Defense Filters for Robust Learning of Partially Observed Dynamical Systems

summary

The gist

The gist: This work proposes a defense-filtering framework to robustly estimate unknown system dynamics from partial observations under adversarial attacks with an attack probability of p < 0.5,

In short

This work proposes a defense-filtering framework to robustly estimate unknown system dynamics from partial observations when an adversary injects noise with a probability less than 0.5 at each time step. The method uses a defense filter matrix constructed using knowledge of the observation matrix to restrict attacks into a lower-dimensional subspace, ensuring provable error bounds for recovering the system's Markov parameter matrix G*.

Key concepts

Defense Filter Matrix (E): This is a special matrix constructed by the system designer based on the known observation matrix C. Its purpose is to filter out or restrict adversarial state injections (wt) into a specific lower-dimensional subspace, thereby limiting the impact of attacks while still allowing for useful system identification.
Full Column-Rank Condition (rank(CE) = e): This condition requires the rank of the product of C and E to equal 'e', which is the dimension of the attack vector. This ensures that the defense filter effectively restricts attacks to a subspace where they are detectable or manageable, allowing for stable estimation.
Markov Parameter Matrix (G*): This matrix captures the essential input-output relationship of a system. Recovering G* allows researchers to reconstruct key system matrices like A, B, and D up to a similarity transformation, which is crucial for understanding the underlying dynamics.

Terminology used across episodes

Reinforcement Learning (RL) — explained in 25 episodes
Sample Complexity — explained in 20 episodes
Retrieval-Augmented Generation (RAG) — explained in 19 episodes
Federated Learning — explained in 17 episodes
Flow Matching — explained in 17 episodes
Quantum Fisher Information (QFI) — explained in 16 episodes

This episode discusses

The paper

Defense Filters for Robust Learning of Partially Observed Dynamical Systems · Read on arXiv

Jihun Kim, Javad Lavaei

Department of Industrial Engineering and Operations Research, University of California, Berkeley

Robust estimation of unknown system dynamics from partial observations under attack is a core challenge in learning for control, increasingly critical in multi-agent networks subject to adversarial data poisoning. Existing methods either require highly restrictive assumptions on the adversary or yield weak error bounds. In this paper, we consider identifying partially observed linear dynamical systems subject to adversarial attacks with an attack probability p < 0.5 at each time. We propose a defense-filtering framework in which a system designer leverages knowledge of the observation matrix to construct a defense filter satisfying full column rank and subspace separability conditions, which enables the evaluation of a single-attack scenario against observed data. Using this framework, we analyze the constrained 2-norm estimator and establish finite-sample error bounds for recovering the Markov parameter matrix G*. This is the first approach to provide provable system identification guarantees via a defense filter for partially observed systems subject to harsh attack environments where the attack probability approaches 0.5.

Transcript

Introduction to the show: ident: Robotics Radio. Generated commentary on the latest robotics and control papers.

Rosa: Today's paper: "Defense Filters for Robust Learning of Partially Observed Dynamical Systems".

Dev: The gist: This work proposes a defense-filtering framework to robustly estimate unknown system dynamics from partial observations under adversarial attacks with an attack probability of p < 0.5,

Rosa: First, who's behind it and why it matters.

Title and authors: Rosa: Now we move into the title and authors of this paper, "Defense Filters for Robust Learning of Partially Observed Dynamical Systems." This paper is essentially about making system identification more robust when you're missing some observations and facing adversarial attacks.

Dev: The authors are Jihun Kim and Javad Lavaei from the Department of Industrial Engineering and Operations Research at the University of California, Berkeley. They are the ones who developed this defense-filtering framework.

Taro: So they’re applying their work on partially observed systems, which is a tricky area where you don't have all your data points for every state variable at once.

Rosa: That partial observation is exactly the problem here, but they are adding the layer of adversarial attacks where some of those observations might be deliberately wrong.

Dev: They tackle this by proposing a defense filter matrix E that the system designer constructs based on the known observation matrix C to restrict where these adversarial injections can happen in the state update.

Taro: So it’s about using knowledge of how we observe the system to create a shield against attacks, which is an interesting way to approach robustness.

The paper's summary: Rosa: The summary explains that they are identifying partially observed linear dynamical systems subject to adversarial attacks with an attack probability p less than zero point five at each time step <ref:2610.21935#pg1,identifying partially observed linear dynamical systems subject to adversarial attacks with an>.

Dev: They propose this defense-filtering framework where the system designer builds a filter matrix E to satisfy two specific geometric conditions: full column rank and subspace separability.

Taro: Those conditions are necessary for them to find a matrix H that connects the observation matrix C and the state update structure in a way that allows them to evaluate the single-attack scenario against observed data.

Rosa: Essentially, they are using this framework to analyze a single attack scenario against observed data by leveraging knowledge of C.

Dev: They then use this setup to analyze the constrained L2-norm estimator and establish finite-sample error bounds for recovering the Markov parameter matrix G star.

Taro: The core implication is that they prove that accurate estimation of G star is achievable under adversarial attacks with any p less than zero point five, which is a significant step over previous methods that required the attack probability to get very small <ref:2610.21935#pg1>.

The paper's improvements: Rosa: The paper highlights several key improvements. First, they successfully introduce an L2-norm estimator under adversarial attacks with p less than zero point five and establish rigorous finite-sample error bounds for recovering the Markov parameter matrix G star <ref:2610.21935#pg1,finite-sample error bounds for recovering the Markov parameter matrix G>.

Dev: They also showed that the relative estimation error bound decays exponentially with parameter s whenever rho one minus p is less than one or equivalently, when the attack probability is less than one minus rho <ref:2610.21935#pg1>.

Taro: And they provide a diagnostic signal through the normalized filter residuals, where unattacked periods yield small filter residuals while attacked periods induce large residual spikes.

Rosa: They also include a lower-bound constraint on H squared greater than or equal to one in the optimization problem to prevent the estimation error factor from approaching zero and ensure a stable time bound.

Conclusion: Dev: So, wrapping up, this paper successfully introduces a constrained L2-norm estimator under adversarial attacks with p less than zero point five and proves these finite-sample error bounds for recovering the Markov parameter matrix G star <ref:2610.21935#pg1,finite-sample error bounds for recovering the Markov parameter matrix G>.

Rosa: It’s a major step forward because it overcomes the limitation of existing methods that required diminishing attack probability as the target estimation error decreases.

Taro: The ability to detect attacked time steps via filter residuals is a very practical feature for real-time monitoring in systems where data streams might be corrupted by attacks.

Dev: We also get a diagnostic signal through the relative estimation error bound, which lets us monitor anomalies even when absolute scale isn't explicitly known.

Rosa: This whole work on "Defense Filters for Robust Learning of Partially Observed Dynamical Systems" shows that we can build identification systems that are much more resilient to attacks than before.

Taro: It’s a solid result, and the path forward seems to be extending this into a two-stage algorithm where you filter out attacked data first, then re-estimating the system dynamics on the clean dataset.

Dev: We’re ready for what's next in robust system identification research.

More episodes

← Home