6-minute read · Cyber-physical systems security
A robot receives a perfectly authenticated message: its wheels are stationary. Its camera suggests motion. Its controller must decide what to believe before the next steering command. The network may be secure, yet the machine's account of the physical world is inconsistent.
This hypothetical situation captures a central problem in cyber-physical security. Protecting software and communications is essential, but a controller also needs reasons to trust its measurements. Those reasons must survive interference, equipment faults and deliberate deception. Research on sensor attacks and resilient control offers useful foundations, provided we understand what each result actually establishes.
Authentication can establish that a message came from a device holding the expected credentials and was not altered in transit. It does not establish that the device measured reality correctly. If interference corrupts a sensor before its output becomes a digital message, the device can faithfully authenticate an incorrect reading.
The WALNUT study demonstrated this distinction experimentally. Trippel and colleagues showed that acoustic interference could manipulate outputs from susceptible MEMS accelerometers, miniature devices that measure acceleration. The weakness lay in the interaction between physical sensing and signal processing. This was evidence about tested devices under specified conditions, not a finding that every accelerometer is equally vulnerable. [1]
Tu and colleagues subsequently investigated how misleading inertial measurements could propagate into the behavior of real devices and control systems. Their work reinforces an important evaluation principle: a corrupted sensor reading matters because of what downstream software does with it. A large measurement error and a dangerous physical outcome are related, but they are not interchangeable measures of impact. [2]
Sensor fusion combines observations to estimate something that no single sensor measures perfectly. For example, a mobile robot may combine satellite positioning, inertial measurements and observations of its surroundings. This can improve ordinary operating accuracy. Security additionally requires asking how the combination behaves when an input is deliberately misleading.
Shen and colleagues examined a production-grade localization system combining multiple sensors. Their analysis and evaluation using recorded sensor traces showed that manipulated GPS input could dominate the estimate during vulnerable conditions. The study challenged the assumption that incorporating other sensors automatically defeats GPS spoofing. It did not demonstrate that every fusion architecture fails in the same way. [3]
A practical design recommendation follows: assess the independence of evidence, not simply the number of devices. Two measurements may share a vulnerable sensing principle, a clock, a power supply or a processing component. Engineers should also examine how confidence weights change when one source becomes uncertain. A collection of sensors is useful only to the extent that its remaining trustworthy information can constrain a bad estimate.
One useful question is whether measurements agree with the system's expected physical behavior. If a controller commands motion, do subsequent observations remain compatible with that command, the previous state and plausible disturbances? The difference between a predicted and an observed measurement is often called a residual. A persistent or unexpected residual can prompt closer scrutiny.
SAVIOR, developed by Quinonez and colleagues, combined physical models with statistical monitoring for autonomous vehicles and evaluated the approach on aerial and ground platforms. The research also considered attacks designed to remain difficult to detect. Its threat model explicitly excluded an adversary able to manipulate all relevant sensors and actuators: some trustworthy relationship had to remain available to expose inconsistency. This is a valuable qualification whenever physics-based detection is proposed as a defense. [4]
More recent work extends consistency reasoning across space and time. PhyScout examined conflicts in observations of an autonomous vehicle's environment and evaluated detection in simulations, datasets and physical scenarios. It illustrates how relationships between observations can provide evidence beyond an isolated sensor value. Its reported performance belongs to its evaluated settings, rather than constituting a universal guarantee. [5]
For an engineering team, I would start with interpretable checks: feasible ranges, plausible rates of change, timestamp freshness and agreement between commanded actions and observed responses. These are design suggestions, not a claim that a particular checklist defeats all attacks. Thresholds need validation across legitimate operating conditions. A sharp turn, a changed payload or a rough surface may create unusual observations without malicious activity.
An alarm alone does not tell a controller which value is correct. Fawzi, Tabuada and Diggavi studied secure estimation and control for linear systems with corrupted measurements or control inputs. Their results connect recoverability to the system's mathematical structure and the extent of corruption. The broader lesson is that trustworthy reconstruction requires explicit assumptions about what remains observable; it cannot be promised solely because an algorithm rejects outliers. [6]
Consequently, the response to uncertainty should be designed alongside detection. Depending on the application, candidate responses might include reducing speed, restricting operating modes, requesting operator intervention or transitioning to a separately validated protective state. Each option needs its own hazard analysis. Abruptly stopping is not automatically safe for every physical process.
NIST's guidance for operational technology emphasizes that cybersecurity measures must account for performance, reliability and safety requirements. Applied here, that means evaluating both the suspicious measurement and the consequences of the chosen response. A defensive action that disrupts a critical process can itself create unacceptable risk. [7]
For researchers comparing defenses, I recommend reporting outcomes that connect security claims to physical behavior:
Detection delay: Does the alarm arrive before the system loses its safety margin?
False alarms: How often does normal operation trigger intervention, and what does that intervention cost?
Physical consequence: How far do position, speed, temperature or another relevant variable depart from acceptable limits?
Coverage and assumptions: Which sensors, operating conditions and adversary capabilities were tested, and which were excluded?
Recovery behavior: Can the system reach and maintain the intended protective condition with the information still available?
Evaluation should include benign disturbances as well as adversarial inputs, and distinguish software simulation, replayed measurements and physical experiments. Each provides different evidence. Tests should also cover transitions between operating modes, when the assumptions supporting an estimator or fallback may change.
The engineering objective is a system that recognizes when its evidence has weakened and adjusts its behavior accordingly. That requires collaboration across sensor hardware, estimation, cybersecurity and safety engineering. Trustworthy sensing begins with a clear account of what the machine knows, why it believes it and what it can safely do when that belief becomes uncertain.
Timothy Trippel, Ofir Weisse, Wenyuan Xu, Peter Honeyman and Kevin Fu. “WALNUT: Waging Doubt on the Integrity of MEMS Accelerometers with Acoustic Injection Attacks.” 2017 IEEE European Symposium on Security and Privacy, pp. 3–18, 2017. DOI: 10.1109/EuroSP.2017.42.
Yazhou Tu, Zhiqiang Lin, Insup Lee and Xiali Hei. “Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors.” 27th USENIX Security Symposium, pp. 1545–1562, 2018. Paper and proceedings record.
Junjie Shen, Jun Yeon Won, Zeyuan Chen and Qi Alfred Chen. “Drift with Devil: Security of Multi-Sensor Fusion based Localization in High-Level Autonomous Driving under GPS Spoofing.” 29th USENIX Security Symposium, pp. 931–948, 2020. Paper and proceedings record.
Raul Quinonez, Jairo Giraldo, Luis Salazar, Erick Bauman, Alvaro Cardenas and Zhiqiang Lin. “SAVIOR: Securing Autonomous Vehicles with Robust Physical Invariants.” 29th USENIX Security Symposium, pp. 895–912, 2020. Paper and proceedings record.
Yuan Xu, Gelei Deng, Xingshuo Han, Guanlin Li, Han Qiu and Tianwei Zhang. “PhyScout: Detecting Sensor Spoofing Attacks via Spatio-temporal Consistency.” Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security, pp. 1879–1893, 2024. DOI: 10.1145/3658644.3670290.
Hamza Fawzi, Paulo Tabuada and Suhas Diggavi. “Secure Estimation and Control for Cyber-Physical Systems Under Adversarial Attacks.” IEEE Transactions on Automatic Control, 59(6), pp. 1454–1467, 2014. DOI: 10.1109/TAC.2014.2303233. Open author manuscript.
Keith Stouffer, Michael Pease, CheeYee Tang, Timothy Zimmerman, Victoria Pillitteri, Suzanne Lightman, Adam Hahn, Stephanie Saravia, Aslam Sherule and Michael Thompson. Guide to Operational Technology (OT) Security. NIST Special Publication 800-82 Revision 3, 2023. DOI: 10.6028/NIST.SP.800-82r3.