New Attack on AI-Controlled Systems Evades Safety Monitors via Gain Manipulation

In a new paper, Ali Eslami and Jiangbo Yu introduce Gain Manipulation Attacks (GMA) targeting agentic cyber-physical systems (CPS)—systems where AI agents modify control parameters in real time. The authors identify feedback gains as the highest-leverage target: a single gain matrix determines the closed-loop eigenvalue placement for the entire system. Malicious updates can alter dynamics while evading classical residual-based monitors because the attack operates through a novel parameter channel distinct from sensor and actuator channels. The paper introduces a three-axis attacker model and a taxonomy of GMA, identifying two impact classes: stability-margin erosion under sustained gain drift, and transient amplification under one-shot gain replacement.

Importantly, the authors show that even a stability-preserving gain replacement can produce transient amplification far exceeding safe operating limits—meaning stability verification alone is insufficient to guarantee safety. They derive stealthiness conditions and worst-case impact certificates using Bauer–Fike eigenvalue bounds and the Kreiss matrix theorem. Preliminary detection directions are provided, along with a vehicle lateral dynamics example. This work highlights a critical vulnerability in next-generation autonomous systems, where AI agents can be manipulated to cause catastrophic failures while passing all stability checks.