Robust and Efficient AI-Based Attack Recovery in Autonomous Drones

Alvaro A. Cardenas; Cihang Xie; Diego Ortiz Barbosa; Luis Burbano; Siwei Yang; Yinzhi Cao; Zijun Wang

REVIEW 3 major objections 5 minor 22 references

Robust and Efficient AI-Based Attack Recovery in Autonomous Drones

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that a generative-AI planner can replace precomputed safety targets with on-the-fly recovery goals chosen by a language model.

desk verdict A clearly written position paper proposing an LLM-plus-simplex recovery architecture for drones; the idea is plausible but the safety-critical verifier is deferred and there is no evaluation, so treat it as a proposal, not a result. read the letter →

arxiv 2505.14835 v1 pith:NT6AO3WD submitted 2025-05-20 cs.CR

Diego Ortiz Barbosa , Luis Burbano , Siwei Yang , Zijun Wang , Alvaro A. Cardenas , Cihang Xie , Yinzhi Cao This is my paper · ORCID

classification cs.CR

keywords dronerecoverysimplexarchitecturemultimodallargelanguagemodelsedgedevicestargetsetsGPSspoofingrandomizedsmoothingattack

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that autonomous attack recovery can be made adaptive by giving a large language model the job of choosing the recovery goal. Today's recovery controllers, built on the simplex architecture, are fast and safe but need safe target locations to be specified before the mission, so they fail when the environment changes or the attack is new. The proposed two-level design keeps the proven low-level recovery controller and adds a generative-AI planner that converts sensor observations, camera images, and context into the parameters $\theta$ of a safe target set. If this works, a spoofed or otherwise attacked drone could decide on its own where to land or hover safely, and its low-level controller would fly it there even with compromised sensors. The paper also argues the AI layer can be compressed to run on edge hardware and hardened against adversarial prompts.

What carries the argument

The load-bearing object is the two-level recovery loop. At the lower level sits the simplex architecture (a nominal controller plus a recovery controller that takes over when an alarm fires), concretely the Optimal Probabilistic Recovery (OPR) algorithm, which steers the drone to a target set $T(\theta)$ — for example a strip defined by three parameters $\theta_1,\theta_2,\theta_3$ — using stochastic optimal control even when sensors are compromised. At the higher level sits the generative-AI planner, a function $F:\mathcal{O}\times\mathcal{T}\times\mathcal{C}\to\Theta$ that takes observations, the target-set form, and context and returns the parameters $\theta$; the paper's visual example has a multimodal LLM rank candidate landing zones from the drone's camera feed. Between the two levels is the verifier, which is supposed to certify that the proposed $T(\theta)$ is safe and feasible; the paper identifies this certification as necessary work rather than a completed component. Supporting the edge-deployment claim are distillation to a sub-0.2B-parameter model, linear-complexity sequence architectures, and post-training quantization; supporting the security claim is randomized smoothing over masked prompts.

What would settle it

Run the full pipeline on a simulated or real quadcopter under GPS spoofing with no preloaded target zones, and time the loop from attack detection to certified recovery command. The central claim is falsified if the certified command arrives after the drone has descended below its safe altitude in a meaningful fraction of trials, or if the verifier rejects most LLM-proposed target sets as unsafe or infeasible.

Watch

Extended reading notes

Core claim

The central claim is that an LLM can produce the parameters $\theta$ that define the safe target set used by a low-level recovery controller, turning recovery planning from a pre-mission setup into a real-time, perception-driven decision. The paper formalizes the planner as a function $F: \mathcal{O} \times \mathcal{T} \times \mathcal{C} \to \Theta$ operating on observations, the chosen target-set form, and contextual/environmental conditions. An example target set is the strip $T(\theta)=\{x\in\mathbb{R}^n \mid \theta_1^\top x \ge \theta_2 \wedge \theta_1^\top x \le \theta_3\}$, so choosing a safe altitude band or landing zone becomes choosing three parameters. The paper reports that its lower-level Optimal Probabilistic Recovery controller already beats the RTR-LQR and Virtual Sensors baselines on recovery success and distance to the target center, and it argues that the remaining limitation — reliance on precomputed targets — is exactly what the generative-AI layer removes. A multimodal-LLM example reads a drone camera feed and returns ranked candidate landing coordinates with reasoning, and the authors explicitly defer the mechanism that would make the loop safe: a verifier that certifies the proposed target set as both safe and feasible.

Load-bearing premise

The architecture depends on an LLM, in the seconds after an attack, proposing a target set that is genuinely safe and reachable by the low-level controller, and on a verifier certifying that before the drone's remaining time runs out.

Editorial extensions

If this is right

Recovery planning stops depending on pre-mission safe zones: the LLM can generate target-set parameters from live observations and context during the mission.
A drone whose GPS is spoofed can still return to a safe altitude, because the low-level controller reconstructs trustworthy sensor values from physical models while the AI layer supplies the goal.
The AI layer could fit on the drone itself if distillation to sub-0.2B parameters, linear-complexity sequence models, and int8/binary quantization work as proposed, avoiding round-trip cloud delays.
Randomized smoothing over masked prompts is the proposed defense against adversarial inputs to the recovery planner, so a spoofing attacker cannot easily steer the LLM's target choice.
The same $T(\theta)$ formalism can express different recovery goals — altitude strips, landing zones, loitering regions — so one architecture can handle multiple mission-specific safe behaviors.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Inference: the unbuilt verifier, not the LLM, is the bottleneck; if certification cannot finish before the drone's time-to-collision, the hierarchy reduces to the precomputed-target approach the paper wants to escape.
Inference: a quantitative acceptance test for the paper's proposal would measure whether the LLM's top-ranked landing zone lies inside the low-level controller's reachable set across many spoofing scenarios; the paper does not yet report such a metric.
Inference: the proposal transfers beyond drones, since nothing in $F:\mathcal{O}\times\mathcal{T}\times\mathcal{C}\to\Theta$ or the strip target set is aircraft-specific; ground vehicles and maritime vessels could use the same propose-then-certify loop.
Inference: the paper's plan to test the AI layer against jailbreaking and prompt-leaking attacks matters more than it might seem, because a recovery planner that can be redirected by adversarial text is itself a new attack surface on the vehicle.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is a position paper, not a results paper, and the difference matters. The core idea is a hierarchical recovery architecture where an MLLM picks safe target set parameters θ and a lower-level simplex controller flies the drone there. That combination is new and relevant, but the paper stops exactly where the hard questions live: the verifier that would certify the MLLM's output is safe and reachable is deferred, and the quantitative plots are all taken from prior OPR work [20].

What is actually new: framing the LLM as a function F: O × T × C → Θ that outputs target set parameters, on top of a formal simplex recovery layer; the sketch of using masked-prompt majority voting as a robustness shield; and the discussion of edge deployment via distillation and quantization. These are reasonable research directions, and the paper does a decent job of motivating them with the RQ-170 incident and the observation that precomputed target sets break in dynamic environments. The writing is clear and the authors are honest: they say 'we plan' and 'our future work will evaluate,' so it is not an attempt to disguise a proposal as a completed study.

The soft spots are proportional to that honesty. The load-bearing assumption is that an LLM can produce parameters that a verifier can certify as safe and reachable. That verifier is named but not specified, so the architecture's safety story is open. Section 4's randomized smoothing is a sketch: for continuous Θ outputs, the epsilon ball and majority-vote rule are not defined, and there is no argument that the smoothed parameters stay inside the feasible region. Figures 2 and 3 are useful but test OPR only, not the AI layer. And the title's 'robust and efficient' outruns the evidence — no robustness or latency numbers appear.

Would I send this out to reviewers? Only if the venue has a position/vision paper track. As a regular security paper it would likely be desk-rejected for lack of evaluation, and that would be the right call. But the idea is worth engaging with: a pilot study showing, say, an MLLM choosing among a set of pre-computed safe strips, with a verifier checking feasibility, would turn this into a real submission. The current manuscript is a solid research plan, not a research result.

Referee Report

3 major / 5 minor

Summary. The paper proposes a hierarchical attack-recovery architecture for autonomous drones: a lower-level control-theoretic recovery controller based on the simplex architecture and the authors' prior OPR work, and a higher-level generative-AI layer, in which an LLM or multimodal LLM produces target-set parameters theta from sensor observations, target-set form, and environmental context. The manuscript outlines three challenges: autonomous recovery with common-sense reasoning, efficient edge-device deployment, and robustness of the GenAI component against adversarial inputs. It illustrates the recovery concept with a drone example and an MLLM landing-zone-selection use case. The paper explicitly states that a verifier for the safety and feasibility of LLM-generated target sets will be developed in future work, and its conclusion says that the architecture will be evaluated methodologically in future work.

Significance. If realized with rigorous guarantees, the proposed architecture would address a real gap: current simplex-based recovery controllers require precomputed target sets and cannot adapt to dynamic environments, and LLM common-sense reasoning could plausibly fill that gap. The paper usefully decomposes the problem into concrete research challenges and illustrates a plausible interaction between perception, reasoning, and control. Its strengths are the clear problem framing and the honest acknowledgment of deferred components. However, as submitted, the paper is a vision or position statement rather than an evaluated system: the central safety and feasibility link between the LLM output and the lower-level controller is asserted rather than demonstrated, the robustness mechanism is only sketched, and the only quantitative results are inherited from prior OPR work without experiments on the AI components.

major comments (3)

[Section 2 (paragraph after 'LLMs can produce the parameters theta')] The central claim that an LLM can act as F: O x T x C -> Theta and produce safe, feasible target-set parameters is unverified, and the paper itself says 'we will work on a verifier mechanism that certifies the safety and feasibility of the target set.' No verifier is specified, and no theorem, simulation, or experiment shows that an LLM/MLLM can generate parameters theta that the lower-level recovery controller can reach in time while preserving safety. This is load-bearing because the OPR/simplex guarantees apply only to a prescribed target set; without the verifier and without evidence of LLM reliability, the full architecture has no safety or liveness guarantee. The conclusion's statement that 'Our future work will evaluate this architecture methodologically' confirms that this central component is not demonstrated.
[Section 4 (randomized smoothing discussion)] The robustness mechanism is only a sketch and does not provide a certification for the continuous target-set parameters. The text says the method 'takes a majority vote based on an epsilon ball of each output, and then takes the averaged output as the final result' and claims it 'will ensure that the output will not change much given an adversarial input.' For a safety-critical recovery controller, 'will not change much' is not a guarantee: the paper does not define the relevant metric or epsilon ball on Theta, does not specify how masking tokens corresponds to a smoothing distribution, and does not prove that the smoothed output remains inside a certified safe and feasible target set. This leaves the robustness challenge without a formal foundation.
[Sections 1-3 (Figures 2 and 3 versus proposed architecture)] The only quantitative results in the paper, Figures 2 and 3, are inherited from the prior OPR work [20] and evaluate the lower-level recovery controller, not the proposed AI-based architecture. The efficiency claims in Section 3 are plans ('our aim', 'we plan to pioneer') with no measured latency, model size, accuracy, or hardware evaluation, and the robustness discussion in Section 4 is not accompanied by experiments. Consequently, the title's claims of 'robust and efficient' AI-based attack recovery are not demonstrated for the system this paper actually proposes.

minor comments (5)

[Section 1.1, Figure 1 caption] The caption contains grammatical errors ('it's altitude' and 'this attacks') and it is unclear whether the figure presents actual simulation data or an artist's illustration; please clarify.
[Section 2, Figure 5] The example MLLM output lists five coordinate pairs but includes (0,6) twice, so only four unique coordinates are provided; if the example is meant to be a literal output, this should be corrected, and the coordinate system should be explained more precisely.
[Section 3, Model Distillation bullet] The target of keeping the multimodal LLM under 0.2 billion parameters is stated without a concrete rationale or a citation that justifies this size for the drone recovery task; please provide a basis for this number.
[Section 4, attacks discussion] The sentence 'In the past, our previous work has studied different attacks against LLMs' does not cite the specific previous work; please add references for the jailbreaking attack and the prompt-leaking attack.
[Section 2, target-set notation] The notation 'T in T, with T the set of possible forms' uses the same symbol for the target set and the set of forms, which is confusing; consider using different symbols, such as calligraphic T for the set of forms.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the paper is an architecture proposal whose LLM target-set function is defined, not derived, and whose lower-level evidence comes from prior published work used as external support.

full rationale

This paper does not contain a derivation chain that reduces a prediction to its own inputs. The central proposal is a hierarchical architecture in which a GenAI agent produces target-set parameters theta as a function F: O x T x C -> Theta; this is an architectural definition, not a claim derived from a fitted parameter or from an equation that embeds the conclusion. The quantitative results in Figures 2 and 3 are explicitly attributed to prior work [20] (OPR) and are used only to motivate the lower-level simplex controller; they are not claimed to validate the proposed AI layer, and they are externally published results rather than quantities fitted inside this paper. The paper explicitly defers the safety and feasibility guarantee, stating 'we will work on a verifier mechanism that certifies the safety and feasibility of the target set,' and its conclusion states 'Our future work will evaluate this architecture methodologically,' which confirms no evaluation is presented. Missing evaluation and an unverified LLM-capability assumption are correctness risks, not circularity: the paper never asserts that the LLM-generated target sets are certified, so there is no step where a claimed result is equivalent by construction to an input. The only self-citation is [20] for the OPR algorithm and its plots, which is independent support for the lower-level component and is not load-bearing for the higher-level GenAI claim. Therefore no specific circular step meeting the quoted-reduction standard can be exhibited, and the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper introduces no fitted parameters or invented physical entities. It relies on several background assumptions about the reliability of LLM reasoning, randomized smoothing, and a future verifier, all of which are central to the proposed architecture but unverified in this manuscript.

assumptions (4)

domain assumption The simplex architecture with nominal and recovery controllers improves safety upon attack detection.
Taken from prior work [5,8,21]; standard in the control-systems security literature, not demonstrated in this paper.
ad hoc to paper LLMs or multimodal LLMs can reason about visual scenes and environmental context to infer safe target sets.
The paper assumes this capability for its proposed LLM planner, but provides no experimental evidence. Section 2 states 'LLMs can produce the parameters θ' as a design intent.
domain assumption Randomized smoothing guarantees output stability under adversarial perturbations when applied to LLM-based planners.
The paper claims this property in Section 4, citing the general randomized smoothing concept, but does not prove or test it for LLM outputs.
ad hoc to paper A verifier mechanism can certify the safety and feasibility of the LLM-generated target set.
The verifier is not implemented or described; it is listed as future work in Section 2, yet the architecture depends on it to prevent unsafe LLM outputs.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Robust and Efficient AI-Based Attack Recovery in Autonomous Drones." pith.science (2026). https://pith.science/paper/NT6AO3WD

@misc{pith2026250514835,
  author       = {Pith},
  title        = {Pith review of: Robust and Efficient AI-Based Attack Recovery in Autonomous Drones},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NT6AO3WD}},
  note         = {Machine review of arXiv:2505.14835}
}

read the original abstract

We introduce an autonomous attack recovery architecture to add common sense reasoning to plan a recovery action after an attack is detected. We outline use-cases of our architecture using drones, and then discuss how to implement this architecture efficiently and securely in edge devices.

Figures

Figures reproduced from arXiv: 2505.14835 by the authors.

**Figure 2.** Our algorithm (OPR-OL) returns a drone to a safe height (green area) [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** Success rate and average distance to the target set center with increasing [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: AI-Based Recovery. To design an AI-based attack recovery, we need to solve several problems: (1) AI agents need to understand the state of the drone (or vehicle), identify risks, and create action plans. This requires encoding of the state of the physical world into a …

**Figure 5.** Figure 5: Multi-modal LLM (MLLM) evaluates the risks and ranks possible safe [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 13 canonical work pages

[20]

In: 2024 IEEE 30th Real-Time and Embedded Technology and Applications Symposium (RTAS)

Zhang, L., Burbano, L., Chen, X., Cardenas, A.A., Drager, S., Anderson, M., Kong, F.: Fast attack recovery for stochastic cyber-physical systems. In: 2024 IEEE 30th Real-Time and Embedded Technology and Applications Symposium (RTAS). pp. 280–293. IEEE (2024)

work page 2024
[1]

Chrysler recalls 1.4m vehicles for bug fix: https://www.wired.com/2015/07/jeep- hack-chrysler-recalls-1-4m-vehicles-bug-fix/, https://www.wired.com/2015/07/ jeep-hack-chrysler-recalls-1-4m-vehicles-bug-fix/

work page 2015
[2]

arXiv preprint arXiv:2404.14219 (2024)

Abdin, M., Jacobs, S.A., Awan, A.A., Aneja, J., Awadallah, A., Awadalla, H., Bach, N., Bahree, A., Bakhtiari, A., Behl, H., et al.: Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint arXiv:2404.14219 (2024)

arXiv 2024
[3]

arXiv preprint arXiv:2303.08774 (2023)

Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F.L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al.: Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)

arXiv 2023
[4]

In: Proceedings of the 6th ACM symposium on information, computer and communi- cations security

C´ ardenas, A.A., Amin, S., Lin, Z.S., Huang, Y.L., Huang, C.Y., Sastry, S.: At- tacks against process control systems: risk assessment, detection, and response. In: Proceedings of the 6th ACM symposium on information, computer and communi- cations security. pp. 355–366 (2011)

work page 2011
[5]

In: 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)

Dash, P., Li, G., Chen, Z., Karimibiuki, M., Pattabiraman, K.: Pid-piper: Re- covering robotic vehicles from physical attacks. In: 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). pp. 26–38. IEEE (2021)

work page 2021
[6]

In: 31st USENIX Security Symposium (USENIX Security 22)

Dayanıklı, G.Y., Sinha, S., Muniraj, D., Gerdes, R.M., Farhood, M., Mina, M.: {Physical-Layer}attacks against pulse width{Modulation-Controlled}actuators. In: 31st USENIX Security Symposium (USENIX Security 22). pp. 953–970 (2022)

work page 2022
[7]

int8 (): 8-bit matrix multiplication for transformers at scale

Dettmers, T., Lewis, M., Belkada, Y., Zettlemoyer, L.: Gpt3. int8 (): 8-bit matrix multiplication for transformers at scale. Advances in Neural Information Processing Systems35, 30318–30332 (2022)

work page 2022

Show all 22 references

[8]

In: 2022 IEEE 61st Conference on Decision and Control (CDC)

Garg, K., Sanfelice, R.G., Cardenas, A.A.: Control barrier function-based attack- recovery with provable guarantees. In: 2022 IEEE 61st Conference on Decision and Control (CDC). pp. 4808–4813. IEEE (2022)

2022
[9]

arXiv preprint arXiv:2312.00752 (2023)

Gu, A., Dao, T.: Mamba: Linear-time sequence modeling with selective state spaces. arXiv preprint arXiv:2312.00752 (2023)

2023 arXiv
[10]

The Washington Post5(2011)

Jaffe, G., Erdbrink, T.: Iran says it downed us stealth drone; pentagon acknowl- edges aircraft downing. The Washington Post5(2011)

2011
[11]

arXiv preprint arXiv:2402.14905 (2024)

Liu, Z., Zhao, C., Iandola, F., Lai, C., Tian, Y., Fedorov, I., Xiong, Y., Chang, E., Shi, Y., Krishnamoorthi, R., et al.: Mobilellm: Optimizing sub-billion parameter language models for on-device use cases. arXiv preprint arXiv:2402.14905 (2024)

2024 arXiv
[12]

arXiv preprint arXiv:2407.14885 (2024)

Malartic, Q., Chowdhury, N.R., Cojocaru, R., Farooq, M., Campesan, G., Djilali, Y.A.D., Narayan, S., Singh, A., Velikanov, M., Boussaha, B.E.A., et al.: Falcon2- 11b technical report. arXiv preprint arXiv:2407.14885 (2024)

2024 arXiv
[13]

arXiv preprint arXiv:2404.05892 (2024) Robust and Efficient AI-Based Attack Recovery in Autonomous Drones 9

Peng, B., Goldstein, D., Anthony, Q., Albalak, A., Alcaide, E., Biderman, S., Cheah, E., Ferdinan, T., Hou, H., Kazienko, P., et al.: Eagle and finch: Rwkv with matrix-valued states and dynamic recurrence. arXiv preprint arXiv:2404.05892 (2024) Robust and Efficient AI-Based At...

2024 arXiv
[14]

MIT Tech- nology Review (2013)

Rutkin, A.H.: spoofers use fake gps signals to knock a yacht off course. MIT Tech- nology Review (2013)

2013
[15]

In: 31st USENIX Security Symposium (USENIX Security 22)

Sathaye, H., Strohmeier, M., Lenders, V., Ranganathan, A.: An experimental study of{GPS}spoofing and takeover attacks on{UA Vs}. In: 31st USENIX Security Symposium (USENIX Security 22). pp. 3503–3520 (2022)

2022
[16]

The New York Times7(2011)

Shane, S., Sanger, D.E.: Drone crash in iran reveals secret us surveillance effort. The New York Times7(2011)

2011
[17]

arXiv preprint arXiv:1908.07125 (2019)

Wallace, E., Feng, S., Kandpal, N., Gardner, M., Singh, S.: Universal adversarial triggers for attacking and analyzing nlp. arXiv preprint arXiv:1908.07125 (2019)

2019 arXiv
[18]

arXiv preprint arXiv:2402.13116 (2024)

Xu, X., Li, M., Tao, C., Shen, T., Cheng, R., Li, J., Xu, C., Tao, D., Zhou, T.: A survey on knowledge distillation of large language models. arXiv preprint arXiv:2402.13116 (2024)

2024 arXiv
[19]

In: 2020 IEEE Symposium on Security and Privacy (SP)

Yan, C., Shin, H., Bolton, C., Xu, W., Kim, Y., Fu, K.: Sok: A minimalist approach to formalizing analog sensor security. In: 2020 IEEE Symposium on Security and Privacy (SP). pp. 480–495 (2020)

2020
[21]

In: Proceedings of the 2020 IEEE Real-Time Systems Symposium (RTSS)

Zhang, L., Chen, X., Kong, F., Cardenas, A.A.: Real-time attack-recovery for cyber-physical systems using linear approximations. In: Proceedings of the 2020 IEEE Real-Time Systems Symposium (RTSS). pp. 205–217. IEEE (2020)

2020
[22]

arXiv preprint arXiv:2307.15043 (2023)

Zou, A., Wang, Z., Kolter, J.Z., Fredrikson, M.: Universal and transferable adver- sarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 (2023)

2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [20]

In: 2024 IEEE 30th Real-Time and Embedded Technology and Applications Symposium (RTAS)

Zhang, L., Burbano, L., Chen, X., Cardenas, A.A., Drager, S., Anderson, M., Kong, F.: Fast attack recovery for stochastic cyber-physical systems. In: 2024 IEEE 30th Real-Time and Embedded Technology and Applications Symposium (RTAS). pp. 280–293. IEEE (2024)

work page 2024

[2] [1]

Chrysler recalls 1.4m vehicles for bug fix: https://www.wired.com/2015/07/jeep- hack-chrysler-recalls-1-4m-vehicles-bug-fix/, https://www.wired.com/2015/07/ jeep-hack-chrysler-recalls-1-4m-vehicles-bug-fix/

work page 2015

[3] [2]

arXiv preprint arXiv:2404.14219 (2024)

Abdin, M., Jacobs, S.A., Awan, A.A., Aneja, J., Awadallah, A., Awadalla, H., Bach, N., Bahree, A., Bakhtiari, A., Behl, H., et al.: Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint arXiv:2404.14219 (2024)

arXiv 2024

[4] [3]

arXiv preprint arXiv:2303.08774 (2023)

Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F.L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al.: Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)

arXiv 2023

[5] [4]

In: Proceedings of the 6th ACM symposium on information, computer and communi- cations security

C´ ardenas, A.A., Amin, S., Lin, Z.S., Huang, Y.L., Huang, C.Y., Sastry, S.: At- tacks against process control systems: risk assessment, detection, and response. In: Proceedings of the 6th ACM symposium on information, computer and communi- cations security. pp. 355–366 (2011)

work page 2011

[6] [5]

In: 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)

Dash, P., Li, G., Chen, Z., Karimibiuki, M., Pattabiraman, K.: Pid-piper: Re- covering robotic vehicles from physical attacks. In: 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). pp. 26–38. IEEE (2021)

work page 2021

[7] [6]

In: 31st USENIX Security Symposium (USENIX Security 22)

Dayanıklı, G.Y., Sinha, S., Muniraj, D., Gerdes, R.M., Farhood, M., Mina, M.: {Physical-Layer}attacks against pulse width{Modulation-Controlled}actuators. In: 31st USENIX Security Symposium (USENIX Security 22). pp. 953–970 (2022)

work page 2022

[8] [7]

int8 (): 8-bit matrix multiplication for transformers at scale

Dettmers, T., Lewis, M., Belkada, Y., Zettlemoyer, L.: Gpt3. int8 (): 8-bit matrix multiplication for transformers at scale. Advances in Neural Information Processing Systems35, 30318–30332 (2022)

work page 2022