Secure Safety Filter: Towards Safe Flight Control under Sensor Attacks

Aaron D. Ames; Junior Sundar; Martin Andreoni; Paulo Tabuada; Pio Ong; Renzo Bruzzone; Willian T. Lunardi; Xiao Tan

REVIEW 4 major objections 5 minor 24 references

Secure Safety Filter: Towards Safe Flight Control under Sensor Attacks

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A secure safety filter that cross-examines sensor history and only issues safe commands can keep a quadrotor inside its geofence even when one sensor measurement is arbitrarily spoofed, provided its optimization stays feasible.

desk verdict Worth a serious referee: Section III is a clean bounded-noise extension of secure state reconstruction with a robust CBF filter, but the formal guarantee stops at the linear model and the drone validation doesn't fill that gap. read the letter →

arxiv 2505.06845 v1 pith:PVRLQZNM submitted 2025-05-11 cs.RO cs.SYeess.SY

Xiao Tan , Junior Sundar , Renzo Bruzzone , Pio Ong , Willian T. Lunardi , Martin Andreoni , Paulo Tabuada , Aaron D. Ames This is my paper · ORCID

classification cs.ROcs.SYeess.SY

keywords securestatereconstructioncontrolbarrierfunctionssensorspoofingattacksquadrotorsafetyboundedmeasurementnoiserobustfilterreduced-ordermodelcyber-physicalsystems

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes a modular 'secure safety filter' that keeps a drone safe even when one of its sensor measurements is arbitrarily spoofed. It combines a secure state reconstructor, which computes all states consistent with past input-output data under bounded measurement noise, with a control barrier function (CBF) safety filter that issues the safe control input closest to the nominal one. The central claim is Theorem 1: if the filter's quadratic program is feasible at every time step, the resulting control sequence renders the system safe. The authors extend earlier results from linear noiseless systems to bounded noise and, via a reduced-order velocity-tracking model, to the nonlinear dynamics of a quadrotor. Software-in-the-loop simulations and hardware flight tests under constant-value, noise, scale, and shift attacks illustrate the claim.

What carries the argument

The load-bearing object is the pair consisting of a secure state reconstructor under bounded measurement noise and a robust CBF quadratic program. For each sensor subset $\Gamma$, the reconstructor computes a representative state $x_{t,\Gamma}^d$ and a radius $d^e_\Gamma$ from a linear program; plausible states are then bounded by an $\infty$-norm ball whose size grows with the noise bound $d_{\max}$, the matrix norm of the observability map, and the propagation horizon. The safety filter replaces the condition that the CBF inequality hold for every plausible state with the single robust inequality $HBu + H(A-(1-\gamma)I)x_{t,\Gamma}^d + \gamma q - \Delta_\Gamma \mathbb{1}\ge 0$, using the margin $\Delta_\Gamma = \|H(A-(1-\gamma)I)\|_\infty \|A\|^l_\infty d^e_\Gamma / m(O_\Gamma)$, where $m(O_\Gamma)$ is the minimum modulus of the observability block with respect to the $\infty$-norm. This is what makes the infinite set of attack-induced states computationally tractable.

What would settle it

On a real drone, start a constant-value spoofing attack on the x-position output just as the drone is at the boundary of the geofence with a large outward velocity, and record the optimized input at each step; if the optimization problem becomes infeasible before the drone stops, Theorem 1's premise fails at that instant, and observing the drone cross the boundary would show the guarantee lapses exactly when feasibility is lost.

Watch

Extended reading notes

Core claim

The paper's central discovery is a way to make the standard CBF safety filter resilient to sensor spoofing without assuming any sensor is trustworthy. For every candidate set $\Gamma$ of $p-s$ attack-free sensors, the secure state reconstructor solves a linear program (13) to find a representative plausible initial state; Lemma 1 shows that with bounded noise, the true plausible states lie inside an $\infty$-norm ball around that representative. Propagating these balls to the current time and applying a robust CBF inequality (18) with a margin $\Delta_\Gamma$ turns the infinite safety condition 'safe for all plausible states' into finitely many linear constraints. The resulting quadratic program (19) is the secure safety filter, and Theorem 1 states that whenever it is feasible at every step, the closed-loop system stays in the safe set regardless of how the attacker corrupts up to $s$ measurements. The authors explicitly note that verifying feasibility is hard, and in their drone experiments they fall back to a zero-velocity command whenever the program becomes infeasible.

Load-bearing premise

The result rests on the safety filter's optimization problem having a feasible solution at every time step, and on the simplified first-order velocity model being close enough to the real drone that a safety guarantee computed on that model still holds on the actual hardware.

Editorial extensions

If this is right

Any spoofing of up to $s$ sensor outputs is tolerated as long as the quadratic program (19) remains feasible at every step; the attack type does not matter.
Bounded measurement noise on the attack-free sensors is absorbed by enlarging the plausible-state region, so the security guarantee degrades gracefully as noise grows instead of disappearing entirely.
A nonlinear vehicle whose inner attitude loop reliably tracks velocity set-points can inherit the linear safety guarantee through the reduced-order model (20), as the drone experiments demonstrate.
Because the filter acts only when the nominal command is unsafe, the drone resumes its original mission trajectory once the attack is over, as shown in the constant-value and scale attack cases.
When the optimization is infeasible, the system switches to a conservative zero-velocity command, preserving safety in the tested scenarios at the cost of mission progress.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If an offline or online certificate could guarantee feasibility of (19) for the whole flight envelope, the zero-velocity fallback could be replaced by a provably safe recovery controller, making the guarantee unconditional rather than conditional.
The same construction should transfer to other platforms with cascaded inner-loop tracking, such as ground robots or fixed-wing aircraft, provided a reduced-order linear model with an explicit bound on the tracking residual can be identified.
The one-sparse observability of the four-state model with duplicated measurements means the guarantee covers corruption of any one of the eight measurement channels; an attacker that corrupts channels in both copies would break the assumption and fall outside the theorem.
The hardware experiments duplicate one estimation signal at a software interface; a genuinely independent second sensor suite under a physical attack would be a stronger test of the zero-trust premise than the demonstrated setup.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: the paper earns its keep on the linear theory and loses some of that credit when it moves to the drone. Section III does something real: it takes the noise-free plausible-state sets from [16] and shows bounded measurement noise inflates them into ∞-norm balls. Lemma 1 is correct, the LP in (13) gives a reasonable center for each ball, and the robust CBF condition (18) is a conservative over-approximation of the worst case over that set. No fitted constants are hidden in the derivation, and the self-citation to [16] is appropriate. That part is worth citing.

The soft spots are in the transfer to hardware. Theorem 1 is stated for the exact linear system (1), the proof is omitted, and the feasibility assumption is acknowledged but unverified. Those are real but maybe curable. The bigger issue is the reduced-order model (20). The paper asserts that the nonlinear inner loop can be treated as a first-order lag with time constant τs, but gives no error bound, no identification procedure, and no margin. Since the plausible-state set and the CBF condition are both computed using (20), the computed set may not contain the true drone state. In that case the robust CBF inequality does not imply the real system stays in the safe set. The stress-test note correctly identifies this as a load-bearing gap. The experiments also don't close it: they show behavior in chosen scenarios, but no trial counts, no error bars, and the hardware attack is on a duplicated EKF stream rather than an independent sensor. That makes the demonstrations suggestive, not certifying.

Who gets value: people building secure safety filters on linear or linearized models will find Section III useful, and the public code helps reproducibility. People expecting a formal safety guarantee on a real drone should be skeptical until the mismatch is quantified. This deserves peer review — a serious referee can push for the proof of Theorem 1, a robustness margin on τs, and an independent-sensor experiment. I'd conditionally accept after major revision.

Referee Report

4 major / 5 minor

Summary. The paper proposes a 'secure safety filter' that combines secure state reconstruction (SSR) with a control barrier function (CBF) safety filter to maintain safety for discrete-time linear systems subject to sensor spoofing attacks and bounded measurement noise. The SSR module extends prior noise-free results by characterizing the set of plausible states under bounded noise as a union of infinity-norm balls, and the safety filter enforces a robust CBF condition over this inflated set. The authors then adapt the framework to quadrotor flight by using a reduced-order linear model of the inner-loop velocity tracking dynamics, and demonstrate the approach in software-in-the-loop simulations and hardware experiments on a Holybro X500 quadrotor. The main formal result, Theorem 1, states that if the robust CBF QP is feasible at every time step, the control sequence renders the system safe.

Significance. If the central claim holds, the paper makes a useful contribution by extending secure state reconstruction to bounded measurement noise and coupling it with a robust CBF design, which goes beyond prior noise-free SSR work and offers a modular, implementation-oriented safety architecture. The experimental validation on a real quadrotor under emulated attacks is valuable, and the availability of public code supports reproducibility. However, the significance is tempered by a substantial gap between the formal guarantees, which apply to an exact linear model, and the claims about safety of the nonlinear quadrotor through the reduced-order model; the feasibility assumption in Theorem 1 is acknowledged but not analyzed; and the proof of the main theorem is omitted. These issues need to be resolved before the paper can be accepted.

major comments (4)

[Section IV.A, Eq. (20)] The theoretical guarantees (Lemma 1, Theorem 1) are established for the linear system (8), but the drone application relies on the reduced-order model (20) with a pre-chosen time constant tau_s. No bound is provided on the error between this reduced-order model and the actual quadrotor dynamics, nor is any robustness margin added to the plausible-state set X^t_{t,d} or the CBF condition (18). If the true state of the quadrotor is not contained in the computed plausible set, the condition (18) does not imply h(x(t+1)) >= 0 for the real system, so Theorem 1's safety guarantee does not transfer. The SITL and hardware experiments illustrate behavior in specific scenarios but do not quantify the model mismatch or verify that the true state remains in the reconstructed set. This gap is load-bearing for the paper's claim of applicability to nonlinear drone dynamics; the authors should either provide an error bound with corresponding inflation of the plausible set, or explicitly reframe the drone results as an empirical demonstration without a formal safety guarantee.
[Theorem 1, Section III.B] The proof of Theorem 1, the main formal result, is omitted with the statement that it 'follows from Lemma 1 and standard analysis of CBF-based safety filter design.' This is not sufficient for a journal publication, because the derivation of the robust CBF condition (18) relies on the over-approximation (15) and the filtration of sensor combinations with dmax >= dΓ, and the theorem's precise hypotheses are therefore not verifiable without a complete proof. The authors should provide the proof or a precise reference that covers exactly this setting, including how the over-approximation error enters the condition.
[Section III.B, after Theorem 1; Section V.A] The feasibility assumption in Theorem 1 is explicitly acknowledged to be difficult to verify, and the experiments switch to a zero-velocity command when the QP (19) is infeasible. However, this fallback is not analyzed: if feasibility fails while the drone is moving toward the boundary, a zero-velocity command may not prevent a safety violation, and no conditions are given under which the fallback itself preserves safety. The paper should either provide conditions under which the QP remains feasible (e.g., sufficient redundancy in the sensors or bounds on the attack), or analyze the safety properties of the fallback controller.
[Section III.B, Eq. (19) and Algorithm 1] There is an inconsistency between the formal QP definition and the algorithm. Eq. (19) is stated with constraints 'for all Γ in C_p^{p-s} with d^Γ_e >= 0,' but d^Γ_e = dmax + dΓ is always nonnegative, so this would include every sensor combination, even those for which the plausible set X^{t,Γ}_{t,d} is empty (i.e., dΓ > dmax). Algorithm 1 only includes Γ satisfying dmax >= dΓ, which is the correct condition. Including empty-set combinations would add unnecessary constraints and could render the QP infeasible even when a safe input exists. The statement of (19) and the theorem should be corrected to match the algorithm.

minor comments (5)

[Section III.A, after Eq. (15)] The text states 'for the case d^Γ_e < 0, X^{t,Γ}_{t,d} = ∅,' but d^Γ_e = dmax + dΓ is always nonnegative since dΓ is the optimal value of a nonnegative variable. This condition should presumably be 'for the case dΓ > dmax' (i.e., when the linear program finds no plausible state within the noise bound).
[Section V.B] In the hardware experiments, the second EKF output is an exact duplicate of the primary EKF signal, so the two 'sensor' outputs are not independent. The paper acknowledges this, but it should be stated more prominently in the conclusions that physical attacks on independent sensors are not yet validated.
[Section V.A, Fig. 5] In the noise attack and shift attack cases of the SITL simulation, the drone remains safe even without the secure safety filter owing to the robustness of the standard safety filter or the small attack magnitude. The paper notes this, but the exposition would be clearer if the figures explicitly marked which cases demonstrate a safety violation in Phase 2 that the secure filter repairs.
[Abstract and Section II.A] The abstract uses 'we proposed' where 'we propose' is grammatically expected, and Section II.A states that 'the set X^t_t contains finitely many plausible states' without clarifying that this refers to the noise-free case; with noise, the set is a union of infinitely many points and the statement should be qualified.
[References, [17]] Reference [17] lists 'Available from arXiv.org' without a year or arXiv number; please complete the bibliographic information.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the safety guarantee is a standard CBF induction given feasibility and the exact linear model, and the main limitations are soundness/model-validity gaps rather than circular reasoning.

full rationale

The central derivation is not circular. Theorem 1 states that if the secure safety filter QP (19) is always feasible, then the closed-loop system is safe; this is a standard discrete-time CBF argument whose ingredients are the definition of plausible states (Lemma 1), the conservative robustification in (18), and the feasibility assumption. Lemma 1 unpacks the definition of a plausible state under bounded noise; it does not assume the theorem's conclusion. The robust CBF condition (18) is a sufficient condition obtained by bounding the ball-like inflation of the plausible set, not an equivalent restatement of safety. Self-citations [16] and [17] supply the noiseless secure-state-reconstruction background and feasibility discussion, but the paper does not fit any parameter to the safety outcome, nor does it import a uniqueness theorem to force its construction. The authors explicitly flag the omitted proof and the hard-to-verify feasibility assumption, and they describe the zero-velocity fallback when infeasible; these are honest soundness gaps, not circular steps. The main practical weakness is the unquantified mismatch between the reduced-order model (20) and the true nonlinear drone dynamics: Theorem 1 is proved for the linear model (1), and transferring the guarantee to the real drone requires the abstraction in (20) to be faithful. That is a model-validity and correctness risk, not a circularity risk. Accordingly, the paper's formal claim is self-contained relative to its stated assumptions, and the score is low.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim rests on standard assumptions of secure state reconstruction (sparse observability, bounded sensor corruption, known noise bound) plus a feasibility assumption that is explicitly flagged as unresolved. The only hand-chosen numerical parameters are tau_s, dmax, and gamma, none of which is fitted to make the theorem work. No new physical entities are introduced; the plausible-state set and its ball over-approximation are mathematical constructions, not independent entities. The absence of a formal bound on the reduced-order model mismatch is the largest uncharged assumption.

free parameters (3)

tau_s (reduced-order model time constant) = not specified in paper
Time constant in the reduced-order model (20), selected by hand before simulation and flight tests; the model accuracy and the resulting safety filter depend on it.
dmax (measurement noise bound) = assumed known; numerical value not reported
Bounded noise assumption (9) used in Lemma 1 and in the LP (13); the size of the inflated plausible-state balls scales with dmax.
gamma (CBF decay constant) = not reported
Design constant in the CBF condition (7) and in the robust condition (18); it affects the conservativeness and feasibility of the safety QP.

assumptions (5)

domain assumption The system is s-sparse observable.
Section II.A restricts the discussion to systems that remain observable after removing measurements from s arbitrary sensors; this is required for the finite enumeration of plausible states.
domain assumption The attacker corrupts at most s sensor streams, arbitrarily over time.
The attack model in Section II allows e_i(t) != 0 only for up to s sensors; if more sensors are attacked, the reconstruction set is no longer valid.
domain assumption Measurement noise on all sensors is bounded with a known uniform bound dmax.
Equation (9) states ||d(t)||_inf <= dmax; Lemma 1 and the LP (13) rely on this bound being known and correct.
ad hoc to paper The robust CBF QP (19) is feasible at every time step.
Theorem 1 explicitly conditions the safety guarantee on feasibility; the authors acknowledge this is hard to verify and use a zero-velocity fallback when the QP is infeasible.
domain assumption The linear reduced-order model (20) faithfully captures the quadrotor's horizontal dynamics.
Section IV.A abstracts the inner-loop velocity tracking as a first-order system with time constant tau_s; no formal bound on the model mismatch is provided, so safety computed on this model may not strictly imply safety of the real nonlinear drone.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Secure Safety Filter: Towards Safe Flight Control under Sensor Attacks." pith.science (2026). https://pith.science/paper/PVRLQZNM

@misc{pith2026250506845,
  author       = {Pith},
  title        = {Pith review of: Secure Safety Filter: Towards Safe Flight Control under Sensor Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PVRLQZNM}},
  note         = {Machine review of arXiv:2505.06845}
}

read the original abstract

Modern autopilot systems are prone to sensor attacks that can jeopardize flight safety. To mitigate this risk, we proposed a modular solution: the secure safety filter, which extends the well-established control barrier function (CBF)-based safety filter to account for, and mitigate, sensor attacks. This module consists of a secure state reconstructor (which generates plausible states) and a safety filter (which computes the safe control input that is closest to the nominal one). Differing from existing work focusing on linear, noise-free systems, the proposed secure safety filter handles bounded measurement noise and, by leveraging reduced-order model techniques, is applicable to the nonlinear dynamics of drones. Software-in-the-loop simulations and drone hardware experiments demonstrate the effectiveness of the secure safety filter in rendering the system safe in the presence of sensor attacks.

Figures

Figures reproduced from arXiv: 2505.06845 by the authors.

**Figure 2.** Diagram of Software-in-the-Loop (SITL) experiment set-up [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** Diagram of hardware experiment set-up Gazebo Garden simulation environment. All the onboard sensors, actuators, and drone dynamics are simulated in the high-fidelity simulation and run on a desktop computer with a 13th Gen Intel i9 and integrated graphics. Our SITL build of PX4-Autopilot is available in the organization’s open-source repository. Our controller and secure-safety filter code are publicly available1 [… view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Phase 1 - Drone flying with a nominal controller together with a safety filter; Phase 2 - Attack initiated on the data entering the Sensor Aggregator; Phase 3 - Secure safety filter active and safe-guarding the nominal controller. 10 5 0 5 10 x (m) 6 4 2 0 2 4 6 y (m) …

**Figure 5.** Figure 5: Quadrotor trajectories in different phases of the SITL simulation under four different attacks. For easier illustration, all the attacks are performed [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

**Figure 6.** Figure 6: Holybro X500 quadrotor test platform. Two Pixhawk 5X micro [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

**Figure 7.** Figure 7: Quadrotor trajectories in different phases of the hardware experiments under four different attacks. For easier illustration, all the attacks are [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

24 extracted references · 20 canonical work pages

[16]

Safety of linear systems under severe sensor attacks,

X. Tan, P. Ong, P. Tabuada, and A. D. Ames, “Safety of linear systems under severe sensor attacks,” in 63rd IEEE Conference on Decision and Control (CDC) . IEEE, 2024, pp. 1–7

work page 2024
[1]

Iran–U.S. RQ-170 incident,

“Iran–U.S. RQ-170 incident,” https://en.wikipedia.org/wiki/Iran%E2% 80%93U.S. RQ-170 incident, accessed: 2025-02-14

work page 2025
[2]

Stealthy deception attacks on water scada systems,

S. Amin, X. Litrico, S. S. Sastry, and A. M. Bayen, “Stealthy deception attacks on water scada systems,” in Proceedings of the 13th ACM international conference on Hybrid systems: computation and control , 2010, pp. 161–170

work page 2010
[3]

False data injection attacks against state estimation in electric power grids,

Y . Liu, P. Ning, and M. K. Reiter, “False data injection attacks against state estimation in electric power grids,” ACM Transactions on Information and System Security , vol. 14, no. 1, pp. 1–33, 2011

work page 2011
[4]

Security analysis for cyber-physical systems against stealthy deception attacks,

C. Kwon, W. Liu, and I. Hwang, “Security analysis for cyber-physical systems against stealthy deception attacks,” in 2013 American control conference. IEEE, 2013, pp. 3344–3349

work page 2013
[5]

Walnut: Waging doubt on the integrity of mems accelerometers with acoustic injection attacks,

T. Trippel, O. Weisse, W. Xu, P. Honeyman, and K. Fu, “Walnut: Waging doubt on the integrity of mems accelerometers with acoustic injection attacks,” in 2017 IEEE European symposium on security and privacy (EuroS&P). IEEE, 2017, pp. 3–18

work page 2017
[6]

Control barrier function based quadratic programs for safety critical systems,

A. D. Ames, X. Xu, J. W. Grizzle, and P. Tabuada, “Control barrier function based quadratic programs for safety critical systems,” IEEE Transaction on Automatic Control , vol. 62, no. 8, pp. 3861–3876, 2016

work page 2016
[7]

Control barrier functions: Theory and applications,

A. D. Ames, S. Coogan, M. Egerstedt, G. Notomista, K. Sreenath, and P. Tabuada, “Control barrier functions: Theory and applications,” in Proc. European Control Conf. , 2019, pp. 3420–3431

work page 2019

Show all 24 references

[8]

Data-driven safety filters: Hamilton-jacobi reachability, control barrier functions, and predictive methods for uncertain systems,

K. P. Wabersich, A. J. Taylor, J. J. Choi, K. Sreenath, C. J. Tom- lin, A. D. Ames, and M. N. Zeilinger, “Data-driven safety filters: Hamilton-jacobi reachability, control barrier functions, and predictive methods for uncertain systems,” IEEE Control Systems Magazine , vol. 43...

2023
[9]

Sensor defense in-software (sdi): Practical software based detection of spoofing attacks on position sensors,

K. S. Tharayil, B. Farshteindiker, S. Eyal, N. Hasidim, R. Hershkovitz, S. Houri, I. Yoffe, M. Oren, and Y . Oren, “Sensor defense in-software (sdi): Practical software based detection of spoofing attacks on position sensors,” Engineering Applications of Artificial Intelligenc...

2020
[10]

On the performance analysis of resilient networked control systems under replay attacks,

M. Zhu and S. Martinez, “On the performance analysis of resilient networked control systems under replay attacks,” IEEE Transactions on Automatic Control , vol. 59, no. 3, pp. 804–808, 2013

2013
[11]

Input-to-state stabilizing control under denial-of-service,

C. De Persis and P. Tesi, “Input-to-state stabilizing control under denial-of-service,” IEEE Transactions on Automatic Control , vol. 60, no. 11, pp. 2930–2944, 2015

2015
[12]

Covert misappropriation of networked control systems: Presenting a feedback structure,

R. S. Smith, “Covert misappropriation of networked control systems: Presenting a feedback structure,” IEEE Control Systems Magazine , vol. 35, no. 1, pp. 82–92, 2015

2015
[13]

False data injection attacks against state estimation in wireless sensor networks,

Y . Mo, E. Garone, A. Casavola, and B. Sinopoli, “False data injection attacks against state estimation in wireless sensor networks,” in 49th IEEE Conference on Decision and Control (CDC) . IEEE, 2010, pp. 5967–5972

2010
[14]

Secure estimation and control for cyber-physical systems under adversarial attacks,

H. Fawzi, P. Tabuada, and S. Diggavi, “Secure estimation and control for cyber-physical systems under adversarial attacks,” IEEE Transac- tions on Automatic control , vol. 59, no. 6, pp. 1454–1467, 2014

2014
[15]

Event-triggered state observers for sparse sensor noise/attacks,

Y . Shoukry and P. Tabuada, “Event-triggered state observers for sparse sensor noise/attacks,” IEEE Transactions on Automatic Control, vol. 61, no. 8, pp. 2079–2091, 2015

2015
[17]

Computationally efficient safe control of linear systems under severe sensor attacks,

——, “Computationally efficient safe control of linear systems under severe sensor attacks,” in 2025 American Control Conference (ACC) . IEEE, 2025, Available from arXiv.org

2025
[18]

Plug-and-play secondary control for safety of LTI systems under attacks,

Y . Lin, M. S. Chong, and C. Murguia, “Plug-and-play secondary control for safety of LTI systems under attacks,” arXiv preprint arXiv:2212.00593, 2022

2022 arXiv
[19]

Safe control for nonlinear systems under faults and attacks via control barrier functions,

H. Zhang, Z. Li, and A. Clark, “Safe control for nonlinear systems under faults and attacks via control barrier functions,” arXiv preprint arXiv:2207.05146, 2022

2022 arXiv
[20]

Data-driven and stealthy deactiva- tion of safety filters,

D. Arnstr ¨om and A. M. Teixeira, “Data-driven and stealthy deactiva- tion of safety filters,” submitted to L4DC, under review, arXiv preprint arXiv:2412.01346, 2024

2024 arXiv
[21]

Discrete control barrier functions for safety-critical control of discrete systems with application to bipedal robot navigation

A. Agrawal and K. Sreenath, “Discrete control barrier functions for safety-critical control of discrete systems with application to bipedal robot navigation.” in Robotics: Science and Systems , vol. 13. Cambridge, MA, USA, 2017, pp. 1–10

2017
[22]

Robust control barrier functions for constrained sta- bilization of nonlinear systems,

M. Jankovic, “Robust control barrier functions for constrained sta- bilization of nonlinear systems,” Automatica, vol. 96, pp. 359–367, 2018

2018
[23]

Multirotor aerial vehicles: Modeling, estimation, and control of quadrotor,

R. Mahony, V . Kumar, and P. Corke, “Multirotor aerial vehicles: Modeling, estimation, and control of quadrotor,” IEEE robotics & automation magazine, vol. 19, no. 3, pp. 20–32, 2012

2012
[24]

Px4: A node-based multithreaded open source robotics framework for deeply embedded platforms,

L. Meier, D. Honegger, and M. Pollefeys, “Px4: A node-based multithreaded open source robotics framework for deeply embedded platforms,” in 2015 IEEE international conference on robotics and automation (ICRA). IEEE, 2015, pp. 6235–6240. 8

2015

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [16]

Safety of linear systems under severe sensor attacks,

X. Tan, P. Ong, P. Tabuada, and A. D. Ames, “Safety of linear systems under severe sensor attacks,” in 63rd IEEE Conference on Decision and Control (CDC) . IEEE, 2024, pp. 1–7

work page 2024

[2] [1]

Iran–U.S. RQ-170 incident,

“Iran–U.S. RQ-170 incident,” https://en.wikipedia.org/wiki/Iran%E2% 80%93U.S. RQ-170 incident, accessed: 2025-02-14

work page 2025

[3] [2]

Stealthy deception attacks on water scada systems,

S. Amin, X. Litrico, S. S. Sastry, and A. M. Bayen, “Stealthy deception attacks on water scada systems,” in Proceedings of the 13th ACM international conference on Hybrid systems: computation and control , 2010, pp. 161–170

work page 2010

[4] [3]

False data injection attacks against state estimation in electric power grids,

Y . Liu, P. Ning, and M. K. Reiter, “False data injection attacks against state estimation in electric power grids,” ACM Transactions on Information and System Security , vol. 14, no. 1, pp. 1–33, 2011

work page 2011

[5] [4]

Security analysis for cyber-physical systems against stealthy deception attacks,

C. Kwon, W. Liu, and I. Hwang, “Security analysis for cyber-physical systems against stealthy deception attacks,” in 2013 American control conference. IEEE, 2013, pp. 3344–3349

work page 2013

[6] [5]

Walnut: Waging doubt on the integrity of mems accelerometers with acoustic injection attacks,

T. Trippel, O. Weisse, W. Xu, P. Honeyman, and K. Fu, “Walnut: Waging doubt on the integrity of mems accelerometers with acoustic injection attacks,” in 2017 IEEE European symposium on security and privacy (EuroS&P). IEEE, 2017, pp. 3–18

work page 2017

[7] [6]

Control barrier function based quadratic programs for safety critical systems,

A. D. Ames, X. Xu, J. W. Grizzle, and P. Tabuada, “Control barrier function based quadratic programs for safety critical systems,” IEEE Transaction on Automatic Control , vol. 62, no. 8, pp. 3861–3876, 2016

work page 2016

[8] [7]

Control barrier functions: Theory and applications,

A. D. Ames, S. Coogan, M. Egerstedt, G. Notomista, K. Sreenath, and P. Tabuada, “Control barrier functions: Theory and applications,” in Proc. European Control Conf. , 2019, pp. 3420–3431

work page 2019