ConAML: Constrained Adversarial Machine Learning for Cyber-Physical Systems

Abstract

Recent research demonstrated that the superficially well-trained machine learning (ML) models are highly vulnerable to adversarial examples. As ML techniques are rapidly employed in cyber-physical systems (CPSs), the security of these applications is of concern. However, current studies on adversarial machine learning (AML) mainly focus on computer vision and related fields. The risks the adversarial examples can bring to the CPS applications have not been well investigated. In particular, due to the distributed property of data sources and the inherent physical constraints imposed by CPSs, the widely-used threat models in previous research and the state-of-the-art AML algorithms are no longer practical when applied to CPS applications.We study the vulnerabilities of ML applied in CPSs by proposing Constrained Adversarial Machine Learning (ConAML), which generates adversarial examples used as ML model input that meet the intrinsic constraints of the physical systems. We first summarize the difference between AML in CPSs and AML in existing cyber systems and propose a general threat model for ConAML. We then design a best-effort search algorithm to iteratively generate adversarial examples with linear physical constraints. As proofs of concept, we evaluate the vulnerabilities of ML models used in the electric power grid and water treatment systems. The results show that our ConAML algorithms can effectively generate adversarial examples which significantly decrease the performance of the ML models even under practical physical constraints.

Exploring Physical-Based Constraints in Short-Term Load Forecasting: A Defense Mechanism Against Cyberattack

“…This action may present a built-in defense mechanism. Li et al study potential vulnerabilities of ML applied in power systems by proposing constraints that adversarial examples must satisfy the intrinsic constraints of physical systems [14]. In power system SE the physical constraints have already been encoded in the mathematical model; however Liu et al propose an approach that guarantees attacker to pass those constraints in linear case [12].…”

“…To address this issue, physical-based constraints can provide a stronger obstacle for attacker. Li et al propose adding inherent constraints in power system state estimation (SE) [14]. This idea makes a further constrained problem that needs to be solved by attackers while satisfying the physical systems' inherent constraints.…”

Neural Network Guided Evolutionary Fuzzing for Finding Traffic Violations of Autonomous Vehicles

“…As per Section 4.3.3, we apply a constrained gradient-guided mutation on the selected top test cases to maximize their likelihood of leading to traffic violations. The procedure, shown in Algorithm 1, is adapted from the constrained adversarial attack in [39].…”

“…The simplest solution is to discard the perturbations (and subsequent iterations) that lead to constraint violation. However, as shown in [39], the insight for linear constraints is if an original (unperturbed) test case satisfies the constraints and the perturbation alone satisfies the constraints as well, then the perturbed test case also satisfies the constraints. Thus, only the perturbation needs to be checked against the constraints after each iteration.…”

“…Thus, only the perturbation needs to be checked against the constraints after each iteration. If some constraints are violated, we apply a linear regression to the perturbation to map it back within the constrained region (motivated by [39]). For the linear regression, the non-constant part of the constraints are weights W where each row corresponds to the coefficients of one constraint, the constant parts 𝑦 are the objectives, and the projected perturbation 𝑑𝑥 𝑝𝑟𝑜 𝑗 are the variables to search for.…”