Federated Learning (FL) has emerged as a promising framework for privacy-preserving distributed learning by enabling model training across multiple agents (clients) without exchanging raw data. However, FL remains vulnerable to inference attacks and faces challenges in scalability, robustness, and efficiency, especially in wireless and decentralized environments. In this paper, we propose a novel distributed multiagent wireless federated learning algorithm with client-level local differential privacy, where agents communicate over wireless channels and aggregate model updates using wireless channel-aware computation. By explicitly modeling the wireless channel and incorporating artificial noise, each agent performs a consensus-based gradient estimation using its own and its neighbors’ updates. We rigorously prove that under a strongly connected topology and suitable learning-rate conditions, convergence is guaranteed. Client-level differential privacy is further ensured via power control at the channel level. Our approach offers a robust and scalable solution for mission-critical applications such as healthcare and autonomous driving in adversarial environments. Comprehensive simulation results validate the theoretical convergence properties, analyze the privacy-utility tradeoff, and empirically validate privacy protection against membership inference attacks. Results confirm that the distributed algorithm achieves performance comparable to centralized federated learning while providing stronger privacy guarantees and improved fault tolerance.

Sensor attacks on Cyber-Physical Systems (CPS) can cause substantial damage in the physical world, which motivates two major threads of defense works including attack detection and attack recovery. The former aims to identify whether any sensors are compromised while the latter seeks to restore a system to safety once an attack is detected. Although either thread has drawn many efforts, how to coordinate the detection and recovery has been barely studied. Overlooking the coordination, existing works may result in ineffective and even failed defense. For example, if a detector raises an alarm too late, there may not be enough time for a system to recover but reach the unsafe region anyway, even though the detection result is accurate. By contrast, raising an alarm earlier allows more time for recovery, but may come with more false positives and thus unnecessarily trigger the recovery. To fill this gap, we aim to co-design attack detection and recovery, and propose a novel recovery-guaranteed sensor attack detection framework. The framework dynamically adjusts the detection sensitivity and authenticates state estimates at run time to guarantee timely and safe recovery once an attack is detected. The detection will always reserve sufficient time for the recovery while minimizing unnecessary activation of recovery. We conduct extensive simulations and real-world testbed experiments to show the efficiency of our solution.

Cyber-physical systems tightly integrate computational resources with physical processes through sensing and actuating, widely penetrating various safety-critical domains, such as autonomous driving, medical monitoring, and industrial control. Unfortunately, they are susceptible to assorted attacks that can result in injuries or physical damage soon after the system is compromised. Consequently, we require mechanisms that swiftly recover their physical states, redirecting a compromised system to desired states to mitigate hazardous situations that can result from attacks. However, existing recovery studies have overlooked stochastic uncertainties that can be unbounded, making a recovery infeasible or invalidating safety and real-time guarantees. This paper presents a novel recovery approach that achieves the highest probability of steering the physical states of systems with stochastic uncertainties to a target set rapidly or within a given time. Further, we prove that our method is sound, complete, fast, and has low computational complexity if the target set can be expressed as a strip. Finally, we demonstrate the practicality of our solution through the implementation in multiple use cases encompassing both linear and nonlinear dynamics, including robotic vehicles, drones, and vehicles in high-fidelity simulators.

Autonomous driving has drawn great interest from both industry and academia. Due to some serious consequences such as loss of life caused by autonomous vehicles, assurance certification has been proposed in the automotive industry to ensure safe self-adaptive behaviors at run-time in autonomous cars. Central to assurance certification are assurance cases that provide compelling, comprehensive, and valid argument structures showing a system is safe in a given environment. However, many existing approaches generate assurance cases as a by-product of a system. In this paper, we will present a novel development paradigm that employs assurance cases to guide an autonomous vehicle to operate correctly and safely at run-time. Specifically, we consider an F1TENTH racing car as an example to illustrate how the assurance case driven paradigm can guide the vehicle to achieve safe and reliable self-adaptive behavior at run-time.

The use of Unmanned Aerial Vehicles (UAVs) for collecting data from remotely located sensor systems is emerging. The data can be time-sensitive and require to be transmitted to a data processing center. However, planning the trajectory for a swarm of UAVs depends on multi-fold constraints, such as data collection requirements, UAV maneuvering capacities, and budget limitations. Since a UAV may fail or be compromised, it is important to provide necessary resilience to such contingencies, thus ensuring data security. It is important to provide the UAVs with efficient spatio-temporal trajectories so that they can efficiently cover necessary data sources. In this work, we present Synth4UAV, a formal approach for automated synthesis of efficient trajectories for a UAV swarm by logically modeling the aerial space and data point topology, UAV moves, and associated constraints in terms of the turning and climbing angle, fuel usage, data collection point coverage, data freshness, and resiliency properties. We use efficient, logical formulas to encode and solve the complex model. The solution to the model provides the routing and maneuvering plan for each UAV, including the time to visit the points on the paths and corresponding fuel usage such that the necessary data points are visited while satisfying the resiliency requirements. We evaluate the proposed trajectory synthesizer, and the results show that the relationship among different parameters follows the requirements while the tool scales well with the problem size.

With ever-increasing attacks against learning-enabled components (LECs) in safety-critical systems, it has become more challenging to ensure robust operations. By focusing on anterior and posterior attacks on LECs, where malicious tasks need to run before and after a victim task, respectively, to launch attacks, we study in this work the victim-aware fixed-priority scheduling in single processor systems. Specifically, by exploiting the preference-oriented fixed-priority (POFP) scheduler, we devise a Victim-Aware Priority Assignment (VAPA) scheme to assign different priorities for victim tasks that are subject to anterior and posterior attacks, respectively. VAPA aims at reducing both anterior and posterior attacking occasions in the resultant schedule and thus enhancing the robust operations of the victim tasks. Online adaptation is also considered by exploiting idle time slots to further remove such attacking occasions whenever possible. The main ideas of the victim-aware scheduling are illustrated via a concrete example and future work is discussed.

A smart grid is a widely distributed engineering system with overhead transmission lines. Physical damage to these power lines, from natural calamities or technical failures, will disrupt the functional integrity of the grid. To ensure the continuation of the grid's operational flow when those phenomena happen, the grid operator must immediately take steps to nullify the impacts and repair the problems, even if those occur in hardly-reachable remote areas. Emerging unmanned aerial vehicles (UAV s) show great potential to replace traditional human patrols for regularly monitoring critical situations involving the safety of the grid. The critical lines can be monitored by a fleet of UAV s, ensuring resilient surveillance. The proposed approach considers the n-1 contingency analysis to find the criticality of a transmission line. We propose a formal framework that verifies whether a given set of UAV s can perform continuous surveillance of the grid satisfying various requirements, particularly the monitoring and resiliency specifications. The verification process ultimately provides a trajectory plan for the UAV s, including the refueling schedules. The resiliency requirement of inspecting a point on a line is expressed in terms of a k - property specifying that if k UAV s fail or are compromised, there is still a UAV to collect the data on time. We evaluate the proposed framework on synthetic data based on various IEEE test bus systems.

Embedded systems use increasingly complex software and are evolving into cyber-physical systems (CPS) with sophisticated interaction and coupling between physical and computational processes. Many CPS operate in safety-critical environments and have stringent certification, reliability, and correctness requirements. These systems undergo changes throughout their lifetimes, where either the software or physical hardware is updated in subsequent design iterations. One source of failure in safety-critical CPS is when there are unstated assumptions in either the physical or cyber parts of the system, and new components do not match those assumptions. In this work, we present an automated method toward identifying unstated assumptions in CPS. Dynamic specifications in the form of candidate invariants of both the software and physical components are identified using dynamic analysis (executing and/or simulating the system implementation or model thereof). A prototype tool called Hynger (for HYbrid iNvariant GEneratoR) was developed that instruments Simulink/Stateflow (SLSF) model diagrams to generate traces in the input format compatible with the Daikon invariant inference tool, which has been extensively applied to software systems. Hynger, in conjunction with Daikon, is able to detect candidate invariants of several CPS case studies. We use the running example of a DC-to-DC power converter and demonstrate that Hynger can detect a specification mismatch where a tolerance assumed by the software is violated due to a plant change. Another case study of an automotive control system is also introduced to illustrate the power of Hynger and Daikon in automatically identifying cyber-physical specification mismatches.

In this paper, we present two new problems and a theoretical framework that can be used to route information in heterogeneous communication networks. These problems are the cardinality-constrained and interval-constrained paths problems and they consist of finding paths in a network such that cardinality constraints on the number of nodes belonging to different sets of labels are satisfied. We propose a novel algorithm for finding said paths and demonstrate the effectiveness of our approach on networks of various sizes.