Cyber Security of Sensor Systems for State Sequence Estimation: A Machine Learning Approach

Brian M. Sadler; Ramesh Bharadwaj; Rick S. Blum; Xubin Fang

REVIEW 4 major objections 5 minor 44 references

Cyber Security of Sensor Systems for State Sequence Estimation: A Machine Learning Approach

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that augmenting anomaly detection with an actual path consistency check can identify and remove exactly the attacked sensor data feeding a sequence estimator, matching the performance of an approach that knows which…

desk verdict A real blind spot in EDAD is named and patched, but the paper overclaims 'any attack' and the worst-case mathematics are prose, not proof. read the letter →

arxiv 2506.06572 v3 pith:XTZ2F6TM submitted 2025-06-06 cs.CR eess.SP

Xubin Fang , Rick S. Blum , Ramesh Bharadwaj , Brian M. Sadler This is my paper · ORCID

classification cs.CReess.SP

keywords cybersecuritysensorattackprotectionstatesequenceestimationmachinelearninganomalydetectionconnectedvehiclenetworksworst-caseattacks

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims a general outer shell of protection for data-driven sequence estimation: it can identify and remove only the attacked sensor readings presented to the estimator, for attacks where the attacker fully controls the values on attacked sensors, can change the attacked set and the attacks at every time step, and where the defense has no prior knowledge of which sensors are more likely attacked. The approach—called an actual path consistency check (APCC)—does not assume a known statistical model of the sensor data, so it can wrap machine-learning regression and sequence estimators. The simple version matches the performance of an estimate that knows which sensors are attacked (the genie estimate) to two decimal places in every reported experiment. A second version adds a histogram-based check for attackers who know the defense, trading a slight degradation under no attacks for a much smaller worst-case degradation when many sensors are attacked. The paper also gives mathematical descriptions of the worst-case attacks for both versions, so worst-case performance can be computed without searching over attacks.

What carries the argument

The central object is the actual path consistency check (APCC), a two-stage filter placed after an encoder-decoder anomaly detector (EDAD). APCC-SIMPLE compares every sensor reading that survives anomaly detection with a prediction, produced by a Random Forest trained only on unattacked data, of what a typical unattacked sensor should read at that time step; readings whose residual falls outside a β-percent consistency interval are declared attacked. APCC-ADDITIONAL adds a histogram check: from unattacked training data it computes an upper bound U(x) for each residual histogram bin such that Pr( f̂(x) < U(x) ) = α, and when the operating histogram exceeds U(x) in a bin, it removes the smallest number of sensors in that bin needed to bring the histogram back under the bound. The paper further characterizes the worst-case attacks on each version—edge attacks that place values just inside the consistency interval for APCC-SIMPLE, and water-filling attacks that fill the available space under U(x) in the most damaging histogram bins for APCC-ADDITIONAL—so the worst-case NRMSE can be calculated directly for any parameter choice.

What would settle it

Use unattacked sensor recordings from an operating condition not represented in the training set (for example, a different road geometry, weather pattern, or noise distribution), run APCC-SIMPLE with β = 99.9%, and check how many healthy sensors are flagged as attacked and whether the NRMSE still matches the genie value to two decimal places; any substantial divergence would falsify the claim that the method removes only attacked data.

Watch

Extended reading notes

Core claim

The central claim is that augmenting an anomaly detector with an actual path consistency check identifies and eliminates exactly the attacked sensor data presented to a sequence estimation/regression algorithm, for every attack in a model where the attacker has complete control over the attacked sensor values and can vary the attacked sensors and attack magnitudes at each time step. APCC-SIMPLE subtracts a machine-learned prediction of a typical unattacked sensor output from each sensor reading that has already passed anomaly detection, and flags any reading whose residual falls outside an interval containing a chosen percentage β of the training residuals. In all tested cases—Gaussian and Laplacian noise, varying numbers of attacked sensors, and trajectory lengths up to 300,000 steps—the normalized root mean square error (NRMSE) of this simple method equals that of the genie estimate, which knows the attacked sensors, to two decimal places. APCC-ADDITIONAL builds a histogram of the residuals that pass the simple check and eliminates the fewest sensors needed to keep each histogram bin below an upper bound U(x) learned from unattacked training data, which bounds worst-case degradation when the attacker knows the defense. The worst-case attacks are described mathematically as edge attacks (for the simple check) and water-filling attacks (for the additional check), allowing worst-case performance to be computed directly rather than by enumerating attacks.

Load-bearing premise

A machine-learned predictor trained only on unattacked data accurately predicts what a typical unattacked sensor should read at each deployment time step, and the unattacked training data fully represent every operating condition that will occur.

Editorial extensions

If this is right

Any sequence estimation or regression algorithm can be protected by wrapping it in this shell, without assuming a statistical model for the sensor data.
The defense handles the most powerful attack scenarios in the paper's model: complete control of attacked values, arbitrary switching of the attacked set, and no prior knowledge of which sensors are attacked.
With appropriate choices of α and β, the worst-case degradation under a large number of attacked sensors can be held close to the genie estimate, with only a modest cost when no attack occurs.
The worst-case attack descriptions allow worst-case performance to be calculated analytically, so protection parameters can be selected without expensive brute-force search over attack patterns.
All processing uses only unattacked training data, so the method applies where representative attack data is unavailable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the near-genie accuracy extends beyond the SUMO-based experiments, the same shell could protect radar, lidar, sonar, and GPS-based trackers, and could be stacked with other defense layers as the paper suggests.
The worst-case attack calculus introduced here suggests a general certification method for anomaly-detection-based defenses: find the data distribution that maximizes estimator degradation while still passing the detector, then compute that degradation directly.
A testable extension is to replace the Random Forest predictor with a recurrent or stateful predictor and measure whether prediction errors accumulate over very long trajectories; the paper only reports limited results on error accumulation.
Because the consistency interval is calibrated from unattacked training residuals, deployment under distribution shift would likely require recalibration; this is a boundary condition the paper does not explore.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The core idea is worth a look: EDAD approaches are blind to attacks that swap one valid trajectory for another, and the paper's APCC residual check against a learned predictor is a sensible patch. That is a real gap in the literature, and the paper names it clearly. The experimental setup, comparing against a genie that knows the attacked sensors, is the right way to frame the question. If I were working on protecting ML-based sequence estimators, I'd want this paper on my desk.

But the headline claim outruns the evidence. The abstract promises "any attack from our attack model," and Section III.C says it mathematically describes worst-case attacks, but the section contains no equations, no bounds, no proof. It is a prose description of edge and water-filling attacks plus a figure. The "mathematical descriptions" do not appear anywhere in the text. Relatedly, the worst-case analysis is heuristic: the water-filling idea is intuitive, but it is not justified as actually worst-case.

The consistency check itself has a load-bearing assumption the paper admits but does not quantify. Section V concedes prediction error can degrade performance and can accumulate over time, but there is no sensitivity analysis. A small predictor bias or distribution shift breaks the near-genie result. The claim of identical NRMSE to two decimals in every tested case is suspicious, partly because there are no confidence intervals, and partly because the paper leaks a co-author note in Section IV.A ("Why don't you use this? Making m longer is easy to explain") and otherwise looks unpolished. No code or data are released, which makes the perfect agreement hard to verify.

The limitations are not hidden; Section V is honest about many of them. But the abstract and introduction promise far more than the paper delivers. The right fix is to narrow the claims: position APCC-SIMPLE as a heuristic that works well in tested settings, present the worst-case discussion as intuition rather than mathematics, and provide a real analysis of when the residual check separates attacked from healthy data.

Recommendation: send to peer review, but tell the authors the "any attack" and "worst-case" claims will need to be either proven or substantially qualified before publication. With code and a sensitivity analysis, this could be a useful paper.

Referee Report

4 major / 5 minor

Summary. The paper proposes two sensor-attack protection layers, APCC-SIMPLE and APCC-ADDITIONAL, to wrap around data-driven sequence estimation/regression algorithms. APCC-SIMPLE takes sensor readings that pass an existing anomaly detector, subtracts a learned prediction of a 'typical unattacked sensor output' (implemented with Random Forest), and flags readings whose residual falls outside an interval containing β of training residuals. APCC-ADDITIONAL adds a histogram-based check with an upper bound U(x) learned from unattacked training data at confidence level α. The authors claim these are the first methods to identify/eliminate only problematic attacked data under any attack in their attack model, claim mathematical descriptions of worst-case edge and water-filling attacks, and report simulations on SUMO scalar trajectories with Gaussian and Laplacian noise showing APCC-SIMPLE matching a genie estimate to two decimals and APCC-ADDITIONAL improving worst-case knowledge-attack performance.

Significance. If substantiated, the approach would be a useful contribution: it protects estimator-agnostic sequence estimation without a known statistical model, uses only unattacked training data, and explicitly targets the difficult regime where EDAD alone is insufficient. The experimental effort is substantial (1 million Monte Carlo runs, two noise models, baseline comparisons), and the paper is candid in Section V about remaining limitations. However, the central guarantee 'under any attack from our attack model' and the claimed 'mathematical descriptions of the worst-case attacks' are not actually demonstrated in the manuscript, and the empirical support is confined to a narrow simulation setting. As it stands, the paper reads as a heuristic defense with promising initial results rather than a validated universal protection scheme.

major comments (4)

[Section III.C, Figs. 3-5] The abstract, Introduction (Section I-B), and Section III.C claim that the paper provides mathematical descriptions of worst-case attacks and that the approaches handle 'any attack from our attack model.' Section III.C, however, contains no equations, no optimization formulation, and no proof that edge attacks are the worst case for APCC-SIMPLE or that water-filling attacks are the worst case for APCC-ADDITIONAL. Eq. (1) defines U(x) but is never used to derive a bound on the degradation caused by an admissible attack or on the probability that an attack passes detection. Without this derivation, the universal 'any attack' claim is unsupported.
[Section III.A; Section V] APCC-SIMPLE's only discrimination signal is whether the difference between a sensor value and a learned prediction falls inside the β-interval of training residuals. The manuscript gives no bound on the probability that an adversarial value lies inside this interval, nor on the probability that an unattacked value is rejected when the predictor is imperfect or when deployment conditions differ from the 192 SUMO training trajectories. Section V explicitly acknowledges that prediction errors can accumulate over time and that 'an accurate prediction approach must be employed,' but no quantitative sensitivity analysis is provided. This gap is load-bearing because a small structured predictor bias could cause APCC-SIMPLE to admit attacked data or discard healthy data, breaking the near-genie result.
[Section IV, Tables I-VIII] The numerical evidence for the near-genie claim is limited to scalar trajectories generated on one SUMO map, with N_A fixed for the duration of each experiment and with only Gaussian and Laplacian noise. Tables I-IV report NRMSE values identical to GE in every displayed digit, but no confidence intervals or trajectory-to-trajectory variability are reported. The attack model in Section I-A allows the set of attacked sensors and the attack values to change at each time step, yet the experiments do not test time-varying attacked sets. Section V concedes that the numerical results are limited. As a result, the empirical support covers a small corner of the stated attack model.
[Section IV-B, Tables IX-X, Figs. 8-9] The claimed worst-case advantage of APCC-ADDITIONAL depends on ad hoc choices of α, β, histogram bin width (21% of the standard deviation), and number of bins (25). The paper gives no procedure for selecting these parameters, and Tables IX-X show that performance varies strongly with them, with a clear trade-off between N_A=0 degradation and worst-case N_A=40 degradation. Without a principled selection rule or sensitivity analysis, the conclusion that the additional processing can always be configured to achieve the claimed worst-case improvement is not established.

minor comments (5)

[Section IV, after Table III] The text contains a stray editorial note: 'Why don’t you use this?' and 'We defined m as the trajectory length. Why don’t you use this? Making m longer is easy to explain.' This appears to be leftover authorial comment and should be removed.
[Affiliations and Section IV-C] The affiliation line contains 'Wahing-ton' (should be 'Washington'), and Section IV-C says 'less thanksensors attacked,' which appears to mean 'less than sensors attacked.' These typos should be corrected.
[Section III-B, Eq. (1)] The definition of U(x) is ambiguous: U(x) is described both as a learned upper limit and as a random quantity in Pr( f̂(x) < U(x)) = α. Please specify the estimation procedure for U(x) and the probability space over which the probability is taken.
[Section IV-E] The claim that EDAD alone 'can yield very large, potentially unbounded, errors' is supported only by a constant-shift example; the argument should be stated more carefully, since the example relies on a particular normalization in the NRMSE definition and on allowing arbitrarily large shifts h.
[Tables I-XI] The tables report point estimates of NRMSE without confidence intervals or standard errors. The 1-million-run MC length is stated for APCC-SIMPLE, but comparable uncertainty information is not provided for the APCC-ADDITIONAL results, making it hard to judge whether the reported two-decimal equality with the genie estimate is statistically meaningful.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the APCC approaches are standard anomaly detection trained on unattacked data and evaluated against a genie benchmark; self-citations are contextual only.

full rationale

The paper's protection chain is self-contained in the relevant sense: APCC-SIMPLE trains a machine learning predictor on unattacked SUMO trajectories, forms a residual interval containing a chosen percentage beta of training residuals, and then flags operation-phase sensor readings whose residuals fall outside that interval. This is a conventional, empirically calibrated anomaly detector: the threshold is learned from unattacked data and applied to new data, with no equation in which the target result is assumed as an input. APCC-ADDITIONAL similarly learns an upper envelope U(x) for the histogram of residuals from unattacked training data and removes sensors that would push the operational histogram above U(x); this is a data-driven goodness-of-fit check, not a circular definition of attack. The central near-genie claim is an experimental comparison against an oracle that uses only the truly unattacked sensors, and the NRMSE equality to two decimal places in Tables I-IV is an empirical outcome, not an identity forced by construction. The Section III.C worst-case edge and water-filling attacks are described heuristically without a formal optimization proof; even if their worst-case optimality is unestablished, that is a correctness or completeness concern, not circular reasoning. The paper itself acknowledges in Section V that prediction errors can accumulate and that an accurate prediction approach must be employed, which is an honest limitation rather than a concealed assumption of the conclusion. The two self-citations ([12] and [26]) appear in background discussion of attack classes and Kalman-filter-based protection and are not load-bearing for the proposed method; no uniqueness theorem is imported from the authors' prior work. Accordingly, the derivation chain does not reduce to its own inputs, and no specific circular step can be exhibited.

Assumptions & free parameters 5 free parameters · 7 assumptions · 0 invented entities

The central claim rests on representative unattacked training data, a stable predictor, and the unproven assertion that edge and water-filling attacks are worst-case. The free parameters alpha, beta, and bin width are tuned by experiment, and the scalar SUMO results are assumed to generalize.

free parameters (5)

beta (consistency percentage) = 99.9% for APCC-SIMPLE; 80%, 60%, etc. for APCC-ADDITIONAL
Controls the width of the acceptance interval in Fig. 3; chosen by hand and swept in experiments; strongly affects which attacks pass.
alpha (histogram upper-bound probability) = 90%, 80%, 70%, 60%, 50%, 40%
Sets U(x) in Eq. (1); swept to trade no-attack performance against worst-case attack performance.
Histogram bin width = 21% of sensor output standard deviation
Explicitly 'found through experiments'; affects U(x) and detection behavior.
Number of histogram bins = 25
Chosen for the reported experiments; not justified by theory.
Random forest hyperparameters = Unspecified
Method cited as Breiman [40] with a 70/10/20 split, but tree count, depth, and features are not given; results depend on them.

assumptions (7)

domain assumption Unattacked training data is sufficiently large and fully describes all unattacked sensor data.
Section II states this assumption for EDAD; the APCC confidence intervals inherit it.
domain assumption The statistical relationship between the learned predictor and actual unattacked sensor outputs is stationary across training and operation.
U(x) and beta intervals are estimated from training data and applied at deployment without adaptation.
domain assumption EDAD is assumed to catch all invalid trajectories, so only valid-to-valid substitutions reach APCC.
The paper relies on EDAD as a perfect anomaly detector for non-valid data; no false-positive or false-negative model is given.
ad hoc to paper An attacker without knowledge of the protection scheme cannot learn or guess it.
APCC-SIMPLE's near-genie performance is demonstrated only against random attacks, and the paper restricts the claim to attackers 'not endowed with knowledge'.
domain assumption MLE fusion with known noise distribution approximates the performance of machine-learning fusion.
Section IV states non-optimized ML fusion imposes additional degradation, but those results are not shown.
ad hoc to paper Edge attacks and water-filling attacks are the true worst-case attacks for the two processing options.
Section III.C asserts this without formal derivation; the claimed worst-case guarantee rests on it.
domain assumption Scalar trajectory results generalize to vector trajectories.
Section V says higher-dimensional tests were done but not reported.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Cyber Security of Sensor Systems for State Sequence Estimation: A Machine Learning Approach." pith.science (2026). https://pith.science/paper/XTZ2F6TM

@misc{pith2026250606572,
  author       = {Pith},
  title        = {Pith review of: Cyber Security of Sensor Systems for State Sequence Estimation: A Machine Learning Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XTZ2F6TM}},
  note         = {Machine review of arXiv:2506.06572}
}

read the original abstract

Due to possible devastating consequences, counteracting sensor data attacks is an extremely impor- tant topic, which has not seen sufficient study. To the best of our knowledge, this paper develops the first meth- ods that accurately identify/eliminate only the problem- atic attacked sensor data presented to a sequence es- timation/regression algorithm under any attack from our attack model. The approach does not assume a known form for the statistical model of the sensor data, allow- ing data-driven and machine learning sequence estima- tion/regression algorithms to be protected. A simple pro- tection approach for attackers not endowed with knowledge of the details of our protection approach is first developed, followed by additional processing for attacks based on pro- tection system knowledge. Experimental results show that the simple approach achieves performance indistinguish- able from that for an approach which knows which sensors are attacked. For cases where the attacker has knowledge of the protection approach, experimental results indicate the additional processing can be configured so that the worst-case degradation under the additional processing and a large number of sensors attacked can be made signif- icantly smaller than the worst-case degradation of the sim- ple approach, and close to an approach which knows which sensors are attacked, with just a slight degradation under no attacks. Mathematical descriptions of the worst-case attacks are used to demonstrate the additional processing will provide similar advantages for cases for which we do not have numerical results. All the data-driven/machine learning processing used in our approaches employ only unattacked training data.

Figures

Figures reproduced from arXiv: 2506.06572 by the authors.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 39 canonical work pages

[1]

P. K. Varshney,Distributed Detection and Data Fusion. Springer Science & Business Media, 2012

work page 2012
[2]

Non-Coherent Source Localization with Distributed Sensor Array Networks,

Z. Wan, W. Liu and P. Willett, “Non-Coherent Source Localization with Distributed Sensor Array Networks,” in Proc. IEEE 12th Sensor Array and Multichannel Signal Processing Workshop (SAM), Trondheim, Norway, 2022, pp. 86–90, doi: 10.1109/SAM53842.2022.9827843

work page arXiv 2022
[3]

Heterogeneous Sensor Fusion With Out Of Sync Data,

B. Chen et al., “Heterogeneous Sensor Fusion With Out Of Sync Data,” in Proc. IEEE Aerospace Conf., Big Sky, MT, USA, 2020, pp. 1–6, doi: 10.1109/AERO47225.2020.9172681

arXiv 2020
[4]

Target Location Estimation in Sensor Networks With Quantized Data,

R. Niu and P. K. Varshney, “Target Location Estimation in Sensor Networks With Quantized Data,” IEEE Trans. Signal Process., vol. 54, no. 12, pp. 4519–4528, Dec. 2006, doi: 10.1109/TSP.2006.882082

work page arXiv 2006
[5]

Data Fusion,

R. Viswanathan, “Data Fusion,” in Computer Vision. Cham: Springer,

work page
[6]

Stochastic impulse control of non-smooth dynamics with partial observation and execution delay: application to an environmental restoration problem

L. M. Kaplan, “Local node selection for localization in a distributed sensor network,” IEEE Trans. Aerosp. Electron. Syst., vol. 42, no. 1, pp. 136–146, Jan. 2006, doi: 10.1109/TAES.2006.1603410

work page Pith review arXiv 2006
[7]

Rajam ¨aki and V

R. Rajam ¨aki and V . Koivunen, Sparse Sensor Arrays for Active Sensing: Models, Configurations, and Applications, in Sparse Arrays for Radar, Sonar, and Communications, 2024

work page 2024
[8]

[Online]

World Economic Forum, The Global Risks Report 2020. [Online]. Available: https://www.weforum.org

work page 2020

Show all 44 references

[9]

Sensors Cyber- security,

D. A. Gritzalis, G. Pantziou, and R. Rom ´an-Castro, “Sensors Cyber- security,” Sensors (Basel), vol. 21, no. 5, p. 1762, Mar. 2021, doi: 10.3390/s21051762

2021 doi
[10]

GPS Spoofing Attack Characterization and Detection in Smart Grids,

P. Pradhan, K. Nagananda, P. Venkitasubramanium, S. Kishore, and R. S. Blum, “GPS Spoofing Attack Characterization and Detection in Smart Grids,” in Proc. IEEE Conf. Commun. Netw. Security, 2016

2016
[11]

Taxonomy and Challenges of Out-of-Band Signal Injection Attacks and Defenses,

I. Giechaskiel and K. Rasmussen, “Taxonomy and Challenges of Out-of-Band Signal Injection Attacks and Defenses,” IEEE Commun. Surveys Tuts., vol. 22, no. 1, pp. 645–670, 1st Quart., 2020, doi: 10.1109/COMST.2019.2952858

2020
[12]

Approaches to Secure Inference in the Internet of Things,

J. Zhang, R. S. Blum, and H. V . Poor, “Approaches to Secure Inference in the Internet of Things,” IEEE Signal Process. Mag., vol. 35, no. 5, pp. 50–63, 2018

2018
[13]

Comprehensive study for local- ization techniques in manet and vanet,

A. J. Maidamwar and R. Sadakale, “Comprehensive study for local- ization techniques in manet and vanet,” in Proc. Int. Conf. Advances Commun. Comput. Technol., 2018, pp. 349–352

2018
[14]

A security and privacy review of vanets,

F. Qu, Z. Wu, F. Wang, and W. Cho, “A security and privacy review of vanets,” IEEE Trans. Intell. Transp. Syst., vol. 16, no. 6, pp. 2985–2996, 2015

2015
[15]

Implicit cooperative positioning in vehicular networks,

G. Soatti, M. Nicoli, N. Garcia, B. Denis, R. Raulefs, and H. Wymeersch, “Implicit cooperative positioning in vehicular networks,” IEEE Trans. Intell. Transp. Syst., vol. 19, no. 12, pp. 3964–3980, 2018

2018
[16]

Cooperative target tracking in vehicular sensor networks,

H. S. Ramos, A. Boukerche, R. W. Pazzi, A. C. Frery, and A. A. F. Loureiro, “Cooperative target tracking in vehicular sensor networks,” IEEE Wireless Commun., vol. 19, no. 5, pp. 66–73, Oct. 2012

2012
[17]

Vehicular ad hoc networks: A new challenge for localization-based systems,

A. Boukerche, H. de Oliveira, E. Nakamura, and A. Loureiro, “Vehicular ad hoc networks: A new challenge for localization-based systems,” Comput. Commun., vol. 31, pp. 2838–2849, 2008

2008
[18]

Connected Vehicle Security Vulnerabilities [Commentary],

Y . Takefuj, “Connected Vehicle Security Vulnerabilities [Commentary],” IEEE Technol. Soc. Mag., pp. 15–18, Mar. 2018

2018
[19]

A Survey on Cyber-Security of Connected and Autonomous Vehicles (CA Vs),

X. Sun, F. R. Yu, and P. Zhang, “A Survey on Cyber-Security of Connected and Autonomous Vehicles (CA Vs),” IEEE Trans. In- tell. Transp. Syst., vol. 23, no. 7, pp. 6240–6259, Jul. 2022, doi: 10.1109/TITS.2021.3085297

2022
[20]

Cybersecurity Attacks in Vehicular Sensors,

Z. El-Rewini, K. Sadatsharan, N. Sugunaraj, D. F. Selvaraj, S. J. Plathottam, and P. Ranganathan, “Cybersecurity Attacks in Vehicular Sensors,” IEEE Sensors J., vol. 20, no. 22, pp. 13752–13767, Nov. 2020, doi: 10.1109/JSEN.2020.3004275

2020
[21]

Secure state estimation for cyber-physical systems under sparse sensor attacks via a switched Luenberger observer,

A.-Y . Lu and G.-H. Yang, “Secure state estimation for cyber-physical systems under sparse sensor attacks via a switched Luenberger observer,” Inf. Sci., vol. 417, pp. 454–464, 2017

2017
[22]

SMT-based observer design for cyber-physical systems under sensor attacks,

Y . Shoukry et al., “SMT-based observer design for cyber-physical systems under sensor attacks,” ACM Trans. Cyber-Phys. Syst., vol. 2, no. 1, pp. 1–27, 2018

2018
[23]

Secure state estimation: Optimal guarantees against sensor attacks in the presence of noise,

S. Mishra, Y . Shoukry, N. Karamchandani, S. Diggavi, and P. Tabuada, “Secure state estimation: Optimal guarantees against sensor attacks in the presence of noise,” in Proc. IEEE ISIT, 2015, pp. 2929–2933

2015
[24]

Attack detection and identifica- tion in cyber-physical systems,

F. Pasqualetti, F. D ¨orfler, and F. Bullo, “Attack detection and identifica- tion in cyber-physical systems,” IEEE Trans. Autom. Control, vol. 58, no. 11, pp. 2715–2729, 2013

2013
[25]

A data-driven attack detection approach for dc servo motor systems based on mixed optimization strategy,

X.-J. Li and X.-Y . Shen, “A data-driven attack detection approach for dc servo motor systems based on mixed optimization strategy,” IEEE Trans. Ind. Informat., vol. 16, no. 9, pp. 5806–5813, 2019

2019
[26]

Algorithms and Analysis for Optimizing the Tracking Performance of Cyber Attacked Sensor-Equipped Connected Vehicle Networks,

Z. Wang and R. S. Blum, “Algorithms and Analysis for Optimizing the Tracking Performance of Cyber Attacked Sensor-Equipped Connected Vehicle Networks,” IEEE Trans. Inf. Forensics Security, vol. 16, pp. 5061–5076, Oct. 2021

2021
[27]

Distributed Inference with Byzantine Data: State-of-the-Art Review on Data Falsification Attacks,

A. Vempaty, L. Tong, and P. K. Varshney, “Distributed Inference with Byzantine Data: State-of-the-Art Review on Data Falsification Attacks,” IEEE Signal Process. Mag., vol. 30, no. 5, pp. 65–75, Sep. 2013, doi: 10.1109/MSP.2013.2262116

2013
[28]

Localization in Wireless Sensor Networks: Byzantines and Mitigation Techniques,

A. Vempaty, O. Ozdemir, K. Agrawal, H. Chen, and P. K. Varshney, “Localization in Wireless Sensor Networks: Byzantines and Mitigation Techniques,” IEEE Trans. Signal Process., vol. 61, no. 6, pp. 1495–1508, Mar. 2013, doi: 10.1109/TSP.2012.2236325

2013
[29]

The Byzantine generals strike again,

D. Dolev, “The Byzantine generals strike again,” J. Algorithms, vol. 3, no. 1, pp. 14–30, 1982

1982
[30]

Byzantine Machine Learning Made Easy by Resilient Averaging of Momentums,

S. Farhadkhani, R. Guerraoui, N. Gupta, R. Pinot, and J. Stephan, “Byzantine Machine Learning Made Easy by Resilient Averaging of Momentums,” ACM Comput. Surveys, vol. 56, no. 7, Art. 169, Apr. 2024

2024
[31]

The Impact of Order Statistics on Signal Processing,

A. C. Bovik and S. T. Acton, “The Impact of Order Statistics on Signal Processing,” in H. N. Nagaraja, P. K. Sen, and D. F. Morrison, Eds., Statistical Theory and Applications. New York, NY: Springer, 1996

1996
[32]

How Physicality Enables Trust: A New Era of Trust-Centered Cyberphysical Systems,

S. Gil, M. Yemini, A. Chorti, A. Nedi ´c, H. V . Poor, and A. J. Gold- smith, “How Physicality Enables Trust: A New Era of Trust-Centered Cyberphysical Systems,” arXiv preprint arXiv:2311.07492, 2023

2023 arXiv
[33]

Characterizing trust and resilience in distributed consensus for cyberphysical systems,

M. Yemini, A. Nedi ´c, A. J. Goldsmith, and S. Gil, “Characterizing trust and resilience in distributed consensus for cyberphysical systems,” IEEE Trans. Robot., vol. 38, no. 1, pp. 71–91, 2022

2022
[34]

Resilience to malicious activity in distributed optimization for cyberphysical systems,

M. Yemini, A. Nedi ´c, S. Gil, and A. J. Goldsmith, “Resilience to malicious activity in distributed optimization for cyberphysical systems,” in Proc. IEEE Conf. Decision Control (CDC), 2022, pp. 4185–4192

2022
[35]

GAN-based anomaly detection: A review,

X. Xia et al., “GAN-based anomaly detection: A review,” Neurocom- puting, vol. 493, pp. 497–535, 2022

2022
[36]

Generative Adversarial Networks for Anomaly Detec- tion: A Systematic Literature Review,

S. Noor et al., “Generative Adversarial Networks for Anomaly Detec- tion: A Systematic Literature Review,” in Proc. 4th Int. Conf. Comput., Math. Eng. Technol. (iCoMET), Sukkur, Pakistan, 2023, pp. 1–6, doi: 10.1109/iCoMET57998.2023.10099175

2023
[37]

A comprehensive study of auto-encoders for anomaly detection: Efficiency and trade-offs,

A. A. Neloy and M. Turgeon, “A comprehensive study of auto-encoders for anomaly detection: Efficiency and trade-offs,” Mach. Learn. Appl., vol. 17, p. 100572, 2024

2024
[38]

H. V . Poor, An Introduction to Signal Detection and Estimation, 2nd ed. Springer, 1994

1994
[39]

S. M. Kay, Fundamentals of Statistical Signal Processing: Estimation Theory. Prentice Hall, 1993

1993
[40]

Random Forests,

L. Breiman, “Random Forests,” Mach. Learn., vol. 45, no. 1, pp. 5–32, 2001

2001
[41]

Asymptotic minimax charac- ter of the sample distribution function and of the classical multinomial estimator,

A. Dvoretzky, J. Kiefer, and J. Wolfowitz, “Asymptotic minimax charac- ter of the sample distribution function and of the classical multinomial estimator,” Ann. Math. Stat., vol. 27, no. 3, pp. 642–669, 1956

1956
[42]

Data-Driven Attack Detection and Identification for Cyber-Physical Systems Under Sparse Sensor Attacks,

Z. Zhao, Y . Xu, Y . Li, Z. Zhen, Y . Yang, and Y . Shi, “Data-Driven Attack Detection and Identification for Cyber-Physical Systems Under Sparse Sensor Attacks,” IEEE Trans. Autom. Control, vol. 68, no. 10, pp. 6330–6337, 2023, doi: 10.1109/TAC.2022.3230360

2023
[2020]

doi: 10.1007/978-3-030-03243-2 298-1

doi
[2025]

Available: https://arxiv.org/abs/2502.00436

[Online]. Available: https://arxiv.org/abs/2502.00436

arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

P. K. Varshney,Distributed Detection and Data Fusion. Springer Science & Business Media, 2012

work page 2012

[2] [2]

Non-Coherent Source Localization with Distributed Sensor Array Networks,

Z. Wan, W. Liu and P. Willett, “Non-Coherent Source Localization with Distributed Sensor Array Networks,” in Proc. IEEE 12th Sensor Array and Multichannel Signal Processing Workshop (SAM), Trondheim, Norway, 2022, pp. 86–90, doi: 10.1109/SAM53842.2022.9827843

work page arXiv 2022

[3] [3]

Heterogeneous Sensor Fusion With Out Of Sync Data,

B. Chen et al., “Heterogeneous Sensor Fusion With Out Of Sync Data,” in Proc. IEEE Aerospace Conf., Big Sky, MT, USA, 2020, pp. 1–6, doi: 10.1109/AERO47225.2020.9172681

arXiv 2020

[4] [4]

Target Location Estimation in Sensor Networks With Quantized Data,

R. Niu and P. K. Varshney, “Target Location Estimation in Sensor Networks With Quantized Data,” IEEE Trans. Signal Process., vol. 54, no. 12, pp. 4519–4528, Dec. 2006, doi: 10.1109/TSP.2006.882082

work page arXiv 2006

[5] [5]

Data Fusion,

R. Viswanathan, “Data Fusion,” in Computer Vision. Cham: Springer,

work page

[6] [6]

Stochastic impulse control of non-smooth dynamics with partial observation and execution delay: application to an environmental restoration problem

L. M. Kaplan, “Local node selection for localization in a distributed sensor network,” IEEE Trans. Aerosp. Electron. Syst., vol. 42, no. 1, pp. 136–146, Jan. 2006, doi: 10.1109/TAES.2006.1603410

work page Pith review arXiv 2006

[7] [7]

Rajam ¨aki and V

R. Rajam ¨aki and V . Koivunen, Sparse Sensor Arrays for Active Sensing: Models, Configurations, and Applications, in Sparse Arrays for Radar, Sonar, and Communications, 2024

work page 2024

[8] [8]

[Online]

World Economic Forum, The Global Risks Report 2020. [Online]. Available: https://www.weforum.org

work page 2020