  This paper investigates the problem of synthesizing sensor deception
attackers against privacy in the context of supervisory control of
discrete-event systems (DES). We consider a DES plant controlled by a
supervisor, which is subject to sensor deception attacks. Specifically, we
consider an active attacker that can tamper with the observations received by
the supervisor by, e.g., hacking on the communication channel between the
sensors and the supervisor. The privacy requirement of the supervisory control
system is to maintain initial-state opacity, i.e., it does not want to reveal
the fact that it was initiated from a secret state during its operation. On the
other hand, the attacker aims to deceive the supervisor, by tampering with its
observations, such that initial-state opacity is violated due to incorrect
control actions. In this work, we investigate from the attacker's point of view
by presenting an effective approach for synthesizing sensor attack strategies
threatening the privacy of the system. To this end, we propose the All Attack
Structure (AAS) that records state estimates for both the supervisor and the
attacker. This structure serves as a basis for synthesizing a sensor attack
strategy. We also discuss how to simplify the synthesis complexity by
leveraging the structural property of the initial-state privacy requirement. A
running academic example is provided to illustrate the synthesis procedure.
