[table]capposition=top

# Risk assessment and optimal allocation of security measures under stealthy
false data injection attacks

Sribalaji C. Anand1, André M. H. Teixeira2, and Anders Ahlén1 *This work is
supported by the Swedish Research Council under the grant 2018-04396 and by
the Swedish Foundation for Strategic Research.1 Sribalaji C. Anand and Anders
Ahlén are with the Department of Electrical Engineering, Uppsala University,
PO Box 65, SE-75103, Uppsala, Sweden<EMAIL_ADDRESS>André M.
H. Teixeira is with the Department of Information Technology, Uppsala
University, PO Box 337, SE -75105, Uppsala, Sweden<EMAIL_ADDRESS>
###### Abstract

This paper firstly addresses the problem of risk assessment under false data
injection attacks on uncertain control systems. We consider an adversary with
complete system knowledge, injecting stealthy false data into an uncertain
control system. We then use the Value-at-Risk to characterize the risk
associated with the attack impact caused by the adversary. The worst-case
attack impact is characterized by the recently proposed output-to-output gain.
We observe that the risk assessment problem corresponds to an infinite non-
convex robust optimization problem. To this end, we use dissipative system
theory and the scenario approach to approximate the risk-assessment problem
into a convex problem and also provide probabilistic certificates on
approximation. Secondly, we consider the problem of security measure
allocation. We consider an operator with a constraint on the security budget.
Under this constraint, we propose an algorithm to optimally allocate the
security measures using the calculated risk such that the resulting Value-at-
risk is minimized. Finally, we illustrate the results through a numerical
example. The numerical example also illustrates that the security allocation
using the Value-at-risk, and the impact on the nominal system may have
different outcomes: thereby depicting the benefit of using risk metrics.

##  I Introduction

Critical infrastructures describe the assets that are vital for the normal
operation of society. In general, control systems are an integral part of
critical infrastructures. Examples include pH control systems in a bioreactor,
frequency control of power generating systems, etc. Due to the vitality of
their operation, and partly due to advances in technology, these control
systems are monitored regularly through wireless digital communication
channels [1]. And due to the increased use of non-secure communication
channels, the control systems are prone to cyber-attacks such as the attack on
the Ukrainian power grid, and the Kemuri cyber attack to name a few [2]. Thus
there is an increased research interest in the cyber-security of control
systems [3].

One of the common recommendations for improving the security of control
systems is to follow the risk management cycle: Risk assessment, risk
response, and risk monitoring [4]. The risk assessment step involves careful
consideration of risk sources, their likelihood, and their consequences. The
consequence can be quantified in terms of impact which can be obtained through
simulation or optimization-based methods. The risk response step involves
implementing additional measures to minimize the risk if and when necessary.
The risk response step can involve either $(i)$ re-designing of the system
controller/detectors to be robust against attacks, or $(ii)$ allocating
additional security measures such as encrypted communication channels.
Finally, the risk monitoring step involves constant monitoring of the risk at
acceptable intervals of time. This paper studies the risk assessment and risk
response step of the risk management cycle.

Although the risk assessment and the risk response steps have been studied in
the literature [4, Chapter 2], there are some research gaps that are outlined
next. Firstly, the majority of the literature considers a deterministic system
[5, 6]. Secondly, the risk frameworks are mostly application-specific. For
instance, [7, 8] and [9] determine the risk of cyber-attacks on automatic
generation control, power systems, and energy storage systems in smart grids
respectively.

To address these limitations, we consider the following setup. A discrete-time
(DT) linear time-invariant (LTI) process with uncertainties, an output
feedback controller, and an anomaly detector. A stealthy adversary with
complete system knowledge injects false data into the sensor or actuator
channels for a long but finite amount of time. With this setup, we provide the
following contributions.

  1. 1.

We formulate the risk assessment problem using the Value-at-Risk (VaR) as a
risk metric and the Output-to-Output Gain (OOG) as an impact metric.

  2. 2.

We observe that the risk-assessment problem is NP-hard in general. To this
end, we propose an approximate risk assessment problem that is computationally
tractable.

  3. 3.

We show that the approximate risk assessment problem can be solved by an
equivalent convex semi-definite program (SDP). We provide the necessary and
sufficient conditions for the (approximate) risk to be bounded.

  4. 4.

We provide a preliminary algorithm to optimally allocate security measures
using the calculated risk.

  5. 5.

We numerically illustrate that the security measure allocation using the
Value-at-risk, and the impact on the nominal system may have different
outcomes. We thereby depict the advantage of using risk metrics as suggested
in this paper.

The remainder of the paper is organized as follows. The control system and the
adversary are described in Section II. The risk assessment problem (RAP) is
formulated in Section III. We approximate the RAP and convert it to a convex
SDP in Section IV. In Section V we formulate the security measure allocation
problem (SMAP) and provide an algorithm which solves the SMAP for small-scale
systems. The results are illustrated through a numerical example in Section
VI. Finally, we conclude the paper in Section VII.

Notation: Throughout this paper, $\mathbb{R},\mathbb{C},\mathbb{Z}$ and
$\mathbb{Z}^{+}$ represent the set of real numbers, complex numbers, integers
and non-negative integers respectively. A positive semi-definite matrix $A$ is
denoted by $A\succeq 0$. Let $x:\mathbb{Z}\to\mathbb{R}^{n}$ be a discrete-
time signal with $x[k]$ as the value of the signal $x$ at the time step $k$.
Let the time horizon be $[0,N]=\\{k\in\mathbb{Z}^{+}|\;0\leq k\leq N\\}$. The
$\ell_{2}$-norm of $x$ over the horizon $[0,N]$ is represented as
$||x||_{\ell_{2},[0,N]}^{2}\triangleq\sum_{k=0}^{N}x[k]^{T}x[k]$. Let the
space of square summable signals be defined as
$\ell_{2}\triangleq\\{x[k]:\mathbb{Z}^{+}\to\mathbb{R}^{n}|\;||x||^{2}_{\ell_{2},[0,\infty]}<\infty\\}$
and the extended signal space be defined as
$\ell_{2e}\triangleq\\{x[k]:\mathbb{Z}^{+}\to\mathbb{R}^{n}|\;||x||^{2}_{[0,N]}<\infty,\forall
N\in\mathbb{Z}^{+}\\}$. For the sake of simplicity, we represent
$||x||^{2}_{\ell_{2},[0,\infty]}$ as $||x||^{2}_{\ell_{2}}$. For
$x\in\mathbb{R},\left\lceil{x}\right\rceil$ represents the nearest integer
$\geq x$. For any finite set $\mathcal{Q}$, and element of $\mathcal{Q}$ is
represented by $q_{(\cdot)}$, and the cardinality of the set is represented by
$|\mathcal{Q}|$.

##  II Problem background

In this section, we describe the control system structure and the goal of the
adversary. Consider a closed-loop DT LTI system with a process
($\mathcal{P}$), output feedback controller ($\mathcal{C}$) and an anomaly
detector ($\mathcal{D}$) represented by

$\displaystyle\mathcal{P}:$
$\displaystyle\left\\{\begin{array}[]{ll}x_{p}[k+1]&=A^{\Delta}x_{p}[k]+B^{\Delta}\tilde{u}[k]\\\
y[k]&=C^{\Delta}x_{p}[k]\\\
y_{p}[k]&=C_{J}^{\Delta}x_{p}[k]+D_{J}^{\Delta}\tilde{u}[k]\end{array}\right.$
(4) $\displaystyle\mathcal{C}:$
$\displaystyle\left\\{\begin{array}[]{ll}z[k+1]&=A_{c}z[k]+B_{c}\tilde{y}[k]\\\
u[k]&=C_{c}z[k]+D_{c}\tilde{y}[k]\end{array}\right.$ (7)
$\displaystyle\mathcal{D}:$
$\displaystyle\left\\{\begin{array}[]{ll}s[k+1]&=A_{e}s[k]+B_{e}u[k]+K_{e}\tilde{y}[k]\\\
y_{r}[k]&=C_{e}s[k]+D_{e}u[k]+E_{e}\tilde{y}[k]\end{array}\right.$ (10)

where $A^{\Delta}\triangleq A+\Delta A(\delta)$ with $A$ representing the
nominal system matrix and $\delta\in\Omega$. Additionally we assume $\Omega$
to be closed, bounded and to include the zero uncertainty yielding $\Delta
A(0)=0$. The other matrices are similarly expressed. The state of the process
is represented by $x_{p}[k]\in\mathbb{R}^{n_{x}}$, $z[k]\in\mathbb{R}^{n_{z}}$
is the state of the controller, $s[k]\in\mathbb{R}^{n_{s}}$ is the state of
the observer, $\tilde{u}[k]\in\mathbb{R}^{n_{u}}$ is the control signal
received by the process, $u[k]\in\mathbb{R}^{n_{u}}$ is the control signal
generated by the controller, $y[k]\in\mathbb{R}^{n_{m}}$ is the measurement
output produced by the process, $\tilde{y}[k]\in\mathbb{R}^{n_{m}}$ is the
measurement signal received by the controller and the detector,
$y_{p}[k]\in\mathbb{R}^{n_{p}}$ is the virtual performance output, and
$y_{r}[k]\in\mathbb{R}^{n_{r}}$ is the residue generated by the detector. The
closed-loop system is also shown in Fig. 1. The reason to adopt uncertainty
only in the process is that the parameters of the controller and the detector
are chosen by the system operator. However the parameters of the process may
not be known to the operator due to a variety of reasons such as, e.g.
modelling errors.

In general, the system is considered to have a good performance when the
energy of the performance output $||y_{p}||_{\ell_{2}}^{2}$ is small and an
anomaly is considered to be detected when the detector output energy
$||y_{r}||_{\ell_{2}}^{2}$ is greater than a predefined threshold, say
$\epsilon_{r}$. Without loss of generality (w.l.o.g.), we assume
$\epsilon_{r}=1$ in the sequel.

Figure 1: Control system under data injection attack

###  II-A Data injection attack scenario

In the closed-loop system described in (4)-(10), we consider that an adversary
is injecting false data into the sensors or actuators of the plant but not
both. Given this setup, we now discuss the resources the adversary has access
to.

####  II-A1 Disruption and disclosure resources

The adversary can access (eavesdrop) the control and sensor channels and can
inject data. This is represented by
$\begin{bmatrix}\tilde{u}^{T}[k]&\tilde{y}^{T}[k]\end{bmatrix}^{T}=$

$\begin{bmatrix}{u}[k]\\\ {y}[k]\end{bmatrix}+\begin{bmatrix}B_{a}\\\
F_{a}\end{bmatrix}a[k],\left[\begin{array}[]{c|c}B_{a}^{T}&D_{a}^{T}\end{array}\right]\triangleq\left[\begin{array}[]{c|c}E_{a}^{T}&0\\\
0^{T}&F_{a}^{T}\end{array}\right]$

where $a[k]\in\mathbb{R}^{n_{a}}$ is the data injected by the adversary. The
matrix $E_{a}(F_{a})$ is a diagonal matrix with
$E_{a}(i,i)=1\;(F_{a}(i,i)=1)$, if the actuator (sensor) channel $i$ is under
attack and zero otherwise.

####  II-A2 System knowledge

We assume that, the system operator knows the bounds of the set $\Omega$ and
the nominal system matrices. Next, we assume that the adversary has full
system knowledge, i.e., s/he knows the system matrices (4),(7), and (10). In
reality, it is hard for the adversary to know the system matrices, but this
assumption helps to study the worst case.

Defining ${x}[k]\triangleq[x_{p}[k]^{T}\;z[k]^{T}\;s[k]^{T}]^{T}$, the closed-
loop system under attack with the performance output and detection output as
system outputs becomes

$\begin{array}[]{ll}{x}[k+1]&={A}_{cl}^{\Delta}{x}[k]+{B}_{cl}^{\Delta}a[k]\\\
y_{p}[k]&={C}_{p}^{\Delta}{x}[k]+{D}_{p}^{\Delta}a[k]\\\
y_{r}[k]&={C}_{r}^{\Delta}{x}[k]+{D}_{r}^{\Delta}a[k],\\\ \end{array}$ (11)

where the nominal matrices are given by
$\left[\begin{array}[]{c|c}A_{cl}&B_{cl}\end{array}\right]\triangleq$

$\left[\begin{array}[]{c|c}\begin{matrix}A+BD_{c}C&BC_{c}&0\\\
B_{c}C&A_{c}&0\\\
(B_{e}D_{c}+K_{e})C&B_{e}C_{c}&A_{e}\end{matrix}&\begin{matrix}BB_{a}+BD_{c}D_{a}\\\
B_{c}D_{a}\\\ (B_{e}D_{c}+K_{e})D_{a}\end{matrix}\end{array}\right]$
$\displaystyle{C}_{p}$
$\displaystyle\triangleq\begin{bmatrix}C_{J}+D_{J}D_{c}C&D_{J}C_{c}&0\end{bmatrix}$
$\displaystyle{C}_{r}$
$\displaystyle\triangleq\begin{bmatrix}(D_{e}D_{c}+E_{e})C&D_{e}C_{c}&C_{e}\end{bmatrix}$
$\displaystyle{D}_{p}$ $\displaystyle\triangleq
D_{J}(D_{c}D_{a}+B_{a}),{D}_{r}\triangleq(D_{e}D_{c}+E_{e})D_{a}.$

In this paper, we consider the adversarial setup where the adversary is
omniscient.

######  Definition II.1 (Omniscient adversary)

An adversary is defined to be omniscient if it knows the matrices in
(11).$\hfill\triangleleft$

In reality, it is hard for an adversary to know the system matrices of (11)
due to the uncertainty. Thus, such an adversarial setup is far from reality
but it can help us study a worst-case scenario. For clarity, we assume the
following.

###### Assumption II.1

The control system (11) is stable
$\forall\delta\in\Omega$.$\hfill\triangleleft$

###### Assumption II.2

The input matrix has full column rank i.e.,
$\nexists\;s\in\mathbb{R}^{n_{a}}\neq 0$ such that
$B_{cl}^{\Delta}s=0$.$\hfill\triangleleft$

####  II-A3 Attack goals and constraints.

Given the resources the adversary has access to, it aims at disrupting the
system’s behavior while staying stealthy. The system disruption is evaluated
by the increase in energy of the performance output whereas, the adversary is
stealthy if the energy of the detection output is below a predefined threshold
($\epsilon_{r}$). We discuss the attack policy for a deterministic system
next.

###  II-B Optimal attack policy for the nominal system

From the previous discussions, it can be understood that the goal of the
adversary is to maximize the performance cost while staying undetected. When
the system (11) is deterministic, [10] formulates that the attack policy of
the adversary as the following non-convex optimization problem

$\displaystyle||\Sigma||_{\ell_{2e},y_{p}\leftarrow
y_{r}}^{2}\triangleq\sup_{a\in\ell_{2e}}$
$\displaystyle||y_{p}||^{2}_{\ell_{2}}$ (12) s.t.
$\displaystyle||y_{r}||_{\ell_{2}}^{2}\leq 1,x[0]=0,x[\infty]=0,$

where $||\Sigma||_{\ell_{2e},y_{p}\leftarrow y_{r}}^{2}$ represents the $OOG$
that characterizes the disruption caused by the attack signal $a$. In (12),
the constraint $x[0]=0$ is introduced because the system is assumed to be at
equilibrium before the attack.

###### Assumption II.3

The closed-loop system (11) is at equilibrium $x[0]=0$ before the attack
commences.$\hfill\triangleleft$

We also assume that the adversary has finite amount of energy (similar to
$H_{\infty}$ control). Thus, the adversary does not attack the system for an
infinite amount of time but stops after a very long time, say $T$. And since
the attack stops, the state is brought back to equilibrium. To this end, we
introduce the constraint $x[\infty]=0$ in (12).

In the literature, such characterization of the impact of stealthy attacks
(12) has only been studied for fully known deterministic systems, but not for
an uncertain system. Thus, the first goal of the paper is to quantify the
impact in terms of risk on the uncertain system (11). We later describe, in
Section V, as to how the attack impact determined can be used for the benefit
of the system operator.

##  III Problem Formulation

To quantify the risks of data injection attacks on an uncertain control
system, we start by defining a random variable that characterizes the impact
as a function of the system uncertainty and the attack vector.

######  Definition III.1 (Impact random variable)

Let the random variable $X^{A}(\cdot)$ be defined as

$\displaystyle X^{A}(a,\delta)\triangleq$
$\displaystyle\;\|y_{p}(\delta)\|_{\ell_{2}}^{2}\times\mathbb{I}\bigg{(}\|y_{r}(\delta)\|_{\ell_{2}}^{2}\leq
1,x({\delta})[\infty]=0\bigg{)}$ (13)

where $X^{A}(\cdot)$ is the impact caused on the system (11) with the
uncertainty $\delta\in\Omega$ by the attack vector $a\in\ell_{2e}$,
$\mathbb{I}$ is the indicator function, $y_{p}(\delta),y_{r}(\delta)$ and
$x({\delta})$ are the performance, residue output and state of the system with
the isolated uncertainty $\delta$. Here, the signals
$y_{p}(\delta),y_{r}(\delta)$ and $x(\delta)$ are also functions of the attack
vector $a$.$\hfill\triangleleft$

With the random variable defined in Definition III.1, we next formulate the
risk assessment problem. Consider the data injection attack scenario where the
parametric uncertainty $\delta\in\Omega$ of the system is known to the
adversary but not to the system operator. The system operator has knowledge
only about the bounds of the set $\Omega$. Recall that such a scenario is far
from reality, but such a setup helps us study the worst case. Under this
setup, the adversary can cause high disruption by remaining stealthy because
the adversary will be able to inject attacks by solving the optimization
problem

$\displaystyle||\tilde{\Sigma}(\delta)||_{\ell_{2e},y_{p}\leftarrow
y_{r}}^{2}\triangleq\sup_{a_{\delta}\in\ell_{2e}}$ $\displaystyle
X^{A}(a_{\delta},\delta),$ (14)

where $a_{\delta}$ represents the attack vector corresponding to the
uncertainty $\delta$. Since the system operator does not know the uncertainty
$\delta$, $||\tilde{\Sigma}(\delta)||_{\ell_{2e},y_{p}\leftarrow y_{r}}^{2}$
can be interpreted as a random variable. Thus, for the system operator, the
best option is to assess the risk associated with the impact based on a risk
metric. In this paper, we adopt the risk metric VaR [11].

######  Definition III.2 (Value-at-Risk (VaR))

Given a random variable $X$ and $\beta\in(0,1)$, the VaR is defined as

$\text{VaR}_{\beta}(X)\triangleq\inf\\{x|\mathbb{P}[X\leq x]\geq 1-\beta\\}.$

With a specified probability level $\beta\in(0,1)$, $\text{VaR}_{\beta}$ is
the lowest amount of $x$ such that with probability $1-\beta$, the random
variable, $X$, does not exceed $x$. $\hfill\triangleleft$

Therefore, by calculating $\text{VaR}_{\beta}$, one can ensure that the
probability that the value (X) exceeds $\text{VaR}_{\beta}$ is less than or
equal to $\beta$. In our setting, the system operator is interested in
determining the $\text{VaR}_{\beta}$ given a small $\beta$ such that the
impact rarely exceeds $\text{VaR}_{\beta}$. Given that the impact caused by
the adversary on (11) is characterized by
$||\tilde{\Sigma}(\delta)||_{\ell_{2e},y_{p}\leftarrow y_{r}}^{2}$, the
$\text{VaR}_{\beta}(\cdot)$ can be obtained, using Definition III.2, by
solving

$\displaystyle\gamma_{OA}\triangleq\inf_{\gamma}$ $\displaystyle\gamma$ (15)
s.t.
$\displaystyle\mathbb{P}_{\Omega}(||\tilde{\Sigma}(\delta)||_{\ell_{2e},y_{p}\leftarrow
y_{r}}^{2}\leq\gamma)\geq 1-\beta,$

where $\gamma_{OA}$ represents the VaR associated with the impact caused by an
Omniscient Adversary.

Although VaR is not extensively used in the literature [11], it is used here
to only assess the worst-case risk even though this setup may be deemed
unrealistic. Since $\mathbb{P}$ in (15) operates over the continuous space
$\Omega$, the optimization problem is computationally intensive or in general
NP-hard [12, Section 3]. Besides (14) is a non-convex [10]. In Section IV we
discuss a method to solve (15) approximately and efficiently.

##  IV Risk assessment

To recall, (15) is computationally intensive since $\Omega$ is a continuum. To
this end, in this section we determine an approximate solution to (15) and
also provide some probabilistic certificates using the scenario approach
introduced in [13].

###  IV-A Discrete uncertainty set

In this section, we consider a discrete uncertainty set $\Omega$. The results
of this section is the basis for addressing a continuous uncertainty set next.
For brevity, given a sampled uncertainty $\delta_{i}\in\Omega$, we define
$\tilde{\Sigma}_{p,i}\triangleq({A}_{cl,i},{B}_{cl,i},{C}_{p,i},{D}_{p,i})$
and
$\tilde{\Sigma}_{r,i}\triangleq({A}_{cl,i},{B}_{cl,i},{C}_{r,i},{D}_{r,i})$
with $y_{p}(\delta_{i})=y_{pi},y_{r}(\delta_{i})=y_{ri}$ and
$x(\delta_{i})=x_{i}$ as the outputs and states of $\tilde{\Sigma}_{p,i}$ and
$\tilde{\Sigma}_{r,i}$ correspondingly. For such an isolated uncertainty, (14)
can be rewritten as

$\displaystyle||\tilde{\Sigma}(\delta_{i})||_{\ell_{2e},y_{p}\leftarrow
y_{r}}^{2}$
$\displaystyle\triangleq\sup_{a_{i}\in\ell_{2e}}\;X^{A}(a_{i},\delta_{i})$
(16) $\displaystyle=\left\\{\begin{aligned}
\sup_{a_{i}\in\ell_{2e}}&\|y_{p,i}\|_{\ell_{2}}^{2}\\\
\textrm{s.t.}\;&\|y_{r,i}\|_{\ell_{2}}^{2}\leq
1,x_{i}[\infty]=0\end{aligned}\right\\}$

where $a_{i}$ is the attack vector corresponding to the uncertainty
$\delta_{i}$. The optimization problem (16) has two disadvantages: it is non-
convex and intractable (since the optimizer is infinite-dimensional). To this
end, we can use the Lagrange dual function to reformulate the non-convex
problem into its dual-counterpart. Furthermore, we can use dissipative system
theory to convert the intractable non-convex problem to a convex problem with
LMI constraints which is tractable. This reformulation is presented in Lemma
IV.1.

###### Lemma IV.1

The optimization problem (16) is equivalent to the convex SDP (17).

$\min_{\gamma_{i}\geq
0,P_{i}=P_{i}^{T}}\;\left\\{\gamma_{i}\;\Big{|}M(\gamma_{i},\delta^{i},P_{i})\preceq
0\right\\}$ (17)

where
$M(\gamma_{i},\delta^{i},P_{i})\triangleq\begin{bmatrix}A_{cl,i}^{T}P_{i}A_{cl,i}-P_{i}&A_{cl,i}^{T}P_{i}B_{cl,i}\\\
B_{cl,i}^{T}P_{i}A_{cl,i}&B_{cl,i}^{T}P_{i}B_{cl,i}\end{bmatrix}+\begin{bmatrix}C_{p,i}^{T}\\\
D_{p,i}^{T}\end{bmatrix}\begin{bmatrix}C_{p,i}&D_{p,i}\end{bmatrix}-\gamma_{i}\begin{bmatrix}C_{r,i}^{T}\\\
D_{r,i}^{T}\end{bmatrix}\begin{bmatrix}C_{r,i}&D_{r,i}\end{bmatrix}.$

###### Proof:

The result is similar to [10, Theorem 1] and thus the proof is omitted. ∎

Next, we discuss the the conditions for boundedness of
$||\tilde{\Sigma}(\delta_{i})||_{\ell_{2e},y_{p}\leftarrow y_{r}}^{2}$ in the
Lemma IV.2.

######  Lemma IV.2 (Boundedness)

Consider the closed-loop system (11) with an uncertainty $\delta_{i}$ which is
known to the adversary. Then, the optimal value of (17) is bounded if and only
if one of the following conditions hold:

  1. 1.

The system $\tilde{\Sigma}_{r,i}$ has no zeros on the unit circle.

  2. 2.

The zeros on the unit circle of the system $\tilde{\Sigma}_{r,i}$ (including
multiplicity and input direction) are also zeros of $\tilde{\Sigma}_{p,i}$.

###### Proof:

See appendix. ∎

Lemma IV.2 states that the attack impact caused by an omniscient adversary on
(11) with an uncertainty $\delta_{i}$ is bounded if either, there does not
exist an attack vector which makes the output $y_{r}$ identically zero, or all
attack vectors which yields $y_{r}$ identically $0$ also yields $y_{p}$
identically zero.

In this section, we formulated the results on characterizing the attack impact
by a convex SDP and the condition for its boundedness for an isolated discrete
uncertainty. Next, the approach discussed in this section for risk assessment
is extended when considering a continuum of uncertainties.

###  IV-B Continuous uncertainty set

The optimization problem (17) can be directly extended to solve (15) only when
we consider a discrete set $\Omega$. But (15) that we intend to solve operates
over a continuous set $\Omega$. Using the framework of scenario-based
reliability estimation [13], $\Omega$ can be approximated with a finite set.
With this scenario-based framework we revisit (15) in Theorem IV.3.

###### Theorem IV.3

Let $\epsilon_{1}\in(0,1)$ represent the accuracy with which the probability
operator $\mathbb{P}_{\Omega}$ in (15) is to be approximated. Let
$\beta_{1}\in(0,1)$ represent the confidence with which the accuracy
$\epsilon_{1}$ is guaranteed, i.e.,

$\mathbb{P}\\{|\mathbb{P}_{\Omega}(||\tilde{\Sigma}(\delta)||_{\ell_{2e},y_{p}\leftarrow
y_{r}}^{2}\leq\gamma)-\hat{\mathbb{P}}_{N_{1}}|\geq\epsilon_{1}\\}\leq\beta_{1}.$

Here $\hat{\mathbb{P}}_{N_{1}}$ represents the approximation of the
probability operator $\mathbb{P}_{\Omega}$ in (15) defined as

$\hat{\mathbb{P}}_{N_{1}}\triangleq\frac{1}{N_{1}}\sum_{i=1}^{N_{1}}\mathbb{I}\left(||\tilde{\Sigma}(\delta_{i})||_{\ell_{2e},y_{p}\leftarrow
y_{r}}^{2}\leq\gamma\right),\hfill\text{where}$ (18)
$N_{1}\geq\frac{1}{2\epsilon_{1}^{2}}\text{log}\frac{2}{\beta_{1}}.$ (19)

Then, the $\text{VaR}_{\beta}$ defined in (15) can be obtained with an
accuracy $\epsilon_{1}$ and confidence $\beta_{1}$ by solving

$\hat{\gamma}_{OA}=\left\\{\begin{aligned} \min&\;\;\gamma\\\
\textrm{s.t.}\quad&\frac{1}{N_{1}}\sum_{i=1}^{N_{1}}\mathbb{I}\left(\gamma_{i}\leq\gamma\right)\geq
1-\beta,\end{aligned}\right\\}$ (20)

where $\hat{\gamma}_{OA}$ represents the $\text{VaR}_{\beta}$ with an accuracy
$\epsilon_{1}$, and $\mathbb{I}$ is the indicator function. The value of
$\gamma_{i},i=1,\dots,N_{1}$ is obtained by solving the convex SDP (17).

###### Proof:

See appendix. ∎

Theorem IV.3 states that, to solve (20), one could solve the optimization
problem (17) for $N_{1}$ unique realizations of the uncertainty. Since strong
duality holds between (16) and (17), the optimal value of the dual
optimization problem (20) indeed provides the VaRβ with an accuracy
$\epsilon_{1}$ and confidence $\beta_{1}$. Thus Theorem IV.3 provides a method
to determine the risk through a sampled uncertainty set, and provides apriori
probabilistic certificates on the accuracy and confidence of the operator
$\mathbb{P}$. Next, by extending Lemma IV.2, the condition for boundedness of
(20) is stated in Lemma IV.4.

######  Lemma IV.4 (Boundedness)

Consider $N_{1}$ independent and identically distributed realizations of (11),
each with an uncertainty $\delta_{i}$. The optimal value of (20) with these
$N_{1}$ system realizations is bounded iff the optimal value of (17) is
bounded for at least $\left\lceil{N_{1}(1-\beta)}\right\rceil$ system
realizations.

###### Proof:

See appendix. ∎

The interpretation of Lemma IV.4 is that the system operator tolerates a
fraction ($\beta\times 100\%$) of cases where the impact (17) is unbounded.
Conversely, even-though the impact is unbounded for certain realization of
uncertainty, the risk will still be bounded. This allows the system operator
to be less pessimistic: In the sense that, even though the attack impact in
certain scenarios can be very high, the risk evaluated by the operator will be
bounded. In the next section, we briefly discuss the benefit of determining
the risk and how it can be used by the system operator.

##  V Optimal allocation of security measures

In this section, we discuss how the RAP discussed in Section IV can be used
for the benefit of the operator. That is, after determining the risk, the
operator might be interested in the question If the risk value is not
acceptable what actions steps can be taken?. To this end, the determined risk
can be used in two ways. On one hand, the operator can use the risk as a
metric to design the controllers/detectors of the system optimally [14]. On
the other hand, the risk can be used to allocate the security measures
optimally [4, Chapter 5] which is the problem considered here.

Let $n_{w}$ be the number of secure resources. In reality, secure resources
refer to some form of secure communication channels for the sensors and
actuators such that an attack cannot occur. If the number of secure resources
($n_{w}$) is equal to the number of actuators and sensors ($n_{u}+n_{y}$),
then the SMAP is solved trivially. However, in general $n_{w}<<n_{u}+n_{y}$
since secure communication channels are expensive111by expensive we here mean
encryption and processing costs. Thus, we discuss a method to optimally
allocate the security measures when they are limitedly available.

To formulate the problem, we define the following. The set of all sensors
(actuators) is represented by $\mathcal{S}(\mathcal{A})$, where
$|\mathcal{S}|=n_{y}(|\mathcal{A}|=n_{u})$. The set of all vulnerabilities is
represented by $\mathcal{V}$. Any sensor (actuator) is a vulnerability if the
operator believes that an adversary might be able to access the sensor
(actuator) channels. Thus $|\mathcal{V}|=n_{v}\leq n_{y}+n_{u}$. Let the set
of secure resources be represented by $\mathcal{W}$ where
$|\mathcal{W}|=n_{w}$. And as discussed before $n_{w}<<n_{v}\leq n_{y}+n_{u}$.
Then the SMAP has the following structure.

Firstly, the operator aims at optimizing the risk metric. Secondly, if an
actuator (sensor) $i\in\mathcal{V}$ is secure, then the corresponding actuator
(sensor) channels cannot be accessed by the adversary (C$1$). Recall from
Section II, that the matrix $E_{a}(F_{a})$ is a diagonal matrix with
$E_{a}(i,i)=1\;(F_{a}(i,i)=1)$, if the actuator (sensor) channel $i$ is under
attack and zero otherwise. And, as discussed before, the operator can only
secure $n_{w}$ actuators (sensors) at most (C$2$). To this end, the optimal
SMAP under actuator attacks can be formulated as

$\left\\{\hat{\gamma}_{OA}^{*},W^{*}\right\\}=\left\\{\begin{aligned}
\inf_{z_{i}}\;&\hat{\gamma}_{OA}(z)\\\
\text{s.t.}\;&(\text{C}1)E_{a}(i,i)=z_{i},\;\forall i\in\mathcal{V}\\\
&(\text{C}2)\sum_{i\in\mathcal{V}}(1-E_{a}(i,i))\leq n_{w}\\\
&z_{i}\in\\{0,1\\},\;\forall i\end{aligned}\right\\}$ (21)

where, $\hat{\gamma}_{OA}^{*}$ is the optimal risk after the security measures
are allocated, the corresponding optimal vulnerabilities to be protected are
represented by $W^{*}$, and where the constraint C$2$ considers that a
vulnerable actuator is protected if and only if the corresponding actuator has
$E_{a}(i,i)=0$. Similarly, when the sensors are under attack, the optimal SMAP
can be formulated by replacing $E_{a}(\cdot)$ by $F_{a}(\cdot)$ in (21).

The optimization problem (21) is hard to solve since it is a combinatorial
problem. That is, the operator has to search through the whole set of
$\mathcal{V}$ to secure $n_{w}$ vulnerabilities. And it is well known that
combinatorial problems with a large search space ($\mathcal{V}$) are NP-hard
in general. Thus, providing a heuristic to solve (21) is beyond the scope of
this paper and is left for future work. Interested readered are referred to
[4, Chapter 5]. However, we provide a scheme to solve (21) when
$|\mathcal{V}|$ is small in Algorithm 1.

Initialization: $\beta,\epsilon,\Omega,\epsilon,\mathcal{V},n_{w}$ an empty
list $\gamma_{l}$

Step 1: Determine $\mathcal{Q}$ which is the set of all subsets of
$\mathcal{V}$ with maximum cardinality $n_{w}$.

Step 2: For all $q_{(\cdot)}=\mathcal{Q}$, do:

  1. 1.

Set $E_{a}(i,i)=0$ if $i\in q_{(\cdot)}$ and $1$ otherwise.

  2. 2.

Determine $\hat{\gamma}_{OA}$ with the new $E_{a}$.

  3. 3.

Append $\gamma_{l}$ with $\hat{\gamma}_{OA}$

Step 3: Determine the minimum of $\gamma_{l}$ which is $\gamma_{OA}^{*}$.

Step 4: Determine the corresponding $q_{(\cdot)}^{*}$ which yields
$\gamma_{OA}^{*}$.

Step 5: Set $W^{*}\triangleq q_{(\cdot)}^{*}$.

Result: $\hat{\gamma}_{OA}^{*},W^{*}$

Algorithm 1 Algorithm to solve SMAP

The algorithm first determines all possible subsets of the vulnerabilities
with the maximum cardinality of $n_{w}$. Then, the operator determines the
maximum attack impact caused by the adversary when these various subsets of
vulnerabilities are protected. It then selects the set of vulnerabilities
($W^{*}$) which yields the minimum attack impact ($\gamma_{OA}^{*}$).

In this section we discussed how the risk determined in Section IV can be used
by the system operator to optimally allocate the security measures. In the
next section, we will illustrate what results can be obtained by a simple
example.

##  VI Numerical example

In this section, the effectiveness of the proposed Algorithm 1 is illustrated
through a numerical example. Consider the system described in (11) with
$C=C_{J}^{T}=I_{3},E_{a}=I_{2}$

$\displaystyle\left[\begin{array}[]{c|c}A&B^{\Delta}\end{array}\right]=\left[\begin{array}[]{c|c}\begin{matrix}1&0&1\\\
1&0.5&0\\\ 0&1&-0.5\end{matrix}&\begin{matrix}1.5+\delta&0\\\ 0.3&0\\\
0&1\end{matrix}\end{array}\right],$ (24)

$\Omega\triangleq[-0.5,\;0.5],A_{e}=A,B_{e}=B,C_{e}=C,\left[\begin{array}[]{c|c}D_{c}^{T}&K_{e}\end{array}\right]=$

$\displaystyle\left[\begin{array}[]{c|c}\begin{matrix}-0.066&0.178\\\
0.047&0.940\\\ 0.524&-1.346\end{matrix}&\begin{matrix}0.393&0&1\\\
1&-0.048&0\\\ 0&1&-0.996\end{matrix}\end{array}\right],$ (26)

and all the other unspecified matrices are zero. In the system description,
only the matrix $B^{\Delta}$ is a function of the uncertain variable. And the
system has no uncertain zeros on the unit circle, which makes the condition of
Lemma IV.1 hold $\forall\delta\in\Omega$. Thus, for a nominal system with
$\delta=0$, the OOG obtained by solving (12) is
$||\Sigma||_{\ell_{2e},y_{p}\leftarrow y_{r}}^{2}=197.76$.

Let $\epsilon_{1}=0.05,\beta_{1}=\beta=0.1$ and $N_{1}=235$ which satisfies
(19). Here $1-\epsilon_{1}$ represents the accuracy of the approximation of
the probability operator in determining the VaRβ. And $\beta_{1}$ represents
the guarantee. We then solve (20) and obtain $\gamma_{OA}=347.15$.

The optimization problem (20) is solved as follows. The set $\Omega$ is
sampled for $N_{1}$ samples. The value of $\gamma_{i}\;\forall
i=\\{1,\dots,N_{1}\\}$ is obtained by solving the SDP (17). From these values
of $\gamma_{i}$, we choose $\gamma_{OA}$ such that the
$\mathbb{P}(\gamma_{i}\geq\gamma_{OA})=\beta$. Maintaining $\epsilon_{1}$ and
$\beta_{1}$ constant, for varying values of $\beta$, the value of
$\gamma_{OA}=\text{VaR}_{\beta}(X)$ is shown in Fig. 2.

Figure 2: The parameter $\beta$ is shown on the Y-axis and the corresponding
VaRβ on the X-axis. The red line indicates VaR0.1. The blue dots denotes the
value of the impact random variable $X|X<VaR_{0.1}$, whereas the black dots
denotes the value of the impact random variable $X|X>VaR_{0.1}$. It can be
seen that the probability that $X>VaR_{0.1}$ is low when $\beta$ is small.

Fig. 2 depicts that the value of the impact is greater than the VaR with a
probability $\beta$ and confidence $1-\epsilon_{1}$. To recall, by determining
VaRβ for a given $\beta$, the operator can ensure that the impact of any
stealthy attack impact is greater than VaRβ with probability $\beta$. After
determining the VaR, the operator decides if the risk is acceptable or not. If
the risk is not acceptable, the risk can be minimized for a given $\beta$ by
implementing additional security measures.

We next use the risk metric determined to allocate the security measures. Let
$\mathcal{V}=\mathcal{S}=\\{S1,S2,S3\\}$. That is, we assume that all sensors
communication channels are vulnerable to attacks. Then, we determine the risk
when there are no security measures available ($|\mathcal{X}|=0$). Next, we
determine the risks when there is only one security measure available
($|\mathcal{X}|=1$). That is, we determine the risks corresponding to the
setup where either $S1,S2$ or $S3$ is protected. And finally, we determine the
risks when there are two security measure available ($|\mathcal{X}|=2$). That
is, we determine the risk corresponding to the setup where either
$\\{S1,S2\\},\\{S2,S3\\}$ or $\\{S3,S1\\}$ are protected. The risks are
depicted in the left diagram of Fig. 3 in blue, where the text on the top of
the bar depicts the sensors that are protected. From Fig 3, we can conclude
that $(i)$ when $|\mathcal{X}|=1$, it is optimal to secure $S3$ since it
minimizes the risk the most, and $(ii)$ when $|\mathcal{X}|=2$, it is optimal
to secure $S2,$ and $S3$.

We repeat the procedure for the actuators where
$\mathcal{V}=\mathcal{A}=\\{A1,A2\\}$. That is, we assume that all actuator
communication channels are vulnerable to attacks. The risks are depicted in
the right diagram of Fig. 3 in blue. From Fig. 3, we can conclude that $(i)$
when $|\mathcal{X}|=1$, it is optimal to secure $A1$ (actuator 1), and $(ii)$
it is much more riskier to leave the sensors unprotected since the risk of
unprotected sensors is higher than unprotected actuators.

Finally, we show the advantage of using the risk metric. We use the impact on
the nominal system as a metric to allocate the protection resources. That is,
instead of solving the SMAP with the risk determined from (20), we simply
solve the optimization problem (17) for the nominal system and use it as a
metric to allocate the security measure. To this end, we determine the impact
on the nominal system when $|\mathcal{X}|=0,|\mathcal{X}|=1$, and
$|\mathcal{X}|=2$. The corresponding impact are shown in Fig. 3 in red. It can
be seen that the conclusion that we drew using the risk metric are not
reproducible when we use the nominal impact as a metric. For instance, when
the sensors are under attack and $|\mathcal{X}|=1$, the conclusion from the
risk metric is to protect $S3$, whereas if we use the nominal impact, we end
up protecting $S2$. Similarly, when the actuators are under attack and
$|\mathcal{X}|=1$, the conclusion from the risk metric is to protect $A1$,
whereas if we use the nominal impact, we end up protecting $A2$.

Figure 3: The VaR0.1 after protecting various combination of sensors
(actuators) are depicted on the left (right) figure in blue. The text on the
top of each bar denotes the sensor (actuator) that is protected. For instance,
“None” represents that none of the sensors are protected. The bar at position
“1” of the figure in left corresponds to the risk when none of the sensors are
protected and the corresponding risk was found to be 9081.4. The Y axis of the
figure is not extended to show this value since it would affect clarity of the
figure. The plots in red represent the impact on the nominal system after the
security measures are allocated using the impact on the nominal system as a
metric.

##  VII Conclusion

In this paper, we first addressed the RAP of false data attacks injected by an
omniscient adversary on uncertain control systems. We formulated the RAP and
observed that it is a non-convex infinite robust optimization problem. Using
the theory of dissipative systems and scenario approach, we approximated the
RAP as a convex SDP with probabilistic certificates. The necessary and
sufficient conditions for the risk to be bounded were also formulated.
Secondly, we consider the optimal SMAP. We used the risk determined as a
metric to formulate the SMAP. We provide a preliminary algorithm to solve the
allocation problem. The results were depicted through a numerical example.
Future works include $(i)$ considering a process with process and measurement
noise, and $(ii)$ providing a more detailed solution for the allocation
problem.

## Proof of Lemma IV.2

###### Proof:

To recall, the optimization problem (17) was formulated using $3)$ in [15,
Proposition 2] where $y_{1}=\sqrt{\gamma}y_{r}$ and $y_{2}=y_{p}$. Due to the
equivalency between $3)$ and $4)$ of [15, Proposition 2], the Frequency Domain
Inequality (FDI) $G_{1}(\bar{z})^{T}G_{1}(z)-G_{2}(\bar{z})^{T}G_{2}(z)\succeq
0$ should hold $\;\forall\;|z|=1$. Since we know that
$y_{1}=\sqrt{\gamma}y_{r}$ and $y_{2}=y_{p}$, we can deduce that $G_{1}(z)$
corresponds to $\sqrt{\gamma}\tilde{G}_{r,i}(z)$ and $G_{2}(z)$ to
$\tilde{G}_{p,i}(z)$ in FDI, where $\tilde{G}_{r,i}(z_{1})\triangleq
C_{r,i}(z_{1}I-A_{cl,i})^{-1}B_{cl,i}+D_{r,i}$ and
$\tilde{G}_{p,i}(z_{1})\triangleq
C_{p,i}(z_{1}I-A_{cl,i})^{-1}B_{cl,i}+D_{p,i}$. Thus, (17) can be rewritten as

$\inf_{\gamma_{i}\geq
0}\left\\{\gamma_{i}\Bigg{|}\underbrace{\gamma_{i}\tilde{G}_{r,i}(\bar{z})^{T}\tilde{G}_{r,i}({z})-\tilde{G}_{p,i}^{T}(\bar{z})\tilde{G}_{p,i}({z})}_{H(z,\gamma_{i})}\succeq
0,\forall|z|=1\right\\}$ (27)

which is equivalent to

$\inf_{\gamma_{i}\geq 0}\left\\{\gamma_{i}\Bigg{|}x^{H}H(z,\gamma_{i})x\geq
0,\forall|z|=1\right\\}$ (28)

Next, let us define the following sets

$\displaystyle\mathcal{Z}_{pr}$
$\displaystyle\triangleq\\{x\in\mathbb{C}^{n_{a}}\;|\;\tilde{G}_{r,i}({z})x=0,\tilde{G}_{p,i}({z})x=0\\},$
(29) $\displaystyle\mathcal{Z}$
$\displaystyle\triangleq\\{x\in\mathbb{C}^{n_{a}}\;|\;\tilde{G}_{r,i}({z})x\neq
0,\tilde{G}_{p,i}({z})x\neq 0\\},$ (30) $\displaystyle\mathcal{Z}_{r}$
$\displaystyle\triangleq\\{x\in\mathbb{C}^{n_{a}}\;|\;\tilde{G}_{r,i}({z})x=0,\tilde{G}_{p,i}({z})x\neq
0\\},$ (31) $\displaystyle\mathcal{Z}_{p}$
$\displaystyle\triangleq\\{x\in\mathbb{C}^{n_{a}}\;|\;\tilde{G}_{r,i}({z})x\neq
0,\tilde{G}_{p,i}({z})x=0\\}.$ (32)

In the above definitions, each set corresponds to a combination of two logical
conditions of $\tilde{G}_{r,i}({z})x$ and $\tilde{G}_{p,i}({z})x$. Therefore,
the union of all four sets explores all possible combinations of the two
logical conditions, and thus their union corresponds to the entire set
$\mathbb{C}^{n_{a}}$.

For any given $z$ such that $|z|=1$ , if $x\in\mathcal{Z}_{p}$, choosing
$\gamma=0$ satisfies the constraint of (28). Similarly, if $x\in\mathcal{Z}$,
then
$\gamma=\sup_{|z|=1,x\in\mathcal{Z}}\frac{x^{H}\big{\\{}\tilde{G}_{r,i}^{T}(\bar{z})\tilde{G}_{r,i}({z})\big{\\}}x}{x^{H}\big{\\{}\tilde{G}_{p,i}^{T}(\bar{z})\tilde{G}_{p,i}({z})\big{\\}}x}$.
This ratio is well defined since the denominator cannot become zero (since
$x\in\mathcal{Z}$), and the ratio is bounded since we have assumed that the
transfer functions $\tilde{G}_{r,i}({z})$ and $\tilde{G}_{p,i}({z})$ are
always stable (Assumption II.1). Therefore, we have proven that the value of
(28) is bounded whenever $x\in\mathcal{Z}_{p}\cup\mathcal{Z}$. We next begin
by proving that the lemma statements are sufficient for (28) to be bounded
whenever $x\in\mathcal{Z}_{r}\cup\mathcal{Z}_{pr}$.

Sufficiency: Assume that condition $(1)$ of the lemma statement holds. By
definition of a zero $\forall|z|=1,\nexists s\neq
0\in\mathbb{C}^{n_{a}}\;\text{s.t.}\;\tilde{G}_{r,i}({z})s=0$. Thus it follows
that $\mathcal{Z}_{r}=\mathcal{Z}_{pr}=\emptyset$.

Assume that condition $(2)$ of the lemma statement holds. Then by definition
of a zero $\forall|z|=1,\nexists s\neq 0$ such that $\tilde{G}_{r,i}({z})s=0$
and $\tilde{G}_{p,i}({z})s\neq 0$. Thus it follows that
$\mathcal{Z}_{r}=\emptyset$. And if $x\in\mathcal{Z}_{pr}$, then picking
$\gamma=0$ simply satisfies the constraint of (28). This concludes the proof
on sufficiency.
Necessity: We prove by contradiction. Assume that there exists a bounded
$\gamma$ which solves the optimization problem (28). And we also assume that
there exists a complex number $z_{1}$ on the unit circle which is a zero of
the system $\tilde{\Sigma}_{r,i}$ (including multiplicity and input direction)
but are not zeros of $\tilde{\Sigma}_{p,i}$. By definition of a zero, it holds
that $\exists s\neq 0$ such that
$\tilde{G}_{r,i}(z_{1})s=0,\;\tilde{G}_{p,i}(z_{1})s\neq 0$. Thus,
$\mathcal{Z}_{rp}\neq\emptyset$ and becomes a part of the feasible set for
$x$. Then, if $z=z_{1}$ and $x=s$, the constraint of (28) can be rewritten as
$-s^{H}\tilde{G}_{p,i}^{T}(\bar{z}_{1})\tilde{G}_{p,i}({z_{1}})s\geq 0$ which
cannot hold since $\tilde{G}_{p,i}({z_{1}})s\neq 0$. That is, the feasibility
set of (28) is empty which contradicts our assumption. In terms of the primal
problem (17), it means that there cannot exist a bound to its optimal value.
This concludes the proof. ∎

## Proof of Theorem IV.3

Before presenting the proof, an introduction to scenario-based performance
level estimation [13] is provided.

### Scenario-based performance level estimation

Consider a function $f(\delta),\;\delta\in\Delta$. Let $\epsilon\in(0,1)$,
then the performance level estimation problem aims to estimate a performance
level $\gamma^{*}$ with a reliability $1-\epsilon$ such that

$\gamma^{*}\triangleq\inf\left\\{\gamma\;\Big{|}\;\mathbb{P}_{\Delta}\\{f(\delta)\leq\gamma\\}\geq
1-\epsilon.\right\\}$ (33)

The problem (33) is computationally intensive. The scenario-based probability
estimation algorithm (PEA), provides a randomized approach to approximate the
probability operator $\mathbb{P}$. This algorithm is described below.

  1. 1.

Choose a confidence level $\beta_{1}\in(0,1)$, and an accuracy level
$\epsilon_{1}\in(0,1)$.

  2. 2.

Choose $N_{1}$ such that (19) holds.

  3. 3.

Extract $N_{1}$ i.i.d. samples $\delta^{1},\dots,\delta^{N}$ from $\Delta$ and
evaluate $f(\delta^{1}),\dots,f(\delta^{N_{1}})$.

  4. 4.

Then it holds that

$\mathbb{P}\\{|\mathbb{P}_{\Delta}\\{f(\delta)\leq\gamma\\}-\hat{\mathbb{P}}_{N}|\geq\epsilon_{1}\\}\leq\beta_{1},$

where
$\hat{\mathbb{P}}_{N}\triangleq\frac{1}{N_{1}}\sum_{i=1}^{N_{1}}\mathbb{I}\left(f(\delta^{i})\leq\gamma\right).$
Thus, in this step, an equivalent probability operator $\hat{\mathbb{P}}_{N}$
is formulated in place of $\mathbb{P}_{\Delta}$ which was difficult to
compute.

  5. 5.

Using the approximation in $(4)$, compute the solution to (33) with an
accuracy $\epsilon_{1}$ and a confidence $\beta_{1}$ as

$\min\left\\{\gamma\;\Bigg{|}\;\frac{1}{N_{1}}\sum_{i=1}^{N_{1}}\mathbb{I}\left(f(\delta^{i})\leq\gamma\right)\geq
1-\epsilon\right\\}$ (34)

###### Proof:

Let $f(\delta)\triangleq||\tilde{\Sigma}(\delta)||_{\ell_{2e},y_{p}\leftarrow
y_{r}}^{2}$. If we substitute this definition in (33), we obtain (15) which
solves for $\gamma_{OA}$. We use scenario based PEA to approximately compute
$\gamma_{OA}$. To this end, let us define $\beta_{1}\in(0,1)$ and
$\epsilon_{1}\in(0,1)$. Using these definitions, from step $(5)$ of PEA, we
obtain $\gamma_{OA}$ with an accuracy $\epsilon_{1}$ and confidence
$\beta_{1}$ by solving

$\min_{\gamma}\left\\{\gamma\Bigg{|}\frac{1}{N_{1}}\sum_{i=1}^{N_{1}}\mathbb{I}\left(||\tilde{\Sigma}(\delta_{i})||_{\ell_{2e},y_{p}\leftarrow
y_{r}}^{2}\leq\gamma\right)\geq 1-\beta\right\\}$

where $N_{1}$ is given by (19). Using the result of Lemma IV.1,
$||\tilde{\Sigma}(\delta_{i})||_{\ell_{2e},y_{p}\leftarrow y_{r}}^{2}$ can be
obtained by solving the convex SDP (17). This concludes the proof. ∎

## Proof of Lemma IV.4

###### Proof:

Necessity: Multiply both sides of the constraint of (20) by $N_{1}$. Then, for
a bounded $\gamma_{OA}$ to exist, we require
$\sum_{i=1}^{N_{1}}\mathbb{I}\left(\gamma_{i}\leq\gamma_{OA},\;\forall
a_{i}\in\ell_{2e}\right)\geq N_{1}-N_{1}\beta,$ should hold with a bounded
$\gamma_{OA}$. This is satisfied only if $\lceil N_{1}(1-\beta)\rceil$ values
of the set $\\{\gamma_{i}\\}_{i=1,\dots,N_{1}}$ are bounded.
Sufficiency: Assume that the values of the set
$\\{\gamma_{i}\\}_{i=1,\dots,N_{1}}$, for the first $\left\lceil
N_{1}(1-\beta)\right\rceil$ realizations is bounded and is unbounded for the
other realizations. Let us choose $\gamma_{OA}=\max_{i=1,\dots,\lceil
N_{1}(1-\beta)\rceil}\gamma_{i}$. Substituting the definition of
$\gamma_{i},\gamma_{OA}$ in the constraint of (20) yields

$\displaystyle\frac{1}{N_{1}}\left\\{\sum_{i=1}^{\lceil
N_{1}(1-\beta)\rceil}\mathbb{I}\left(\gamma_{i}\leq\gamma_{OA}\right)+\sum_{i=\lceil
N_{1}(1-\beta)\rceil+1}^{N_{1}}\mathbb{I}\left(\gamma_{i}\leq\gamma_{OA}\right)\right\\}$
$\displaystyle=\frac{1}{N_{1}}\left\\{\lceil
N_{1}(1-\beta)\rceil+0\right\\}\geq 1-\beta.$

Thus, there exists a bounded $\gamma_{OA}$ which satisfies the constraint of
(20). This concludes the proof. ∎

## References

  * [1] T. Samad, P. McLaughlin, and J. Lu, “System architecture for process automation: Review and trends,” Journal of Process Control, vol. 17, no. 3, pp. 191–201, 2007.
  * [2] K. E. Hemsley, E. Fisher, et al., “History of industrial control system cyber incidents,” tech. rep., Idaho National Lab.(INL), Idaho Falls, ID (United States), 2018.
  * [3] S. M. Dibaji, M. Pirani, D. B. Flamholz, A. M. Annaswamy, K. H. Johansson, and A. Chakrabortty, “A systems and control perspective of CPS security,” Annual Reviews in Control, vol. 47, pp. 394–411, 2019.
  * [4] J. Milošević, Security metrics and allocation of security resources for control systems.  PhD thesis, KTH Royal Institute of Technology, 2020.
  * [5] J. Milošević, H. Sandberg, and K. H. Johansson, “Estimating the impact of cyber-attack strategies for stochastic networked control systems,” IEEE Transactions on Control of Network Systems, 2019.
  * [6] C. Murguia, I. Shames, J. Ruths, and D. Nešić, “Security metrics and synthesis of secure control systems,” Automatica, vol. 115, p. 108757, 2020\.
  * [7] Y. W. Law, T. Alpcan, and M. Palaniswami, “Security games for risk minimization in automatic generation control,” IEEE Transactions on Power Systems, vol. 30, no. 1, pp. 223–232, 2014.
  * [8] E. Bompard, C. Gao, R. Napoli, A. Russo, M. Masera, and A. Stefanini, “Risk assessment of malicious attacks against power systems,” IEEE Transactions on Systems, Man, and Cybernetics - Part A: Systems and Humans, vol. 39, no. 5, pp. 1074–1085, 2009.
  * [9] X. Liu, M. Shahidehpour, Y. Cao, L. Wu, W. Wei, and X. Liu, “Microgrid risk analysis considering the impact of cyber attacks on solar PV and ESS control systems,” IEEE transactions on smart grid, vol. 8, no. 3, pp. 1330–1339, 2016.
  * [10] A. Teixeira, H. Sandberg, and K. H. Johansson, “Strategic stealthy attacks: the output-to-output $\ell_{2}$-gain,” in 2015 54th IEEE Conference on Decision and Control (CDC), pp. 2582–2587, IEEE, 2015.
  * [11] H. Mausser and D. Rosen, “Beyond VaR: from measuring risk to managing risk,” in Proceedings of the IEEE/IAFE 1999 Conference on Computational Intelligence for Financial Engineering (CIFEr)(IEEE Cat. No. 99TH8408), pp. 163–178, IEEE, 1999.
  * [12] A. Ben-Tal and A. Nemirovski, “Robust convex optimization,” Mathematics of operations research, vol. 23, no. 4, pp. 769–805, 1998.
  * [13] G. C. Calafiore and F. Dabbene, “Probabilistic robust control,” in 2007 American Control Conference, pp. 147–158, IEEE, 2007.
  * [14] M. I. Müller, J. Milošević, H. Sandberg, and C. R. Rojas, “A risk-theoretical approach to $\mathcal{H}_{2}$-optimal control under covert attacks,” in 2018 IEEE Conference on Decision and Control (CDC), pp. 4553–4558, 2018.
  * [15] A. M. Teixeira, “Optimal stealthy attacks on actuators for strictly proper systems,” in 2019 IEEE 58th Conference on Decision and Control (CDC), pp. 4385–4390, IEEE, 2019.


# Active Learning of Non-semantic Speech Tasks with Pretrained Models

###### Abstract

Pretraining neural networks with massive unlabeled datasets has become popular
as it equips the deep models with a better prior to solve downstream tasks.
However, this approach generally assumes that the downstream tasks have access
to annotated data of sufficient size. In this work, we propose ALOE, a novel
system for improving the data- and label-efficiency of non-semantic speech
tasks with active learning (AL). ALOE uses pretrained models in conjunction
with active learning to label data incrementally and learn classifiers for
downstream tasks, thereby mitigating the need to acquire labeled data
beforehand. We demonstrate the effectiveness of ALOE on a wide range of tasks,
uncertainty-based acquisition functions, and model architectures. Training a
linear classifier on top of a frozen encoder with ALOE is shown to achieve
performance similar to several baselines that utilize the entire labeled data.

Index Terms— active learning, audio, non-semantic speech, self-supervised
learning, transfer learning

##  1 Introduction

Deep neural networks require a large amount of well-annotated training data to
generalize well. In the real world, access to labeled datasets is limited, and
collecting abundant examples requires significant investment in terms of both
finance and time. Further, the expertise required to collect high-quality
labels can be limited in domains like health monitoring. Pretraining neural
networks with massive unlabeled datasets have become a popular choice to
tackle this issue, as it equips the deep models with a better prior for
downstream problems. In particular, self-supervision has been shown to achieve
tremendous success across data modalities including audio and speech [1, 2,
3]. Self-supervised learning tasks a neural network to solve an auxiliary
learning problem for which supervision can be acquired from the unlabeled
input itself. This pushes the model to learn useful representations from
unlabeled data. One can then use the pretrained model (or an encoder) either
as a fixed feature extractor or as initialization in transfer learning.

Still, the downstream learning tasks require sufficient annotated samples for
one to train a classifier on top of the encoder from the self-supervised or
unsupervised pretraining phase. We note that for some tasks, pretrained models
may require only a small percentage (e.g., $10$%-$20$%) of labeled data to
match the performance of a supervised model, but the number of labeled
instances can still be huge. As mentioned previously, data labeling is
cumbersome and expensive, and it is unclear a priori for which instances we
should get annotations, as not all examples carry useful information for
learning. In comparison, getting unlabeled data for the desired task is much
easier.

Fig. 1: Illustration of ALOE: active learning with a pretrained model. The
encoder parameters are frozen, allowing the use of the same encoder across
multiple downstream tasks.

In light of these observations and challenges, we design ALOE111Code:
https://github.com/HarlinLee/ALOE (Active Learning of non-semantic speech
tasks with pretrained models) to improve the label- and data-efficiency of
non-semantic speech tasks [1]. Figure 1 describes how ALOE exploits pretrained
models with active learning (AL) for gradual labeling of data and learning
classifiers for downstream tasks. While AL has been explored in speech
recognition [4, 5, 6], to the best of our knowledge, ALOE is a first attempt
at improving label efficiency for non-semantic speech tasks with AL and
pretrained models. In principle, AL provides a systematic way to procure
labels for the most informative instances, e.g., a class for which a model is
highly uncertain [7, 8]. AL framework comprises three stages: a)
acquisition—selecting relevant examples, b) annotation—getting ground-truth
labels from a human annotator; and c) retraining—learning model on acquired
and existing labeled instances. In practice, these steps are time-consuming
and computationally expensive because a model has to be trained many times
during the AL cycle. We improve the efficiency of AL with the power of
semantic representations from pretrained models while also enhancing its
acquisition capability, which is otherwise limited when training a model from
scratch. Furthermore, we are privy to a better view of the annotation process
with human-in-the-loop.

We demonstrate the effectiveness of our approach on a broad range of tasks,
uncertainty-based acquisition functions, and model architectures. Training a
linear classifier on top of a frozen encoder with AL uses only a fraction of
the examples yet results in a similar performance as several baselines that
utilize the entire labeled data. ALOE provides an end-to-end system for
exploiting pretrained models more effectively and mitigates the need to
acquire large labeled data beforehand.

##  2 Methodology

We propose to use a pretrained (unsupervised or self-supervised) model with
active learning (AL) to improve the data- and label-efficiency of deep models
in non-semantic speech tasks. Importantly, ALOE has a shared fixed pretrained
encoder with separate shallow classifiers for each end-task. Our approach
leverages generic speech representations learned from massive amounts of
unlabeled data and identifies key samples from an intended end-task that are
to be labeled by a human annotator (i.e., an oracle) depending on their
uncertainty scores.

We consider an AL setup with the pool-based acquisition as commonly studied in
the literature [8, 9]. Let $\mathcal{X}\subseteq\mathbb{R}^{d}$ be
$d$-dimensional speech data samples, $\mathcal{Y}$ be labels of a non-semantic
speech classification task, and
$\mathcal{F}_{\theta}:\mathcal{X}\to\mathbb{R}^{m}$ be a pretrained encoder,
whose embedding dimension $m\ll d$. Given some labeled instances
$\mathcal{D}_{l}\subset\mathcal{X}\times\mathcal{Y}$ and a large amount of
unlabeled data $\mathcal{D}_{u}\subset\mathcal{X}$ with
$|\mathcal{D}_{l}|\ll|\mathcal{D}_{u}|$, the aim is to incrementally label
samples in $\mathcal{D}_{u}$ to minimize the cost of annotation, better
understand the annotation process, and ultimately improve model generalization
with few labels.

For each task, we initiate the AL process by acquiring $\mathcal{D}_{l}$ to
train a shallow classifier
$\mathcal{G}_{\omega}:\mathbb{R}^{m}\to\mathbb{R}^{|\mathcal{Y}|}$ on top of
the $m$-dimensional representations from $\mathcal{F}_{\theta}$.
$\mathcal{G}_{\omega}$ is a fully-connected linear model with softmax
activation such that it outputs the probability an input $x\in\mathcal{X}$
belongs to each class $y\in\mathcal{Y}$:

$\mathcal{G}_{\omega}(\mathcal{F}_{\theta}(x))=[P(y_{1}|x),P(y_{2}|x),\ldots,P(y_{|\mathcal{Y}|}|x)].$
(1)

Once $\mathcal{G}_{\omega}$ is trained on $\mathcal{D}_{l}$, model weights
$\omega$ is fixed and predictions for each instance in $\mathcal{D}_{u}$ are
generated. ALOE then uses an acquisition function
$\mathcal{A}:\mathbb{R}^{|\mathcal{Y}|}\to\mathcal{X}$ to select the most
valuable examples of $\mathcal{D}_{u}$ for label generation within a certain
budget. Once these labels are acquired, this batch of examples is merged into
the existing $\mathcal{D}_{l}$. It is followed by retraining
$\mathcal{G}_{\omega}$ using the updated $\mathcal{D}_{l}$, and we repeat this
process for a fixed number of AL acquisition steps. We note that instead of
keeping $\mathcal{F}_{\theta}$ fixed during AL, one can fine-tune the entire
model (i.e., $\mathcal{F}_{\theta}$ and $\mathcal{G}_{\omega}$) end-to-end,
but this process can be very time-consuming as retraining has to be performed
after each label acquisition step, and the learnable parameters also increase
significantly. Similarly, the feature extraction model $\mathcal{F}_{\theta}$
will become task-specific; it may lose its generalizable nature and not
perform well for other downstream tasks.

For the acquisition function $\mathcal{A}$, we use an uncertainty sampling-
based method called smallest margin, which is relatively simple yet shown to
be effective in identifying informative examples for annotation [8, 10].
Specifically, $\mathcal{A}$ selects

$\displaystyle x^{*}=\arg\min_{x\in D_{u}}\leavevmode\nobreak\
P(y_{(1)}|x)-P(y_{(2)}|x),$ (2)

where $P(y_{(i)}|x)$ is the $i$th largest probability in (1), e.g. the
predicted label for the sample is $y_{(1)}$. That is, (2) chooses samples that
have a “very close second prediction.” Thus the model is less certain about
them, and acquiring their labels from the oracle will provide more information
about where the decision boundary of the updated model should be.

Table 1: Comparison of test set accuracy (%) of our approach with other baselines on different end-tasks. ALOE achieves similar recognition rate with class-aware sampling, while using several folds less labeled examples. The baseline results are from [11], where available; else we train a linear classifier on time-averaged representations using published models. Dataset | TRILL [1] | TRILL-Dist [1] | FRILL [11] | TRILLsson [12] | ALOE (Ours)
---|---|---|---|---|---
Class-Aware | Class-Agnostic
Random | Uncertainty | Random | Uncertainty
MSWC (Micro-EN) | 81.3 | 74.4 | 79.1 | 93.7 | 90.6 | 93.0 | 76.0 | 79.7
SpeechCommands | 81.9 | 80.2 | 79.7 | 96.4 | 92.6 | 94.9 | 70.3 | 78.6
Vocalsound | 88.2 | 85.8 | 86.7 | 91.1 | 84.9 | 88.2 | 79.0 | 79.1
Voxforge | 84.5 | 80.0 | 76.9 | 99.6 | 98.4 | 99.2 | 94.4 | 96.2
FluentSpeech | 69.3 | 62.3 | 64.9 | 97.5 | 83.5 | 87.5 | 60.8 | 62.6

(a) Class-Aware Sampling

(b) Class-Agnostic Sampling

Fig. 2: Uncertainty sampling outperforms random sampling at every AL round, as
measured by validation set accuracy (%).

##  3 Experiments

For $\mathcal{F}_{\theta}$, we leverage publicly available pretrained models
from the TRILLsson family, in particular, the Audio Spectrogram Transformer
(AST) [12]. TRILLsson models are trained via knowledge distillation using
large-scale unlabeled data with a massive self-supervised conformer-based
teacher model. They provide state-of-the-art performance on a broad spectrum
of downstream non-semantic speech tasks while being smaller than the teacher
model. All pretrained models mentioned in this paper are from TensorFlow Hub
[13]. $\mathcal{F}_{\theta}$ embeds the entire audio clip into a vector with
dimension $m=1024$.

For each task, we report results aggregated from $10$ independent runs of the
experiment. For each run of the experiment, there are $100$ AL acquisition
steps, and at each AL acquisition step, $\mathcal{G}_{\omega}$ is trained for
$100$ epochs with Adam and a learning rate of $0.001$. As the size of $\omega$
is quite small, the added benefit of our approach is that AL executes at a
rapid pace. $\mathcal{D}_{l}$ is initially seeded with $5$ labeled examples
per class. At each round of AL, class-aware sampling selects one example per
class based on the predicted labels, while class-agnostic sampling picks a
single example from all of $\mathcal{D}_{u}$. Note that this means they
acquire $|\mathcal{Y}|$ labels and one label at each step, respectively.

Several publicly available datasets are used to evaluate audio recognition
models on non-semantic speech tasks [1, 12]. We perform experiments on MSWC
(Micro-English) [14] and SpeechCommands [15] for keyword spotting, comprising
of ($96,099$ samples, $31$ classes) and ($100,503$ samples, $12$ classes),
respectively. For spoken language identification, we use Voxforge [16]
containing $176,436$ audio clips from $6$ different languages. Similarly, for
human vocal sounds monitoring, e.g., coughing and sneezing, we use Vocalsound
[17] that has $21,024$ audio examples from $6$ classes. Finally, we evaluate
on action detection ($30,043$ samples, $6$ classes) using FluentSpeech [18].
In all cases, we use the standard train, validation, and test splits provided
with the original datasets, with audio sampled at $16$kHz.

We compare ALOE against many baseline models. First, we investigate several
other self-supervised or distillation-based methods. In TRILL [1], TRILL-Dist
[1], FRILL [11], and TRILLsson (AST), the linear classifiers are trained using
the entire labeled data from the downstream task. These baselines,
particularly the AST model, establish an upper-bound performance that can be
achieved with a simple classifier trained with all labeled examples from a
specific task. Additionally, we explore other uncertainty sampling methods [8,
9] such as largest margin, least confidence, entropy, and norm, as well as
random acquisition, i.e. sampling from a uniform distribution on the pool
$\mathcal{D}_{u}$ at each acquisition step. Lastly, we compare the performance
of AST as $\mathcal{F}_{\theta}$ to other neural network architectures such as
ResNet-50 and EfficientNetv2 (B3) from the TRILLsson family [12]. Unless
otherwise specified, ALOE uses the TRILLsson (AST) pretrained model with
class-aware smallest margin sampling.

##  4 Results and Analysis

Table 2: Uncertainty sampling provides better performance on test set than random sampling across different architectures. Dataset |  ResNet-50 |  EfficientNet-v2 (B3) |  Spectrogram Transformer (AST)
---|---|---|---
Random | Uncertainty | Random | Uncertainty | Random | Uncertainty
MSWC (Micro-EN) |  91.4$\pm$ 0.70 | 92.8$\pm$ 0.58 |  88.2$\pm$ 1.11 | 91.9$\pm$ 0.56 |  90.6$\pm$ 1.48 | 93.0$\pm$ 0.50
SpeechCommands |  92.4$\pm$ 1.37 | 93.1$\pm$ 0.89 |  90.4$\pm$ 0.58 | 92.5$\pm$ 0.96 |  92.6$\pm$ 1.70 | 94.9$\pm$ 1.12
Vocalsound |  82.4$\pm$ 0.92 | 85.6$\pm$ 0.80 |  84.2$\pm$ 0.73 | 87.6$\pm$ 0.38 |  84.4$\pm$ 0.94 | 88.2$\pm$ 0.35
Voxforge |  95.7$\pm$ 0.41 | 97.4$\pm$ 0.23 |  97.0$\pm$ 0.29 | 98.4$\pm$ 0.07 |  98.4$\pm$ 0.17 | 99.2$\pm$ 0.06
FluentSpeech |  79.0$\pm$ 1.90 | 82.7$\pm$ 1.07 |  80.9$\pm$ 1.95 | 85.1$\pm$ 0.96 |  83.5$\pm$ 1.14 | 87.5$\pm$ 0.96

(a)  (b)

(c)  (d)

Fig. 3: Different uncertainty sampling methods paired with pretrained model
perform similarly well on validation set.

Table 1 compares the test set performance of ALOE after 100 rounds of AL to
other self-supervised or distillation-based models. As expected, TRILLsson has
the highest recognition rate (often above 95%) across a wide range of non-
semantic speech classification tasks. But ALOE with class-aware uncertainty-
based sampling achieves accuracy comparable to TRILLsson while using several
times fewer labeled examples. For example, ALOE arrives at 99.2% accuracy on
Voxforge after only acquiring labels for 600 samples, surprisingly close to
the 99.6% achieved by the upper-bound model that used the entire labeled
dataset. This suggests that with the pretrained TRILLsson (AST) model as
$\mathcal{F}_{\theta}$, the linear classifier $\mathcal{G}_{\omega}$ needs
only a couple hundred labeled examples to be near perfect in this task. The
implications are impressive: when deployed in the real world, this human-in-
the-loop approach may eliminate the cost of acquiring excess labels in the
first place, taking the guesswork out of data collection. We note that ALOE
gets to within 0.7% to 2.9% of TRILLsson’s accuracy in MSWC, SpeechCommands,
and Vocalsound as well, supporting the notion that AL with pretrained models
can improve data- and label-efficiency in many non-semantic speech tasks.

Next, we discuss the effect of uncertainty-based sampling in ALOE. Comparing
the neighboring random and uncertainty columns in Table 1 shows that although
the extent may differ (0.1% to 8.3%), the uncertainty-based sampling method
often leads to a higher test set accuracy for different tasks in both class-
aware and class-agnostic settings. Figure 2 confirms that this is also
observed during the AL phase, as measured by validation set accuracy. These
results indicate that ALOE successfully selects examples that are more
informative than random picks. Within uncertainty-based sampling, the
different acquisition functions perform similarly well; see Figure 3.
Furthermore, we explore the effect of AST as the default pretrained model by
switching it out with different neural network architectures. Results on the
test set are summarized in Table 2. The different pretrained TRILLsson models
performed similarly, but AST showed a slight advantage. We point out from
Table 2 that uncertainty sampling performs better than random sampling across
different architectures as well.

Recall that class-aware setting selects more examples than class-agnostic
setting at every acquisition step, and therefore these two cannot be directly
compared to each other. Instead, users should choose an approach based on
their AL labeling budgets and computational costs. For example, class-agnostic
may make more sense when labeling is very expensive and there are many
classes. Users also need to choose the number of AL acquisition steps. While
we fixed that number at 100 for all experiments in this work, users can easily
monitor validation accuracy as in Figure 2 to determine stopping points. For
instance, they may decide to do early stopping when the performance plateaus
(e.g. SpeechCommands with class-aware sampling) or let the model train longer
(e.g. Fluent Speech).

ALOE’s core strength is in its simplicity. Indeed, adding more layers or
complexity to $\mathcal{G}_{\omega}$ may improve the classification accuracy,
but we wanted to show that even with a linear (i.e. single layer) model,
optimal performance can be achieved. Also, it is standard protocol in self-
supervised learning to evaluate pretrained models with linear probes [3].
Further, keeping $\mathcal{G}_{\omega}$ small greatly improves training
efficiency and reduces the number of parameters to be learned. To reiterate,
ALOE does not fine-tune the encoder during AL as our motivation is to use a
generic feature extractor for more than one task, and updating the parameters
with few samples can have catastrophic consequences for the learned
representations from large-scale data. However, we note that when a sizeable
portion of the data is labeled at the end of the AL phase, it may be used for
end-to-end model fine-tuning.

##  5 Conclusions

We proposed ALOE, a novel approach to improve label- and sample-efficiency of
non-semantic speech tasks with active learning. It provides an end-to-end
system that exploits pretrained models more effectively, consequently
mitigating the need to prepare large labeled data for downstream tasks. ALOE’s
simplicity allows easy implementation, scaling and deployment. We plan to
extend this framework to graph-based active learning and to AudioSet in the
future.

## References

  * [1] Joel Shor, Aren Jansen, Ronnie Maor, Oran Lang, Omry Tuval, Félix de Chaumont Quitry, Marco Tagliasacchi, Ira Shavitt, Dotan Emanuel, and Yinnon Haviv,  “Towards Learning a Universal Non-Semantic Representation of Speech,”  in Proc. Interspeech 2020, 2020, pp. 140–144.
  * [2] Alexei Baevski, Yuhao Zhou, Abdelrahman Mohamed, and Michael Auli,  “wav2vec 2.0: A framework for self-supervised learning of speech representations,”  Advances in Neural Information Processing Systems, vol. 33, pp. 12449–12460, 2020.
  * [3] Aaqib Saeed, David Grangier, and Neil Zeghidour,  “Contrastive learning of general-purpose audio representations,”  in ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2021, pp. 3875–3879.
  * [4] G. Riccardi and D. Hakkani-Tur,  “Active learning: theory and applications to automatic speech recognition,”  IEEE Transactions on Speech and Audio Processing, vol. 13, no. 4, pp. 504–511, 2005.
  * [5] H Jiaji, C Rewon, R Vinay, L Hairong, S Sanjeev, and C Adam,  “Active learning for speech recognition: The power of gradients,”  in The 30th Conference on Neural Information Processing Systems, NIPS. Barcelona, Spain, 2016, pp. 1–5.
  * [6] Karan Malhotra, Shubham Bansal, and Sriram Ganapathy,  “Active Learning Methods for Low Resource End-to-End Speech Recognition,”  in Proc. Interspeech 2019, 2019, pp. 2215–2219.
  * [7] David D. Lewis and William A. Gale,  “A sequential algorithm for training text classifiers,”  1994, pp. 3–12, Springer-Verlag.
  * [8] Burr Settles,  “Active learning,”  Synthesis lectures on artificial intelligence and machine learning, vol. 6, no. 1, pp. 1–114, 2012.
  * [9] Kevin Miller, Jack Mauro, Jason Setiadi, Xoaquin Baca, Zhan Shi, Jeff Calder, and Andrea L Bertozzi,  “Graph-based active learning for semi-supervised classification of sar data,”  in Algorithms for Synthetic Aperture Radar Imagery XXIX. SPIE, 2022, vol. 12095, pp. 126–139.
  * [10] David D Lewis and Jason Catlett,  “Heterogeneous uncertainty sampling for supervised learning,”  in Machine learning proceedings 1994, pp. 148–156. Elsevier, 1994\.
  * [11] Jacob Peplinski, Joel Shor, Sachin Joglekar, Jake Garrison, and Shwetak Patel,  “FRILL: A Non-Semantic Speech Embedding for Mobile Devices,”  in Proc. Interspeech 2021, 2021, pp. 1204–1208.
  * [12] Joel Shor and Subhashini Venugopalan,  “TRILLsson: Distilled Universal Paralinguistic Speech Representations,”  in Proc. Interspeech 2022, 2022, pp. 356–360.
  * [13] Martín Abadi, Ashish Agarwal, Paul Barham, Eugene Brevdo, Zhifeng Chen, Craig Citro, Greg S. Corrado, Andy Davis, Jeffrey Dean, Matthieu Devin, Sanjay Ghemawat, Ian Goodfellow, Andrew Harp, Geoffrey Irving, Michael Isard, Yangqing Jia, Rafal Jozefowicz, Lukasz Kaiser, Manjunath Kudlur, Josh Levenberg, Dandelion Mané, Rajat Monga, Sherry Moore, Derek Murray, Chris Olah, Mike Schuster, Jonathon Shlens, Benoit Steiner, Ilya Sutskever, Kunal Talwar, Paul Tucker, Vincent Vanhoucke, Vijay Vasudevan, Fernanda Viégas, Oriol Vinyals, Pete Warden, Martin Wattenberg, Martin Wicke, Yuan Yu, and Xiaoqiang Zheng,  “TensorFlow: Large-scale machine learning on heterogeneous systems,” 2015,  Software available from tensorflow.org.
  * [14] Mark Mazumder, Sharad Chitlangia, Colby Banbury, Yiping Kang, Juan Manuel Ciro, Keith Achorn, Daniel Galvez, Mark Sabini, Peter Mattson, David Kanter, et al.,  “Multilingual spoken words corpus,”  in Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2), 2021.
  * [15] Pete Warden,  “Speech commands: A dataset for limited-vocabulary speech recognition,”  arXiv preprint arXiv:1804.03209, 2018.
  * [16] Ken MacLean,  “Voxforge,”  Ken MacLean.[Online]. Available: http://www. voxforge. org/home.[Acedido em 2012], 2018.
  * [17] Yuan Gong, Jin Yu, and James Glass,  “Vocalsound: A dataset for improving human vocal sounds recognition,”  in ICASSP 2022 - 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2022, pp. 151–155.
  * [18] Loren Lugosch, Mirco Ravanelli, Patrick Ignoto, Vikrant Singh Tomar, and Yoshua Bengio,  “Speech Model Pre-Training for End-to-End Spoken Language Understanding,”  in Proc. Interspeech 2019, 2019, pp. 814–818.