{"id":"2a5e0c2a-b59e-4511-80ed-56d27db96556","arxiv_id":"2505.06845","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A secure safety filter combines secure state reconstruction under bounded noise with a robust control barrier function QP, and tests on a quadrotor show it can keep the drone safe when one sensor stream is spoofed.","lead":"This paper adds a module, the secure safety filter, that keeps a drone safe when a sensor is spoofed by reconstructing plausible states from noisy measurements and filtering unsafe control commands. It is useful because autopilots currently trust onboard sensors, and a spoofed GPS or IMU can push a drone out of its safe region.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Safety guarantee does not transfer from the linear reduced-order model to the real drone because model mismatch is unquantified, so the plausible-state set may not contain the true state.","rationale":"The reader's verdict is CONDITIONAL, citing both the feasibility assumption of the QP and the reduced-order model fidelity. I agree that both are load-bearing, but I single out the reduced-order model mismatch as the most load-bearing concern for the paper's central claim. Theorem 1 is conditional on feasibility, and the authors explicitly acknowledge that verifying feasibility is hard and that they fall back to a zero-velocity command. By contrast, the model mismatch is treated as a working assumption without any stated limitation or error analysis, yet it is the bridge that lets the linear-theory guarantee claim applicability to nonlinear drones. If the true state leaves the plausible set, the robust CBF condition may be satisfied while the actual trajectory becomes unsafe, even when the QP is feasible. The proposed concrete test directly checks whether the true state remains in the plausible set, which is the key condition for the theory to transfer. This does not change the overall verdict; it reinforces that the paper should be CONDITIONAL on quantifying the reduced-order model error, not only on feasibility. The reader already identified this as a weak assumption, so my agreement is partial: I elevate it to the primary concern over feasibility.","tokens_in":10959,"tokens_out":4775,"duration_ms":54855,"concrete_test":"Using recorded data from the hardware experiments (or a new SITL run with motion-capture ground truth), perform an offline set-membership check: at each time step, compute the plausible-state set X^{t}_{t,d} from the measurements using the linear model (20) with the chosen tau_s and noise bound dmax, and test whether the true state (from motion capture or high-fidelity simulation) lies inside the set. If there exists any time step where the true state is outside X^{t}_{t,d}, the reduced-order abstraction is invalid and the safety certificate does not apply to the real system. Additionally, compare the measured velocity response to a sequence of step commands against the first-order model (20) to estimate the worst-case model error and check whether the CBF margin in (18) can absorb it.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Theorem 1 guarantees safety only for the exact linear system (1). The drone application depends on the reduced-order model (20), which abstracts the nonlinear inner-loop velocity tracking as a first-order system with a pre-chosen time constant tau_s. No error bound, identification procedure, or robustness margin for this abstraction is provided. The secure state reconstructor and the robust CBF condition (18) both rely on this model: the plausible-state set X^{t}_{t,d} is computed by propagating the linear model, and the CBF inequality is evaluated at the center of the inflated ball. If the true drone dynamics deviate from (20) — for example, due to attitude dynamics, actuator saturation, or discretization effects — the true state may not belong to the computed plausible set. In that case, the robust CBF condition does not imply h(x(t+1)) >= 0 for the real system, and the central safety claim fails. The feasibility assumption is also load-bearing and explicitly acknowledged, but the model-mismatch issue is unacknowledged and directly bridges the theory to the claimed nonlinear application. The SITL and hardware experiments demonstrate behavior in specific scenarios but do not quantify the mismatch or verify that the true state remains in the reconstructed set.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a 'secure safety filter' that combines secure state reconstruction (SSR) with a control barrier function (CBF) safety filter to maintain safety for discrete-time linear systems subject to sensor spoofing attacks and bounded measurement noise. The SSR module extends prior noise-free results by characterizing the set of plausible states under bounded noise as a union of infinity-norm balls, and the safety filter enforces a robust CBF condition over this inflated set. The authors then adapt the framework to quadrotor flight by using a reduced-order linear model of the inner-loop velocity tracking dynamics, and demonstrate the approach in software-in-the-loop simulations and hardware experiments on a Holybro X500 quadrotor. The main formal result, Theorem 1, states that if the robust CBF QP is feasible at every time step, the control sequence renders the system safe.","tokens_in":11141,"tokens_out":6719,"duration_ms":68448,"significance":"If the central claim holds, the paper makes a useful contribution by extending secure state reconstruction to bounded measurement noise and coupling it with a robust CBF design, which goes beyond prior noise-free SSR work and offers a modular, implementation-oriented safety architecture. The experimental validation on a real quadrotor under emulated attacks is valuable, and the availability of public code supports reproducibility. However, the significance is tempered by a substantial gap between the formal guarantees, which apply to an exact linear model, and the claims about safety of the nonlinear quadrotor through the reduced-order model; the feasibility assumption in Theorem 1 is acknowledged but not analyzed; and the proof of the main theorem is omitted. These issues need to be resolved before the paper can be accepted.","major_comments":[{"comment":"The theoretical guarantees (Lemma 1, Theorem 1) are established for the linear system (8), but the drone application relies on the reduced-order model (20) with a pre-chosen time constant tau_s. No bound is provided on the error between this reduced-order model and the actual quadrotor dynamics, nor is any robustness margin added to the plausible-state set X^t_{t,d} or the CBF condition (18). If the true state of the quadrotor is not contained in the computed plausible set, the condition (18) does not imply h(x(t+1)) >= 0 for the real system, so Theorem 1's safety guarantee does not transfer. The SITL and hardware experiments illustrate behavior in specific scenarios but do not quantify the model mismatch or verify that the true state remains in the reconstructed set. This gap is load-bearing for the paper's claim of applicability to nonlinear drone dynamics; the authors should either provide an error bound with corresponding inflation of the plausible set, or explicitly reframe the drone results as an empirical demonstration without a formal safety guarantee.","section":"Section IV.A, Eq. (20)"},{"comment":"The proof of Theorem 1, the main formal result, is omitted with the statement that it 'follows from Lemma 1 and standard analysis of CBF-based safety filter design.' This is not sufficient for a journal publication, because the derivation of the robust CBF condition (18) relies on the over-approximation (15) and the filtration of sensor combinations with dmax >= dΓ, and the theorem's precise hypotheses are therefore not verifiable without a complete proof. The authors should provide the proof or a precise reference that covers exactly this setting, including how the over-approximation error enters the condition.","section":"Theorem 1, Section III.B"},{"comment":"The feasibility assumption in Theorem 1 is explicitly acknowledged to be difficult to verify, and the experiments switch to a zero-velocity command when the QP (19) is infeasible. However, this fallback is not analyzed: if feasibility fails while the drone is moving toward the boundary, a zero-velocity command may not prevent a safety violation, and no conditions are given under which the fallback itself preserves safety. The paper should either provide conditions under which the QP remains feasible (e.g., sufficient redundancy in the sensors or bounds on the attack), or analyze the safety properties of the fallback controller.","section":"Section III.B, after Theorem 1; Section V.A"},{"comment":"There is an inconsistency between the formal QP definition and the algorithm. Eq. (19) is stated with constraints 'for all Γ in C_p^{p-s} with d^Γ_e >= 0,' but d^Γ_e = dmax + dΓ is always nonnegative, so this would include every sensor combination, even those for which the plausible set X^{t,Γ}_{t,d} is empty (i.e., dΓ > dmax). Algorithm 1 only includes Γ satisfying dmax >= dΓ, which is the correct condition. Including empty-set combinations would add unnecessary constraints and could render the QP infeasible even when a safe input exists. The statement of (19) and the theorem should be corrected to match the algorithm.","section":"Section III.B, Eq. (19) and Algorithm 1"}],"minor_comments":[{"comment":"The text states 'for the case d^Γ_e < 0, X^{t,Γ}_{t,d} = ∅,' but d^Γ_e = dmax + dΓ is always nonnegative since dΓ is the optimal value of a nonnegative variable. This condition should presumably be 'for the case dΓ > dmax' (i.e., when the linear program finds no plausible state within the noise bound).","section":"Section III.A, after Eq. (15)"},{"comment":"In the hardware experiments, the second EKF output is an exact duplicate of the primary EKF signal, so the two 'sensor' outputs are not independent. The paper acknowledges this, but it should be stated more prominently in the conclusions that physical attacks on independent sensors are not yet validated.","section":"Section V.B"},{"comment":"In the noise attack and shift attack cases of the SITL simulation, the drone remains safe even without the secure safety filter owing to the robustness of the standard safety filter or the small attack magnitude. The paper notes this, but the exposition would be clearer if the figures explicitly marked which cases demonstrate a safety violation in Phase 2 that the secure filter repairs.","section":"Section V.A, Fig. 5"},{"comment":"The abstract uses 'we proposed' where 'we propose' is grammatically expected, and Section II.A states that 'the set X^t_t contains finitely many plausible states' without clarifying that this refers to the noise-free case; with noise, the set is a union of infinitely many points and the statement should be qualified.","section":"Abstract and Section II.A"},{"comment":"Reference [17] lists 'Available from arXiv.org' without a year or arXiv number; please complete the bibliographic information.","section":"References, [17]"}],"recommendation":"major_revision","confidential_remarks":"The core linear-system-with-noise theory appears sound, and the code release is a genuine strength. The two most serious issues are the unquantified model-mismatch between the reduced-order model and the quadrotor, which blocks the transfer of the formal guarantee, and the omitted proof of Theorem 1. The inconsistency in the formal definition of the QP in Eq. (19) versus Algorithm 1 is a correctable but load-bearing defect. I would like to see the authors either provide a rigorous robustness margin for the reduced-order model or, if they prefer, clearly separate the formal linear-system contribution from an empirical study on the drone, with the latter explicitly not claiming a formal safety certificate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper earns its keep on the linear theory and loses some of that credit when it moves to the drone. Section III does something real: it takes the noise-free plausible-state sets from [16] and shows bounded measurement noise inflates them into ∞-norm balls. Lemma 1 is correct, the LP in (13) gives a reasonable center for each ball, and the robust CBF condition (18) is a conservative over-approximation of the worst case over that set. No fitted constants are hidden in the derivation, and the self-citation to [16] is appropriate. That part is worth citing.\n\nThe soft spots are in the transfer to hardware. Theorem 1 is stated for the exact linear system (1), the proof is omitted, and the feasibility assumption is acknowledged but unverified. Those are real but maybe curable. The bigger issue is the reduced-order model (20). The paper asserts that the nonlinear inner loop can be treated as a first-order lag with time constant τs, but gives no error bound, no identification procedure, and no margin. Since the plausible-state set and the CBF condition are both computed using (20), the computed set may not contain the true drone state. In that case the robust CBF inequality does not imply the real system stays in the safe set. The stress-test note correctly identifies this as a load-bearing gap. The experiments also don't close it: they show behavior in chosen scenarios, but no trial counts, no error bars, and the hardware attack is on a duplicated EKF stream rather than an independent sensor. That makes the demonstrations suggestive, not certifying.\n\nWho gets value: people building secure safety filters on linear or linearized models will find Section III useful, and the public code helps reproducibility. People expecting a formal safety guarantee on a real drone should be skeptical until the mismatch is quantified. This deserves peer review — a serious referee can push for the proof of Theorem 1, a robustness margin on τs, and an independent-sensor experiment. I'd conditionally accept after major revision.","headline":"Worth a serious referee: Section III is a clean bounded-noise extension of secure state reconstruction with a robust CBF filter, but the formal guarantee stops at the linear model and the drone validation doesn't fill that gap.","tokens_in":11736,"tokens_out":2319,"would_cite":true,"duration_ms":23573,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A secure safety filter that cross-examines sensor history and only issues safe commands can keep a quadrotor inside its geofence even when one sensor measurement is arbitrarily spoofed, provided its optimization stays feasible.","keywords":["secure state reconstruction","control barrier functions","sensor spoofing attacks","quadrotor safety","bounded measurement noise","robust safety filter","reduced-order model","cyber-physical systems"],"falsifier":"On a real drone, start a constant-value spoofing attack on the x-position output just as the drone is at the boundary of the geofence with a large outward velocity, and record the optimized input at each step; if the optimization problem becomes infeasible before the drone stops, Theorem 1's premise fails at that instant, and observing the drone cross the boundary would show the guarantee lapses exactly when feasibility is lost.","tokens_in":10701,"feed_emoji":"🚁","tokens_out":6446,"duration_ms":61203,"temperature":0.7,"pith_summary":"This paper proposes a modular 'secure safety filter' that keeps a drone safe even when one of its sensor measurements is arbitrarily spoofed. It combines a secure state reconstructor, which computes all states consistent with past input-output data under bounded measurement noise, with a control barrier function (CBF) safety filter that issues the safe control input closest to the nominal one. The central claim is Theorem 1: if the filter's quadratic program is feasible at every time step, the resulting control sequence renders the system safe. The authors extend earlier results from linear noiseless systems to bounded noise and, via a reduced-order velocity-tracking model, to the nonlinear dynamics of a quadrotor. Software-in-the-loop simulations and hardware flight tests under constant-value, noise, scale, and shift attacks illustrate the claim.","feed_headline":"Zero-trust safety filter keeps drones safe when a sensor lies","feed_subtitle":"Secure state reconstruction plus a barrier-function filter guards quadrotors under spoofed signals; hardware flights confirm.","key_machinery":"The load-bearing object is the pair consisting of a secure state reconstructor under bounded measurement noise and a robust CBF quadratic program. For each sensor subset $\\Gamma$, the reconstructor computes a representative state $x_{t,\\Gamma}^d$ and a radius $d^e_\\Gamma$ from a linear program; plausible states are then bounded by an $\\infty$-norm ball whose size grows with the noise bound $d_{\\max}$, the matrix norm of the observability map, and the propagation horizon. The safety filter replaces the condition that the CBF inequality hold for every plausible state with the single robust inequality $HBu + H(A-(1-\\gamma)I)x_{t,\\Gamma}^d + \\gamma q - \\Delta_\\Gamma \\mathbb{1}\\ge 0$, using the margin $\\Delta_\\Gamma = \\|H(A-(1-\\gamma)I)\\|_\\infty \\|A\\|^l_\\infty d^e_\\Gamma / m(O_\\Gamma)$, where $m(O_\\Gamma)$ is the minimum modulus of the observability block with respect to the $\\infty$-norm. This is what makes the infinite set of attack-induced states computationally tractable.","core_discovery":"The paper's central discovery is a way to make the standard CBF safety filter resilient to sensor spoofing without assuming any sensor is trustworthy. For every candidate set $\\Gamma$ of $p-s$ attack-free sensors, the secure state reconstructor solves a linear program (13) to find a representative plausible initial state; Lemma 1 shows that with bounded noise, the true plausible states lie inside an $\\infty$-norm ball around that representative. Propagating these balls to the current time and applying a robust CBF inequality (18) with a margin $\\Delta_\\Gamma$ turns the infinite safety condition 'safe for all plausible states' into finitely many linear constraints. The resulting quadratic program (19) is the secure safety filter, and Theorem 1 states that whenever it is feasible at every step, the closed-loop system stays in the safe set regardless of how the attacker corrupts up to $s$ measurements. The authors explicitly note that verifying feasibility is hard, and in their drone experiments they fall back to a zero-velocity command whenever the program becomes infeasible.","pith_inferences":["If an offline or online certificate could guarantee feasibility of (19) for the whole flight envelope, the zero-velocity fallback could be replaced by a provably safe recovery controller, making the guarantee unconditional rather than conditional.","The same construction should transfer to other platforms with cascaded inner-loop tracking, such as ground robots or fixed-wing aircraft, provided a reduced-order linear model with an explicit bound on the tracking residual can be identified.","The one-sparse observability of the four-state model with duplicated measurements means the guarantee covers corruption of any one of the eight measurement channels; an attacker that corrupts channels in both copies would break the assumption and fall outside the theorem.","The hardware experiments duplicate one estimation signal at a software interface; a genuinely independent second sensor suite under a physical attack would be a stronger test of the zero-trust premise than the demonstrated setup."],"forward_implications":["Any spoofing of up to $s$ sensor outputs is tolerated as long as the quadratic program (19) remains feasible at every step; the attack type does not matter.","Bounded measurement noise on the attack-free sensors is absorbed by enlarging the plausible-state region, so the security guarantee degrades gracefully as noise grows instead of disappearing entirely.","A nonlinear vehicle whose inner attitude loop reliably tracks velocity set-points can inherit the linear safety guarantee through the reduced-order model (20), as the drone experiments demonstrate.","Because the filter acts only when the nominal command is unsafe, the drone resumes its original mission trajectory once the attack is over, as shown in the constant-value and scale attack cases.","When the optimization is infeasible, the system switches to a conservative zero-velocity command, preserving safety in the tested scenarios at the cost of mission progress."],"supporting_citations":[{"why":"Establishes secure state reconstruction for linear systems under adversarial sensor attacks, giving the exact characterization the paper extends to bounded noise.","marker":"[14]"},{"why":"Provides an event-triggered sparse-attack observer that underpins the combinatorial enumeration of plausible sensors.","marker":"[15]"},{"why":"Introduces plausible-state safety analysis under severe sensor attacks in the noise-free case, the direct predecessor of the secure safety filter.","marker":"[16]"},{"why":"Basis of the CBF quadratic-program safety filter whose nominal safe control selection the secure filter extends.","marker":"[6]"},{"why":"Supplies the discrete-time control barrier function condition used for the safety constraint.","marker":"[7]"},{"why":"Provides the robust CBF technique used to turn the infinite set of plausible states into the finite linear constraint (18).","marker":"[22]"},{"why":"Models quadrotor dynamics, motivating the reduced-order abstraction of the nonlinear platform.","marker":"[23]"},{"why":"Documents the cascaded attitude and velocity-tracking control architecture that justifies the first-order reduced-order model (20).","marker":"[24]"}],"fun_headline_variants":["Secure filter thwarts drone sensor spoofing","Robust safety filter guards drones from sensor lies","Spoof-proof filter keeps drones safe without trusting sensors","Barrier filter with state reconstruction blocks sensor attacks","Secure safety filter fends off sensor attacks on drones"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The result rests on the safety filter's optimization problem having a feasible solution at every time step, and on the simplified first-order velocity model being close enough to the real drone that a safety guarantee computed on that model still holds on the actual hardware.","fun_headline_variants_meta":{"raw":{"variants":["Secure filter thwarts drone sensor spoofing","Robust safety filter guards drones from sensor lies","Spoof-proof filter keeps drones safe without trusting sensors","Barrier filter with state reconstruction blocks sensor attacks","Secure safety filter fends off sensor attacks on drones"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000735,"raw_usage":{"total_tokens":3257,"prompt_tokens":887,"completion_tokens":2370,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":503,"completion_tokens_details":{"reasoning_tokens":2296}},"tokens_in":503,"tokens_out":2370,"duration_ms":17075,"temperature":1.0,"reasoning_tokens":2296,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:30:57.351402+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"On a real drone, start a constant-value spoofing attack on the x-position output just as the drone is at the boundary of the geofence with a large outward velocity, and record the optimized input at each step; if the optimization problem becomes infeasible before the drone stops, Theorem 1's premise fails at that instant, and observing the drone cross the boundary would show the guarantee lapses exactly when feasibility is lost.","supporting_citations":[{"cited_title":"Secure estimation and control for cyber-physical systems under adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"Establishes secure state reconstruction for linear systems under adversarial sensor attacks, giving the exact characterization the paper extends to bounded noise."},{"cited_title":"Event-triggered state observers for sparse sensor noise/attacks,","cited_arxiv_id":null,"evidence_quote":"Provides an event-triggered sparse-attack observer that underpins the combinatorial enumeration of plausible sensors."},{"cited_title":"Safety of linear systems under severe sensor attacks,","cited_arxiv_id":null,"evidence_quote":"Introduces plausible-state safety analysis under severe sensor attacks in the noise-free case, the direct predecessor of the secure safety filter."},{"cited_title":"Control barrier function based quadratic programs for safety critical systems,","cited_arxiv_id":null,"evidence_quote":"Basis of the CBF quadratic-program safety filter whose nominal safe control selection the secure filter extends."},{"cited_title":"Control barrier functions: Theory and applications,","cited_arxiv_id":null,"evidence_quote":"Supplies the discrete-time control barrier function condition used for the safety constraint."},{"cited_title":"Multirotor aerial vehicles: Modeling, estimation, and control of quadrotor,","cited_arxiv_id":null,"evidence_quote":"Models quadrotor dynamics, motivating the reduced-order abstraction of the nonlinear platform."},{"cited_title":"Px4: A node-based multithreaded open source robotics framework for deeply embedded platforms,","cited_arxiv_id":null,"evidence_quote":"Documents the cascaded attitude and velocity-tracking control architecture that justifies the first-order reduced-order model (20)."}],"review_version":1}