Pith. sign in

REVIEW 1 major objections 2 minor 1 cited by

Short sequences of legitimate MAVLink commands can degrade ArduPilot UAV stability and cause crashes by changing controller parameters.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.3

2026-06-26 10:53 UTC pith:H6E5SHCJ

load-bearing objection The paper catalogs six MAVLink parameter attacks on ArduPilot that degrade control and cause crashes in both simulation and Pixhawk hardware, with the experiments appearing to match the claims. the 1 major comments →

arxiv 2606.22289 v1 pith:H6E5SHCJ submitted 2026-06-21 cs.CR cs.SYeess.SY

Control-Aware Manipulation of ArduPilot via Legitimate MAVLink Commands: Simulation and Hardware Validation

Feras Benchellal andLotfi Ben Othmane , Yasaswini Konapalli , Cihan Tunc , Bharat Bhargava This is my paper
classification cs.CR cs.SYeess.SY
keywords ArduPilotMAVLinkUAV securityflight controller attacksPID gainsEKFfailsafecontrol-aware attacks
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper establishes that an adversary can use well-formed MAVLink messages to alter PID gains, EKF settings, and failsafe parameters in ArduPilot flight controllers. These changes exploit the controller's sensitivity to parameter values and update rates, leading to degraded attitude stability, trajectory tracking, and estimator performance. When effects are combined, the UAV enters unsafe states and crashes. The demonstrations in simulation and on Pixhawk hardware show that no malformed commands are needed, only trusted ones. A sympathetic reader would care because current UAV systems may lack checks against such parameter manipulations that affect closed-loop behavior.

Core claim

The paper claims that six specific attacks, each using short sequences of MAVLink parameter-change commands, can force ArduPilot into unsafe operating conditions by modifying interactions among its multi-layer controllers. These attacks target PID gains, EKF estimation configuration, and failsafe assumptions, and their combined effects result in loss of control and vehicle crashes, as validated in both SITL simulation and Pixhawk hardware experiments.

What carries the argument

The six attacks that modify PID gains, alter EKF estimation configuration, and violate failsafe assumptions to exploit controller sensitivities to parameter values and update frequency.

Load-bearing premise

The ArduPilot flight controller accepts and immediately applies MAVLink parameter-change commands without additional runtime validation of their effect on closed-loop stability or estimator health.

What would settle it

Running the described sequences of MAVLink parameter commands in ArduPilot SITL simulation or on Pixhawk hardware and observing whether attitude stability, angular rates, trajectory tracking, and estimator health degrade as claimed, or if the vehicle crashes.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Modifying PID gains degrades attitude stability and angular-rate behavior.
  • Altering EKF estimation configuration affects estimator health.
  • Violating failsafe assumptions allows the vehicle to enter unsafe operating conditions.
  • Combining multiple parameter changes causes trajectory tracking failure and vehicle crashes.
  • These outcomes occur from short sequences of well-formed MAVLink messages without code changes.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Other flight controllers that accept MAVLink parameter commands without stability checks may share similar vulnerabilities.
  • Adding runtime validation of parameter effects on closed-loop dynamics could block these attacks but would change how controllers process trusted inputs.
  • The same parameter-manipulation approach could be tested on different UAV hardware platforms to determine if the issues extend beyond ArduPilot.
  • Security for UAVs may need to treat parameter updates as potential control inputs rather than benign configuration.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

1 major / 2 minor

Summary. The paper claims that short sequences of well-formed MAVLink parameter-set commands can exploit ArduPilot's multi-layer controllers (PID gains, EKF configuration, failsafe assumptions) to degrade attitude stability, angular-rate behavior, trajectory tracking, and estimator health, ultimately causing loss of control and crashes when effects are combined. The central results are direct experimental observations from SITL simulation and Pixhawk 2.4.8 hardware runs demonstrating six specific attacks.

Significance. If the results hold, the work is significant for highlighting practical security gaps in input-parameter handling and command trust within a widely deployed open-source flight controller. The combination of SITL traces and hardware validation on real Pixhawk hardware, together with the absence of fitted parameters or circular derivations, provides concrete, falsifiable evidence of controller sensitivity to legitimate commands.

major comments (1)
  1. [Evaluation section] Evaluation section: the abstract states concrete degradation metrics, but full data tables, run counts, success rates, and exclusion criteria are not visible; this is load-bearing for assessing reproducibility of the hardware validation and the claim that combined effects produce crashes.
minor comments (2)
  1. [Abstract] Abstract: 'inwhich' is a typographical error and should be 'in which'.
  2. The six attacks are described at a high level; adding a table summarizing the exact MAVLink message sequences, targeted parameters, and observed effects per attack would improve clarity without altering the central claim.

Simulated Author's Rebuttal

1 responses · 0 unresolved

Thank you for the opportunity to respond to the referee's report. We appreciate the referee's recognition of the significance of our work and the recommendation for minor revision. We address the single major comment below.

read point-by-point responses

  1. Referee: [Evaluation section] Evaluation section: the abstract states concrete degradation metrics, but full data tables, run counts, success rates, and exclusion criteria are not visible; this is load-bearing for assessing reproducibility of the hardware validation and the claim that combined effects produce crashes.

    Authors: We agree with the referee that additional details on the experimental data would improve the reproducibility of our results. The current manuscript presents key observations from SITL and hardware experiments but does not include comprehensive tables summarizing all runs. In the revised version, we will expand the Evaluation section to include tables reporting the number of experimental runs performed for each attack, success rates, observed degradation metrics with statistics where applicable, and any exclusion criteria applied during hardware validation. This will provide stronger support for the claims that combined effects can lead to crashes. revision: yes

Circularity Check

0 steps flagged

No significant circularity; results are direct experimental observations

full rationale

The manuscript contains no derivations, equations, fitted parameters, or load-bearing self-citations. Its central claims consist of direct SITL and Pixhawk hardware observations that short MAVLink parameter-set sequences degrade attitude stability, rates, trajectory tracking, and EKF health, culminating in loss of control when combined. The attack surface (acceptance of parameter changes without runtime stability validation) is both the premise and the demonstrated mechanism, with no reduction of any result to its own inputs by construction. This is the expected non-finding for an experimental security paper.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The work rests on the domain assumption that MAVLink parameter commands are processed without additional stability or sanity checks; no free parameters or invented entities are introduced.

axioms (1)
  • domain assumption MAVLink commands are processed without additional security checks beyond protocol compliance
    The attacks rely on the system accepting parameter changes via MAVLink.

pith-pipeline@v0.9.1-grok · 5755 in / 1200 out tokens · 30978 ms · 2026-06-26T10:53:17.876408+00:00 · methodology

0 comments
read the original abstract

This paper investigates control-aware attacks against ArduPilot-based Unmanned Aerial Vehicles (UAVs), inwhich an adversary exploits the sensitivity of flight-controller dynamics to parameter changes to cause loss of control and crashes. It describes six attacks that exploit interactions among multi-layer controllers by modifying Proportional-Integral-Derivative (PID) gains, altering Extended Kalman Filter (EKF) estimation configuration, and violating failsafe assumptions, thereby forcing ArduPilot into unsafe operating conditions. We evaluate the attacks in Software-in-the-Loop (SITL) simulation and validate them on a Pixhawk 2.4.8 hardware platform. The results show that short sequences of well-formed MAVLink messages can exploit controller sensitivity to parameter values and updates frequency, affecting controller states and degrading attitude stability, angular-rate behavior, trajectory tracking, and estimator health. We demonstrate that when multiple effects are combined, the vehicle can enter an unsafe state and crashes. These findings show that security gaps in input-parameter handling, command trust, and controller-state validation can be exploited to cause loss of control and crashes in UAVs.

Figures

Figures reproduced from arXiv: 2606.22289 by Bharat Bhargava, Cihan Tunc, Feras Benchellal andLotfi Ben Othmane, Yasaswini Konapalli.

Figure 1
Figure 1. Figure 1: Control-aware manipulation against a UAV. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Reverse-engineered ArduCopter Control System [16]. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Attack 3 - The EKF roll/pitch error errRP. Note that the error is almost 0 in the baseline scenario and ramps to 0.170 while the vehicle remains airborne in the attack scenario. An operator watching the attitude and rate panels from the authorized GCS would not see the effect of this attack. The external flight behavior remained almost unchanged – roll, pitch, and yaw variability changed by less than 1%, a… view at source ↗
Figure 4
Figure 4. Figure 4: Attack 4 angular-rate response. (a) Roll rate enters [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figure 7
Figure 7. Figure 7: Attack 6 estimator response. errRP peaks at 0.524 before the EKF failsafe triggers and the north/east velocity estimates show the filter losing coherent state long before the failsafe activates. we report a successful attack scenario. Future work will derive analytical bounds on the parameters needed to guarantee the desired impact. ArduPilot response to the attack commands. Attack 6 requires no attacker i… view at source ↗
Figure 6
Figure 6. Figure 6: UML Sequence Diagram for Attack 6 to 5.0, ATC_RAT_PIT_I and ATC_RAT_RLL_I to 3.0, ATC_RAT_PIT_D and ATC_RAT_RLL_D to 0, ATC_RAT_PIT_IMAX and ATC_RAT_RLL_IMAX to 3.0. For the yaw, the script sets parameter ATC_RAT_YAW_P to 1.5, ATC_RAT_YAW_I to 0.5, and ATC_RAT_YAW_IMAX to 2.0. Phase 3 weakens the outer attitude controllers by setting ATC_ANG_PIT_P, ATC_ANG_RLL_P, and ATC_ANG_YAW_P to 0.5. The script then s… view at source ↗
Figure 9
Figure 9. Figure 9: Quadcopter testbed with a Pixhawk 2.4.8 flight con [PITH_FULL_IMAGE:figures/full_fig_p012_9.png] view at source ↗
Figure 8
Figure 8. Figure 8: Attack 6 attitude response. Roll diverges to approxi [PITH_FULL_IMAGE:figures/full_fig_p012_8.png] view at source ↗
Figure 10
Figure 10. Figure 10: Summary of the control-aware attacks, their methods, and their effects. [PITH_FULL_IMAGE:figures/full_fig_p014_10.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Control

    cs.CR 2026-07 conditional novelty 5.0

    An architecture that mediates LLM computer-use agents for UAV control by compiling agent decisions into validated, time-bounded, evidence-logged skill invocations, with a prototype on OpenClaw/PX4/OP-TEE.

Reference graph

Works this paper leans on

34 extracted references · cited by 1 Pith paper

  1. [1]

    Drone Market (2026 - 2033),

    “Drone Market (2026 - 2033),” https://www.grandviewresearch.com/ industry-analysis/drone-market-report, [Accessed 21-05-2026]

    2026

  2. [2]

    Vulnerability analysis of the MA VLink protocol for command and control of unmanned aircraft,

    J. A. Marty, “Vulnerability analysis of the MA VLink protocol for command and control of unmanned aircraft,” Master’s thesis, Air Force Institute of Technology, Wright-Patterson AFB, Ohio, 2014

    2014

  3. [3]

    Empirical analysis of MA VLink protocol vulnerability for attacking unmanned aerial vehicles,

    Y .-M. Kwon, J. Yu, B.-M. Cho, Y . Eun, and K.-J. Park, “Empirical analysis of MA VLink protocol vulnerability for attacking unmanned aerial vehicles,”IEEE Access, vol. 6, pp. 43 203–43 212, 2018

    2018

  4. [4]

    MA VLink protocol: A survey of security threats and countermeasures,

    M. A. Hamza, M. Mohsin, M. Khalil, and S. M. K. A. Kazmi, “MA VLink protocol: A survey of security threats and countermeasures,” inProceedings of the 4th International Conference on Digital Futures and Transformative Technologies (ICoDT2), 2024, pp. 1–8

    2024

  5. [5]

    Rocking drones with intentional sound noise on gyroscopic sensors,

    Y . Son, H. Shin, D. Kim, Y . Park, J. Noh, K. Choi, J. Choi, and Y . Kim, “Rocking drones with intentional sound noise on gyroscopic sensors,” in 24th USENIX Security Symposium (USENIX Security 15). Washington, D.C.: USENIX Association, 2015, pp. 881–896

    2015

  6. [6]

    Injected and delivered: Fabricating implicit control over actuation systems by spoofing inertial sensors,

    Y . Tu, Z. Lin, I. Lee, and X. Hei, “Injected and delivered: Fabricating implicit control over actuation systems by spoofing inertial sensors,” in 27th USENIX Security Symposium (USENIX Security 18). Baltimore, MD: USENIX Association, 2018, pp. 1545–1562

    2018

  7. [7]

    W ALNUT: Waging doubt on the integrity of MEMS accelerometers with acoustic injection attacks,

    T. Trippel, O. Weisse, W. Xu, P. Honeyman, and K. Fu, “W ALNUT: Waging doubt on the integrity of MEMS accelerometers with acoustic injection attacks,” in2017 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2017, pp. 3–18

    2017

  8. [8]

    MUVIDS: False MA VLink injection attack detection in communication for unmanned vehicles,

    S. Jeong, E. Park, K. U. Seo, J. D. Yoo, and H. K. Kim, “MUVIDS: False MA VLink injection attack detection in communication for unmanned vehicles,” inWorkshop on Automotive and Autonomous V ehicle Security (AutoSec), 2021

    2021

  9. [9]

    Intrusion detection system for drones,

    B. Tufekci, “Intrusion detection system for drones,” Ph.D. dissertation, University of North Texas, Denton, Texas, 2024

    2024

  10. [10]

    A lightweight and efficient intrusion detec- tion system for drone networks,

    F. J. Alruwaili and C. Tunc, “A lightweight and efficient intrusion detec- tion system for drone networks,” in2025 5th Intelligent Cybersecurity Conference (ICSC), 2025, pp. 219–226

    2025

  11. [11]

    Run- time anomaly detection for drones: An integrated rule-mining and unsupervised-learning approach,

    I. Tan, W. Minn, C. M. Poskitt, L. K. Shar, and L. Jiang, “Run- time anomaly detection for drones: An integrated rule-mining and unsupervised-learning approach,” 2025

    2025

  12. [12]

    A secure communication protocol for unmanned aerial vehicles,

    N. A. Khan, N. Z. Jhanjhi, S. N. Brohi, and A. A. Almazroi, “A secure communication protocol for unmanned aerial vehicles,”Computers, Materials & Continua, vol. 70, no. 1, pp. 601–618, 2022

    2022

  13. [13]

    Enhancing the security of the MA VLink with symmetric authenticated encryption for drones,

    B. Tufekci, A. Arslan, C. Tunc, and K. Morozov, “Enhancing the security of the MA VLink with symmetric authenticated encryption for drones,” in Proceedings of the 11th International Conference on Internet of Things: Systems, Management and Security (IOTSMS), 2024, pp. 58–65

    2024

  14. [14]

    Ardupilot,

    “Ardupilot,” https://ardupilot.org/, accessed in Oct. 2025

    2025

  15. [15]

    A. D. Team, https://ardupilot.org/dev/docs/security-landing-page.html, 2026

    2026

  16. [16]

    Reverse engineering and control-aware security analysis of the ardupi- lot uav framework,

    Y . Konapalli, L. B. Othmane, C. Tunc, F. Benchellal, and L. Mudagere, “Reverse engineering and control-aware security analysis of the ardupi- lot uav framework,” in8th International Workshop on Software Engi- neering Research and Practices for the IoT, Rio De Janeiro, April 2026

    2026

  17. [17]

    Complete parameter list — Copter documentation,

    ArduPilot Development Team, “Complete parameter list — Copter documentation,” https://ardupilot.org/copter/docs/parameters.html, 2025, accessed: 2026-03-30

    2025

  18. [18]

    A new approach to linear filtering and prediction problems,

    R. E. Kalman, “A new approach to linear filtering and prediction problems,”Journal of Basic Engineering, vol. 82, no. 1, pp. 35–45, 03 1960

    1960

  19. [19]

    Directional stability of automatically steered bodies,

    N. Minorsky, “Directional stability of automatically steered bodies,” Journal of the American Society for Naval Engineers, vol. 34, no. 2, pp. 280–309, 1922

    1922

  20. [20]

    F. L. Lewis, D. Vrabie, and V . L. Syrmos,Optimal Control, 3rd ed. Hoboken, NJ: Wiley, 2012

    2012

  21. [21]

    Reinforcement learning and adaptive dynamic programming for feedback control,

    F. L. Lewis and D. Vrabie, “Reinforcement learning and adaptive dynamic programming for feedback control,”IEEE Circuits and Systems Magazine, vol. 9, no. 3, pp. 32–50, 2009

    2009

  22. [22]

    Drift with devil: Security of multi-sensor fusion based localization in high-level autonomous driving under GPS spoofing,

    J. Shen, J. Y . Won, Z. Chen, and Q. A. Chen, “Drift with devil: Security of multi-sensor fusion based localization in high-level autonomous driving under GPS spoofing,” in29th USENIX Security Symposium, 2020, pp. 931–948

    2020

  23. [23]

    Flight recovery of mavs with compromised imu,

    Z. Tu, F. Fei, M. Eagon, D. Xu, and X. Deng, “Flight recovery of mavs with compromised imu,” in2019 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). Macau, China: IEEE, November 2019, pp. 3638–3644

    2019

  24. [24]

    Sensor deprivation attacks for stealthy UA V manipulation,

    A. Erba, N. O. Tippenhauer, and D. Balzarotti, “Sensor deprivation attacks for stealthy UA V manipulation,” inProceedings of the 33rd USENIX Security Symposium, 2024, pp. 1–18

    2024

  25. [25]

    ArduPilot coverity scan results,

    ArduPilot Development Team, “ArduPilot coverity scan results,” https: //scan.coverity.com/projects/ardupilot-ardupilot, 2019, accessed: 2024

    2019

  26. [26]

    An exploratory study of autopilot software bugs in unmanned aerial vehicles,

    D. Wang, S. Li, G. Xiao, Y . Liu, and Y . Sui, “An exploratory study of autopilot software bugs in unmanned aerial vehicles,” inProceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the F oundations of Software Engineering (ESEC/FSE), 2021, pp. 20–31

    2021

  27. [27]

    AP_NavEKF3.cpp — ArduPilot source code,

    ArduPilot Development Team, “AP_NavEKF3.cpp — ArduPilot source code,” https://github.com/ArduPilot/ardupilot/blob/master/libraries/AP_ NavEKF3/AP_NavEKF3.cpp, 2025, accessed: 2026-03-30

    2025

  28. [28]

    Mavlink developer guide,

    “Mavlink developer guide,” https://mavlink.io/en/, accessed in oct. 2025

    2025

  29. [29]

    Control-aware attacks against ArduPilot drone sys- tems,

    Feras Benchellal, “Control-aware attacks against ArduPilot drone sys- tems,” https://github.com/CopterRecon/CopterManipulation, 2026, ac- cessed: 2026

    2026

  30. [30]

    Mission planner home,

    Michael Oborne, “Mission planner home,” https://ardupilot.org/planner/ #mission-planner-home, 2026, accessed: 2026

    2026

  31. [31]

    Exception for limited recreational operations of unmanned aircraft,

    D. o. T. D. Federal Aviation Administration (FAA), “Exception for limited recreational operations of unmanned aircraft,” https://www.federalregister.gov/documents/2019/05/17/2019-10169/ exception-for-limited-recreational-operatio\ns-of-unmanned-aircraft# h-7, 2019

    2019

  32. [32]

    DUDE-IDS: A frame- work for efficiently detecting network-related drone cyberattacks,

    B. Tufekci, V . Quach, C. Tunc, and R. Dantu, “DUDE-IDS: A frame- work for efficiently detecting network-related drone cyberattacks,” in Proceedings of the 2024 11th International Conference on Internet of Things: Systems, Management and Security (IOTSMS). IEEE, 2024, pp. 240–247

    2024

  33. [33]

    Intrusion detection for unmanned aerial vehicles security: A tiny machine learning model,

    Y . Wu, L. Yang, L. Zhang, L. Nie, and L. Zheng, “Intrusion detection for unmanned aerial vehicles security: A tiny machine learning model,” IEEE Internet of Things Journal, vol. 11, no. 12, pp. 20 970–20 982, Jun. 2024

    2024

  34. [34]

    Drone- Guard: An explainable and efficient machine learning framework for intrusion detection in drone networks,

    V . U. Ihekoronye, S. O. Ajakwe, J. M. Lee, and D.-S. Kim, “Drone- Guard: An explainable and efficient machine learning framework for intrusion detection in drone networks,”IEEE Internet of Things Journal, pp. 1–1, 2024

    2024