In recent years, the rapid advancement of embedded technologies and intelligent perception has led to the widespread application of multi-UAV drone systems in both military and civilian domains, particularly in formation tracking control. The UAV drone, as a versatile platform, enables complex tasks such as surveillance, search and rescue, and cooperative transportation. Existing research on formation tracking control largely relies on leader-follower structures, where the leader plays a pivotal role. Leaders can be categorized into three types: autonomous leaders, non-autonomous leaders, and adversarial leaders. Autonomous leaders have zero control input, while non-autonomous leaders are driven by time-varying bounded signals. However, these models often overlook the interactive dynamics between leaders and followers, which is crucial for accurately simulating scenarios like target interception in military operations. In such cases, when a target detects approaching UAV drones, it typically performs evasive maneuvers based on the positions of other UAV drones, making it an adversarial leader. This highlights the need for adversarial leader-follower formation tracking control, where the leader’s input is state-dependent and potentially malicious.
Moreover, UAV drones heavily depend on Global Navigation Satellite Systems (GNSS) for global positioning, introducing significant security vulnerabilities. GNSS spoofing attacks, for instance, can maliciously manipulate the GNSS sensors of a UAV drone, corrupting positioning data and ultimately leading to mission failure. In adversarial scenarios, the susceptibility to such attacks increases dramatically. The adversarial leader UAV drone may be equipped with a GNSS spoofing module to disrupt the tracking efforts of follower UAV drones, thereby enhancing its chances of escape. This module can alter the GNSS signals of nearby follower UAV drones, misleading them off their intended paths. Therefore, addressing GNSS spoofing attacks while achieving formation tracking against an adversarial leader is a critical yet underexplored challenge.
To mitigate the impact of GNSS spoofing attacks, cooperative localization techniques offer a promising defense mechanism. By leveraging measurements from GNSS sensors and Ultra-Wideband (UWB) modules, accurate global positioning can be achieved even under attack. However, existing methods often require continuous sensor signals, leading to unnecessary data transmission and computational waste. Additionally, in theoretical approaches, continuous controller updates and sensor monitoring impose substantial loads on computation and communication channels. Event-triggered mechanisms have gained attention to reduce such burdens by updating controls only when necessary, but most prior work uses static triggering conditions, which may not optimize resource usage effectively.
From a control perspective, game theory provides a natural framework to model the interactive dynamics between adversarial leaders and followers. Multiplayer nonzero-sum games (MNSG) can capture the optimal strategies of both parties, where each UAV drone aims to minimize its own cost function. In this context, the leader seeks to evade followers, while followers aim to maintain a predefined formation around the leader. Solving such games typically involves Hamilton-Jacobi-Bellman equations, but exact solutions are often intractable due to unknown value functions. Approximate dynamic programming with neural networks, such as single-critic neural networks, can approximate these value functions online, enabling real-time optimal control. However, integrating these approaches with security mechanisms against GNSS spoofing attacks remains an open problem.
In this paper, we investigate the adversarial formation tracking control problem for multi-UAV drone systems under GNSS spoofing attacks. The leader is both adversarial and malicious, with its control input derived from the states of follower UAV drones. To defend against attacks, we design an event-based attack detection and switching mechanism using cooperative localization. This allows UAV drones to intermittently detect attacks and select accurate positioning data. We then construct a secure state estimator that relies only on sampled signals to continuously estimate the true states of follower UAV drones, even in the presence of output measurement noise. This estimator reduces computational burden while improving data utilization. Furthermore, we reformulate the formation tracking problem as an MNSG, where the leader and followers engage in a dynamic interaction. By employing single-critic neural networks to approximate value functions and an improved dynamic event-triggered mechanism (DETM), we develop approximate optimal control strategies for followers. These strategies ensure stable tracking of the adversarial leader while minimizing communication and computation costs. Simulation studies validate the effectiveness of our approach, demonstrating robust formation tracking under GNSS spoofing attacks.
The main contributions of this work are threefold. First, we address a novel problem: adversarial leader-follower formation tracking control under GNSS spoofing attacks. Unlike autonomous or non-autonomous leaders in prior work, the considered leader is adversarial and malicious, with its input determined by follower states. Additionally, the leader UAV drone is equipped with a GNSS spoofing module to compromise follower signals. Second, we establish a game-based formation control framework. Using MNSG theory, we model the dynamic interaction between leader and followers. The control strategies of UAV drones constitute a Nash equilibrium solution, ensuring followers track the leader in a predefined formation despite adversarial inputs. Compared to time-triggered or static event-triggered mechanisms, we design an improved DETM and derive optimal control strategies, significantly avoiding redundant updates and unnecessary data transmission. Third, we propose defense countermeasures. By combining sampled GNSS and UWB data, we design an event-based signal detection and switching mechanism to intermittently detect attacks and select accurate position data. Coupled with filtering techniques, we build a secure state estimator for UAV drones. Unlike existing methods that require continuous signals, our estimator guarantees continuous state estimation using only intermittent samples, enhancing data efficiency.
The remainder of this paper is organized as follows. In Section 1, we formulate the problem, including UAV drone dynamics, attack models, and the adversarial formation tracking control problem. Section 2 presents our methodology: a secure state estimator under GNSS spoofing attacks, game-based problem reformulation, event-triggered optimal controller design with single-critic neural networks, and overall stability analysis. Section 3 provides simulation studies to verify effectiveness and advancement. Finally, Section 4 concludes the paper and discusses future work.
1 Problem Formulation
1.1 Preliminaries
Consider a multi-UAV drone system consisting of one leader and \(N\) followers, where \(N \geq 4\). The communication topology among UAV drones is represented by an undirected graph \(\mathcal{G} = (\mathcal{V}, \mathcal{E}, \mathcal{A})\). Here, \(\mathcal{V} = \{v_1, \dots, v_N\}\) is the node set, \(\mathcal{E}\) is the edge set, and \(\mathcal{A} = [a_{ij}] \in \mathbb{R}^{N \times N}\) is the adjacency matrix. If \(v_j\) is a neighbor of \(v_i\), then \((v_j, v_i) \in \mathcal{E}\) and \(a_{ij} = 1\); otherwise, \(a_{ij} = 0\). The in-degree of node \(i\) is \(d_i = \sum_{j=1}^{N} a_{ij}\), and the in-degree matrix is \(\mathcal{D} = \text{diag}\{d_1, \dots, d_N\}\). The Laplacian matrix is \(\mathcal{L} = \mathcal{D} – \mathcal{A}\). The connection between followers and the leader is described by \(\mathcal{A}_0 = \text{diag}\{a_{10}, \dots, a_{N0}\}\), where \(a_{i0} = 1\) if follower \(i\) can access the leader’s information; otherwise, \(a_{i0} = 0\). Similarly, \(\mathcal{B}_0 = \text{diag}\{b_{01}, \dots, b_{0N}\}\) indicates the leader’s access to followers, with \(b_{0i} = 1\) if the leader can access follower \(i\)’s information; otherwise, \(b_{0i} = 0\). Let \(d_0 = \sum_{i=1}^{N} b_{0i}\). The set of followers is \(\mathcal{N} = \{1, \dots, N\}\), and the neighbor set of follower \(i\) is \(\mathcal{N}_i\). For any matrix \(M\), its maximum and minimum eigenvalues are denoted as \(\lambda_M\) and \(\lambda_M\), respectively.
1.2 UAV Drone and Attack Models
The dynamics of each UAV drone are modeled in the inertial frame \(O-XYZ\). For follower \(i \in \mathcal{N}\), the equations are:
$$
\dot{p}_i = v_i, \quad \dot{v}_i = \alpha_{p_i} p_i + \alpha_{v_i} v_i + \alpha_{u_i} u_i, \quad y_i = p_i + n_{p_i},
$$
where \(p_i \in \mathbb{R}^n\) and \(v_i \in \mathbb{R}^n\) are the position and velocity vectors, respectively; \(u_i\) is the control input; \(\alpha_{p_i}\), \(\alpha_{v_i}\), and \(\alpha_{u_i}\) are damping and control coefficients; and \(n_{p_i}\) is output measurement noise. Typically, \(n=2\) for planar motion. Define the state \(x_i = [p_i^T, v_i^T]^T \in \mathbb{R}^q\) with \(q = 2n\). Then, the system dynamics can be written as:
$$
\dot{x}_i = A_i x_i + B_i u_i, \quad y_i = C_i x_i + n_{p_i},
$$
where \(A_i \in \mathbb{R}^{q \times q}\), \(B_i \in \mathbb{R}^{q \times n}\), and \(C_i \in \mathbb{R}^{n \times q}\) are system matrices. The leader’s dynamics are:
$$
\dot{x}_0 = A_0 x_0 + B_0 u_0,
$$
with \(A_0 \in \mathbb{R}^{q \times q}\) and \(B_0 \in \mathbb{R}^{q \times n}\). We assume that for each UAV drone \(i \in \{0\} \cup \mathcal{N}\), the pairs \((A_i, B_i)\) are controllable and \((C_i, A_i)\) are observable. The noises \(n_{p_i}(t)\) and relative distance measurement noise \(n_{d_i}(t)\) are bounded, satisfying \(|n_{p_i}|_\infty \leq \varpi_{p_i}\) and \(|n_{d_i}|_\infty \leq \varpi_{d_i}\).
Under a GNSS spoofing attack, the GNSS measurement signal of a follower UAV drone can be corrupted. Let \(a_i(t) \in \mathbb{R}^n\) denote the spoofing position vector. Then, the compromised measurement output for follower \(i\) is:
$$
y_i^a(t) = C y_i(t) + a_i(t), \quad i \in \mathcal{N},
$$
where \(y_i(t)\) is the original measurement and \(C \leq 1\) is a constant vector. Additionally, each follower UAV drone is equipped with UWB sensors to measure relative distances to neighbors:
$$
d_{ij}(t) = \| p_i(t) – p_j(t) \| + n_{d_i}(t), \quad j \in \mathcal{N}_i.
$$
1.3 Adversarial Leader-Follower Formation Tracking Control Problem Under GNSS Spoofing Attacks
The objective is for followers to track the adversarial leader while maintaining a predefined geometric formation. The formation is defined by a constant vector \(\Delta = [\Delta_1^T, \dots, \Delta_N^T]^T \in \mathbb{R}^{qN}\), where \(\Delta_i = [\Delta_{p,i}, \Delta_{v,i}]^T\) is the desired relative state between follower \(i\) and the leader, with \(\Delta_{p,i}\) as the desired relative position and \(\Delta_{v,i} = 0\). All UAV drones are assumed to fly at the same altitude.
Define the local error for follower \(i\) as:
$$
\delta_i = \sum_{j=1}^{N} a_{ij}(x_i – x_j + \Delta_j – \Delta_i) + a_{i0}(x_i – x_0 – \Delta_i).
$$
The leader’s local error is:
$$
\delta_0 = -\sum_{i=1}^{N} b_{0i}(x_0 – x_i).
$$
The goals are: (1) followers track the adversarial leader and achieve the formation; (2) detect and mitigate GNSS spoofing attacks. The leader aims to escape tracking by executing an adversarial input and launching attacks to increase escape time.
2 Game-Based Secure Formation Tracking Control Strategy
2.1 Secure State Estimator Against GNSS Spoofing Attacks
To obtain accurate positioning under GNSS spoofing attacks, we design an event-based attack detection and switching mechanism using cooperative localization. Let \(y_i^{\text{uwb}}\) denote the estimated global position from UWB measurements. Define the filtered position signal deviation as \(e_{y,i}(t) = y_i(t) – y_i^{\text{uwb}}(t)\). Consider a sampling sequence \(\{t_{i,k}^s\}_{k=1}^{+\infty}\) for follower \(i\), with sampling interval \(\iota_{i,k} = t_{i,k+1}^s – t_{i,k}^s\) satisfying \(0 < \iota_i \leq \iota_{i,k} \leq \bar{\iota}_i\). The event-based detection mechanism is:
$$
t_{i,g+1}^s = \inf\{ t_{i,k}^s > t_{i,g}^s \mid e_{y,i}(t_{i,k}^s) \geq \Gamma_i(t_{i,k}^s) \},
$$
where \(\Gamma_i(t)\) is a dynamic threshold with \(0 \leq \Gamma_i(t) \leq \bar{\gamma}_i\). This mechanism intermittently detects attacks.
For \(t \in [t_{i,k}^s, t_{i,k+1}^s)\), the secure state estimator for follower \(i\) is:
$$
\begin{align*}
\dot{\hat{x}}_i &= A_i \hat{x}_i + B_i u_i – \kappa_i K_i \chi_i, \\
\dot{\chi}_i &= -\kappa_i E_i \chi_i + \kappa_i^2 A_i^T \chi_i + \kappa_i C_i^T \left( C_i \hat{x}_i(t_{i,k}^s) – y_{i,c}(t_{i,k}^s) + \alpha_i(t) \right), \\
\dot{\alpha}_i(t) &= -\kappa_i K_{i,1} \chi_{i,1},
\end{align*}
$$
where \(\hat{x}_i \in \mathbb{R}^q\) is the estimated state, \(\kappa_i > 0\), \(K_i = [K_{i,1}, K_{i,2}]^T \otimes I_n\), \(\chi_i = [\chi_{i,1}, \chi_{i,2}]^T \in \mathbb{R}^q\) is an auxiliary variable with \(\chi_i(t_{i,0}^s) = 0\), and \(\alpha_i(t)\) satisfies \(\alpha_i(t_{i,k}) = 0\). The switched measurement \(y_{i,c}(t_{i,k}^s)\) is:
$$
y_{i,c}(t_{i,k}^s) =
\begin{cases}
y_i^{\text{uwb}}\{t_{i,k}^s\}, & \text{if } t_{i,k}^s \text{ is a trigger moment}, \\
y_i\{t_{i,k}^s\}, & \text{otherwise}.
\end{cases}
$$
Define estimation error \(\tilde{x}_i = \hat{x}_i – x_i\). Under Assumptions 1-2, if \(\bar{\iota}_i < a_{\vartheta_i} / b_{\vartheta_i}\), the error converges to a bounded region:
$$
\| \tilde{x}_i \| \leq \kappa_i \sqrt{\frac{\lambda_{P_i}}{\lambda_{P_i}}} \| \tilde{x}_i(0) \| e^{-\xi_i t} + \frac{\kappa_i c_{\vartheta_i} \bar{\iota}_i}{\sqrt{\lambda_{P_i}}} \frac{2 – e^{-\xi_i \iota_i}}{1 – e^{-\xi_i \iota_i}},
$$
where \(\vartheta_i > 0\), \(P_i > 0\) satisfy \(M_i^T P_i + P_i M_i \leq -2\vartheta_i I_q\), with \(M_i = [A_i, -K_i; C_i^T C_i, -E_i + A_i^T]\), and constants \(a_{\vartheta_i} = \frac{\vartheta_i \kappa_i}{2 \lambda_{P_i}}\), \(b_{\vartheta_i} = \kappa_i^2 \sqrt{\frac{\lambda_{P_i}}{\lambda_{P_i}}}\), \(c_{\vartheta_i} = \sqrt{\lambda_{P_i}} (\kappa_i^2 \varpi_n)\), \(\xi_i = (a_{\vartheta_i} – b_{\vartheta_i} \bar{\iota}_i) e^{-a_{\vartheta_i} \bar{\iota}_i}\), and \(\varpi_n = \max\{\varpi_{p_i}, \varpi_{d_i}\}\). This estimator ensures continuous state estimation using only sampled signals, improving data utilization.
2.2 Problem Reformulation Based on Game Theory
Using the secure estimator, redefine the local error for follower \(i\) as:
$$
\delta_i^e = \sum_{j=1}^{N} a_{ij}(\hat{x}_i – \hat{x}_j + \Delta_j – \Delta_i) + a_{i0}(\hat{x}_i – x_0 – \Delta_i).
$$
To quantify performance, define the cost function for follower \(i\):
$$
J_i(\delta_i^e(0), u_i) = \int_0^\infty r_i(\delta_i^e, u_i) \, dt,
$$
where \(r_i(\delta_i^e, u_i) = (\delta_i^e)^T Q_i \delta_i^e + \sum_{j=1}^{N} a_{ij} u_j^T R_{ij} u_j + u_i^T R_{ii} u_i\), with \(Q_i, R_{ii}, R_{ij} > 0\). The leader’s cost function is:
$$
J_0(\delta_0(0), u_0) = \int_0^\infty r_0(\delta_0, u_0) \, dt,
$$
where \(r_0(\delta_0, u_0) = \delta_0^T Q_0 \delta_0 + u_0^T R_0 u_0\), with \(Q_0, R_0 > 0\).
The error dynamics are:
$$
\dot{\delta}_i^e = \mathcal{A}_i + (d_i + a_{i0}) B_i u_i – \sum_{j=1}^{N} a_{ij} B_j u_j – a_{i0} B_0 u_0 + F_i,
$$
where \(\mathcal{A}_i = \sum_{j=1}^{N} a_{ij}(A_i x_i – A_j x_j) + a_{i0}(A_i x_i – A_0 x_0)\), and \(F_i = -(d_i + a_{i0}) \kappa_i K_i \chi_i + \sum_{j=1}^{N} a_{ij} \kappa_j K_j \chi_j\). The leader’s error dynamics are:
$$
\dot{\delta}_0 = \mathcal{A}_0 – d_0 B_0 u_0 + \sum_{i=1}^{N} b_{0i} B_i u_i,
$$
with \(\mathcal{A}_0 = -\sum_{i=1}^{N} b_{0i}(A_0 x_0 – A_i x_i)\).
We formulate a multiplayer nonzero-sum game where each UAV drone seeks an optimal control strategy. A set of admissible strategies \(\{u_0, u_1, \dots, u_N\}\) is defined as continuous strategies that stabilize the system and yield finite costs. A Nash equilibrium is achieved if:
$$
J_i(\delta_i^e(0), u_i^*, u_{-i}^*, u_0^*) \leq J_i(\delta_i^e(0), u_i, u_{-i}^*, u_0^*), \quad \forall i \in \mathcal{N},
$$
and
$$
J_0(\delta_0(0), u_0^*, u_{-0}^*) \leq J_0(\delta_0(0), u_0, u_{-0}^*).
$$
2.3 Event-Triggered Optimal Controller Design
Define the value function for follower \(i\):
$$
V_i(\delta_i^e(t)) = \int_t^\infty r_i(\delta_i^e, u_i) \, d\tau.
$$
Assuming \(V_i\) is continuously differentiable, the Hamiltonian is:
$$
H_i(\delta_i^e, \nabla V_i(\delta_i^e), u_i, u_{-i}, u_0) = r_i(\delta_i^e, u_i) + \nabla V_i^T(\delta_i^e) \dot{\delta}_i^e,
$$
with \(\nabla V_i = \partial V_i / \partial \delta_i^e\) and boundary condition \(V_i(0) = 0\). Similarly, for the leader:
$$
V_0(\delta_0(t)) = \int_t^\infty r_0(\delta_0, u_0) \, d\tau,
$$
and
$$
H_0(\delta_0, \nabla V_0(\delta_0), u_0, u_{-0}) = r_0(\delta_0, u_0) + \nabla V_0^T(\delta_0) \dot{\delta}_0.
$$
Using the stationarity condition, the optimal control strategies are:
$$
u_i^*(\delta_i^e) = -\frac{1}{2} (d_i + a_{i0}) R_{ii}^{-1} B_i^T \nabla V_i^*(\delta_i^e), \quad i \in \mathcal{N},
$$
and
$$
u_0^*(\delta_0) = \frac{1}{2} d_0 R_0^{-1} B_0^T \nabla V_0^*(\delta_0).
$$
To reduce communication burden, we design an event-triggered mechanism for followers. Let \(\{t_{i,l}^c\}_{l=0}^\infty\) be a monotonically increasing triggering time sequence for follower \(i\), with \(t_{i,l}^c \leq t_{i,l+1}^c\). For \(t \in [t_{i,l}^c, t_{i,l+1}^c)\), define the sampled local error as \(\breve{\delta}_{i,l}^e = \delta_i^e(t_{i,l}^c)\), and the triggering error as \(e_{i,l}(t) = \breve{\delta}_{i,l}^e – \delta_i^e(t)\). The event-triggered optimal control for follower \(i\) is:
$$
u_i^*(\breve{\delta}_{i,l}^e) = -\frac{1}{2} (d_i + a_{i0}) R_{ii}^{-1} B_i^T \nabla V_i^*(\breve{\delta}_{i,l}^e).
$$
Assume \(u_i^*\) is Lipschitz continuous: \(\| u_i^*(\delta_i^e(t)) – u_i^*(\breve{\delta}_{i,l}^e) \| \leq G_i \| e_{i,l}(t) \|\), with \(G_i > 0\). Then, the triggering condition is:
$$
\| e_{i,l}(t) \|^2 \leq \frac{\Lambda_{2i} \lambda_{Q_i} \| \delta_i^e \|^2 + \sigma_{1i} \theta_i + \sigma_{4i} e^{-\sigma_{3i} t}}{\Lambda_{1i} G_i^2},
$$
where \(\Lambda_{1i} = \lambda_{R_{ii}} + 2d_i \lambda_{R_{ij},M} + d_i \| B_i \|^2\), \(\Lambda_{2i} = (1 – \eta_{1i}^2)\), \(\lambda_{R_{ij},M} = \max\{\lambda_{R_{i1}}, \dots, \lambda_{R_{iN}}\}\), \(\eta_{1i} \in (0,1)\), and \(\theta_i\) is a dynamic auxiliary variable with \(\dot{\theta}_i = -\sigma_{2i} \theta_i + \Lambda_{2i} \lambda_{Q_i} \| \delta_i^e \|^2 + \sigma_{4i} e^{-\sigma_{3i} t} – \Lambda_{1i} G_i^2 \| e_{i,l}(t) \|^2\). The parameters \(\eta_{1i}\) and \(\sigma_{1i}, \sigma_{2i}, \sigma_{3i}, \sigma_{4i} > 0\) are chosen such that \(\| \nabla V_i^*(\delta_i^e) \|^2 \leq \eta_{1i}^2 \lambda_{Q_i} \| \delta_i^e \|^2\). This dynamic event-triggered mechanism reduces triggering frequency compared to static ones.
To exclude Zeno behavior, the triggering interval \(\Delta t_l^c = t_{i,l+1}^c – t_{i,l}^c\) has a positive lower bound:
$$
\Delta t_l^c \geq \frac{1}{\| A_i \|} \ln \left( 1 + \frac{\| A_i \| \| e_{i,l} \|}{\| A_i \| \| \breve{\delta}_{i,l}^e \| + \Psi_{1i}} \right) > 0,
$$
where \(\Psi_{1i}\) is bounded. Thus, Zeno behavior is avoided.
2.4 Single-Critic Neural Network Approximator
Since the optimal value functions are unknown, we approximate them using single-critic neural networks. For agent \(-i \in \{0\} \cup \mathcal{N}\) (with \(-i=0\) for leader and \(-i \in \mathcal{N}\) for followers), the ideal value function is:
$$
V_{-i}^*(\delta_{-i}) = W_{c,-i}^T \phi_{-i}(\delta_{-i}) + \varepsilon_{-i},
$$
where \(W_{c,-i} \in \mathbb{R}^{h_{c,-i}}\) is the ideal weight vector, \(\phi_{-i} \in \mathbb{R}^{h_{c,-i}}\) is the activation function, \(h_{c,-i}\) is the number of neurons, and \(\varepsilon_{-i} \in \mathbb{R}\) is the reconstruction error. The gradient is \(\nabla V_{-i}^*(\delta_{-i}) = \nabla \phi_{-i}^T(\delta_{-i}) W_{c,-i} + \nabla \varepsilon_{-i}(\delta_{-i})\). The approximate value function is:
$$
\hat{V}_{-i}(\delta_{-i}) = \hat{W}_{c,-i}^T \phi_{-i}(\delta_{-i}),
$$
with gradient \(\nabla \hat{V}_{-i}(\delta_{-i}) = \nabla \phi_{-i}^T(\delta_{-i}) \hat{W}_{c,-i}\). The approximate optimal control strategies become:
$$
\hat{u}_i = -\frac{1}{2} (d_i + a_{i0}) R_{ii}^{-1} B_i^T \left( \nabla \phi_i^T(\breve{\delta}_{i,l}^e) \hat{W}_{c,i} \right), \quad i \in \mathcal{N},
$$
and
$$
\hat{u}_0 = \frac{1}{2} d_0 R_0^{-1} B_0^T \left( \nabla \phi_0^T(\delta_0) \hat{W}_{c,0} \right).
$$
Define the Hamiltonian errors:
$$
\hat{H}_i = \hat{r}_i + \hat{W}_{c,i}^T \nabla \phi_i(\delta_i^e) \dot{\delta}_i^e = e_{c,i}, \quad \hat{H}_0 = \hat{r}_0 + \hat{W}_{c,0}^T \nabla \phi_0(\delta_0) \dot{\delta}_0 = e_{c,0},
$$
where \(\hat{r}_i = r_i(\delta_i^e, \hat{u}_i(\breve{\delta}_{i,l}^e))\) and \(\hat{r}_0 = r_0(\delta_0, \hat{u}_0)\). To train the neural networks, we minimize the objective functions \(L_{c,-i} = \frac{1}{2} e_{c,-i}^T e_{c,-i}\) using normalized gradient descent:
$$
\dot{\hat{W}}_{c,-i} = -\beta_{c,-i} \frac{\varrho_{-i} e_{c,-i}}{(1 + \varrho_{-i}^T \varrho_{-i})^2},
$$
where \(\beta_{c,-i} > 0\) is the learning rate, and \(\varrho_{-i} = \nabla \phi_{-i}(\delta_{-i}) \dot{\delta}_{-i}\). The weight estimation errors \(\tilde{W}_{c,-i} = W_{c,-i} – \hat{W}_{c,-i}\) satisfy:
$$
\dot{\tilde{W}}_{c,-i} = -\beta_{c,-i} \frac{\varrho_{-i}}{(1 + \varrho_{-i}^T \varrho_{-i})^2} \left( \varrho_{-i}^T \tilde{W}_{c,-i} – e_{cH,-i} \right),
$$
with \(e_{cH,-i} = -\nabla \varepsilon_{-i}(\delta_{-i}) \dot{\delta}_{-i}\). Assume the gradients \(\nabla \phi_{-i}\), \(\nabla \varepsilon_{-i}\), weights \(W_{c,-i}\), \(\hat{W}_{c,-i}\), and residual \(e_{cH,-i}\) are bounded: \(\| \nabla \phi_{-i} \| \leq \varpi_{\phi_{-i}}\), \(\| \nabla \varepsilon_{-i} \| \leq \varpi_{\varepsilon_{-i}}\), \(\| W_{c,-i} \| \leq \varpi_{W_{-i}}\), \(\| \hat{W}_{c,-i} \| \leq \varpi_{\hat{W}_{-i}}\), \(\| e_{cH,-i} \| \leq \varpi_{e_{-i}}\).
2.5 Overall Stability Analysis
We now analyze the stability of the closed-loop system. Consider the Lyapunov candidate:
$$
L_3 = L_{3,1} + L_{3,2} + L_{3,3},
$$
where
$$
L_{3,1} = \sum_{i=1}^{N} \left( V_i^*(\delta_i^e) + \theta_i + \frac{\sigma_{4i}}{\sigma_{3i}} e^{-\sigma_{3i} t} \right) + V_0^*(\delta_0), \quad L_{3,2} = \sum_{i=1}^{N} V_i^*(\breve{\delta}_{i,l}^e), \quad L_{3,3} = \sum_{i=1}^{N} \frac{1}{2} \tilde{W}_{c,i}^T \tilde{W}_{c,i} + \frac{1}{2} \tilde{W}_{c,0}^T \tilde{W}_{c,0}.
$$
For \(t \in [t_{i,l}^c, t_{i,l+1}^c)\) (no event), the derivative \(\dot{L}_3\) is bounded by:
$$
\dot{L}_3 \leq -\lambda_{Q_0} \| \delta_0 \|^2 + \ell_0 – \frac{\beta_{c,0}}{2} \lambda_{\rho_0} \| \tilde{W}_{c,0} \|^2 + \frac{\beta_{c,0}}{2} \| \varpi_{e_0} \|^2 + \sum_{i=1}^{N} \left( -\eta_{1i} \lambda_{Q_i} \| \delta_i^e \|^2 + \ell_{1i} – \frac{\beta_{c,i}}{2} \lambda_{\rho_i} \| \tilde{W}_{c,i} \|^2 + \frac{\beta_{c,i}}{2} \| \varpi_{e_i} \|^2 \right),
$$
where \(\ell_0\) and \(\ell_{1i}\) are constants derived from bounds. If the errors satisfy \(\delta_i^e \notin \Omega_{\delta_i^e}\), \(\delta_0 \notin \Omega_{\delta_0}\), \(\tilde{W}_{c,i} \notin \Omega_{\tilde{W}_{c,i}}\), and \(\tilde{W}_{c,0} \notin \Omega_{\tilde{W}_{c,0}}\), then \(\dot{L}_3 \leq 0\), where these sets are defined as:
$$
\Omega_{\delta_i^e} = \left\{ \delta_i^e : \| \delta_i^e \| \leq \sqrt{\frac{2\ell_{1i} + \beta_{c,i} \| \varpi_{e_i} \|^2}{4\eta_{1i} \lambda_{Q_i}}} \right\}, \quad \Omega_{\delta_0} = \left\{ \delta_0 : \| \delta_0 \| \leq \sqrt{\frac{2\ell_0 + \beta_{c,0} \| \varpi_{e_0} \|^2}{4\lambda_{Q_0}}} \right\},
$$
$$
\Omega_{\tilde{W}_{c,i}} = \left\{ \tilde{W}_{c,i} : \| \tilde{W}_{c,i} \| \leq \sqrt{\frac{2\ell_{1i} + \beta_{c,i} \| \varpi_{e_i} \|^2}{2\beta_{c,i} \lambda_{\rho_i}}} \right\}, \quad \Omega_{\tilde{W}_{c,0}} = \left\{ \tilde{W}_{c,0} : \| \tilde{W}_{c,0} \| \leq \sqrt{\frac{2\ell_0 + \beta_{c,0} \| \varpi_{e_0} \|^2}{\beta_{c,0} \lambda_{\rho_0}}} \right\}.
$$
At event times \(t = t_{i,l+1}^c\), the jump in \(L_3\) is negative due to the triggering condition. Thus, the closed-loop system is uniformly ultimately bounded. The local neighbor errors \(\delta_i^e\), \(\delta_0\), and weight estimation errors \(\tilde{W}_{c,i}\), \(\tilde{W}_{c,0}\) converge to small sets around zero, ensuring stable formation tracking under GNSS spoofing attacks.
3 Simulation Studies
We conduct simulations to validate the effectiveness and advancement of our approach. Consider a scenario with one adversarial leader and four follower UAV drones (\(N=4\)). All UAV drones operate in a plane (\(n=2\)). The damping coefficients are set as: \(\alpha_{p_0} = -0.5\), \(\alpha_{v_0} = 0\) for the leader; \(\alpha_{p_1} = -1.0\), \(\alpha_{v_1} = -1.2\); \(\alpha_{p_2} = -1.5\), \(\alpha_{v_2} = -1.0\); \(\alpha_{p_3} = -0.8\), \(\alpha_{v_3} = -1.5\); \(\alpha_{p_4} = -1.0\), \(\alpha_{v_4} = -1.0\) for followers. The control coefficient \(\alpha_{u_i} = 1\) for all UAV drones. The GNSS spoofing attack signal is \(a_i(t) = [2 \sin(t), 3 \cos(t)]^T\). The cost function matrices are \(Q_i = Q_0 = R_{ii} = R_{ij} = R_0 = I_4\). Activation functions for neural networks are \(\phi_{-i}(\delta_{-i}) = [\delta_{-i}(1)^2 + \delta_{-i}(3)^2, \delta_{-i}(1)\delta_{-i}(3), \delta_{-i}(2)^2 + \delta_{-i}(4)^2, \delta_{-i}(2)\delta_{-i}(4)]^T\). Learning rates \(\beta_{c,-i} = 0.5\). For the secure estimator, sampling interval \(\iota_{i,k} = 0.5\) s, dynamic threshold \(\Gamma_i(t) = 1.5 \tanh(t)\), and parameters \(\kappa_i = 1.1\), \(K_{i,1} = 3\), \(K_{i,2} = 0.1\). For the event-triggered mechanism, \(\eta_{1i} = 0.1\), \(G_i = 20\).
3.1 Effectiveness Verification
The simulation results demonstrate the efficacy of our method. Figure 1 shows the position errors of all UAV drones converging over time, indicating successful formation tracking. Figure 2 shows the velocity errors also converging. For the secure state estimator, Figures 3 and 4 display the position estimates for follower UAV drones 2 and 4, respectively. The top regions indicate attack intervals, while the bottom regions show when the detection mechanism is activated. The estimator accurately tracks the true states despite attacks, with only sampled signals. Figure 5 presents the 2D trajectories of UAV drones, showing followers maintaining a predefined formation around the adversarial leader while under GNSS spoofing attacks. The leader executes evasive maneuvers, but followers adapt using the proposed control strategies.
| Parameter Set | \(\sigma_{1i}\) | \(\sigma_{2i}\) | \(\sigma_{3i}\) | \(\sigma_{4i}\) | Trigger Count |
|---|---|---|---|---|---|
| Baseline (Set 1) | 20 | 0.3 | 0.3 | 20 | 191 |
| Set 2 (increase \(\sigma_{1i}\)) | 30 | 0.3 | 0.3 | 20 | 163 |
| Set 3 (increase \(\sigma_{2i}\)) | 30 | 2 | 0.3 | 20 | 189 |
| Set 4 (increase \(\sigma_{3i}\)) | 30 | 2 | 1 | 20 | 337 |
| Set 5 (increase \(\sigma_{4i}\)) | 20 | 0.3 | 0.3 | 40 | 149 |
Table 1 illustrates the impact of parameters on triggering frequency for follower 1. As \(\sigma_{1i}\) and \(\sigma_{4i}\) increase, triggering counts decrease, showing that the dynamic event-triggered mechanism reduces communication burden. Conversely, increases in \(\sigma_{2i}\) and \(\sigma_{3i}\) tend to increase counts, highlighting the trade-offs in parameter tuning.
3.2 Advancement Verification
We compare our improved dynamic event-triggered mechanism (DETM) with existing approaches: time-triggered control and static event-triggered mechanism (ETM). The simulation settings are identical. The results are summarized in Table 2.
| Scheme | Follower 1 | Follower 2 | Follower 3 | Follower 4 |
|---|---|---|---|---|
| Time-Triggered [18] | 3001 | 3001 | 3001 | 3001 |
| Static ETM [27] | 591 | 556 | 605 | 625 |
| Our DETM | 191 | 260 | 234 | 218 |
Our DETM significantly reduces triggering counts compared to both time-triggered and static ETM schemes, demonstrating superior efficiency in reducing communication and computation loads while maintaining tracking performance. This advancement is crucial for resource-constrained multi-UAV drone systems operating in adversarial environments.
4 Conclusion
In this paper, we have addressed the adversarial leader-follower formation tracking control problem for multi-UAV drone systems under GNSS spoofing attacks. The leader is adversarial and malicious, with its control input dependent on follower states, and it can launch GNSS spoofing attacks to disrupt tracking. To defend against attacks, we designed an event-based attack detection and switching mechanism using cooperative localization, along with a secure state estimator that relies only on sampled signals to provide continuous state estimation despite output measurement noise. This estimator reduces computational burden and improves data utilization. We then reformulated the formation tracking problem as a multiplayer nonzero-sum game, modeling the dynamic interaction between leader and followers. By employing single-critic neural networks to approximate value functions and an improved dynamic event-triggered mechanism, we developed approximate optimal control strategies for followers. These strategies ensure stable tracking of the adversarial leader while minimizing communication and computation costs through reduced triggering. Stability analysis proved the uniform ultimate boundedness of the closed-loop system. Simulation studies validated the effectiveness of our approach, showing successful formation tracking under GNSS spoofing attacks, and demonstrated the advancement of our dynamic event-triggered mechanism in reducing event counts compared to existing schemes.
Future work will focus on extending this framework to heterogeneous multi-agent systems, such as UAV-ground vehicle collaborations, and investigating more sophisticated attack models, including coordinated spoofing attacks. Additionally, we plan to explore distributed learning algorithms to further enhance scalability and robustness in large-scale UAV drone networks.