  Recent research demonstrated that the superficially well-trained machine
learning (ML) models are highly vulnerable to adversarial examples. As ML
techniques are becoming a popular solution for cyber-physical systems (CPSs)
applications in research literatures, the security of these applications is of
concern. However, current studies on adversarial machine learning (AML) mainly
focus on pure cyberspace domains. The risks the adversarial examples can bring
to the CPS applications have not been well investigated. In particular, due to
the distributed property of data sources and the inherent physical constraints
imposed by CPSs, the widely-used threat models and the state-of-the-art AML
algorithms in previous cyberspace research become infeasible.
  We study the potential vulnerabilities of ML applied in CPSs by proposing
Constrained Adversarial Machine Learning (ConAML), which generates adversarial
examples that satisfy the intrinsic constraints of the physical systems. We
first summarize the difference between AML in CPSs and AML in existing
cyberspace systems and propose a general threat model for ConAML. We then
design a best-effort search algorithm to iteratively generate adversarial
examples with linear physical constraints. We evaluate our algorithms with
simulations of two typical CPSs, the power grids and the water treatment
system. The results show that our ConAML algorithms can effectively generate
adversarial examples which significantly decrease the performance of the ML
models even under practical constraints.
