Reference and Sensor Attacks on Classical Control Laws and an Open-Source Autopilot

A feedback controller is tuned to be robust against noise and bounded disturbances. An adversary who can write to its set-point or to one of its sensors is neither, and the margins a control engineer reads off a noise analysis say little about how far such an adversary can push the physical process. We study this gap on a benchmark nonlinear loop with seven classical control laws, run at a realistic 1 kHz rate with measurement noise, model error and a quantised sensor, and on ArduPilot, an open-source autopilot, in software-in-the-loop flight. On the benchmark the two attack channels behave in opposite ways. A reference attack never appears in the tracking error, yet the derivative feedforward that most designs use makes the reference channel cost about 75 times more actuation than the same injection on the sensor channel. A sensor bias destabilises the loop beyond a critical value that we derive in closed form, and across six hundred tunings of the linear laws that value is proportional to the actuator noise the law admits, so noise rejection is bought with attack margin and the quietest law is the most fragile. A residual detector tuned to avoid false alarms under a realistic model error leaves a patient attacker a bias window of up to four set-point amplitudes, and a model-consistent covert attack defeats any single-sensor test on an unstable plant. On ArduPilot the feedforward fields of a set-point message turn a 1m command into an excursion of up to 74m with every health signal nominal, navigation ramps up to 2m/s displace the vehicle by over 100m per minute without an alarm, and a second receiver helps only when the two are compared. We measure the autopilot's stealth window against its own detector tuning, evaluate a protocol-boundary rate gate and a receiver cross-check, and release all code.