Inverting Self-Triggered Control: Adversarial Reinforcement Learning for Sparse Denial-of-Service Attacks

What is a self-triggered DoS attack?

It is a jamming attacker that, like a self-triggered controller, decides at each of its own decision instants how long to keep jamming next (here chosen from a discrete grid of durations) instead of following a fixed periodic schedule. Under the paper's hold-last MAC model, a jam makes the actuator keep applying the previously delivered control input while the channel is blocked.

How much better is the learned attacker than simple jamming baselines?

Across Pendulum, CartPole, and Quadrotor2D it crashes all 12 defender-plant combinations at a 100% rate, while a greedy predicate-based attacker misses up to 42% of episodes (Quadrotor2D vs LQR) and a periodic burst jammer misses up to 97% (Pendulum vs LQR). On jam time needed per successful crash it is up to 2.8x more efficient, with the biggest margin on Quadrotor2D.

Does the paper's theory match its experiments?

Only in direction. Theorem 1 predicts minimum jam counts of 9, 3 and 5 ticks for the three plants, but the measured thresholds for one contiguous jam block reaching a 95% crash rate are 30, 30 and more than 80 ticks (the Quadrotor2D scan was stopped at 91%). The authors attribute this to the bound being a certified worst case on a linearized model versus a typical-case measurement on the nonlinear plant.

Is the attack robust to imperfect sensing?

On Quadrotor2D against the wc=14 defender, yes in the tested range: Gaussian observation noise up to sigma=0.2 - larger than the state components' magnitudes at reset - and removing all velocity information (position-only observation) both keep the 100% failure rate and keep the learned attacker ahead of both baselines on jam time per failure. Other plants and defenders were not ablated this way.