{"id":"a31812cb-e23c-40b9-968b-bc229cc11e83","arxiv_id":"2502.00436","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"A data-driven, model-free framework reconstructs the true trajectory of an LTI system when up to k entries or channels of the measured data are maliciously altered.","lead":"This paper develops methods to reconstruct the true signals of an unknown control system when an attacker has corrupted some of the measured data, using only recorded input-output trajectories and no system model. It gives conditions under which both exact searches and fast convex approximations recover the true trajectory, with tests on simulated mechanical and tank systems.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The l1-recovery guarantees in Theorems 3 and 4 are vacuous whenever H_L(w_d) has a null vector, which occurs in the common overdetermined data regime T-L+1 > mL+n.","rationale":"The reader's weakest_assumption focuses on verifiability of Conditions 1-3 and the dependence of Condition 3 on the unknown attack set. This is a valid concern, but the more specific and more damaging issue is that Theorems 3 and 4 contain an implicit full-column-rank requirement that is not stated and that fails in the typical case of longer offline data. The brute-force Theorems 1 and 2, which rely on the offline Conditions 1 and 2, remain mathematically sound and are not affected. The novelty of the l1 and group-LASSO relaxations, however, is central to the paper's practical contribution, and a vacuous sufficient condition leaves that contribution without theoretical support in the standard overdetermined regime. The paper could fix this by either adding an explicit full-column-rank assumption and explaining its restrictiveness, or by proving a version of Theorem 3 that quantifies only over v with Hv ≠ 0 and showing that all minimizers still map to the true trajectory. Because the issue is technical and addressable, and because the exact brute-force results stand, the reader's CONDITIONAL verdict remains appropriate; I do not see grounds to reject the paper outright, but the convex-recovery claims need substantial revision.","tokens_in":15528,"tokens_out":14200,"duration_ms":141268,"concrete_test":"Construct an LTI system with known m and n, and choose an offline trajectory w_d satisfying (1) with T-L+1 = mL+n+1. Compute a nonzero v in the null space of H_L(w_d); verify that for any partition into benign (B) and attacked (F) rows, ||H_B v||_1 = ||H_F v||_1 = 0, so (24) fails. Then run the l1 recovery (22) for a small entry attack and check whether w* = \\bar w. If recovery still succeeds, the theorem's condition is unnecessarily strong and can be weakened; if it fails, the l1 method has no exact guarantee in the overdetermined regime. Either outcome settles whether the paper's convex-recovery theorems cover their claimed setting.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's efficient convex recovery results, Theorems 3 and 4 (Section V-A), rely on condition (24), ||H_B v||_1 > ||H_F v||_1 for all nonzero v, or on Condition 3 plus ||T||_1 < 1. Both are impossible whenever H = H_L(w_d) has a nontrivial null space. Under the standing generalized persistency condition (1), rank H = mL+n, but H has N = T-L+1 columns. Whenever N > mL+n, there exists a nonzero v with Hv = 0. For such v, both H_B v and H_F v are zero, so (24) reads 0 > 0, and the proof of Theorem 4 would require 0 < 0. Consequently, Theorems 3 and 4 can only hold when H has full column rank, i.e., when T-L+1 = mL+n; the paper does not state this full-column-rank restriction. The numerical example in Section VI uses T=11, L=3, m=1, n=6, giving N=9 = mL+n, which exactly avoids the failure. But the theorems are claimed generally, and the l1 relaxation is advertised as the computationally efficient method for typical data. This is load-bearing because the central algorithmic contribution loses its exact-recovery guarantee precisely in the overdetermined-data regime that is standard in data-driven control, where more offline trajectories are available.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript considers an unknown discrete-time LTI system in the behavioral framework and addresses reconstruction of an L-length trajectory from corrupted measurements, given an attack-free offline trajectory wd satisfying the generalized persistency of excitation condition. Two attack scenarios are studied: up to k arbitrary entries and up to k compromised channels. The authors formulate recovery as combinatorial optimization, propose brute-force algorithms, and prove exact recovery under critical-row-set conditions (Theorems 1 and 2, Propositions 1 and 2). They then replace the cardinality constraints by l1 and group-LASSO relaxations, claiming exact recovery under condition (24) or Condition 3 with ||T||_1 < 1 (Theorems 3 and 4). A heuristic noisy-data extension and numerical examples on mass-spring-damper and quadruple-tank systems are provided.","tokens_in":15842,"tokens_out":8017,"duration_ms":85269,"significance":"The behavioral, model-free formulation is novel and relevant as a safeguard for data-driven control. The paper's main positive features are that the brute-force recovery theorems are mathematically sound and non-circular, relying directly on [17, Corollary 21]; the tightness constructions in Propositions 1 and 2 are meaningful; code is released; and the numerical comparison with a model-based method illustrates the advantage of not needing model knowledge. However, the convex-relaxation guarantees, which are the advertised computationally efficient contribution, have a serious gap in the overdetermined-data regime. The paper needs a substantive revision before the exact-recovery guarantees for (22) can be accepted as stated.","major_comments":[{"comment":"Under the standing generalized persistency condition (1), rank H = mL+n. In the common data-rich case T-L+1 > mL+n, H has a nonzero null vector v, and for that v both H_B v and H_F v vanish, so (24) reads 0 > 0 and cannot hold. Thus the hypothesis of Theorem 3 is unsatisfiable exactly in the overdetermined regime where multiple offline trajectories are available, and the proof of (28) gives equality rather than strict inequality for such v. The theorem needs either an explicit full-column-rank assumption, or a modified condition restricted to v not in Null H together with an argument that trajectory recovery still holds despite non-unique g.","section":"Section V-A, Theorem 3, Eq. (24)"},{"comment":"The displayed chain ||H_F v||_1 = ||T H_B v||_1 <= ||T||_1 ||H_B v||_1 < ||H_B v||_1 for v != 0 is invalid when v is in the null space of H, because it would require 0 < 0. The conclusion of Theorem 4 may be salvageable by decomposing v into null and non-null components, but as written the proof does not establish the theorem. Since Theorem 4 is presented as the main tractable verification route, this gap is load-bearing.","section":"Section V-A, Theorem 4, proof after Eq. (32)"},{"comment":"Condition 3 is defined through the unknown attack set C via H_B = H|_{[qL]\\C}. The statement in Section VI that Condition 3 'can be easily verified offline since H_L(wd) is provided' conflates offline knowledge of wd with offline knowledge of C. In a security setting, C is adversarial and is not available for verification; the paper should either state explicitly that Condition 3 is an unverifiable sufficient condition or provide verifiable proxy conditions. The same limitation applies to condition (24) in Theorem 3, which also depends on C.","section":"Section V-A, Condition 3; Section VI"}],"minor_comments":[{"comment":"The phrase 'given in in Fig. 4' contains a duplicated 'in'.","section":"Section VI, Fig. 4 caption and text"},{"comment":"The citation [Mao2022] does not match any numbered reference in the bibliography; it should be replaced with the corresponding entry (likely [6]) or listed properly.","section":"Section VI-A, comparison paragraph"},{"comment":"The example uses T=11, L=3, m=1, n=6, so N=9=mL+n; this is precisely the full-column-rank case and therefore avoids the nullspace obstruction discussed above. The paper should acknowledge this and also demonstrate a data-rich example with N > mL+n.","section":"Section VI, numerical example parameters"},{"comment":"In the proof of Proposition 1, the line 'H |_{C(i)} = H |_C' is confusing because C(i) was defined as a set of indices inside I(i), not as a set of rows of H; the notation should be clarified.","section":"Section III-C, proof of Proposition 1"},{"comment":"Problem (33) is introduced but no theorem is proved for it; the footnote claiming that 'all results remain valid' needs to be made precise for the group-LASSO formulation.","section":"Section V-A, group-LASSO problem (33)"}],"recommendation":"major_revision","confidential_remarks":"I do not see grounds for rejection: the brute-force recovery results are sound, and the convex-relaxation issues are repairable with an explicit full-column-rank assumption and a corrected proof of Theorem 4. The paper should be sent back for major revision rather than rejected."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core exact-recovery results for the brute-force algorithms are the real contribution here, and they hold up. Theorems 1 and 2 are proven cleanly from the generalized persistency condition, and Conditions 1 and 2 are shown to be tight via constructive counterexamples. The behavioral formulation is natural, and the channel-attacked scenario is a worthwhile extension of the entry-attacked setup. I would trust these parts of the paper.\n\nThe computational centerpiece, however, has a load-bearing gap that the stress-test note catches correctly. Theorems 3 and 4 claim exact recovery for the l1 relaxation under condition (24) or Condition 3 plus ||T||_1 < 1. But under the standing assumption rank H = mL+n, the Hankel matrix H has N = T-L+1 columns. Whenever N > mL+n—the standard data-rich regime—H has a nontrivial null vector v, so H_B v and H_F v are both zero. Condition (24) then reads 0 > 0, and the proof of Theorem 4 would require 0 < 0. So the conditions are impossible to satisfy unless H has full column rank, i.e., T-L+1 = mL+n. The paper never states this restriction. The numerical example uses exactly the balanced case (T=11, L=3, m=1, n=6, so N=9=mL+n), which conveniently avoids the failure. This is not a minor technicality; it undermines the paper's advertised low-complexity guarantee in the typical situation where you have more offline data than the minimum. The authors need to either add the full-column-rank assumption explicitly, or develop conditions that can hold when H has a null space.\n\nOther soft spots are less severe. Conditions 1 and 2 are acknowledged to be computationally hard to verify, and Condition 3 is defined through the unknown attack set C, so it cannot be checked online—the paper says this but could be more upfront about the practical limitations. The noisy-data extension is a heuristic without any guarantee; it works in the examples but is not backed by theory. There are also mechanical errors: the unresolved [Mao2022] citation and a wrong equation cross-reference in Proposition 1. The \"first work\" claim is overstated given [32], though the specific formulations and rank conditions do appear new.\n\nMy recommendation: send this to peer review. The brute-force results are correct and relevant, and the problem is worth solving. But the authors should be pushed to fix the convex-recovery guarantees or at least state the full-column-rank restriction clearly. As written, the paper's main selling point—the efficient relaxation—is unsupported in the data-rich regime where it is most needed.","headline":"The brute-force exact-recovery results are solid, but the l1-relaxation guarantees are vacuous unless the Hankel matrix has full column rank—a restriction the paper never states.","tokens_in":16339,"tokens_out":3089,"would_cite":false,"duration_ms":30746,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"By proving that brute-force search and its convex $\\ell_1$ relaxation recover the true trajectory under explicit rank and norm conditions on the offline Hankel matrix, this paper makes secure data reconstruction possible for unknown…","keywords":["secure data reconstruction","behavioral systems theory","data-driven control","false data injection","Hankel matrix","l1 minimization","group LASSO","cyber-physical system security"],"falsifier":"Fix any offline trajectory satisfying the generalized persistency of excitation condition but with a minimum critical row set of size at most $2k$, construct the entry attack from Proposition 1 by tampering exactly with a critical set, and run Algorithm 1: if it outputs a trajectory different from the true one, the claimed tightness is confirmed and the theorem's condition is shown necessary in that instance. For the $\\ell_1$ claim, find any Hankel matrix and attack set with $\\operatorname{rank} H_B = \\operatorname{rank} H$ and $\\|T\\|_1 \\ge 1$ where the minimizer of (22) differs from the true trajectory; that would refute the sufficiency of Condition 3 alone.","tokens_in":15301,"feed_emoji":"🛡️","tokens_out":7039,"duration_ms":66214,"temperature":0.7,"pith_summary":"This paper asks whether a trajectory of an unknown linear time-invariant system can be reconstructed exactly after an adversary corrupts up to $k$ entries, or up to $k$ channels, of the received data, using only an attack-free offline trajectory and no state-space model. It answers yes under quantitative richness conditions on the offline data: if the relevant Hankel matrix keeps full rank after deleting any $2k$ rows, or any $2k$ channel blocks, then the brute-force search algorithms recover the true trajectory whenever they terminate. The paper then proves that convex $\\ell_1$ and group-LASSO relaxations of these NP-hard problems are also exact under an $\\ell_1$-dominance condition or a rank-plus-contraction condition, making the recovery computationally tractable. This matters because data-driven controllers act directly on measured trajectories, so a safeguard that provably returns the true trajectory prevents corrupted data from translating into unsafe control actions.","feed_headline":"Repair attacked control data using only recorded trajectories","feed_subtitle":"Brute-force and convex l1 search provably restore the true trajectory once the offline Hankel data is rich enough.","key_machinery":"The key object is the block-Hankel matrix $H_L(w_d)$ of an offline attack-free trajectory, together with its minimum critical row set $S^*(H_L(w_d))$ or the channel-structured variant. The behavioral lemma says that when $\\operatorname{rank} H_L(w_d) = m(B)L + n(B)$, the image of this matrix is exactly the set of length-$L$ system trajectories, so a candidate reconstruction is legal exactly when it lies in that image. The critical-row-set size then measures how much row deletion the matrix tolerates before losing rank, which is precisely the redundancy needed to overwrite $k$ attacked entries or $k$ attacked channels. The $\\ell_1$ problem (22) replaces the combinatorial search by minimizing $\\|w - H g\\|_1$; Theorem 3 certifies exactness through the inequality $\\|H_B v\\|_1 > \\|H_F v\\|_1$ for all nonzero $v$, and Theorem 4 converts this into a checkable contraction condition on the matrix $T$ with $H_F = T H_B$.","core_discovery":"The central claim is that secure trajectory reconstruction for an unknown LTI system can be reduced to a rank-persistence property of the Hankel matrix built from offline data. With the generalized persistency of excitation condition, any length-$L$ trajectory is exactly the image of this Hankel matrix; then, if the minimum critical row set of the Hankel matrix has size at least $2k+1$, deleting any $2k$ rows leaves the column space unchanged, so the brute-force algorithm's solution necessarily equals the true trajectory (Theorem 1). The same reasoning with channel-structured critical row sets gives the channel-attack guarantee (Theorem 2). For computation, recovery via (22), an $\\ell_1$ minimization over the coefficient vector $g$, is exact provided the benign rows dominate the malicious rows in $\\ell_1$ norm for every nonzero direction (Theorem 3), or provided the rank condition $\\operatorname{rank} H_B = \\operatorname{rank} H$ and the contraction $\\|T\\|_1 < 1$ hold (Theorem 4).","pith_inferences":["The paper leaves implicit that Condition 1 is the data-driven counterpart of $2k$-sparse observability in model-based secure state estimation, suggesting that the same redundancy lower bounds transfer to model-free settings.","Because the verification in Remark 4 gives a polynomial-time certificate for the $\\ell_1$-dominance condition once an attack set is hypothesized, one could turn (22) into a testable detector by sweeping candidate attack sets and keeping those that pass; the paper does not develop this.","The analysis assumes the offline data $w_d$ is attack-free and rich enough; a natural extension not treated here is to robustify against a compromised offline set by combining multiple trajectories or applying the critical-row test to an augmented Hankel matrix."],"forward_implications":["If Condition 1 holds, Algorithm 1 never returns a wrong trajectory: any returned candidate equals the true one, so a practitioner can trust a positive reconstruction without knowing the attack set.","Together with Lemma 2, the entry-attack guarantee implies the fundamental limit $k \\le p(B)/2$; systems with too few outputs cannot be secured against this attacker model regardless of offline data length.","The convex problems (22) and (33) inherit exactness in the regimes of Theorems 3 and 4, so secure reconstruction can run in polynomial time instead of enumerating $\\binom{qL}{k}$ or $\\binom{q}{k}$ subproblems.","The noisy-data extension turns the same machinery into a two-stage procedure of convex fit, residual ranking, and least-squares refinement, so the guarantees extend approximately to measurement noise, as demonstrated on mass-spring-damper and quadruple-tank examples."],"supporting_citations":[{"why":"Supplies Corollary 21 and the generalized persistency of excitation condition that underpin Lemma 1, the behavioral representation used throughout.","marker":"[17]"},{"why":"Provides the fundamental lemma on persistency of excitation that this work generalizes and builds upon.","marker":"[16]"},{"why":"Establishes the behavioral data-driven interpolation setting and the result that a benign subset always yields the true trajectory via Proposition 9.","marker":"[13]"},{"why":"Gives the model-based secure state reconstruction baseline and the computational-complexity comparison used in the numerical experiments.","marker":"[6]"},{"why":"Introduces the low-complexity secure state estimation idea and the $2k$-sparse observability concept used to position Condition 1.","marker":"[7]"},{"why":"Supplies the convex-polytope and vertex-checking fact that Remark 4 uses to verify the $\\ell_1$-dominance condition.","marker":"[29]"},{"why":"Provides the group LASSO formulation used to approximate the channel-attacked problem in (33).","marker":"[30]"}],"fun_headline_variants":["Model-free recovery of true data after sensor attacks","Exact data reconstruction from corrupted recordings alone","Proven repair for attacked control data, no model needed","Hankel matrix trick restores true trajectory after attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the offline Hankel matrix is rich enough that removing any $2k$ rows or channel blocks never reduces its rank, plus, for the $\\ell_1$ relaxation, that the attack rows are dominated by healthy rows ($\\|T\\|_1 < 1$); the paper notes the first condition is computationally difficult to verify and the second depends on the unknown attack set.","fun_headline_variants_meta":{"raw":{"variants":["Model-free recovery of true data after sensor attacks","Exact data reconstruction from corrupted recordings alone","Proven repair for attacked control data, no model needed","Hankel matrix trick restores true trajectory after attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000761,"raw_usage":{"total_tokens":3389,"prompt_tokens":969,"completion_tokens":2420,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":585,"completion_tokens_details":{"reasoning_tokens":2358}},"tokens_in":585,"tokens_out":2420,"duration_ms":18206,"temperature":1.0,"reasoning_tokens":2358,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T19:01:34.637359+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fix any offline trajectory satisfying the generalized persistency of excitation condition but with a minimum critical row set of size at most $2k$, construct the entry attack from Proposition 1 by tampering exactly with a critical set, and run Algorithm 1: if it outputs a trajectory different from the true one, the claimed tightness is confirmed and the theorem's condition is shown necessary in that instance. For the $\\ell_1$ claim, find any Hankel matrix and attack set with $\\operatorname{rank} H_B = \\operatorname{rank} H$ and $\\|T\\|_1 \\ge 1$ where the minimizer of (22) differs from the true trajectory; that would refute the sufficiency of Condition 3 alone.","supporting_citations":[{"cited_title":"Identifiability in the behavioral setting,","cited_arxiv_id":null,"evidence_quote":"Supplies Corollary 21 and the generalized persistency of excitation condition that underpin Lemma 1, the behavioral representation used throughout."},{"cited_title":"Data-driven dynamic interpolation and approximation,","cited_arxiv_id":null,"evidence_quote":"Establishes the behavioral data-driven interpolation setting and the result that a benign subset always yields the true trajectory via Proposition 9."},{"cited_title":"On the computational complexity of the secure state-reconstruction problem,","cited_arxiv_id":null,"evidence_quote":"Gives the model-based secure state reconstruction baseline and the computational-complexity comparison used in the numerical experiments."},{"cited_title":"Low complexity secure state estimation design for linear system with non-derogatory dynamics,","cited_arxiv_id":null,"evidence_quote":"Introduces the low-complexity secure state estimation idea and the $2k$-sparse observability concept used to position Condition 1."},{"cited_title":"The group lasso for logistic regression,","cited_arxiv_id":null,"evidence_quote":"Provides the group LASSO formulation used to approximate the channel-attacked problem in (33)."}],"review_version":1}