Adversarial Tradeoffs in Robust State Estimation

Our work makes connections between adversarial robustnesss and robust estimation and control. We now provide a brief overview of work related to ours from these areas.

Robustness-accuracy tradeoffs: We draw inspiration from recent work offering theoretical characterizations of robustness-accuracy tradeoffs: Tsipras et al. (2018) and Zhang et al. (2019) posit that high standard accuracy is fundamentally at odds with high robust accuracy by considering classification problems, whereas Nakkiran (2019) suggests an alternative explanation that classifiers that are simultaneously robust and accurate are complex, and may not be contained in current function classes. However, Raghunathan et al. (2019) shows that the tradeoff is not due to optimization or representation issues by showing that such tradeoffs exist even for a problem with a convex loss where the optimal predictor achieves 100% standard and robust accuracy. In contrast to previous work, we provide sharp and interpretable characterizations of the robustness-accuracy tradeoffs that may arise in inverse problems, albeit restricted to linear models. Most closely related to our work, Javanmard et al. (2020) derive a formula for the exact tradeoff between standard and robust accuracy in the linear regression setting. We derive similar results for a matrix-valued linear inverse problem, and apply these tools to the adversarially robust Kalman Filtering problem, wherein data is generated by a dynamical system.

Robust estimation and control: Robustness in estimation and control has traditionally been studied from a worst-case induced gain perspective (Hassibi et al., 1999; Zhou and Doyle, 1998). When perturbations are restricted to be $\ell^{2}$-bounded, this gives rise to $\mathcal{H}_{\infty}$ estimation and control problems. Although widely known, and celebrated for their applications in robust control, $\mathcal{H}_{\infty}$-based methods are often overly conservative. This conservatism can be reduced by using mixed $\mathcal{H}_{2}/\mathcal{H}_{\infty}$ methods (Khargonekar et al., 1996), which blend Gaussian and worst-case disturbance assumptions. While such an approach is related to the adversarially robust Kalman Filtering problem that we pose, we note that mixed $\mathcal{H}_{2}/\mathcal{H}_{\infty}$ decouples the worst-case and stochastic inputs during design, leading to a fundamentally different tradeoff. On the other hand, our method considers the stochastic and worst-case components jointly, finding the optimal filter robust to $\ell^{2}$-bounded disturbances given the realizations of stochastic noise. We note the decoupling of worst-case and stochastic inputs allows mixed $\mathcal{H}_{2}/\mathcal{H}_{\infty}$ methods to guarantee stability under dynamic uncertainties. We leave similar guarantees for the filtering problem that we pose, and further characterizing connections between traditional and adversarial robustness to future work. More recently, Al Makdah et al. (2020) have considered the robustness-accuracy tradeoff in data-driven perception-based control. However, the adversary in Al Makdah et al. (2020) perturbs the covariance of the noise distribution, which is assumed to remain Gaussian, whereas our adversary additively attacks each measurement, which is more aligned to the perturbations considered in machine learning and robust control contexts. Additionally, Al Makdah et al. (2020) does not quantitatively analyze the severity of tradeoffs, but rather proves the existence of tradeoffs. Our prior work Lee et al. (2022) studies analogous tradeoffs to the ones in this paper arising in the setting of adversarially robust LQR, and bounds the severity of these tradeoffs in terms of the spectral properties of the controllability gramian.

The Kalman filter is designed for the setting where the underlying dynamical system is linear, and disturbances are Gaussian. In particular, consider a linear-time-invariant (LTI) autonomous system with state and measurement disturbances: let $x_{t}\in\mathbb{R}^{n}$ be the system state, $w_{t}\in\mathbb{R}^{n}$ the process noise, $y_{t}\in\mathbb{R}^{p}$ the measurement, and $v_{t}\in\mathbb{R}^{p}$ the measurement noise. The initial condition, process noise, and measurement noise are assumed to be i.i.d. zero-mean Gaussians: $x_{0}\sim{}\mathcal{N}(0,\Sigma_{0})$, $w_{t}\overset{\mathrm{i.i.d.}}{\sim}\mathcal{N}(0,\Sigma_{w})$, $v_{t}\overset{\mathrm{i.i.d.}}{\sim}\mathcal{N}(0,\Sigma_{v})$. The LTI system is then defined by:

Finite horizon state estimation determines an estimate for the state of the system at time $k$ given some sequence of measurements $y_{0},\dots,y_{N}$. This problem encompasses smoothing ($k<N$), filtering ($k=N$), and prediction ($k>N$). When the measurement and process noise satisfy the assumptions above, the optimal state estimator is the celebrated Kalman filter (or smoother/predictor), which produces state estimates that are a linear function of the observations. Therefore, the optimal estimate $\hat{x}_{k}$ of the state $x_{k}$ at time $k$ can be written as¹¹1State-space representations for the Kalman filter (see Appendix A) also exist (Hassibi et al., 1999), but for our purposes it is more convenient to view it as a linear map. $\hat{x}_{k}:=LY_{N}$, where $L\in\mathbb{R}^{n\times p(N+1)}$ is some matrix and $Y_{N}$ is a vector of stacked observations

We similarly define the stacked process and measurement noise vectors as

Furthermore, suppose $k\leq N$ and let

so that $Y_{N}=\mathcal{O}_{N}x_{0}+\tau_{N}W_{N}+V_{N}$ and $x_{k}=A^{k}x_{0}+\Gamma_{k}W_{N}$. Here $\mathcal{O}_{N}$ is the $N$-step observability matrix, which is a quantity of interest in our analysis. Recall that a system of the form (1) is observable if and only if the observability matrix $\mathcal{O}_{n-1}$ has rank $n$.

As stated, observability is a binary notion that determines whether state consistent estimation is possible. However, observability does not capture the conditioning of the problem defining the Kalman filter.

The observability gramian provides significantly more information about the difficulty of state estimation than the rank condition on the observability matrix. In particular, the ellipsoid $\left\{x\,|\,x^{\top}W_{o}(\infty)x\leq 1\right\}$ contains the initial states $x$ that lead to measurement signals with $\ell^{2}$ norm bounded by $1$ in the absense of process and measurement noise. To see this, let $x_{0}=x$. Then we have $x_{0}^{\top}W_{o}(\infty)x_{0}=\sum_{t=0}^{\infty}x_{0}^{\top}\left(A^{t}\right)^{\top}C^{\top}CA^{t}x_{0}=\sum_{t=0}^{\infty}x_{t}^{\top}C^{\top}Cx_{t}=\sum_{t=0}^{\infty}\left\|y_{t}\right\|_{2}^{2}$. As such, small eigenvalues of the observability gramian imply that a large subset of the state space leads to relatively small impacts on future measurements. This makes it difficult to use measurements to distinguish states in this region in the presence of process and measurement noise, requiring high-gain estimators. This in turn suggests that such estimators may be more susceptible to small adversarial perturbations.

We begin by reviewing relevant results from standard Kalman Filtering and Smoothing.

As earlier stated, no closed-form expression exists for the adversarially robust estimation problem: indeed, even in scalar linear regression studied in (Javanmard et al., 2020), it is characterized by a recursive relationship. Furthermore, the techniques used to derive that recursion do not extend to the multi-variable case.

To address this challenge, we show how to efficiently compute solutions to the inner maximization in (3). We observe that the maximization $\max_{\left\|\delta\right\|_{2}\leq\varepsilon}\left\|x_{k}-L(Y_{N}+\delta)\right\|_{2}^{2}$ can be expanded and re-written as the following (non-convex) quadratically-constrained quadratic maximization problem:

where we set $b:=x_{k}-LY_{N}$. Let $L=U\begin{bmatrix}\Sigma&0\end{bmatrix}V^{\top}\in\mathbb{R}^{n\times(N+1)p}$ be the full singular-value decomposition of $L$, with $U\in\mathbb{R}^{n\times n}$, $\Sigma\in\mathbb{R}^{n\times(N+1)p}$, $V\in\mathbb{R}^{(N+1)p\times(N+1)p}$, and $\Sigma=\mathrm{diag}(\sigma_{1},\dots,\sigma_{n})$, $\sigma_{1}\geq\cdots\geq\sigma_{n}\geq 0$ the singular values of $L$. We also denote the columns of $U$ and $V$ by $u_{i}$ and $v_{i}$, respectively. It is known that (P) satisfies strong duality (Boyd and Vandenberghe, 2004) and the optimal primal-dual pair $(\delta^{*},\lambda^{*})$ can be characterized by the KKT conditions:

The KKT conditions can then be leveraged to solve for the optimal dual solution $\lambda^{*}$ and subsequently the optimal perturbation $\delta^{*}$. The full procedure is summarized in Algorithm 1.

We note that Boyd and Vandenberghe (2004) shows how to solve (P) via semidefinite programming. Algorithm 1, however, allows us to recycle the SVD of $L$ to solve (P) for different values of $b:=x_{k}-LY_{N}$ simply by solving a root finding problem for each $b$. This enables efficient batching when applying SGD to the outer minimization problem.

The proof of correctness for Algorithm 1 is detailed in Section B.2.

We note that the Kalman state estimation problem can be posed as a general linear inverse problem, where $x\sim\mathcal{N}(0,\Sigma_{x})$, $w\sim\mathcal{N}(0,\Sigma_{w})$, $y=Mx+w$, and our goal is to minimize one of the following risks

Although no closed-form expression exists for the adversarial risk $\operatorname{AR}(L)$ exists, we show now that interepretable upper and lower bounds on the robustness-accuracy tradeoff, as characterized by the gap $\operatorname{AR}(L)-\operatorname{SR}(L)$, can be derived. Such bounds predict the severity of the robustness-accuracy tradeoff based upon underlying properties of specific linear inverse problems. We further show that these bounds are tight in the sense that they are exact for certain classes of matrices $L$, and strong in the sense that the lower and upper bounds differ only in higher-order terms with respect to the adversarial budget $\varepsilon$.

The proof of these bounds relies on turning the inner maximization of the adversarial risk into various equivalent optimization problems, and utilizing the properties of Schur complements and the S-lemma. See Section C.1 for details.

We note that when $L^{\top}\in\mathbb{R}^{n}$, inequality (6) recovers the exact characterization of the gap $\operatorname{AR}(L)-\operatorname{SR}(L)$ provided in Javanmard et al. (2020); thus when $p=1$, the inequality (6) is in fact an equality. We also note that the upper and lower bounds differ only in the $\mathcal{O}(\varepsilon^{2})$ terms. This leads immediately to the following result.

The terms involving the eigenvalues of $L^{\top}L$ in our bounds also support the intuition that adversarial robustness is a form of implicit regularization, which is visualized in Figure 1. In the one-dimensional linear classification setting, this phenomenon is well-understood (Tsipras et al., 2018; Dobriban et al., 2020), where robustness to adversarial perturbations prevent a robust feature vector from relying on an aggregate of small features. We note that in the case of state estimation, we have in general $p<n$, and thus the quadratic factor in $\varepsilon$ is $0$ in the lower bound (5).

In the subsequent section, we will leverage bounds (5) and (6) from Theorem 3.2 to bound both the susceptibility and robustness of the Kalman Filter.

As stated in 2.1, $(A,C)$ is always assumed to be observable. Generalizations of our subsequent results to generic dynamics $A$ and positive definite covariance matrices are stated and proven in Appendix C: although more notationally cumbersome, they nevertheless convey the same overall trends.

Lemma 3.1 makes clear that the noise terms act as a regularizer: if $\sigma_{w}^{2}=\sigma_{v}^{2}=0$, then $\min_{L}\operatorname{SR}(L)=0$ and is achieved by $L=A^{k}(W_{o}(N))^{-1}\mathcal{O}_{N}^{\top}$. The gain of this filter has clear dependence upon the spectral properties of $W_{o}(N)$, indicating the key role that $W_{o}(N)$ plays in the robustness-accuracy tradeoffs satisfied by an LTI system (1). We formalize this intuition next. As a first step, we specialize the lower bound in Theorem 3.1 to the dynamical system setting.

We now turn our attention to studying the tradeoffs enjoyed by the Kalman Filter/Smoother $L=\hat{L}_{k}$ defined in Lemma 2.1. Since the Kalman estimator is the optimal estimator in the nominal setting and is commonly used in practice, instantiating Lemma 3.2 for $L=\hat{L}_{k}$ captures the susceptibility of a nominal estimator to small adversarial perturbations. To simplify notation in the subsequent results, we will denote $\sigma_{\vee}^{2}=\max\left\{\sigma_{0}^{2},\sigma_{w}^{2}\right\}$, $\sigma_{\wedge}^{2}=\min\left\{\sigma_{0}^{2},\sigma_{w}^{2}\right\}$ and

With these definitions, we have the following theorem.

We see that the lower bound increases as the Frobenius norm of the observability gramian decreases. This indicates that as observability becomes uniformly low, i.e., if all eigenvalues of $W_{o}(N)$ are small, then a nominal state estimator $\hat{L}_{k}$ will have a large gap $\operatorname{AR}(\hat{L}_{k})-\operatorname{SR}(\hat{L}_{k})$. Observe that increasing $\sigma_{w}$ will increase the lower bound shown above when $\sigma_{w}\leq\sigma_{0}$.

Again, we consider how this upper bound looks for the Kalman estimator $\hat{L}_{k}$.

The upper bound on the gap decreases as the minimum eigenvalue of the observability gramian increases. This indicates that as the observability of the system becomes uniformly large, the gap between standard and adversarial risk for the nominal Kalman estimator will decrease. Perhaps counter-intuitively, when observability is poor in some direction, i.e. when $\lambda_{\min}\left(W_{o}(N)\right)$ is small, increasing the sensor noise $\sigma_{v}$ will actually decrease the above upper bound, as long as $\lambda_{\min}\left(W_{o}(N)\right)\geq\frac{\sigma_{v}}{\sigma_{\wedge}^{2}}$. This aligns with results demonstrating that injecting artificial noise can improve the robustness of state observers (Doyle and Stein, 1979), and is further consistent with our interpretation of noise as a regularizer following Lemma 3.1.

We note that since the properties of the observability gramian $W_{o}(N)$ are tied to $\rho$, it is not immediately clear how to extract the role of stability $\rho\in[0,1]$ in either Equation 9 or Theorem 3.3. This is to be expected, as the fragility of the Kalman Filter has more to do with the observability of the system rather than its autonomous stability. For example, when $C^{\top}C=I$, corresponding to maximal observability $W_{o}(N)=r_{k}(\rho)$, and $k\leq\mathcal{O}(N)$, then the dominant terms in the lower and upper bound are essentially independent of $\rho$ when $N$ is large.