Inverting Self-Triggered Control: Adversarial Reinforcement Learning for Sparse Denial-of-Service Attacks

arXiv cs.LG Papers
adversarial-learning reinforcement-learning self-triggered-control dos-attacks control-theory rl-security

Summary

This paper introduces an adversarial reinforcement learning agent that learns to disrupt self-triggered controllers with sparse Denial-of-Service attacks, outperforming baselines on control systems like Pendulum and Quadrotor2D.

arXiv:2609.12016v1 Announce Type: new Abstract: Self-triggered reinforcement learning control (RL-STC) learns the sparsest control schedule that preserves Lyapunov-decreasing stability under a Run-Time Assurance (RTA) override. We invert this: an adversarial RL agent learns the sparsest jamming or Denial-of-Service (DoS) schedule that destabilizes the closed loop, with a Lyapunov-increase admissibility predicate mirroring the defender's safety certificate. We prove a plant-property lower bound on the minimum jam count required for an immediate hold-last medium-access-control adversary to force a crash against a self-triggered controller (STC) satisfying a Lyapunov contract, and recover a certificate-level analog of the consecutive-grouping optimality of prior count-budget DoS scheduling as a corollary. This extends the DoS-scheduling count-budget analysis from periodic and linear-time-invariant to STC controllers. Empirically, we train against four fixed defenders per plant (one Linear Quadratic Regulator (LQR) and three RL-STC) on Pendulum, CartPole, and Quadrotor2D. The learned adversary is the only adversary that crashes every defender on every plant at $100\%$: greedy misses Quadrotor2D LQR on $42\%$ of episodes and periodic misses Pendulum LQR on $97\%$. On jam-time-per-failure it beats baselines by up to $2.8\times$, and shows its widest absolute margin on Quadrotor2D LQR. Robustness ablations show that Gaussian observation noise exceeding the initial-state magnitude and position-only observation both preserve $100\%$ failure rate and keep the learned adversary strictly ahead of both baselines on jam-time-per-failure.
Original Article
View Cached Full Text

Cached at: 09/14/26, 08:33 AM 

# Inverting Self-Triggered Control: Adversarial Reinforcement Learning for Sparse Denial-of-Service Attacks
Source: [https://arxiv.org/abs/2609.12016](https://arxiv.org/abs/2609.12016)
[View PDF](https://arxiv.org/pdf/2609.12016)

> Abstract:Self\-triggered reinforcement learning control \(RL\-STC\) learns the sparsest control schedule that preserves Lyapunov\-decreasing stability under a Run\-Time Assurance \(RTA\) override\. We invert this: an adversarial RL agent learns the sparsest jamming or Denial\-of\-Service \(DoS\) schedule that destabilizes the closed loop, with a Lyapunov\-increase admissibility predicate mirroring the defender's safety certificate\. We prove a plant\-property lower bound on the minimum jam count required for an immediate hold\-last medium\-access\-control adversary to force a crash against a self\-triggered controller \(STC\) satisfying a Lyapunov contract, and recover a certificate\-level analog of the consecutive\-grouping optimality of prior count\-budget DoS scheduling as a corollary\. This extends the DoS\-scheduling count\-budget analysis from periodic and linear\-time\-invariant to STC controllers\. Empirically, we train against four fixed defenders per plant \(one Linear Quadratic Regulator \(LQR\) and three RL\-STC\) on Pendulum, CartPole, and Quadrotor2D\. The learned adversary is the only adversary that crashes every defender on every plant at $100\\%$: greedy misses Quadrotor2D LQR on $42\\%$ of episodes and periodic misses Pendulum LQR on $97\\%$\. On jam\-time\-per\-failure it beats baselines by up to $2\.8\\times$, and shows its widest absolute margin on Quadrotor2D LQR\. Robustness ablations show that Gaussian observation noise exceeding the initial\-state magnitude and position\-only observation both preserve $100\\%$ failure rate and keep the learned adversary strictly ahead of both baselines on jam\-time\-per\-failure\.

## Submission history

From: Adam Haroon \[[view email](https://arxiv.org/show-email/6cf85137/2609.12016)\] **\[v1\]**Thu, 10 Sep 2026 07:21:54 UTC \(125 KB\)

Similar Articles

When Actions Disappear: Adversarial Action Removal in Self-Play Reinforcement Learning

arXiv cs.LG

This paper studies adversarial action masking in self-play reinforcement learning, where an attacker selectively removes legal actions from a victim's action set. The attack is shown to be significantly more damaging than random masking or perturbation baselines across multiple environments and algorithms, and victims do not recover under extended training.

Neuro-Agentic Control: A Deep Learning-based LLM-Powered Agentic AI Framework for Controlling Security Controls

arXiv cs.AI

This paper introduces a neuro-agentic control framework that couples an LLM-based planner (Gemini 2.5 Flash-Lite) with a pre-trained Time-Series Foundation Model (TimesFM) for physics-grounded autonomous defense in industrial IoT. A Counterfactual Physics Injection mechanism ensures only safe, non-hallucinated actions are executed, achieving zero invalid actions and better breach prevention than LSTM and TCN baselines on the SWaT dataset.

Adversarial attacks on neural network policies

OpenAI Blog

OpenAI researchers demonstrate that adversarial attacks, previously studied in computer vision, are also effective against neural network policies in reinforcement learning, showing significant performance degradation even with small imperceptible perturbations in white-box and black-box settings.