  In this paper, we consider the problem of synthesizing the supremal covert
damage-reachable attacker, in the setup where the model of the supervisor is
unknown to the adversary but the adversary has recorded a (prefix-closed)
finite set of observations of the runs of the closed-loop system. The
synthesized attacker needs to ensure both the damage-reachability and the
covertness against all the supervisors which are consistent with the given set
of observations. There is a gap between the de facto supremality, assuming the
model of the supervisor is known, and the supremality that can be attained with
a limited knowledge of the model of the supervisor, from the adversary's point
of view. We consider the setup where the attacker can exercise sensor
replacement/deletion attacks and actuator enablement/disablement attacks. The
solution methodology proposed in this work is to reduce the synthesis of the
supremal covert damage-reachable attacker, given the model of the plant and the
finite set of observations, to the synthesis of the supremal safe supervisor
for certain transformed plant, which shows the decidability of the
observation-assisted covert attacker synthesis problem. The effectiveness of
our approach is illustrated on a water tank example adapted from the
literature.
