How to Calibrate your Adversary's Capabilities? Inverse Filtering for Counter-Autonomous Systems

TL;DR

This paper develops inverse filtering techniques to estimate an adversary's posterior, observation likelihood, and optimal state design in a Bayesian adversarial setting, aiding in counter-autonomous system strategies.

Contribution

It introduces novel inverse filtering methods for estimating adversary's beliefs and sensor accuracy, and formulates an input design problem to minimize estimation uncertainty.

Findings

Derived Bayesian inverse filtering algorithms for posterior estimation.

Developed maximum likelihood estimators for adversary's observation likelihood.

Formulated an optimal input design problem to reduce estimation covariance.

Abstract

We consider an adversarial Bayesian signal processing problem involving "us" and an "adversary". The adversary observes our state in noise; updates its posterior distribution of the state and then chooses an action based on this posterior. Given knowledge of "our" state and sequence of adversary's actions observed in noise, we consider three problems: (i) How can the adversary's posterior distribution be estimated? Estimating the posterior is an inverse filtering problem involving a random measure - we formulate and solve several versions of this problem in a Bayesian setting. (ii) How can the adversary's observation likelihood be estimated? This tells us how accurate the adversary's sensors are. We compute the maximum likelihood estimator for the adversary's observation likelihood given our measurements of the adversary's actions where the adversary's actions are in response to estimating our state. (iii) How can the state be chosen by us to minimize the covariance of the estimate of the adversary's observation likelihood? "Our" state can be viewed as a probe signal which causes the adversary to act; so choosing the optimal state sequence is an input design problem. The above questions are motivated by the design of counter-autonomous systems: given measurements of the actions of a sophisticated autonomous adversary, how can our counter-autonomous system estimate the underlying belief of the adversary, predict future actions and therefore guard against these actions.

Tables

Table 1. TABLE I: Comparison of Cramer Rao bounds for C 𝐶 C - classical state space model vs inverse Kalman filter model

$C^o$	Classic	Inverse
0.5	$0.24\times {10}^{-3}$	$5.3\times {10}^{-3}$
1.5	$1.2\times {10}^{-3}$	$37\times {10}^{-3}$
2	$2.1\times {10}^{-3}$	$70\times {10}^{-3}$
3	$4.6\times {10}^{-3}$	$336\times {10}^{-3}$

Equations

$$\begin{array}{rl}{x}_k& \sim P_{x_{k-1},x}=p(x|x_{k-1}),x_0\sim {\pi }_0\\ y_k& \sim B_{x_k,y}=p(y|x_k)\\ {\pi }_k& =T({\pi }_{k-1},y_k)\\ a_k& \sim G_{{\pi }_k,a}=p(a|{\pi }_k)\end{array}$$

$$T(\pi ,y)=\frac{B_{x,y}{\int }_{\mathcal{X}}{P}_{\zeta ,x}\pi (\zeta )d\zeta }{{\int }_{\mathcal{X}}{B}_{x,y}{\int }_{\mathcal{X}}{P}_{\zeta ,x}\pi (\zeta )d\zeta dx}$$

$${\alpha }_k({\pi }_k)=p({\pi }_k|a_{1:k},x_{0:k}).$$

$${\alpha }_{k+1}(\pi )=\frac{G_{\pi ,a_{k+1}}{\int }_{\Pi }{B}_{x_{k+1},y_{{\pi }_k,\pi }}{\alpha }_k({\pi }_k)d{\pi }_k}{{\int }_{\Pi }{G}_{\pi ,a_{k+1}}{\int }_{\Pi }{B}_{x_{k+1},y_{{\pi }_k,\pi }}{\alpha }_k({\pi }_k)d{\pi }_{k}d\pi }$$

$$\begin{gathered} p({\pi }_{k+1},y_{k+1},a_{1:k+1},x_{0:k+1})=p(a_{k+1}|{\pi }_{k+1})p(y_{k+1}|x_{k+1}) \\ \times p(x_{k+1}|x_k){\int }_{\Pi }p({\pi }_{k+1}|y_{k+1},{\pi }_k)p({\pi }_k,a_{1:k},x_{0:k})d{\pi }_k \end{gathered}$$

$$\Pi_{k}=\big{\{}T(\pi,y),\;y\in\mathcal{Y},\pi\in\Pi_{k-1}\big{\}},\quad\Pi_{0}=\{\pi_{0}\}.$$

$${\alpha }_{k+1}(\pi )=\frac{G_{\pi ,a_{k+1}}{\sum }_{\bar{\pi }\in {\Pi }_k}{B}_{x_{k+1},y_{\bar{\pi },\pi }}{\alpha }_k(\bar{\pi })}{{\sum }_{\pi \in {\Pi }_{k+1}}{G}_{\pi ,a_{k+1}}{\sum }_{\bar{\pi }\in {\Pi }_k}{B}_{x_{k+1},y_{\bar{\pi },\pi }}{\alpha }_k(\bar{\pi })}$$

$$\mathbb{E}\{{\pi }_{k+1}|a_{1:k+1},x_{0:k+1}\}=\sum _{\pi \in {\Pi }_{k+1}}\pi {\alpha }_{k+1}(\pi )$$

$$\begin{array}{rl}{x}_{k+1}& =A{x}_k+w_k,x_0\sim {\pi }_0\\ y_k& =C{x}_k+v_k\end{array}$$

$${\Sigma }_{k+1}^{-1}={\Sigma }_{k+1|k}^{-1}+C^{\prime }{R}^{-1}C,{\psi }_{k+1}={\Sigma }_{k+1}{C}^{\prime }{R}^{-1}$$

$${\bar{\Sigma }}_{k+1}^{-1}={\bar{\Sigma }}_{k+1|k}^{-1}+{\bar{C}}_{k+1}^{\prime }{\bar{R}}^{-1}{\bar{C}}_{k+1},{\bar{\psi }}_{k+1}={\bar{\Sigma }}_{k+1}{\bar{C}}_{k+1}^{\prime }{\bar{R}}^{-1}.$$

$$\begin{array}{rl}{\Sigma }_{k+1|k}& =A{\Sigma }_k{A}^{\prime }+Q\\ K_{k+1}& =C{\Sigma }_{k+1|k}{C}^{\prime }+R\\ {\hat{x}}_{k+1}& =A{\hat{x}}_k+{\Sigma }_{k+1|k}{C}^{\prime }{K}_{k+1}^{-1}(y_{k+1}-CA{\hat{x}}_k)\\ {\Sigma }_{k+1}& ={\Sigma }_{k+1|k}-{\Sigma }_{k+1|k}{C}^{\prime }{K}_{k+1}^{-1}C{\Sigma }_{k+1|k}\end{array}$$

$$a_k=\varphi ({\Sigma }_k){\hat{x}}_k+{ϵ}_k,{ϵ}_k\sim \text{ iid }N(0,{\sigma }_{ϵ}^2)$$

$$\begin{array}{rl}{\hat{x}}_{k+1}& =(I-{\psi }_{k+1}C)A{\hat{x}}_k+{\psi }_{k+1}{v}_{k+1}+{\psi }_{k+1}C{x}_{k+1}\\ a_k& =\varphi ({\Sigma }_k){\hat{x}}_k+{ϵ}_k,{ϵ}_k\sim \text{ iid }N(0,{\sigma }_{ϵ}^2)\\ & \text{ where }{\psi }_{k+1}={\Sigma }_{k+1|k}{C}^{\prime }{K}_{k+1}^{-1}\end{array}$$

$$\begin{array}{rl}{\bar{A}}_k& =(I-{\psi }_{k+1}C)A,{\bar{F}}_k={\psi }_{k+1}C,{\bar{C}}_k=\varphi ({\Sigma }_k),\\ {\bar{Q}}_k& ={\psi }_{k+1}{\psi }_{k+1}^{\prime },\bar{R}={\sigma }_{ϵ}^2\end{array}$$

$$\begin{split}\bar{\Sigma}_{k+1|k}&=\bar{A}_{k}\bar{\Sigma}_{k}\bar{A}_{k}^{\prime}+\bar{Q}_{k}\\ \bar{K}_{k+1}&=\bar{C}_{k+1}\bar{\Sigma}_{k+1|k}\bar{C}_{k+1}^{\prime}+\bar{R}\\ \hat{\hat{x}}_{k+1}&=\bar{A}_{k}\,\hat{\hat{x}}_{k}+\bar{\Sigma}_{k+1|k}\bar{C}_{k+1}^{\prime}\bar{K}_{k+1}^{-1}\\ &\hfill$\displaystyle\times\big{[}a_{k+1} - \bar{C}_{k+1} \left(\bar{A}_{k} \hat{x}_{k}+ \bar{F}_{k} x_{k+1} \right) \big{]}$\ignorespaces\\ \bar{\Sigma}_{k+1}&=\bar{\Sigma}_{k+1|k}-\bar{\Sigma}_{k+1|k}\bar{C}_{k+1}^{\prime}\bar{K}_{k+1}^{-1}\bar{C}_{k+1}\bar{\Sigma}_{k+1|k}\end{split}$$

$$p({\pi }_{0:k},y_{1:k}|x_{0:k},a_{1:k})\approx \sum _{i=1}^N\frac{w_k^{(i)}({\pi }_{0:k}^{(i)},y_{1:k}^{(i)})}{{\sum }_{j=1}^N{w}_k^{(i)}({\pi }_{0:k}^{(j)},y_{1:k}^{(i)})}\delta ({\pi }_{0:k}^{(i)},y_{1:k}^{(i)})$$

$$\begin{gathered} p({\pi }_{0:k},y_{1:k}|x_{0:k},a_{1:k})\propto p(a_k|{\pi }_k)p({\pi }_k|{\pi }_{k-1},y_k)p(y_k|x_k) \\ \times p(x_k|x_{k-1})p({\pi }_{0:k-1},y_{1:k-1}|x_{0:k-1},a_{1:k-1}) \end{gathered}$$

$$\begin{gathered} q({\pi }_{0:k},y_{1:k}|x_{0:k},a_{1:k})=q({\pi }_{0:k-1},y_{1:k-1}|x_{0:k-1},a_{1:k-1}) \\ \times q({\pi }_k,y_k|{\pi }_{0:k-1},y_{0:k-1},x_{0:k},a_{1:k}) \end{gathered}$$

$$w_k^{(i)}({\pi }_{0:k}^{(i)},y_{1:k}^{(i)})=\frac{p({\pi }_{0:k}^{(i)},y_{1:k}^{(i)}|x_{0:k},a_{1:k})}{q({\pi }_{0:k}^{(i)},y_{1:k}^{(i)}|x_{0:k},a_{1:k})}$$

$$\begin{gathered} w_k^{(i)}({\pi }_{0:k}^{(i)},y_{1:k}^{(i)})\propto w_{k-1}^{(i)}({\pi }_{0:k-1}^{(i)},y_{1:k-1}^{(i)}) \\ \times \frac{G_{{\pi }_k^{(i)},a_k}\delta ({\pi }_k^{(i)}-T({\pi }_{k-1}^{(i)},y_k^{(i)}))B_{x_k,y_k^{(i)}}{P}_{x_{k-1},x_k}}{q({\pi }_k^{(i)},y_k^{(i)}|{\pi }_{0:k-1}^{(i)},y_{0:k-1}^{(i)},x_{0:k},a_{1:k})} \end{gathered}$$

$$w_k^{(i)}({\pi }_{0:k}^{(i)},y_{1:k}^{(i)})\propto w_{k-1}^{(i)}({\pi }_{0:k-1}^{(i)},y_{1:k-1}^{(i)})G_{{\pi }_k,a_k}{P}_{x_{k-1},x_k}$$

$$({\tilde{\pi }}_k^{(i)},{\tilde{y}}_k^{(i)})\sim q({\tilde{\pi }}_k,y_k|{\pi }_{0:k-1}^{(i)},y_{1:k-1}^{(i)},x_{0:k},a_{1:k})$$

$${\eta }_k$$

$$u_k\in \mathcal{A}=\{1,2,\dots ,A\}$$

$$u_k=\arg \underset{u\in \mathcal{A}}{\min }\mathbb{E}\{c(x_k,u)|u_{1:k-1},y_k\}=\arg \underset{u\in \mathcal{A}}{\min }\{c_u^{\prime }{\eta }_k\}.$$

$${\pi }_k=T({\pi }_{k-1},u_k),\text{ where }T(\pi ,u)=\frac{R_u^{\pi }{P}^{\prime }\pi }{\sigma (\pi ,u)}$$

$$P(u_k=u|x_k=i,{\pi }_{k-1}=\pi )=\sum _{y\in \mathcal{Y}}\mathbb{P}(u|y,\pi )\mathbb{P}(y|x_k=i)$$

$$P(u_k=u|y,\pi )=\{\begin{array}{l}1\text{ if }{c}_u^{\prime }{B}_y{P}^{\prime }\pi \le c_{\tilde{u}}^{\prime }{B}_y{P}^{\prime }\pi ,\tilde{u}\in \mathcal{A}\\ 0\text{ otherwise. }\end{array}$$

$$R_u^{\pi }=R_u^l,\pi \in {\Pi }^l,l\in \{1,\dots ,A\}.$$

$$\Pi_{k}=\big{\{}T(\pi,u),\;u\in\mathcal{A},\pi\in\Pi_{k-1}\big{\}},\quad\Pi_{0}=\{\pi_{0}\}.$$

Full text

I Introduction

Bayesian filtering maps a sequence of noisy observations to a sequence of posterior distributions of the underlying state. This paper considers the inverse problem of reconstructing the posterior given the state and noisy measurements of the posterior; and also estimating the observation likelihood parameter and designing the state signal. That is we wish to construct an optimal filter to estimate the adversary’s optimal filtered estimate, given noisy measurements of the adversary’s action. Such problems arise in adversarial signal processing applications involving counter-autonomous systems: the adversary has a sophisticated autonomous sensing system; given measurements of the adversary’s actions we wish to estimate the adversary’s sensor’s capabilities and predict its future actions (and therefore guard against these actions).

I-A Problem Formulation

The problem formulation involves two players; we refer to the two players as “us” and “adversary”. With $k=1,2,\ldots$ denoting discrete time, the model has the following dynamics:

[TABLE]

Let us explain the notation in (1): $p(\cdot)$ denotes a generic conditional probability density function (or probability mass function), $\sim$ denotes distributed according to, and

• •

$x_{k}\in\mathcal{X}$ is our Markovian state with transition kernel $P_{x_{k-1},x}$ and prior $\pi_{0}$ where $\mathcal{X}$ denotes the state space.

• •

$y_{k}\in\mathcal{Y}$ is the adversary’s noisy observation of our state $x_{k}$; with observation likelihoods $B_{xy}$. Here $\mathcal{Y}$ denote the observation space.

• •

$\pi_{k}=p(x_{k}|y_{1:k})$ is the adversary’s belief (posterior) of our state $x_{k}$ where $y_{1:k}$ denotes the sequence $y_{1},\ldots,y_{k}$. The operator $T$ in (1) is the classical Bayesian filter [1]

[TABLE]

Let $\Pi$ denote the space of all such beliefs. When the state space $\mathcal{X}$ is Euclidean space, then $\Pi$ is a function space comprising the space of density functions; if $\mathcal{X}$ is finite, then $\Pi$ is the unit $X-1$ dimensional simplex of $X$-dimensional probability mass functions.

• •

$a_{k}\in\mathcal{A}$ denotes our measurement of the adversary’s action based on its current belief111More explicitly, the adversary chooses an action $u_{k}$ as a deterministic function of $\pi_{k}$ and we observe $u_{k}$ in noise as $a_{k}$. We encode this as $G_{\pi_{k},a_{k}}$. $\pi_{k}$ where $\mathcal{A}$ denotes the action space. Thus $G$ is the conditional probability (or density if $\mathcal{A}$ is continuum) of observing an action $a$ given the adversary’s belief $\pi$.

Figure 1 is a graphical representation of the model (1). The shaded nodes are known to us, while the white nodes are computed by the adversary and unknown to us. This is in contrast to classical Bayesian filtering where $y_{k}$ is known to us and $x_{k}$ is to be estimated, i.e, $\pi_{k}$ is to be computed.

I-B Objectives

Given (1), this paper considers the following problems:

Inverse Filtering: How to estimate the adversary’s belief given measurements of its actions (which are based on its filtered estimate of our state)? Assuming probability distributions $P,B,G$ are known, estimate the adversary’s belief $\pi_{k}$ at each time $k$, by computing posterior $p(\pi_{k}\mid\pi_{0},x_{0:k},a_{1:k})$. From a practical point of view, estimating the adversary’s belief allows us to predict (in a Bayesian sense) future actions of the adversary. In the design of counter-autonomous systems, this facilitates taking effective measures against such actions. 2. 2.

Covariance Bounds in Localization: Localization refers to estimating the underlying state $x$ when the transition kernel is identity; so state $x$ is a random variable. We consider the case where both us and the adversary do not know $x$. For the Gaussian case, we consider a sequential game setting involving us and the adversary estimating the underlying state. We show that the asymptotic covariance is twice as large as that of classical localization. 3. 3.

Parameter Estimation: How to remotely calibrate the adversary’s sensor? Assume $P,G$ are known and $B$ is parametrized by vector $\theta$. Compute the maximum likelihood estimate (MLE) of $\theta$ given $x_{0:N},a_{1:N}$ for fixed data length $N$. From a practical point of view, this determines the accuracy of the adversary’s sensor. 4. 4.

Optimal Probing. The transition kernel $P$ determines our random signal $x$ which “probes” the adversary’s sensor. What choice of $P$ yields the smallest variance in our estimate of the adversary’s likelihood $B$?

I-C Examples

1. Calibrating a Radar. Here “us” refers to a drone/UAV or electromagnetic signal that probes an adversary’s sophisticated multi-function radar system. The adversary’s radar records measurements $y_{k}$ of the drones kinematic state $x_{k}$ and its Bayesian tracking functionality computes $\pi_{k}$. The radar resource manager then chooses an action $u_{k}$ (e.g. waveform, beam orientation/aperture) and our inference/measurement of this action is $a_{k}$. The above problems then boil down to: estimating the adversary’s tracked estimate so as to predict its future actions (inverse filtering); determining the accuracy of the adversary’s radar system (parameter estimation), optimizing the drone’s trajectory to estimate $B$ accurately (optimal probing).

2. Electronic Warfare. Suppose $x_{k}$ is our electromagnetic signal applied to jam the adversary’s radar (e.g. a cross polarized signal where the phase evolves according to a Markov process). The radar responds with various actions. Our aim is to determine the effectiveness of the jamming signal; $B$ models the likelihood of the radar recognizing the jamming signal, $\pi_{k}$ denotes the radar’s belief of whether it is being jammed; and $a_{k}$ denotes the action we observe from the radar.

3. Interactive Learning. Although we do not pursue it here, the above model has strong parallels with those used in personalized education and interactive learning: $x_{k}$ denotes the quality/difficulty of material being taught; $B$ models how the learner absorbs the material; $\pi_{k}$ models the learner’s knowledge of the material and $a_{k}$ is the response to an exam administered by the instructor. The instructor aims to estimate the learner’s knowledge and the learner’s absorption probabilities to optimize how to present the material.

Simplifications: This paper makes several simplifying assumptions. First, we assume the adversary knows our transition kernel $P$ to compute the Bayesian belief using (2). In reality the adversary needs to estimate $P$ based on our trajectory; and we need to estimate the adversary’s estimate of $P$. Second, we assume that the adversary’s sensors are not reactive - that is, it does not know that we are probing it. If the adversary is a reactive low probability of intercept (LPI) radar, it will attempt to confuse our estimator resulting in a dynamical game. Both these simplifying assumptions point to a more general game-theoretic setting; which is the subject of future work.

I-D Related Works

Counter unmanned autonomous systems are discussed in [2]. Specifically, [2, Figure 1] places such systems at a level of abstraction above the physical sensors/actuators/weapons and datalink layers; and below the human controller layer.

This paper extends our recent works [3, 4, 5] where the mapping from belief $\pi$ to action $a$ was assumed deterministic. Specifically, [3] gives a deterministic regression based approach to estimate the adversary’s model parameters in a Hidden Markov model. In comparison, the current paper assumes a probabilistic map between $\pi$ and $a$ and develops Bayesian filtering algorithms for estimating the posterior along with MLE algorithms for $\theta$. There strong parallels between inverse filtering and Bayesian social learning [6] as described in Sec.II-D; the key difference is that in social learning the aim is to estimate the underlying state given noisy posteriors, whereas our aim is to estimate the posterior given noisy posteriors and the underlying state.

II Optimal Inverse Filter for Estimating Belief

Given the model (1) we now derive a filtering recursion for the posterior of the adversary’s belief given knowledge of our state sequence and recorded actions. Accordingly, define

[TABLE]

Note that the posterior $\alpha_{k}(\cdot)$ is a random measure since it is a posterior distribution of the adversary’s posterior distribution (belief) $\pi_{k}$.

Theorem 1**.**

The posterior $\alpha_{k}$ satisfies the following filtering recursion initialized by prior random measure $\alpha_{0}=p(\pi_{0})$:

[TABLE]

Here $y_{\pi_{k},\pi}$ is the observation such that $\pi=T(\pi_{k},y)$ where $T$ is the adversary’s filter (2). The conditional mean estimate of the belief is $\mathbb{E}\{\pi_{k+1}|a_{1:k},x_{0:k}\}=\int_{\Pi}\pi\alpha_{k+1}(\pi)d\pi$. ∎

Proof.

Start with the un-normalized density:

[TABLE]

Note that $p(\pi_{k+1}|y_{k+1},\pi_{k})=I(\pi_{k+1}-T(\pi_{k},y_{k+1}))$ where $I(\cdot)$ denotes the indicator function. Finally, marginalizing the above by integrating over $y_{k+1}$ and then normalizing yields (3). The $p(x_{k+1}|x_{k})$ term cancels out after normalization.

∎

We call (3) the optimal inverse filter since it yields the Bayesian posterior of the adversary’s belief given our state and noisy measurements of the adversary’s actions. At first sight, it appears that $\alpha_{k+1}$ does not depend on the transition kernel $P$. Actually $\alpha_{k+1}$ does depend on $P$ since from (2), $y_{\pi_{k},\pi_{k+1}}$ depends on $P$.

The rest of this section considers inverse filtering algorithms for evaluating $\alpha_{k}(\pi)$ for the following 5 cases:

Inverse Hidden Markov filter (finite dimensional but exponential computational cost in time) 2. 2.

Inverse Kalman filter (finite dimensional sequence of Kalman filters) 3. 3.

Sequential MCMC for inverse filtering; the structure faciliates using the so called “optimal importance” function. 4. 4.

Inverse filtering in multi-agent social learning 5. 5.

Inverse Bayesian localization involving conjugate priors (Gaussian likelihood and Gamma prior)

II-A Inverse Hidden Markov Model (HMM) Filter

We first illustrate the inverse filter (3) for the case where the adversary deploys a HMM filter. Suppose $\mathcal{X}=\{1,2,\dots,X\}$, $\mathcal{Y}=\{1,\ldots,Y\}$, $\mathcal{A}=\{1,\ldots,A\}$, implying that our state $\{x_{k},k\geq 0\}$ is a finite state Markov chain with transition matrix $P$ and the adversary has finite valued HMM observations $\{y_{k},k\geq 0\}$ with observation probability $B$. Then $T(\pi,y)$ in (2) is the classical HMM filter and the belief space $\Pi$ is the unit $X-1$ dimensional simplex, i.e., the space of $X$-dimensional probability vectors. Suppose (3) is initialized with $\alpha_{0}(\pi)=\delta(\pi-\pi_{0})$, i.e., the prior is a Dirac-delta function placed at $\pi_{0}\in\Pi$.

For $k=1,2,\ldots$ construct the finite sets $\Pi_{k}$ of belief states via the following recursion:

[TABLE]

Note $\Pi_{k}$ has $Y^{k}$ elements.

Using (3), the inverse HMM filter for estimating the belief reads: for $\pi\in\Pi_{k+1}$, the posterior and conditional mean are

[TABLE]

The inverse HMM filter (4) is a finite dimensional recursion, but the cardinality of $\Pi_{k}$ grows exponentially with $k$.

II-B Inverse Kalman Filter

We consider a second special case of (3) where the inverse filtering problem admits a finite dimensional characterization in terms of the Kalman filter. Consider a linear Gaussian state space model

[TABLE]

where $x_{k}\in\mathcal{X}={\rm IR}^{X}$ is “our” state with initial density $\pi_{0}\sim N(\hat{x}_{0},\Sigma_{0})$, $y_{k}\in\mathcal{Y}={\rm IR}^{Y}$ denotes the adversary’s observations, $w_{k}\sim N(0,Q_{k})$, $v_{k}\sim N(0,R_{k})$ and $\{w_{k}\}$, $\{v_{k}\}$ are mutually independent i.i.d. processes.

Based on observations $y_{1:k}$, the adversary computes the belief $\pi_{k}=N(\hat{x}_{k},\Sigma_{k})$ where $\hat{x}_{k}$ is the conditional mean state estimate and $\Sigma_{k}$ is the covariance; these are computed via the classical Kalman filter equations:222For localization problems, we will use the information filter form:

$\Sigma^{-1}_{k+1}=\Sigma_{k+1|k}^{-1}+C^{\prime}R^{-1}C,\quad\psi_{k+1}=\Sigma_{k+1}C^{\prime}R^{-1}$

(6) Similarly, the inverse Kalman filter in information form reads

$\bar{\Sigma}^{-1}_{k+1}=\bar{\Sigma}^{-1}_{k+1|k}+\bar{C}_{k+1}^{\prime}\bar{R}^{-1}\bar{C}_{k+1},\;\bar{\psi}_{k+1}=\bar{\Sigma}_{k+1}\bar{C}_{k+1}^{\prime}\bar{R}^{-1}.$

(7)

[TABLE]

The adversary then chooses its action as $\bar{a}_{k}=\phi(\Sigma_{k})\,\hat{x}_{k}$ for some pre-specified function333This choice is motivated by linear quadratic Gaussian control where the action (control) is chosen as a linear function of the estimated state $\hat{x}_{k}$ weighed by the covariance matrix $\phi$. We measure the adversary’s action as

[TABLE]

The Kalman covariance $\Sigma_{k}$ is deterministic and fully determined by the model parameters. So to estimate the belief $\pi_{k}=N(\hat{x}_{k},\Sigma_{k})$ we only need to estimate $\hat{x}_{k}$ at each time $k$ given $a_{1:k},x_{0:k}$. Substituting (5) for $y_{k+1}$ in (8), we see that (8), (9) constitute a linear Gaussian system with un-observed state $\hat{x}_{k}$, observations $a_{k}$, and known exogenous input $x_{k}$:

[TABLE]

$\psi_{k+1}$ is called the Kalman gain.

To summarize, our filtered estimate of the adversary’s filtered estimate $\hat{x}_{k}$ given measurements $a_{1:k},x_{0:k}$ is achieved by running “our” Kalman filter on the linear Gaussian state space model (10), where $\hat{x}_{k},\psi_{k},\Sigma_{k}$ in (10) are generated by the adversary’s Kalman filter. Therefore, our Kalman filter uses the parameters

[TABLE]

The equations of our inverse Kalman filter are:

[TABLE]

Note $\hat{\hat{x}}_{k}$ and $\bar{\Sigma}_{k}$ denote our conditional mean estimate and covariance of the adversary’s conditional mean $\hat{x}_{k}$.

II-C Particle Filter for Inverse Filtering

In general the optimal inverse filter (3) does not have a finite dimensional statistic. Also, the inverse HMM filter (4) is intractable for large data lengths. One needs to resort to an approximation such as sequential MCMC. Here we describe a particle filter that uses the optimal importance function (i.e., minimizes the variance of the importance weights). Due to the different dependency structure compared to classical state space models (see Figure 1), the updates for the importance weights given below are different compared to classical particle filters.

The particle filter constructs the $N$-point Dirac delta function approximation to the posterior as:444We assume here that the adversary computes the belief $\pi$ exactly. Of course, in reality, the adversary itself would use a sub-optimal approximation to the optimal filter.

[TABLE]

In complete analogy to the classical particle filter, we construct the sequential importance sampling update as follows:

[TABLE]

The importance density $q(\cdot)$ is chosen such that

[TABLE]

Then defining the importance weights

[TABLE]

(13), (14) yield the following time recursion:

[TABLE]

In particle filtering, it recommended to use the so called “optimal” importance density [7, 8], namely, $q^{*}=p(\pi_{k},y_{k}|\pi_{k-1},y_{k-1},x_{k},a_{k})$. Note that in our case q^{*}=p(\pi_{k}|\pi_{k-1},y_{k})\,p(y_{k}|x_{k},a_{k})=\delta\big{(}\pi_{k}-T(\pi_{k-1},y_{k})\big{)}\,p(y_{k}|x_{k}) is straightforward to sample from. Also using $q^{*}$, the importance weight update (15) becomes

[TABLE]

In summary, the particle filtering algorithm becomes:

Sequential Importance Sampling step: At each time $k$

• •

For $i=1,\ldots,N$ sample from importance density $q$ or $q^{*}$

[TABLE]

Set $(\tilde{\pi}_{0:k}^{(i)},y_{1:k}^{(i)})=(\pi^{(i)}_{0:k-1},\tilde{\pi}_{k}^{(i)},y^{(i)}_{1:k-1},\tilde{y}_{k}^{(i)})$.

• •

Update importance weights $w_{k}^{(i)}$ using (15) or (16).

Resampling/Selection step: Multiply/Discard particles with high/low normalised importance weights to obtain $N$ new particles with unit weight.

Finally, the particle filter estimate of the posterior $\pi_{k}$ at each time $k$ is $\mathbb{E}\{\pi_{k}|a_{1:k},x_{0:k}\}\approx\sum_{i=1}^{N}w_{k}^{(i)}\pi_{k}^{(i)}/\sum_{i=1}^{N}w_{k}^{(i)}$.

To summarize, the particle filter provides a tractable sub-optimal algorithm for inverse filtering and it is straightforward to sample from the optimal importance density.

II-D Inverse Filtering for Multiagent Social Learning Models

Thus far we have considered inverse filtering based on the graphical model in Figure 1. Below, motivated by Bayesian social learning models in behavioral economics and sociology (which is also now popular in signal processing), we consider inverse filtering for the graphical model depicted in Figure 2. The adversary now is a multi-agent system that aims to estimate the state of “our” underlying Markov state $x_{k}\in\{1,2,\dots,X\}$. The key difference compared to Figure 1 is that in Figure 2 the previous action taken by the adversary directly affects the dynamics of the belief update. Such social learning is motivated by multi-agent decision making in social groups/networks and can result in spectacular behavior such as cascades and herding; see [9] for an extensive signal processing centric discussion.

II-D1 Social Learning Protocol

We start by describing the classic Bayesian social learning protocol. In social learning, the multiagent adversary learns (estimates) our state based on their observations of the state and actions taken by previous agents. Each agent takes an action $u_{k}$ once in a predetermined sequential order indexed by $k=1,2,\ldots$ The index $k$ can also be viewed as the time instant when agent $k$ acts. Assume at the beginning of iteration $k$, all agents have access to the public belief $\pi_{k-1}$ defined in Step (iv) below.

The social learning protocol proceeds as follows [10, 6]:

(i) Private Observation: At time $k$, agent $k$ records a private observation $y_{k}\in\mathcal{Y}=\{1,2,\ldots,Y\}$ from the observation distribution $B_{iy}=P(y_{k}=y|x_{k}=i)$, $i\in\mathcal{X}$.

(ii) Private Belief: Using the public belief $\pi_{k-1}$ available at time $k-1$ (Step (iv) below), agent $k$ updates its private posterior belief $\eta_{k}(i)=\mathbb{P}(x_{k}=i|u_{1},\ldots,u_{k-1},y_{k})$ using the classical Bayesian filter (2) which reads:

[TABLE]

Here $\eta_{k}$ is an $X$-dimensional probability mass function (pmf).

(iii) Myopic Action: Agent $k$ takes action

[TABLE]

to minimize its expected cost

[TABLE]

Here $c_{u}=(c(i,u),i\in\mathcal{X})$ denotes an $X$ dimensional cost vector, and $c(i,u)$ denotes the cost incurred when the underlying state is $i$ and the agent chooses action $u$.

(iv) Social Learning Filter: Given the action $u_{k}$ of agent $k$, and the public belief $\pi_{k-1}$, each subsequent agent $k^{\prime}>k$ performs social learning to update the public belief $\pi_{k}$ according555For the reader unfamiliar with social learning, the remarkable aspect of the social learning filter is that the likelihood $R_{u}^{\pi}$ is an explicit function of the prior $\pi$; whereas in classical filtering the prior and likelihood are functionally independent. This dependence of the likelihood on the prior that causes social learning to have unusual behavior such as herding and information cascades. to the “social learning filter”:

[TABLE]

where $\sigma(\pi,u)=\mathbf{1}^{\prime}R^{\pi}_{u}P^{\prime}\pi$ is the normalization factor of the Bayesian update. In (19), the public belief $\pi_{k}(i)=P(x_{k}=i|u_{1},\ldots u_{k})$ and $R^{\pi}_{u}=\text{diag}(\mathbb{P}(u|x=i,\pi),i\in\mathcal{X})$ has elements

[TABLE]

where $I(\cdot)$ is the indicator function and $B_{y}$ are the classical observation likelihoods is defined in (17).

II-D2 Inverse Social Learning Filter

Given the above classical Bayesian social learning model, our aim is to estimate the public belief $\pi_{k}$ given the state sequence $x_{0:k}$ and noisy measurements $a_{1:k}$ of the agents actions $u_{1:k}$.

In order to proceed, first note that, as shown [11], the social learning filter (19) has the following property: The belief space $\Pi$ can be partitioned into $A$ (possibly empty) subsets denoted $\Pi^{1},\ldots,\Pi^{A}$ such that the prior dependent likelihood $R^{\pi}_{a}$ in (19) is a peiecewise constant function of prior belief $\pi$. i.e.,

[TABLE]

In complete analogy to Sec.II-A, we can now construct the inverse social learning filter: Let $G_{u,a}=\mathbb{P}(a|u)$.

For $k=1,2,\ldots$ construct $\Pi_{k}$ via the following recursion:

[TABLE]

Note $\Pi_{k}$ has $A^{k}$ elements. The inverse social learning filter computes the posterior $\alpha(\pi)$ and conditional mean of belief $\pi\in\Pi_{k+1}$ as follows:

[TABLE]

Here $u^{*}(\bar{\pi},\pi)$ is the action such that $\pi=T(\bar{\pi},u)$. Also, $y(\bar{\pi},\pi,u)$ is the observation such that (18) holds.

II-E Inverse Bayesian Localization using Conjugate Priors

We conclude this section by discussing a two-time scale inverse Bayesian localization problem. Recall that localization refers to the case where our state is a random variable $x_{0}$ instead of a random process.

II-E1 Model

Assume our state is a finite valued; so $x_{0}\in\{1,2,\dots,X\}$ is a random variable with prior $\pi_{0}$. (The transition kernel $P=I$). The adversary aims to localize (estimate) our state based on noisy measurements that are exponentially distributed (this models the received radar signal power)

[TABLE]

In (21), $\lambda_{0}\stackrel{{\scriptstyle\text{defn}}}{{=}}\lambda_{x_{0}}$ denotes the power gain parameter at the receiver when the true state is $x_{0}$. Note that $k$ indexes the slow time scale. The measurements $y_{k}$ are obtained by integrating the received power over a fast time scale defined below.

The adversary computes belief $\pi_{k}$ using the Bayesian filter (2) with $P=I$ and observation kernel $B_{x,y}$ with parameter $\lambda=(\lambda_{1},\ldots,\lambda_{X})^{\prime}$. Let $\bar{\pi}_{k}(i)=p(x,y_{1:k})$ denote the un-normalized posterior density at time $k$. Since $B_{xy}$ is an exponential density, each element $\log\bar{\pi}_{k}(i)$, $i\in\{1,2,\dots,X\}$ evolves with linear dynamics:

[TABLE]

Equivalently, relative to some fixed location 1, defining $\Delta_{k}(i)=\log\bar{\pi}_{k}(i)-\log\bar{\pi}_{k}(1)$, the dynamics of the adversary’s belief update are given by the linear stochastic system

[TABLE]

Let $t=1,\ldots,T$ denote the fast time scale at each epoch $k$. We assume that our measurement of the adversary’s radiated power in units of decibels (relative to location 1) at fast time scale $(t,k)$ in each location $i\in\{2,\dots,X\}$ is

[TABLE]

where $\mu_{i}$ is the path loss and $v_{t,k}(i)$ is zero mean unit variance iid Gaussian. Equivalently the absolute power is proportional to $\exp(\mu_{i})\,z_{t,k}(i)$ where $z_{t,k}(i)=(\pi_{k}(1)/\pi_{k}(i))^{v_{t,k}(i)}$ is log-normal distributed. The intuition behind (24) is as follows: Since the adversary’s radar radiates energy to location $i$ proportional to $\pi_{k}(i)$, so our variance of the measurement noise is inversely proportional to $\pi_{k}(i)$. Hence the scaling of the noise variance by $1/\Delta_{k}(i)$ in (24) in log-scale.

II-E2 Inverse Localization

The aim is to estimate adversary’s belief $\Delta_{k}$ given $a_{1:T,k}$, i.e., compute $p(\Delta_{k}|a_{1:T,k})$ given $x_{0}$. Recall $a_{1:T,k}=(a_{1,k},\ldots,a_{T,k})$. From (22)

[TABLE]

Denote $S_{k}=\sum_{n=1}^{k}y_{n}$. Since $\{y_{n}\}$ are iid exponential distributed, hence $S_{k}$ has a Gamma distribution with pdf

[TABLE]

The Gaussian likelihood (24) with Gamma prior for the precision (inverse of variance) form a Bayesian conjugate pair; implying that the posterior is also a Gamma distribution. Therefore, we have the following Bayesian estimator of the adversary’s relative belief $\Delta_{k}$:

Theorem 2**.**

For the model (21), (22), (24), our posterior of the adversary’s belief given $a_{1:T,k},x_{0}$ has a Gamma density:

[TABLE]

where $s\geq 0,b_{i}=k\log\lambda_{i}/\lambda_{1}+\log\Delta_{0}(i)$ and

[TABLE]

∎

III Sequential Localization Game: Covariance Bounds

Suppose our state $x_{0}$ is a random variable and the adversary localizes our state via a Bayesian estimator. We observe the adversary’s actions and estimate the adversary’s belief. Since the adversary’s belief $\pi_{k}$ converges to a Dirac mass centered on our state $x_{0}$ with probability one (under suitable regularity conditions666The Bernstein von-Mises theorem [12] yields a central limit theorem for the Bayesian estimator and therefore the asymptotic convergence rate.), our posterior $\alpha_{k}(\pi)$ computed via the inverse filter, will also converge with probability one to a Dirac mass centered on $x_{0}$. The question we address in this section is: How much slower is the convergence of our inverse filter compared to the adversary’s Bayesian filter?

To make our analysis illustrative, throughout this section, we consider a scalar-valued localization problem with the inverse Kalman filter. Assume $x_{0}\in{\rm IR}$ (scalar state), $A=1$, $C=1$, $Q=0$, $R=1$; so the adversary observes us with SNR 1. Assume the adversary’s prior is non-informative; so $\hat{x}_{0}=0_{X},\Sigma_{0}=\infty$.

III-A Localization and Inverse Kalman Filter

We start with an elementary but useful observation. Using the information filter (6), it readily follows that the adversary’s localization estimate is

[TABLE]

Supose we observe the adversary’s action with $\overline{\operatorname{SNR}}_{k}=\bar{C}_{k}^{2}/\bar{R}_{k}$ and initial condition $\bar{\Sigma}_{0}=\infty$. Then the covariance of our estimate (using inverse Kalman filter (10)) of the adversary’s belief evolves as

[TABLE]

From (25), it is easily seen that

[TABLE]

i.e., our covariance of the adversary’s state estimate is strictly smaller than the adversary’s covariance of our state.

III-B Sequential Localization Game in Adversarial Setting

Thus far we assumed that $x_{0}$ is known to us and our aim was to estimate the adversary’s estimate. In this section, our framework is different in two ways. First, we assume that neither us nor the adversary know the underlying state $x_{0}$. For example, $x_{0}$ could denote the threat level of an autonomous unidentified drone hovering relative to a specific location. Second, there is feedback; the adversary’s action affects our estimate and our action affects the adversary’s estimate.

The setup is naturally formulated in game-theoretic terms. The adversary and us play a sequential game to localize (estimate) $x_{0}$:

At odd time instants $k=1,3,\ldots$, the adversary takes active measurements of the target and makes decisions based on its estimate. We use measurements of the adversary’s decisions to localize the target. The details are as follows: The adversary has a noisy measurement $a_{k-1}=u_{k-1}+\epsilon_{k-1}$ where $u_{k-1}=\hat{x}_{k-1}$ is our action. The adversary assumes that our state estimate is $a_{k-1}$ and its Kalman filter (8) then yields the updated state estimate

[TABLE]

The adversary then takes action $u_{k}=\hat{x}_{k}$ to myopically minimize the mean square error of the estimate. We eavesdrop (observe) the adversary’s action in noise as $a_{k}=\hat{x}_{k}+\epsilon_{k}$. Assume $\epsilon_{k}\sim N(0,\sigma^{2}_{\epsilon})$ iid. So

[TABLE]

Since $a_{k-1}=u_{k-1}+\epsilon_{k-1}$, our effective observation equation of $x_{0}$ based on our measurement of the adversary’s action $a_{k}$ is

[TABLE]

We know all the quantities in the middle equation; $u_{k-1}$ was our action taken at time $k-1$, and $a_{k}$ is our measurement of the adversary’s action at time $k$.

To summarize, at odd time instants, $z_{k}=\frac{1-\psi_{k}}{\psi_{k}}\,\epsilon_{k-1}+v_{k}+\frac{\epsilon_{k}}{\psi_{k}}+x_{0}$ is our effective observation of the unknown state $x_{0}$ purely based on sensing the adversary’s actions. 2. 2.

At even time instants $k=2,4,\ldots,$ we take active measurements of the target and take actions based on our estimates. The adversary uses measurements of our actions to localize the target. We use our measurement $a_{k-1}$ of the adversary’s action, obtain a noisy observation $y_{k}$ of $x_{0}$ and then compute belief $\pi_{k}$. We then take action $u_{k}$ to myopically minimize the mean square error of the estimate. The adversary eavesdrops on (observes) our action in noise as $a_{k}$.

The above setup constitutes a social learning sequential game [13]. Since the decisions are made myopically each time (to minimize the mean square error), the strategy profile at each time constitutes a Nash equlibrium. More importantly [13, Theorem 5], the asymptotic behavior (in time) is captured by a social learning equlibrium (SLE).

Theorem 3**.**

Consider the sequential game formulation for localizing the random variable state $x_{0}$. Then for large $k$, the covariance of our estimate of the state $x_{0}$ is $\Sigma_{k}=2k^{-1}$ (which is twice the covariance for classical localization). The same result holds for the adversary’s estimate. ∎

Remark. Theorem 3 has two interesting consequences.

The asymptotic covariance is independent of $\sigma^{2}_{\epsilon}$ (i.e. SNR of our observation of the adversary’s action) as long as $\sigma^{2}_{\epsilon}>0$. If $\sigma^{2}_{\epsilon}=0$, there is a phase change and the covariance $\Sigma_{k}=k^{-1}$ as in the standard Kalman filter. 2. 2.

In the special case where only (26) is observed at each time (and the $\epsilon_{k-1}$ term is omitted), the formulation reduces to the Bayesian social learning problem of [6, Chapter 3]. In that case, [6, Proposition 3.1] shows that $\Sigma_{k}=O(k^{-1/3})$.

To summarize, Theorem 3 confirms the intuition that sequentially learning the state indirectly from the adversary’s actions (and the adversary learning the state from our actions) slows down the convergence of the localization estimator.

IV Maximum Likelihood Parameter Estimation of Adversary’s Sensor

So far we have discussed Bayesian estimation of the adversary’s belief state. In comparison, this section considers parameter estimation. Our aim is to estimate the adversary’s observation kernel $B$ in (1) which quantifies the accuracy of the adversary’s sensors. We assume that $B$ is parametrized by an $M$-dimensional vector $\theta\in\Theta$ where $\Theta$ is a compact subset of ${\rm IR}^{M}$. Denote the parametrized observation kernel as $B^{\theta}$. Assume that both us and the adversary know $P$ (state transition kernel777As mentioned earlier, otherwise the adversary estimates $P$ as $\hat{P}$ and we need to estimate the adversary’s estimate as $\hat{\hat{P}}$. This makes the estimation task substantially more complex.) and $G$ (probabilistic map from adversary’s belief to its action). Then given our state sequence $x_{0:N}$ and adversary’s action sequence $a_{1:N}$, our aim is to compute the maximum likelihood estimate (MLE) of $\theta$. That is, with $\mathcal{L}(\theta)$ denoting the log likelihood, compute

[TABLE]

IV-A General Purpose Optimization for MLE

The likelihood can be evaluated from the un-normalized version of the inverse filtering recursion (3) which reads

[TABLE]

Given the un-normalized filtering recursion (27), the log likelihood is the normalization term at time $N$:

[TABLE]

Given (28), the MLE can be computed using a general purpose numerical optimization algorithm such as fmincon in Matlab. This uses the interior reflective Newton method [14] for large scale problems and sequential quadratic programming [15] for medium scale problems. In general $\mathcal{L}(\theta)$ is non-concave in $\theta$ and the constraint set $\Theta$ is non-convex. So the algorithm at best will converge to a local stationary point of the likelihood function. General purpose optimizers such as fmincon in Matlab allow for the gradient $\nabla_{\theta}\mathcal{L}(\theta)$ and Hessian $\nabla_{\theta}^{2}\mathcal{L}(\theta)$ of the likelihood as inputs to the algorithm. These are typically computed via the so called sensitivity equations. For the general inverse filtering problem, the sensitivity equations are formidable.

Remark. EM Algorithm: The Expectation Maximization (EM) algorithm is a popular numerical algorithm for computing the MLE especially when the Maximization (M) step can be computed in closed form. It is widely used for computing the MLE of the parameters of a linear Gaussian state space model [16, 17]. Unfortunately, for estimating the adversary’s observation model, due to the time evolving dynamics in (11), the EM algorithm is not useful since the M-step involves a non-convex optimization that cannot be done in closed form. There is no obvious way of choosing the latent variables to avoid this non-convexity.

IV-B Estimating Adversary’s Gain Matrix in Linear Gaussian Case

Consider the setup in Sec.II-B where our dynamics are linear Gaussian and the adversary observes our state linearly in Gaussian noise (5). The adversary estimates our state using a Kalman filter, and we estimate the adversary’s estimate using the inverse Kalman filter (10). Using (28), (10), (11), the log likelihood for the adversary’s observation gain matrix $\theta=C$ based on our measurements is

[TABLE]

where $\iota_{k}$ are the innovations of the inverse Kalman filter (12). In (29), our state $x_{k-1}$ is known to us and therefore is a known exogenous input. Also note from (11) that $\bar{A}_{k},\bar{F}_{k}$ are explicit functions of $C$, while $\bar{C}_{k}$ and $\bar{Q}_{k}$ depend on $C$ via the adversary’s Kalman filter.

The following known result summarizes the consistency of the MLE for the for the adversary’s gain matrix $C$ in the linear Gaussian case.

Theorem 4**.**

Assume that $A$ is stable, and the state space model (5) is an identifiable minimal realization (which implies controllability and observability). Then the adversary’s Kalman filter variables $K_{k},\psi_{k},\Sigma_{k}$ converge to steady state values geometrically fast in $k$ [18] implying that asymptotically the system (10) is stable linear time invariant. Also, the MLE $\theta^{*}$ (maximizer for (29)) for the adversary’s observation matrix $C$ using (10) is unique and a strongly consistent estimator [19]. ∎

Numerical Examples. To provide insight, Figure 3 displays the log-likelihood versus adversary’s gain matrix $C$ using (29) in the scalar case. The parameters in the simulation are $A=0.4$, $Q=2$, $R=1$, $\sigma^{2}_{\epsilon}=1$ in (9) with $N=1000$. The four sub-figures correspond to true values of $C^{o}=0.5,1,5,2,3$ respectively.

Each sub-figure in Figure 3 has two plots. The plot in red is the log-likelihood of $C\in(0,10]$ evaluated based on the adversary’s observations using the standard Kalman filter. (This is the classical log-likelihood of the observation gain of a Gaussian state space model.) The plot in blue is the log-likelihood of $C\in(0,10]$ computed using (29) based on our measurements of the adversary’s action using the inverse Kalman filter (where the adversary first estimates our state using a Kalman filter) - we call this the inverse case.

Figure 3 shows that the log likelihood in the inverse case (blue plots) has a less pronounced maximum compared to the standard case (red plots). This implies that numerical algorithms for computing the MLE of the enemy’s gain using our observations of the adversary’s actions (via the inverse Kalman filter) will converge much more slowly than the classical MLE (which uses the adversary’s observations). This is intuitive - our estimate of the adversary’s parameter is based on the adversary’s estimate of our state - so there is more noise to contend with.

Cramer Rao (CR) bounds. Is it instructive to compare the CR bounds for MLE of $C$ for the classic model versus that of the inverse Kalman filters model. Table I displays the CR bounds (reciprocal of expected Fisher information) for the four examples considered above evaluated using via the algorithm in [20]. It shows that the covariance lower bound for the inverse case is substantially higher than that for the classic case. This is again consistent with the intuition that estimating the adversary’s parameter based on its actions (which is based on its estimate of us) is more difficult than directly estimating $C$ in a classical state space model.

V Optimal Probing of Adversary

Thus far we have discussed estimating the adversary’s belief state and observation matrix. This section deals with optimal probing also known as input design. Suppose our probe signal $x_{k}$ is a finite state Markov chain with transition matrix $P$. Recall from (1) that the adversary observes $x_{k}$ via observation probabilities $B$ and deploys a Bayesian filter (involving $P,B$) to compute its belief $\pi_{k}$, then chooses action $u_{k}$ that we observe as $a_{k}$. This section addresses the question: How should we choose the transition matrix $P$ of our probe signal $x_{k}$ to minimize the covariance of our estimate of the adversary’s observation kernel $B$?

Below we consider two approaches. The first approach is analytical – using stochastic dominance, we establish a partial ordering amongst probe transition matrices which results in a corresponding ordering of our SNR of the adversary’s actions. The second approach is numerical – we describe a stochastic gradient algorithm to optimize the probe transition matrix.

V-A Stochastic Dominance Ordering of Optimal Probing Transition Matrices

In this subsection, we construct a partial ordering for transition matrices $P$ of our probe signal $x_{k}$ which results in a corresponding ordering of our SNR of the adversary’s action. The result is useful since computing the optimal $P$ is non-trivial (see next subsection), yet we can compare the SNRs to two different probing signals without brute force computations. Note that maximizing this SNR can be viewed as a surrogate for minimizing the covariance of our estimate of the adversary’s observation kernel $B$.

V-A1 Assumptions

We assume (these assumptions are discussed below)

1. (A1)

$P$ is totally positive of order 2, see [21, 1]. That is every second order minor of $P$ is non-negative. 2. (A2)

The adversary chooses action $u_{k}=\phi(g^{\prime}\pi_{k})$ where $g$ is a vector with increasing elements and $\phi$ is any increasing non-negative function (e.g.  quantizer). Recall the adversary observes $x_{k}$ as $y_{k}$ and computes its Bayesian belief $\pi_{k}$ via (2) using the transition matrix $P$.

Given our observation $a_{k}=u_{k}+\epsilon_{k}$ of the adversary’s action $u_{k}$, define the signal to noise ratio

[TABLE]

V-A2 Copositive Dominance and Monotone Likelihood Ratio Dominance

In order to compare $\overline{\operatorname{SNR}}(P)$ for different probing transition matrices $P$, we introduce two definitions: copositive dominance of transition matrices and monotone likelihood ratio dominance of beliefs.

Copositivity generalizes positive semi-definiteness. Recall a matrix $L$ is positive semi-definite if $\pi^{\prime}L\pi\geq 0$ for all $\pi\in{\rm IR}^{X}$. In comparison, a matrix $L$ is copositive if $\pi^{\prime}L\pi\geq 0$ for all $X$-dimensional probability vectors $\pi$.

Given two transition matrices $P(1)$ and $P(2)$, define the matrices $L^{j}$, $j=1,\ldots X-1$ each of dimension $X\times X$ as

[TABLE]

Definition 5** (Copositive Ordering of Transition Matrices [1]).**

Given two transition matrices $P(1)$ and $P(2)$, we say that $P(1)$ is copositively dominated by $P(2)$, denoted as $P(1)\preceq P(2)$ if each matrix $L^{j,a}$, $j=1\,\ldots,X-1$ is copositive, i.e.,

[TABLE]

Next we define the monotone likelihood ratio partial order for probability mass functions.

Definition 6** (Monotone Likelihood Ratio (MLR) Dominance).**

Let $\pi_{1},\pi_{2}\in\Pi$ be any two probability vectors. Then $\pi_{1}$ is greater than $\pi_{2}$ with respect to the MLR ordering – denoted as $\pi_{1}\geq_{lr}\pi_{2}$ – if

[TABLE]

Similarly $\pi_{1}\leq_{lr}\pi_{2}$ if $\leq$ in (31) is replaced by a $\geq$.

The MLR stochastic order is useful in a Bayesian context since it is closed under conditional expectations. That is, $X\geq_{lr}Y$ implies $\mathbb{E}\{X|\mathcal{F}\}\geq_{lr}\mathbb{E}\{Y|\mathcal{F}\}$ for any two random variables $X,Y$ and sigma-algebra $\mathcal{F}$ [22].

Discussion of Assumptions: (A1) is widely used in Markov chain structural analysis; see [1] for specific examples and also the classic paper [21]. (A2) says that larger beliefs (wrt MLR order) of the adversary correspond to larger actions taken by the adversary. This implies that $u$ is increasing with our state $x$. For example, if $x$ denote the threat levels perceived by the adversary, then the larger our state, the larger the adversary’s action.

V-A3 Main Result

With the above definitions, we are now ready to state the main result of this subsection.

As shown in [1], copositive dominance is a sufficient condition for the one step Bayesian belief updates (2) using $P(1)$ and $P(2)$, respectively, to satisfy $T(\pi,y;P(1))\leq_{lr}T(\pi,y,P(2))$ where $\leq_{lr}$ denotes likelihood ratio dominance. Assumption (A1) globalizes this assertion and implies that adversary’s beliefs for transition matrices $P(1)$ and $P(2)$ satisfy $\pi^{P(1)}_{k}\leq_{lr}\pi^{P(2)}_{k}$ for all time $k$. This implies that $\mathbb{E}\{u_{k}^{2}\}$ using $P(1)$ is smaller than that using $P(2)$. We summarize this argument as the following result.

Theorem 7**.**

Suppose transition matrices $P(1)$, $P(2)$ satisfy (A1), (A2) and $P(1)\preceq P(2)$ (copositive ordering). Then

The belief updates using transition matrices $P(1)$ and $P(2)$ satisfy: $\pi^{P(1)}_{k}\leq_{lr}\pi^{P(2)}_{k}$ for all time $k$. 2. 2.

Therefore, our probe signal $\{x_{k}\}$ generated with transition matrix $P(1)$ incurs a smaller signal to noise ratio compared to probe signal with transition matrix $P(2)$, that is, $\overline{\operatorname{SNR}}(P(1))\leq\overline{\operatorname{SNR}}(P(2))$.

∎

To put the above theorem in context, note that evaluating $\overline{\operatorname{SNR}}(P)$ is non-trivial due to multiple levels of dynamics and dependencies: $P$ determines our probe signal; then the adversary observes our probe signal in noise, computes the posterior (using the Bayesian filter (2) with transition matrix $P$) and then responds with an action $u_{k}$ generated according to (A2) which we observe in noise. Despite this complexity, the theorem says that we can impose a partial order on the probe transition matrices $P$ resulting in a corresponding ordering of the SNR of our observation of the adversary’s action (which is a surrogate for the covariance of our estimate of $B$).

V-A4 Examples

We start with simple 2-state examples of (A1) and copositive dominance $P(1)\preceq P(2)$ for illustrative purposes; see [1] for several high dimensional examples:

[TABLE]

For examples (i) and (ii) above, (A1) and copositive dominance holds; so if (A2) also holds then Theorem 7 holds.

We now illustrate Theorem 7 with higher dimensional examples.

Example 1. Optimizing Probe Signal with Stopping Probability Constraints. Let state 1 denote the stopping (absorbing state). The transition matrix of our probe signal is of the form

[TABLE]

where $\theta_{i}\in[0,1/(X-1)]$, $i=2,\ldots,X$ so that $P(\theta)$ is a valid stochastic matrix. Then (A1) holds. Also $P(\theta)\preceq P(\bar{\theta})$ for $\theta<\bar{\theta}$ elementwise.

If state 1 is viewed as sending no probe signal, then the probe signal stops (to maintain a low probability of intercept constraint) at a random time whose expected value is determined by $\theta_{i}$. The larger $\theta_{i}$ is chosen, the higher the SNR of the adversary.

Example 2. Monotone Likelihood Ratio (MLR) ordered probability vectors. Suppose we have $L$ probability vectors $v_{i}$ each of dimension $X$ that are MLR ordered (see Defn. 6), i.e. $v_{1}\leq_{lr}v_{2}\cdots\leq_{lr}v_{L}$. We need to choose $X$ vectors out of these $L$ vectors to construct the transition matrix of our probe signal. Then the optimal probability vectors to choose for the transition matrix are $P(2)=\begin{bmatrix}v_{L-X+1},\cdots,v_{L-1},v_{L}\end{bmatrix}^{\prime}$. It can be shown that (A1) holds and $P(2)$ copositively dominates any other transition matrix $P(1)$ constructed from vectors $v_{1},\ldots,v_{L-X}$. Thus Theorem 7 implies that $P(2)$ yields the probe signal with the optimal SNR.

In summary, this subsection presented a partially ordering for the transition matrices of probe signals which resulted in a corresponding ordering of SNRs (surrogate for the covariance of our estimate of the adversary’s sensor gain).

V-B Stochastic Gradient Algorithm for Optimizing Probe

The previous subsection presented an analytical framework for characterizing the probe signals. Here we present a numerical stochastic gradient algorithm to solve the following stochastic optimization problem: Given our state sequence $x_{0:N}$ and observations of the adversary’s actions $a_{1:N}$, find the transition matrix $P^{*}$ of our probe signal that minimizes the variance of our estimate of the adversary’s likelihood:

[TABLE]

Here $\hat{B}$ is our MLE of $B$ given $a_{1:N}$ computed using the methods in Sec.IV, and $\operatorname{Var}(\hat{B})$ denotes the empirical variance.

Note that (32) is a constrained optimization problem since $P$ needs to be a valid stochastic matrix. We use the following trick to re-parametize the problem as an unconstrained optimization. We parametrize $P$ using spherical coordinates: Let $\theta_{ij}\in{\rm IR}$ for $i\in\{1,2,\dots,X\}$, $j=\{1,\ldots,X-1\}$ and define the parametrized transition matrix $P(\theta)$ as

[TABLE]

Note that even though $\theta$ is unconstrained, is straightforwardly verified that $P(\theta)$ is a valid stochastic matrix.888This approach is based on elementary differential geometry and is equivalent to constraining the derivative to a manifold that ensures the stochastic gradient update yields a valid transition matrix [23]. For $X=2$, the parametrization yields $\begin{bmatrix}\cos^{2}\theta_{11}&\sin^{2}\theta_{11}\\ \cos^{2}\theta_{21}&\sin^{2}\theta_{21}\end{bmatrix}$ which is always a valid transition matrix. Another possibility is to use logistic functions.

The stochastic optimization (32) can be solved using a stochastic gradient algorithm. The key issue is to estimate the gradient of the covariance of the MLE $B^{*}$ wrt $\theta$. Algorithm 1 uses one possible stochastic gradient algorithm, namely, the Simultaneous Perturbation Stochastic Approximation (SPSA) algorithm [24] to generate a sequence of estimates $\theta^{(I)}$, $I=1,2,\ldots,$ that converges to a local stationary point of the objective $J(P)$ defined in (32).

The SPSA Algorithm 1 [24] picks a single random direction $d_{n}$ along which direction the derivative is evaluated at each batch $n$. To evaluate the gradient estimate $\nabla_{\theta}J^{(I)}$ in (34), SPSA requires only 2 batch simulations, i.e., the number of evaluations is independent of dimension of parameter $\theta$. Algorithm 1 converges to a local stationary point optimum of objective $J(P)$ (defined in (32)) with probability one. This is a straightforward application of techniques in [25] (which gives general convergence methods for Markovian dependencies).

VI Conclusions

This paper is an early step towards understanding adversarial signal processing problems in counter-autonomous systems. We presented four main results: First, we formulated the problem of estimating the adversary’s filtered density (posterior) given noisy measurements (adversary’s actions), when the adversary itself runs a Bayesian filter to estimate our state. Several such inverse filtering algorithms were proposed for various signal models. Second, we discussed sequential localization as a game between us and the adversary. The convergence of the inverse filter is slower compared to the adversary’s Bayesian filter. An interesting result was the phase transition in the asymptotic covariance. Third, we discussed how to compute the maximum likelihood estimate of the adversary’s observation matrix using the inverse filter. This allows us to calibrate the accuracy of the adversary’s sensors and therefore estimate the adversary’s sensor capability. Finally, we discussed how to adapt (control) our state to minimize the covariance of the estimate of the adversary’s observation likelihood. “Our” state can be viewed as a probe signal which causes the adversary to act; so choosing the optimal state sequence is an input design problem.

Estimating the posterior distribution and sensor gain of the adversary is a difficult problem. In general identifiability issues can arise for estimating the adversary’s sensor gain. Also geometric ergodicity (stability) of the inverse filter, that is, the inverse filter forgets its initial condition geometrically fast, is difficult to establish. There are several interesting extensions that can be considered in future work. One area is to study the convergence properties of the maximum likelihood estimate to the CRB for the inverse filtering case, i.e., sample complexity results for the error variance to converge to the CRB. Another extension is to estimate the utility function of the adversary based on its response, using for example, revealed preferences from microeconomics. Finally, a careful dynamic game theoretic formulation of counter-autonomous systems is of interest, where the specific forward and backward physical channel responses are considered.

Acknowledgment. Cornell PhD student Kunal Pattanayak did the simulations for generating Figure 3 and Table I. We thank Dr. Erik Blasch for several technical discussions. This work extends our previous papers to a Bayesian framework; we are grateful to Robert Mattila, Cristian Rojas and Bo Wahlberg at KTH for preliminary discussions.

Proof of Theorem 3

Our update dynamics via the Kalman filter are:

• •

At odd time instants, using effective observation $z_{k}$ (from the adversary) our state estimate and covariance evolves as

[TABLE]

Note: Even though $z_{k}$ has $\epsilon_{k}$ and $\epsilon_{k-1}$, since the update only happens every two time steps (odd times), they are statistically independent of $\epsilon_{k+2}$ and $\epsilon_{k+1}$ in $z_{k+2}$.

• •

At even time instants, using our own observation $y_{k}$,

[TABLE]

To analyze the convergence rate, consider the precision matrix $\mathcal{P}_{k}=\Sigma_{k}^{-1}$. The combined covariance update of (35), (36) is

[TABLE]

Thus asymptotically $\mathcal{P}_{k}=O(k)$ and $\Sigma_{k}=O(k^{-1})$. However, the initial behavior of the covariance exhibits slower decrease due to the last term in (37). It is straightforward (but tedious) to show that for large $k$, $\Sigma_{k}=2/k$.

Proof of Theorem 7

Let $\pi^{P(1)}_{k}$ and $\pi^{P(2)}_{k}$, denote the posteriors computed using Bayesian filter (2) with transition matrices $P(1)$ and $P(2)$ respectively, initialized with common prior $\pi_{0}$. Under (A1), it follows from [1, Theorem 10.6.1] that copositive dominance $P(1)\preceq P(2)$ implies the following sample path likelihood ratio dominance: $\pi^{P(1)}_{k}\leq_{lr}\pi^{P(2)}_{k}$ for all time $k$ where $\leq_{lr}$ denotes monotone likelihood ratio dominance. Since likelihood ratio dominance implies first order stochastic dominance [22], it follows that under (A2) that $g^{\prime}\pi^{P(1)}_{k}\leq g^{\prime}\pi^{P(2)}_{k}$. From (A2) $\phi(\cdot)$ is non-negative and increasing, and so $u^{P(1)}_{k}\leq u_{k}^{P(2)}$ implying $\mathbb{E}\{(u^{P(1)}_{k})^{2}\}\leq\mathbb{E}\{(u^{P(2)}_{k})^{2}\}$.