Adversarial-Input Defense for Control Models

Learned components are hardened against crafted inputs, and physics-based sanity bounds ensure a fooled model still cannot request an unsafe action.

Crafted inputs, not random noise

Adversarial inputs are small, deliberate perturbations that push a model to a wrong output while looking normal. In a fusion control context, an attacker who can perturb diagnostics (see diagnostic spoofing) might try to steer a learned estimator or predictor toward a decision that benefits the attack. Kronos defends the models directly and, more importantly, refuses to give any model unbounded authority.

Model-level hardening

• Input validation and range/consistency checks before inference - physically impossible inputs are rejected, not classified.
• Ensembles and redundancy: agreement across independent models/diagnostics is required for consequential inferences.
• Uncertainty-aware outputs: a model that is out of distribution reports low confidence, which downgrades its authority.
• Adversarial training and robustness testing during model development.

Physics as the outer guardrail

# A model output is only acted on if it is physically plausible AND confident
def guarded_infer(model, x):
    if not physically_valid(x):        return SAFE_DEFAULT   # reject bad input
    y, conf = model.infer_with_uncertainty(x)
    if conf < policy.min_conf:         return SAFE_DEFAULT   # OOD -> fall back
    if not within_physics_bounds(y):   return SAFE_DEFAULT   # implausible -> ignore
    return y

Why the guardrail is the real defense

Adversarial robustness of any single model is never perfect. Kronos's stronger claim is architectural: no learned output bypasses the physics envelope, the actuator limits, or the independent safety path. A perfectly fooled model can still only request actions within a safe envelope; anything outside it is refused by non-learned, analyzable logic. The learned layer optimizes; the deterministic layer protects.

Design status: input validation, uncertainty gating, and physics-bound guardrails run in the twin against simulated and archival data, including adversarial test suites. Live-plasma validation waits on FOAK from Q2 2027.