Pith. sign in

REVIEW 4 major objections 4 minor 57 references

A Unified Attack Detection Strategy for Multi-Agent Systems over Transient and Steady Stages

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proposes a unified attack-detection framework for leader-following multi-agent systems that detects communication-layer, agent-layer, and hybrid attacks during both the transient and steady stages, without waiting for consensus…

desk verdict A worthwhile idea—dual-watermarked message sets for transient-stage attack detection—but the agent-layer guarantee rests on a false lemma, so the theory needs real repair before the paper can be accepted. read the letter →

arxiv 2501.03496 v1 pith:FYTOVCEF submitted 2025-01-07 eess.SY cs.SY

Jinming Gao , Yijing Wang , Wentao Zhang , Rui Zhao , Yang Shi , Zhiqiang Zuo This is my paper · ORCID
classification eess.SYcs.SY
keywords multi-agentsystemsattackdetectionwatermarkingKullback-LeiblerdivergenceByzantinehybridtransientstageconnectedvehicleplatoon
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to give a multi-agent system a single attack-detection framework that works both before and after consensus is reached, the transient and steady stages. For communication-layer attacks it has each transmitter send two watermarked state values per message and uses the KL divergence between the de-watermarked values as the test statistic; under the paper's ratio conditions, an attacked edge produces an unbounded divergence. For agent-layer Byzantine attacks it tests each neighbor's reported state against a decreasing envelope that matches the system's convergence rate, flagging only attackers that would break convergence. For hybrid attacks it combines both detectors with two-hop trusted-agent voting, and the paper claims this needs weaker graph conditions and less transmitted information than existing two-hop schemes. The reason to care is that in applications such as connected-vehicle platoons, attacks often arrive during the transient phase, when conventional consensus- or observer-based detectors are blind.

What carries the argument

The argument is carried by three objects. (i) The watermarked message set, $\{y_{1ij}(k), y_{2ij}(k)\}$, in which multiplicative watermarks $M_1^{-1}(k)$, $M_2^{-1}(k)$ and additive watermarks $F_1(k)$, $F_2(k)$ are applied to two copies of the same transmitted value; after the receiver removes the watermark, the KL divergence $D_{\mathrm{KL}}(y^*_{1ij}\|y^*_{2ij})$ is compared against a threshold. (ii) The convergence envelope $\tau(k)=M_r e^{-\lambda_{\min} k (1-\phi)}$ with offset $\delta$, which upper-bounds the neighbor tracking error in a healthy system and supplies the threshold in Algorithm 2. (iii) The flag pair $\{\varphi_{ij1}(k), \varphi_{ij2}(k)\}$ and the trusted-agent rule, which decide whether an edge or an agent is attacked and resolve ambiguity in hybrid scenarios. Theorem 1's ratio conditions on $(\sigma^2_{F_1}, \sigma^2_{F_2})$ and $(\lambda_1, \lambda_2)$ make the communication detector's statistic diverge; Lemma 1 supplies the norm ratio bound that Proposition 3 uses to convert the leader-follower envelope into a neighbor-based condition.

What would settle it

Take the one-dimensional case with $\Gamma=1$, $\Omega=-1$, so both entries lie in $[-1,1]$; Lemma 1 would claim $2 \le \sqrt{2}\|0\| = 0$, a contradiction, which shows the inequality is false for the very range Assumption 3 permits.

Watch

Extended reading notes

Core claim

On its own terms, the paper establishes three detection results. First, a watermarking scheme with two different watermarks per edge makes the Kullback-Leibler divergence between the two recovered messages tend to infinity under any communication-layer attack, provided the watermark variances and shifts satisfy the ratio conditions in Theorem 1, so the edge is detectable without waiting for an observer to converge. Second, an envelope detector using the convergence rate $\tau(k)=M_r e^{-\lambda_{\min} k (1-\phi)}$ and an offset $\delta$ characterizes the normal evolution of neighbor errors; an agent is declared Byzantine only when its error leaves this envelope, which the paper argues realizes a trade-off between detection accuracy and resilience. Third, a flag-based protocol over two-hop trusted agents (Algorithm 3) distinguishes an attacked communication edge from an attacked agent and detects their combination, under the graph condition of at least $L+P+1$ directed two-hop paths between neighboring agents. The central promise is that all three mechanisms are valid in the transient stage as well as the steady stage.

Load-bearing premise

The load-bearing premise is Lemma 1, a norm inequality for vectors whose entries lie in $[\varrho_1, \varrho_2]$; its proof requires $\varrho_1 > 0$, but Assumption 3 explicitly permits state bounds with $\varepsilon_1 < 0 < \varepsilon_2$, so the lemma does not cover the system's admissible signals and the agent-layer detector's theoretical guarantee in Proposition 3 is not established.

Editorial extensions

If this is right

  • Communication-layer attacks become detectable from the first time step, so a vehicle platoon or reconfiguring formation need not wait for consensus before raising an alarm.
  • The agent-layer detector tolerates misbehavior that does not disturb convergence, which reduces false isolation and preserves network connectivity with fewer redundant edges than robust-only schemes.
  • For hybrid attacks, the flag-based trusted-agent protocol distinguishes an attacked edge from an attacked agent, enabling layer-specific countermeasures rather than broad isolation.
  • The graph condition of at least $L+P+1$ directed two-hop paths between neighboring agents relaxes the $2L+1$ requirement of prior two-hop detection and cuts the transmitted information to watermarked data plus two flags.
  • The watermark parameter ratios in Theorem 1 give a concrete design rule: choose $\sigma^2_{F_1}/\sigma^2_{F_2}\to 0$ and $\lambda_1/\lambda_2\to 0$ to make the detector's divergence unbounded under attack.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One extension the authors leave implicit is that a corrected norm inequality for two-sided state bounds would let the same envelope detector handle systems whose states cross zero, such as bidirectional platoons.
  • A quantitative design question the paper does not resolve is how to choose watermark variances under a fixed false-alarm constraint; the ratio conditions give detectability but not an optimal energy allocation.
  • The flag-based trusted-agent voting could be adapted to event-triggered or asynchronous communication, where discrete verdicts rather than continuous signals are exchanged.
  • The framework is detection-only; integrating a resilient controller that reacts to the flags would complete the defense loop, a natural but unstated next step.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a three-part detection framework for multi-agent systems against communication-layer attacks, agent-layer (Byzantine) attacks, and hybrid attacks, with the stated goal of remaining effective during both transient and steady stages. For the communication layer, each agent transmits two differently watermarked versions of its state and the receiver uses a KL-divergence test after de-watermarking. For the agent layer, a convergence-rate envelope τ(k) is used as a threshold on inter-agent error growth, and a trusted-agent/two-hop scheme is then layered on top for hybrid attacks. The paper claims theoretical guarantees for all three algorithms and validates them on a platooning example. The central proof machinery is Lemma 1 in Section III-B, which is used to establish the no-false-alarm condition for the agent-layer detector and, through it, the hybrid detector.

Significance. If the proposed framework were sound, it would be a useful contribution: it addresses a genuine limitation of observer/consensus-based detectors during transients, it proposes a novel dual-watermarking message structure for communication-layer detection, and the trusted-agent hybrid scheme aims at a weaker graph condition than prior two-hop detectors. The paper also includes a Monte Carlo platooning simulation and makes explicit claims about parameter roles (watermark variances, threshold, envelope parameters), which is valuable. However, the load-bearing theoretical results are not established. Lemma 1 is false in the sign-indefinite regime explicitly allowed by Assumption 3, Proposition 1's 'if and only if' characterization is incorrect, and Proposition 3's proof does not derive the claimed inequality. Since Algorithm 2 and Algorithm 3 inherit these results, the main guarantees of the paper are unsupported. The communication-layer Theorem 1 also rests on unverified analytic inequalities. These issues are central, not local presentation problems.

major comments (4)
  1. [Section III-B, Lemma 1, Eq. (23)] Lemma 1 is false when ϱ1 < 0, a case permitted by Assumption 3 since ε1 may be negative. The proof uses 2nϱ1^2 ≤ Σ(Γ_i^2 + Ω_i^2), which requires ϱ1 > 0. A direct counterexample is n=1, ϱ1=-1, ϱ2=1, Γ=-1, Ω=1: the left side of (23) is 2 while ∥Ω+Γ∥=0. Proposition 3 derives its key bound (24) from Lemma 1, and Algorithm 2's detection test in its line 3, as well as Theorem 2's agent-layer and hybrid guarantees, rest on Proposition 3/4. Therefore the agent-layer and hybrid detection guarantees are unsupported as stated. There is also a constant mismatch: Lemma 1 gives the factor sqrt((ϱ1^2+ϱ2^2)/ϱ1^2), whereas Algorithm 2 and Proposition 3 use sqrt((ε1^2+ε2^2)/ε2^2) or its reciprocal; these are not algebraically equivalent, and no justification is given for replacing one by the other.
  2. [Section III-A, Proposition 1, Eq. (2)] The claimed 'if and only if' characterization of E(y^a_{ijl}(k)) ∈ [ε1, ε2] is incorrect for ε1 < 0 < ε2 because the allowed interval for Λ depends on Ξ. For example, take ε1=-1, ε2=1, Ξ=0.5, and Λ=0.8; these satisfy the stated conditions Ξ∈[-1,1] and Λ∈[ε1,ε2], yet at x=1 the expected received value is 1.3, outside [−1,1]. The endpoint conditions used in the proof are not sufficient when stated as independent intervals for Ξ and Λ; the feasible set for Λ is an interval that shrinks with |Ξ|. Since Proposition 1 is presented as the formal model of stealthy communication-layer attacks, this must be corrected, and any subsequent claims about which attacks remain within normal range need to be revisited.
  3. [Section III-B, Proposition 3, proof of Eq. (24)] The proof of (24) does not actually derive the claimed bound. After invoking Lemma 1 and the path decomposition (25), the argument states that if inequality (26) holds for each path segment, then (27) follows; but (26) is essentially the same multiplicative bound as (24) applied to a single edge, and the proof does not show how the triangle-inequality sum in (25) can be transformed term-by-term into the multiplicative factor (τ(k)+δ). The statement 'if (26), we have (27)' is an assumption of the desired result, not a proof. Consequently, even setting aside the falsity of Lemma 1, the no-false-alarm guarantee of Algorithm 2 is not established by the text.
  4. [Section III-A, Theorem 1 proof, Eqs. (11)-(22)] The proof of Theorem 1 contains unverified analytic steps that are load-bearing for the communication-layer detector. Equation (12) is an identity for the Gaussian density (the integral equals one), and the proof then asserts the existence of positive constants ξ11, ξ12, ξ31 'bounded away from zero' without construction or proof of uniformity in the attack parameters Ξ, Λ, the state x, and the watermark variances. The inequalities in (13), (14), and (16) replace the actual PDFs by Gaussian bounds using these constants, but no justification is supplied for the direction of the inequalities or for the constants being uniform enough to make the limits in (15), (17), (20), and (22) valid. Thus the claim that D_KL → +∞ for every case in TABLE I is not rigorously established.
minor comments (4)
  1. [Section III-C, Algorithm 3, line 5 and Eq. (29)] In Algorithm 3, line 5 and in Eq. (29), the second de-watermarked value is written as y*_2ij(k) = M1(k)(y^a_2ij(k) - F2(k)); it should use M2(k), not M1(k). The same typo appears in Eq. (30) of the Theorem 2 proof, where y*_2im(k) is incorrectly assigned M1(k); as written, the two de-watermarked streams are not equal in the attack-free case, contrary to the claim immediately following Eq. (30).
  2. [Section II-B, system model and Section III-B, Algorithm 2] The notation for the noise-attenuation gain is inconsistent: Assumption 4 uses ai(k) ∈ [µ1 k^{-Λ}, µ2 k^{-Λ}], but the control protocol in Section II-B writes ai(k) as a time-varying scalar with no relation to the later Assumption 4 parameters. Please clarify whether these are the same gain and how the envelope parameters Mr, δ, and ϕ in Algorithm 2 are to be chosen in terms of the system data.
  3. [Section IV, Fig. 8 attack parameters] The illustrative communication-layer attack matrices in the simulation, such as Ξ125(k) with diagonal entries 8.3 sin(k) and 2.4 sin(k), have magnitudes larger than 1, which lies outside the stealth interval Ξ ∈ [-1,1] stated in Proposition 1. If these attacks are not stealthy, the simulation may be testing an easier regime than the one characterized in the theoretical analysis; please either adjust the attack parameters to respect Proposition 1 or explicitly state that the detector is being tested beyond the stealthy class.
  4. [Section III-A, Theorem 1 statement] The limit condition in (6), lim_{σ_F1,σ_F2→+∞, λ1,λ2→+∞} D_KL = +∞, is written as a simultaneous limit with ratio conditions σ_F1/σ_F2→0 and λ1/λ2→0. This needs a precise definition of the limit order or a parametrization; otherwise the statement is ambiguous, especially because the proof treats σ_F variances and λ values in different cases separately.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the detection thresholds and envelope parameters are design choices or imported external convergence-rate results, not fitted to the data being predicted; the main technical weakness (Lemma 1) is a correctness gap, not a circular reduction.

full rationale

The derivation chain is not circular. Algorithm 1's watermarking detector is analyzed directly from the signal model in (4)-(5); the detection threshold theta is a pre-set design parameter, and the conditions in Theorem 1 (sigma_F1/sigma_F2 -> 0, lambda1/lambda2 -> 0 as the variances and gains diverge) are sufficient design conditions, not parameters fitted to the attack examples in the simulations. Algorithm 2's envelope is imported from a prior convergence-rate theorem [50], a published external result with stated assumptions; the constants M_r, phi, delta and the exponential envelope form are design choices describing the normal-system baseline, and no attack data are used to set them. The only self-citation of note is Assumption 1 from [49] and the convergence-rate envelope from [50], which include co-author Y. Wang; however, these are published theorems with independent mathematical content and are not re-derived from this paper's conclusions, so they count as independent support rather than a self-citation chain. The agent-layer attack model is explicitly restricted in Section III-B: 'the Byzantine attacks mentioned below refer to the ones that the state error exceeds the envelope'; this makes Proposition 4 an honest statement about the defined attack class, not a hidden equivalence between input and output. The significant technical weakness - Lemma 1's proof uses 2n*rho_1^2 <= sum(Omega_i^2 + Gamma_i^2), which requires rho_1 > 0 while Assumption 3 permits epsilon_1 < 0 < epsilon_2, and the constant in Algorithm 2 does not match Lemma 1 - is a correctness gap in the supporting mathematics, not a circular reduction. On the circularity axis the paper is self-contained and scores 0.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new physical entities. Its central results depend on five design parameters chosen by hand with no tuning procedure, on four background assumptions imported from [49] and [50], and on Lemma 1, which is stated as proved but is false as written. The free parameters are not fitted to attack data, so they are not a circularity source, but they are not justified either.

free parameters (5)
  • λ1, λ2 (multiplicative watermarking scale) = λ1=2, λ2=5 in simulation
    Choose the watermarking scales; Theorem 1 requires λ1/λ2→0, but the simulation uses 0.4, so these do not satisfy the proved sufficient condition.
  • σ_M1^2, σ_M2^2 (multiplicative watermark variances) = 7.2, 4.3
    Variances of the multiplicative watermarking noise; hand-selected without a tuning rule.
  • σ_F1^2, σ_F2^2 (additive watermark variances) = 2, 3.5
    Variances of the additive watermark; Theorem 1 requires σ_F1^2/σ_F2^2→0, but the simulation uses 0.57.
  • θ (detection threshold) = 4.61
    Pre-set threshold for KL divergence; the paper gives no procedure for setting it.
  • Mr, φ, δ (envelope parameters) = Mr=100, φ=0.16, δ=6
    Parameters of the convergence envelope and offset; chosen by hand, no sensitivity analysis.
assumptions (5)
  • domain assumption Assumption 1: spanning tree, noise attenuation gain conditions from [49]
    Imported from prior work; defines the nominal consensus convergence used throughout.
  • domain assumption Assumption 2: (L,P)-local attack model
    Bounding the number of misbehaving agents and channels; standard in the Byzantine literature.
  • domain assumption Assumption 3: state range disclosed to attacker
    Justifies the stealth condition in Proposition 1, but the proposition's 'if and only if' is incorrect.
  • domain assumption Assumption 4: bounds on noise attenuation gains ai(k) from [50]
    Used to justify the convergence rate envelope in Proposition 3.
  • ad hoc to paper Lemma 1 inequality for vector intervals
    Claimed lemma is false when the interval contains negative values, as is the case for states with ε1<0<ε2; it is load-bearing for Algorithm 2.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Unified Attack Detection Strategy for Multi-Agent Systems over Transient and Steady Stages." pith.science (2026). https://pith.science/paper/FYTOVCEF

@misc{pith2026250103496,
  author       = {Pith},
  title        = {Pith review of: A Unified Attack Detection Strategy for Multi-Agent Systems over Transient and Steady Stages},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FYTOVCEF}},
  note         = {Machine review of arXiv:2501.03496}
}
read the original abstract

This paper proposes a unified detection strategy against three kinds of attacks for multi-agent systems (MASs) which is applicable to both transient and steady stages. For attacks on the communication layer, a watermarking-based detection scheme with KullbackLeibler (KL) divergence is designed. Different from traditional communication schemes, each agent transmits a message set containing two state values with different types of watermarking. It is found that the detection performance is determined by the relevant parameters of the watermarking signal. Unlike the existing detection manoeuvres, such a scheme is capable of transient and steady stages. For attacks on the agent layer, a convergence rate related detection approach is put forward. It is shown that the resilience of the considered system is characterized by the coefficient and offset of the envelope. For hybrid attacks, based on the above detection mechanisms, a general framework resorting to trusted agents is presented, which requires weaker graph conditions and less information transmission. Finally, an example associated with the platooning of connected vehicles is given to support the theoretical results.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 56 canonical work pages

  1. [1]

    Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs,

    Y . Mo, S. Weerakkody, and B. Sinopoli, “Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs,” IEEE Control Systems Magazine, vol. 35, no. 1, pp. 93–109, 2015

    work page 2015

  2. [2]

    Offensive cyber-weapons: Technical, legal, and strategic aspects,

    A. K. Maitra, “Offensive cyber-weapons: Technical, legal, and strategic aspects,” Environment Systems and Decisions, vol. 35, no. 1, pp. 169–182, 2015

    work page 2015

  3. [3]

    False data injection attacks with complete stealthiness in cyber–physical systems: A self-generated approach,

    T. Y . Zhang and D. Ye, “False data injection attacks with complete stealthiness in cyber–physical systems: A self-generated approach,” Automatica, vol. 120, pp. 109117, 2020

    work page 2020

  4. [4]

    False data injection attacks against state estimation without knowledge of estimators,

    A. Y . Lu and G. H. Yang, “False data injection attacks against state estimation without knowledge of estimators,” IEEE Transactions on Automatic Control, vol. 67, no. 9, pp. 4529–4540, 2022

    work page 2022

  5. [5]

    Optimal denial-of-service attack scheduling with energy constraint,

    H. Zhang, P. Cheng, L. Shi, and J. Chen, “Optimal denial-of-service attack scheduling with energy constraint,” IEEE Transactions on Automatic Control, vol. 60, no. 11, pp. 3023–3028, 2015

    work page 2015

  6. [6]

    Cyber attack mitigation for cyber–physical systems: Hybrid system approach to controller design,

    C. Kwon and I. Hwang, “Cyber attack mitigation for cyber–physical systems: Hybrid system approach to controller design,” IET Control Theory & Applications , vol. 10, no. 7, pp. 731–741, 2016

    work page 2016

  7. [7]

    Secure estimation and control for cyber-physical systems under adversarial attacks,

    H. Fawzi, P. Tabuada, and S. Diggavi, “Secure estimation and control for cyber-physical systems under adversarial attacks,” IEEE Transactions on Automatic Control , vol. 59, no. 6, pp. 1454–1467, 2014

    work page 2014

  8. [8]

    Resilient control of networked control system under DoS attacks: A unified game approach,

    Y . Yuan, H. Yuan, L. Guo, H. Yang, and S. Sun, “Resilient control of networked control system under DoS attacks: A unified game approach,” IEEE Transactions on Industrial Informatics , vol. 12, no. 5, pp. 1786–1794, 2016

    work page 2016

Show all 57 references
  1. [9]

    Attack detection and identification in cyber-physical systems,

    F. Pasqualetti, F. Dörfler, and F. Bullo, “Attack detection and identification in cyber-physical systems,” IEEE Transactions on Automatic Control, vol. 58, no. 11, pp. 2715–2729, 2013

    2013

  2. [10]

    Detection and identification of sparse sensor attacks in cyber physical systems with side information,

    A. Y . Lu and G. H. Yang, “Detection and identification of sparse sensor attacks in cyber physical systems with side information,” IEEE Transactions on Automatic Control , vol. 68, no. 9, pp. 5349– 5364, 2022

    2022

  3. [11]

    Detection and mitigation of classes of attacks in supervisory control systems,

    L. K. Carvalho, Y . C. Wu, R. Kwong, and S. Lafortune, “Detection and mitigation of classes of attacks in supervisory control systems,” Automatica, vol. 97, pp. 121–133, 2018

    2018

  4. [12]

    Fault diagnosis of a class of nonlinear uncertain systems with Lipschitz nonlinearities using adaptive estimation,

    X. Zhang, M. M. Polycarpou, and T. Parisini, “Fault diagnosis of a class of nonlinear uncertain systems with Lipschitz nonlinearities using adaptive estimation,” Automatica, vol. 46, no. 2, pp. 290–299, 2010

    2010

  5. [13]

    A distributed cyber-attack detection scheme with application to DC microgrids,

    A. J. Gallo, M. S. Turan, F. Boem, T. Parisini, and G. Ferrari-Trecate, “A distributed cyber-attack detection scheme with application to DC microgrids,” IEEE Transactions on Automatic Control, vol. 65, no. 9, pp. 3800–3815, 2020

    2020

  6. [14]

    Detection of covert cyber-attacks in interconnected systems: A distributed model-based approach,

    A. Barboni, H. Rezaee, F. Boem, and T. Parisini, “Detection of covert cyber-attacks in interconnected systems: A distributed model-based approach,” IEEE Transactions on Automatic Control , vol. 65, no. 9, pp. 3728–3741, 2020

    2020

  7. [15]

    Joint watermarking-based replay attack detection for industrial process operation optimization cyber-physical systems,

    C. Yang, Z. Chu, L. Ma, G. Wang, and W. Dai, “Joint watermarking-based replay attack detection for industrial process operation optimization cyber-physical systems,” IEEE Transactions on Industrial Informatics , vol. 19, no. 8, pp. 8910–8922, 2022

    2022

  8. [16]

    A practical physical watermarking approach to detect replay attacks in a CPS,

    C. M. Ahmed, V . R. Palleti, and V . K. Mishra, “A practical physical watermarking approach to detect replay attacks in a CPS,” Journal of Process Control, vol. 116, pp. 136–146, 2022

    2022

  9. [17]

    Secure control against replay attacks,

    Y . Mo and B. Sinopoli, “Secure control against replay attacks,” in Proc. Annual Allerton Conference on Communication, Control, and Computing, pp. 911–918, 2009

    2009

  10. [18]

    Optimal periodic watermarking schedule for replay attack detection in cyber–physical systems,

    C. Fang, Y . Qi, P. Cheng, and W. X. Zheng, “Optimal periodic watermarking schedule for replay attack detection in cyber–physical systems,” Automatica, vol. 112, pp. 108698, 2020

    2020

  11. [19]

    Quickest detection of deception attacks on cyber–physical systems with a parsimonious watermarking policy,

    A. Naha, A. Teixeira, A. Ahlén, and S. Dey, “Quickest detection of deception attacks on cyber–physical systems with a parsimonious watermarking policy,” Automatica, vol. 155, pp. 111147, 2023

    2023

  12. [20]

    A blended active detection strategy for false data injection attacks in cyber-physical systems,

    M. Ghaderi, K. Gheitasi, and W. Lucia, “A blended active detection strategy for false data injection attacks in cyber-physical systems,” IEEE Transactions on Control of Network Systems , vol. 8, no. 1, pp. 168–176, 2020

    2020

  13. [21]

    Proactive attack detection scheme based on watermarking and moving target defense,

    H. Liu, Y . Zhang, Y . Li, and B. Niu, “Proactive attack detection scheme based on watermarking and moving target defense,” Automatica, vol. 155, pp. 111163, 2023

    2023

  14. [22]

    A switching multiplicative watermarking scheme for detection of stealthy cyber-attacks,

    R. M. G. Ferrari and A. Teixeira, “A switching multiplicative watermarking scheme for detection of stealthy cyber-attacks,” IEEE Transactions on Automatic Control , vol. 66, no. 6, pp. 2558–2573, 2020

    2020

  15. [23]

    Detection and isolation of routing attacks through sensor watermarking,

    R. M. G. Ferrari and A. Teixeira, “Detection and isolation of routing attacks through sensor watermarking,” in Proc. IEEE American Control Conference, pp. 5436–5442, 2017. 14 IEEE TRANSACTIONS AND JOURNALS TEMPLATE

    2017

  16. [24]

    Detection of sensor data injection attacks with multiplicative watermarking,

    A. Teixeira and R. M. G. Ferrari, “Detection of sensor data injection attacks with multiplicative watermarking,” in Proc. IEEE European Control Conference, pp. 338–343, 2018

    2018

  17. [25]

    Detection of cyber-attacks: A multiplicative watermarking scheme,

    R. M. G. Ferrari and A. Teixeira, “Detection of cyber-attacks: A multiplicative watermarking scheme,” inSafety, Security and Privacy for Cyber-Physical Systems . Springer, 2021, pp. 173–201

    2021

  18. [26]

    Fleet rebalancing for expanding shared e-mobility systems: A multi-agent deep reinforcement learning approach,

    M. Luo, B. Du, W. Zhang, T. Song, K. Li, H. Zhu, M. Birkin, and H. Wen, “Fleet rebalancing for expanding shared e-mobility systems: A multi-agent deep reinforcement learning approach,” IEEE Transactions on Intelligent Transportation Systems , vol. 24, no. 4, pp. 3868–3881, 2023

    2023

  19. [27]

    Distributed finite- time fault-tolerant containment control for multiple unmanned aerial vehicles,

    Z. Yu, Z. Liu, Y . Zhang, Y . Qu, and C. Y . Su, “Distributed finite- time fault-tolerant containment control for multiple unmanned aerial vehicles,” IEEE Transactions on Neural Networks and Learning Systems, vol. 31, no. 6, pp. 2077–2091, 2019

    2019

  20. [28]

    Multi-agent deep reinforcement learning based distributed optimal generation control of DC microgrids,

    Z. Fan, W. Zhang, and W. Liu, “Multi-agent deep reinforcement learning based distributed optimal generation control of DC microgrids,” IEEE Transactions on Smart Grid , vol. 14, no. 5, pp. 3337–3351, 2023

    2023

  21. [29]

    A novel bipartite consensus tracking control for multiagent systems under sensor deception attacks,

    X. Wang, Y . Cao, B. Niu, and Y . Song, “A novel bipartite consensus tracking control for multiagent systems under sensor deception attacks,” IEEE Transactions on Cybernetics, vol. 53, no. 9, pp. 5984– 5993, 2022

    2022

  22. [30]

    Secure control of multiagent systems against malicious attacks: A brief survey,

    W. He, W. Xu, X. Ge, Q. L. Han, W. Du, and F. Qian, “Secure control of multiagent systems against malicious attacks: A brief survey,” IEEE Transactions on Industrial Informatics, vol. 18, no. 6, pp. 3595–3608, 2021

    2021

  23. [31]

    Resilient consensus of multiagent systems against denial-of-service attacks,

    Z. Zuo, X. Cao, Y . Wang, and W. Zhang, “Resilient consensus of multiagent systems against denial-of-service attacks,” IEEE Transactions on Systems, Man, and Cybernetics: Systems , vol. 52, no. 4, pp. 2664–2675, 2021

    2021

  24. [32]

    Event-triggered consensus control for multi-agent systems against false data-injection attacks,

    X. M. Li, Q. Zhou, P. Li, H. Li, and R. Lu, “Event-triggered consensus control for multi-agent systems against false data-injection attacks,” IEEE Transactions on Cybernetics, vol. 50, no. 5, pp. 1856– 1866, 2020

    2020

  25. [33]

    Novel stealthy attack and defense strategies for networked control systems,

    Y . Mao, H. Jafarnejadsani, P. Zhao, E. Akyol, and N. Hovakimyan, “Novel stealthy attack and defense strategies for networked control systems,” IEEE Transactions on Automatic Control , vol. 65, no. 9, pp. 3847–3862, 2020

    2020

  26. [34]

    Distributed fault detection for interconnected second-order systems,

    I. Shames, A. Teixeira, H. Sandberg, and K. H. Johansson, “Distributed fault detection for interconnected second-order systems,” Automatica, vol. 47, no. 12, pp. 2757–2764, 2011

    2011

  27. [35]

    Distributed function calculation via linear iterative strategies in the presence of malicious agents,

    S. Sundaram and C. N. Hadjicostis, “Distributed function calculation via linear iterative strategies in the presence of malicious agents,” IEEE Transactions on Automatic Control , vol. 56, no. 7, pp. 1495– 1508, 2010

    2010

  28. [36]

    Consensus computation in unreliable networks: A system theoretic approach,

    F. Pasqualetti, A. Bicchi, and F. Bullo, “Consensus computation in unreliable networks: A system theoretic approach,” IEEE Transactions on Automatic Control, vol. 57, no. 1, pp. 90–104, 2011

    2011

  29. [37]

    Secure consensus with distributed detection via two-hop communication,

    L. Yuan and H. Ishii, “Secure consensus with distributed detection via two-hop communication,” Automatica, vol. 131, pp. 109775, 2021

    2021

  30. [38]

    Resilient synchronization of distributed multi-agent systems under attacks,

    A. Mustafa, H. Modares, and R. Moghadam, “Resilient synchronization of distributed multi-agent systems under attacks,” Automatica, vol. 115, pp. 108869, 2020

    2020

  31. [39]

    Resilient asymptotic consensus in robust networks,

    H. J. LeBlanc, H. Zhang, X. Koutsoukos, and S. Sundaram, “Resilient asymptotic consensus in robust networks,” IEEE Journal on Selected Areas in Communications , vol. 31, no. 4, pp. 766–781, 2013

    2013

  32. [40]

    An overview on multi-agent consensus under adversarial attacks,

    H. Ishii, Y . Wang, and S. Feng, “An overview on multi-agent consensus under adversarial attacks,” Annual Reviews in Control , vol. 53, pp. 252–272, 2022

    2022

  33. [41]

    Federated variance- reduced stochastic gradient descent with robustness to Byzantine attacks,

    Z. Wu, Q. Ling, T. Chen, and G. B. Giannakis, “Federated variance- reduced stochastic gradient descent with robustness to Byzantine attacks,” IEEE Transactions on Signal Processing, vol. 68, pp. 4583– 4596, 2020

    2020

  34. [42]

    Resilient multi-dimensional consensus in adversarial environment,

    J. Yan, X. Li, Y . Mo, and C. Wen, “Resilient multi-dimensional consensus in adversarial environment,” Automatica, vol. 145, pp. 110530, 2022

    2022

  35. [43]

    Resilient consensus of higher order multiagent networks: An attack isolation-based approach,

    D. Zhao, Y . Lv, X. Yu, G. Wen, and G. Chen, “Resilient consensus of higher order multiagent networks: An attack isolation-based approach,” IEEE Transactions on Automatic Control , vol. 67, no. 2, pp. 1001–1007, 2022

    2022

  36. [44]

    Physical safety and cyber security analysis of multi-agent systems: A survey of recent advances,

    D. Zhang, G. Feng, Y . Shi, and D. Srinivasan, “Physical safety and cyber security analysis of multi-agent systems: A survey of recent advances,” IEEE/CAA Journal of Automatica Sinica , vol. 8, no. 2, pp. 319–333, 2021

    2021

  37. [45]

    Resilient consensus of discrete-time complex cyber-physical networks under deception attacks,

    W. Fu, J. Qin, Y . Shi, W. X. Zheng, and Y . Kang, “Resilient consensus of discrete-time complex cyber-physical networks under deception attacks,” IEEE Transactions on Industrial Informatics , vol. 16, no. 7, pp. 4868–4877, 2019

    2019

  38. [46]

    Reducing time headway for platooning of connected vehicles via V2V communication,

    Y . Bian, Y . Zheng, W. Ren, S. E. Li, J. Wang, and K. Li, “Reducing time headway for platooning of connected vehicles via V2V communication,” Transportation Research Part C: Emerging Technologies, vol. 102, pp. 87–105, 2019

    2019

  39. [47]

    Bipartite Byzantine-resilient event-triggered consensus control of heterogeneous multi-agent systems,

    X. Lu and Y . Jia, “Bipartite Byzantine-resilient event-triggered consensus control of heterogeneous multi-agent systems,” International Journal of Robust and Nonlinear Control , vol. 33, no. 1, pp. 282–310, 2023

    2023

  40. [48]

    Observer-based fixed-time secure tracking consensus for networked high-order multiagent systems against DoS attacks,

    H. Yang and D. Ye, “Observer-based fixed-time secure tracking consensus for networked high-order multiagent systems against DoS attacks,” IEEE Transactions on Cybernetics, vol. 52, no. 4, pp. 2018– 2031, 2022

    2018

  41. [49]

    Consensus seeking in a network of discrete-time linear agents with communication noises,

    Y . Wang, L. Cheng, Z. G. Hou, M. Tan, C. Zhou, and M. Wang, “Consensus seeking in a network of discrete-time linear agents with communication noises,” International Journal of Systems Science , vol. 46, no. 10, pp. 1874–1888, 2015

    2015

  42. [50]

    On convergence rate of leader-following consensus of linear multi- agent systems with communication noises,

    L. Cheng, Y . Wang, W. Ren, Z. G. Hou, and M. Tan, “On convergence rate of leader-following consensus of linear multi- agent systems with communication noises,” IEEE Transactions on Automatic Control, vol. 61, no. 11, pp. 3586–3592, 2016

    2016

  43. [51]

    Byzantine-resilient distributed state estimation: A min-switching approach,

    A. Y . Lu and G. H. Yang, “Byzantine-resilient distributed state estimation: A min-switching approach,” Automatica, vol. 129, pp. 109664, 2021

    2021

  44. [52]

    Security index based on perfectly undetectable attacks: Graph-theoretic conditions,

    S. Gracy, J. Miloševi ´c and H. Sandberg, “Security index based on perfectly undetectable attacks: Graph-theoretic conditions,” Automatica, vol. 134, pp. 109925, 2021

    2021

  45. [53]

    G. F. Franklin, J. D. Powell, and A. Emami-Naeini, Feedback Control of Dynamic Systems , 8th ed. London, U.K.: Pearson, 2019

    2019

  46. [54]

    Watermarking- based protection strategy against stealthy integrity attack on distributed state estimation,

    J. Zhou, W. Yang, W. Ding, W. X. Zheng, and Y . Xu, “Watermarking- based protection strategy against stealthy integrity attack on distributed state estimation,” IEEE Transactions on Automatic Control, vol. 68, no. 1, pp. 628–635, 2023

    2023

  47. [55]

    Convergence rate of leader-following consensus of networks of discrete-time linear agents in noisy environments,

    L. Cheng, Y . Wang, Z. G. Hou, and M. Tan, “Convergence rate of leader-following consensus of networks of discrete-time linear agents in noisy environments,” in Proc. IEEE Chinese Control Conference , pp. 8102–8107, 2016

    2016

  48. [56]

    Summation detector for false data- injection attack in cyber-physical systems,

    D. Ye and T. Y . Zhang, “Summation detector for false data- injection attack in cyber-physical systems,” IEEE Transactions on Cybernetics, vol. 50, no. 6, pp. 2338–2345, 2020

    2020

  49. [57]

    False data injection attacks in control systems,

    Y . Mo, and B. Sinopoli, “False data injection attacks in control systems,” in Proc. Workshop Secure Control System, pp. 1–7, 2010

    2010

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.