  This paper studies attackers with control objectives against cyber-physical
systems (CPS). The system is equipped with its own controller and attack
detector, and the goal of the attacker is to move the system to a target state
while altering the system's actuator input and sensor output to avoid
detection. We formulate a cost function that reflects the attacker's goals,
and, using dynamic programming, we show that the optimal attack strategy
reduces to a linear feedback of the attacker's state estimate. By changing the
parameters of the cost function, we show how an attacker can design optimal
attacks to balance the control objective and the detection avoidance objective.
Finally, we provide a numerical illustration based on a remotely-controlled
helicopter under attack.
