  Controller confidentiality under sensor attacks refers to whether the
internal states of the controller can be estimated when the adversary knows the
model of the plant and controller, while only having access to sensors, but not
the actuators. We show that the controller's state can be estimated accurately
when the nonlinear closed-loop system is detectable. In the absence of
detectability, controller confidentiality can still be breached with a periodic
probing scheme via the sensors under a robust observability assumption, which
allows for the controller's state to be estimated with arbitrary accuracy
during the probing period, and with bounded error during the non-probing
period. Further, stealth can be maintained by choosing an appropriate probing
duration. This study shows that the controller confidentiality for nonlinear
systems can be breached by balancing the estimation precision and the
stealthiness of the adversary.
