Controller confidentiality for nonlinear systems under sensor attacks

Controller confidentiality under sensor attacks refers to whether the internal states of the controller can be estimated when the adversary knows the model of the plant and controller, while only having access to sensors, but not the actuators. We show that the controller's state can be estimated accurately when the nonlinear closed-loop system is detectable. In the absence of detectability, controller confidentiality can still be breached with a periodic probing scheme via the sensors under a robust observability assumption, which allows for the controller's state to be estimated with arbitrary accuracy during the probing period, and with bounded error during the non-probing period. Further, stealth can be maintained by choosing an appropriate probing duration. This study shows that the controller confidentiality for nonlinear systems can be breached by balancing the estimation precision and the stealthiness of the adversary.