Defense Filters for Robust Learning of Partially Observed Dynamical Systems

The gist: This work proposes a defense-filtering framework to robustly estimate unknown system dynamics from partial observations under adversarial attacks with an attack probability of p < 0.5, establishing provable system identification guarantees in harsh environments where previous methods fail due to diminishing attack assumptions.

Problem Formulation

The paper considers a partially observed discrete-time system represented by the state-space equation (1) where the observation matrix C is known, and an adversarial attack vector wt is injected into the state update at each time step t with probability p < 0.5, where wt is zero when there is no attack. The system designer constructs a defense filter matrix E to restrict adversarial injections to a lower-dimensional subspace, ensuring the full column-rank condition rank(CE) = e. The objective is to recover the Markov parameter matrix G∗, defined by G∗ = [D CB CAB... CAk−2B] (2), which allows for the recovery of system matrices A, B, and D up to a similarity transformation.

Defense Filter Construction and Conditions

The defense filter E is constructed to satisfy specific geometric conditions:

1. Full column-rank condition: Assumption 1 requires rank(CE) = e, which necessitates r ≥ e.

2. Subspace separability condition (Assumption 5): This assumes that Im(CE) ∩ Im([CAE... CAs−1E]) = O, which is a necessary and sufficient condition for the existence of a matrix H satisfying HCE = Ie and H · [CAE... CAs−1E] = 0.

Theoretical Analysis and Main Result

The analysis focuses on the constrained optimization problem (3) for estimating G∗, which is reformulated into a minimization problem (6) involving the estimation error matrix Kˆ = HGˆ ∗−Jˆ. The main result establishes a finite-sample error bound for the Markov parameter matrix G∗. Theorem 1 proves that the estimation error satisfies∥Kˆ∥F = O ρ 1 − p s (1 − p)(∥Hˆ∥2 + ∥H∗∥2)(1 + ∥C‖2M) (1 − 2p)σ.

Relative Error Analysis and Implementation Remarks

The relative estimation error bound is derived as O ρ 1 − p s (1 − p)(1 + 1 sin(θ))(1 + ∥C‖2M) (1 − 2p)σ. This result shows that the estimation error decays exponentially with parameter s whenever ρ 1−p < 1, or equivalently p < 1−ρ. Furthermore, the normalized filter residuals provide a principled metric for attack detection, as unattacked periods yield small filter residuals while attacked periods induce large residual spikes. A lower-bound constraint∥H∥2 ≥ 1 can be enforced in the optimization problem to prevent the estimation error factor from approaching zero, ensuring a stable time bound.

Conclusion

The paper successfully introduces a constrained l2-norm estimator under adversarial attacks with p < 0.5 and establishes rigorous finite-sample error bounds for recovering the Markov parameter matrix G∗. This framework overcomes the limitation of existing approaches that rely on diminishing attack probability as the target estimation error decreases. The analysis also provides a diagnostic signal for separating normal and corrupted data timestamps. Future work includes extending this framework to a two-stage algorithm that filters out attacked data, followed by re-estimating the system dynamics on the clean dataset.

--- Page 1 ---

Defense Filters for Robust Learning of Partially Observed Dynamical Systems⋆ Jihun Kim∗ Javad Lavaei∗ Department of Industrial Engineering and Operations Research, University of California, Berkeley, CA 94720 USA (e-mail: jihun.kim, lavaei@berkeley.edu). Abstract: Robust estimation of unknown system dynamics from partial observations under attack is a core challenge in learning for control, increasingly critical in multi-agent networks subject to adversarial data poisoning. Existing methods either require highly restrictive assumptions on the adversary or yield weak error bounds. In this paper, we consider identifying partially observed linear dynamical systems subject to adversarial attacks with an attack probability p < 0.5 at each time. We propose a defense-filtering framework in which a system designer leverages knowledge of the observation matrix to construct a defense filter satisfying full column rank and subspace separability conditions, which enables the evaluation of a singleattack scenario against observed data. Using this framework, we analyze the constrained l2-norm estimator and establish finite-sample error bounds for recovering the Markov parameter matrix G∗. This is the first approach to provide provable system identification guarantees via a defense filter for partially observed systems subject to harsh attack environments where the attack probability approaches 0.5. Keywords: Defense Filters, Robust System Identification, Partially Observed Systems.

--- Page 2 ---

Consider a partially observed discrete-time system represented as xt+1 = Axt + But + Ewt, yt = Cxt + Dut, t = 0, 1..., (1) where xt ∈ R n is the state, ut ∈ R m is the control input, and yt ∈ R r is the observation output at time t. The observation matrix C ∈ R r×n is assumed to be known. Based on C, the system designer constructs a defense filter matrix E ∈ R n×e where wt ∈ R e represents a dimensionally restricted adversarial attack injected into the state update. At each time step t, an attack time occurs with probability p < 0.5, and wt is identically zero when the system is not under attack. We allow wt to be completely arbitrarily chosen by an adversary at the attack times.

--- Page 3 ---

To construct an estimate of G∗, we solve the constrained optimization problem: min H∈R e×r J∈R e×mk X t∈T Hyt − JU(k)t 2 s.t. HCE = Ie, (3) where T = O(k − 1,..., T + k − 2) and U(k)t = uT t uT t−1... uT t−k+1.

--- Page 4 ---

To establish the input–output relationship, we recall the definition of the Markov parameter matrix: Definition 1. (Markov parameter matrix of order k). From the true system (A, B, C, D), the Markov parameter matrix required to recover the input-output mapping is denoted as G∗ and defined by G∗ = [D CB CAB... CAk−2B] (2) Note that the size of G∗ depends on k; however, we omit the explicit dependence on k in the notation for simplicity. An accurate estimate of the Markov parameter matrix allows for the recovery of the system matrices A, B, and D up to a similarity transformation. In particular, subspace identification techniques such as the Ho-Kalman algorithm (Ho and Kalman (1966)) have been shown to yield accurate k-th order balanced realizations from finite-sample estimates once G∗ is sufficiently accurate.

--- Page 5 ---

The next lemma bounds the tail terms α(s)t and βt. Lemma 1. Suppose that Assumptions 2 and 3 hold. Let the control inputs T +k−2 t=0 be independent with ut ∼ N (0, σ2 Im).

1. Bold System identification under adversarial conditions: The improved system can accurately recover Markov parameter matrices up to a similarity transformation by solving the constrained optimization problem (3) using a defense filter satisfying full column rank and subspace separability conditions.

2. Robustness to non-vanishing attack probability: The framework establishes "rigorous finite-sample error bounds for recovering the Markov parameter matrix G∗, proving that accurate estimation is achievable under adversarial attacks with any p < 0.5, overcoming the limitation of existing methods that rely on a diminishing attack probability as the target estimation error decreases."

3. Adversarial time step detection: The system can provide a principled metric for identifying attacked time steps by evaluating the filter residual, as during attacked periods, large magnitude of adversarial attacks v(s)t induce large residual spikes under clear separation between normal and corrupted data.

4. Relative error-based monitoring: The improved system offers a diagnostic signal through the relative estimation error bound of ∥Kˆ∥F/∥Hˆ∥2, allowing for the detection of anomalies even when absolute scale is not explicitly known.

Robust estimation of unknown system dynamics from partial observations under attack is a core challenge in learning for control, increasingly critical in multi-agent networks subject to adversarial data poisoning. Existing methods either require highly restrictive assumptions on the adversary or yield weak error bounds. In this paper, we consider identifying partially observed linear dynamical systems subject to adversarial attacks with an attack probability p < 0.5 at each time. We propose a defense-filtering framework in which a system designer leverages knowledge of the observation matrix to construct a defense filter satisfying full column rank and subspace separability conditions, which enables the evaluation of a single-attack scenario against observed data. Using this framework, we analyze the constrained 2-norm estimator and establish finite-sample error bounds for recovering the Markov parameter matrix G*. This is the first approach to provide provable system identification guarantees via a defense filter for partially observed systems subject to harsh attack environments where the attack probability approaches 0.5.