LogiC-Diff: Embedding Security Properties Into AI-Enabled Cyber-Physical Systems

Ziyan An; John Stankovic; Meiyi Ma

cs.CRSep 29, 2026

LogiC-Diff: Embedding Security Properties Into AI-Enabled Cyber-Physical Systems

Authors: Ziyan An, John Stankovic, Meiyi Ma

Organizations: Department of Computer Science Vanderbilt University Nashville, TN · Department of Computer Science University of Virginia Charlottesville, VA

Abstract

AI-enabled Cyber-Physical Systems (CPS) are highly vulnerable to adversarial and anomalous inputs, where small perturbations can induce cascading errors and unsafe control actions. Existing approaches, such as rule-based filtering, training-time regularization, or diffusion-based reconstruction, either operate outside the model or lack mechanisms to incorporate formal security specifications into the prediction process. In this paper, we take the first step toward embedding security properties directly into AI-enabled CPS, enabling predictive models to enforce system-level constraints during inference rather than relying on external defenses. We introduce a logic-conditioned bi-stage diffusion framework that integrates Signal Temporal Logic (STL) specifications into forecasting. STL serves as a first-class conditioning signal that guides both an input repair stage and an output refinement stage, allowing the model to jointly mitigate adversarial perturbations and enforce desired temporal behaviors to satisfy security-critical properties. We evaluate our approach on two real-world multivariate CPS forecasting datasets under a diverse set of physical sensor and cyber attacks. Across sensor faults, gradient-based attacks, adaptive attacks, and varying attack strengths, our method consistently improves robustness and specification compliance, degrades more gracefully as attack strength increases, and generalizes better to unseen attacks. Ablation studies on specification coverage and quality further show that embedding logical security properties yields gains unattainable by reconstruction-based methods alone, highlighting a new direction for integrating formal methods with generative models in secure CPS.

Figures & tables

Figure 1: Overview of LogiC-Diff. Given a potentially attacked multivariate CPS time-series input, LogiC-Diff first constructs STL-guided signals from CPS security specifications. The framework then performs a repair and a refinement stage on input-side and an output-side, respectively. In both stages, the diffusion estimate is blended with the projection to encourage both data-plausible reconstruction and specification-consistent behavior. The framework is trained end-to-end.

STL-based Guidance Signal Construction Rules for Secure CPS
$\varphi_{1}:=\square_{[t_{1},t_{2}]}\bigl((x^{(j)}_{t}\geq c_{1})\wedge\neg(x^{(j)}_{t}\geq c_{2})\bigr)$	Stability $(x^{(j)},[t_{1},t_{2}])$ enforces physically valid ranges and prevents false high or low values outside feasible limits over time.
$\varphi_{2}:=\square_{[t_{1},t_{2}]}\Bigl(\neg\bigl((x^{(j)}_{t}\geq c_{1})\wedge\neg(x^{(j+1)}_{t}\geq c_{2})\bigr)\Bigr)$	Associativity $(x^{(j)},x^{(j+1)},[t_{1},t_{2}])$ encapsulates the correlational associativity across features over time.
$\varphi_{3}:=\neg(x^{(j)}_{t}\geq c_{1})\,\mathcal{U}_{[t_{1},t_{2}]}\,(x^{(j+1)}_{t}\geq c_{2})$	Propagation $(x^{(j)},x^{(j+1)},[t_{1},t_{2}])$ strengthens upstream and downstream system behavior between two sensor locations or across temporally related events.
$\varphi_{4}:=\square_{[t_{1},t_{2}]}\Bigl(\neg\bigl(\|\bar{x}^{(j)}_{[t-w_{1},t]}-\bar{x}^{(j)}_{[t-w_{1}-w_{2},t-w_{1}]}\|\geq c_{1}\bigr)\Bigr)$	Smoothness $(x^{(j)},[t_{1},t_{2}],w_{1},w_{2})$ bounds the change in mean between adjacent windows of widths $w_{1}$ and $w_{2}$ , detecting persistent changes in feature behavior.
$\varphi_{5}:=\square_{[t_{1},t_{2}]}\Bigl(\neg\bigl((x^{(j)}_{t}\geq c_{1})\wedge\neg\lozenge_{[d_{1},d_{2}]}(x^{(j+1)}_{t}\geq c_{2})\bigr)\Bigr)$	Latency $(x^{(j)},x^{(j+1)},[t_{1},t_{2}],[d_{1},d_{2}])$ enforces that whenever feature $x^{(j)}$ reaches level $c_{1}$ , feature $x^{(j+1)}$ reaches level $c_{2}$ at some time within the future window $[d_{1},d_{2}]$ .
$\varphi_{6}:=\lozenge_{[t_{1},t_{2}]}\,\square_{[0,d]}\bigl((x^{(j)}_{t}\geq c_{1})\wedge\neg(x^{(j)}_{t}\geq c_{2})\bigr)$	Recovery $(x^{(j)},[t_{1},t_{2}],d)$ requires the feature to eventually enter and remain within a safe operational band for a duration of at least $d$ time units.

Table 1: STL-based CPS specifications. Each rule is parameterized by features and a time interval

[t_{1},t_{2}]

and encodes a physically meaningful constraint on feature trajectories.

	Dropout		FDI		Replay		Mixed
Method	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$
Default	$0.469_{\pm.017}$	$77.3_{\pm 3.7}$	$0.197_{\pm.008}$	$84.2_{\pm 2.2}$	$0.538_{\pm.021}$	$80.5_{\pm 2.8}$	$0.283_{\pm.017}$	$84.5_{\pm 2.2}$
Inherent (STL)	$0.470_{\pm.017}$	$77.2_{\pm 3.5}$	$0.207_{\pm.009}$	$84.3_{\pm 2.2}$	$0.551_{\pm.023}$	$79.6_{\pm 2.6}$	$0.295_{\pm.019}$	$84.4_{\pm 2.0}$
AT (Madry)	$0.484_{\pm.015}$	$78.2_{\pm 3.5}$	$0.175_{\pm.007}$	$86.1_{\pm 2.4}$	$0.459_{\pm.018}$	$80.7_{\pm 2.9}$	$0.281_{\pm.016}$	$84.6_{\pm 2.5}$
AT (TRADES)	$0.489_{\pm.016}$	$78.7_{\pm 3.7}$	$0.205_{\pm.008}$	$85.1_{\pm 2.6}$	$0.438_{\pm.016}$	$80.8_{\pm 3.2}$	$0.287_{\pm.013}$	$83.7_{\pm 2.7}$
AP (DiffPure)	$0.473_{\pm.017}$	$77.4_{\pm 3.7}$	$0.186_{\pm.008}$	$84.5_{\pm 2.2}$	$0.525_{\pm.021}$	$80.5_{\pm 2.8}$	$0.276_{\pm.017}$	$84.3_{\pm 2.3}$

Table 2: Robust performance under physical attacks. MSE and STL Sat% reported as

\mathrm{mean}_{\pm 95\%~\mathrm{CI}}

	PGD		MIM		CW		APGD
Method	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$
Default	$0.324_{\pm.011}$	$83.1_{\pm 2.4}$	$0.320_{\pm.011}$	$82.9_{\pm 2.4}$	$0.290_{\pm.012}$	$84.2_{\pm 2.3}$	$0.325_{\pm.011}$	$83.0_{\pm 2.4}$
Inherent (STL)	$0.316_{\pm.012}$	$83.4_{\pm 2.2}$	$0.312_{\pm.012}$	$83.5_{\pm 2.2}$	$0.283_{\pm.013}$	$84.9_{\pm 2.2}$	$0.317_{\pm.012}$	$83.4_{\pm 2.2}$
AT (Madry)	$0.226_{\pm.009}$	$85.3_{\pm 2.5}$	$0.225_{\pm.009}$	$85.3_{\pm 2.6}$	$0.186_{\pm.009}$	$86.6_{\pm 2.4}$	$0.226_{\pm.009}$	$85.3_{\pm 2.5}$
AT (TRADES)	$0.244_{\pm.009}$	$84.4_{\pm 2.7}$	$0.244_{\pm.009}$	$84.4_{\pm 2.7}$	$0.210_{\pm.008}$	$85.1_{\pm 2.6}$	$0.244_{\pm.009}$	$84.4_{\pm 2.7}$
AP (DiffPure)	$0.301_{\pm.011}$	$83.4_{\pm 2.4}$	$0.297_{\pm.011}$	$83.4_{\pm 2.4}$	$0.265_{\pm.012}$	$85.0_{\pm 2.3}$	$0.300_{\pm.011}$	$83.5_{\pm 2.4}$

Table 3: Robust performance under cyber attacks (

\ell_{2}

\varepsilon{=}1.0

). (a) Gradient-based white-box attacks. MSE and STL Sat% are reported as

\mathrm{mean}_{\pm 95\%~\mathrm{CI}}

for the main baselines; projection-based baselines added during the extended evaluation are reported using point estimates. (b) Defense-aware and query-based attacks (MSE): Proj.-PGD, BPDA/EOT, and the gradient-free Square Attack at

273

500

, and

1000

proposal steps (query accounting in App. F ).

	Deterministic		Probabilistic
Method	$\kappa=2$	$\kappa=4$	$\kappa=2$	$\kappa=4$
Default	$0.2542_{\pm.016}$	$0.2755_{\pm.017}$	$0.2523_{\pm.016}$	$0.2757_{\pm.017}$
Inherent (STL)	$0.2561_{\pm.016}$	$0.2745_{\pm.016}$	$0.2537_{\pm.016}$	$0.2748_{\pm.016}$
AT (Madry)	$0.1754_{\pm.012}$	$0.1829_{\pm.012}$	$0.1738_{\pm.012}$	$0.1830_{\pm.012}$
AT (TRADES)	$0.1750_{\pm.011}$	$0.1794_{\pm.011}$	$0.1737_{\pm.011}$	$0.1795_{\pm.011}$
AP (DiffPure)	$0.2355_{\pm.016}$	$0.2491_{\pm.016}$	$0.2341_{\pm.016}$	$0.2516_{\pm.017}$

Table 4: Robustness evaluation following the sparse indirect attack setting of Liu et al. (a) Sparse indirect attacks on our smart-city dataset under deterministic and probabilistic variants. (b) Evaluation on a seven-series subset of the traffic benchmark used by Liu et al. under the probabilistic attack. (a) reports MSE on the target series; (b) reports point-forecast normalized deviation of the target lane. Dataset and metric details are provided in App. E and App. F . Lower is better for both.

Figure 2: LogiC-Diff achieves the lowest median MSE across all attack budgets and types. Left : median per-sample MSE versus attack budget $\varepsilon$ for PGD and Mixed attacks. Right : cumulative distributions of per-sample MSE at four budgets per attack family. Annotations show LogiC-Diff’s median MSE and the percentage reduction relative to the best-performing baseline at each budget. Vertical dashed lines mark per-method medians.

	MIM- $\ell_{2}$		PGD- $\ell_{2}$		Replay		Dropout
Method	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$
AT (Madry)	$0.245_{\pm.009}$	$84.4_{\pm 2.6}$	$0.249_{\pm.009}$	$85.0_{\pm 2.5}$	$0.582_{\pm.021}$	$77.0_{\pm 3.1}$	$0.499_{\pm.019}$	$76.9_{\pm 4.0}$
AT (TRADES)	$0.232_{\pm.009}$	$85.1_{\pm 2.5}$	–	–	$0.646_{\pm.027}$	$78.6_{\pm 2.8}$	$0.550_{\pm.020}$	$76.5_{\pm 3.8}$
LogiC-Diff	$\mathbf{0.213_{\pm.009}}$	$\mathbf{87.3_{\pm 2.3}}$	$\mathbf{0.205_{\pm.009}}$	$\mathbf{86.5_{\pm 2.4}}$	$\mathbf{0.275_{\pm.014}}$	$\mathbf{87.2_{\pm 2.2}}$	$\mathbf{0.276_{\pm.014}}$	$\mathbf{85.4_{\pm 2.9}}$

Table 5: Generalization of robustness. (a) Cross-attack generalization: each method is adversarially trained on the opposite attack within the same category. For cyber attacks, the training budget is

\ell_{\infty}

with

\varepsilon=0.1

; for physical attacks, we use the same budgets as in Tables 2 and 3 . TRADES on MIM-

\ell_{\infty}

is omitted as a non-standard configuration. Best per train scenario in bold . Metrics reported as mean

\pm

95% CI. (b) Cross-domain transfer: robust MSE on the ALFA UAV dataset across physical and cyber attacks; lower is better.

	Dropout		Mixed		PGD		CW
Variant	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$
-Rule (Input)	$0.496_{\pm.020}$	$79.7_{\pm 3.2}$	$0.234_{\pm.011}$	$86.5_{\pm 2.2}$	$0.250_{\pm.010}$	$85.8_{\pm 2.6}$	$0.210_{\pm.010}$	$87.3_{\pm 2.4}$
-Rule (Output)	$0.250_{\pm.010}$	$84.9_{\pm 3.0}$	$0.194_{\pm.008}$	$87.2_{\pm 2.2}$	$0.203_{\pm.008}$	$86.3_{\pm 2.5}$	$0.185_{\pm.008}$	$87.0_{\pm 2.4}$
-Rule Loss $\mathcal{L}_{\mathrm{stl}}$	$0.260_{\pm.010}$	$84.6_{\pm 3.1}$	$0.203_{\pm.008}$	$87.2_{\pm 2.3}$	$0.219_{\pm.008}$	$86.4_{\pm 2.5}$	$0.197_{\pm.008}$	$87.3_{\pm 2.4}$
- Stability	$0.269_{\pm.012}$	$85.1_{\pm 3.0}$	$0.205_{\pm.008}$	$87.7_{\pm 2.2}$	$0.224_{\pm.009}$	$87.1_{\pm 2.3}$	$0.201_{\pm.009}$	$87.8_{\pm 2.2}$
- Associativity	$0.248_{\pm.010}$	$86.0_{\pm 3.1}$	$0.193_{\pm.008}$	$88.0_{\pm 2.3}$	$0.229_{\pm.008}$	$87.2_{\pm 2.6}$	$0.211_{\pm.008}$	$87.7_{\pm 2.5}$

Table 6: Component and logic-rule ablation of LogiC-Diff under Dropout, Mixed, PGD, and CW attacks. Each variant removes one mechanism or rule family from the full pipeline; metrics are reported as mean

\pm

95% CI.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Description
Signals and data
$x\in\mathbb{R}^{m\times d}$	Clean input history window of $d$ -dimensional signals over $m$ timesteps.
$x^{(j)}_{t}$	Value of the $j$ -th feature at time $t$ .
$x^{*}$	Adversarially perturbed (attacked) input sequence, $x^{*}=x+\delta$ .
$\tilde{x}$	Repaired input after input-stage logic-conditioned diffusion.
$x_{n}$	Forward-diffusion latent state at diffusion step $n$ , with $n\in\{0,\dots,N\}$ .

Appendix

Table 7: Notations used in this paper.

Attack and Description	Affected Components	Temporal Pattern	Representative Techniques
Data (Input) Level Attacks
Data Suppression. Suppress or delay genuine events by selectively dropping measurements or interrupting data streams.	Sensors, gateways, edge aggregators, and time synchronization services.	Periodic gaps or bursty outages aligned with critical events.	Selective packet loss, jitter injection, induced clock drift.
Data Replay. Reinject previously valid measurements to misrepresent the current system state.	Sensors and data ingestion pipelines feeding prediction models.	Event-triggered (e.g., congestion or demand spikes).	Timestamp-consistent replay, sliding-window or delayed injection.
False Data Injection. Inject fabricated or biased sensor values to systematically mislead predictions.	Loop detectors, CCTV counts, floating-car data, air-quality sensors, communication links.	Single-shot, periodic, adaptive, or event-driven.	Value biasing, context-aware perturbations constrained to nominal ranges.
GNSS Spoofing. Manipulate physical sensing modalities to distort perceived system state.	GNSS receivers, Bluetooth and Wi-Fi probes, radar or loop-based traffic sensors.	Adaptive, often synchronized with traffic peaks.	RF spoofing, reflective interference, density inflation or deflation.
Model-Level Attacks

Appendix

Table 8: Attack types targeting smart-city and cyber-physical predictive pipelines. We focus on adversarial manipulations of inputs to prediction models and organize attacks by increasing operational complexity.

Explore similar work

Sep 17, 2026eess.SY

Large Language Models as Falsifiers for Cyber-Physical Systems

Falsification searches for counterexamples to formal specifications in cyber-physical systems (CPS). With specifications written in Signal Temporal Logic (STL), falsification can be formulated as a robustness optimization problem, traditionally tackled with black-box search algorithms. In parallel, large language models (LLMs) have recently emerged as surprisingly effective optimizers when coupled with iterative prompting. In this work, we connect these ideas and introduce LLM-Falsifier, an LLM-based approach that falsifies specifications by minimizing the STL robustness degree. Beyond generic prompt-based optimization, our key idea is to expose the LLM to semantic information that is natural for language models but absent from standard numerical optimizers, including natural-language input and output names, output trajectories, and critical-time witnesses for the minimum robustness value. These additions enable smarter and more sample-efficient robustness search. On the ARCH-COMP falsification benchmarks, LLM-Falsifier is shown to outperform existing falsification tools based on a range of optimization paradigms, from surrogate-based and Bayesian optimization to search-based testing, on 14 of 21 specifications when measured by the average number of simulations required to find a counterexample.

Ali ArjomandBigdeli, Jiawei Zhou, Stanley Bak

Stony Brook University, Stony Brook, New York, USA

Cyber-Physical System Invariant Synthesis Falsehood Signal Temporal Logic

Ask PDF

May 28, 2026cs.AI

Provably Secure Agent Guardrail

As large language models transition from bounded generative engines to agents with expansive execution privileges, AI going out of control precipitates a fundamental crisis in artificial intelligence security. Existing defense architectures heavily rely on empirical semantic guardrails and probabilistic large model adjudicators, mechanisms that fail to provide deterministic security lower bounds when facing complex semantic symbol decoupling attacks. To overcome this empirical semantic guardrail dilemma, this paper proposes a new security paradigm for agents based on the fundamental limitations of logical reasoning. Based on this paradigm, we further introduce an executable Proof-Constrained Action (ePCA) framework with a neural symbolic isolation architecture. This framework abandons semantic trust in natural language, forcing agents to losslessly formalize their intentions into first-order logical mathematical constraints before performing physical operations. Empirical evaluations of macroscopic and microscopic two-dimensional dynamic adversarial systems demonstrate that our formal verification mechanism achieves zero attack success rate and zero false positive rate across the evaluated scenarios, with extremely low computational latency. This research provides a conditional formal foundation under explicit system assumptions and an engineering paradigm for constructing the underlying defense foundation for future intelligent systems.

Benlong Wu, Weiming Zhang, Kejiang Chen +2

University of Science and Technology of China

Streaming Guardrails Artificial Intelligence Safety Artificial Intelligence Risk Neuro-Symbolic Framework

Ask PDF

Jul 31, 2026cs.SE

Studying, Identifying, and Fixing Hidden Technical Debt in AI-Intensive Cyber-Physical Systems

Artificial Intelligence (AI) components are increasingly pervasive in several software systems, including Cyber-Physical Systems (CPSs). AI-CPS are used in several domains, including autonomous vehicles, industry, home automation, robotics, and healthcare. Being composed of hardware, AI components, and conventional modules, AI-CPS can exhibit technical debt (TD) that is peculiar and potentially more challenging than that of conventional systems. This thesis aims to characterize AI-CPS TD and propose approaches for its identification and repair. In a first phase, we characterize AI-CPS TD by analyzing AI ecosystems and AI-CPS repositories, as well as interviewing developers. Based on the acquired knowledge, we define approaches to identify and mitigate such TD. Finally, we plan to develop and validate an automated tool that supports agentic AI solutions to monitor, govern, and repay AI-CPS TD.

Beena

University of Sannio Benevento, Italy

Cyber-Physical System Artificial Intelligence Systems

Ask PDF