08 · Evasion testing · Adversarial
We attacked
our own detector
A black-box evasion campaign against QUARANET and four baselines on the same frozen
split: an attacker perturbs features within an L∞ budget, 60 label-only queries per sample, and wins if
a malicious packet is called benign. At a realistic budget (ε=0.05) QUARANET is evaded
10.0% of the time versus 64.7% for a decision tree,
77.3% for a random forest and 100% for the quantised MLP.
Because each feature is quantised to 32 levels, any perturbation that never crosses a boundary yields a
bit-identical hypervector and provably cannot change the decision.
More useful than the win: every successful evasion collapsed the Hamming
margin from a median of 219 bits to 15 100% landed below the flight MARGIN of 73,
inside the “unknown” band. Evasion does not buy silence; it buys a low-confidence flag.
Self-tested10.0% evaded at ε=0.05 · 100% of evasions fall below MARGIN
What went against us. Freezing the volumetric evidence an attacker cannot fake barely
changed the result (10.0% → 8.7%), which means the model leans on forgeable header fields, the
same TCP artifacts our feature audit flagged. And at an unconstrained ε=0.5, every model
tested is defeated, ours at 98.7%. We publish both numbers, because a self-assessment that only contains
good news is a marketing document.
What we did about it
That finding opened a piece of work we have since finished. The detector was
trained on a network corpus, and several of its inputs were TCP artifacts with no counterpart on
a space link. We rebuilt the feature set from the CCSDS telecommand protocol itself, on a
simulated link running the real frame acceptance rules, and sorted every feature by how much of
it an attacker controls.
Eleven features remain. None of them is a single-frame header value the
attacker writes freely. Five are produced by the spacecraft's own frame acceptance
state machine, against a counter the attacker cannot observe, because it is reported only on the
downlink. He can raise those five by attacking. He cannot lower them.
| Measured on the rebuilt feature set | Result |
|---|
| Detection accuracy, seven independent model seeds | 98.00% ± 0.49 |
| Recall | 96.74% |
| False-positive rate | 0.75% |
| Attack attribution, six classes | 94.62% |
| Evasion once the attacker is held to what a transmitter can do | 0.0% |
| Change in flight memory | 0 bytes |
Read that last row carefully. The 0.0% is a property of the feature set, not
of our classifier: under the same constraint every model we tested collapses to roughly the
same place. It holds because each remaining input counts something the attacker adds to the
uplink, and he cannot un-transmit a frame. It says nothing about an attacker who simply
transmits less, which is a smaller attack and which we measure separately. The corpus behind
these numbers is a simulated mission running modelled protocol behaviour.
It is not recorded spacecraft traffic, and replacing it with recorded operator traffic is
the next thing that would make it flight evidence.
