Resilient Dynamic Average-Consensus of Multiagent Systems

This letter presents a distributed protocol based on competitive interaction design method to solve the dynamic average-consensus problem on strongly-connected balanced directed graphs in the presence of adversaries. The competitive interaction method allows us to design a network that protects the multi-agent systems from adversaries without requiring high network connectivity and global information about the number of adversaries. We design a resilient distributed protocol to track the average of time-varying bounded reference signals, which every agent is receiving. We show that in the presence of bounded cyber-attacks onto the communication network and actuators, the agents achieve dynamic average-consensus. Simulations are presented to illustrate our theoretical results.


I. INTRODUCTION
C ONSIDER a network of autonomous agents, where each agent is receiving a time-varying reference signal. The objective is to design a distributed protocol to enable agents to track the average of time-varying signals, which every agent is receiving. This problem of tracking the average of time-varying signals is called dynamic averageconsensus or distributed average tracking problem [1], [2]. Dynamic average-consensus problem has received much attention for the past decade due to its applications in distributed formation control, distributed estimation, distributed unconstrained optimization and distributed resource allocation. A brief description of all the above applications can be found in a tutorial paper [3] and the references therein. Distributed protocols are proposed in [4]- [6] to solve the dynamic averageconsensus problem for unbounded reference signals, and with zero-steady state error [7]. However, these distributed protocols to solve the dynamic average-consensus problem are vulnerable to cyber-attacks, because each agent shares their local information on communication channel to track the average of time-varying reference signals. A destabilizing attack can compromise the communication channel or actuator of an agent, and prevent agents to achieve consensus. Therefore, it is important to design distributed protocols, which solve the dynamic average-consensus problem in the presence of cyber-attacks. Solving resilient static consensus problem in the presence of adversaries has received considerable attention, see for example [8]- [12]. However, there is still very limited work which aims at solving the dynamic average-consensus problem in the presence of adversaries. Very recently, a decentralized resilient state-tracking problem is solved in [13] in the presence of cyber-attacks on sensor nodes. However, this letter does not consider attacks on the communication network and actuators. To our knowledge, solving the dynamic averageconsensus problem in the presence of adversaries is still an open problem [14].
The contributions of this letter are twofold. First, a new dynamic average-consensus protocol based on competitive interaction [10], [11] is proposed, which enables agents to track the average of time-varying bounded reference signals (see Section III). The assumption on reference signals of being bounded can be seen in power system application [15]. Second, it is shown that the proposed dynamic-average consensus protocol is resilient against any number of bounded cyber-attacks on the communication links between agents and actuators of agents in the network (see Section IV). The proposed resilient dynamic average-consensus is illustrated via simulations in Section V.

A. Notations and Preliminaries on Graph Theory
The Euclidean norm of a column vector x ∈ R n is denoted by x , and x T is the transpose of a vector x. The ith eigenvalue of a square matrix, say A, can be written as This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ b i = {λ i (A)} is the imaginary-part of λ i (A), and ι = √ −1. We denote I n and O n to represent n × n identity matrix and a zero matrix, respectively. We write diag(a 11 , . . . , a nn ) to denote a diagonal matrix and blockdiag(A, B) to denote a block-diagonal matrix. A column vector with n entries, all equal to 1 is denoted by 1 n . The time-derivative of a function f : t → R is denoted byḟ . The set C p contains all functions f that are p-times differentiable. A measure of a matrix A ∈ C n×n is defined as [16]: The solutions of a dynamical systemẋ = f (x) are uniformly ultimately bounded with ultimate bound if there exists c > 0, independent of t o , and for every δ ∈ (0, c), there is T ≥ 0, dependent on δ and but independent of t o , such that [17]. For detailed discussion, the readers are referred to [17].
Next, we provide a background of graph theory that we will use in the sequel. Consider a directed graph (digraph) be the adjacency matrix of the digraph G, where q ij = 1 if node i is receiving information from node j, and q ij = 0 otherwise. The set N in i = {j | q ij = 1, ∀j ∈ V} ⊆ V contains the ith agent in-neighbors. The Laplacian matrix L = L(G) of a digraph G is defined as: where D = [d ij ] ∈ R n×n is a diagonal matrix. The diagonal entry d ii (G) of the matrix D represents the number of inneighbors of the ith agent. The symmetric part of the Laplacian matrix L is denoted by sym(L) = 1 2 (L + L T ). A directed path from node v i to node v l in a digraph, is a sequence of ordered edges of the form (i, i+k), where k = 1, . . . , l−1. A digraph G is said to be strongly connected, if there exists a directed path from any node to any other node in G. A strongly connected digraph is said to be balanced digraph, if j q ij = j q ji for all i ∈ V.

B. Problem Statement
Consider a group of n ≥ 2 agents modeled as: where u i is the control input, J i represents local state x i and a time-varying reference signal r i : (0, ∞] → R that each agent is receiving, and I i j denotes the state information coming from the in-neighbors (j ∈ N in i ) of an ith agent as shown in Fig. 1. To achieve the dynamic average-consensus, the distributed protocol u i is designed such that the state of the ith agent x i (t) tracks r avg = 1 n n j=1 r j with the following assumptions on the time-varying reference signals and the digraph G representing the network topology of multi-agent systems.
Assumption 1: The signal r i (t) is uniformly bounded and uniformly continuous for all i ∈ {1, . . . , n}.
Assumption 2: The digraph G is strongly connected and balanced. The above setup imitates applications where agents receive time-varying reference signals, and the objective is that each agent tracks r avg . For example, consider a multi-camera target tracking system, in which each camera is tracking a moving target. Due to external disturbances and measurement noise, the tracking performance of each camera might be deteriorated. To improve the tracking performance, one needs to take the average of the signals received at multiple cameras. The challenging part is to compute the average of the time-varying signals in a distributed manner because centralized unit is not present. Dynamic-average consensus protocol offers a solution to such problems. Many other potential applications are presented in [3], and the references therein.
In the foregoing discussion, we assumed secure communication links between agents, and secured nodes. However, in practice, communication channels and actuators are vulnerable to cyber-attacks. Therefore, we consider false-data injection attacks, which is essentially a cyber-attack onto the actuator of the ith agent, and can be modeled as given below: whereũ i (t) is the control input together with an unknown false-data injection δ ui (t), and η ui (t) ∈ {0, 1} is an activation function, which is η ui (t) = 1, in the presence of an attack. In the case of attack onto the communication channel, agent i may not be receiving the true information from its neighbors. Thus, the feedback that agent i is receiving from its neighbor, say j ∈ N in i takes the following form: is the malicious information received by the ith agent from its neighbors, δ I i j (t) is the information injected by the adversary into the communication link, and η I i j (t) ∈ {0, 1} is the activation function. In the presence of both actuator and communication channel attack, the dynamics of (3) can be written as: Note that |δ I i j (t)|, j ∈ N in i and |δ ui (t)| for all i, are bounded. The attacker aims to generate a bounded attack signal that can destabilize (6), without having a knowledge of the agent's parameters. The bounded attacks considered in this letter are permanent [18] and can cause the system to be unstable or at least degrade the performance of the control objective. Moreover, no restrictions are made on the number of attacks.
The objective of this letter is to design a distributed resilient control law u i given in (3) such that the state x i (t) tracks the average signal r avg in the presence of cyber-attacks; that is where T < ∞ is a finite value, is sufficiently small positive value.

III. COMPETITIVE INTERACTION BASED RESILIENT DYNAMIC AVERAGE CONSENSUS
In this section, we aim to design a new distributed protocol based on competitive interaction method [11] to solve the dynamic average-consensus problem for strongly connected balanced digraphs. Later in this letter, we will show that the designed dynamic average-consensus protocol is resilient to cyber-attacks.
We propose the following resilient dynamic average consensus protocol to enable each agent to track the average of time-varying reference signals that each agent is receiving: (8) where v r i =ṙ i , and r i (t) ∈ C 2 is a time-varying signal that the ith agent is receiving, z i ∈ R is a state of the ith agent, α and β are positive scalar gains.
Remark 1: The design of α and β relies on the eigenvalues of L, which implies that the network topology must be known a priori. However, the implementation is distributed because every agent is taking decisions based on local and neighboring information. Let then in the context of (6), Similarly, letting I i j = {I x i j , I z i j }, then for each ith agent, the information available from its neighbors through the communication network is (8) in a compact vector form: where r = [r 1 , . . . , r n ] T , z = [z 1 , . . . , z n ] T and v r = [v r 1 , . . . , v r n ] T . To show that (9) achieve dynamic averageconsensus, we show that e x i = x i − 1 n n j=1 r j and e z i = z i − 1 n n j=1 r j converge to an -sized hyperball around the origin as t → ∞. To that end, we have the following transformation: Note that Le x = Lx and Le z = Lz. Taking the time-derivative of (10), we havė After algebraic manipulation, we have the following convenient form of (11): e x = −(αI n + αβL)e x + βLe z + n (αr + v r ) e z = −βLe x − (αI n + αβL)e z + n (αr + v r ), (12) where n = I n − 1 n 1 n 1 T n . Writing (12) in a compact vector form:ζ Next, we study the stability properties of (13). To do so, first we check the stability of the zero-system of (13). Thus, for r(t) = 0, (13) can be written as: In the following result, we show that the system (15) is stable. Lemma 1: Let L given in (14), be the Laplacian matrix associated with a digraph that holds Assumption 2. Let λ i (L) = δ i + ιω i be the ith eigenvalue of L. Let α > 0 and β > 0 in (14) be the gains, the system (15) is asymptotically stable if and only if α > β|ω i | 1+βδ i for all i ∈ V. Proof: To show the stability of (15), we diagonalize the matrix . To that end, we use the following transformation: whereζ = [ζ 1 ,ζ 1 ,ζ 2 , . . . ,ζ n−1 ,ζ 2 ,ζ n , . . . ,ζ 2n−2 ] T , and V is a matrix containing the generalized left-eigenvectors of L.
Note that the first and the (n+1)th elements of TSϒ(αr, v r ) are zero, because the first row vector of V is the left-eigenvector of L associated with the strongly connected balanced digraph G.
Next, we show the Input-to-State Stability (ISS) of (13). Theorem 1: Consider a network of n agents given in (9), where L be the Laplacian matrix associated with a digraph that holds Assumption 2, and each r i (t) satisfies Assumption 1. Then the norm of the solution ζ of (13) is uniformly bounded and uniformly ultimately bounded by > 0 if α > max{ β|ω i | 1+βδ i , μ( ) λ 2 (sym(L)) } and sufficiently large β > 0, for all i ∈ V. Moreover n i=1 e x i approaches to zero asymptotically. The conditions lim t→∞ n i=1 e x i → 0 and lim t→∞ n i=1 e z i → 0 entail that the average of timevarying signals stays within the states' trajectories because lim t→∞ n i=1 e x i implies lim t→∞ | 1 n n i=1 x i (t) − r avg |. Therefore, the states' trajectories enclose r avg in their convex hull, asymptotically.
Next pre-multiplyingė x andė z given in (12) by 1 T n , and by exploiting the balanced property of the digraph G, we have

IV. RESILIENT CONSENSUS IN THE PRESENCE
OF CYBER-ATTACKS In this section, we consider bounded cyber-attacks on communication network and on actuators as shown in (6). In the context of (6), the dynamics of (8) can be written as given below:ẋ where We see from Fig. 1 and Fig. 2 that d i (t) represents malicious information added to the actuator signal, denoted by δ u x i (t), and malicious information added to the neighboring state information, denoted by δ I x i j (t). Similarly, d i (t) represents malicious information added to the actuator signal, denoted by δ u z i (t), and malicious information added to the neighboring state information, denoted by δ I z i j (t). Note that, in general, an adversary can manipulate the shared information differently for different neighbors, which is known as Byzantine adversary [19]. A detailed model for the ith agent is shown in Fig. 2. In the general case as shown in (24), the adversary may or may not attack the local feedback signals, and the links (i, j), (i, k) can be manipulated differently for maximum damage.
As such, (9) takes the following form under cyber-attacks: where U and U * are positive constants. In the following, we show that agents achieve the resilient dynamic averageconsensus in the presence of adversarial attacks on communication network and on actuators. Theorem 2: Consider an interconnected system (25) where L is the Laplacian matrix associated with a digraph satisfying Assumption 2, and the attack vectors d(t), d (t) are bounded. Then for sufficiently large β > 0 and α > max{ β|ω i | 1+βδ i , μ( ) λ 2 (sym(L)) }, for all i ∈ V, the multi-agent system in (25) solve the resilient dynamic average-consensus problem, that is, the state vector x(t) ∈ R n and z(t) ∈ R n converge to a small neighborhood of r avg = 1 n n j=1 r j , where each r j satisfies Assumption 1.
Next, we consider a special case of cyber-attacks, where the attacks in (25) take the form d(t) = Ld(t) and d (t) = Ld(t), because the attack on agent i is polluting the transmitting information by the same amount. Moreover, we assume that the same malicious information is added to the local feedback signals x i and z i as well [11]. Note that the adversary is not Byzantine, as it is polluting the neighbors in a similar manner. In addition, the states x i and z i are amplified first and thereafter used as a local feedback. Thus, (25) can be written in the following form: Next, we show that x i for all i ∈ V, tracks r avg . To that end, we show the ultimate boundedness on the norm of error signals e x , e z , and lim t→∞ n i=1 e x i , lim t→∞ n i=1 e z i approach to zero. Following the similar path of coordinate transformation in Section III, define e x and e z and taking its time-derivative yields: x , e T z ] T and using the coordinate transformation ζ = TSζ given in (16), (32) takes the following form: where˜ (Ld(t), Ld(t)) = [˜ 1 , . . . ,˜ 2n−2 ] T contains the elements of TS˜ (Ld(t), Ld(t)), excluding the first and the (n + 1)the entries.
The following result shows that the resilient dynamic average-consensus can be achieved in the presence of unknown bounded attacks on the communication network.
Corollary 1: Consider an interconnected system as given in (31) where L is the Laplacian matrix associated with a digraph satisfying Assumption 2, and each r i (t) satisfies Assumption 1. Let the attack vectorsd(t),d(t) be bounded. (a) Then for α > max{ β|ω i | 1+βδ i , μ( ) λ 2 (sym(L)) } and sufficiently large β > 0, for all i ∈ V, the norm of the error vector ζ(t) in (32) is uniformly bounded and uniformly ultimately bounded by > 0. (b) Moreover, lim t→∞ n i=1 e x i and lim t→∞ n i=1 e z i approach to zero, for all i ∈ V.
(b) Next pre-multiplyingė x andė z given in (32) by 1 T n , and by exploiting the balanced property of the digraph G, we have Thus, the average of the time-varying reference signals r avg = 1 n n i=1 r i stays within the agents states trajectories x i and z i for all i ∈ {1, 2, . . . , n}. This completes the proof.
Remark 2: Theorem 2 does not quantify that r avg stays in between the state trajectories, whereas Corollary 1 quantifies this fact.
First, we demonstrate how agents achieve dynamic averageconsensus in the presence of cyber-attack on communication network as given in (31). One can always design a destabilizing bounded attack, which can destabilize a MAS. For example, the strategy of the attacker in (31) is given below: where F 1 = −I, F 2 = −2I, and d o = [9.9, 7.7, 5.5, 4.4, 2.2] T . The norm of the solution vectord(t) of (36a) is bounded because F 1 is Hurwitz and that d o is bounded. Similarly, the norm of the solution vectord(t) of (36b) is bounded because F 2 is Hurwitz. The bounded signalsd i andd i , which are the linear combination of actuator and communication attacks as shown in (24), are added to the state information that Agent i is receiving and also added to the actuator signal of Agent i, representing the cyber-attacks d i (t) and d i (t) given in (24), respectively. The competitive interaction based distributive protocol given in (9) solves the dynamic-average consensus problem in the presence of attack onto the communication network as shown in Fig. 3. Note that r avg stays in between the state trajectories. Next, we demonstrate how competitive interaction based design method enables agents to track the average of timevarying reference signals in the presence of cyber-attacks on the communication network and actuators as shown in (25), where the attack injections d(t) and d (t) have the same dynamics asd(t) andd(t), respectively, as given in (36a) and (36b). We choose α = 110 and β = 50 so that α + αβλ 2 (sym(L)) >> βμ(J). We see in Fig. 4 that state trajectories track the average signal r avg .

VI. CONCLUSION
We have designed a competitive interaction based distributed protocol to solve the dynamic average-consensus problem in the presence of adversaries. We considered attack on the communication network and actuators of the agents in a network. The cyber-attack considered in this letter is a general form of bounded attacks. We showed that agents track the average of the time-varying bounded reference signals, which each agent is receiving, in the presence of attack on the communication network and the actuators of agents.