New model-free attack scheduling achieves 1-2% budget accuracy on CPS

Cyber-physical systems (CPS) like autonomous vehicles or industrial control networks face a new class of stealthy attacks that carefully schedule false data injections to stay below detection thresholds. Existing attack schedulers rely on full knowledge of the plant model and assume sensor residuals follow a Gaussian distribution—assumptions that fail in real-world CPS where residuals are heavy-tailed and dynamics are unknown to the adversary. A team from academia has now demonstrated a model-free alternative that bypasses these requirements entirely.

The approach replaces the parametric Gaussian threshold with the empirical quantile of a learned sequence autoencoder residual, calibrated purely from sensor measurements. The scheduler provably converges to the target attack budget almost surely under stationary ergodic residuals. Experiments on both synthetic systems and a real heavy-duty truck dataset show budget tracking within 1-2%, while preserving residual magnitude to guarantee stealthiness against any residual-based detector. In contrast, a model-based baseline with full knowledge of the true plant and innovation covariance mis-realized the budget by up to 8.96% under heavy-tailed residuals, delivering only 1.37x system degradation when 1.84x was intended—a significant shortfall that could allow the attacker to fail their objective or get detected.