# Learning-Based Vulnerability Analysis of Cyber-Physical Systems

arXiv: https://arxiv.org/abs/2103.06271 · HTML: https://mlsanity.com/paper/2103.06271/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 54 references that are in the map.
- First posted on arXiv 10 Mar 2021.

## Builds on (most cited first, 24 of 24)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [CARLA: An Open Urban Driving Simulator](https://mlsanity.com/paper/1711.03938/) (2017)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [Practical Black-Box Attacks against Machine Learning](https://mlsanity.com/paper/1602.02697/) (2016)
- [Adversarial Examples: Attacks and Defenses for Deep Learning](https://mlsanity.com/paper/1712.07107/) (2017)
- [Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack](https://mlsanity.com/paper/1907.02044/) (2019)
- [Adversarial Attacks on Neural Network Policies](https://mlsanity.com/paper/1702.02284/) (2017)
- [Tactics of Adversarial Attack on Deep Reinforcement Learning Agents](https://mlsanity.com/paper/1703.06748/) (2017)
- [Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving](https://mlsanity.com/paper/1907.06826/) (2019)
- [Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures](https://mlsanity.com/paper/2006.16974/) (2020)
- [Targeted Adversarial Perturbations for Monocular Depth Prediction](https://mlsanity.com/paper/2006.08602/) (2020)
- [Drift with Devil: Security of Multi-Sensor Fusion based Localization in High-Level Autonomous Driving under GPS Spoofing (Extended Version)](https://mlsanity.com/paper/2006.10318/) (2020)
- [ConAML: Constrained Adversarial Machine Learning for Cyber-Physical Systems](https://mlsanity.com/paper/2003.05631/) (2020)
- [Learning-based attacks in Cyber-Physical Systems: Exploration, Detection, and Control Cost trade-offs](https://mlsanity.com/paper/2011.10718/) (2020)
- [A Deep Learning-based Framework for Conducting Stealthy Attacks in Industrial Control Systems](https://mlsanity.com/paper/1709.06397/) (2017)
- [Coding Schemes for Securing Cyber-Physical Systems Against Stealthy Data Injection Attacks](https://mlsanity.com/paper/1605.08962/) (2016)
- [Integrating Security in Resource-Constrained Cyber-Physical Systems](https://mlsanity.com/paper/1811.03538/) (2018)
- [Relaxing Integrity Requirements for Attack-Resilient Cyber-Physical Systems](https://mlsanity.com/paper/1707.02950/) (2017)
- [Tuning Windowed Chi-Squared Detectors for Sensor Attacks](https://mlsanity.com/paper/1710.02573/) (2017)
- [The Vulnerability of Cyber-Physical System under Stealthy Attacks](https://mlsanity.com/paper/2002.01557/) (2020)
- [Attack-Resilient State Estimation with Intermittent Data Authentication](https://mlsanity.com/paper/2005.08122/) (2020)

## Built on by (most cited first, 1 of 1)

- [Probabilistic Segmentation for Robust Field of View Estimation](https://mlsanity.com/paper/2503.07375/) (2025)

## Abstract (arXiv)

This work focuses on the use of deep learning for vulnerability analysis of cyber-physical systems (CPS). Specifically, we consider a control architecture widely used in CPS (e.g., robotics), where the low-level control is based on e.g., the extended Kalman filter (EKF) and an anomaly detector. To facilitate analyzing the impact potential sensing attacks could have, our objective is to develop learning-enabled attack generators capable of designing stealthy attacks that maximally degrade system operation. We show how such problem can be cast within a learning-based grey-box framework where parts of the runtime information are known to the attacker, and introduce two models based on feed-forward neural networks (FNN); both models are trained offline, using a cost function that combines the attack effects on the estimation error and the residual signal used for anomaly detection, so that the trained models are capable of recursively generating such effective sensor attacks in real-time. The effectiveness of the proposed methods is illustrated on several case studies.