Inverting Self-Triggered Control: Adversarial Reinforcement Learning for Sparse Denial-of-Service Attacks

A new arXiv paper (2609.12016v1) reports that an adversarial reinforcement learning agent learned the sparsest jamming or Denial-of-Service schedule that destabilizes self-triggered control loops, achieving a 100% crash rate against every defender on every plant tested. The authors trained against four fixed defenders per plant — one Linear Quadratic Regulator and three RL-STC controllers — on Pendulum, CartPole, and Quadrotor2D, where greedy missed Quadrotor2D LQR on 42% of episodes and periodic missed Pendulum LQR on 97%. The learned adversary beat baselines by up to 2.8x on jam-time-per-failure and maintained a 100% failure rate under Gaussian observation noise exceeding the initial-state magnitude and under position-only observation.

arXiv:2609.12016v1 Announce Type: new Abstract: Self-triggered reinforcement learning control RL-STC learns the sparsest control schedule that preserves Lyapunov-decreasing stability under a Run-Time Assurance RTA override. We invert this: an adversarial RL agent learns the sparsest jamming or Denial-of-Service DoS schedule that destabilizes the closed loop, with a Lyapunov-increase admissibility predicate mirroring the defender's safety certificate. We prove a plant-property lower bound on the minimum jam count required for an immediate hold-last medium-access-control adversary to force a crash against a self-triggered controller STC satisfying a Lyapunov contract, and recover a certificate-level analog of the consecutive-grouping optimality of prior count-budget DoS scheduling as a corollary. This extends the DoS-scheduling count-budget analysis from periodic and linear-time-invariant to STC controllers. Empirically, we train against four fixed defenders per plant one Linear Quadratic Regulator LQR and three RL-STC on Pendulum, CartPole, and Quadrotor2D. The learned adversary is the only adversary that crashes every defender on every plant at $100\%$: greedy misses Quadrotor2D LQR on $42\%$ of episodes and periodic misses Pendulum LQR on $97\%$. On jam-time-per-failure it beats baselines by up to $2.8\times$, and shows its widest absolute margin on Quadrotor2D LQR. Robustness ablations show that Gaussian observation noise exceeding the initial-state magnitude and position-only observation both preserve $100\%$ failure rate and keep the learned adversary strictly ahead of both baselines on jam-time-per-failure.