Resilient and efficient safeguard mechanism design for deploying untrusted linear controllers

Abstract

Deployment of untrusted controllers is challenging. Such an untrusted controller may be provided by a malicious third party, who claims to deliver optimal control performance but actually attempts to exploit the system. Alternatively, untrusted controllers arising from benign factors such as inaccurate modeling or human error may also destabilize the system and cause security breaches. The system operator, with limited access to the knowledge of the system, may not be able to verify the untrusted controllers offline. To mitigate this risk, we propose a “plug-and-play” modification to the untrusted controller with minimal requirement on system knowledge, which switches to a known stabilizing controller when the norm of the difference between the untrusted and fallback control inputs exceeds a certain threshold. We show that for linear stochastic systems, this safeguard mechanism is both resilient and efficient, in the sense that: 1) the linear–quadratic cost of the system is always bounded even if the original untrusted controller is destabilizing; 2) in case the untrusted controller is stabilizing, the performance loss caused by the safeguard converges super-exponentially to 0 for Gaussian noise, while converging polynomially for general heavy-tailed noise. Finally, we demonstrate the effectiveness of the proposed safeguard strategy via numerical simulation on the Tennessee Eastman Process.