Confidentiality of Linear Control Systems with Quadratic Output Under Sensor Attacks [Extended Version]

We study the state estimation problem for linear control systems with quadratic outputs which are locally unobservable at the equilibrium. We show that, despite this inherent lack of observability, an adversary with sensor read and write capability can induce observability by injecting an appropriate signal into the measurement channel. Taking the role of an adversary, we characterize when an injected signal can or cannot induce observability and, in the successful case, construct an observer that achieves local exponential convergence of state estimates to the true states of the system. A simulation study demonstrates our results.