only have to deal with disturbances resulting from the attack. The analysis of SAGE requires new technical tools, that we develop in this paper, not found in [5], to deal with the measurement noise. Compared to the literature (notably [5, 28, 29, 30, 31]), the improvements of SAGE are

1. heterogeneous measurement models and measurement noise with respect to [5] and
2. the presence of attacks with respect to [28, 29, 30, 31].

This paper focuses on measurement attacks, where an adversary manipulates the values of a subset of the agents’ measurement streams, in contrast with Byzantine attacks where adversarial agents send false information to their neighbors. To cope with Byzantine agents, the uncompromised agents must additionally filter and process the information they receive from neighbors [18, 19, 21, 10, 22, 11]. In contrast, to cope with measurement attacks, agents must additionally filter and process their own measurement streams. Existing algorithms for resilient distributed computation with Byzantine agents (e.g., [18, 19, 21, 10, 22, 11]) only ensure that the uncompromised agents resiliently complete the task. Moreover, algorithms from [18, 19, 22] constrain the topology of the communication network to satisfy specific conditions (e.g., in [22], on the number of unique paths between any two uncompromised agents). In contrast, we will show here that SAGE is resilient to measurement attacks regardless of the network topology, as long as it is connected on average, and we ensure that all of the agents, including those with compromised measurements, consistently estimate the unknown parameter.

The rest of this paper is organized as follows. In Section II, we review the models for the measurements, communications, and attacks. Section III presents the SAGE algorithm, a consensus+innovations estimator that is resilient to measurement attacks. In Section IV, we show that, as long as a sufficient condition on the number of compromised agents is satisfied, then, for any connected network topology, SAGE guarantees that all of the agents’ local estimates are strongly consistent. Section V compares the sufficient condition (on the number of compromised agents for resilient distributed estimation) against theroetical resilience bounds for centralized (cloud) estimators. We illustrate the performance of SAGE through numerical examples in Section VI, and we conclude in Section VII.

II Background

II-A Notation

Let $\mathbb{R}^{k}$ be the $k$ dimensional Euclidean space, $I_{k}$ the $k$ by $k$ identity matrix, $\mathbf{1}_{k}$ and $\mathbf{0}_{k}$ the $k$ dimensional one and zero vectors. The operator $\left\lVert\cdot\right\rVert_{2}$ is the $\ell_{2}$ norm. For matrices $A$ and $B$, $A\otimes B$ is the Kronecker product. A set of vectors $\mathcal{V}=\left\{v_{1},\dots,v_{\left\lvert\mathcal{V}\right\rvert}\right\}$ is orthogonal if $v_{i}^{\intercal}v_{j}=0$ for all $i\neq j$.

Let $G=(V,E)$ be a simple undirected graph (no self loops or multiple edges) with vertices $V=\left\{1,\dots,N\right\}$ and edges $E$. The neighborhood of vertex $n$, $\Omega_{n}$, is the set of vertices that share an edge with $n$. The degree of a node $d_{n}$ is the size of its neighborhood $\left\lvert\Omega_{n}\right\rvert$, and the degree matrix of the graph $G$ is $D=\operatorname*{diag}(d_{1},\dots,d_{N})$. The adjacency matrix of $G$ is $A=\left[A_{nl}\right]$, where $A_{nl}=1$ if $\left(n,l\right)\in E$ and $A_{nl}=0$ otherwise. The Laplacian matrix of $G$ is $L=D-A$. The Laplacian matrix $L$ has ordered eigenvalues $0=\lambda_{1}(L)\leq\cdots\leq\lambda_{N}(L),$ and eigenvector $\mathbf{1}_{N}$ associated with the eigenvalue $\lambda_{1}(L)=0.$ For a connected graph $G$, $\lambda_{2}(L)>0$. We assume that $G$ is connected in the sequel. References [32, 33] review spectral graph theory.

Random objects are defined on a common probability space $\left(\Omega,\mathcal{F}\right)$ equipped with a filtration $\left\{\mathcal{F}_{t}\right\}$. Reference [34] reviews stochastic processes and filtrations. Let $\mathbb{P}\left(\cdot\right)$ and $\mathbb{E}\left(\cdot\right)$ be the probability and expectation operators, respectively. In this paper, unless otherwise stated, all inequalities involving random variables hold almost surely (a.s.), i.e., with probability $1$.

II-B Measurement and Communication Model

Consider a set of $N$ agents or devices $\left\{1,2,\dots,N\right\}$, each making noisy, local streams of measurements of an unknown field represented by a vector parameter $\theta^{*}\in\mathbb{R}^{M}$. For example, a network of air quality sensors may monitor several pollutant concentrations over a city. The measurement of agent $n$ at time $t=0,1,2,\dots$ is

[TABLE]

where $w_{n}(t)$ is the local measurement noise. Agent $n$ has $P_{n}$ scalar measurements (at each time $t$), and $M$ is the dimension of the parameter $\theta^{*}$ (i.e., $H_{n}\in\mathbb{R}^{P_{n}\times M}$).111Our measurement model differes from the model used in [5], where each agent made the same, noiseless measurement $y_{n}(t)=\theta^{*}$. In air quality monitoring, for example, each device may measure the concentrations of a few pollutants in its neighborhood over time, corresponding to specific components of $\theta^{*}$.

Assumption 1**.**

The measurement noise $w_{n}(t)$ is independently and identically distributed (i.i.d.) over time and independent across agents with mean $\mathbb{E}\left[w_{n}(t)\right]=0$ and covariance $\mathbb{E}\left[w_{n}(t)w_{n}(t)^{\intercal}\right]=\Sigma_{n}.$ The sequence $\left\{w_{n}(t)\right\}$ is $\mathcal{F}_{t+1}$ adapted and independent of $\mathcal{F}_{t}$.

The agents’ estimation performance depends on the collection of all of their local measurements. Let

[TABLE]

be stack of all agents’ measurements at time $t$, where

[TABLE]

collect the measurement noises and measurement matrices ($H_{1},\dots,H_{N}$), respectively. Let $P=\sum_{n=1}^{N}P_{n}$ be the total number of (scalar) measurements (at each time $t$) over all agents (i.e., the matrix $\mathcal{H}$ has $P$ rows). We index the scalar components of $\mathbf{y}_{t}$ from $1$ to $P$,

[TABLE]

where $\overline{P}_{n}=\sum_{j=0}^{n-1}P_{j}$. In general, $\overline{P}_{n}+1,\dots,\overline{P}_{n}+P_{n}$ index the components of $y_{n}(t)$. Similar to (3), we label the rows of $\mathcal{H}$ as $h^{\intercal}_{1},\dots,h^{\intercal}_{P}$ ($h_{p}^{\intercal}\in\mathbb{R}^{1\times M}$), i.e.,

[TABLE]

and, in general, $\overline{P}_{n}+1,\dots,\overline{P}_{n}+P_{n}$, index the rows of $H_{n}$.

Assumption 2**.**

The measurement vectors $h_{p}$ are normalized to unit $\ell_{2}$ norm, i.e., $\left\lVert h_{p}\right\rVert_{2}=1,\forall p=1,\dots P$.

We make Assumption 2 without loss of generality. If Assumption 2 is not satisfied, each agent may compute a normalized version of its local measurement

[TABLE]

where

[TABLE]

Then, instead of processing the raw measurements $y_{n}(t)$, the agents may process the normalized measurements $\mathcal{D}y_{n}(t)$. Note that each row of the matrix $\mathcal{D}H_{n}$ (i.e., the measurement matrix associated with the normalized measurement $\mathcal{D}y_{n}(t)$) satisfies Assumption 2.

We now define a measurement stream.

Definition 1** (Measurement Stream).**

A measurement stream $\left\{y^{(p)}(t)\right\}_{t=0,1,2,\dots}$ is the collection of the scalar measurement $y^{(p)}(t)$ over all times $t=0,1,2,\dots$. $\small\blacksquare.$

For the rest of this paper, we refer to measurement streams by their component index, i.e., measurement stream $p$ refers to $\left\{y^{(p)}(t)\right\}_{t=0,1,2,\dots}$. Let $\mathcal{P}=\left\{1,\dots,P\right\}$ be the set of all measurement streams.

The agents’ collective goal is to estimate the value of $\theta^{*}$ using their local measurement streams. Global observabilty is an important property for estimation.

Definition 2** (Global Observability).**

Let $\mathcal{X}=\left\{p_{1},\dots,p_{\left\lvert\mathcal{X}\right\rvert}\right\}\subseteq\mathcal{P}$ be a collection of measurement stream indices. Consider the measurement vectors associated with the streams in $\mathcal{X}$, collected in the stacked measurement matrix

[TABLE]

The set $\mathcal{X}$ is globally observable if the observability Grammian

[TABLE]

is invertible. $\small\blacksquare.$

Global observabilty of a set of measurement streams $\mathcal{X}$, means that, in the absence of noise $w_{n}(t)$, the value of $\theta^{*}$ may be determined exactly from a single snapshot (in time) of the measurements in $\mathcal{X}$. When the parameter $\theta^{*}$ and measurement vectors $h_{p}$ are static, then, having access to streams of measurements over time does not affect observability.

Assumption 3**.**

The set of all measurement streams $\mathcal{P}$ is globally observable: the matrix $\mathcal{G}_{\mathcal{P}}=\sum_{p=1}^{P}h_{p}h_{p}^{\intercal}$ is invertible.222Global observability is necessary for centralized estimators to be consistent, so, it is natural to also assume it here for distributed settings.

In contrast with [5], here, the measurements at each individual agent are not observable, i.e., we do not require local observability, and an individual agent may not consistently estimate $\theta^{*}$ using just its own local measurements.

Agents may exchange information with each other over a time-varying communication network, defined by a time varying graph $G(t)=(V,E(t))$. In the graph $G(t)$, the vertex set $V$ is the set of all agents $\left\{1,2,\dots,N\right\}$, and the edge set $E(t)$ is the set of communication links between agents at time $t$.

Assumption 4**.**

The Laplacians $\left\{L(t)\right\}$ (associated with the graphs $\left\{G(t)\right\}$) form an i.i.d. sequence with mean $\mathbb{E}\left[L(t)\right]=\overline{L}.$ The sequence $\left\{L(t)\right\}$ is $\mathcal{F}_{t+1}$ adapted and independent of $\mathcal{F}_{t}$. The sequences $\left\{L(t)\right\}$ and $\left\{w_{n}(t)\right\}$ are mutually independent.

The random graphs $G(t)$ (and associated Laplacians $L(t)$) capture communication link failures, like intermittent shadowing common in wireless environments, as well as random gossip communication protocols [30]. For example, in the absence of link failures, the communication network may be a fixed graph $G=(V,E)$. In practice, however, some of these links may fail intermitently, inducing a random, time varying graph $G(t)=(V,E(t))$.

The agents’ collective goal is to estimate the value of the parameter $\theta^{*}$ (in context of air quality monitoring, the concentration of pollutants) using their measurements and information received from their neighbors.

Assumption 5**.**

The communication network is connected on average. That is, we require $\lambda_{2}\left(\overline{L}\right)>0$. We do not require $G(t)$ to be connected.

II-C Attack Model

An attacker attempts to disrupt the agents and prevent them from estimating $\theta^{*}$. The attacker replaces a subset of the measurements with arbitrary values. We model the effect of the attack as an additive disturbance $a_{n}(t)$, so that, under attack, the measurement of agent $n$ is

[TABLE]

Similar to $y_{n}(t)$ and $H_{n}$, we label the components of $a_{n}(t)$ by $\overline{P}_{n}+1,\dots,\overline{P}_{n}+P_{n}$, i.e., a_{n}(t)=\left[\begin{array}[]{ccc}a^{\left(\overline{P}_{n}+1\right)}(t)&\cdots&a^{\left(\overline{P}_{n}+P_{n}\right)}(t)\end{array}\right]^{\intercal}. We say that measurement stream $p$ is compromised or under attack if, for any $t=0,1,\dots,$ $a^{(p)}(t)\neq 0$.333A compromised measurement stream does not have to be under attack for all times $t$. If there is any $t$ such that $a^{(p)}(t)\neq 0$, we consider $p$ to be compromised even if there exists $t^{\prime}\neq t$ such that $a^{(p)}(t)=0.$ We make no assumptions about how the attacker compromises the measurement streams. The attacker may choose $a_{n}(t)$ arbitrarily, which, in general, may be unbounded and time varying. For example, in air quality monitoring, if measurement stream $p$ is compromised, then, at some time $t$, instead of taking the value of the true pollutant concentration, $y^{(p)}(t)$ becomes an arbitrarily valued concentration measurement. For analysis, we partition $\mathcal{P}$, the set of all measurement streams, into the set of compromised measurement streams

[TABLE]

and the set of noncompromised or uncompromised measurement streams $\mathcal{N}=\mathcal{P}\setminus\mathcal{A}$. Each agent $n$ may have both compromised and uncompromised local measurement streams: if one of agent $n$’s measurement streams is compromised, it does not necessarily mean that all of its streams are compromised. The sets $\mathcal{A}$ and $\mathcal{N}$ are time invariant. Agents do not know which measurement streams are compromised.

When measurements fall under attack, resilient estimation of $\theta^{*}$ depends on the notion of (global) $s$-sparse observabilty.

Definition 3** (Global $s$-Sparse Observabilty (​[24, 25])).**

Let $\mathcal{P}$ be the set of all measurement streams. The set of all measurement streams is globally $s$-sparse observable if the matrix

[TABLE]

is invertible for all subsets $\mathcal{X}\subseteq\mathcal{P}$ of cardinality $\left\lvert\mathcal{X}\right\rvert=s$. $\small\blacksquare.$

A set of measurements is (globally) $s$-sparse observable if it is still (globally) observable after removing any $s$ measurements from the set [24, 25].

We make the following assumptions on the attacker:

Assumption 6**.**

The attacker may only manipulate a subset of the measurement streams. That is, $0\leq\frac{\left\lvert\mathcal{A}\right\rvert}{P}<1$. The attacker may not manipulate all of the measurement streams.

Assumption 7**.**

The attack does not change the value of $\theta^{*}$. That is the attacker may only manipulate the agents’ measurements of $\theta^{*}$, but it may not change the true value of $\theta^{*}$. In the context of air quality monitoring, this means that the attacker may change some of the measurements of the pollutant concentrations, but may not change the true concentrations themselves.

The attack model in this paper differs from the Byzantine attack model (see, e.g., [12, 11, 14, 35, 18, 19]). Under the Byzantine attack model, a subset of adversarial agents behaves arbitrarily and transmits false information to their neighbors, while the remaining nonadversarial agents must cope with pathologically corrupted data received from their adversarial neighbors. In contrast, under the measurement attack model (5), agents do not intentionally transmit false information to their neighbors. Instead, agents must cope with adversarial data from a subset of their measurement streams. Resilient algorithms for the Byzantine attacker model aim to ensure that only the non-adversarial, uncompromised agents accomplish their computation task [11, 18, 19]. This is because Byzantine agents may behave arbitrarily and deviate from any prescribed protocol. For distributed estimation under the measurement attack model (equation (5) with Assumptions 6 and 7), we aim to ensure that all agents recover the value of the unknown parameter, even those agents with compromised measurement streams.

Byzantine attacks compromise the communication between agents. Attackers may intercept communication packets and change their contents, or they may, via malicious software, force agents to transmit false information to neighbors [36]. The measurement attack model in SAGE considers attacks that compromise the data collected by the agents. Attackers spoof the agents’ measurements so that they collect false data. For example, attackers may create false obstacles for a driverless car by feeding it false LIDAR measurements [6].

III SAGE: Saturating Adaptive Gain Estimator

In this section, we present SAGE, the Saturating Adaptive Gain Estimator, a distributed estimation algorithm that is resilient to measurement attacks. SAGE is a consensus + innovations distributed estimator [28, 29, 30, 31] and is based on the Saturated Innovations Update (SIU) algorithm we introduced [5]. Unlike the SIU algorithm, which requires the agents’ measurement streams to be noiseless (i.e., $w_{n}(t)\equiv 0$ in (1) and (5)) and homogeneous ($H_{n}\equiv I_{M}$), SAGE may simultaneously cope with disturbances from both measurement noise and the attacker on heterogeneous (possibly different $H_{n}$) linear measurement models.

III-A Algorithm Description

SAGE is an iterative algorithm in which each agent maintains and updates a local estimate $x_{n}(t)$ based on its local observation $y_{n}(t)$ and the information it receives from its neighbors. Each iteration of SAGE consists of a message passing step and an estimate update step. Each agent $n$ sets its initial local estimate as $x_{n}(0)=0$.

Message Passing: Every agent $n$ transmits its current estimate, $x_{n}(t)$, to each of its neighbors $l\in\Omega_{n}$.

Estimate Update: Every agent $n$ maintains a running average of its local measurement stream; i.e., each agent computes

[TABLE]

with initial condition $\overline{y}_{n}(-1)=0$. Note that, if $p$ is not under attack (i.e., $p\in\mathcal{N}$), then,

[TABLE]

where $\overline{w}^{(p)}_{n}(t)=\frac{1}{t+1}\sum_{j=0}^{t}w^{(p)}_{n}(j)$ is time-averaged measurement noise. Every agent $n$ updates its estimate as

[TABLE]

where $\alpha_{t}>0$ and $\beta_{t}>0$ are weight sequences to be defined in the sequel. The term $\overline{y}_{n}(t)-H_{n}x_{n}(t)$ is innovation of agent $n$. The innovation term is the difference between the agent’s observed (averaged) measurement $\overline{y}_{n}(t)$ and its predicted measurement $H_{n}x_{n}(t)$, based on its current estimate $x_{n}(t)$ and the measurement model (1). The innovation term incorporates information from the agent’s measurement streams into its updated estimate. The second term in (8) is the global consensus average.

The term $K_{n}(t)$ is a diagonal matrix of gains that depends on the innovation $\overline{y}_{n}(t)-H_{n}x_{n}(t)$ and is defined as

[TABLE]

where, for $p=\overline{P}_{n}+1,\dots,\overline{P}_{n}+P_{n}$,

[TABLE]

and $\gamma_{t}$ is a scalar adaptive threshold to be defined in the sequel. The gain $k_{p}(t)$ saturates the innovation term, along each component, at the threshold $\gamma_{t}$. That is, $k_{p}(t)$ ensures that, for each measurement stream $p$, the magnitude of the scaled innovation, $\left\lvert k_{p}(t)\left(\overline{y}_{n}^{(p)}(t)-h_{p}^{\intercal}x_{n}(t)\right)\right\rvert$, never exceeds the threshold $\gamma_{t}$.

The purpose of $K_{n}(t)$ and $\gamma_{t}$ is to limit the impact of attacks. It may, however, also limit the impact of measurements that are not under attack ($p\in\mathcal{N}$). The main challenge in designing the SAGE algorithm is to choose the adaptive threshold $\gamma_{t}$ to balance these two effects. We choose $\gamma_{t}$ and the weight sequences $\alpha_{t}$ and $\beta_{t}$ as follows:

Select $\alpha_{t}$, $\beta_{t}$ as:

[TABLE]

with $a,b>0$ and $0<\tau_{2}<\tau_{1}<1$. 2. 2.

Select $\gamma_{t}$ as:

[TABLE]

with $\Gamma>0$ and $0<\tau_{\gamma}<\min\left(\frac{1}{2},\tau_{1}-\tau_{2}\right).$

Choosing $\alpha_{t}$, $\beta_{t}$, and $\gamma_{t}$ correctly is key to the resilience and consistency of SAGE. If we choose these weight sequences incorrectly, then, SAGE is not resilient to the measurement attacks. We carefully craft $\alpha_{t}$ and $\beta_{t}$ to decay over time, with $\alpha_{t}$ decaying faster than $\beta_{t}$. In the long run, the consensus term dominates the innovation term. The difference in decay rates results in the mixed time-scale behavior of the estimate update (8), which is crucial for consistency [28, 29, 30, 31]. The threshold $\gamma_{t}$ also decays over time. Initially, the estimate update (8), with large contributions from the innovation terms, incorporates more information from the measurements. After several updates, as local estimates $x_{n}(t)$ become closer to the true value of the parameter, we expect the innovation to decrease in magnitude for uncompromised measurements. By reducing the threshold $\gamma_{t}$ over time, we limit the impact of compromised measurements without overly affecting the contribution from the noncompromised measurements.

Compared with SIU [5], SAGE uses the same innovation and consensus weights $\alpha_{t}$ and $\beta_{t}$ (11) but uses a different threshold sequence $\gamma_{t}$ (12). In [5], which considered homogeneous measurements without noise, we designed threshold $\gamma_{t}$ to be an upper bound on the magnitude of the innovation term for noncompromised measurements. That is, in [5], if measurement stream $p$ is not under attack, then, the innovation component associated with $p$ is guaranteed to have magnitude less than $\gamma_{t}$. When there is (unbounded) measurement noise, it is impossible to construct a threshold sequence with this property: even if measurement stream $p$ is not under attack, the noise may cause the innovation magnitude to exceed the threshold. So, instead of using the threshold sequence from [5], we use a new threshold sequence (12), which is more suitable for the noisy setting. Further, in SAGE, because the local measurements are heterogeneous, they can also, and will in general be, unobservable (that we refer to in this paper as locally unobservable). This differs with SIU where the agents measure directly the unknown (vector) parameter and so, in the absence of attacks, are (locally) observable.

III-B *Main Results: Strong Consistency of *SAGE

We present our main results on the performance of SAGE. The first result establishes the almost sure convergence of the SAGE algorithm (under a condition on the measurement streams under attack) and specifies its rate of convergence. Recall that $\mathcal{A}$ is the set of compromised measurement streams.

Theorem 1** (SAGE Strong Consistency).**

Let $\mathcal{A}=\left\{p_{1},\dots,p_{\left\lvert\mathcal{A}\right\rvert}\right\}$, \mathcal{H}_{\mathcal{A}}=\left[\begin{array}[]{ccc}h_{p_{1}}&\cdots&h_{p_{\left\lvert\mathcal{A}\right\rvert}}\end{array}\right]^{\intercal}, and $\mathcal{N}=\mathcal{P}\setminus\mathcal{A}$. If the matrix

[TABLE]

satisfies

[TABLE]

where

[TABLE]

then, for all $n$, we have

[TABLE]

for every $0\leq\tau_{0}<\min\left(\tau_{\gamma},\frac{1}{2}-\tau_{\gamma}\right).$

We are interested in determining the attacks against which SAGE is resilient. Theorem 1 provides a sufficient condition for the attacks on the measurements under which SAGE ensures strong consistency of all local estimates.444The ceiling at $\frac{1}{2}$ on the rate of convergence $\tau_{0}$ in Theorem 1 comes as a result of the measurement noise. This is the fastest rate at which the norm of the averaged measurement noise converges to [math]. This ceiling is not present in [5] because it assumed noiseless measurements. Due to heterogeneous measurements, this resilience condition (14) is different from the resilience condition in [5] (which assumed homogeneous measurements). This is necessary because, heterogeneous measurements provide different information about $\theta^{*}$ (e.g., when each measurement stream provides information about a single component of $\theta^{*}$), so the resilience of SAGE depends on which measurement streams are compromised.

This condition depends on $\mathcal{G}_{\mathcal{N}}$ (13), the observability Grammian of the noncompromised measurements, and $\Delta_{\mathcal{A}}$ (15), which captures the maximum disturbance caused by the compromised measurements. The minmum eigenvalue of $\mathcal{G}_{\mathcal{N}}$, $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)$ captures the redundancy of the noncompromised measurement streams in measuring $\theta^{*}$. For example, consider the case where all measurement vectors $h_{p}$ are canonical basis vectors, so that each scalar measurement stream provides information about one component of $\theta^{*}$. Then, there are at least $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)$ scalar streams measuring each component of $\theta^{*}$.

Intuitively, the resilience condition (14) states that there needs to be enough redundancy in the noncompromised measurements $\mathcal{N}$ to overcome the effects of any attack on the measurement streams in $\mathcal{A}$. Condition (14) is sufficient, but it is not always necessary for consistent estimation. As we will demonstrate through numerical examples, in some cases (i.e., for certain sets of compromised measurements $\mathcal{A}$), SAGE still guarantees strongly consistent local estimates even if (14) is not satisfied.

The optimization problem in (15) is nonconvex (since it is a constrained maximization of a convex function). As a consequence of Assumption 2, which states that $\left\lVert h_{p}\right\rVert_{2}=1$, we have $\left\lvert\mathcal{A}\right\rvert\geq\Delta_{\mathcal{A}}$. Then, a sufficient condition for (14) is

[TABLE]

The condition in (17) describes the total number of compromised measurement streams that are tolerable under SAGE, and we are interested in comparing this number against theoretical limits established in [25] for centralized (cloud) estimators.

Specifically, Theorem 3.2 in [25] states that, in the absence of measurement noise, a centralized estimator may tolerate attacks on any $s$ measurement streams and still consistently recover the value of the parameter if and only if the set of all measurement streams is $2s$-sparse observable. By tolerating attacks on any $s$ measurement streams, we mean that, no matter which $s$ measurement streams are under attack, and no matter how the attacker maniuplates those measurements, the estimator still produces consistent estimates. If an estimator is not resilient to attacks on $s$ measurements, it means that there is a specific set of $s$ measurements, and a specific way in which they are manipulated, such that the resulting estimate is not consistent. If the attacker compromises a different set of $s$ measurements, or changes the way the measurements are manipulated, the estimator may still produce consistent estimates. We again emphasize that the resilience condition (17) is a sufficient condition; under certain attacks, even if (17) is not satisfied, SAGE still produces consistently local estimates.

The following result relates the (relaxed) resilience condition (17) to sparse observability.

Theorem 2**.**

If $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)>\left\lvert\mathcal{A}\right\rvert$ for all $\left\lvert\mathcal{A}\right\rvert\leq s$, then, the set of all measurement streams $\mathcal{P}=\left\{1,\dots,P\right\}$ is globally $2s$-sparse observable. Now, let

[TABLE]

be the set of all unique measurement vectors $h_{p}$. If $\mathcal{V}$ is orthogonal, then $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)>\left\lvert\mathcal{A}\right\rvert$ only if $\mathcal{P}$ is $2s$-sparse observable.

In general, $2s$-sparse observability is a necessary condition for SAGE to tolerate attacks on any $s$ sensors. If the set of all unique measurement vectors $h_{p}$ is orthogonal, then, $2s$-sparse observability is also sufficient.

The scenario where $\mathcal{V}$, the set of all unique measurement vectors, is orthogonal arises when we are interested in estimating a high dimensional field parameter. For example, in air pollution monitoring, each component of the parameter $\theta^{*}$, which may be high dimensional, represents the pollutant concentration at a particular location. Each individual device is only able to measure concentrations of nearby locations. In this case, the rows $h_{p}^{\intercal}$ of the measurement matrix $H_{n}$ are the canonical basis (row) vectors, where each device measures a subset of the components of $\theta^{*}$. Recall that agents are interested in estimating the entire parameter $\theta^{*}$. When the measurement vectors $h_{p}$ are canonical basis vectors, the local measurements at each agent provide information about some, but not all, components of $\theta^{*}$. In order to estimate all of the components of $\theta^{*}$ when the measurements are not locally observable, the agents must exchange information with their neighbors.

For analyzing the resilience condition $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)>\left\lvert\mathcal{A}\right\rvert$, another case of interest is when $\theta^{*}$ is a scalar parameter. When $\theta^{*}$ is a scalar parameter, each (uncompromised) agent’s measurement stream is modeled by

[TABLE]

For the measurement model (19), the resilience condition $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)>\left\lvert\mathcal{A}\right\rvert$ becomes $\frac{\left\lvert\mathcal{A}\right\rvert}{P}<\frac{1}{2}.$ To ensure that SAGE produces strongly consistent local estimates of scalar parameters, it is sufficient to have a majority of the measurement streams remain uncompromised. For the scalar parameter and measurement model (19), the condition $\frac{\left\lvert\mathcal{A}\right\rvert}{P}<\frac{1}{2}$ is also necessary. If a majority of the measurement streams are compromised, then, the adversary may force the local estimates to converge to any arbitrary value. This is because the adversary may compromise measurement streams arbitrarily; $a_{n}(t)$ may take any (i.e., unbounded) value in (5). The condition $\frac{\left\lvert\mathcal{A}\right\rvert}{P}<\frac{1}{2}$ is also necessary for resilient centralized estimation [25].

IV Convergence Analysis: Proof of Theorem 1

This section proves Theorem 1, which states that, under SAGE, all local estimates are strongly consistent as long as the resilience condition (14) is satisfied ($\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)>\Delta_{\mathcal{A}}$). The proof of Theorem 1 requires several intermediate results that are found in the Appendix. The proof of Theorem 1 has two main components: we separately show that, in the presence of measurement attacks, the local estimates $x_{n}(t)$ converge a.s. to the mean of all of the agents’ estimates (i.e., the agents reach consensus on their local estimates), and that, under resilience condition (14), the mean estimate converges a.s. to the true value of the parameter. Unless otherwise stated, all inequalities involving random variables hold a.s. (with probability $1$).

IV-A Resilient Consensus

In this subsection, we show that the agents reach consensus. Let

[TABLE]

The vectors $\mathbf{x}_{t},\overline{\mathbf{y}}_{t}\in\mathbb{R}^{NM}$ collect the estimates and time-averaged measurements, respectively, of all of the agents. The matrix $\mathbf{K}_{t}\in\mathbb{R}^{P\times P}$ is a diagonal matrix whose diagonal elements are the saturating gains $k_{p}(t)$ for each measurement stream. The variable $\overline{\mathbf{x}}_{t}\in\mathbb{R}^{M}$ is the network average estimate (the mean of the agents’ local estimates) and $\widehat{\mathbf{x}}\in\mathbb{R}^{NM}$ collects the differences between the agents’ local estimate $x_{n}(t)$ and the network average estimate $\overline{\mathbf{x}}_{t}$.

Lemma 1**.**

Under SAGE, $\widehat{\mathbf{x}}$ satisfies

[TABLE]

for every $0\leq\tau_{3}<\tau_{\gamma}+\tau_{1}-\tau_{2}.$

Lemma 1 states that, under SAGE, the agents’ local estimates converge a.s. to the network average estimate at a polynomial rate. That is, the agents reach consensus on their local estimates even in the presence of measurement attacks. Under SAGE, the agents reaching consensus do not depend on the number of compromised measurement streams: the result in Lemma 1 holds even when all of the measurement streams fall under attack, as long as the inter-agent communication network is connected on average.

Proof:

From (8), we find that $\mathbf{x}_{t}$ follows the dynamics

[TABLE]

Then, from (29), we have that $\widehat{\mathbf{x}}_{t}$ follows the dynamics

[TABLE]

where

[TABLE]

From [28], we have that the eigenvalues of the matrix $I_{NM}-P_{NM}-\beta_{t}L\otimes I_{M}$ are [math] and $1-\lambda_{n}\left(L\right)$, for $n=2,\dots,N$, each repeated $M$ times.

Taking the $\ell_{2}$ norm of $\widehat{\mathbf{x}}_{t+1}$, we have

[TABLE]

where we have used the following relations to derive (32) from (30):

[TABLE]

Relation (33) follows from the definitions of $I_{NM}$ and $P_{NM}$, relation (34) follows from Assumption 2, and relation (35) follows from the definition of $K_{n}(t)$ (equation (9)). By definition, $\widehat{\mathbf{x}}_{t}\in\mathcal{C}^{\perp}$, where $\mathcal{C}\subseteq\mathbb{R}^{NM}$ is the consensus subspace

[TABLE]

and $\mathcal{C}^{\perp}$ is the orthogonal complement of $\mathcal{C}$. Since $\widehat{\mathbf{x}}_{t}\in\mathcal{C}^{\perp}$, we have $P_{NM}\widehat{\mathbf{x}}=0$. Lemma 7 in the appendix provides an upper bound for the first term on the right hand side of (32). Specifically Lemma 7 states that, for $t$ large enough, we have

[TABLE]

where $r(t)$ is an $\mathcal{F}_{t+1}$ adapted process that satisfies $0\leq r(t)\leq 1$ a.s. and $\mathbb{E}\left[r(t)|\mathcal{F}_{t}\right]\geq\frac{c_{r}}{(t+1)^{\tau_{2}}}$ for some $c_{r}>0$. Substituting (37) into (32), we have

[TABLE]

Lemma 6 in the appendix studies the stability of the relation in (38) and shows that $(t+1)^{\tau_{3}}\left\lVert\widehat{\mathbf{x}}\right\rVert_{2}$ converges a.s. to [math] for every $0\leq\tau_{3}<\tau_{\gamma}+\tau_{1}-\tau_{2}$. ∎

IV-B Network Average Behavior

This subsection characterizes the behavior of the network average estimate $\overline{\mathbf{x}}_{t}$. Specifically, we show that, under resilience condition (14), $\overline{\mathbf{x}}_{t}$ converges a.s. to the value of the parameter $\theta^{*}$. Define

[TABLE]

The term $\overline{\mathbf{e}}_{t}$ in (39) is the network average estimation error.

Lemma 2**.**

Define the auxiliary threshold

[TABLE]

where

[TABLE]

for arbitrarily small

[TABLE]

If the resilence condition (14) is satisfied, then, almost surely, there exists $T_{0}\geq 0,0<Y<\infty,0<W<\infty$ such that,

$\left\lVert\overline{\mathbf{w}}_{t}\right\rVert_{2}\leq\frac{W}{(t+1)^{\frac{1}{2}-\epsilon_{W}}}$* a.s.,* 2. 2.

$\left\lVert\widehat{\mathbf{x}}_{t}\right\rVert_{2}\leq\frac{Y}{(t+1)^{\tau_{3}}}$* a.s., and,* 3. 3.

if, for some $T_{1}\geq T_{0}$, we have $\left\lVert\overline{\mathbf{e}}_{T_{1}}\right\rVert_{2}\leq\overline{\gamma}_{T_{1}}$, then, $\left\lVert\overline{\mathbf{e}}_{t}\right\rVert_{2}\leq\overline{\gamma}_{t}$ for all $t\geq T_{1}$ a.s.

Proof:

From (8), we find that $\mathbf{e}_{t}$ follows the dynamics

[TABLE]

Lemma 4 in the appendix characterizes the a.s. convergence of the time-averaged noise $\overline{\mathbf{w}}_{t}$ and shows that

[TABLE]

for every $0\leq\delta_{0}<\frac{1}{2}.$ As a result of Lemma 1, we have

[TABLE]

for every $0\leq\tau_{3}<\tau_{\gamma}+\tau_{1}-\tau_{2}$.

We now consider the evolution $\overline{\mathbf{e}}_{t}$ along sample paths $\omega\in\Omega$ such that

[TABLE]

Note that the set of all such $\omega$ has probability measure $1$. The notation $\overline{\mathbf{e}}_{t,\omega}$ means the value of $\overline{\mathbf{e}}_{t}$ along the sample path $\omega$. As a result of (53) and (54), there exists finite $Y_{\omega}$ and $W_{\omega}$ such that, with probability $1$,

[TABLE]

Suppose that, at time $T_{1}$, $\left\lVert\overline{\mathbf{e}}_{T_{1},\omega}\right\rVert_{2}\leq\overline{\gamma}_{T_{1},\omega}$ (where, in (47), $Y=Y_{\omega}$ and $W=W_{\omega}$). We show that there exists finite $T_{0}$ such that if $T_{1}\geq T_{0}$, then, for all $t\geq T_{1}$, $\left\lVert\mathbf{e}_{t,\omega}\right\rVert\leq\overline{\gamma}_{t,\omega}$ a.s.

Specifically, we show that, for sufficiently large $T_{1}$, if $\left\lVert\overline{\mathbf{e}}_{T_{1},\omega}\right\rVert_{2}\leq\overline{\gamma}_{T_{1},\omega}$ then, $\left\lVert\overline{\mathbf{e}}_{T_{1}+1,\omega}\right\rVert_{2}\leq\overline{\gamma}_{T_{1}+1,\omega}$. We show that if $\left\lVert\overline{\mathbf{e}}_{T_{1},\omega}\right\rVert_{2}\leq\overline{\gamma}_{T_{1},\omega}$, then, $k_{p}(T_{1},\omega)=1$ for all $p\in\mathcal{N}$ (i.e., the magnitude of the innovations for noncompromised measurements $p$ are all below the threshold $\gamma_{t}$.) By the triangle inequality, we have, for all $p\in\mathcal{N}$,

[TABLE]

By definition of $\overline{\gamma}_{t}$, we have

[TABLE]

which means that

[TABLE]

As a result of (60), we have $k_{p}(T_{1},\omega)=1$ for all $p\in\mathcal{N}$.

Using (50), we analyze the dynamics of $\left\lvert\overline{\mathbf{e}}_{t}\right\rVert_{2}$. From (50), we have

[TABLE]

To derive (61), we use the fact that $k_{p}(t)\leq 1$ and $k_{p}(t)\left\lvert\overline{y}^{(p)}_{n}(t)-h_{p}^{\intercal}(t)x_{n}(t)\right\rvert\leq\gamma_{t}$ for all $p\in\mathcal{A}$ and for all $t$. Substituting (59) into (61), and using the fact that $k_{p}(T_{1},\omega)=1$ for all $p\in\mathcal{N}$, we have

[TABLE]

where

[TABLE]

To derive (62), we also use the fact that, for $T_{1}$ sufficiently large, $\frac{\alpha_{T_{1}}\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)}{N}\leq 1$ and

[TABLE]

Equation (64) follows from the fact that, by definition, $\mathcal{G}_{\mathcal{N}}=\sum_{p\in\mathcal{N}}h_{p}h_{p}^{\intercal}$ (equation (13)).

Using (62), we now find conditions on $T_{1}$ such that $\left\lVert\overline{\mathbf{e}}_{T_{1}+1,\omega}\right\rVert_{2}\leq\overline{\gamma}_{T_{1}+1,\omega}$. Define

[TABLE]

Note that $\overline{\gamma}_{t,\omega}=\frac{\overline{\Gamma}_{t,\omega}}{(t+1)^{\tau_{\gamma}}}$, $\overline{\Gamma}_{t,\omega}$ is increasing in $t$, and, for $t$ sufficiently large, $\overline{\Gamma}_{t,\omega}>0$. Without loss of generality, let $\widetilde{T}_{\omega}$ be defined such that, for all $t\geq\widetilde{T}_{\omega}$, (64) holds and $\overline{\Gamma}_{t,\omega}>0$. Since $\overline{\Gamma}_{t,\omega}$ is increasing in $t$, we have

[TABLE]

Thus, to find conditions on $T_{1}$ such that

[TABLE]

it is sufficient to find conditions on $T_{1}$ such that

[TABLE]

Since $\left\lVert\overline{\mathbf{e}}_{T_{1},\omega}\right\rVert_{2}\leq\overline{\gamma}_{T_{1},\omega}$, we may rearrange the right hand side of (62) so that (67) becomes

[TABLE]

where

[TABLE]

Note that

[TABLE]

where $\tau_{4}=\min\left(\tau_{3},\frac{1}{2}-\epsilon_{W}\right)$ and $c_{5}=\frac{P\left(Y_{\omega}+W_{\omega}\right)}{\overline{\Gamma}_{T_{1},\omega}}$. For

[TABLE]

the right hand side of (70) is nonnegative, and, after substitution of (70), the condition in (68) becomes

[TABLE]

where we have used the fact that, by definition (equation (11)), $\alpha_{T_{1}}=\frac{a}{(T_{1}+1)^{\tau_{1}}}$.

Since $(1-x)\leq e^{-x}$ for $x\geq 0$, (71) becomes

[TABLE]

Note that $\log\left(\frac{T_{1}+1}{T_{1}+2}\right)\geq 1-\frac{T_{1}+2}{T_{1}+1}=-\frac{1}{T_{1}+1}$, so a sufficient condition for (72) is

[TABLE]

Let $\tau_{5}=\min(\tau_{1}+\tau_{4}-\tau_{\gamma},1)$. By definition, $\tau_{5}>\tau_{1}$. Then, (73) is satisfied for all $T_{1}\geq\left(\frac{ac_{5}+N\tau_{\gamma}}{a\kappa}\right)^{\frac{1}{\tau_{5}-\tau_{1}}}-1$. Define

[TABLE]

If $T_{1}\geq T_{0}$ and $\left\lVert\overline{\mathbf{e}}_{T_{1},\omega}\right\rVert_{2}\leq\overline{\gamma}_{T_{1},\omega}$, then $\left\lVert\overline{\mathbf{e}}_{T_{1}+1,\omega}\right\rVert_{2}\leq\overline{\gamma}_{T_{1}+1,\omega}$. Since $T_{1}+1\geq T_{0}$, we then have $\left\lVert\overline{\mathbf{e}}_{t,\omega}\right\rVert_{2}\leq\overline{\gamma}_{t,\omega}$ for all $t\geq T_{1}$. This analysis holds for almost all sample paths $\omega$, and Lemma 2 follows. ∎

Lemma 2 states that, with probability $1$, there exists some finite time $T_{0}$ such that, if the $\ell_{2}$-norm of the network average error at some time $T_{1}\geq T_{0}$ falls below $\overline{\gamma}_{T_{1}}$, then, it will be upper bounded by $\overline{\gamma}_{t}$ for all $t\geq T_{1}$. The auxiliary threshold $\overline{\gamma}_{t}$ is defined in such a way that, if $\left\lVert\overline{\mathbf{e}}_{t}\right\rVert_{2}\leq\overline{\gamma}_{t}$, then, with probability $1$, $k_{p}(t)=1$ for all $p\in\mathcal{N}$. That is, if the network average error has $\ell_{2}$ norm less than the auxiliary threshold $\gamma_{t}$, then, SAGE does not affect the contribution of the uncompromised measurements in the agents’ local estimate updates. We now use Lemma 2 above to show that the network average estimate converges almost surely to $\theta^{*}$.

Lemma 3**.**

Under SAGE, if $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)>\Delta_{\mathcal{A}},$ then

[TABLE]

for every $0\leq\tau_{0}<\min\left(\tau_{\gamma},\frac{1}{2}-\tau_{\gamma}\right)$.

Proof:

We study the convergence of $\overline{\mathbf{e}}_{t}$ along sample paths $\omega\in\Omega$ for which Lemma 2 holds (such a set of sample paths has probabilty measure $1$). Consider a specific instantiation of $\left\lVert\overline{\mathbf{e}}_{t,\omega}\right\rVert_{2}$. There exists finite $T_{0}$ such that, if at any time $T_{1}\geq T_{0}$, $\left\lVert\overline{\mathbf{e}}_{T_{1},\omega}\right\rVert_{2}\leq\overline{\gamma}_{T_{1},\omega}$, then, for all $t\leq T_{1}$, $\left\lVert\overline{\mathbf{e}}_{t,\omega}\right\rVert_{2}\leq\overline{\gamma}_{t,\omega}$. Consider $t>T_{0}$. There are two possibilities: either 1.) there exists $T_{1}>T_{0}$ such that $\left\lVert\overline{\mathbf{e}}_{T_{1},\omega}\right\rVert_{2}\leq\overline{\gamma}_{T_{1},\omega}$, or 2.) for all $t\geq T_{0}$, $\left\lVert\overline{\mathbf{e}}_{t,\omega}\right\rVert_{2}>\overline{\gamma}_{t,\omega}.$ If the first case occurs, then, by Lemma 2, for $t\geq T_{1}$,

[TABLE]

which means that $\lim_{t\rightarrow\infty}(t+1)^{\tau_{0}}\left\lVert\mathbf{e}_{t}\right\rVert_{2}=0$ for every $0\leq\tau_{0}<\tau_{\gamma}$.

If the second case occurs, then, define

[TABLE]

Since $\left\lVert\overline{\mathbf{e}}_{t,\omega}\right\rVert_{2}>\overline{\gamma}_{t,\omega}$, $\widehat{K}_{t,\omega}<1$. By definition, the numerator in (77) is equal to $\gamma_{t}$. Recall that the sample $\omega$ is chosen from a set (of probabilty measure $1$) on which Lemma 2 holds, which means that there exists finite $Y_{\omega}$ and $W_{\omega}$ that satisfy $\left\lVert\widehat{\mathbf{x}}_{t,\omega}\right\rVert_{2}\leq\frac{Y_{\omega}}{(t+1)^{\tau_{3}}}$ and $\left\lVert\overline{\mathbf{w}}_{t,\omega}\right\rVert_{2}\leq\frac{W_{\omega}}{(t+1)^{\frac{1}{2}-\epsilon_{W}}}$. As a result, the denominator in (77) satisfies

[TABLE]

for all $p\in\mathcal{N}$. Thus, we have

[TABLE]

for all $n\in\mathcal{N}$. Rearranging (77), we also have

[TABLE]

Substituting (78) and (79) into (61), we have

[TABLE]

To derive (LABEL:eqn:_avgConv5) from (61), we have used the fact that, for $t$ large enough,

[TABLE]

since, by definition, $\mathcal{G}_{\mathcal{N}}=\sum_{p\in\mathcal{N}}h_{p}h_{p}^{\intercal}.$ From (LABEL:eqn:_avgConv6), we show that $\left(t+1\right)^{\tau_{\gamma}}\widehat{K}_{t,\omega}\geq\widehat{K}_{\omega}$ for some $\widehat{K}_{\omega}>0$. It suffices to show that $\left\lVert\overline{\mathbf{e}}_{t,\omega}\right\rVert<\infty$. Note that there exists finite $T$ such that $\alpha_{T}\leq 1$. Because such a finite $T$ exists, to show $\left\lVert\overline{\mathbf{e}}_{t,\omega}\right\rVert<\infty$, it then suffices to only consider $t\geq T$ (since, for $t<T$, $\left\lVert\overline{\mathbf{e}}_{t,\omega}\right\rVert_{2}<\infty$ by definition). From (77), we have

[TABLE]

where $R_{\omega}=Y_{\omega}+W_{\omega}.$

Define the system

[TABLE]

where $\tau_{6}=\min\left(\tau_{3},\frac{1}{2}-\epsilon_{W}\right)$, with initial condition $m_{T}=\left\lVert\overline{\mathbf{e}}_{T,\omega}\right\rVert_{2}$. By definition, $m_{t}\geq\sup_{j\in\left[t,T\right]}\left\lVert\overline{\mathbf{e}}_{j,\omega}\right\rVert_{2}$. Further, from (49), we have $\tau_{\gamma}<\tau_{6}$, since $\tau_{\gamma}<\frac{1}{2}-\epsilon_{W}$ and $\tau_{\gamma}<\tau_{3}=\tau_{\gamma}+\tau_{1}-\tau_{2}$555By definition (11), $\tau_{1}>\tau_{2}$., so the system in (84) falls under the purview of Lemma 8. As a result, we have $\sup_{t\geq T}\left\lVert\overline{\mathbf{e}}_{t,\omega}\right\rVert_{2}<\infty.$ Since $\left\lVert\overline{\mathbf{e}}_{t,\omega}\right\rVert_{2}$ is bounded from above, we have that

[TABLE]

for some $\widehat{K}_{\omega}>0$. Substituting (85) into (LABEL:eqn:_avgConv6), we have

[TABLE]

Lemma 5 in the appendix studies the convergence of the systems in the form of (86). As a result, we have

[TABLE]

for every $0\leq\tau_{0}<\tau_{6}-\tau_{\gamma}$. By definition $\tau_{6}-\tau_{\gamma}=\min\left(\tau_{1}-\tau_{2}-\epsilon_{Y},\frac{1}{2}-\epsilon_{W}-\tau_{\gamma}\right)$. Taking $\epsilon_{Y},\epsilon_{W}$ arbitrarily close to [math], combining (87) with (76) and using the fact that $\tau_{\gamma}<\tau_{1}-\tau_{2}$, we have that (87) holds for every $0\leq\tau_{0}<\min\left(\tau_{\gamma},\frac{1}{2}-\tau_{\gamma}\right)$. Moreover (87) holds for every $\omega$ that satisfies Lemma 2, which yields (75). ∎

IV-C Proof of Theorem 1

Proof:

We show that, for all $n\in\left\{1,\dots,N\right\}$, as long as the resilience condition (14) (i.e., $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)>\Delta_{\mathcal{A}}$) is satisfied, we have

[TABLE]

for every $0\leq\tau_{0}<\min\left(\tau_{\gamma},\frac{1}{2}-\tau_{\gamma}\right).$ By the triangle inequality, we have

[TABLE]

Lemma 1 states that

[TABLE]

for every $0\leq\tau_{3}<\tau_{\gamma}+\tau_{1}-\tau_{2}$. Lemma 3 states that

[TABLE]

for every $0\leq\tau_{0}<\min\left(\tau_{\gamma},\frac{1}{2}-\tau_{\gamma}\right)$. Combining (88), (89), and (90) yields the desired result. ∎

V Resilience Analysis: Proof of Theorem 2

In this section, we prove Theorem 2, which relates the resilience condition $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)>\left\lvert\mathcal{A}\right\rvert$ to sparse observability. Theorem 2 states that a necessary condition for SAGE to tolerate attacks on any $s$ measurement streams is global $2s$-sparse observability. In addition, if the set of all unique measurement vectors $h_{p}$ is an orthogonal set, then global $2s$-sparse observability is sufficient for SAGE to tolerate attacks on any $s$ measurement streams.

Proof:

First, we show that if $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)>\left\lvert\mathcal{A}\right\rvert$ for all $\left\lvert\mathcal{A}\right\rvert\leq s$, then, the set of all measurement streams $\mathcal{P}$ is $2s$-sparse observable. We prove the contrapositive. Suppose that $\mathcal{P}$ is not $2s$-sparse observable. Then, there exists a set $\mathcal{X}\subseteq\mathcal{P}$ with cardinality $\left\lvert\mathcal{X}\right\rvert=2s$ such that $\mathcal{G}_{\mathcal{P}\setminus\mathcal{X}}=\mathcal{H}^{\intercal}_{\mathcal{P}\setminus\mathcal{X}}\mathcal{H}_{\mathcal{P}\setminus\mathcal{X}}$ is not invertible. Partition $\mathcal{X}$ as $\mathcal{X}=\mathcal{A}\cup\mathcal{A}^{\prime}$, where $\left\lvert\mathcal{A}\right\rvert=s$, $\left\lvert\mathcal{A^{\prime}}\right\rvert=s$, and $\mathcal{A}\cap\mathcal{A}^{\prime}=\emptyset$, and define $\mathcal{N}=\mathcal{P}\setminus\mathcal{A}$. Note that

[TABLE]

The minimum eigenvalue of $\mathcal{G}_{\mathcal{N}}$ satisfies [37]

[TABLE]

For any nonzero, unit norm $v$ in the nullspace of $\mathcal{G}_{\mathcal{P}\setminus\mathcal{X}}$, we have

[TABLE]

where the last inequality in (94) follows as a consequence of the Cauchy-Schwarz Inequality [37] $h_{p}^{\intercal}v\leq\left\lVert h_{p}\right\rVert_{2}\left\lVert v\right\rVert_{2}=1$. From (93) and (94), we have that $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)\leq\left\lvert\mathcal{A}\right\rvert$, which shows the contrapositive.

Second, we show that, under the condition that $\mathcal{V}$, the set of unique measurement vectors $h_{p}$, is orthogonal, if $\mathcal{P}$ is $2s$-sparse observable, then, $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)>\left\lvert\mathcal{A}\right\rvert$ for all $\left\lvert\mathcal{A}\right\rvert\leq s$. We resort to contradiction. Let $\mathcal{V}=\left\{v_{1},\dots,v_{\left\lvert\mathcal{V}\right\rvert}\right\}$. If $\left\lvert\mathcal{V}\right\rvert<M$, then, define $v_{\left\lvert\mathcal{V}\right\rvert+1},\dots,v_{M}$ so that $\left\{v_{1},\dots,v_{M}\right\}$ forms an orthonormal basis for $\mathbb{R}^{M}$. Suppose there exists $\mathcal{A}$ such that $\left\lvert\mathcal{A}\right\rvert\leq s$ and $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)\leq\left\lvert\mathcal{A}\right\rvert$. Define, for $m=1,\dots M$,

[TABLE]

Then, for any $v_{m}$, $m=1,\dots,M$, we have

[TABLE]

since, by the orthogonality of $\mathcal{V}$, we have $h_{p}^{\intercal}v_{m}=1$ if $h_{p}=v_{m}$ and $h_{p}^{\intercal}v_{m}=0$ if $h_{p}\neq v_{m}$. Equation (96) states that the eigenvalues of $\mathcal{G}_{\mathcal{N}}$ are $\left\lvert\mathcal{N}_{1}\right\rvert,\dots,\left\lvert\mathcal{N}_{M}\right\rvert$. Let $m^{*}=\operatorname*{arg\,min}_{m\in\{1,\dots,M\}}\left\lvert\mathcal{N}_{m}\right\rvert,$ and define $\mathcal{X}=\mathcal{A}\cup\mathcal{N}_{m^{*}}.$ Since $\lambda_{\min}\left(\mathcal{G}_{\mathcal{N}}\right)\leq\left\lvert\mathcal{A}\right\rvert\leq s$, we have $\left\lvert\mathcal{X}\right\rvert\leq 2s$. Then, we calculate the minimum eigenvalue of $\mathcal{G}_{\mathcal{P}\setminus\mathcal{X}}$ as

[TABLE]

Equation (97) indicates that the set of all measurement streams $\mathcal{P}$ is not $2s$-sparse observable, which is a contradiction and shows the desired result. ∎

VI Numerical Examples

We demonstrate the performance of SAGE through two numerical examples.

VI-A Homogeneous Measurements

In this first example, we consider a random geometric network of $N=500$ agents each making (homogeneous) measurements of an unknown parameter $\theta^{*}\in\mathbb{R}^{2}$.

The parameter $\theta^{*}$ may represent, for example, the location of a target to be tracked. Each agent makes a local stream of measurements $y_{n}(t)=\theta^{*}+w_{n}(t)$, where the measurement noise $w_{n}(t)$ is additive white Gaussian noise (AWGN) with mean [math] and covariance $\sigma^{2}I_{2}$. According to (17), SAGE is resilient to attacks on any set of $250$ measurement streams.

In this example, we consider four levels of local signal-to-noise ratio (SNR): -7 dB, -13 dB, -19 dB, and -25 dB. Note that, at these SNRs, even in the absence of attack, the noise at each local device is much stronger than the measured signal. We place agents uniformly at random on a two dimensional grid, and agents may communicate with nearby agents whose Euclidean distance is below a certain threshold. Figure 1 depicts the network setup for the first numerical example. Communication links may fail at random. In each iteration, each communication link fails (independently) with probability $0.1$ (i.e., $10\%$ chance of failure in each iteration). An adversary compromises the measurement streams of $100$ of the agents, chosen uniformly at random. In this example, the agents under attack have measurement streams $y_{n}^{a}(t)=-3\theta^{*}+w_{n}(t)$. 666 Although we use a fixed attack $a_{n}(t)$ in this simulation, recall that, in general, the attack $a_{n}(t)$ may be unbounded and time varying.

It is important to correctly choose $\alpha_{t}=\frac{a}{(t+1)^{\tau_{1}}}$, $\beta_{t}=\frac{b}{(t+1)^{\tau_{2}}}$, and $\gamma_{t}=\frac{\Gamma}{(t+1)^{\tau_{\gamma}}}$. The weight selection procedure (equations (11) and (12)) only require $a,b,\Gamma>0$, $0<\tau_{2}<\tau_{1}\leq 1$, and $\tau_{\gamma}<\min\left(\frac{1}{2},\tau_{1}-\tau_{2}\right)$. We use the following guidelines for selecting these weights in our numerical simulations. We choose

[TABLE]

where $L$ is the Laplacian of the fixed graph shown in Figure 1 (with no failing links). The effect of choosing different $\Gamma$ on the performance of SAGE also depends on the true value of $\theta^{*}$ and the adversary’s actions $a_{n}(t)$. Since we do not know these values, instead of providing a rule for choosing $\Gamma$, we show, for fixed $\theta^{*}$ and $a_{n}(t)$, the effect of choosing different $\Gamma$ on the estimator’s performance. For the decay rates $\tau_{1},\tau_{2}$, and $\tau_{\gamma}$, we choose

[TABLE]

We now explain our guidelines. From (61), we see that the evolution of $\left\lVert\overline{\mathbf{e}}_{t}\right\rVert_{2}$ depends on $\left\lVert I_{M}-\frac{\alpha_{t}}{N}\sum_{p\in\mathcal{N}}k_{p}(t)h_{p}h_{p}^{\intercal}\right\rVert_{2}$. If we choose $a=1$, then, we guarantee that

[TABLE]

for all $t$, which ensures, at each time step, a contractive effect on the evolution of $\left\lVert\overline{\mathbf{e}}_{t}\right\rVert_{2}$. Similarly, from (32), we see that the evolution of $\left\lVert\widehat{\mathbf{x}}_{t}\right\rVert_{2}$ depends on $\left\lVert I_{NM}\!-\!\beta_{t}L_{t}\!\otimes\!I_{M}\!-\!P_{NM}\right\rVert_{2}.$ If we consider the fixed graph Laplacian $L$ and choose $b=\frac{1}{\lambda_{N}\left(L\right)}$, then, we guarantee that

[TABLE]

for all $t$, which ensures, at each time step, a contractive effect on the evolution of $\left\lVert\widehat{\mathbf{x}}\right\rVert_{2}$. For choosing the decay rates, note that, in Theorem 1, the local estimates’ convergence rate is upper bounded by $\min\left(\tau_{\gamma},\frac{1}{2}-\tau_{\gamma}\right)$. We maximize this upper bound by selecting $\tau_{\gamma}=0.25$. To promote fast resilient consensus, we select a small decay rate for the consensus weight ($\tau_{2}=0.001$). Finally, we choose $\tau_{1}$ to be large enough ($\tau_{1}=0.26$) to satisfy $\tau_{\gamma}<\tau_{1}-\tau_{2}$. Choosing $\tau_{1}$ to be too large causes the innovation weight $\alpha_{t}$ to decay rapidly, which may slow down the convergence of the algorithm.

The agents follow SAGE with the following weights: $a=1,\tau_{1}=0.26,b=0.0337,\tau_{2}=0.001,\Gamma=5,\tau_{\gamma}=0.25$. We compare the performance of SAGE against the performance of the baseline consensus+innovations estimator [28, 29] with the same weights $a,\tau_{1},b,\tau_{2}$.

Figures 2 shows the evolution of the maximum of the local root mean squared error (RMSE) (across all agents) over iterations of SAGE and the baseline consensus+innovations estimator. We report the average of the maximum RMSE over $500$ trials. In the presence of adversaries, under SAGE, the local RMSE decreases with increasing number of iterations, while, under baseline consensus+innovations, there is a persistent local RMSE that does not decrease. Figure 2 shows that, under SAGE, higher local SNR yields lower RMSE.

Figure 3 shows the effect of choosing different $\Gamma$ on the maximum local RMSE (across all aents) after $1000$ iterations of SAGE. If we choose $\Gamma$ to be too small (e.g., at $-7\text{ dB}$ SNR, if $\Gamma<10^{-0.8}$), then, the thresholding is too aggressive, and we limit the contributions of noncompromised measurements to the estimate update. As we increase $\Gamma$, SAGE incorporates more information from the noncompromised measurements, resulting in lower RMSE. If we increase $\Gamma$ too much, however, SAGE becomes less effective at limiting the impact of the attacks, which results in higher RMSE. The “optimal” choice of $\Gamma$ (the choice of $\Gamma$ that provides the lowest RMSE in Figure 3) depends on the value of the parameter $\theta^{*}$ and the attack $a_{n}(t)$, which we do not know a priori.

The performance of SAGE also depends on the number of compromised measurement streams.

Figure 4 describes the relationship between the number of agents with compromised measurements and the maximum local RMSE (at a local SNR of $-13$ dB). We report the average maximum RMSE over $500$ trials, where in each trial, the adversary attacks a new set of agents chosen uniformly at random. Figure 4 shows that, for a fixed number of iterations of SAGE, the local RMSE increases as the number of agents under attack increases.777 When there is no measurement noise and the parameter is guarnteed to be bounded (i.e., $\left\lVert\theta^{*}\right\rVert\leq\eta$ for some $\eta>0$), reference [5] provides an analytical description of the relationship between the number of agents under attack and the local RMSE. We fit the exponential curve

[TABLE]

with $R^{2}=0.9603$, to describe the relationship between the number of compromised measurements $\left\lvert\mathcal{A}\right\rvert$ and the RMSE after $1000$ iterations of SAGE.

VI-B Heterogeneous Measurements

In the second example, we demonstrate the performance of SAGE with heterogeneous measurement models. The physical motivation for the example is as follows. We consider the network of $N=100$ robots placed in a two dimensional environment modeled by a $100\text{ unit }\times 100\text{ unit }$ grid (see Figure 5). Similar to the first example, the communication links in the network fail at random. In each iteration, each link fails independently with probability $0.1$. Each square of the grid has an associated $[0,255]$-valued safety score, which represents the state of that particular location. For example, a safety score of [math] may mean that there is an inpassable obstacle at a particular location, while a safety score of safety score of $255$ may represent a location that is completely free of obstacles. The unknown parameter $\theta^{*}\in[0,255]^{10,000}$ is the collection of safety scores over the entire environment. Each component of $\theta^{*}$ is the safety score at a single grid location. We represent the true value of $\theta^{*}$ an image (the image of the baboon in Figure 5), where each pixel value represents the score of a grid location.

The agents’ goal is to recover the entire image from their local measurements. Each agent measures the local pixel values in a 45 pixel by 45 pixel grid centered at its own location. The measurement of agent $n$ is

[TABLE]

where each measurement vector $h_{p}$ is a canonical basis vector. In this example, the $H_{n}$ matrices are chosen to emphasize local measurements. The measurement matrix $H_{n}$ “selects” in this simulation the components of $\theta^{*}$ corresponding to all grid locations within a $45$ pixel by $45$ pixel subgrid centered at the location of agent $n$. The measurement noise $w_{n}(t)$ is i.i.d. $\mathcal{N}\left(0,100I_{P_{n}}\right).$ The dimension $P_{n}$ of the measurement $y_{n}(t)$ depends on the location of the agent $n$. Agents in the center of the grid environment measure the states of $P_{n}=45\times 45=2025$ grid locations, while agents toward the edge of the environment have smaller $P_{n}$ (for example, agents in the corner of the environment have $P_{n}=22\times 22=484$). An adversary attacks $10$ agents and compromises all of their measurement streams: all compromised measurement streams $p\in\mathcal{A}$ take value $y_{n}^{(p)}(t)=255$. In total, there are $P=93,025$ measurement streams, and the adversary attacks $10$ agents and compromises $\left\lvert\mathcal{A}\right\rvert=16,082$ measurement streams.888 The set $\mathcal{A}$ is the set of compromised measurement streams, not the set of compromised agents. It is impractical to explicitly detect and identify each compromised measurement stream in this scenario, due to the combinatorial cost.

According to (17) and Theorem 2, SAGE is guaranteed to be resilient to attacks on any $4$ measurement streams, which is the same as the most resilient centralized estimator. That is, there exists a specific set of $5$ measurement streams, which, if compromised, prevents SAGE (and any other estimator) from consistently estimating $\theta^{*}$. Even though there exists a specific set of $5$ (or more) compromised measurement streams prevent SAGE from producing consistent estimates, in this simulation, we show that SAGE may still produce consistent estimates even the number of compromised measurements vastly exceeds four ($\left\lvert\mathcal{A}\right\rvert=16,082\gg 4$).

We use the same guidelines as in the first example to select the weights for SAGE: $a=1,\tau_{1}=0.26,b=0.0494,\tau_{2}=0.001,\Gamma=100,\tau_{\gamma}=0.25$. We compare the performance of SAGE against the performance of the baseline consensus+innovations estimator.

Figure 6 shows the evolution of the maximum local RMSE (over all agents) for SAGE and the baseline consensus+innovations estimator. We report the average of the maximum RMSE over $500$ trials. Under the measurement attacks, SAGE produces estimates with decreasing RMSE (with increasing number of iterations), while the baseline consensus+innovations estimator has a persistent local RMSE that does not decrease. Figure 7 compares the estimation results of SAGE and the baseline consensus+innovations estimator, after $800$ iterations of each algorithm. We reconstruct each pixel of the image using the worst estimate across all agents. Figure 7 shows that, under SAGE, all of the agents resiliently recover the image even when there are measurement attacks. In contrast, under the baseline consensus+innovations estimator, measurement attacks prevent the agents from consistently estimating $\theta^{*}$.

VII Conclusion

In this paper, we have studied resilient distributed estimation under measurement attacks. A network of IoT devices makes heterogeneous, linear, successive noisy measurements of an unknown parameter $\theta^{*}$ and cooperates over a sparse communication network to sequentially process their measurements and estimate the value of $\theta^{*}$. An adversary attacks a subset of the measurements and manipulates their values arbitrarily. This paper presented SAGE, the Saturating Adaptive Gain Estimator, a recursive, consensus+innovations estimator that is resilient to measurement attacks.

Under SAGE, each device applies an adaptive gain to its innovation (the difference between its observed and predicted measurements) to ensure that the magnitude of the scaled each innovation component is below time-varying, decaying threshold. This adaptive gain limits the impact of compromised measurements. As long as the number of compromised measurements is below a particular bound, then, we demonstrate that, for any on-average connected topology, SAGE guarantees the strong consistency of all of the (compromised and uncompromised) devices’ local estimates. When each measurement stream collects data about a single component of $\theta^{*}$, SAGE achieves the same level of resilience (in terms of number of tolerable compromised measurement streams) as the most resilient centralized estimator. For example, this could occur in air quality monitoring, when devices measure local pollutant concentrations corresponding to inidivudal components of the unknown parameter. Finally, we illustrated the performance of SAGE through numerical examples. Future work includes designing resilient estimators for dynamic (time-varying) parameters and dealing with measurement attacks that roam over the network.

The proof of Theorem 1 requires several intermediate results. The following result from [11] characterizes the behavior of time-averaged measurement noise.

Lemma 4** (Lemma 5 in [11]).**

Let $v_{1},v_{2},v_{3},\dots$ be i.i.d. random variables with mean $\mathbb{E}\left[v_{t}\right]=0$ and finite covariance $\mathbb{E}\left[v_{t}v_{t}^{\intercal}\right]=\Sigma.$ Define the time-averaged mean $\overline{v}_{t}=\frac{1}{t+1}\sum_{j=0}^{t}v_{t}.$ Then, we have

[TABLE]

for all $0\leq\delta_{0}<\frac{1}{2}.$

We will need to study the convergence properties of scalar, time-varying dynamical systems of the form:

[TABLE]

where

[TABLE]

$c_{1},c_{2}>0$, and $0<\delta_{1}<\delta_{2}<1$. The following Lemma from [28] describes the convergence rate of the system in (99).

Lemma 5** (Lemma 5 in [28]).**

The system in (99) satisfies

[TABLE]

for every $0\leq\delta_{0}<\delta_{2}-\delta_{1}.$

We will also need the convergence properties of the system in (99) when the $r_{1}(t)$ is random.

Lemma 6** (Lemma 4.2 in [31]).**

Let $\left\{w_{t}\right\}$ be an $\mathcal{F}_{t}$-adapted process satisfying (99), i.e., $w_{t+1}=\left(1-r_{1}(t)\right)w_{t}+r_{2}(t),$ where $\left\{r_{1}(t)\right\}$ is an $\mathcal{F}_{t+1}$-adapted process such that, for all $t$, $0\leq r_{1}(t)\leq 1$ a.s. and

[TABLE]

with $c_{1}>0$, $0\leq\delta_{1}<1$. Let $r_{2}=\frac{c_{2}}{(t+1)^{\delta_{2}}}$ with $c_{2}>0$ and $\delta_{1}<\delta_{2}<1$. Then, we have

[TABLE]

for every $0\leq\delta_{0}<\delta_{2}-\delta_{1}$.

To account for the effect of random, time-varying Laplacians, we use the following result from [31].

Lemma 7** (Lemma 4.4 in [31]).**

Let $\mathcal{C}\subseteq\mathbb{R}^{NM}$ be the consensus subspace, defined as

[TABLE]

and let $\mathcal{C}^{\perp}$ be the orthogonal complement of $\mathcal{C}$. Let $\left\{w_{t}\right\}$ be an $\mathcal{F}_{t}$-adapted process such that $w_{t}\in\mathcal{C}^{\perp}$. Also, let $\left\{L_{t}\right\}$ be an i.i.d. sequence of Laplacian matrices that is $\mathcal{F}_{t+1}$-adapted, independent of $\mathcal{F}_{t}$, and satisfies $\lambda_{2}\left(\mathbb{E}\left[L_{t}\right]\right)>0.$ Then, there exists a measurable $\mathcal{F}_{t+1}$-adapted process $\left\{r(t)\right\}$ and a constant $c_{r}>0$ such that $0\leq r(t)\leq 1$ a.s. and

[TABLE]

with

[TABLE]

for all sufficiently large $t$. The terms $\beta_{t}$ and $\tau_{2}$ are defined according to (11).

We will also need to analyze scalar, time-varying dynamical systems of the form:

[TABLE]

with initial condition $m_{0}\geq 0$, where $r_{1}(t)$ and $r_{2}(t)$ are given by (100), and $c_{3}>0$.

Lemma 8**.**

The system in (107) satisfies

[TABLE]

Proof:

First, we show that there exists finite $T$ such that $m_{T+1}=m_{T}$ and $r_{1}(T)<1$. We separately consider the cases of $T=0$ and $T>0$. If $m_{1}=m_{0}$ and $r_{1}(0)<1$, then the condition is satisfied for $T=0$. Otherwise, by construction, $m_{t}$ is a non-negative, non-decreasing sequence. Since $r_{1}(t)$ decreases in t, for $T$ large enough, we have $r_{1}(T)<1$ and $\left(1-\frac{r_{1}(T)}{m_{T}+c_{3}}\right)\geq 0$, which means that $\left\lvert\widehat{m}_{T+1}\right\rvert=\widehat{m}_{T+1}$. Further, this means that, for $T$ large enough, a sufficient condition for $m_{T+1}=m_{T}$ is $m_{T}\geq\widehat{m}_{T+1}$. Computing $m_{T}-\widehat{m}_{T+1}$, we have

[TABLE]

The term $\frac{m_{T}}{m_{T}+c_{3}}$ is increasing in $m_{T}$. Since $m_{T}$ is a nondecreasing sequence, we have

[TABLE]

for all $T>0$. To derive (110) from (109), we have used the fact that $m_{1}>0$, which is guaranteed by (107).

Then, letting $c_{4}=\frac{m_{1}}{m_{1}+c_{3}}$, substituting into (109), and performing algebraic manipulations, a sufficient condition for $m_{t}\geq\widehat{m}_{T+1}$ is

[TABLE]

which shows that there exists finite $T$ such that $m_{T+1}=m_{T}$. Second, we show that $m_{t}=m_{T}$ for all $t\geq T$. If $t\geq T$, then $t$ also satisifies the sufficient condition in (111), which means that $m_{T}=m_{T+1}=m_{T+2}=\dots$. Finally, we have $\sup_{t\geq 0}m_{t}=m_{T}<\infty.$ ∎