How Sensor Attacks Transfer Across Lie Groups

TL;DR

This paper develops a geometric framework to analyze sensor attack transferability in cyber-physical systems modeled on Lie groups, revealing conditions for stealthy attack transfer and their physical impact during maneuvers.

Contribution

It introduces a Lie group-based analysis of sensor attack transferability, identifying key conditions and effects of noncommutativity on attack stealthiness and impact.

Findings

Transferability requires attack to commute with system dynamics.

Attacks outside invariant subspace alter residuals and are detectable.

Maneuvers can collapse transferable attack subspace, confirming detection bounds.

Abstract

Sensor spoofing analysis in cyber-physical systems is predominantly confined to linear state spaces, where attack transferability is trivial. On Lie groups, however, the noncommutativity of the dynamics can distort certain sensor attacks, exposing nominally stealthy attacks during complex maneuvers. We present a geometric framework characterizing when a sensor attack can transfer across operating conditions, preserving both its physical impact and stealthiness. We prove that successful transfer requires the attack to commute with the nominal dynamics (a Lie bracket condition), which isolates transferable attacks to an invariant subspace, while attacks outside this subspace identifiably alter residuals. For small deviations from ideal transferable attacks, our decomposition theorem reveals a fundamental asymmetry: the flow's Adjoint action amplifies the physical impact of the bracket-violating component. Furthermore, although the attack perturbs the innovation linearly, the accumulated error drift undergoes distortion via the Adjoint action. Finally, we demonstrate how turning maneuvers on a Dubins unicycle collapse the transferable subspace to a single direction, verifying that imperfect attacks remain within theoretical detection bounds.