Industrial robot arms receive sensor data — joint positions, forces, velocities — from encoders and use this data for closed-loop control. A cyberattack that injects false data into the sensor stream can make the manipulator deviate from its intended trajectory. Standard anomaly detection (chi-squared tests on the innovation sequence of a Kalman filter) catches crude attacks but fails against sophisticated adversaries who craft their injections to stay within the detector's statistical bounds.
Gualandi and Papadopoulos (arXiv:2603.13003) propose a two-layer defense. The passive layer is the standard anomaly detector — it monitors sensor data for inconsistencies using a Kalman filter and flags deviations above a threshold. The active layer responds to the anomaly score by attenuating the control inputs: when the anomaly score is elevated (even below the detection threshold), the controller reduces its reliance on potentially corrupted sensor data.
The key innovation is the measurement-free state predictor. Standard controllers use measurements to estimate the current state. The active defense component computes a parallel state prediction that doesn't use any measurements at all — it propagates the state forward using only the known control inputs and the dynamical model. The discrepancy between this measurement-free prediction and the sensor-based estimate is an “actuation-projected” anomaly score that captures attack effects that the chi-squared test misses.
The theoretical guarantee: under no attack, the active defense layer is transparent — it doesn't degrade normal performance because the anomaly score stays low and the attenuation is minimal. Under attack, the attenuation limits the damage by reducing the system's response to corrupted inputs, even when the attack is designed to evade the passive detector.