LogiC-Diff: Embedding Security Properties Into AI-Enabled Cyber-Physical Systems

Ziyan An; John Stankovic; Meiyi Ma

cs.CRSep 29, 2026

LogiC-Diff: Embedding Security Properties Into AI-Enabled Cyber-Physical Systems

Authors: Ziyan An, John Stankovic, Meiyi Ma

Organizations: Department of Computer Science Vanderbilt University Nashville, TN · Department of Computer Science University of Virginia Charlottesville, VA

Abstract

AI-enabled Cyber-Physical Systems (CPS) are highly vulnerable to adversarial and anomalous inputs, where small perturbations can induce cascading errors and unsafe control actions. Existing approaches, such as rule-based filtering, training-time regularization, or diffusion-based reconstruction, either operate outside the model or lack mechanisms to incorporate formal security specifications into the prediction process. In this paper, we take the first step toward embedding security properties directly into AI-enabled CPS, enabling predictive models to enforce system-level constraints during inference rather than relying on external defenses. We introduce a logic-conditioned bi-stage diffusion framework that integrates Signal Temporal Logic (STL) specifications into forecasting. STL serves as a first-class conditioning signal that guides both an input repair stage and an output refinement stage, allowing the model to jointly mitigate adversarial perturbations and enforce desired temporal behaviors to satisfy security-critical properties. We evaluate our approach on two real-world multivariate CPS forecasting datasets under a diverse set of physical sensor and cyber attacks. Across sensor faults, gradient-based attacks, adaptive attacks, and varying attack strengths, our method consistently improves robustness and specification compliance, degrades more gracefully as attack strength increases, and generalizes better to unseen attacks. Ablation studies on specification coverage and quality further show that embedding logical security properties yields gains unattainable by reconstruction-based methods alone, highlighting a new direction for integrating formal methods with generative models in secure CPS.

Figures & tables

Figure 1: Overview of LogiC-Diff. Given a potentially attacked multivariate CPS time-series input, LogiC-Diff first constructs STL-guided signals from CPS security specifications. The framework then performs a repair and a refinement stage on input-side and an output-side, respectively. In both stages, the diffusion estimate is blended with the projection to encourage both data-plausible reconstruction and specification-consistent behavior. The framework is trained end-to-end.

STL-based Guidance Signal Construction Rules for Secure CPS
$\varphi_{1}:=\square_{[t_{1},t_{2}]}\bigl((x^{(j)}_{t}\geq c_{1})\wedge\neg(x^{(j)}_{t}\geq c_{2})\bigr)$	Stability $(x^{(j)},[t_{1},t_{2}])$ enforces physically valid ranges and prevents false high or low values outside feasible limits over time.
$\varphi_{2}:=\square_{[t_{1},t_{2}]}\Bigl(\neg\bigl((x^{(j)}_{t}\geq c_{1})\wedge\neg(x^{(j+1)}_{t}\geq c_{2})\bigr)\Bigr)$	Associativity $(x^{(j)},x^{(j+1)},[t_{1},t_{2}])$ encapsulates the correlational associativity across features over time.
$\varphi_{3}:=\neg(x^{(j)}_{t}\geq c_{1})\,\mathcal{U}_{[t_{1},t_{2}]}\,(x^{(j+1)}_{t}\geq c_{2})$	Propagation $(x^{(j)},x^{(j+1)},[t_{1},t_{2}])$ strengthens upstream and downstream system behavior between two sensor locations or across temporally related events.
$\varphi_{4}:=\square_{[t_{1},t_{2}]}\Bigl(\neg\bigl(\|\bar{x}^{(j)}_{[t-w_{1},t]}-\bar{x}^{(j)}_{[t-w_{1}-w_{2},t-w_{1}]}\|\geq c_{1}\bigr)\Bigr)$	Smoothness $(x^{(j)},[t_{1},t_{2}],w_{1},w_{2})$ bounds the change in mean between adjacent windows of widths $w_{1}$ and $w_{2}$ , detecting persistent changes in feature behavior.
$\varphi_{5}:=\square_{[t_{1},t_{2}]}\Bigl(\neg\bigl((x^{(j)}_{t}\geq c_{1})\wedge\neg\lozenge_{[d_{1},d_{2}]}(x^{(j+1)}_{t}\geq c_{2})\bigr)\Bigr)$	Latency $(x^{(j)},x^{(j+1)},[t_{1},t_{2}],[d_{1},d_{2}])$ enforces that whenever feature $x^{(j)}$ reaches level $c_{1}$ , feature $x^{(j+1)}$ reaches level $c_{2}$ at some time within the future window $[d_{1},d_{2}]$ .
$\varphi_{6}:=\lozenge_{[t_{1},t_{2}]}\,\square_{[0,d]}\bigl((x^{(j)}_{t}\geq c_{1})\wedge\neg(x^{(j)}_{t}\geq c_{2})\bigr)$	Recovery $(x^{(j)},[t_{1},t_{2}],d)$ requires the feature to eventually enter and remain within a safe operational band for a duration of at least $d$ time units.

Table 1: STL-based CPS specifications. Each rule is parameterized by features and a time interval

[t_{1},t_{2}]

and encodes a physically meaningful constraint on feature trajectories.

	Dropout		FDI		Replay		Mixed
Method	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$
Default	$0.469_{\pm.017}$	$77.3_{\pm 3.7}$	$0.197_{\pm.008}$	$84.2_{\pm 2.2}$	$0.538_{\pm.021}$	$80.5_{\pm 2.8}$	$0.283_{\pm.017}$	$84.5_{\pm 2.2}$
Inherent (STL)	$0.470_{\pm.017}$	$77.2_{\pm 3.5}$	$0.207_{\pm.009}$	$84.3_{\pm 2.2}$	$0.551_{\pm.023}$	$79.6_{\pm 2.6}$	$0.295_{\pm.019}$	$84.4_{\pm 2.0}$
AT (Madry)	$0.484_{\pm.015}$	$78.2_{\pm 3.5}$	$0.175_{\pm.007}$	$86.1_{\pm 2.4}$	$0.459_{\pm.018}$	$80.7_{\pm 2.9}$	$0.281_{\pm.016}$	$84.6_{\pm 2.5}$
AT (TRADES)	$0.489_{\pm.016}$	$78.7_{\pm 3.7}$	$0.205_{\pm.008}$	$85.1_{\pm 2.6}$	$0.438_{\pm.016}$	$80.8_{\pm 3.2}$	$0.287_{\pm.013}$	$83.7_{\pm 2.7}$
AP (DiffPure)	$0.473_{\pm.017}$	$77.4_{\pm 3.7}$	$0.186_{\pm.008}$	$84.5_{\pm 2.2}$	$0.525_{\pm.021}$	$80.5_{\pm 2.8}$	$0.276_{\pm.017}$	$84.3_{\pm 2.3}$

Table 2: Robust performance under physical attacks. MSE and STL Sat% reported as

\mathrm{mean}_{\pm 95\%~\mathrm{CI}}

	PGD		MIM		CW		APGD
Method	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$
Default	$0.324_{\pm.011}$	$83.1_{\pm 2.4}$	$0.320_{\pm.011}$	$82.9_{\pm 2.4}$	$0.290_{\pm.012}$	$84.2_{\pm 2.3}$	$0.325_{\pm.011}$	$83.0_{\pm 2.4}$
Inherent (STL)	$0.316_{\pm.012}$	$83.4_{\pm 2.2}$	$0.312_{\pm.012}$	$83.5_{\pm 2.2}$	$0.283_{\pm.013}$	$84.9_{\pm 2.2}$	$0.317_{\pm.012}$	$83.4_{\pm 2.2}$
AT (Madry)	$0.226_{\pm.009}$	$85.3_{\pm 2.5}$	$0.225_{\pm.009}$	$85.3_{\pm 2.6}$	$0.186_{\pm.009}$	$86.6_{\pm 2.4}$	$0.226_{\pm.009}$	$85.3_{\pm 2.5}$
AT (TRADES)	$0.244_{\pm.009}$	$84.4_{\pm 2.7}$	$0.244_{\pm.009}$	$84.4_{\pm 2.7}$	$0.210_{\pm.008}$	$85.1_{\pm 2.6}$	$0.244_{\pm.009}$	$84.4_{\pm 2.7}$
AP (DiffPure)	$0.301_{\pm.011}$	$83.4_{\pm 2.4}$	$0.297_{\pm.011}$	$83.4_{\pm 2.4}$	$0.265_{\pm.012}$	$85.0_{\pm 2.3}$	$0.300_{\pm.011}$	$83.5_{\pm 2.4}$

Table 3: Robust performance under cyber attacks (

\ell_{2}

\varepsilon{=}1.0

). (a) Gradient-based white-box attacks. MSE and STL Sat% are reported as

\mathrm{mean}_{\pm 95\%~\mathrm{CI}}

for the main baselines; projection-based baselines added during the extended evaluation are reported using point estimates. (b) Defense-aware and query-based attacks (MSE): Proj.-PGD, BPDA/EOT, and the gradient-free Square Attack at

273

500

, and

1000

proposal steps (query accounting in App. F ).

	Deterministic		Probabilistic
Method	$\kappa=2$	$\kappa=4$	$\kappa=2$	$\kappa=4$
Default	$0.2542_{\pm.016}$	$0.2755_{\pm.017}$	$0.2523_{\pm.016}$	$0.2757_{\pm.017}$
Inherent (STL)	$0.2561_{\pm.016}$	$0.2745_{\pm.016}$	$0.2537_{\pm.016}$	$0.2748_{\pm.016}$
AT (Madry)	$0.1754_{\pm.012}$	$0.1829_{\pm.012}$	$0.1738_{\pm.012}$	$0.1830_{\pm.012}$
AT (TRADES)	$0.1750_{\pm.011}$	$0.1794_{\pm.011}$	$0.1737_{\pm.011}$	$0.1795_{\pm.011}$
AP (DiffPure)	$0.2355_{\pm.016}$	$0.2491_{\pm.016}$	$0.2341_{\pm.016}$	$0.2516_{\pm.017}$

Table 4: Robustness evaluation following the sparse indirect attack setting of Liu et al. (a) Sparse indirect attacks on our smart-city dataset under deterministic and probabilistic variants. (b) Evaluation on a seven-series subset of the traffic benchmark used by Liu et al. under the probabilistic attack. (a) reports MSE on the target series; (b) reports point-forecast normalized deviation of the target lane. Dataset and metric details are provided in App. E and App. F . Lower is better for both.

Figure 2: LogiC-Diff achieves the lowest median MSE across all attack budgets and types. Left : median per-sample MSE versus attack budget $\varepsilon$ for PGD and Mixed attacks. Right : cumulative distributions of per-sample MSE at four budgets per attack family. Annotations show LogiC-Diff’s median MSE and the percentage reduction relative to the best-performing baseline at each budget. Vertical dashed lines mark per-method medians.

	MIM- $\ell_{2}$		PGD- $\ell_{2}$		Replay		Dropout
Method	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$
AT (Madry)	$0.245_{\pm.009}$	$84.4_{\pm 2.6}$	$0.249_{\pm.009}$	$85.0_{\pm 2.5}$	$0.582_{\pm.021}$	$77.0_{\pm 3.1}$	$0.499_{\pm.019}$	$76.9_{\pm 4.0}$
AT (TRADES)	$0.232_{\pm.009}$	$85.1_{\pm 2.5}$	–	–	$0.646_{\pm.027}$	$78.6_{\pm 2.8}$	$0.550_{\pm.020}$	$76.5_{\pm 3.8}$
LogiC-Diff	$\mathbf{0.213_{\pm.009}}$	$\mathbf{87.3_{\pm 2.3}}$	$\mathbf{0.205_{\pm.009}}$	$\mathbf{86.5_{\pm 2.4}}$	$\mathbf{0.275_{\pm.014}}$	$\mathbf{87.2_{\pm 2.2}}$	$\mathbf{0.276_{\pm.014}}$	$\mathbf{85.4_{\pm 2.9}}$

Table 5: Generalization of robustness. (a) Cross-attack generalization: each method is adversarially trained on the opposite attack within the same category. For cyber attacks, the training budget is

\ell_{\infty}

with

\varepsilon=0.1

; for physical attacks, we use the same budgets as in Tables 2 and 3 . TRADES on MIM-

\ell_{\infty}

is omitted as a non-standard configuration. Best per train scenario in bold . Metrics reported as mean

\pm

95% CI. (b) Cross-domain transfer: robust MSE on the ALFA UAV dataset across physical and cyber attacks; lower is better.

	Dropout		Mixed		PGD		CW
Variant	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$	MSE $\downarrow$	Sat% $\uparrow$
-Rule (Input)	$0.496_{\pm.020}$	$79.7_{\pm 3.2}$	$0.234_{\pm.011}$	$86.5_{\pm 2.2}$	$0.250_{\pm.010}$	$85.8_{\pm 2.6}$	$0.210_{\pm.010}$	$87.3_{\pm 2.4}$
-Rule (Output)	$0.250_{\pm.010}$	$84.9_{\pm 3.0}$	$0.194_{\pm.008}$	$87.2_{\pm 2.2}$	$0.203_{\pm.008}$	$86.3_{\pm 2.5}$	$0.185_{\pm.008}$	$87.0_{\pm 2.4}$
-Rule Loss $\mathcal{L}_{\mathrm{stl}}$	$0.260_{\pm.010}$	$84.6_{\pm 3.1}$	$0.203_{\pm.008}$	$87.2_{\pm 2.3}$	$0.219_{\pm.008}$	$86.4_{\pm 2.5}$	$0.197_{\pm.008}$	$87.3_{\pm 2.4}$
- Stability	$0.269_{\pm.012}$	$85.1_{\pm 3.0}$	$0.205_{\pm.008}$	$87.7_{\pm 2.2}$	$0.224_{\pm.009}$	$87.1_{\pm 2.3}$	$0.201_{\pm.009}$	$87.8_{\pm 2.2}$
- Associativity	$0.248_{\pm.010}$	$86.0_{\pm 3.1}$	$0.193_{\pm.008}$	$88.0_{\pm 2.3}$	$0.229_{\pm.008}$	$87.2_{\pm 2.6}$	$0.211_{\pm.008}$	$87.7_{\pm 2.5}$

Table 6: Component and logic-rule ablation of LogiC-Diff under Dropout, Mixed, PGD, and CW attacks. Each variant removes one mechanism or rule family from the full pipeline; metrics are reported as mean

\pm

95% CI.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Description
Signals and data
$x\in\mathbb{R}^{m\times d}$	Clean input history window of $d$ -dimensional signals over $m$ timesteps.
$x^{(j)}_{t}$	Value of the $j$ -th feature at time $t$ .
$x^{*}$	Adversarially perturbed (attacked) input sequence, $x^{*}=x+\delta$ .
$\tilde{x}$	Repaired input after input-stage logic-conditioned diffusion.
$x_{n}$	Forward-diffusion latent state at diffusion step $n$ , with $n\in\{0,\dots,N\}$ .

Appendix

Table 7: Notations used in this paper.

Attack and Description	Affected Components	Temporal Pattern	Representative Techniques
Data (Input) Level Attacks
Data Suppression. Suppress or delay genuine events by selectively dropping measurements or interrupting data streams.	Sensors, gateways, edge aggregators, and time synchronization services.	Periodic gaps or bursty outages aligned with critical events.	Selective packet loss, jitter injection, induced clock drift.
Data Replay. Reinject previously valid measurements to misrepresent the current system state.	Sensors and data ingestion pipelines feeding prediction models.	Event-triggered (e.g., congestion or demand spikes).	Timestamp-consistent replay, sliding-window or delayed injection.
False Data Injection. Inject fabricated or biased sensor values to systematically mislead predictions.	Loop detectors, CCTV counts, floating-car data, air-quality sensors, communication links.	Single-shot, periodic, adaptive, or event-driven.	Value biasing, context-aware perturbations constrained to nominal ranges.
GNSS Spoofing. Manipulate physical sensing modalities to distort perceived system state.	GNSS receivers, Bluetooth and Wi-Fi probes, radar or loop-based traffic sensors.	Adaptive, often synchronized with traffic peaks.	RF spoofing, reflective interference, density inflation or deflation.
Model-Level Attacks

Appendix

Table 8: Attack types targeting smart-city and cyber-physical predictive pipelines. We focus on adversarial manipulations of inputs to prediction models and organize attacks by increasing operational complexity.

Explore similar work

Large Language Models as Falsifiers for Cyber-Physical Systems
Sep 17, 2026Ali ArjomandBigdeli, Jiawei Zhou, Stanley BakCyber-Physical System Invariant Synthesis
Stony Brook University, Stony Brook, New York, USA
Provably Secure Agent Guardrail
May 28, 2026Benlong Wu, Weiming Zhang, Kejiang Chen +2Streaming Guardrails Artificial Intelligence Safety
University of Science and Technology of China
Studying, Identifying, and Fixing Hidden Technical Debt in AI-Intensive Cyber-Physical Systems
Jul 31, 2026BeenaCyber-Physical System Artificial Intelligence Systems
University of Sannio Benevento, Italy

Sep 17, 2026, eess.SYJ/K move · Enter open · S save

Large Language Models as Falsifiers for Cyber-Physical Systems

Ali ArjomandBigdeli, Jiawei Zhou, Stanley Bak

Stony Brook University, Stony Brook, New York, USA

Cyber-Physical System Invariant Synthesis Falsehood Signal Temporal Logic

Open paper AskPDF arXiv

Falsification searches for counterexamples to formal specifications in cyber-physical systems (CPS). With specifications written in Signal Temporal Logic (STL), falsification can be formulated as a robustness optimization problem, traditionally tackled with black-box search algorithms. In parallel, large language models (LLMs) have recently emerged as surprisingly effective optimizers when coupled with iterative prompting. In this work, we connect these ideas and introduce LLM-Falsifier, an LLM-based approach that falsifies specifications by minimizing the STL robustness degree. Beyond generic prompt-based optimization, our key idea is to expose the LLM to semantic information that is natural for language models but absent from standard numerical optimizers, including natural-language input and output names, output trajectories, and critical-time witnesses for the minimum robustness value. These additions enable smarter and more sample-efficient robustness search. On the ARCH-COMP falsification benchmarks, LLM-Falsifier is shown to outperform existing falsification tools based on a range of optimization paradigms, from surrogate-based and Bayesian optimization to search-based testing, on 14 of 21 specifications when measured by the average number of simulations required to find a counterexample.

Abstract

Explore similar work

Large Language Models as Falsifiers for Cyber-Physical Systems

Provably Secure Agent Guardrail

Studying, Identifying, and Fixing Hidden Technical Debt in AI-Intensive Cyber-Physical Systems