  As more attention is paid to security in the context of control systems and
as attacks occur to real control systems throughout the world, it has become
clear that some of the most nefarious attacks are those that evade detection.
The term stealthy has come to encompass a variety of techniques that attackers
can employ to avoid detection. Here we show how the states of the system (in
particular, the reachable set corresponding to the attack) can be manipulated
under two important types of stealthy attacks. We employ the chi-squared fault
detection method and demonstrate how this imposes a constraint on the attack
sequence either to generate no alarms (zero-alarm attack) or to generate alarms
at a rate indistinguishable from normal operation (hidden attack).
