Bezzo and colleagues keep a ground robot’s cruise control working when one of its speed sensors is attacked. The robot has N redundant speed measurements (GPS, left and right wheel encoders, IMU). Their recursive adaptive estimator (RAE) is a Kalman-style filter with an extra “shielding factor” per sensor: whenever a sensor’s measurement disagrees with the predicted state by more than its noise would explain, its noise variance is inflated, so it counts for less. No sensor is thrown out, and a sensor whose attack stops regains its weight. They compare it with the resilient state estimator (RSE) of Fawzi, Tabuada and Diggavi, which solves an decoding problem over a window of past measurements.
Findings
- Assumption: fewer than N/2 sensors are under attack at once. The attack vector is otherwise arbitrary.
- Simulation, cruise control at 4 m/s then 10 m/s, attack on GPS. With low noise (σ = 0.01) and a 5 m/s attack, a plain Kalman filter’s error is 334 times the oracle’s, while RSE and RAE both match the oracle (error 0.005).
- With σ = 1 and a 3 m/s attack, RAE’s error is 1.38 times the oracle against 1.62 for RSE and 7.62 for the Kalman filter. When the attack hides inside the noise (σ = 2, 2 m/s), all three degrade and the Kalman filter is nearly as good as the others.
- Hardware: a LandShark and a custom MiniShark UGV on tiles and grass, with GPS and two encoders, hold the reference speed while one sensor at a time is attacked with a constant offset. RAE needs no measurement history, so it is cheaper than RSE.
Limits
- Linear, one-dimensional state (speed) and a stable plant. The authors list unstable systems such as quadrotors, waypoint navigation and coordinated attacks as future work.
- The noise bounds must be known. The authors note that too tight a bound rejects good data and too loose a bound lets attacks through.
- Attacks inside the noise profile are, by construction, not separable from noise.
- Recovery here is graceful degradation of the estimate. A supervisor that switches strategies is future work.
Relevance
It poses the single-robot version of the resilient consensus problem: fewer than half the sources may lie, and a weighted average must not follow them. The N/2 bound plays the role that plays for Byzantine agreement. GPS spoofing is the motivating attack, so it also belongs under robot security and cyber-physical security.