{"id":"1f47fa39-9819-404b-9ede-a61c36363396","arxiv_id":"2411.09956","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A Gaussian-Bernoulli mixture with binary observation indicators enables joint sensor-attack detection and state estimation through mixed-integer optimization, closed-form Kalman updates, and a proximal-gradient iteration.","lead":"The paper proposes a Gaussian-Bernoulli Secure estimator that jointly estimates a system's state and flags attacked sensor readings when the attack model is unknown, by solving a mixed-integer optimization with Kalman-style updates. A reader in control or CPS security would care because it couples attack detection and resilient state estimation in one objective and offers a faster iterative update scheme.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Equations (4)-(6) do not establish the residual-threshold rule as the optimal detector for Assumption 1: uniform-density and normalization terms are dropped, and alpha is tuned in Section 7.2, so the central 'optimal surrogate' claim is unsupported.","rationale":"The reader's weakest assumption identifies the threshold rule and the tuning of alpha as the weak point; I agree and go further by locating the failure in the probabilistic derivation itself. Equations (4)-(5) are not valid posterior odds for the Gaussian-Bernoulli mixture: they multiply by p(delta1_t) when no delta_t exists under p_t=0, maximize the p_t=1 term to exp(0) while retaining a uniform-density factor, and omit the Gaussian normalization and the marginal p(y_t). The claimed reduction to equation (6) therefore does not follow from Assumption 1. This matters because Problem 1 and Algorithm 3 inherit the threshold, so the paper's assertion that detection is recast as an optimal estimation problem is not supported. The empirical comparisons in Sections 7.2 and 7.3 are real evidence that the tuned heuristic performs well, and the fixed-indicator estimation results (Lemma 1, Theorem 1, and the proximal update) appear internally coherent. The lack of a global optimality guarantee for Algorithm 3 is secondary: the threshold derivation is more foundational. The paper can be repaired by providing a correct MAP derivation or by explicitly treating alpha as a tunable robustness parameter with a sensitivity and false-alarm analysis; conditional acceptance remains appropriate. The appendix numbering mismatch (A.2 proving Theorem 2, A.3 proving Theorem 3) is a presentation issue, not a load-bearing concern.","tokens_in":19786,"tokens_out":6753,"duration_ms":77812,"concrete_test":"Re-derive the MAP test under Assumption 1 exactly. Fix a scalar system, set R, beta, and Uniform(-a,a) for delta_t; for a grid of residuals r = y - Cx compute the exact posterior probability P(p_t=1 | r) using the convolution p(r|p_t=1) = (2a)^{-1} integral_{-a}^{a} phi(r - delta; R) d(delta). Then check whether the optimal decision boundary is of the form r^2/R > alpha for a constant alpha independent of a and x. Also compare the exact MAP labels with the paper's rule on samples generated from the assumed model using the Section 7.2 parameters; if the labels differ on a nontrivial fraction of samples, equations (6) and (19) are not the optimal rule for the assumed model.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central theoretical claim is that solving Problem 1 is the correct statistical way to combine state estimation and attack detection under Assumption 1. That claim is not supported by the derivation of the threshold rule. In equations (4)-(5), the likelihood for p_t=0 includes a factor p(delta1_t) even though delta_t is absent when p_t=0, while the p_t=1 term is maximized to exp(0) times beta p(delta2_t); these are not the correct posterior odds for the stated model. If delta_t is uniform on a finite support, the p_t=1 marginal is the convolution N(0,R) * Uniform, not exp(0). Its density depends on the support length, and the posterior odds also carry the Gaussian normalization from R and the marginal p(y_t). These terms do not collapse into alpha proportional to ln((1-beta)/beta). Moreover, Assumption 1 states that delta_t has 'unknown probability density', so no such alpha can be computed from the model. Consistent with this, Section 7.2 does not compute alpha from beta: it sets alpha_threshold=6 and tau=3 to 'achieve optimal performance', i.e., the detection rule is tuned. Since equations (19) and Problem 1 inherit this threshold, the load-bearing assertion that the GBS estimator yields attack detection without attack-model knowledge is not established. The empirical results still stand as evidence for a tuned heuristic, but the paper's foundational 'transform detection into optimal estimation' claim is unproven.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This manuscript considers secure state estimation and attack detection for linear cyber-physical systems, modeling the measurement noise as a Gaussian term plus a Bernoulli-switched attack term of unknown distribution (Assumption 1). The proposed Gaussian-Bernoulli Secure (GBS) estimator solves Problem 1 (Eq. 7), a mixed-integer program over the state sequence and binary observation indicators, by alternating a threshold-based indicator update (Eq. 19) with state-sequence estimation under the selected reliable observations. For the latter, Lemma 1 gives a closed-form Kalman/RTS smoother solution, and Theorem 1 with Algorithm 1 provides a proximal-gradient iteration with a linear convergence rate; Theorem 2 bounds the iteration count when one observation is added. Algorithm 3 combines these pieces and raises an attack alarm when the number of rejected observations exceeds a tolerance parameter. Simulations compare the GBS estimator with chi-square, CUSUM, and resilient estimators under random, constant, and ramp attacks, and compare the direct and iterative update rules under different observation-addition schedules.","tokens_in":20114,"tokens_out":6387,"duration_ms":70028,"significance":"The paper has a clear practical ambition: a joint detector-estimator formulated as a single optimization problem. The fixed-indicator state-estimation portion is coherent and largely standard: Lemma 1 is a direct Kalman/RTS derivation for partial observations, and Theorem 1 follows from standard proximal-gradient analysis under strong convexity. The numerical comparisons are extensive, and the reported gains in detection and estimation are plausible for the tuned threshold rule actually implemented. However, the paper's foundational claim that the Gaussian-Bernoulli model optimally converts attack detection into state estimation is not substantiated. Equations (4)-(6) do not correctly compute posterior odds under Assumption 1, and the threshold alpha is tuned rather than derived from the model. The significance of the work therefore currently rests on empirical evidence for a tuned innovation-based heuristic rather than on the claimed model-based optimality. If the authors either correct the statistical derivation or explicitly reframe the contribution as an efficient tuned heuristic with good empirical performance, the paper would still be useful to the CPS security community.","major_comments":[{"comment":"The derivation of the threshold rule is not a posterior-odds computation for the model in Assumption 1. For p_t = 0, the likelihood should be the Gaussian density of y_t - C x_t alone, with no factor p(delta^1_t), since delta_t is absent when p_t = 0. For p_t = 1, the likelihood is the convolution of N(0, R) with the distribution of delta_t, not exp(0), and the maximization over delta_t does not remove the dependence on the support of the uniform distribution. The posterior odds also carry the normalization 1/p(y_t) and the Gaussian normalization from R, and these terms do not collapse into a constant alpha proportional to ln((1-beta)/beta). Moreover, Assumption 1 states that delta_t has an unknown density, so no alpha can be computed from the model as written. Equation (6) is therefore an assumed threshold rule, not a derived consequence of the Gaussian-Bernoulli mixture model.","section":"Section 3.2, Eqs. (4)-(6)"},{"comment":"The central claim that the GBS estimator detects attacks without attack-model knowledge relies on the parameter alpha. Section 7.2 states that alpha_threshold = 6 and tau_tolerant = 3 are chosen to allow each detector and estimator to achieve optimal performance, and Algorithm 3 inherits these values through the threshold in Eq. (19) and through the alarm condition on line 24. No procedure is given for computing alpha from the Bernoulli parameter beta or for choosing alpha from an attack-free false-alarm specification. Consequently, the experiments demonstrate the behavior of a tuned residual-threshold heuristic; they do not validate the model-based optimality asserted in Contribution (1) and in Section 3.2. The authors should either derive alpha from the stated model and a detection criterion, or explicitly reframe the method as a heuristic whose parameters are tuned.","section":"Section 7.2 and Algorithm 3"},{"comment":"The initial strategy uses the opposite inequality from the rest of the paper. Line 3 sets p-hat_i = bool(||y_i - C x-hat_i||^2_{R^{-1}} < alpha), so p-hat_i = 1 denotes a small residual, and lines 5-7 then perform a Kalman measurement update with that observation. Throughout Section 6.2, however, p_i = 1 denotes an abnormal observation that should be discarded: Eq. (19) flags p-hat_i = 1 when the residual norm exceeds alpha, and the reliable set is O = {i | p-hat_i = 0}. If Algorithm 2 is taken literally, the initialization discards the normal observations and assimilates the attacked ones. This should be corrected to use '> alpha', and the implications for the reported simulations should be checked.","section":"Algorithm 2, lines 3-8"}],"minor_comments":[{"comment":"The statement that delta_t has a uniform distribution with unknown probability density is internally contradictory; a uniform distribution has a known density up to its support. Please clarify whether the support is known and whether the density is intended to be unknown only in its support parameters.","section":"Assumption 1, Eq. (3)"},{"comment":"The appendix headings are mismatched with the main text: Appendix A.2 is titled 'Proof of Theorem 2' but proves the convergence result of Theorem 1, while Appendix A.3 proves Theorem 3, which does not appear in the main text (the relevant statement is Theorem 2 in Section 5.2). Renumbering would remove confusion.","section":"Appendix A.2 and A.3"},{"comment":"The sentence 'we assume the process noise ... is not uncorrelated with measurement noise' appears to be a double negative; presumably the intended meaning is that the process noise is uncorrelated with the measurement noise. Please correct the wording.","section":"Section 3.1, text after Eq. (1)"},{"comment":"The caption refers to the 'GSB Estimator' in the left and right figures, but the estimator is elsewhere called the GBS estimator; the abbreviation should be made consistent.","section":"Figure 9 caption"},{"comment":"The convergence argument shows monotone non-increase of W over the finite set of indicator vectors, which implies termination at a fixed point of the local search, but it does not establish convergence to the global optimum of Problem 1. The local flip test in Eq. (23) can stop at a local minimum. The authors should state this limitation explicitly where the word 'optimal' is used.","section":"Section 6.3, after Eq. (26)"}],"recommendation":"major_revision","confidential_remarks":"The paper fits the journal's scope and does not raise citation or novelty concerns. The main obstacle is the unsupported statistical derivation of the detection threshold; this is a load-bearing issue for the central claim that the method solves an optimal estimation-based detection problem. The fixed-indicator estimation results are solid enough to be retained, and the empirical evaluation may still be publishable if the method is repositioned as a tuned heuristic or if a correct derivation of alpha is supplied. I would not reject the paper at this stage, but the revision must address the derivation and the parameter-tuning issue head-on."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The GBS estimator is a real engineering contribution, but the theoretical packaging oversells it. What is genuinely new is the joint MIP formulation in Problem 1 and the alternating algorithm that combines threshold-based indicator updates with warm-started proximal gradient state updates. That combination is not in the cited literature, and the simulation section shows it can beat chi-square, CUSUM, and resilient estimators across random, constant, and ramp attacks. Those experiments are the strongest part of the paper, and they stand even if the theory is weaker than claimed.\n\nThere is good material in the state-estimation half. Lemma 1's closed-form solution for smoothing with partial observations via Kalman/RTS is a clean extension, and the iterative proximal gradient method with a fixed preconditioner is a sensible way to avoid recomputing gains. The convergence rate in Theorem 1 is standard but correctly applied. The iteration-count bound in Theorem 2, which ties the number of iterations to the initial estimation error, is a nice touch and plausibly useful for online implementations.\n\nThe soft spot is the derivation of the detection rule. Equations (4) and (5) are not correct posterior odds for the stated model. When p_t=0, the likelihood is a normalized Gaussian density; there is no delta_t term. When p_t=1, the likelihood is the convolution of the Gaussian and the uniform distribution, not exp(0), and its value depends on the support length. Nor do the posterior odds collapse into a single penalty alpha unless the normalizing constants and the uniform density cancel, which they do not. Assumption 1 explicitly says delta_t has unknown density, so alpha cannot be computed from beta. Section 7.2 confirms this: alpha_threshold=6 is tuned, not derived. The threshold rule in equations (6) and (19) is therefore a reasonable residual-based heuristic, and the empirical results support that heuristic, but the paper's central claim that detection is 'transformed into optimal estimation' is not established.\n\nA few smaller issues: the GBS convergence result is monotone descent to a fixed point, not global optimality of the MIP, and the appendix theorem numbering does not match the main text. No code or data is provided, which matters for a paper whose main evidence is simulation. Still, the method is coherent and the empirical comparisons are informative. With the framing adjusted to present Problem 1 as a principled heuristic rather than the exact Bayesian solution, this is worth publishing.\n\nI would send this to peer review as a regular submission, with the request that the authors either supply a correct probabilistic derivation or explicitly reframe the contribution as a joint optimization heuristic with tuned alpha. The paper will be useful to researchers working on secure state estimation who want a practical joint detector-estimator; they should read the simulations and treat the theoretical derivation with caution.","headline":"A useful joint detection-estimation heuristic with a promising alternating solver, but the paper's claim to have derived it as the optimal Gaussian-Bernoulli estimator is not supported by the equations.","tokens_in":20607,"tokens_out":1958,"would_cite":false,"duration_ms":27120,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["93E11","90C11"],"pacs":[],"model":"deepseek-v4-flash","headline":"One optimization over states and attack flags detects sensor attacks without an attack model.","keywords":["cyber-physical systems","attack detection","resilient state estimation","Gaussian-Bernoulli mixture model","observation indicators","Kalman filter","proximal gradient descent","mixed-integer programming"],"falsifier":"Run the GBS estimator against an adversary that knows the current estimate and injects $\\delta_t$ so that the corrupted reading stays inside the $\\alpha$-threshold ellipsoid, for example by setting the injected value close to $C\\hat{x}_t$ and adding small noise. If the estimator reports no alarm while the state estimate diverges from the true state, the residual-threshold detection rule is falsified; a quantitative version would vary $\\alpha$ and report the minimum attack magnitude needed for a given detection rate.","tokens_in":19560,"feed_emoji":"📡","tokens_out":12770,"duration_ms":123090,"temperature":0.7,"pith_summary":"Most cyber-physical systems run attack detection and state estimation as separate routines, and both degrade when the attack model is unknown. This paper claims that by modeling each observation as either clean Gaussian noise or contaminated by an unknown extra term selected by a Bernoulli indicator, the two tasks collapse into a single dual-variable optimization over states and indicators. The resulting Gaussian-Bernoulli Secure estimator alternates between estimating states from trusted observations and updating trust flags by a threshold on the squared residual, with closed-form Kalman-filter and smoothing solutions for the estimation subproblem and a proximal-gradient iteration for speed. In simulations it reports higher detection success and lower estimation error than chi-square, CUSUM, and resilient baselines under random, constant, and ramp attacks.","feed_headline":"One estimator detects attacks and keeps state estimates accurate","feed_subtitle":"A Gaussian-Bernoulli model turns attack detection into a residual threshold, beating chi-square and CUSUM in simulations.","key_machinery":"The load-bearing object is the Gaussian-Bernoulli mixture observation model $\\bar{v}_t = v_t + p_t\\delta_t$, where $p_t$ is a Bernoulli indicator flagging abnormal readings and $\\delta_t$ is an unknown uniform disturbance; this turns the problem into a mixed-integer program over states and flags. The dual-variable objective $W$ in equation (7) is what lets one algorithm do detection and estimation: the quadratic terms encode system dynamics and trusted observations, while the binary term $\\alpha p_i$ charges a penalty for distrusting a reading. Two sub-results carry the computation: Lemma 1 gives a closed-form Kalman/RTS solution for sequential estimation from partial observations, with zero gains on missing data, and Theorem 1 gives the proximal-gradient update $(I + \\eta H)^{-1}(X - \\eta\\nabla f(X))$, which converges linearly and reuses the previous estimate as a warm start when new observations are admitted. The threshold rule $\\hat{p}_i = \\mathrm{bool}(\\|y_i - C\\hat{x}_i\\|^2_{R^{-1}} > \\alpha)$ closes the loop by updating flags from residuals.","core_discovery":"The paper's central claim is that attack detection is not a separate problem from state estimation: in a linear Gaussian system whose measurement noise is a Gaussian-Bernoulli mixture, the right object to solve is the joint objective $W$ over the state sequence and binary observation indicators, and its minimizer simultaneously yields resilient estimates and attack flags. The detection rule falls out as a threshold: flag observation $i$ whenever the squared residual $\\|y_i - C\\hat{x}_i\\|^2_{R^{-1}}$ exceeds $\\alpha$, where $\\alpha$ is set by the assumed Bernoulli rate. For a fixed set of trusted observations, the estimation subproblem is a partial-observation MAP problem with a unique closed-form solution via Kalman filtering and Rauch-Tung-Striebel smoothing with zero gains on discarded data. Because that direct solution is expensive, the paper proves a proximal-gradient iteration converges linearly to the same estimate, and the full algorithm alternates these steps with a one-flag flip test to escape suboptimal cycles.","pith_inferences":["The paper leaves implicit that the same objective could run in sliding-window online mode: the warm-started proximal iteration is naturally suited to streaming observations, though the convergence proof is stated for a fixed interval.","A testable extension is to treat $\\beta$, hence $\\alpha$, as unknown and estimate it online from the empirical frequency of flagged observations; the current method assumes this penalty is known a priori.","The residual-threshold rule defines the method's boundary: an adversary who keeps each corrupted measurement close to the predicted state will not be flagged, and the paper does not analyze that case; its own Section 6.2 notes the alternating update can stall at suboptimal indicator configurations and adds a flip check to escape them.","Conceptually the method is a penalized-regression approach with explicit binary flags, in the same family as LASSO-type detectors; comparing $\\alpha$ against the sparsity penalty in such detectors would clarify when GBS wins."],"forward_implications":["An operator gets detection and estimation from one algorithm: observations whose residual exceeds $\\alpha$ are dropped automatically, and the state sequence is recomputed only from the trusted set.","The closed-form partial-observation solution inherits Kalman/RTS optimality on the trusted set, with missing or attacked readings handled by zero gains rather than ad hoc filtering.","Because the proximal iteration warm-starts from the previous estimate, adding one trusted observation to a large set requires fewer iterations as the set grows.","The same derivation covers multi-sensor systems by giving each sensor its own indicator, which is how the 20-sensor experiment distinguishes attacked sensors from ordinary outliers.","Detection success rises with attack intensity while estimation error rises only slightly and then levels off, so the estimator stays usable under strong random, constant, and ramp attacks."],"supporting_citations":[{"why":"Supplies the chi-square detector baseline on Kalman innovations that GBS must beat.","marker":"[16]"},{"why":"Supplies the interval anomaly detector used as another detection comparison.","marker":"[17]"},{"why":"Supplies the LASSO-based detector for integrity attacks that motivates residual-based flagging.","marker":"[18]"},{"why":"Supplies the minimax secure estimator baseline for multiple measurements under sensor attacks.","marker":"[32]"},{"why":"Formulates secure estimation in noiseless systems as error correction, giving recovery conditions that GBS's partial-observation solution parallels.","marker":"[33]"},{"why":"Supplies the robust Gaussian Kalman filter with outlier detection used as the resilient-estimation comparison.","marker":"[34]"},{"why":"Supplies a recent secure distributed state estimation method against sparse integrity attacks as a comparison point.","marker":"[36]"}],"fun_headline_variants":["Gaussian-Bernoulli estimator unifies attack detection and state estimation","Joint attack detection and state estimation via Gaussian-Bn model","Secure estimator detects attacks and maintains estimate accuracy","Gaussian-Bernoulli estimator couples detection and estimation securely","Attack detection meets state estimation in one Gaussian-Bernoulli filter"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole scheme rests on the assumption that a compromised sensor produces a measurement that deviates enough from the current state estimate to trip a residual threshold, and that the rate of such events is known in advance.","fun_headline_variants_meta":{"raw":{"variants":["Gaussian-Bernoulli estimator unifies attack detection and state estimation","Joint attack detection and state estimation via Gaussian-Bn model","Secure estimator detects attacks and maintains estimate accuracy","Gaussian-Bernoulli estimator couples detection and estimation securely","Attack detection meets state estimation in one Gaussian-Bernoulli filter"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000828,"raw_usage":{"total_tokens":3595,"prompt_tokens":900,"completion_tokens":2695,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":516,"completion_tokens_details":{"reasoning_tokens":2614}},"tokens_in":516,"tokens_out":2695,"duration_ms":20510,"temperature":1.0,"reasoning_tokens":2614,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T20:07:20.025747+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the GBS estimator against an adversary that knows the current estimate and injects $\\delta_t$ so that the corrupted reading stays inside the $\\alpha$-threshold ellipsoid, for example by setting the injected value close to $C\\hat{x}_t$ and adding small noise. If the estimator reports no alarm while the state estimate diverges from the true state, the residual-threshold detection rule is falsified; a quantitative version would vary $\\alpha$ and report the minimum attack magnitude needed for a given detection rate.","supporting_citations":[{"cited_title":"Detecting integrity attacks on scada systems","cited_arxiv_id":null,"evidence_quote":"Supplies the chi-square detector baseline on Kalman innovations that GBS must beat."},{"cited_title":"Optimal deception attacks on remote state estimators equipped with interval anomaly detectors","cited_arxiv_id":null,"evidence_quote":"Supplies the interval anomaly detector used as another detection comparison."},{"cited_title":"LASSO-based detection and identification of actuator integrity attacks in remote control systems","cited_arxiv_id":null,"evidence_quote":"Supplies the LASSO-based detector for integrity attacks that motivates residual-based flagging."},{"cited_title":"Secure estimation in the presence of integrity attacks","cited_arxiv_id":null,"evidence_quote":"Supplies the minimax secure estimator baseline for multiple measurements under sensor attacks."},{"cited_title":"Secure estimation based Kalman filter for cyber–physical systems against sensor attacks","cited_arxiv_id":null,"evidence_quote":"Formulates secure estimation in noiseless systems as error correction, giving recovery conditions that GBS's partial-observation solution parallels."},{"cited_title":"Robust Gaussian Kalman filter with outlier detection","cited_arxiv_id":null,"evidence_quote":"Supplies the robust Gaussian Kalman filter with outlier detection used as the resilient-estimation comparison."},{"cited_title":"Secure distributed dynamic state estimation against sparse integrity attack via distributed convex optimization","cited_arxiv_id":null,"evidence_quote":"Supplies a recent secure distributed state estimation method against sparse integrity attacks as a comparison point."}],"review_version":1}