  Learning-enabled controllers used in cyber-physical systems (CPS) are known
to be susceptible to adversarial attacks. Such attacks manifest as
perturbations to the states generated by the controller's environment in
response to its actions. We consider state perturbations that encompass a wide
variety of adversarial attacks and describe an attack scheme for discovering
adversarial states. To be useful, these attacks need to be natural, yielding
states in which the controller can be reasonably expected to generate a
meaningful response. We consider shield-based defenses as a means to improve
controller robustness in the face of such perturbations. Our defense strategy
allows us to treat the controller and environment as black-boxes with unknown
dynamics. We provide a two-stage approach to construct this defense and show
its effectiveness through a range of experiments on realistic continuous
control domains such as the navigation control-loop of an F16 aircraft and the
motion control system of humanoid robots.
