Adversarial Reinforcement Learning for Detecting False Data Injection Attacks in Vehicular Routing
Authors: Taha Eghtesad, Yevgeniy Vorobeychik, Aron Laszka
Organizations: Informatics and Intelligent Systems Pennsylvania State University University Park, USA · Computer Science & Engineering Washington University in St. Louis St. Louis, USA
In modern transportation networks, adversaries can manipulate routing algorithms using false data injection attacks, such as simulating heavy traffic with multiple devices running crowdsourced navigation applications, to mislead vehicles toward suboptimal routes and increase congestion. To address these threats, we formulate a strategically zero-sum game between an attacker, who injects such perturbations, and a defender, who detects anomalies based on the observed travel times of network edges. We propose a computational method based on multi-agent reinforcement learning to compute a Nash equilibrium of this game, providing an optimal detection strategy, which ensures that total travel time remains within a worst-case bound, even in the presence of an attack. We present an extensive experimental evaluation that demonstrates the robustness and practical benefits of our approach, providing a powerful framework to improve the resilience of transportation networks against false data injection. In particular, we show that our approach yields approximate equilibrium policies and significantly outperforms baselines for both the attacker and the defender.
Figures & tables
Fig. 1 : Dividing a two-player game environment into two single-agent reinforcement learnings for the PSRO algorithm: one for player p and one for its opponent pˉ , where pˉ plays with MSNE σpˉ∗ and p plays with σp∗ , respectively.
Fig. 2 : Experimental evaluation and comparison of our approach to alternative strategies. First, we compare various baseline attack strategies to our equilibrium solutions ; here, a higher total travel time would indicate a more effective attack ( higher is better ). Second, we compare various defense strategies to our equilibrium solutions ; here, a lower total travel time would indicate a more effective defense ( lower is better ). The results show that our approach outperforms all of the alternatives, inducing higher travel times than other attacks and securing lower travel times than other defenses . The results demonstrate that our approach outperforms the alternatives in both roles; crucially, our equilibrium-based defender is robust against these alternative attacks without prior training on them, which demonstrates the success of our algorithm.
Component
Hyperparameter
Value
Source File
Attack Oracle Hyperparameters
Training
Total Training Timesteps
5,000,000
models/double_oracle/trainer.py
Algorithm
Proximal Policy Optimization (PPO)
models/trainer.py
Learning Rate
0.0003 (default)
stable_baselines3/ppo/ppo.py
PPO Number of Steps (n_steps)
50
models/trainer.py
Batch Size
64 (default)
stable_baselines3/ppo/ppo.py
TABLE I : Hyperparameters of the Attack Oracle, Defense Oracle, and the Double Oracle (DO) Algorithm
Traffic forecasting by graph-based AI is a critical component of intelligent transportation systems, motivating security research on robustness to malicious sensor readings. We argue that prior robustness evaluations are largely shaped by unrealistic threat models and untargeted objectives, so both attacks and defenses must be revisited. We study a practical adversary with limited model knowledge and the ability to monitor and manipulate only a few road sensors. More importantly, practical attacks can be localized to specific links or routes, causing incorrect estimated arrival times or unnecessary rerouting while leaving the broader network largely unaffected. This targeted setting remains underexplored, and defenses such as adversarial training do not transfer well from the norm-bounded attacks they train on to structurally different, physics-aware attacks that mimic genuine congestion. We therefore reframe robustness as a detection problem, introducing a learned physics-informed detector whose output is fed to a hardened forecaster as an input feature and trained against adaptive attacks with the forecaster fixed. We evaluate across a variety of model architectures and benchmarks. The physics-aware attack multiplies target-link error several-fold while the network-wide error barely moves, and adversarial training, tuned to norm-bounded perturbations, barely dents it. Our detection--mitigation defense improves even on adversarial training hardened against the physics-aware attack itself, on 13 of 15 model--dataset settings and by the widest margin on a held-out attack, at near-zero clean cost. The results emphasize the need to examine abstracted AI adversarial attacks under application-specific constraints to assess their true security impacts.
Distributed target tracking in multi-agent networks plays a critical role in cooperative sensing and autonomous navigation. However, it faces significant challenges in highly dynamic and adversarial setups. This study aims to enhance the resilience of decentralized target tracking algorithms against measurement faults and cyber-physical threats, especially false data injection attacks. We propose a consensus-based estimation algorithm that integrates a nearly-constant-velocity model with saturation-based filtering to suppress impulsive measurement variations and promote robust, distributed state estimation. To counteract adversarial conditions, we incorporate a dynamic false data injection detection and isolation mechanism that uses innovation thresholds to identify and disregard suspicious measurements before they can degrade the global estimate. The effectiveness of the proposed algorithms is demonstrated through a series of simulation-based case studies under both benign and adversarial conditions. The results show that increased network connectivity and higher consensus iteration rates improve estimation accuracy and convergence speed, while properly tuned saturation filters achieve a practical balance between fault suppression and accurate estimation. Furthermore, under localized, coordinated, and transient false data injection attacks, the detection mechanism successfully identifies compromised agents and prevents their data from corrupting the distributed global estimate. Overall, this study illustrates that the proposed algorithm provides a simplified fault-tolerant solution that significantly enhances the accuracy and resilience of distributed target tracking without imposing excessive communication or computational burdens.
Amir Ahmad Ghods, Mohammadreza Doostmohammadian
Faculty of Mechanical Engineering, Semnan University, Iran
Increasing connectivity to the outside world and the lack of inbuilt security mechanisms have made legacy intra-vehicular networks vulnerable to cyberattacks. Initial research focused on maximising detection accuracy for known and unknown attacks, often using large, full-precision machine learning models. However, embedding IDSs into vehicular electronic systems also requires low detection latency, energy efficiency and minimal electronic control unit (ECU) resource overhead to process about 2,000 CAN frames/s. Lightweight models must balance accuracy with these deployment constraints. We propose a dual IDS framework comprising supervised and unsupervised learning-based solutions, each optimised for real-time, resource-constrained automotive platforms. A quantised LSTM-based IDS (QLSTM-IDS) achieves over 99.9% detection accuracy for DoS/Flooding, Fuzzing and Spoofing/Malfunction attacks using a single model architecture evaluated on two widely used datasets. The model is trained using the Brevitas quantisation-aware training library, transformed into a dataflow accelerator with custom blocks compatible with AMD's FINN toolchain, and synthesised using Vitis HLS. Complementing this, an 8-bit quantised convolutional autoencoder-based IDS (QCAE-IDS), quantised using AMD's Vitis-AI toolchain, detects previously unseen anomalies that alter CAN-ID sequence patterns with over 99% accuracy. An integration architecture enables both models to operate on a single FPGA, bridging the network interface IP and processing system to minimise software overhead. QLSTM-IDS achieves 0.25 ms inference latency and 0.8 mJ energy consumption per message, while QCAE-IDS achieves 0.42 ms and 1.1 mJ per block. Both solutions are deployed and evaluated on the ZCU104 SoC (XCZU7EV FPGA), demonstrating a flexible hardware/software co-design for real-time detection of known and unknown attacks on high-speed CAN buses.