  Security issues have gathered growing interest within the control systems
community, as physical components and communication networks are increasingly
vulnerable to cyber attacks. In this context, recent literature has studied
increasingly sophisticated \emph{false data injection} attacks, with the aim to
design mitigative measures that improve the systems' security. Notably,
data-driven attack strategies -- whereby the system dynamics is oblivious to
the adversary -- have received increasing attention. However, many of the
existing works on the topic rely on the implicit assumption of linear system
dynamics, significantly limiting their scope. Contrary to that, in this work we
design and analyze \emph{truly} model-free false data injection attack that
applies to general linear and nonlinear systems. More specifically, we aim at
designing an injected signal that steers the output of the system toward a
(maliciously chosen) trajectory. We do so by designing a zeroth-order feedback
optimization policy and jointly use probing signals for real-time measurements.
We then characterize the quality of the proposed model-free attack through its
optimality gap, which is affected by the dimensions of the attack signal, the
number of iterations performed, and the convergence rate of the system.
Finally, we extend the proposed attack scheme to the systems with internal
noise. Extensive simulations show the effectiveness of the proposed attack
scheme.
