Rong Su

Avalpreet Singh Brar, Rong Su, Christos G. Cassandras et al.

Ride-hailing platforms frequently face spatiotemporal supply-demand imbalances caused by uneven passenger demand and decentralized driver decision-making. Existing vehicle rebalancing methods typically assume drivers always follow repositioning recommendations or model adherence using static probabilities. In practice, adherence evolves through repeated interactions with the platform. We propose the Adherence-Aware Vehicle Rebalancing (AAVR) model, which generates simultaneous fleet-wide repositioning recommendations while explicitly accounting for driver preferences and dynamically evolving adherence. The resulting optimization problem is computationally intractable, so we derive a tractable upper-bound reformulation that enables real-time recommendation generation for large-scale systems. Simulations on the NYC taxi dataset under dynamic adherence updates show that AAVR consistently outperforms state-of-the-art methods, improving served demand by 26.72%, reducing passenger waiting time by 26.45%, increasing platform and driver profits by 25.90% and 28.75%, respectively, and improving fleet adherence by 30.06%. These results demonstrate that modeling evolving driver adherence improves both operational performance and long-term adherence to platform recommendations.

Yuting Zhu, Liyong Lin, Rong Su

In this paper, we propose and address the problem of supervisor obfuscation against actuator enablement attack, in a common setting where the actuator attacker can eavesdrop the control commands issued by the supervisor. We propose a method to obfuscate an (insecure) supervisor to make it resilient against actuator enablement attack in such a way that the behavior of the original closed-loop system is preserved. An additional feature of the obfuscated supervisor, if it exists, is that it has exactly the minimum number of states among the set of all the resilient and behavior-preserving supervisors. Our approach involves a simple combination of two basic ideas: 1) a formulation of the problem of computing behavior-preserving supervisors as the problem of computing separating finite state automata under controllability and observability constraints, which can be efficiently tackled by using modern SAT solvers, and 2) the use of a recently proposed technique for the verification of attackability in our setting, with a normality assumption imposed on both the actuator attackers and supervisors.

Liyong Lin, Rong Su

In this paper, we investigate the problem of synthesizing resilient supervisors against combined actuator and sensor attacks, for the subclass of cyber-physical systems that can be modelled as discrete-event systems. We assume that the attackers can carry out actuator enablement and disablement attacks as well as sensor replacement attacks. We consider both risky attackers and covert attackers in the setup where the (partial-observation) attackers may or may not eavesdrop the control commands (issued by the supervisor). A constraint-based approach for the bounded synthesis of resilient supervisors is developed, by reducing the problem to the Quantified Boolean Formulas (QBF) problem. The bounded synthesis problem can then be solved either with a QBF solver or with repeated calls to a propositional satisfiability (SAT) solver, by employing maximally permissive attackers, which can be synthesized with the existing partial-observation supervisor synthesis procedures, as counter examples in the counter example guided inductive synthesis loop.

Liyong Lin, Tomáš Masopust, W. Murray Wonham et al.

A reduction of a source distribution is a collection of smaller sized distributions that are collectively equivalent to the source distribution with respect to the property of decomposability. That is, an arbitrary language is decomposable with respect to the source distribution if and only if it is decomposable with respect to each smaller sized distribution (in the reduction). The notion of reduction of distributions has previously been proposed to improve the complexity of decomposability verification. In this work, we address the problem of generating (optimal) reductions of distributions automatically. A (partial) solution to this problem is provided, which consists of 1) an incremental algorithm for the production of candidate reductions and 2) a reduction validation procedure. In the incremental production stage, backtracking is applied whenever a candidate reduction that cannot be validated is produced. A strengthened substitution-based proof technique is used for reduction validation, while a fixed template of candidate counter examples is used for reduction refutation; put together, they constitute our (partial) solution to the reduction verification problem. In addition, we show that a recursive approach for the generation of (small) reductions is easily supported.

Liyong Lin, Sander Thuijsman, Yuting Zhu et al.

In this work, we propose and develop a new discrete-event based actuator attack model on the closed-loop system formed by the plant and the supervisor. We assume the actuator attacker partially observes the execution of the closed-loop system and eavesdrops the control commands issued by the supervisor. The attacker can modify each control command on a specified subset of attackable events. The attack principle of the actuator attacker is to remain covert until it can establish a successful attack and lead the attacked closed-loop system into generating certain damaging strings. We present a characterization for the existence of a successful attacker, via a new notion of attackability, and prove the existence of the supremal successful actuator attacker, when both the supervisor and the attacker are normal (that is, unobservable events to the supervisor cannot be disabled by the supervisor and unobservable events to the attacker cannot be attacked by the attacker). Finally, we present an algorithm to synthesize the supremal successful attackers that are represented by Moore automata.

Liyong Lin, Yuting Zhu, Rong Su

In this paper, we shall formulate and address a problem of covert actuator attacker synthesis for cyber-physical systems that are modelled by discrete-event systems. We assume the actuator attacker partially observes the execution of the closed-loop system and is able to modify each control command issued by the supervisor on a specified attackable subset of controllable events. We provide straightforward but in general exponential-time reductions, due to the use of subset construction procedure, from the covert actuator attacker synthesis problems to the Ramadge-Wonham supervisor synthesis problems. It then follows that it is possible to use the many techniques and tools already developed for solving the supervisor synthesis problem to solve the covert actuator attacker synthesis problem for free. In particular, we show that, if the attacker cannot attack unobservable events to the supervisor, then the reductions can be carried out in polynomial time. We also provide a brief discussion on some other conditions under which the exponential blowup in state size can be avoided. Finally, we show how the reduction based synthesis procedure can be extended for the synthesis of successful covert actuator attackers that also eavesdrop the control commands issued by the supervisor.

Ahmad Reza Shehabinia, Liyong Lin, Rong Su

In this paper, we model an operational planning and scheduling problem under multiple job deadlines in a time-weighted automaton framework. We first present a method to determine whether all given job specifications and deadlines can be met by computing a supremal controllable job satisfaction sublanguage. When this supremal sublanguage is not empty, we compute one of its controllable sublanguages that ensures the minimum total job earliness by adding proper delays. When this supremal sublanguage is empty, we will determine the minimal sets of job deadlines that need to be relaxed.

Hong Liu, Haosen Yang, Evi M. C. Huijben et al.

Tumor segmentation plays a critical role in histopathology, but it requires costly, fine-grained image-mask pairs annotated by pathologists. Thus, synthesizing histopathology data to expand the dataset is highly desirable. Previous works suffer from inaccuracies and limited diversity in image-mask pairs, both of which affect training segmentation, particularly in small-scale datasets and the inherently complex nature of histopathology images. To address this challenge, we propose PathoPainter, which reformulates image-mask pair generation as a tumor inpainting task. Specifically, our approach preserves the background while inpainting the tumor region, ensuring precise alignment between the generated image and its corresponding mask. To enhance dataset diversity while maintaining biological plausibility, we incorporate a sampling mechanism that conditions tumor inpainting on regional embeddings from a different image. Additionally, we introduce a filtering strategy to exclude uncertain synthetic regions, further improving the quality of the generated data. Our comprehensive evaluation spans multiple datasets featuring diverse tumor types and various training data scales. As a result, segmentation improved significantly with our synthetic data, surpassing existing segmentation data synthesis approaches, e.g., 75.69% -> 77.69% on CAMELYON16. The code is available at https://github.com/HongLiuuuuu/PathoPainter.

Rong Su

Cybersecurity of discrete event systems (DES) has been gaining more and more attention recently, due to its high relevance to the so-called 4th industrial revolution that heavily relies on data communication among networked systems. One key challenge is how to ensure system resilience to sensor and/or actuator attacks, which may tamper data integrity and service availability. In this paper we focus on some key decidability issues related to smart sensor attacks. We first present a sufficient and necessary condition that ensures the existence of a smart sensor attack, which reveals a novel demand-supply relationship between an attacker and a controlled plant, represented as a set of risky pairs. Each risky pair consists of a damage string desired by the attacker and an observable sequence feasible in the supervisor such that the latter induces a sequence of control patterns, which allows the damage string to happen. It turns out that each risky pair can induce a smart weak sensor attack. Next, we show that, when the plant, supervisor and damage language are regular, it is computationally feasible to remove all such risky pairs from the plant behaviour, via a genuine encoding scheme, upon which we are able to establish our key result that the existence of a nonblocking supervisor resilient to smart sensor attacks is decidable. To the best of our knowledge, this is the first result of its kind in the DES literature on cyber attacks. The proposed decision process renders a specific synthesis procedure that guarantees to compute a resilient supervisor whenever it exists, which so far has not been achieved in the literature.

Rong Su

One of the major challenges about cyber physical systems is how to prevent cyber attacks to ensure system integrity. There has been a large number of different types of attacks discussed in the modern control and computer science communities. In this paper we aim to investigate one special type of attacks in the discrete-event system framework, where an attacker can arbitrarily alter sensor readings after intercepting them from a target system in order to trick a given supervisor to issue control commands improperly, driving the system to an undesirable state. We first consider the cyber attack problem from an attacker point of view, and formulate an attack with bounded sensor reading alterations (ABSRA) problem. We then show that the supremal (or least restrictive) ABSRA exists and can be synthesized, as long as the plant model and the supervisor model are regular, i.e., representable by finite-state automata. Upon the synthesis of the supremal ABSRA, we present a synthesis algorithm, which ensures that a computed supervisor will be ABSRA-robust , i.e., either an ABSRA will be detectable or will not lead the system to an undesirable state.

Rong Su

To make a supervisor comprehensible to a layman has been a long-lasting goal in the supervisory control community. One strategy is to reduce the size of a supervisor to generate a control equivalent version, whose size is hopefully much smaller than the original one so that a user or control designer can easily check whether a designed controller fulfils its objectives and requirements. After the first journal paper on this topic appeared in 1986 by Vaz and Wonham, which relied on the concept of control covers, in 2004 Su and Wonham proposed to use control congruences to ensure computational viability. This work is later adopted in the supervisor localization theory, which aims for a control equivalent distributed implementation of a given centralized supervisor. But after so many publications, some fundamental questions, which should have been addressed in the first place, have not been answered yet, namely what information is critical to ensure control equivalence, what information is responsible for size reduction, and whether the partial observation really makes things different. In this paper we will address these fundamental questions by showing that there does exist a unified supervisor reduction theory, which is applicable to all feasible supervisors regardless of whether they are under full observation or partial observation. Our theory provides a partial order over all control equivalent feasible supervisors based on their enabling, disabling and marking information, which can be used to categorize the corresponding reduction rates. Based on this result we can see that, given two control equivalent feasible supervisors, the one under full observation can always result in a reduced supervisor no bigger than that induced by a supervisor under partial observation.