# ConAML: Constrained Adversarial Machine Learning for Cyber-Physical Systems

arXiv: https://arxiv.org/abs/2003.05631 · HTML: https://mlsanity.com/paper/2003.05631/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Mar 2020.

## Built on by (most cited first, 13 of 13)

- [A Unified Framework for Adversarial Attack and Defense in Constrained Feature Space](https://mlsanity.com/paper/2112.01156/) (2021)
- [Neural Network Guided Evolutionary Fuzzing for Finding Traffic Violations of Autonomous Vehicles](https://mlsanity.com/paper/2109.06126/) (2021)
- [On The Empirical Effectiveness of Unrealistic Adversarial Hardening Against Realistic Adversarial Attacks](https://mlsanity.com/paper/2202.03277/) (2022)
- [Constrained Adversarial Learning for Automated Software Testing: a literature review](https://mlsanity.com/paper/2303.07546/) (2023)
- [Robustness Testing of Data and Knowledge Driven Anomaly Detection in Cyber-Physical Systems](https://mlsanity.com/paper/2204.09183/) (2022)
- [Towards Adversarial-Resilient Deep Neural Networks for False Data Injection Attack Detection in Power Grids](https://mlsanity.com/paper/2102.09057/) (2021)
- [EaTVul: ChatGPT-based Evasion Attack Against Software Vulnerability Detection](https://mlsanity.com/paper/2407.19216/) (2024)
- [Learning-Based Vulnerability Analysis of Cyber-Physical Systems](https://mlsanity.com/paper/2103.06271/) (2021)
- [A Practical Adversarial Attack on Contingency Detection of Smart Energy Systems](https://mlsanity.com/paper/2109.06358/) (2021)
- [Adversarial Attacks on Leakage Detectors in Water Distribution Networks](https://mlsanity.com/paper/2306.06107/) (2023)
- [Insights on Adversarial Attacks for Tabular Machine Learning via a Systematic Literature Review](https://mlsanity.com/paper/2506.15506/) (2025)
- [Constrained Adversarial Perturbation](https://mlsanity.com/paper/2510.15699/) (2025)
- [GenAI-FDIA: Physics-Informed Generative Models for False Data Injection Attacks](https://mlsanity.com/paper/2605.18873/) (2026)

## Abstract (arXiv)

Recent research demonstrated that the superficially well-trained machine learning (ML) models are highly vulnerable to adversarial examples. As ML techniques are becoming a popular solution for cyber-physical systems (CPSs) applications in research literatures, the security of these applications is of concern. However, current studies on adversarial machine learning (AML) mainly focus on pure cyberspace domains. The risks the adversarial examples can bring to the CPS applications have not been well investigated. In particular, due to the distributed property of data sources and the inherent physical constraints imposed by CPSs, the widely-used threat models and the state-of-the-art AML algorithms in previous cyberspace research become infeasible. We study the potential vulnerabilities of ML applied in CPSs by proposing Constrained Adversarial Machine Learning (ConAML), which generates adversarial examples that satisfy the intrinsic constraints of the physical systems. We first summarize the difference between AML in CPSs and AML in existing cyberspace systems and propose a general threat model for ConAML. We then design a best-effort search algorithm to iteratively generate adversarial examples with linear physical constraints. We evaluate our algorithms with simulations of two typical CPSs, the power grids and the water treatment system. The results show that our ConAML algorithms can effectively generate adversarial examples which significantly decrease the performance of the ML models even under practical constraints.