Active Defense Against False Data Injection Attacks in Robotic Manipulators

Adversarial attacks on motion planning are crucial for evaluating and quantifying the intrinsic robustness of robotic manipulation. However, existing approaches are typically limited by restrictive exact-pose objectives and their reliance on planner-in-the-loop queries. To address these limitations, we propose a planner-agnostic attack framework for tolerance-aware manipulation. Our approach shifts the evaluation paradigm to task-level feasibility over goal regions, efficiently inserting adversarial obstacles without requiring oracle access to the victim system. Offline, we characterize the robot's intrinsic workspace capabilities via a kinematic occupancy heatmap, which encodes the density of feasible trajectories and robustness priors without invoking a specific planner. Online, we formulate the attack as a budgeted maximum-coverage optimization, strategically deploying obstacles subject to explicit geometric constraints to occlude the solution space. Extensive experiments across simulation and real-world scenarios demonstrate that our method reliably induces planning failures, significantly outperforming planner-in-the-loop baselines in both computational efficiency and attack efficacy.

A false data injection attack (FDIA) can change the estimated grid state while evading a residual-based bad data detector (BDD). Existing blind attacks learn a low-rank measurement subspace, but this algebraic view does not state the physical grid constraints that make an attack stealthy or the minimum information needed to recover the complete attack space. Under the connected direct-current (DC) branch-flow model, we show that the residual-sensitive subspace of the noiseless orthogonal test is exactly the weighted cycle space. Its orthogonal complement is therefore the complete stealthy attack space, making weighted cycle-space knowledge both necessary and sufficient for complete blind FDIA. This space identifies the topology only up to 2-isomorphism and the relative cycle-edge parameters only up to one scale per biconnected component; bridge parameters are neither identified nor required. We then formulate a computationally unconstrained benchmark and a tractable measurement-only reconstruction method. Experiments on IEEE systems compare BDD bypass rate at a 95% nominal-acceptance threshold against state impact. As a compact alternating-current (AC) extension, we characterize feasible branch P/Q measurements by a cycle manifold and demonstrate topology-assisted manifold fitting and measurement generation on a graphics processing unit (GPU). In the lossless fixed-voltage small-angle limit, the normal space of the active-power slice reduces to the DC weighted cycle space.

False data injection attacks (FDIAs) introducing small measurement perturbations can still cause large deviations in power system state estimation when the injected signals align with the pseudo-null space of the system model. Existing model- and data-driven detectors may fail to identify such low-magnitude but high-impact attacks because residual tests ignore changes hidden in the pseudo-null space, while subspace learning methods capture correlation patterns without enforcing physical consistency. This paper proposes Physically Consistent Null Space Alignment (PCNSA), a framework that detects stealthy FDIAs by preserving, through preprocessing, the geometric correspondence between the physical null space and the measurement-derived pseudo-null space. The key point is a Pseudo-null Space Conserved data Preprocessing (PSCP) step that re-expresses measurements in the physical coordinate frame before subspace extraction. We prove that PSCP preserves the separation between row space and its orthogonal complement, a property that conventional per-feature standardization violates. This keeps the singular value decomposition (SVD)-derived pseudo-null subspace aligned with the physical residual space without explicit knowledge of H. Experiments on IEEE 14-, 30-, 57-, and 118-bus systems confirm this principle in practice: stealthy attacks that evade XTM, LSTM, AE and Isolation Forest baselines appear as clear deviations in the aligned subspace, yielding higher F1-score and detection accuracy while remaining robust under partial observability and realistic PMU noise.