{"id":"beee8fca-9cdc-47d1-9763-6b6a3fbbee3b","arxiv_id":"2504.17118","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A path integral Monte Carlo framework is developed for synthesizing worst-case stealthy attacks on nonlinear continuous-time control systems and for computing saddle-point defensive policies.","lead":"The authors adapt path integral control, a sampling-based stochastic optimal control method, to design stealthy attacks on nonlinear control systems and to compute defensive control policies against them. The key idea is to quantify stealth by Kullback-Leibler divergence and then solve the resulting attack-defense game by Monte Carlo path sampling.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (22) and the mitigation formulas require inverting h_t h_t^T, but the paper's own unicycle and cruise-control examples have rank-deficient h_t, so the stated path-integral formulas are undefined for the validation systems.","rationale":"The KL-to-quadratic reduction (Theorem 1) is sound, and the Feynman-Kac derivation is standard in the nondegenerate case. However, the paper's central computational formulas silently require h_t h_t^T to be invertible, a condition violated by both numerical examples. This is an internal inconsistency rather than a disagreement with consensus: the stated equations cannot produce the reported simulations. It is plausibly repairable by a pseudoinverse formulation, so I retain the reader's CONDITIONAL verdict rather than moving to REJECT. The reader's weakest assumption (Assumptions 2 and 3) is a separate, also valid scope restriction on the mitigation half; my concern is complementary and concerns the attack-synthesis half. Both point to the same conclusion: the contribution needs a revision that precisely states the rank/matching conditions and supplies reproducible code before the advertised generality can be accepted.","tokens_in":19018,"tokens_out":19161,"duration_ms":194488,"concrete_test":"Analytical check: for the unicycle model in Section V-A, form h_t h_t^T and compute its rank; it is 2 < 4, so det(h_t h_t^T) = 0 and the inverse in Eq. (22) does not exist. Running the stated Monte Carlo estimator on this model fails at the first evaluation of H_t. To test the likely repair, re-derive Theorem 2 with h_t assumed full column rank, replacing H_t by the Moore-Penrose pseudoinverse h_t^+ = (h_t^T h_t)^{-1} h_t^T; if the resulting theta* does not match Eq. (22), the theorem must be restated with the additional rank condition, and the unicycle/cruise-control experiments need to be re-run under that condition or in the reduced noise coordinates.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In Section V-A the unicycle has h_t = [[0,0],[0,0],[sigma,0],[0,nu]] with sigma=nu=0.1, so h_t h_t^T = diag(0,0,sigma^2,nu^2) is singular. Theorem 2 defines H_t = h_t^T (h_t h_t^T)^{-1} in Eq. (22), so the optimal attack estimator cannot be evaluated for this system. The same defect appears in the mitigation formulas: under Assumption 3 (Eq. (41)), g R^{-1} g^T - (1/lambda) h h^T is proportional to h h^T, so the inverse in H_t^u of Eq. (43) is also singular whenever rank(h) < n. The paper states no full-rank hypothesis and never introduces a pseudoinverse; no code is provided, so the reported P_crash numbers cannot be obtained from the equations as written. Because actuators typically disturb only a subset of state directions, this is not an exotic edge case but the normal CPS setting, and it directly undermines the headline claim of path-integral attack synthesis for nonlinear CPS.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper develops path integral methods for synthesizing and mitigating stealthy attacks in continuous-time nonlinear stochastic systems. The attacker's problem is formulated as a KL-constrained optimal control problem (Problem 1) and shown, via Girsanov's theorem, to be equivalent to a quadratic-cost stochastic optimal control problem (Theorem 1). The solution is then expressed as a path integral and computed by Monte Carlo sampling (Theorem 2). The mitigation problem is formulated as a minimax KL control problem (Problem 2), connected to risk-sensitive control and a two-player zero-sum stochastic differential game (Problems 4 and 5), and solved by path integral formulas under an added matching assumption (Theorems 3 and 4). The approach is illustrated on unicycle navigation and cruise control examples, with reported crash probabilities under attack and mitigation.","tokens_in":19323,"tokens_out":9917,"duration_ms":92720,"significance":"If the technical gaps are repaired, the paper would extend stealthy attack analysis from the discrete-time linear-Gaussian setting to a continuous-time nonlinear setting, and would demonstrate a sampling-based, simulator-driven method that does not require explicit policy synthesis. The Girsanov reduction in Theorem 1 and the Feynman-Kac steps are, in structure, standard and plausible, and the connections among KL minimax control, risk-sensitive control, and H-infinity control are useful. The paper also gives explicit Monte Carlo formulas, which is a strength for reproducibility in principle. The significance is, however, limited by the restrictive matching conditions (Assumptions 2 and 3) and by the rank-deficiency problems described below, which currently prevent the validation examples from being reproduced from the stated equations.","major_comments":[{"comment":"The matrix H_t = h_t^T (h_t h_t^T)^{-1} is undefined whenever h_t h_t^T is singular, and this is exactly the situation in both validation examples. In Section V-A the unicycle has h_t with two zero rows, so h_t h_t^T = diag(0,0,sigma^2,nu^2) is singular, and Section V-B has the same rank-deficient structure. The paper states no full-rank assumption and introduces no pseudoinverse, so the attack synthesis formula (25) and the reported P_crash values are not computable from the equations as written. Since actuators typically affect only a subset of state directions, this is a load-bearing gap for the paper's central claim.","section":"Theorem 2, Eq. (22)"},{"comment":"The controller formulas invert g_t R_t^{-1} g_t^T - (1/lambda) h_t h_t^T, but under Assumption 2 or 3 this matrix is proportional to h_t h_t^T, which is singular in both examples because g and h have zero rows for the unactuated state components. The paper neither restricts the inverse to the actuated subspace nor introduces a pseudoinverse. Moreover, the verification of Assumption 3 in Section V-A is performed on a 2x2 block rather than on the full 4x4 matrices appearing in the theorem, so the stated matrix equations are not actually satisfied by the validation systems. The mitigation policy (43) is therefore not justified for the systems used in the numerical experiments.","section":"Theorems 3 and 4, Eqs. (33), (43)-(44)"},{"comment":"The mitigation results apply only when the noise covariance and the control-effectiveness covariance are matched, i.e., h_t h_t^T = xi g_t R_t^{-1} g_t^T or the equivalent Assumption 3. This is a genuine structural restriction: for arbitrary f, g, h it need not hold, and the abstract and title claim applicability to nonlinear CPS generally, which is stronger than what Theorems 3 and 4 establish. The paper should either state the scope explicitly as systems satisfying the matching condition or provide a relaxation with an error analysis.","section":"Assumptions 2 and 3"},{"comment":"In the Cole-Hopf linearization, the potential term is displayed as ell_t Psi_t / lambda in both proofs, but the stated Feynman-Kac solutions (39) and (50) use the exponents -1/gamma and -1/alpha, which require the potential coefficient to be ell_t/gamma and ell_t/alpha respectively. If the displayed lambda is not a typographical error, the proofs of Theorems 3 and 4 are internally inconsistent; this needs to be corrected or clarified.","section":"Theorems 3 and 4 proofs, Eqs. (38) and (49)"},{"comment":"The paper derives saddle-point policies from the HJI equation, but it does not provide a verification theorem showing that the resulting pair (u*, theta*) is a saddle point of the zero-sum game, nor does it state conditions such as the Isaacs condition or convexity-concavity of the Hamiltonian under which the game has a value. This is needed to support the claim that (43)-(44) solve Problem 2 rather than merely satisfy first-order necessary conditions.","section":"Problem 5 / Theorem 4"}],"minor_comments":[{"comment":"The notation is ambiguous: the left-hand side of (25) is written as an approximation to theta*_t, while (22) states theta*_t dt equals an expression involving h_t dw_t; the relationship between dt and the sqrt(Delta t) discretization should be made explicit.","section":"Section III, Eq. (25)"},{"comment":"The verification of Assumption 3 is presented as a 2x2 matrix equation, but h and g are 4x2 matrices in the dynamics; the authors should explain the reduction to the 2x2 block and why the inverse formulas in Theorems 3 and 4 are well-defined in that setting.","section":"Section V-A"},{"comment":"The statement that both alpha and beta can be made arbitrarily small simultaneously as h tends to zero is asserted from Figure 7; a short analytic argument or a precise limit would make the claim rigorous.","section":"Appendix"},{"comment":"No code or data are provided for the numerical experiments; releasing the simulator and sampling scripts would substantially improve reproducibility and would help readers verify the reported P_crash values once the rank issues are addressed.","section":"General"}],"recommendation":"major_revision","confidential_remarks":"The paper appears to build on the authors' prior work [11], [13], [33]; the novelty of the continuous-time path integral formulation and its limitations relative to those papers should be clarified. The rank-deficiency problem is fixable in principle by adding assumptions or by deriving the correct pseudoinverse/projection formulas, but the current text does not support the validation examples as written."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The real contribution here is Theorem 1: the KL-stealthy attack problem is exactly a quadratic-cost stochastic optimal control problem, and the optimal attack is a deterministic bias on the noise. That reduction is correct and clean, and it is new for continuous-time nonlinear systems. The path integral estimator for the value function is also standard but sensibly applied, and the connection to risk-sensitive control and nonlinear H-infinity is a nice unifying observation. The math, as far as it goes, checks out.\n\nThe soft spots are real, and one of them is load-bearing for the numerical section. The sampling formula for the optimal attack, Eq. (22), requires (h h^T)^{-1}. The unicycle and cruise control examples have h of size n x m with m < n, so h h^T is singular. The paper neither assumes full row rank nor introduces a pseudoinverse. The mitigation formulas, Eq. (43), have the same problem under Assumption 3. So the reported P_crash numbers cannot be obtained from the equations as written. This is not an edge case; most CPS have disturbances affecting fewer directions than the state dimension. The theory can be fixed by using a pseudoinverse, but the paper needs to say that explicitly and justify it.\n\nThe mitigation results also require restrictive matching conditions, Assumptions 2 and 3, which the abstract and title do not advertise. The paper does note these assumptions in the theorems, but the claim of broad applicability to nonlinear CPS is stronger than what the theorems support. There is also no verification theorem for the saddle-point policy, only a formal HJI derivation. That is common in the path integral literature, but it should be flagged.\n\nThe simulations are indicative but not convincing as evidence: no code, no error bars, no quantitative report of the achieved KL divergence or detection error, and no baseline defense against an attacker who is ignored. The qualitative plots show the effect, but the numbers have little weight.\n\nThe paper is worth a serious referee: the core reduction in Theorem 1 is a solid step, and the path integral machinery is appropriate even if the presentation is incomplete. I would send it to review, but the revision must address the invertibility issue, make the assumptions visible in the narrative, and ideally release code so the simulations can be checked.","headline":"The attack-synthesis reduction is genuinely clean, but the sampling formulas require an invertibility the paper's own examples lack, so the numerical claims are not reproducible as written.","tokens_in":19806,"tokens_out":5139,"would_cite":false,"duration_ms":50836,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["93E20","49N70","93C10","60H30"],"pacs":[],"model":"deepseek-v4-flash","headline":"Path sampling reveals both the stealthy attack and the control that defeats it","keywords":["stealthy attacks","Kullback-Leibler divergence","path integral control","minimax zero-sum game","nonlinear cyber-physical systems","risk-sensitive control","H-infinity control","Monte Carlo simulation"],"falsifier":"Take a two-state system with $g_t = [1;0]$, $h_t = [0;1]$, and $R_t = I$. Then $h_th_t^\\top = \\mathrm{diag}(0,1)$ while $g_t R_t^{-1} g_t^\\top = \\mathrm{diag}(1,0)$, so no $\\alpha > 0$ satisfies Assumption 3. Solve the HJI equation (47) directly for this system and compare its value to the Monte Carlo estimate (42); a mismatch would confirm that the matching condition is necessary for the mitigation formula, while the attack-synthesis formula (22) should still reproduce the true HJB value.","tokens_in":18775,"feed_emoji":"🛡️","tokens_out":7102,"duration_ms":62649,"temperature":0.7,"pith_summary":"This paper treats a stealthy attack on a nonlinear stochastic control system as a change of probability measure: the attacker replaces the natural noise with a biased noise process, and the Kullback-Leibler divergence between the two noise laws quantifies how detectable the attack is. It proves that maximizing attack impact minus a KL stealthiness penalty is exactly a quadratic-cost stochastic optimal control problem in the attack bias, so the worst-case attack can be computed online from Monte Carlo rollouts of the system rather than from an explicit model. The paper then formulates attack mitigation as a minimax game between attacker and controller, shows this game is equivalent to a risk-sensitive control problem and to a two-player zero-sum differential game, and gives path-integral formulas for both players' saddle-point policies. Numerical demonstrations show a unicycle and a cruise-control car being covertly driven into unsafe regions, and the same sampling machinery steering them back to safety. If these results hold up, an attacker and a defender can each reason about worst-case stealthy behavior using only a simulator.","feed_headline":"Path sampling crafts stealthy attacks and the defenses that stop them","feed_subtitle":"KL-divergence stealth turns attack synthesis and mitigation into simulator-only path integral problems.","key_machinery":"The load-bearing device is the logarithmic (Cole-Hopf) transformation of the value function, $V_t = \\pm\\gamma\\log\\Psi_t$, combined with the Feynman-Kac lemma. Applying this transformation to the HJB equation of the attack problem, or to the HJI equation of the game, cancels the quadratic gradient term exactly when the problem has the right special structure, leaving a linear backward Chapman-Kolmogorov PDE whose solution is an expectation over simulated paths. For attack synthesis the cancellation needs no extra structural condition; for mitigation it requires Assumption 2 or 3, which makes $h_th_t^\\top$ proportional to $g_t R_t^{-1} g_t^\\top$ (with a $\\frac{1}{\\lambda}h_th_t^\\top$ correction in Assumption 3). The resulting formulas, such as equation (22) for the attack and equations (43)-(44) for the controller and attacker, are weighted averages of noise increments $h_t dw_t$ over trajectories weighted by $\\exp(\\pm\\frac{1}{\\gamma}\\int \\ell_s\\,ds)$, computed by Monte Carlo simulation.","core_discovery":"The central claim is that both sides of the stealthy attack problem reduce to path integrals over simulated noise paths. For attack synthesis (Problem 1), Theorem 1 shows the KL-constrained attack objective is equivalent to a quadratic-cost stochastic optimal control problem whose optimal bias is $\\theta_t^* = (1/\\lambda) h_t^\\top \\partial_x V_t(x_t)$; Theorem 2 evaluates the value function via the Feynman-Kac representation as $V_t = \\lambda \\log \\mathbb{E}_Q[\\exp(\\frac{1}{\\lambda}\\int_t^T c_s\\,ds)]$ and expresses $\\theta_t^*$ as a weighted average of Brownian increments over sampled trajectories, so the attacker needs only a simulator. For mitigation (Problem 2), the minimax KL control problem is shown to be equivalent to a risk-sensitive control problem (Problem 4) and a two-player zero-sum stochastic differential game (Problem 5); under a matching condition between the noise covariance $h_th_t^\\top$ and the control-effectiveness matrix $g_t R_t^{-1} g_t^\\top$, Theorems 3 and 4 turn the HJB and HJI equations into linear backward Chapman-Kolmogorov PDEs, and express the value and saddle-point policies as Monte Carlo expectations over the uncontrolled dynamics. The paper thus claims that worst-case stealthy attacks and their countermeasures are computable in real time for nonlinear systems without explicit models or an explicit policy synthesis step.","pith_inferences":["Editorial inference: the matching condition is structural: if $h_th_t^\\top$ and $g_t R_t^{-1} g_t^\\top$ act in different subspaces, no scalar $\\alpha$ can satisfy Assumption 3, so the mitigation formulas are not justified for those systems. A testable extension is to lift the condition by allowing a state-dependent $\\alpha$ or by adding a second controller channel.","Editorial inference: the attack-synthesis side (Theorem 2) needs no matching condition, suggesting an asymmetry: worst-case attack analysis is more broadly applicable than the proposed mitigation formula, so a practical recipe would pair Theorem 2 with a different defense for non-matching systems.","Editorial inference: the paper's own Remark 3 concedes that KL divergence is only an asymptotic measure of stealthiness; for short horizons its higher-order error behavior may diverge from true detectability, so the synthesized attacks and defenses should be interpreted through the lens of that surrogate.","Editorial inference: equation (22) weights trajectories by $\\exp(\\frac{1}{\\lambda}\\int c)$, so for large costs the estimate concentrates on rare paths; variance reduction such as cross-entropy or scheduled sampling is a natural next step before deployment."],"forward_implications":["Worst-case stealthy attacks for a fixed, known controller policy can be synthesized in real time from simulations, so systems whose models exist only as digital twins or neural ODEs remain amenable to principled attack analysis.","Because the value function obeys the Feynman-Kac representation, the same attack synthesizer works for high-dimensional nonlinear systems where grid-based PDE solvers are infeasible, subject only to Monte Carlo sampling accuracy.","The mitigation policy obtained from risk-sensitive control and the saddle-point policy obtained from the zero-sum game coincide, unifying two existing solution concepts under one path-integral computation.","The optimal attack bias is deterministic in continuous time, in contrast to the randomized optimal attacks found in discrete-time linear settings; only the underlying noise remains random.","When the matching condition holds, the controller can compute a saddle-point policy online from uncontrolled simulations of the system, without solving a game PDE."],"supporting_citations":[{"why":"Supplies the path integral method for quadratic-cost stochastic optimal control, including the exponential transformation used in Theorem 2.","marker":"[14]"},{"why":"Introduces epsilon-stealthiness measured by relative entropy in linear stochastic control systems, the baseline this paper extends to nonlinear continuous time.","marker":"[6]"},{"why":"Provides the continuous-time hypothesis-testing game whose KL stealthiness and Chernoff-Stein asymptotics underlie the problem formulation.","marker":"[13]"},{"why":"Supplies the model predictive path integral sampling scheme used for real-time Monte Carlo implementation of the attack and defense formulas.","marker":"[16]"},{"why":"Establishes the KL control formulation and relative-entropy/free-energy dualities that motivate Problem 1.","marker":"[24]"},{"why":"Provides the risk-sensitive path integral control solution that Theorem 3 relies on.","marker":"[32]"},{"why":"Provides the two-player zero-sum path integral game solution that Theorem 4 relies on.","marker":"[33]"},{"why":"Supplies the Girsanov theorem and Feynman-Kac lemma used to derive the path integral representations.","marker":"[25]"}],"fun_headline_variants":["Path integrals compute worst-case stealth attacks and their defenses","Simulator-only path integrals design stealthy attacks and countermeasures","Stealth attack and defense both reducible to path integral sampling","Path sampling reveals worst-case stealth attacks and optimal defenses","Nonlinear stealth attacks and defenses solved via path integral Monte Carlo"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The mitigation results stand on the matching condition that the noise covariance and the controller's effectiveness-weighted cost matrix must be proportional; if a system's noise and control directions do not align in that way, the path-integral defense formula is not derived.","fun_headline_variants_meta":{"raw":{"variants":["Path integrals compute worst-case stealth attacks and their defenses","Simulator-only path integrals design stealthy attacks and countermeasures","Stealth attack and defense both reducible to path integral sampling","Path sampling reveals worst-case stealth attacks and optimal defenses","Nonlinear stealth attacks and defenses solved via path integral Monte Carlo"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000184,"raw_usage":{"total_tokens":1351,"prompt_tokens":1009,"completion_tokens":342,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":625,"completion_tokens_details":{"reasoning_tokens":259}},"tokens_in":625,"tokens_out":342,"duration_ms":3382,"temperature":1.0,"reasoning_tokens":259,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:49:45.692507+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a two-state system with $g_t = [1;0]$, $h_t = [0;1]$, and $R_t = I$. Then $h_th_t^\\top = \\mathrm{diag}(0,1)$ while $g_t R_t^{-1} g_t^\\top = \\mathrm{diag}(1,0)$, so no $\\alpha > 0$ satisfies Assumption 3. Solve the HJI equation (47) directly for this system and compare its value to the Monte Carlo estimate (42); a mismatch would confirm that the matching condition is necessary for the mitigation formula, while the attack-synthesis formula (22) should still reproduce the true HJB value.","supporting_citations":[{"cited_title":"Path integrals and symmetry breaking for optimal control theory,","cited_arxiv_id":null,"evidence_quote":"Supplies the path integral method for quadratic-cost stochastic optimal control, including the exponential transformation used in Theorem 2."},{"cited_title":"Data-injection attacks in stochastic control systems: Detectability and performance tradeoffs,","cited_arxiv_id":null,"evidence_quote":"Introduces epsilon-stealthiness measured by relative entropy in linear stochastic control systems, the baseline this paper extends to nonlinear continuous time."},{"cited_title":"Covert ve- hicle misguidance and its detection: A hypothesis testing game over continuous-time dynamics,","cited_arxiv_id":null,"evidence_quote":"Provides the continuous-time hypothesis-testing game whose KL stealthiness and Chernoff-Stein asymptotics underlie the problem formulation."},{"cited_title":"Relative entropy and free energy dualities: Connections to path integral and KL control,","cited_arxiv_id":null,"evidence_quote":"Establishes the KL control formulation and relative-entropy/free-energy dualities that motivate Problem 1."},{"cited_title":"Risk-minimizing two-player zero-sum stochastic differential game via path integral con- trol,","cited_arxiv_id":null,"evidence_quote":"Provides the two-player zero-sum path integral game solution that Theorem 4 relies on."},{"cited_title":"Øksendal, Stochastic differential equations","cited_arxiv_id":null,"evidence_quote":"Supplies the Girsanov theorem and Feynman-Kac lemma used to derive the path integral representations."}],"review_version":1}