Adaptive Randomized Asynchronous Sampling and Distributed Detection for Resilient Consensus of Heterogeneous Multiagent Systems Under Schedule-Aware Zero-Dynamics Attacks

Abstract

Zero-dynamics attacks (ZDAs) inject signals that keep the monitored outputs at their nominal values while the internal states diverge. In sampled-data multiagent systems (MASs) the attack uses unstable invariant zeros of the discretized model. Liu et al. [1] showed that asynchronous sampling with integer-ratio periods removes the destructive sampling zeros of homogeneous second-order MASs. That countermeasure runs on a fixed schedule, and an attacker who reads packet timestamps can recover the schedule, rebuild the sampled model, and attack again. We propose adaptive randomized asynchronous sampling (ARAS) together with a distributed windowed χ² detector for heterogeneous MASs with agent-specific measurement coefficients. We show that the invariant zeros of the sampled network split into one zero per agent and give closed-form conditions on the coefficients and the period. When the attacker does not know the current sampling mode at the moment it commits its input, a perfectly stealthy attack survives K consecutive steps with probability at most (1 − (m − 1)p_min)^K, and the residual seen by the detector has an explicit lower bound. If the current mode leaks to the attacker, the guarantee disappears, so the secrecy of the draw is part of the design. Mean-square practical consensus under measurement noise follows from a windowed contraction condition that holds for every admissible schedule, independently of the adaptation. In 500 Monte Carlo trials per configuration on a four-quadrotor formation, a schedule-aware attacker succeeded in 99.8% of the runs against deterministic asynchronous sampling and in 5.6% (95% CI 3.9% to 8.0%) against ARAS. ARAS sent 29.7% more control messages than synchronous sampling, against 49.0% for the deterministic scheme. We also report ablations, detector operating curves, and tests with up to 50 agents, four topologies, four noise levels, several attack strengths, and partially informed attackers.