{"id":"9645b87a-2b2d-49b0-b5ea-46a681e7086b","arxiv_id":"1909.01477","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Low-pass filtering the residual before a chi-squared detector reduces the nominal covariance and makes low-frequency sensor attacks substantially easier to detect, at the cost of enabling new high-frequency stealthy attacks.","lead":"This paper shows that filtering the residual signal with a low-pass Butterworth filter shrinks the covariance of the chi-squared anomaly detector's test statistic, making low-frequency sensor attacks easier to detect, and that a sliding-mode observer's filtered switching term can estimate an ongoing attack. The work is aimed at control-system security, offering a simple retrofit for existing detectors and a way to reconstruct the attack waveform for mitigation.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1's covariance formula (18) is only a first-order truncation of the exact Euler-discretized covariance, and no bound on τωc is supplied; without such a bound the filtered detector's Lemma 1 threshold is not guaranteed to deliver the intended false alarm rate.","rationale":"The reader's weakest_assumption is exactly the Euler truncation, and I agree. I independently checked the un-truncated expression from the proof against the Euler Lyapunov equation for a scalar channel and found the paper's full expression algebraically consistent; the issue is not the Lyapunov step but the dropped O(a²) correction. In the likely parameter regime a = 0.012 the correction is about 1.7%, so the practical impact may be modest, which is why the concern supports conditionality rather than rejection. The paper itself flags the missing bound by writing 'if the sampling time is taken small enough the higher order terms vanish,' and it explicitly defers the full stealthy-attack characterization and the formal αf threshold to future work. These self-identified limitations do not invalidate the central idea, but they mean the headline sensitivity numbers are not yet independently reproducible: no ωc is stated for the filtered chi-squared example, no error bars are given on the 55%/7% alarm rates, and no Monte Carlo confidence interval is reported. The covariance formula is checkable and the derivation is parameter-free, so the central contribution remains credible; the threshold calibration claim needs a quantitative validity condition before the method is deployed. The reader's CONDITIONAL verdict already captures this, so no adjustment is needed.","tokens_in":9539,"tokens_out":11179,"duration_ms":107120,"concrete_test":"Set a = τωc using the sample period τ = 0.001 and the ωc actually used in the Section V-A simulation (the paper must supply this; if it is the ωc = 12 rad/s used in Section V-B, take a = 0.012). Compute the exact filtered covariance from the un-truncated expression in the proof of Theorem 1, form the normalized distance with the truncated covariance (18), and compute the true nominal false-alarm rate Pr(χ²_1 > 3.84 · [Σρ]_trunc/[Σρ]_exact). If the resulting rate is not within sampling error of 5%, or if re-running Fig. 1 with the exact normalization changes the 55%/7% alarm-rate gap by more than a few points, then the Lemma 1 calibration fails and the comparison must be re-run.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central analytical claim is Theorem 1, which gives the filtered residual covariance as Σρ = τωc/(2√2)Σr and then uses this in (25) to claim a chi-squared statistic with the threshold from Lemma 1. The proof obtains (18) from the exact Euler-discretized covariance by dropping all terms beyond first order in a = τωc. The un-truncated expression exhibited in the proof before (24) is [Σρ]ij = -a(a² - √2a + 2)/(a³ - 3√2a² + 8a - 4√2) · [Σr]ij. For small a this equals a/(2√2) · (1 + √2a + O(a²)) Σr, so the retained formula is only an O(a) approximation. No bound on a is stated. The Lemma 1 threshold is valid only if (18) is the exact covariance; otherwise zk is a scaled chi-square and the nominal false alarm rate differs from A*. Since the Section V-A comparison evaluates performance through alarm rates, a miscalibrated threshold could materially change the claimed 55%-vs-7% separation. The proof itself says 'if the sampling time is taken small enough the higher order terms vanish,' a self-admitted condition that is never quantified, and the ωc actually used in Section V-A is not reported. Thus the quantitative benefit of the filtered detector is tied to a first-order truncation whose regime of validity is unspecified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes two ways to use low-pass filtering to improve anomaly/attack detection in LTI control systems with Gaussian measurement noise. The first is a \"filtered chi-squared detector\": residual signals are passed through a bank of second-order Butterworth filters, and the paper derives (Theorem 1) that the steady-state covariance of the filtered residual is proportional to the unfiltered residual covariance, Σρ = (τωc/(2√2))Σr. This covariance is used to normalize a filtered distance measure so that it remains chi-squared with p degrees of freedom, allowing the standard Lemma 1 threshold to set the false alarm rate. The second approach uses a discontinuous (sliding-mode) observer whose filtered switching term approximates a smooth attack signal, giving yf ≈ δ̈ + aδ + bδ̇, and an anomaly detector based on the magnitude of yf. The paper demonstrates both methods on a second-order numerical example, reporting that the filtered chi-squared detector raises alarms at 55% under a small constant attack whereas the unfiltered detector raises alarms at only 7%, and that the sliding-mode observer reconstructs time-varying and constant attacks in the noise-free case.","tokens_in":9734,"tokens_out":4674,"duration_ms":48033,"significance":"If Theorem 1 is correct, the filtered chi-squared detector is a simple and potentially useful retrofit: filtering reduces the nominal covariance of the detection statistic, making low-frequency attacks easier to separate from noise while preserving the threshold-setting procedure of the standard chi-squared detector. The sliding-mode observer section offers a genuinely different detection paradigm, namely attack reconstruction via the filtered discontinuous term, and the noise-free comparison in Fig. 3 between measured and predicted residuals is a credible validation of equation (39). The analytical covariance computation is a parameter-free derivation from the stated stochastic assumptions rather than a curve fit, which is a strength. However, the central claim is currently supported only by a first-order truncation with no quantified error bound, so the quantitative 55%-versus-7% comparison rests on an unverified regime of validity. The overall idea is promising and within scope for the journal, but the missing error control and the empirically tuned threshold in Section IV are load-bearing limitations that require attention.","major_comments":[{"comment":"The proof of Theorem 1 obtains the exact covariance of the Euler-discretized filter, as exhibited before Eq. (24), and then drops all terms of order O((τωc)^2) and higher with the statement \"if the sampling time is taken small enough the higher order terms vanish.\" No quantitative bound on τωc is given, and the text does not state the cutoff frequency ωc used in the Section V-A experiment. Because Eq. (25) uses the truncated covariance to normalize the filtered residual and because Lemma 1's threshold is valid only when the normalized statistic is exactly chi-squared, the claimed false alarm rate A*=5% and the reported 55% alarm rate under attack are not guaranteed unless the truncation error is negligible at the chosen parameters. Please provide either a rigorous error bound on the covariance approximation or a numerical validation that the distribution of the left-hand side of (25) is sufficiently close to chi-squared at the parameters used in Fig. 1, and report ωc for that example.","section":"Section III-B, Theorem 1 (Eqs. (23)-(24))"},{"comment":"The threshold αf for the discontinuous-observer detector is not derived from a false alarm specification but is set empirically to the L∞-norm of the filter output measured under normal noisy operation. As the paper states, there is no formal procedure for determining αf. Consequently, the claim that attacks (44)-(45) \"can be identified\" in the noisy case is not accompanied by any characterization of the false alarm rate or the detection probability, so it cannot be compared quantitatively with the residual-based detectors. At minimum, the paper should report the empirical false alarm rate for the chosen αf and discuss how the threshold should be adjusted if the noise level changes.","section":"Section IV-A, Eq. (40)"},{"comment":"The derivation leading to yf ≈ δ̈ + aδ + bδ̇ assumes η=0 and assumes that the system is on the sliding surface (e1 = ė1 = 0). In the noisy example, the detector is applied directly to a noisy output without an analytic extension of the equivalent-control result, so the relationship between the filter output and the attack under noise (including the effect of finite c3 and chattering) is not established. Please clarify under what noise conditions and observer gains (39) remains a valid approximation, or restrict the claim to the noise-free case and treat the noisy case as purely empirical.","section":"Section IV, Eqs. (30)-(39)"}],"minor_comments":[{"comment":"The title contains a typo: \"Dete ction\" should be \"Detection.\"","section":"Title"},{"comment":"The phrase \"The recent work to to tune classical detectors\" contains a duplicated \"to.\"","section":"Introduction, paragraph 4"},{"comment":"\"apriori\" should be written as \"a priori.\"","section":"Section III-B, first paragraph"},{"comment":"\"worth nothing\" should be \"worth noting.\"","section":"Section IV-A, first paragraph"},{"comment":"Please report the number of Monte Carlo runs or the time horizon used to estimate the empirically reported alarm rates, since the rates are compared to four decimals (e.g., 7% and 55%).","section":"Section V-A, Fig. 1"}],"recommendation":"major_revision","confidential_remarks":"The main intellectual contribution is the covariance calculation in Theorem 1. The manuscript would be acceptable after the authors either provide a bound on the truncation error or demonstrate numerically that the chi-squared approximation holds at the chosen operating point. The empirical threshold in Section IV is a separate limitation that should be disclosed more prominently. No concerns about novelty or citation practice beyond the usual expectation that the authors cite prior filtering-based detection work if any exists."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nYou should know two things. First, the paper does something genuinely new: it analyzes what happens when you low-pass filter the residual before feeding it into the standard chi-squared detector, and it gives an explicit formula for the filtered covariance. That formula plus the normalized statistic (25) is the core contribution, and it is not in the cited attack-detection literature. Second, the proof of that formula is approximate in a way that is acknowledged but not quantified, and the example section omits the filter cutoff frequency, which is exactly the parameter that determines whether the approximation is good. So the paper is worth reading and citing, but the headline numbers should be taken with a grain of salt until the truncation error is bounded.\n\nThe good parts. Section III is a clear, honest treatment. The idea of retrofitting a filter to shrink the nominal residual covariance is simple and appealing, and the analytical covariance derivation (18) is the kind of thing practitioners want. The stealthy-attack discussion, while explicitly deferred for the filtered detector, correctly points out that the conventional zero-alarm attacks remain zero-alarm and that high-frequency attack content gets attenuated. Section IV reframes the sliding-mode disturbance estimation of [12] as an attack detector and validates (39) numerically; the measured and predicted residuals match in Fig. 3. The paper is also candid about its own limitations, which counts for a lot.\n\nThe soft spots. The main one is Theorem 1. The proof obtains the exact Euler-discretized covariance and then drops everything beyond first order in a = τωc, with no bound on a. The un-truncated expression in the proof shows the retained formula is O(a) accurate; the paper just says \"small enough τ.\" That is a load-bearing approximation because (25) and the Lemma 1 threshold inherit it. If the example uses T=0.001 and ωc is, say, a few rad/s, the error is negligible; if ωc is large, it is not. Not reporting ωc in Section V-A is a simple omission that makes the 55%-vs-7% alarm rate comparison impossible to reproduce. The Section IV threshold α_f is empirical and the false-alarm rate under noise is not characterized; the paper says this openly, but it means that detector is a demonstration, not a tuned method. None of these flaws are fatal to the central idea, but they need tightening.\n\nWho this is for: anyone working on model-based attack detection in control systems. A serious referee should see it; the right outcome is likely major revision with a bounded truncation error and a reproducible example.","headline":"Useful and honest paper on filtering residuals for attack detection, but the load-bearing covariance formula is only a first-order truncation and the paper never says how small the sampling time must be.","tokens_in":10357,"tokens_out":2585,"would_cite":true,"duration_ms":24175,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["93B12","93C05","93C57"],"pacs":[],"model":"deepseek-v4-flash","headline":"Filtering the anomaly-detection residual shrinks its nominal covariance by a factor of $\\tau\\omega_c/(2\\sqrt{2})$, so the chi-squared threshold stays valid while small attacks become far easier to detect.","keywords":["anomaly detection","cyber-physical system security","chi-squared detector","Butterworth filter","low-pass filtering","sliding-mode observer","stealthy attacks","residual-based detection"],"falsifier":"Compute the exact steady-state covariance of the discretized Butterworth filter keeping all terms in $\\tau\\omega_c$, form the normalized distance measure (25), and compare its empirical false alarm rate with the Lemma 1 threshold: if the rates depart from $A^*$ for $\\tau\\omega_c$ near 0.1-1, the small-$\\tau\\omega_c$ assumption fails and the detector is miscalibrated.","tokens_in":9240,"feed_emoji":"🔍","tokens_out":4313,"duration_ms":40157,"temperature":0.7,"pith_summary":"This paper asks whether the standard workhorse of attack detection, the residual-based chi-squared detector, can be made more sensitive by first low-pass filtering the residual. It argues yes: when a zero-mean Gaussian residual passes through a bank of second-order Butterworth filters, the filtered output is again zero-mean Gaussian with covariance scaled by $\\tau\\omega_c/(2\\sqrt{2})$, so the same threshold-tuning lemma still achieves the desired false alarm rate while small attacks become much easier to see. The paper also shows that a sliding-mode observer's filtered discontinuous term approximates $\\ddot{\\delta}+a\\delta+b\\dot{\\delta}$, so the anomaly can not only be detected but reconstructed. The payoff is a detection scheme that exploits the frequency separation between noise and attacks without disturbing the statistical calibration of the detector.","feed_headline":"A low-pass filter makes small sensor attacks obvious","feed_subtitle":"Exact covariance shrinkage keeps false alarms fixed while detection sensitivity jumps from 7% to 55%.","key_machinery":"The machinery that carries the argument is a bank of $p$ identical second-order Butterworth low-pass filters in state-space form, discretized with a first-order Euler step $\\Phi_d = I + \\Phi\\tau$ and $\\Psi_d = \\Psi\\tau$. Steady-state Riccati equations on each subblock give the filtered covariance elementwise, and dropping higher-order terms in $\\tau\\omega_c$ yields (18). The normalized distance measure built from $\\rho_k$ is the chi-squared statistic, and the equivalent-control method of sliding-mode theory converts the filtered sign term of the observer into an attack reconstruction.","core_discovery":"Theorem 1 is the load-bearing result: for a residual $r_k \\sim \\mathcal{N}(0,\\Sigma_r)$ passed through the second-order Butterworth filter (16)-(17) with bandwidth $\\omega_c$ and sampling time $\\tau$, the output $\\rho_k$ is zero-mean Gaussian with covariance $\\Sigma_\\rho = \\frac{\\tau\\omega_c}{2\\sqrt{2}}\\Sigma_r$. Because the filtered distance measure (25) normalizes by this smaller covariance, it remains chi-squared with $p$ degrees of freedom, so Lemma 1 supplies the threshold and the false alarm rate is preserved while the attack's effect on the statistic is magnified. A second claim, equation (39), is that filtering the discontinuous term of a robust sliding-mode observer yields $y_f \\approx \\ddot{\\delta}+a\\delta+b\\dot{\\delta}$, turning the detector into an attack reconstructor: for constant attacks the filter output is approximately $a\\delta_0$, which could be fed back to nullify the attack.","pith_inferences":["The covariance law (18) likely extends in spirit to higher-order Butterworth filters with a different numerical constant, giving a family of detectors with tunable noise rejection; this is not shown in the paper.","Because the scaling is linear in the cutoff frequency $\\omega_c$, lowering $\\omega_c$ shrinks the nominal covariance but also attenuates low-frequency attacks, so an optimal cutoff must balance detection sensitivity against attack bandwidth; the paper does not solve this tradeoff.","The same filtering idea could be applied to CUSUM or windowed chi-squared detectors, where the reduced nominal covariance would sharpen change-point statistics; the paper leaves this open.","An analytic threshold for the observer-based detector could replace the empirical $L_\\infty$-norm calibration, making its false alarm rate predictable; the paper explicitly leaves $\\alpha_f$ numeric."],"forward_implications":["The same threshold from Lemma 1 applies to the filtered detector, so upgrading an existing chi-squared detector requires no re-tuning of the false alarm rate.","Small constant attacks that change the alarm rate only from 5% to 7% without filtering push the filtered detector's alarm rate to 55%, making previously invisible attacks visible.","Stealthy attacks on the filtered detector must respect frequency content, not just amplitude, so high-frequency attack components are attenuated by the filter.","The robust observer with filter reconstructs smooth attacks as $y_f \\approx \\ddot{\\delta}+a\\delta+b\\dot{\\delta}$, enabling mitigation such as canceling constant attacks via feedback.","Because the filtered detector inherits the chi-squared calibration, its threshold remains meaningful even though the nominal covariance is much smaller."],"supporting_citations":[{"why":"Supplies the residual covariance $\\Sigma_r = C\\Sigma_e C' + \\Sigma_\\eta$ and Lemma 1's inverse-gamma threshold that the filtered detector inherits.","marker":"[13]"},{"why":"Provides the discontinuous sliding-mode observer whose filtered sign term yields the attack reconstruction (39).","marker":"[12]"},{"why":"Gives the equivalent-control method used to convert the filtered discontinuous term into $\\ddot{\\delta}+a\\delta+b\\dot{\\delta}$.","marker":"[14]"},{"why":"Establishes the windowed chi-squared detector tuning and false-alarm-rate framework that this paper extends with filtering.","marker":"[9]"},{"why":"Characterizes stealthy sensor attacks and their reachable-set impact, which the filtered detector further constrains.","marker":"[10]"},{"why":"Shows the generalized chi-squared tuning framework for non-Gaussian noise that the present detector builds on.","marker":"[11]"}],"fun_headline_variants":["Low-pass filter lifts anomaly detection from 7% to 55%","Filtering preserves false alarms while magnifying attack residuals","Butterworth filter turns residual detector into attack reconstructor","Filtering boosts detection sensitivity without changing false alarm rate"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Theorem 1's covariance formula assumes the sampling interval $\\tau$ is small enough that all terms of order $(\\tau\\omega_c)^2$ and higher vanish, and the paper gives no bound on $\\tau\\omega_c$ for when this truncation is accurate.","fun_headline_variants_meta":{"raw":{"variants":["Low-pass filter lifts anomaly detection from 7% to 55%","Filtering preserves false alarms while magnifying attack residuals","Butterworth filter turns residual detector into attack reconstructor","Filtering boosts detection sensitivity without changing false alarm rate"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000705,"raw_usage":{"total_tokens":3155,"prompt_tokens":900,"completion_tokens":2255,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":516,"completion_tokens_details":{"reasoning_tokens":2187}},"tokens_in":516,"tokens_out":2255,"duration_ms":15824,"temperature":1.0,"reasoning_tokens":2187,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T05:16:54.688785+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the exact steady-state covariance of the discretized Butterworth filter keeping all terms in $\\tau\\omega_c$, form the normalized distance measure (25), and compare its empirical false alarm rate with the Lemma 1 threshold: if the rates depart from $A^*$ for $\\tau\\omega_c$ near 0.1-1, the small-$\\tau\\omega_c$ assumption fails and the detector is miscalibrated.","supporting_citations":[{"cited_title":"Cusum and chi-squared attack d etection of compromised sensors,","cited_arxiv_id":null,"evidence_quote":"Supplies the residual covariance $\\Sigma_r = C\\Sigma_e C' + \\Sigma_\\eta$ and Lemma 1's inverse-gamma threshold that the filtered detector inherits."},{"cited_title":"Robust observation and identification of ndof lagrangian systems,","cited_arxiv_id":null,"evidence_quote":"Provides the discontinuous sliding-mode observer whose filtered sign term yields the attack reconstruction (39)."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Gives the equivalent-control method used to convert the filtered discontinuous term into $\\ddot{\\delta}+a\\delta+b\\dot{\\delta}$."},{"cited_title":"Tuning windowed chi- squared detectors for sensor attacks,","cited_arxiv_id":null,"evidence_quote":"Establishes the windowed chi-squared detector tuning and false-alarm-rate framework that this paper extends with filtering."},{"cited_title":"A comparison of st ealthy sensor attacks on control systems,","cited_arxiv_id":null,"evidence_quote":"Characterizes stealthy sensor attacks and their reachable-set impact, which the filtered detector further constrains."},{"cited_title":"Generalized chi-squared dete ctor for lti systems with non-gaussian noise,","cited_arxiv_id":null,"evidence_quote":"Shows the generalized chi-squared tuning framework for non-Gaussian noise that the present detector builds on."}],"review_version":1}