Pith. sign in

REVIEW 2 major objections 2 minor 1 cited by

Data-Driven Control from Poisoned Data: Fundamental Limitations and Secure DeePC

T0 review · 2 major / 2 minor · reviewed 2026-06-26 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Secure DeePC recovers equivalent performance to model predictive control from poisoned offline data in finite time.

desk verdict The paper flags three real limits from poisoned outputs in DeePC and offers a phased Secure DeePC that switches after online inputs become exciting, but the excitation step under truncated control lacks a supporting argument. read the letter →

arxiv 2606.20301 v1 pith:LH5DBJPQ submitted 2026-06-18 eess.SY cs.SY

Takumi Shinohara , Henrik Sandberg , Karl Henrik Johansson This is my paper · ORCID
classification eess.SYcs.SY
keywords data-drivencontrolpoisoningattacksDeePCsecuremodelpredictivepersistentexcitationoutputconstraints
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper shows that data-driven controllers cannot detect or mitigate poisoning attacks on offline output measurements from the data alone, rendering unprotected data useless for robust design and un-certifiable for hard constraints. To address this, it introduces Secure DeePC, which begins with a truncated version of data-enabled predictive control using only protected data until the online inputs become persistently exciting. It then reconstructs the missing data from online measurements and switches to the full DeePC law, achieving performance equivalent to model predictive control in finite time with probability one under the stated conditions.

What carries the argument

The Secure DeePC algorithm, which switches from output-truncated DeePC to full DeePC after reconstructing poisoned data using online persistently exciting inputs.

What would settle it

An experiment where the online inputs fail to become persistently exciting under the truncated law, preventing reconstruction of the offline data.

Watch

Extended reading notes

Core claim

Secure DeePC achieves MPC-equivalent performance in finite time almost surely by first applying output-truncated DeePC on the protected dataset until the online input sequence becomes persistently exciting, then reconstructing the partial offline dataset from online measurements, and finally switching back to full-output DeePC.

Load-bearing premise

The online input sequence will eventually become persistently exciting while the system operates under the output-truncated DeePC controller.

Editorial extensions

If this is right

  • Poisoning attacks cannot be detected solely from the offline dataset.
  • Unprotected data provide no worst-case performance guarantees for controller design.
  • Hard output constraints cannot be certified when data is unprotected.
  • The proposed algorithm restores full performance after finite time.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • This approach could extend to other data-driven methods beyond DeePC.
  • It suggests that online data collection can serve as a verification mechanism in adversarial settings.
  • Future work might explore minimal protection requirements for data storage.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 2 minor

Summary. The paper identifies three fundamental limitations for data-driven control when a subset of offline output measurements can be arbitrarily poisoned: poisoning cannot be detected from the dataset alone, unprotected outputs are non-informative for worst-case controller synthesis, and hard output constraints on unprotected channels cannot be certified. Motivated by these, it proposes Secure DeePC, which first applies output-truncated DeePC using only the protected data subset until the online input sequence becomes persistently exciting, reconstructs the partial offline dataset from online measurements, and then switches to standard full-output DeePC. The central claim is that this procedure achieves MPC-equivalent closed-loop performance in finite time almost surely, under certain (unspecified in the abstract) conditions; efficacy is illustrated via simulations.

Significance. If the finite-time almost-sure performance guarantee can be rigorously established, the work would be significant for practical deployment of data-driven predictive control in security-sensitive settings. The explicit cataloguing of fundamental limitations provides a useful conceptual contribution that clarifies why standard DeePC is vulnerable and motivates the truncated-then-reconstruct strategy.

major comments (2)
  1. [Abstract / Algorithm description] The reconstruction step and the finite-time performance claim both rest on the assertion that output-truncated DeePC (operating with strictly less information) eventually renders the online input persistently exciting. The fundamental-limitations section already shows that unprotected outputs carry no information for worst-case design; no argument, rank condition, or set of plant assumptions is supplied showing that the reduced-information law still produces the required full-row-rank input Hankel matrix in finite time for arbitrary linear systems. This assumption is load-bearing for the entire Secure DeePC procedure.
  2. [Abstract / Performance claim] The statement that Secure DeePC achieves MPC-equivalent performance in finite time almost surely is presented without any proof sketch, explicit conditions on the plant or noise, or error-bound analysis. The abstract supplies only the high-level claim; the absence of these elements prevents verification of the central theoretical result.
minor comments (2)
  1. [Simulations] Simulation section should report quantitative metrics (e.g., closed-loop cost, constraint violation frequency) and explicit comparison against both nominal DeePC and MPC under the same attack realizations.
  2. [Preliminaries] Notation for the protected versus unprotected data partitions and the precise definition of the output-truncated Hankel matrices should be introduced with an equation or table early in the manuscript.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the careful reading and constructive comments. We address each major comment below and will revise the manuscript to strengthen the theoretical support for Secure DeePC.

read point-by-point responses

  1. Referee: [Abstract / Algorithm description] The reconstruction step and the finite-time performance claim both rest on the assertion that output-truncated DeePC (operating with strictly less information) eventually renders the online input persistently exciting. The fundamental-limitations section already shows that unprotected outputs carry no information for worst-case design; no argument, rank condition, or set of plant assumptions is supplied showing that the reduced-information law still produces the required full-row-rank input Hankel matrix in finite time for arbitrary linear systems. This assumption is load-bearing for the entire Secure DeePC procedure.

    Authors: We agree that the manuscript lacks an explicit argument, rank condition, or plant assumptions establishing that output-truncated DeePC produces a persistently exciting input in finite time. The fundamental-limitations section correctly identifies the non-informativeness of unprotected outputs, yet the algorithm relies on this property without dedicated analysis. In the revision we will add a proposition (with proof) specifying the required assumptions, such as controllability of the protected input-output subsystem, under which the truncated controller guarantees full row rank of the input Hankel matrix almost surely; this will be placed in the algorithm description section. revision: yes

  2. Referee: [Abstract / Performance claim] The statement that Secure DeePC achieves MPC-equivalent performance in finite time almost surely is presented without any proof sketch, explicit conditions on the plant or noise, or error-bound analysis. The abstract supplies only the high-level claim; the absence of these elements prevents verification of the central theoretical result.

    Authors: The abstract indeed states the performance claim at a high level without conditions or sketch. While the body contains a theorem on finite-time almost-sure equivalence, we acknowledge that a self-contained proof sketch, explicit plant/noise assumptions, and reconstruction error bounds are not provided in sufficient detail. We will revise the abstract to mention the key conditions (linear dynamics, bounded noise, persistent excitation) and add an expanded proof outline together with error-bound analysis in the main text or appendix. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; derivation is self-contained

full rationale

The paper first establishes independent fundamental limitations (poisoning undetectability, non-informativeness of unprotected outputs, non-certifiability of constraints) from the problem setup. It then defines Secure DeePC as a switching procedure that applies output-truncated DeePC until an online persistent-excitation condition holds, reconstructs the partial dataset, and reverts to full DeePC. The finite-time MPC-equivalence claim is explicitly conditioned on the excitation event occurring almost surely and on other stated assumptions; it does not reduce any performance metric to a fitted parameter, self-citation, or input by construction. No load-bearing step invokes a uniqueness theorem, ansatz, or renaming from the authors' prior work. The central algorithm and its guarantees therefore remain independent of the inputs they are derived from.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

Abstract-only review; standard LTI system assumptions and persistent excitation requirements from DeePC literature are implied but not enumerated.

assumptions (2)
  • domain assumption The underlying plant is linear time-invariant
    Required for DeePC equivalence to MPC and for the reconstruction step.
  • domain assumption A non-empty protected subset of output data exists
    Core premise enabling the initial output-truncated phase.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Data-Driven Control from Poisoned Data: Fundamental Limitations and Secure DeePC." pith.science (2026). https://pith.science/paper/LH5DBJPQ

@misc{pith2026260620301,
  author       = {Pith},
  title        = {Pith review of: Data-Driven Control from Poisoned Data: Fundamental Limitations and Secure DeePC},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LH5DBJPQ}},
  note         = {Machine review of arXiv:2606.20301}
}
read the original abstract

We study a data-driven control problem in the presence of arbitrary data poisoning attacks. We assume that a subset of offline output data is stored in unprotected locations and may be poisoned by an adversary. We first establish fundamental limitations for data-driven control arising from such poisoned data: poisoning attacks are not detected/identified from the dataset alone; unprotected data are non-informative for controller design with worst-case guarantees; and hard constraints on unprotected outputs are not certifiable. Motivated by these limitations and the data-enabled predictive control (DeePC) technique, we propose Secure DeePC, a data-driven control algorithm that is resilient against poisoning attacks. It first runs output-truncated DeePC using only the protected dataset until the online input becomes persistently exciting. It then uses online measurements to reconstruct the partial offline dataset, and finally returns to full-output DeePC. Secure DeePC achieves MPC-equivalent performance in finite time almost surely under certain conditions. Simulation results illustrate the efficacy of the proposed framework against poisoning attacks.

Figures

Figures reproduced from arXiv: 2606.20301 by the authors.

Figure 1
Figure 1. An overview of data poisoning attacks and Secure DeePC. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Inverted pendulum. The observability condition on (A, ¯ C¯ S ) is needed to guarantee performance in Phase I. If an attack-free dataset is available and the offline input data is PE of order n + Tp with Tp ≥ n, one can select an optimal placement of S so that (A, ¯ C¯ S ) is observable from the dataset by using the rank-condition of Hankel matrices [16, Proposition 1]. This paper focuses on noise-free systems. Since… view at source ↗
Figure 3
Figure 3. I/O trajectories (solid black) of the regularized DeePC, the output-truncated DeePC, and Secure DeePC under poisoning attacks [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Data-driven Kernel-based Predictive Control with Stability and Robustness Guarantees

    eess.SY 2026-07 conditional novelty 6.5 of 10

    Kernel multi-step predictors enable data-driven MPC for nonlinear systems with recursive feasibility and practical stability when the horizon is long and representation error is small.

Reference graph

Works this paper leans on

16 extracted references · 1 canonical work pages · cited by 1 Pith paper

  1. [1]

    Formulas for data-driven control: Stabiliza- tion, optimality, and robustness,

    C. D. Persis and P. Tesi, “Formulas for data-driven control: Stabiliza- tion, optimality, and robustness,”IEEE Trans. Autom. Control, vol. 65, no. 3, pp. 909–924, Mar. 2020

    2020

  2. [2]

    Data-enabled predictive control: In the shallows of the DeePC,

    J. Coulson, J. Lygeros, and F. D ¨orfler, “Data-enabled predictive control: In the shallows of the DeePC,” inProc. Eur. Control Conf., Napoli, Italy, 2019, pp. 307–312

    2019

  3. [3]

    Robust data-enabled predictive control: Tractable formulations and performance guaran- tees,

    L. Huang, J. Zhen, J. Lygeros, and F. D ¨orfler, “Robust data-enabled predictive control: Tractable formulations and performance guaran- tees,”IEEE Trans. Autom. Control, vol. 68, no. 5, pp. 3163–3170, 2023

    2023

  4. [4]

    Data-driven model predictive control with stability and robustness guarantees,

    J. Berberich, J. K ¨ohler, M. A. M ¨uller, and F. Allg ¨ower, “Data-driven model predictive control with stability and robustness guarantees,” IEEE Trans. Autom. Control, vol. 66, no. 4, pp. 1702–1717, 2021

    2021

  5. [5]

    Poisoning attacks against data-driven control methods,

    A. Russo and A. Proutiere, “Poisoning attacks against data-driven control methods,” inProc. 2021 Amer. Control Conf., New Orleans, LA, 2021, pp. 3234–3241

    2021

  6. [6]

    Poisoning attacks against data-driven predictive control,

    Y . Yu, R. Zhao, S. Chinchali, and U. Topcu, “Poisoning attacks against data-driven predictive control,” inProc. 2023 Amer. Control Conf., San Diego, CA, 2023, pp. 545–550

    2023

  7. [7]

    Adversarial attacks to direct data-driven control for destabilization,

    H. Sasahara, “Adversarial attacks to direct data-driven control for destabilization,” inProc. 62nd IEEE Conf. Decis. Control, Singapore, 2023, pp. 7094–7099

    2023

  8. [8]

    Data-driven security control for CPSs under aperiodic DoS attacks: A switched system approach,

    R. Zhang, R. Yang, Y . Zhu, and P. Shi, “Data-driven security control for CPSs under aperiodic DoS attacks: A switched system approach,” IEEE Control Syst. Lett., vol. 9, pp. 1688–1693, 2025

    2025

Show all 16 references
  1. [9]

    Data-driven security controller design for unknown networked systems,

    S. Hu, D. Yue, Z. Jiang, X. Xie, and J. Zhang, “Data-driven security controller design for unknown networked systems,”Automatica, vol. 171, 111843, 2025

    2025

  2. [10]

    A note on persistency of excitation,

    J. C. Willems, P. Rapisarda, I. Markovsky, and B. L. M. De Moor, “A note on persistency of excitation,”Syst. Control Lett., vol. 54, no. 4, pp. 325–329, 2005

    2005

  3. [11]

    Data-driven resilient predictive control under denial-of-service,

    W. Liu, J. Sun, G. Wang, F. Bullo, and J. Chen, “Data-driven resilient predictive control under denial-of-service,”IEEE Trans. Autom. Con- trol, vol. 68, no. 8, pp. 4722–4737, 2023

    2023

  4. [12]

    Data-driven control against false data injection attacks,

    W. Liu, L. Li, J. Sun, F. Deng, G. Wang, and J. Chen, “Data-driven control against false data injection attacks,”Automatica, vol. 179, 112399, 2025

    2025

  5. [13]

    Data-driven robust control under input-output stealthy attacks,

    A. Bhowmik, S. D. Bopardikar, and J. P. Hespanha, “Data-driven robust control under input-output stealthy attacks,”IEEE Control Syst. Lett., vol. 9, pp. 2885–2890, 2025

    2025

  6. [14]

    Detection and identification of sensor attacks using partially attack-free data,

    T. Shinohara, K. H. Johansson, and H. Sandberg, “Detection and identification of sensor attacks using partially attack-free data,” 2025. [Online]. Available: https://arxiv.org/abs/2510.02183

    2025

  7. [15]

    Event-triggered state observers for sparse sensor noise/attacks,

    Y . Shoukry and P. Tabuada, “Event-triggered state observers for sparse sensor noise/attacks,”IEEE Trans. Autom. Control, vol. 60, no. 8, pp. 2079–2091, 2016

  8. [16]

    Beyond persistent excitation: Online experiment design for data-driven modeling and control,

    H. J. van Waarde, “Beyond persistent excitation: Online experiment design for data-driven modeling and control,”IEEE Control Syst. Lett., vol. 6, pp. 319–324, 2022

    2022

Pith tools

Reviewed June 26, 2026 · model on record in the stance chip above.