Remote State Estimation and Instruction Adjustment of Multi-Agent Systems Under False Data Injection Attacks

Abstract

This paper investigates the problems of remote state estimation and instruction adjustment for multi-agent systems (MASs) under simultaneous sensor and instruction attacks, as well as external disturbances. Unlike existing research that primarily focuses on single-channel attacks, this paper investigates the more challenging scenario of dual-channel attacks. To decouple the detrimental effects of instruction attacks on state estimation, an augmented descriptor system is constructed, treating sensor attacks as part of an extended state. Then, a distributed unknown input observer is designed to estimate the system states. Theoretical analysis demonstrates that state estimation error is asymptotically convergent and independent of instruction estimation. Furthermore, to counteract instruction attacks, a distributed cooperative estimation strategy based on an adaptive saturation mechanism is proposed, enabling all agents to achieve bounded estimation of the true reference instruction within a finite number of iterations. Finally, the effectiveness and robustness of the proposed approach under dual-channel attacks are verified by a simulation of an unmanned vehicle platoon.

1. Introduction

Multi-agent systems (MASs) are distributed systems consisting of multiple autonomous agents. These agents are capable of sensing, decision-making, and interaction, and they work collaboratively to accomplish complex tasks [1]. In recent years, MASs have garnered significant attention due to their broad applications in domains such as unmanned aerial vehicle formations [2,3], smart grids [4,5], and distributed sensor networks [6]. However, their heavy reliance on communication networks makes them highly vulnerable to various cyber-attacks in open and shared network environments, posing serious threats to their secure and stable operation [7].

Common cyber-attacks against MASs primarily include false data injection (FDI) attacks, denial-of-service (DoS) attacks, replay attacks, and man-in-the-middle attacks [8,9]. Specifically, FDI attacks compromise data integrity by tampering with sensor measurements or control instructions [10,11]; DoS attacks disrupt communication links to deprive the system of partial or full control capability [12]; replay attacks interfere with state updates by retransmitting historical data [13]; and man-in-the-middle attacks undermine coordination by eavesdropping on or altering communication content [14]. To address these complex threats, researchers have focused on areas such as attack detection, secure controller design, and secure state estimation for MASs [15]. For instance, ref. [16] developed a resilient control strategy for multi-agent networks that combated FDI attacks using an adaptive estimator and achieved resource-efficient consensus via a neural approximation-based optimal event-triggered mechanism. Ref. [17] addressed the resilient consensus problem for linear MASs under directed topologies and DoS attacks by proposing a distributed observer-based event-triggered control scheme that effectively reduced communication and excluded Zeno phenomena.

In recent years, substantial progress has been made in secure control of MASs, with mature theoretical frameworks established for classical problems like consensus control and formation control [18,19]. Consequently, the design of closed-loop control for MASs is no longer a primary research challenge. However, in practical applications, when task environments change or emergent missions arise, local closed-loop control alone is often insufficient for global objective adjustment, necessitating real-time instruction issuance from a remote monitoring center (RMC) [20]. Therefore, a critical problem is how to ensure that agents receive correct instructions while maintaining stable operation of the MASs, when the instruction transmission process is compromised by cyber-attacks.

Furthermore, secure state estimation in MASs is particularly crucial [20,21,22,23,24,25]. For instance, ref. [22] optimized secure state estimation under homologous attacks and established a unique reconstruction condition from shared observations. Ref. [23] developed an online observer based on average consensus to recover both states and attacks in heterogeneous MASs. However, most of these works focus solely on sensor channel attacks, paying insufficient attention to instruction channel attacks. In fact, the accuracy of control instructions directly influences the evolution of system states, thereby coupling with and affecting the outcomes of state estimation. Although a few existing studies, e.g., [20], have attempted to address secure state estimation under both instruction and sensor attacks, the state estimation process remains susceptible to interference from biases in instruction estimation. This vulnerability leads to conservative convergence analysis and compromises estimation accuracy. A comparison of the relevant references is provided in

Table 1. Comparison with relevant secure state estimation methods.

References	Architecture	Attack Types	Control Input	Disturbance	Stability
[21]	Distributed	Sensor attacks	unknown	✗	asymptotic stability
[22,23]	Distributed	Sensor attacks	known	✗	asymptotic stability
[24]	Centralized	Sensor attacks	known	✓	asymptotic stability
[20,25]	Distributed	Sensor attacks and instruction attacks	unknown	✗	Bounded
[26]	Distributed	Sensor attacks and instruction attacks	known	✓	Bounded
Proposed	Distributed	Sensor attacks and instruction attacks	unknown	✓	asymptotic stability

✗ indicates that the article does not account for disturbance, while ✓ indicates that it does.

. Thus, in complex scenarios involving dual-channel attacks on both instructions and sensors, the core motivation of this study is to eliminate the coupling effect of instruction attacks on state estimation and achieve unbiased estimation of the system state.

Based on the above description, this paper studies the secure state estimation and instruction adjustment problems of MASs under dual-channel attacks. The main contributions of this paper include:

• For dual-channel attacks, an augmented system is constructed to decouple the sensor attacks. Subsequently, a distributed unknown input observer is designed to effectively eliminate the coupling effects of the instruction attacks on the state estimation process. In contrast to [20], where the state estimation remains susceptible to instruction estimation bias, our approach achieves asymptotically unbiased state estimation and enhances robustness against instruction attacks.
• To mitigate instruction channel attacks, a distributed estimation algorithm is developed. This algorithm leverages neighbor-to-neighbor communication and an adaptive saturation function, guaranteeing that all agents’ estimation errors for the reference instruction converge to a bounded region after a finite number of iterations, thereby enhancing system resilience.

The structure of this paper is as follows: Section 2 presents the preliminaries and problem formulation. Section 3 presents the main results. In Section 4, the effectiveness of the proposed method is demonstrated through a simulation. Finally, Section 5 provides a concluding summary of this paper.

Notation: ${\mathbb{R}}^n$ is used to denote the n-dimensional Euclidean space. The Euclidean norm is expressed as $\parallel ·\parallel$. The vector ${\mathbb{I}}_N={[1,\cdots ,N]}^T$ is defined as an N-dimensional column vector. The symbols $1_n$ represent the n-dimensional all-ones vector, and $I_n$ is the identity matrix of size n. For any matrix W, $W^T$ indicates its transpose, $W>0(W<0)$ signifies that W is positive definite(negative definite), $W^{†}$ represents its pseudo-inverse. Given a set v, $\left|v\right|$ denotes its cardinality.

2. Preliminaries and Problem Formulation

2.1. Graph Theory

Definition $\mathcal{G}=(\mathcal{V},\mathcal{E},\mathcal{A})$ represents an undirected graph, where $\mathcal{V}=\{1,2,\dots ,N\}$ is the node set, $\mathcal{E}\subseteq \mathcal{V}\times \mathcal{V}$ is the edge set, and $\mathcal{A}=[a_{ij}]\in {\mathbb{R}}^{N\times N}$ is the adjacency matrix. If $(j,i)\in \mathcal{E}$, then $a_{ij}=1$; otherwise $a_{ij}=0$. The neighbor set of node i is defined as ${\mathcal{N}}_i=\{j\in \mathcal{V}|(j,i)\in \mathcal{E}\}$. The graph Laplacian matrix is defined as $\mathcal{L}=\mathcal{D}-\mathcal{A}$, where $\mathcal{D}=\mathrm{diag}\{d_1,\dots ,d_N\}$ is the degree matrix with $d_i={\sum }_{j\in {\mathcal{N}}_i}{a}_{ij}$. Let ${\lambda }_i$ denote the ith smallest eigenvalue of the Laplacian matrix $\mathcal{L}$. If the graph $\mathcal{G}$ is connected, then $0={\lambda }_1<{\lambda }_2\le {\lambda }_3\dots \le {\lambda }_N$. Furthermore, the second smallest eigenvalue ${\lambda }_2$ satisfies the following lemma.

Lemma 1. 

For an undirected connected graph G, the second smallest eigenvalue ${\lambda }_2$ of its Laplacian matrix $\mathcal{L}$ provides a strict lower bound for the Rayleigh quotient $(x^T\mathcal{L}x)/(x^{T}x)$ over the subspace $\{x\in {\mathbb{R}}^N\mid 1_N^{T}x=0,x\ne 0\}$. That is, for any non-zero vector x satisfying $1_N^{T}x=0$, we have:

$$x^T\mathcal{L}x\ge {\lambda }_2{x}^{T}x.$$

2.2. System Dynamics

Consider MASs composed of N agents. The dynamics of the ith agent can be represented in the following discrete form:

$$\left\{\begin{array}{c}{x}_i(t+1)=A{x}_i(t)+B(u_i(t,x_i(t),x_j(t),r_i(t))+{\omega }_i(t)),j\in {\mathcal{N}}_i\hfill \\ y_i(t)=C{x}_i(t),i=1,\dots ,N\hfill \end{array}\right.$$

(1)

where $x_i(t)\in {\mathbb{R}}^n$, $u_i(t,x_i(t),x_j(t),r_i(t))\in {\mathbb{R}}^m$, $y_i(t)\in {\mathbb{R}}^p$, and ${\omega }_i(t)\in {\mathbb{R}}^m$ are the system state, control input, measured output, and external disturbance, respectively. $r_i(t)\in {\mathbb{R}}^v$ is the reference instruction from the RMC. $A\in {\mathbb{R}}^{n\times n}$, $B\in {\mathbb{R}}^{n\times m}$, and $C\in {\mathbb{R}}^{p\times n}$ are known matrices with appropriate dimensions.

The overall framework for state estimation and instruction adjustment in MASs under FDI attacks is illustrated in Figure 1. The RMC is responsible for monitoring the states of each agent in real time and sending reference instructions at appropriate moments. Based on the received instructions, the agents proceed to update their own states. However, when the measured output $y_i$ and the reference instruction $r_i$ are transmitted over the network, they become highly vulnerable to FDI attacks. Such attacks can not only compromise the decision-making accuracy of the RMC but may also lead to unpredictable safety risks in the MASs. The measurement output and reference instructions affected by FDI attacks can be represented as follows:

$$\begin{array}{cc}\hfill {\tilde{r}}_i(t)& =r_i(t)+D_r{\delta }_i^r,\hfill \\ \hfill {\tilde{y}}_i(t)& =y_i(t)+D_s{\delta }_i^s,\hfill \end{array}$$

(2)

where ${\tilde{r}}_i(t)\in {\mathbb{R}}^v$ represents the reference instruction actually received by agent i; ${\tilde{y}}_i(t)\in {\mathbb{R}}^p$ denotes the measured output from agent i actually received by the RMC; ${\delta }_i^r\in {\mathbb{R}}^{q_r}$ and ${\delta }_i^s\in {\mathbb{R}}^{q_s}$ respectively represent instruction attacks and sensor attacks. $D_r\in {\mathbb{R}}^{v\times q_r}$ and $D_s\in {\mathbb{R}}^{p\times q_s}$ ($p\ge q_s$) are known matrices with appropriate dimensions. For instruction attacks, we define ${\mathbf{A}}_t^r=\left\{i\right|{\delta }_i^r\ne 0\}$ to represent the set of attacked instruction channels and ${\mathbf{N}}_t^r=\mathbb{I}/{\mathbf{A}}_t^r$.

To mitigate the direct impact of instruction attacks on the closed-loop dynamics of the agents, this paper adopts an active defense strategy based on instruction estimation. Specifically, upon receiving the potentially compromised instruction ${\tilde{r}}_i(t)$, agent i does not use it directly in the controller. Instead, it first performs instruction estimation to obtain an estimate $r_i^m(t)$ of the true instruction $r_i(t)$. The estimated value $r_i^m(t)$ is then used in computing the control law. Under this strategy and considering the sensor attack ${\delta }_i^s(t)$, the system (1) under dual-channel attacks can be reformulated as follows:

$$\left\{\begin{array}{c}{x}_i(t+1)=A{x}_i(t)+B(u_i(t)+{\omega }_i(t)),j\in {\mathcal{N}}_i\hfill \\ {\tilde{y}}_i(t)=C{x}_i(t)+D_s{\delta }_i^s(t),i=1,\dots ,N\hfill \end{array}\right.$$

(3)

where $u_i(t)=u_i(t,x_i(t),x_j(t),r_i^m(t))$. Next, the following assumptions are provided for subsequent analysis.

Assumption 1. 

The pair $(A,B)$ is controllable, $(A,C)$ is observable, and $rank(D_s)=q_s$.

Assumption 2. 

The malicious adversary can compromise at most $|{\mathit{A}}_t^r| =n_r<N/2$ instruction channels simultaneously.

Assumption 3. 

Within each sampling period, agent i estimates the reference instruction $r_i$ by executing a maximum of K iterations. Denoting the estimated value by agent i at the k-th iteration as ${\widehat{r}}_i(k)$, the final instruction estimate used for the control input is given by $r_i^m(t)={\widehat{r}}_i(K)$.

Remark 1. 

In Assumption 1, the assumptions about controllability and observability are the fundamental assumptions that ensure the feasibility of instruction regulation and state estimation. Moreover, the assumption that matrix $D_s$ is full rank is reasonable, as when $D_s$ is not full rank, it can be achieved by eliminating the redundant terms of ${\delta }_i(t)$. Assumption 2 limits the number of instruction channels that can be attacked simultaneously, which is the standard assumption for accurately estimating reference instructions under FDI attacks. Assumption 3 guarantees that each agent achieves bounded estimation of the reference instruction within a finite number of iterations.

2.3. Augmented System Construction

The goal of this article is to achieve remote state estimation and instruction adjustment, but both sensor attacks and instruction attacks can compromise the performance of remote state estimation. A key strategy is to decouple and simultaneously estimate the system states and the sensor attack signals. This is achieved by constructing an augmented descriptor system where the sensor attack is treated as part of the extended state.

Based on system (3), the dynamic of augmented system ${\xi }_i(t)={[x_i^T(t),{\delta }_i^T(t)]}^T\in {\mathbb{R}}^{n+q_s}$ is as follows:

$$\left\{\begin{array}{c}E{\xi }_i(t+1)=\overline{A}{\xi }_i(t)+B(u_i(t)+{\omega }_i(t)),\hfill \\ {\tilde{y}}_i(t)=\overline{C}{\xi }_i(t),\hfill \end{array}\right.$$

(4)

where $E=\left[\begin{array}{cc}{I}_n& 0\end{array}\right]\in {\mathbb{R}}^{n\times (n+q_s)},\overline{A}=\left[\begin{array}{cc}A& 0\end{array}\right]\in {\mathbb{R}}^{n\times (n+q_s)},\overline{C}=\left[\begin{array}{cc}C& D_s\end{array}\right]\in {\mathbb{R}}^{p\times (n+q_s)}$.

The following assumption and lemma regarding augmented system (4) are used for subsequent analysis.

Lemma 2. 

If $D_s$ is a column full rank matrix, there exist matrices $R_1$ and $R_2$ that satisfy

$${\mathcal{R}}_{1}E+{\mathcal{R}}_2\overline{C}=I_{n+q_s}$$

(5)

and the general solutions for $R_1$ and $R_2$ can be expressed as:

$$\left[\begin{array}{cc}{\mathcal{R}}_1& {\mathcal{R}}_2\end{array}\right]={\left[\begin{array}{cc}{I}_n& 0\\ C& D_s\end{array}\right]}^{†}+\Lambda \left(I-\left[\begin{array}{cc}{I}_n& 0\\ C& D_s\end{array}\right]{\left[\begin{array}{cc}{I}_n& 0\\ C& D_s\end{array}\right]}^{†}\right),$$

(6)

where Λ is an arbitrary matrix of appropriate dimensions.

Assumption 4. 

$rank(\overline{C}{R}_{1}B)=rank(B)=m$.

Remark 2. 

Note that the state observer designed in this paper is similar to an unknown input observer, requiring decoupling of the disturbance term. Therefore, Assumption 4 is necessary, similar to the standard assumption of $rank(\overline{C}B)=rank(B)$ in an unknown input observer. Since $R_1$ contains free parameters through Λ in (6), one can select $R_1$ to satisfy $rank(\overline{C}{R}_{1}B)=rank(B)$ in most practical MASs. In the vehicle-platoon example of Section 4, we have numerically verified that $rank(\overline{C}B)=rank(B)$. A similar full-rank assumption is also used in existing work [26], which further indicates that Assumption 4 is mild and practically reasonable.

Using Lemma 2, the augmented system (4) can be transformed into:

$$\begin{array}{cc}\hfill {\xi }_i(t+1)& ={\mathcal{R}}_1\overline{A}{\xi }_i(t)+{\mathcal{R}}_{1}B[u_i(t)+{\omega }_i(t)]+{\mathcal{R}}_2{y}_i(t+1),\hfill \\ \hfill {\tilde{y}}_i(t)& =\overline{C}{\xi }_i(t).\hfill \end{array}$$

(7)

2.4. Problem Statement

In the existing literature, secure state estimation under either sensor attacks or reference instruction attacks alone has been extensively studied. However, when both sensor measurements and reference instructions are simultaneously compromised by FDI attacks, the system faces a more challenging scenario: it must ensure that the agents accurately track reference instructions and maintain stable operation, while also obtaining accurate state estimates from corrupted measurement data. Distortions in the reference instructions directly affect the system’s output response, thereby interfering with the performance of the state observer. If not properly handled, biases induced by instruction attacks can propagate and amplify the state estimation error. To achieve secure state estimation and instruction adjustment, the following two key problems can be summarized:

Problem 1. 

For the system (3) under external disturbances and dual-channel FDI attacks, design a secure state estimation strategy such that for each agent i, the state estimate ${\widehat{x}}_i(t)$ asymptotically converges to the true state $x_i(t)$. Specifically, the estimation error should satisfy:

$$\underset{t\to \infty }{lim}\parallel {\widehat{x}}_i(t)-x_i(t)\parallel =0.$$

Problem 2. 

Under FDI attacks on reference instructions, design a distributed cooperative estimation strategy such that all agents achieve bounded estimation of the true reference instruction within a finite number of iterations. Specifically, there exists a positive constant ε such that for all agents i and sufficiently large time t, the estimation error satisfies:

$$\parallel r_i^m(t)-r_i(t)\parallel \le \epsilon .$$

Remark 3. 

It should be noted that this paper does not address the specific design of the controller, as objectives such as consensus control, formation control, and path following in MASs have been extensively studied, and mature controller design methods are readily available. Thus, this paper assumes that the controller is already designed and operational, and the focus is on secure state estimation and instruction estimation under network attacks.

3. Design of Distributed Observers Under Dual-Channel Attack

In this section, we design a distributed unknown input observer to achieve unbiased estimation of the system state. In addition, a distributed observer based on adaptive saturation mechanism is designed for instruction estimation.

3.1. Distributed Unknown Input Observer for State Estimation

Both unknown noise and instruction estimation errors can degrade the performance of state estimation, leading to estimation bias. To solve Problem 1, an unknown input observer is designed to achieve unbiased state estimation. Inspired by the unknown-input proportional-differential observer for continuous-time systems proposed in [26], we design an unknown input observer for the discrete-time augmented system (7) as follows:

$$\left\{\begin{array}{c}{\sigma }_i(t+1)={\mathcal{R}}_1\overline{A}{\widehat{\xi }}_i(t)+{\mathcal{R}}_{1}B[{\widehat{u}}_i(t)+{\widehat{\overline{\omega }}}_i(t)]+L[\tilde{y}(t)-{\widehat{y}}_i(t)],\hfill \\ {\widehat{\xi }}_i(t)={\sigma }_i(t)+{\mathcal{R}}_2{\tilde{y}}_i(t),\hfill \\ {\widehat{\overline{\omega }}}_i(t)={(\overline{C}{\mathcal{R}}_{1}B)}^{†}[{\tilde{y}}_i(t+1)-\overline{C}{\mathcal{R}}_2{\tilde{y}}_i(t+1)-\overline{C}{\mathcal{R}}_1\overline{A}{\widehat{\xi }}_i(t)]-{\widehat{u}}_i(t),\hfill \\ {\widehat{y}}_i(t)=\overline{C}{\widehat{\xi }}_i(t),\hfill \end{array}\right.$$

(8)

where ${\sigma }_i(t)$ is the state of the ith observer node, ${\widehat{\xi }}_i(t)$ represents the estimate of the augmented state ${\xi }_i(t)$, ${\widehat{u}}_i(t)=u_i(t,{\widehat{x}}_i(t),{\widehat{x}}_j(t),r_i(t))$, ${\widehat{\overline{\omega }}}_i(t)$ is the estimate of the unknown input ${\overline{\omega }}_i(t)={\omega }_i(t)+u_i(t)-{\widehat{u}}_i(t)$, ${\widehat{y}}_i(t)$ is the estimate of the measured output ${\tilde{y}}_i(t)$, and L is the gain matrix to be designed. (8) is the state estimation of the augmented system (7), and it is evident that the state estimation of the original system (3) can be obtained by ${\widehat{x}}_i(t)=E{\widehat{\xi }}_i(t)$.

Remark 4. 

Note that the update of ${\widehat{\omega }}_i(t)$ in (8) involves the measurement ${\tilde{y}}_i(t+1)$. In practice, the observer is implemented as follows. At time $t+1$, the RMC first receives the updated measurement ${\tilde{y}}_i(t+1)$ from all agents and uses (8) to compute ${\widehat{\overline{\omega }}}_i(t)$. Then, based on ${\widehat{\overline{\omega }}}_i(t)$ and the previous estimate ${\widehat{\xi }}_i(t)$, it sequentially updates ${\widehat{y}}_i(t)$ and ${\sigma }_i(t+1)$, respectively, and finally obtains the new state estimate ${\widehat{\xi }}_i(t+1)$. This step-by-step description clarifies that the use of ${\tilde{y}}_i(t+1)$ does not introduce any timing ambiguity.

Remark 5. 

Due to the presence of instruction attacks, RMC cannot access the agent i’s actual estimate of the reference instruction $r_i^m$, but instead must rely on the originally sent instruction $r_i$. Consequently, when $r_i^m$ differs from $r_i$, an error inevitably arises between the actual control input $u_i$ and the computed control input ${\widehat{u}}_i$ based on the state estimates. If the observer (8) only compensates by estimating the external disturbance ${\omega }_i$, the state estimation error will fail to converge to zero because the control input error continuously perturbs the system dynamics. To address this, the above observer compensates for the unknown term ${\overline{\omega }}_i(t)$ and eliminates the coupling effect of instruction attacks on state estimation, thereby solving Problem 1.

Next, the performance of the unknown input observer (8) is analyzed. Define the state estimation error of the augmented system and estimation error of unknown input ${\overline{\omega }}_i(t)$ respectively as:

$${\tilde{\xi }}_i(t)={\xi }_i(t)-{\widehat{\xi }}_i(t)$$

and

$${\tilde{\overline{\omega }}}_i(t)={\overline{\omega }}_i(t)-{\widehat{\overline{\omega }}}_i(t).$$

Based on (5) and (8), we have

$$\begin{array}{cc}\hfill {\tilde{\xi }}_i(t)& =(R_{1}E+R_2\overline{C}){\xi }_i(t)-{\widehat{\xi }}_i(t),\hfill \\ \hfill & =R_{1}E{\xi }_i(t)-{\sigma }_i(t).\hfill \end{array}$$

(9)

From (4), (8), and (9), the dynamics of state estimation error ${\tilde{\xi }}_i(t)$ can be derived as:

$$\begin{array}{cc}\hfill {\tilde{\xi }}_i(t+1)=& R_{1}E{\xi }_i(t+1)-{\sigma }_i(t+1)\hfill \\ \hfill =& {\mathcal{R}}_1\overline{A}{\xi }_i(t)+{\mathcal{R}}_{1}B[u_i(t)+{\omega }_i(t)]\hfill \\ \hfill & -{\mathcal{R}}_1\overline{A}{\widehat{\xi }}_i(t)-{\mathcal{R}}_{1}B[{\widehat{u}}_i(t)+{\widehat{\overline{\omega }}}_i(t)]-L[{\tilde{y}}_i(t)-{\widehat{y}}_i(t)]\hfill \\ \hfill =& ({\mathcal{R}}_1\overline{A}-L\overline{C}){\tilde{\xi }}_i(t)+{\mathcal{R}}_{1}B{\tilde{\overline{\omega }}}_i(t).\hfill \end{array}$$

(10)

The estimation error of the unknown input ${\overline{\omega }}_i(t)$ is further analyzed. From (7) and the observer (8), we have:

$$\begin{array}{cc}\hfill {\tilde{\overline{\omega }}}_i(t)& ={\overline{\omega }}_i(t)-{\widehat{\overline{\omega }}}_i(t)\hfill \\ \hfill & ={\overline{\omega }}_i(t)-\left\{{(\overline{C}{\mathcal{R}}_{1}B)}^{†}[{\tilde{y}}_i(t+1)-\overline{C}{\mathcal{R}}_2{\tilde{y}}_i(t+1)-\overline{C}{\mathcal{R}}_1\overline{A}{\widehat{\xi }}_i(t)]-{\widehat{u}}_i(t)\right\}\hfill \\ \hfill & ={\omega }_i(t)+u_i(t)-{(\overline{C}{\mathcal{R}}_{1}B)}^{†}\overline{C}[{\mathcal{R}}_1\overline{A}{\xi }_i(t)+{\mathcal{R}}_{1}B(u_i(t)+{\omega }_i(t))]\hfill \\ \hfill & +{(\overline{C}{\mathcal{R}}_{1}B)}^{†}\overline{C}{\mathcal{R}}_1\overline{A}{\widehat{\xi }}_i(t)\hfill \\ \hfill & =-H{\tilde{\xi }}_i(t),\hfill \end{array}$$

(11)

where $H={(\overline{C}{\mathcal{R}}_{1}B)}^{†}\overline{C}{\mathcal{R}}_1\overline{A}$.

Substituting (11) into (10), we obtain the final error dynamics:

$${\tilde{\xi }}_i(t+1)=({\mathcal{R}}_1\overline{A}-L\overline{C}-{\mathcal{R}}_{1}BH){\tilde{\xi }}_i(t).$$

(12)

Remark 6. 

Under Assumption 4, the matrix $\overline{C}{\mathcal{R}}_{1}B$ is full column rank, hence its left pseudo-inverse ${(\overline{C}{\mathcal{R}}_{1}B)}^{†}$ exists. From (11), it can be seen that due to this property, the unknown input estimation error ${\tilde{\overline{\omega }}}_i(t)$ can be expressed as a linear function of the state estimation error ${\tilde{\xi }}_i(t)$, thus achieving decoupling of the unknown terms. Moreover, (12) shows that the state estimation error dynamics ${\tilde{\xi }}_i(t)$ is independent of the control input $u_i(t)$ or the instruction estimation error, which implies that the instruction estimation error does not affect the state estimation. Therefore, the requirement for asymptotic convergence of the state estimation error in Problem 1 can be well addressed. If $\overline{C}{R}_{1}B$ is rank-deficient, (11) cannot be satisfied due to the inability to eliminate the unknown input. Therefore, Assumption 4 is necessary for observer (8) to accurately estimate the system state.

The following Theorem 1 is given for analyzing the performance of the unknown input observer (8).

Theorem 1. 

Under Assumptions 1 and 4, if there exists a positive scalar $0<{\vartheta }_1<1$, a positive definite matrix $P>0$, and a matrix $\tilde{L}$ such that the following linear matrix inequality (LMI) holds:

$$\left[\begin{array}{cc}-{\vartheta }_{1}P& {({\mathcal{R}}_1\overline{A}-{\mathcal{R}}_{1}BH)}^{\top }P-{\overline{C}}^{\top }{\tilde{L}}^{\top }\\ \ast & -P\end{array}\right]<0,$$

(13)

then the unknown input observer (8) with gain $L=P^{-1}\tilde{L}$ ensures that the state estimation error satisfies ${lim}_{t\to \infty }\parallel {\widehat{x}}_i(t)-x_i(t)\parallel =0$.

Proof. 

Choose the Lyapunov function candidate

$$V(t)={\tilde{\xi }}^T(t)(I_N\otimes P)\tilde{\xi }(t),$$

(14)

where $\tilde{\xi }(t)={[{\tilde{\xi }}_1^T(t),\dots ,{\tilde{\xi }}_N^T(t)]}^T$. From LMI (13), we have

$${({\mathcal{R}}_1\overline{A}-L\overline{C}-{\mathcal{R}}_{1}BH)}^{T}P({\mathcal{R}}_1\overline{A}-L\overline{C}-{\mathcal{R}}_{1}BH)<{\vartheta }_{1}P.$$

(15)

Based on (12) and (15), one can derive

$$\begin{array}{cc}\hfill V(t+1)=& {\tilde{\xi }}^T(t+1)(I_N\otimes P)\tilde{\xi }(t+1)\hfill \\ \hfill =& {\tilde{\xi }}^T(t)(I_N\otimes {({\mathcal{R}}_1\overline{A}-L\overline{C}-{\mathcal{R}}_{1}BH)}^{T}P({\mathcal{R}}_1\overline{A}-L\overline{C}-{\mathcal{R}}_{1}BH))\tilde{\xi }(t)\hfill \\ \hfill \le & {\vartheta }_{1}V(t).\hfill \end{array}$$

(16)

Recursively using (16) makes it easy to get $V(t)\le {\vartheta }_1^{t}V(0)$. Since $V(0)$ is bounded and $0<{\vartheta }_1<1$, we conclude that ${lim}_{t\to \infty }V(t)=0$ which implies ${lim}_{t\to \infty }\parallel {\tilde{\xi }}_i(t)\parallel =0$. Thus, ${lim}_{t\to \infty }\parallel {\widehat{x}}_i(t)-x_i(t)\parallel ={lim}_{t\to \infty }\parallel E{\tilde{\xi }}_i(t)\parallel =0$. The proof is completed. □

Remark 7. 

Theorem 1 shows that observer (8) can achieve unbiased estimation of the system states. It is noteworthy that observer (8) and Theorem 1 do not involve the design of the controller. This implies that the RMC equipped with observer (8) can accurately estimate the states of the MASs under any control input. This capability holds even when the reference instructions are severely compromised by attackers and the agents fail to estimate the true control instructions. This result highlights the observer’s strong robustness under dual-channel attacks.

3.2. Distributed Adaptive Saturation Observer for Instruction Estimation

To solve Problem 2, this subsection designs a distributed adaptive saturation observer that can achieve bounded estimation of reference instructions after a finite number of iterations. The dynamics of the instructions observer ${\widehat{r}}_i(t_k)$ is designed as follows:

$$\begin{array}{cc}\hfill {\widehat{r}}_i(t_{k+1})=& {\widehat{r}}_i(t_k)+{\kappa }_1\sum _{j=1}^N{a}_{ij}({\widehat{r}}_j(t_k)-{\widehat{r}}_i(t_k))+{\kappa }_2{\eta }_i(t_k)({\tilde{r}}_i(t)-{\widehat{r}}_i(t_k)),\hfill \end{array}$$

(17)

where ${\widehat{r}}_i(t_k)$ is the estimated values of $r_i(t)$. ${\kappa }_1$ and ${\kappa }_2$ are the parameters to be determined. ${\eta }_i(t_k)$ is an adaptive saturation function and defined as follows:

$${\eta }_i(t_k)=min\{1,{\displaystyle \frac{\psi (t_k)}{\parallel {\tilde{r}}_i(t)-{\widehat{r}}_i(t_k)\parallel }}\},$$

(18)

where $\psi (t_k)$ is an adaptive threshold. The key to the adaptive saturation strategy lies in the configuration of the threshold $\psi (t_k)$, which is based on the following assumptions.

Assumption 5. 

An upper bound on the initial error of the instruction estimation is assumed to be known. Specifically, there exists a known constant ${\varrho }_t^r$ such that the instruction estimation error $e_i^r(t_k)={\widehat{r}}_i(t_k)-r_i(t)$ satisfies

$$\parallel e_i^r(t_0)\parallel \le {\varrho }_t^r,\forall i\in \mathcal{V}.$$

Then, the threshold $\psi (t_k)$ can be designed as

$$\begin{array}{cc}\hfill \psi (t_k)& ={\psi }_1(t_k)+{\psi }_2(t_k),\hfill \\ \hfill {\psi }_1(t_{k+1})& =(1-{\kappa }_1{\lambda }_2+\sqrt{N}{\kappa }_2){\psi }_1(t_k)+\sqrt{N}{\kappa }_2{\psi }_2(t_k),\hfill \\ \hfill {\psi }_2(t_{k+1})& =2n_r{\kappa }_2{\psi }_1(t_k)/N+[1-{\kappa }_2(1-2n_r/N)]{\psi }_2(t_k),\hfill \end{array}$$

(19)

with the initial state ${\psi }_1(t_0)\ge 0$, ${\psi }_2(t_0)={\varrho }_t^r$, and we assume that RMC sends the same reference instruction $r(t)$ to all agents. The estimates of all agents can be aggregated into the following form:

$$\begin{array}{c}\hfill \widehat{r}(t_{k+1})=((I_N-{\kappa }_1\mathcal{L})\otimes I_v)\widehat{r}(t_k)+{\kappa }_2\eta (t_k)\otimes I_v(\tilde{r}(t)-\widehat{r}(t_k)),\end{array}$$

(20)

where $\widehat{r}(t_k)={[{\widehat{r}}_1^T(t_k),\cdots ,{\widehat{r}}_N^T(t_k)]}^T$, $\eta (t_k)=diag\{{\eta }_1(t_k),\cdots ,{\eta }_N(t_k)\}$. Define the average of instruction estimation $\overline{r}(t_k)={\displaystyle \frac{1}{N}}(1_N^T\otimes I_v)\widehat{r}(t_k)$, matrix $\tilde{I}=I_{Nv}-{\displaystyle \frac{1}{N}}{1}_N{1}_N^T\otimes I_v$ with $\parallel \tilde{I}\parallel =1$, and auxiliary error variable

$$\begin{array}{cc}\hfill {\overline{e}}^r(t_k)& =\overline{r}(t_k)-r(t),\hfill \\ \hfill {\tilde{e}}^r(t_k)& =\widehat{r}(t_k)-1_N\otimes \overline{r}(t_k)=\tilde{I}\widehat{r}(t_k).\hfill \end{array}$$

(21)

By substituting (20) into (21), we can obtain that

$$\begin{array}{cc}\hfill {\overline{e}}^r(t_{k+1})=& {\overline{e}}^r(t_k)+{\displaystyle \frac{{\kappa }_2}{N}}{1}_N^T\eta (t_k)\otimes I_v(\tilde{r}(t)-\widehat{r}(t_k))\hfill \\ \hfill =& (1-{\kappa }_2){\overline{e}}^r(t_k)+{\displaystyle \frac{{\kappa }_2}{N}}{1}_N^T{\eta }_{{\mathbf{A}}_t^r}(t_k)\otimes I_v(\tilde{r}(t)-\widehat{r}(t_k))\hfill \\ \hfill & +{\displaystyle \frac{{\kappa }_2}{N}}[1_N^T(I_N-{\eta }_{{\mathbf{N}}_t^r}(t_k))\otimes I_v]e^r(t_k)\hfill \end{array}$$

(22)

and

$$\begin{array}{c}\hfill {\tilde{e}}^r(t_{k+1})=[(I_N-{\kappa }_1\mathcal{L})\otimes I_v]{\tilde{e}}^r(t_k)+{\kappa }_2\tilde{I}(\eta (t_k)\otimes I_v)(\tilde{r}(t)-\widehat{r}(t_k)).\end{array}$$

(23)

The following theorem is proposed for analyzing the estimation performance of adaptive saturation observer (17).

Theorem 2. 

Under Assumptions 1–3, if there exist positive parameters ${\kappa }_1$, ${\kappa }_2$, and ${\vartheta }_2<1$ satisfying ${\kappa }_1({\lambda }_2+{\lambda }_N)\le 2$, $(1-2n_r/N){\kappa }_2<1$, and the following linear matrix inequality holds:

$$\left[\begin{array}{cc}-{\vartheta }_{2}I& {\Gamma }^T\\ \ast & -I\end{array}\right]<0,$$

(24)

where the matrix Γ is defined as:

$$\Gamma =\left[\begin{array}{cc}1-{\kappa }_1{\lambda }_2+\sqrt{N}{\kappa }_2& \sqrt{N}{\kappa }_2\\ 2{\kappa }_2{n}_r/N& 1-(1-2n_r/N){\kappa }_2\end{array}\right],$$

then each agent equipped with observer (17) can achieve bounded estimation of the reference instruction $r_i(t)$ after a finite number of iterations. Specifically, the estimation error satisfies $\parallel r_i^m(t)-r_i(t)\parallel \le \sqrt{2}{\vartheta }_2^{K/2}{\varrho }_t^r=\epsilon$.

Proof. 

We construct the following Lyapunov functions to analyze the system stability

$$V_1(t_k)= \parallel {\tilde{e}}^r(t_k)\parallel ,V_2(t_k)=\parallel {\overline{e}}^r(t_k)\parallel .$$

Considering the initial time $k=0$, we set the initial estimates of all agents to zero, i.e., ${\widehat{r}}_i(t_0)=0$ ($\forall i\in \mathcal{V}$), which implies $\overline{r}(t_0)=0$. Based on this initial condition, one has

$$V_1(t_0)=0\le {\psi }_1(t_0),V_2(t_0)\le {\varrho }_t^r={\psi }_2(t_0).$$

(25)

Then, we need to prove that for any $t,k\ge 0$, the following inequalities hold

$$\begin{array}{c}\hfill V_1(t_k)\le {\psi }_1(t_k),V_2(t_k)\le {\psi }_2(t_k).\end{array}$$

(26)

According to the initial condition (25), there must exist $k\ge 0$ such that inequality (26) holds. This leads to

$$\parallel e_i^r(t_k)\parallel \le \parallel {\tilde{e}}_i^r(t_k)\parallel + \parallel {\overline{e}}^r(t_k)\parallel \le \psi (t_k),i\in \mathcal{V}.$$

(27)

From inequality (27), for $i\in {\mathbf{N}}_t^r$, we have ${\eta }_i(t_k)=1$. Furthermore, according to the definition of the saturation function (18), the following inequality is derived.

$${\eta }_i(t_k)\parallel {\tilde{r}}_i(t)-{\widehat{r}}_i(t_k)\parallel \le \psi (t_k),i\in \mathcal{V}.$$

(28)

Considering $1_N^T{\tilde{e}}^r(t_k)=0$, along with the condition ${\kappa }_1({\lambda }_2+{\lambda }_N)\le 2$ and Lemma 1, we acquire

$$\parallel [(I_N-{\kappa }_1\mathcal{L})\otimes I_v]{\tilde{e}}^r(t_k)\parallel \le (1-{\kappa }_1{\lambda }_2)\parallel {\tilde{e}}^r(t_k)\parallel .$$

(29)

Substituting expressions (19), (28), and (29) into (22) and (23) respectively, one deduces

$$\begin{array}{cc}\hfill V_1(t_{k+1})\le & (1-{\kappa }_1{\lambda }_2){\psi }_1(t_k)+\sqrt{N}{\kappa }_2\psi (t_k)\hfill \\ \hfill \le & (1-{\kappa }_1{\lambda }_2+\sqrt{N}{\kappa }_2){\psi }_1(t_k)+\sqrt{N}{\kappa }_2{\psi }_2(t_k)\hfill \\ \hfill =& {\psi }_1(t_{k+1})\hfill \end{array}$$

(30)

and

$$\begin{array}{cc}\hfill V_2(t_{k+1})\le & (1-{\kappa }_2){\psi }_2(t_k)+{\displaystyle \frac{2{\kappa }_2}{N}}\left|A_t^r\right|\psi (t_k)\hfill \\ \hfill \le & (1-{\kappa }_2(1-{\displaystyle \frac{2n_r}{N}})){\psi }_2(t_k)+{\displaystyle \frac{2n_r{\kappa }_2}{N}}{\psi }_1(t_k)\hfill \\ \hfill =& {\psi }_2(t_{k+1}).\hfill \end{array}$$

(31)

Therefore, inequality (26) and $\parallel e_i^r(t_k)\parallel \le \psi (t_k)$ hold for all $t,k\ge 0$. Defining the vector $\tilde{\psi }(t_k)={[{\psi }_1(t_k),{\psi }_2(t_k)]}^T$. From LMI (24), ${\Gamma }^T\Gamma <{\vartheta }_{2}I$ can be obtained, which implies

$$\parallel \tilde{\psi }(t_{k+1})\parallel <{\vartheta }_2\parallel \tilde{\psi }(t_k)\parallel .$$

(32)

Recursively applying inequality (32), we obtain:

$$\begin{array}{cc}\hfill & {\psi }_1^2(t_k)+{\psi }_2^2(t_k)<{\vartheta }_2^k({\psi }_1^2(t_0)+{\psi }_2^2(t_0)),\hfill \end{array}$$

which leads to

$$\psi (t_K)\le {(2{\psi }_1^2(t_K)+2{\psi }_2^2(t_K))}^{{\displaystyle \frac{1}{2}}}<\sqrt{2}{\vartheta }_2^{K/2}{\varrho }_t^r.$$

Finally, we conclude that $\parallel r_i^m(t)-r_i(t)\parallel \le \sqrt{2}{\vartheta }_2^{K/2}{\varrho }_t^r=\epsilon$. The proof is completed. □

4. Simulation Example

In this section, numerical simulations are conducted to validate the effectiveness and robustness of the proposed method under dual-channel FDI attacks. We consider MASs consisting of 7 unmanned vehicles, forming a platoon on a road. All vehicles in the platoon travel with identical spacing and speed. The communication topology is such that each vehicle can only communicate with its immediate neighbors (i.e., the front and rear vehicles), as shown in Figure 2. RMC estimates the states of the vehicles using the proposed observer (8) and sends reference instructions to control the vehicles’ speed and spacing.

The dynamics of each vehicle are described by the discrete-time linear system (3), with the following system matrices [27]:

$$A=\left[\begin{array}{ccc}1& T& \tau T-{\tau }^2\left(1-e^{-T/\tau }\right)\\ 0& 1& \tau \left(1-e^{-T/\tau }\right)\\ 0& 0& e^{-T/\tau }\end{array}\right],B=\left[\begin{array}{c}{\tau }^2\left(e^{T/\tau }-1-{\displaystyle \frac{T}{\tau }}-{\displaystyle \frac{T^2}{2{\tau }^2}}\right)\\ \tau \left(e^{T/\tau }-1-{\displaystyle \frac{T}{\tau }}\right)\\ e^{T/\tau }-1\end{array}\right],$$

$C=I_3$, $D_r=I_2$ and $D_s=10\ast [4,1;3,0;2,2]$, where $T=0.01$ represents the sampling time and $\tau =0.4$ is the time lag constant. The state vector of the vehicle i is $x_i(t)=[d_i(t),v_i(t),a_i(t)]$, which represents displacement, velocity, and acceleration, respectively. Assuming the initial state of the last vehicle is $[0,5,0]$ and the interval between all vehicles is 5, the initial velocity and acceleration of the other vehicles are the same as the last vehicle (i.e., $x_7(0)=[0,5,0],\dots ,x_1(0)=[30,5,0]$).

The external disturbance ${\omega }_i(t)$ is modeled as a bounded random signal with $\parallel {\omega }_i(t)\parallel \le 1$. The reference instruction sent by RMC is $r(t)=[v(t),\Delta (t)]$, which represents velocity and spacing. It is assumed that when RMC detects the displacement $d_7(t)=30$ of the last unmanned vehicle, it starts sending reference signals $r(t)=[10sin(0.5t),10]$ to all unmanned vehicles. The estimated value of vehicle i for the instruction is $r_i^c=[v_i^c,{\Delta }_i^c]$. Based on the vehicle platooning control method in [28], the controller for each unmanned vehicle is designed as:

$$u_i(t)=-K\sum _{j\in {\mathcal{N}}_i}(x_i(t)-x_j(t)-(j-i)\ast {\Delta }_i^c(t))-k_2(v_i(t)-v_i^c(t)),$$

(33)

where $K=[k_1,k_2,k_3]=[24.55,53.70,17.55]$ is a feedback gain satisfying the stabilization condition. In accordance with Assumption 2, at each sampling instant the adversary can attack at most $n_r<N/2$ instruction channels. Thus, we consider the simplest nontrivial case with one attacked instruction channel and design a relatively strong instruction attack ${\delta }_i^r(t)=[20sin(0.5t),-30sin(t)]$ that would lead to severe collisions in the vehicle platoon if it were not compensated. Since no explicit upper bound on the number of attacked sensor channels is imposed in our analysis, we consider the worst case where all sensor channels are simultaneously subjected to FDI attacks with ${\delta }_i^s(t)=[(8-i)\ast 10sin(2t),i\ast 35sin(5t)]$. Next, we verify the instruction estimation performance of the adaptive saturation observer (17) and state estimation performance of the unknown input observer (8), separately.

(1) Performance analysis of instruction estimation: assume that only instruction attacks are present (i.e., sensor attacks are zero). According to Theorem 2, the parameters ${\kappa }_1$ and ${\kappa }_2$ are selected by solving the LMI (24) under the constraints ${\kappa }_1({\lambda }_2+{\lambda }_N)\le 2$ and $(1-2n_r/N){\kappa }_2<1$, yielding ${\kappa }_1=0.459$ and ${\kappa }_2=0.01$. The iteration number is set to $K=800$ to ensure the convergence of the instruction estimation. The initial instruction estimate for all agents is ${\widehat{r}}_i(t_0)=[0,0]$. Figure 3 illustrates the instruction estimation error of all unmanned vehicles. It can be observed that the estimation errors rapidly decrease and then remain within a small neighborhood of zero after approximately 450 iterations, which is consistent with Theorem 2. To validate the effectiveness of the distributed adaptive saturation observer (17), two cases are compared:

Case 1: agents obtain the instruction estimate $r_i^m(t)$ via the distributed adaptive saturation observer (17) and employ it in the controller;

Case 2: agents directly use the attacked instruction ${\tilde{r}}_i(t)$.

Simulation results are shown in Figure 4 and Figure 5. Figure 4 shows that after applying observer (17), the speed and acceleration of the unmanned vehicles can still achieve consensus and operate stably according to the reference instructions sent by RMC. Figure 5 shows that without the observer (17), unmanned vehicles not only cannot operate according to the reference instructions, but also collide multiple times.

To provide a quantitative comparison, we compute the root mean square error (RMSE) between the actual vehicle states and the reference instruction for both the velocity v and spacing $\Delta$ at the time $T=35\mathrm{s}$. Specifically, the RMSE indices are defined as

$${\mathrm{RMSE}}_1=\sqrt{{\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}{\left(v_i-v\right)}^2},{\mathrm{RMSE}}_2=\sqrt{{\displaystyle \frac{1}{N-1}}{\displaystyle \sum _{i=1}^{N-1}}{\left(d_i-d_{i+1}-\Delta \right)}^2}.$$

For convenience, the time T in the above equation has been omitted. The convergence time is determined as the first time instant when both ${\mathrm{RMSE}}_1$ and ${\mathrm{RMSE}}_2$ remain below 1.

Table 2. RMSE and convergence time in two cases.

Method	RMSE1	RMSE2	Convergence Time
Case 1	0.0872	0.5299	25.8
Case 2	3.274	3.9177	Periodic oscillation

compares the proposed method (Case 1) against a baseline in which the agents directly use the attacked instruction without the observer (Case 2). The numerical results in Table 2 clearly show that the proposed method significantly reduces the RMSE and achieves much faster convergence than the baseline.

(2) Performance analysis of state estimation: under dual-channel attacks (both instruction and sensor attacks), the performance of the state observer is evaluated. The proposed unknown input observer (8) is employed in RMC, with the initial state ${\sigma }_i(0)=0$, matrices

$$\begin{array}{cc}\hfill L& =\left[\begin{array}{ccc}0.2530& 0.4205& 0.1255\\ 0.4050& 0.6754& 0.2025\\ -1.8560& -3.0924& -0.9261\\ -0.0135& -0.02250& -0.0068\\ 0.0793& 0.13214& 0.0396\end{array}\right],R_1=\left[\begin{array}{ccc}0.8759& -0.2069& -0.0621\\ -0.2069& 0.6552& -0.1034\\ -0.0628& -0.1034& 0.9690\\ 0.0138& -0.0103& 0.0069\\ 0.02& 0& -0.04\end{array}\right],\hfill \end{array}$$

$$\begin{array}{cc}\hfill R_2& =\left[\begin{array}{ccc}0.1241& 0.2069& 0.0621\\ 0.2069& 0.3448& 0.1034\\ 0.0621& 0.1034& 0.0310\\ -0.0138& 0.0103& -0.01\\ -0.02& 0.00& 0.04\end{array}\right].\hfill \end{array}$$

To comprehensively demonstrate the effectiveness and robustness of the state observer, we consider two cases:

Case 1: simultaneously estimate instructions and states using observers (17) and (8), respectively;

Case 2: Only use observer (8) to estimate the system state (i.e., agents directly utilize the attacked instruction ${\tilde{r}}_i(t)$).

For each case, we analyze the convergence of the state estimation error $e_i^x(t)=\parallel {\widehat{x}}_i(t)-x_i(t)\parallel$ and the stability of the vehicle states (Whether the vehicle has collided, i.e., the state component $d_i(t)$). The simulation results are depicted in Figure 6. Figure 6 illustrates the norm of the state estimation error over time. In case 1, where both observers are employed, the state estimation error converges to zero rapidly, confirming that the method in this paper can achieve accurate state estimation despite dual-channel attacks. In case 2, where only the state observer (8) is used, the state estimation error also converges to zero; however, the vehicle states become unstable due to the propagation of instruction errors, and even collisions occur. This highlights that the state observer (8) can decouple the effects of instruction attacks and provide unbiased estimates, even if the control inputs are compromised.

5. Conclusions

This paper investigated the problems of secure state estimation and instruction adjustment for MASs subject to concurrent FDI attacks on both sensor and instruction channels. The key challenge of decoupling state estimation from instruction attacks has been successfully addressed through the innovative design of a distributed unknown input observer and a distributed adaptive saturation-based instruction observer. The proposed collaborative estimation method ensures accurate state estimation even when control inputs are compromised due to instruction attacks and simultaneously maintaining bounded instruction estimation errors. Both theoretical analysis and numerical simulations confirm the effectiveness of the proposed method in countering dual-channel attacks, significantly bolstering the security and resilience of MASs in adversarial network environments.

We note that the proposed approach relies on relatively strong rank conditions and on a fixed, undirected communication topology, which limits its generality. In future work, we will aim to relax such constraints and extend the framework to more practical environments with measurement noise, communication loss, and time-varying topologies.