Paper deep dive
LogiC-Diff: Embedding Security Properties Into AI-Enabled Cyber-Physical Systems
Ziyan An, John Stankovic, Meiyi Ma
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 10/1/2026, 8:52:41 AM
Summary
The paper introduces LogiC-Diff, a logic-conditioned bi-stage diffusion framework designed to enhance the robustness of AI-enabled Cyber-Physical Systems (CPS) against adversarial attacks. By integrating Signal Temporal Logic (STL) specifications as conditioning signals, the framework performs input repair and output refinement to ensure that forecasting models adhere to security-critical temporal constraints during inference, outperforming existing reconstruction-based and rule-based methods.
Entities (7)
Relation Signals (6)
LogiC-Diff → employs → Diffusion Models
confidence 95% · We introduce a logic-conditioned bi-stage diffusion framework... allowing the model to jointly mitigate adversarial perturbations
LogiC-Diff → uses → Signal Temporal Logic
confidence 95% · We introduce a logic-conditioned bi-stage diffusion framework that integrates Signal Temporal Logic (STL) specifications into forecasting.
LogiC-Diff → defendsagainst → Adversarial Attacks
confidence 94% · Across sensor faults, gradient-based attacks, adaptive attacks, and varying attack strengths, our method consistently improves robustness
LogiC-Diff → protects → Cyber-Physical Systems
confidence 93% · enabling predictive models to enforce system-level constraints during inference rather than relying on external defenses.
PGD → istypeof → Adversarial Attacks
confidence 92% · We consider specific attacks including PGD... gradient-based white-box attacks
LogiC-Diff → evaluatedon → Caltrans
confidence 90% · We evaluate our approach on two real-world multivariate CPS forecasting datasets, including a smart city dataset spanning Caltrans
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:AI-enabled Cyber-Physical Systems (CPS) are highly vulnerable to adversarial and anomalous inputs, where small perturbations can induce cascading errors and unsafe control actions. Existing approaches, such as rule-based filtering, training-time regularization, or diffusion-based reconstruction, either operate outside the model or lack mechanisms to incorporate formal security specifications into the prediction process. In this paper, we take the first step toward embedding security properties directly into AI-enabled CPS, enabling predictive models to enforce system-level constraints during inference rather than relying on external defenses. We introduce a logic-conditioned bi-stage diffusion framework that integrates Signal Temporal Logic (STL) specifications into forecasting. STL serves as a first-class conditioning signal that guides both an input repair stage and an output refinement stage, allowing the model to jointly mitigate adversarial perturbations and enforce desired temporal behaviors to satisfy security-critical properties. We evaluate our approach on two real-world multivariate CPS forecasting datasets under a diverse set of physical sensor and cyber attacks. Across sensor faults, gradient-based attacks, adaptive attacks, and varying attack strengths, our method consistently improves robustness and specification compliance, degrades more gracefully as attack strength increases, and generalizes better to unseen attacks. Ablation studies on specification coverage and quality further show that embedding logical security properties yields gains unattainable by reconstruction-based methods alone, highlighting a new direction for integrating formal methods with generative models in secure CPS.
Tags
Links
- Source: https://arxiv.org/abs/2609.38381v1
- Canonical: https://arxiv.org/abs/2609.38381v1
Trouble viewing inline? Open PDF directly →
Full Text
126,708 characters extracted from source content.
Expand or collapse full text
LogiC-Diff: Embedding Security Properties Into AI-Enabled Cyber-Physical Systems Ziyan An Affiliation: Department of Computer Science Affiliation: Vanderbilt University Affiliation: Nashville, TN Email: ziyan.an@vanderbilt.edu John Stankovic Affiliation: Department of Computer Science Affiliation: University of Virginia Affiliation: Charlottesville, VA Email: jas9f@virginia.edu Meiyi Ma Affiliation: Department of Computer Science Affiliation: Vanderbilt University Affiliation: Nashville, TN Email: meiyi.ma@vanderbilt.edu Abstract AI-enabled Cyber-Physical Systems (CPS) are highly vulnerable to adversarial and anomalous inputs, where small perturbations can induce cascading errors and unsafe control actions. Existing approaches, such as rule-based filtering, training-time regularization, or diffusion-based reconstruction, either operate outside the model or lack mechanisms to incorporate formal security specifications into the prediction process. In this paper, we take the first step toward embedding security properties directly into AI-enabled CPS, enabling predictive models to enforce system-level constraints during inference rather than relying on external defenses. We introduce a logic-conditioned bi-stage diffusion framework that integrates Signal Temporal Logic (STL) specifications into forecasting. STL serves as a first-class conditioning signal that guides both an input repair stage and an output refinement stage, allowing the model to jointly mitigate adversarial perturbations and enforce desired temporal behaviors to satisfy security-critical properties. We evaluate our approach on two real-world multivariate CPS forecasting datasets under a diverse set of physical sensor and cyber attacks. Across sensor faults, gradient-based attacks, adaptive attacks, and varying attack strengths, our method consistently improves robustness and specification compliance, degrades more gracefully as attack strength increases, and generalizes better to unseen attacks. Ablation studies on specification coverage and quality further show that embedding logical security properties yields gains unattainable by reconstruction-based methods alone, highlighting a new direction for integrating formal methods with generative models in secure CPS. Keywords Cyber-Physical Systems ⋅· Signal Temporal Logic ⋅· Diffusion Models ⋅· Adversarial Robustness ⋅· Formal Specifications 1 Introduction AI-enabled cyber-physical systems (CPS), such as smart healthcare, smart cities, and autonomous mobility, rely heavily on deep learning-based forecasting models to support real-time monitoring and control [Yao et al., 2019, Wu, 2021, Sefati et al., 2023, Mengash et al., 2023]. However, these systems operate in high-stakes environments where failures can lead to unsafe or even catastrophic outcomes. A key vulnerability arises from data-level adversarial or anomalous inputs: even small ℓ2 _2-bounded perturbations can distort sensor signals, propagate through forecasting pipelines, and ultimately trigger unsafe downstream control actions [Liu et al., 2022, Wu et al., 2022, Duo et al., 2022]. As a result, ensuring the robustness of forecasting models is critical to the safe deployment of AI-enabled CPS. At the core of this challenge is a fundamental limitation of current learning-based forecasting models. These models are largely data-driven and unconstrained, with no built-in guarantees of safety, temporal consistency, or adherence to system-level requirements. When inputs are corrupted, prediction errors can propagate and amplify across the pipeline, leading to cascading failures. This exposes a key gap: current forecasting models lack mechanisms to enforce system-level security properties during prediction. In this paper, we ask a central question: can system-critical security properties be embedded into learning-enabled CPS by design, so that models remain robust under adversarial attacks? Existing defenses for CPS forecasting fall into two broad categories. The first focuses on improving robustness through learning-based reconstruction methods [Cai et al., 2021, Salman et al., 2020, Wu et al., 2023]. Early approaches such as Defense-GAN [Samangouei et al., 2018] detect or repair adversarial inputs by exploiting distributional discrepancies, while more recent diffusion-based models restore samples via learned reverse processes [Sohl-Dickstein et al., 2015, Ho et al., 2020]. Although these methods achieve strong empirical robustness, they rely solely on distributional reconstruction and lack an explicit notion of what constitutes safe or acceptable system behavior. As a result, they cannot enforce temporal or logical constraints on predictions. A complementary line of work incorporates rule-based properties to improve alignment with system requirements under nominal conditions [Ma et al., 2020, Hu et al., 2016, An et al., 2024]. These approaches encode semantic constraints—such as temporal ordering, persistence, and cross-feature consistency—using formal languages like Linear Temporal Logic [Pnueli, 1977], Metric Temporal Logic [Koymans, 1990], and Signal Temporal Logic (STL) [Maler and Nickovic, 2004]. In practice, such properties are applied as training-time regularizers or post-hoc monitoring and filtering mechanisms [Swaroop et al., 2024, Dmitry et al., 2022, Bartocci et al., 2018, Yang et al., 2022b]. However, these approaches are not designed as security mechanisms: they operate outside the predictive process, are reactive rather than preventative, and do not mitigate adversarial perturbations during inference. This limitation is exacerbated under structured perturbations, such as gradient-based attacks that shift inputs across fragile decision boundaries: once temporal dynamics are distorted before prediction, the model may apply a qualitatively different mapping to the corrupted data [Hein and Andriushchenko, 2017, Wesego and Rooshenas, 2025]. Indeed, post-hoc correction can enforce certain output constraints, but it cannot reliably recover information lost upstream, and the resulting forecast may still fail to reflect the true system dynamics. In this work, we take a step toward embedding security properties directly into the forecasting process. We propose a logic-conditioned bi-stage diffusion framework that integrates formal specifications into model inference. Specifically, we use Signal Temporal Logic (STL) to express system-critical properties and incorporate them as conditioning signals within a diffusion-based repair pipeline. This enables a new paradigm of specification-aware prediction, where forecasts are actively shaped to satisfy security constraints while maintaining robustness. Our work investigates repositioning prior secure system specifications, expressed as temporal logic, into two stages of the diffusion-based repair process, thereby enabling both pre-hoc and post-hoc defense. Specifically, we condition the diffusion-based repair model on a logic-informed signal obtained by projecting the data manifold, at different stages of the framework, onto the ℓ1 _1 minimum-distance φ -feasible set. We then modulate the diffusion prediction with a learnable gating coefficient that balances the diffusion reconstruction and the projected signal in the final output. The framework is trained end-to-end under loss terms that cover each of our three defense desideratum. We evaluate our method on two real-world multivariate time-series CPS forecasting datasets, including a smart city dataset spanning Caltrans Chen [2002] and air quality and a UAV dataset Keipour et al. [2021]. The framework is evaluated against a comprehensive set of black-box sensor attacks and faults, gradient-based white-box attacks, adaptive and query-based attacks, sparse indirect attacks, and varying attack strengths. We further study cross-attack generalization, cross-domain transfer, and sensitivity to specification coverage and quality. Compared with a broad set of baselines spanning adversarial training, adversarial purification, randomized smoothing, and logic-regularized learning, our approach consistently reduces forecasting error and improves specification compliance and generalization across a range of attack strengths. Our ablation results further show that these gains depend strongly on the guidance provided by the embedded logic specifications. To our knowledge, this is the first work to embed formal security properties directly into CPS forecasting via logic-conditioned generative modeling. Contributions. (1) We formulate secure CPS forecasting as embedding STL-based specifications into learning-based prediction. (2) We propose a logic-conditioned bi-stage diffusion framework for input repair and output refinement. (3) We develop an STL-guided conditioning mechanism that enables specification-aware generative reconstruction under adversarial settings. (4) We conduct a comprehensive evaluation across two CPS domains and a diverse set of threat models, including physical sensor attacks, gradient-based and adaptive cyber attacks, varying attack strengths, sparse indirect attacks, and unseen attack settings. The results show that LogiC-Diff consistently improves robustness and specification compliance while demonstrating stronger generalization across attacks and domains. 2 Background and Problem Statement We introduce the key preliminaries underlying our approach, including DDPM models [Ho et al., 2020] for generative repair, Signal Temporal Logic (STL) [Maler and Nickovic, 2004] for formal specification, and the CPS security setting considered in this work. Background: Diffusion Models for Data Repair. Diffusion models [Sohl-Dickstein et al., 2015, Song et al., 2020] learn a data distribution p(x)p(x) through gradual noising and denoising. In the forward process, clean data x0x_0 are corrupted by Gaussian noise over NN steps until xN∼(0,I)x_N (0,I). We build on DDPMs [Ho et al., 2020] as the basis of our input repair mechanism, where a reverse diffusion network ϵθ(xn,n) _θ(x_n,n) predicts the injected noise and denoises corrupted inputs back toward the clean data manifold. In forecasting settings with adversarial purification, a potentially corrupted input x∗=x+δx =x+δ is treated as a noisy observation of an underlying clean sample x and is first injected with Gaussian noise during the forward diffusion step. In the reversing step, a denoiser ϵθ _θ parameterized by θ guides the learned reverse process to produce the reconstructed data x~=Φθ(x∗) x= _θ(x ), where Φθ _θ denotes the forward-reverse denosing process. In the subsequent CPS forecasting step, a forecasting neural network FωF_ω is applied to x~ x, with the goal that its prediction approximates the clean-input forecast Fω(x)F_ω(x). Background: Signal Temporal Logic. STL is a real-valued, time-bounded formalism for specifying temporal properties over continuous signals. Given time-series data and a CPS specification, STL supports monitoring through qualitative semantics that describe Boolean satisfaction and quantitative semantics that measure the degree of satisfaction or violation [Donzé and Maler, 2010]. In this work, we use STL to formalize “secure” system behaviors, including temporal requirements such as event ordering and persistence, as well as relationships between multiple signal traces over specified time intervals. Consider an [a,b][a,b]-bounded time interval and an atomic predicate of the form μ≡f(xt)≥cμ≡ f(x_t)≥ c, where f:ℝd→ℝf:R^d is a valuation function and c∈ℝc is a threshold. A formula φ is defined inductively as φ:=μ|¬φ∣φ1∧φ2∣φ1[a,b]φ2∣□[a,b]φ∣◊[a,b]φ. :=μ _1 _2 _1U_[a,b] _2 _[a,b] _[a,b] . Here, the temporal operators include the “always” operator □[a,b] _[a,b], which requires that a time series satisfy φ at everywhere within the bounded interval; the “eventually” operator ◊[a,b] _[a,b], which requires that φ hold at least once within the bounded interval; and the “until” operator [a,b]U_[a,b], which requires that φ1 _1 hold until φ2 _2 is true within the bounded interval. The STL quantitative semantics function ρφ(x,t)∈ℝ _ (x,t) measures the signed margin by which a signal satisfies or violates φ at time t. We refer the reader to App. C for the full definition of STL semantics and additional examples of logic rules. Threat Model. We consider a comprehensive set of runtime attacks for CPS spanning two attack families, both of them aim to corrupt the forecasting model’s output and adversely affect downstream system performance. The first family consists of black-box CPS physical system attacks, which we refer to as sensor attacks [Yu et al., 2023]. In this setting, the attacker has access to the physical or communication layer and can compromise sensor data by freezing, replaying, or spoofing sensor readings, as well as by applying randomized mixtures of these attack types [Duo et al., 2022]. The second family consists of gradient-based white-box attacks to the cyber system, bounded by an ℓ2 _2 budget ‖δ‖2≤ε\|δ\|_2≤ , where δ is the added perturbation. These attacks leverage model gradients to generate the worst-case adversarial input within the allowed budget, which is typically formulated as x∗∈argmaxx′ℒ(x′,y,ω)s.t.‖x′−x‖2≤ε,x ∈ _x L(x ,y;ω)\;s.t.\|x -x\|_2≤ , where ℒL is the model’s training loss, (x,y)(x,y) is a clean input-output pair, and ω denotes the model parameters [Goodfellow et al., 2014]. We consider specific attacks including PGD [Madry et al., 2018], MIM [Dong et al., 2018], CW [Carlini and Wagner, 2017], and AutoAttack [Croce and Hein, 2020]. Defense Goal. Given a potentially attacked input trajectory x∗x , our goal is to produce a repaired trajectory x~ x and subsequently a final forecast y~ y that are both accurate and semantically valid. Specifically, the defense should produce: (i) a repaired input trajectory x~ x that remains close to the clean input x and satisfies an input-side STL specification φ , and (i) a final forecast y~ y that approximates the clean-input forecast Fω(x)F_ω(x) and satisfies an output-side STL specification φ′ . Formally, we have: Fω(x~)≈Fω(x),x~∈argmaxx¯∈(x∗)ρφ(x¯,t),y~∈argmaxy¯∈(Fω(x~))ρφ′(y¯,t),F_ω( x)≈ F_ω(x), x∈ _ x (x ) _ ( x,t), y∈ _ y (F_ω( x)) _ ( y,t), where (⋅)N(·) denotes a projected neighborhood of the given point. Together, these objectives require a defense that produces outputs both likely under the clean data distribution and consistent with system-level security specifications. We describe how our bi-stage diffusion framework operationalizes these goals in the next section. Figure 1: Overview of LogiC-Diff. Given a potentially attacked multivariate CPS time-series input, LogiC-Diff first constructs STL-guided signals from CPS security specifications. The framework then performs a repair and a refinement stage on input-side and an output-side, respectively. In both stages, the diffusion estimate is blended with the projection to encourage both data-plausible reconstruction and specification-consistent behavior. The framework is trained end-to-end. 3 Method: LogiC-Diff We present our logic-guided bi-stage diffusion defense for secure CPS forecasting. At a high level, the method first projects STL specifications into a logic-consistent guidance signal, and then uses this signal to nudge the reconstruction process at two repair stages: an input-stage diffusion that preventatively reconstructs the attacked trajectory before forecasting, and an output-stage diffusion that refines the forecast residual afterward. We refer to this pipeline as LogiC-Diff, short for STL-conditioned diffusion reconstruction, and use Φθ _θ to denote the full end-to-end pipeline. Figure 1 depicts the overall workflow of our framework. 3.1 STL Guidance Signal In this section, we formalize how STL rules support defense against security attacks. We introduce CPS-oriented spatiotemporal logic formulas that encode safe global behavior and are also relevant to downstream control, then describe how an attacked signal is projected into a guidance signal. This signal is later used as the basis for an embedding to condition the diffusion model and as a reference trajectory in the final interpolation step, encouraging specification-compliant repair. Security Guidance: STL Rules. In Section 2, we introduced the formal definition of STL and its temporal operators. In our setting, an STL rule takes a form such as φ:=□[t1,t2](xt≥c) := _[t_1,t_2](x_t≥ c), where the temporal operator □[t1,t2] _[t_1,t_2] may be replaced by ◊[t1,t2] _[t_1,t_2] depending on the desired requirement, and μ:=(xt≥c)μ:=(x_t≥ c) denotes the atomic predicate that the temporal requirement is based on. Specifically, we define the following set of spatiotemporal logic formulas to support the security requirements of CPS operation. Let xt(j)x^(j)_t denote the value of the j-th feature at time t in the forecasting dataset. We then apply the following coarse categories of logic rules, summarized in Table 1. Table 1: STL-based CPS specifications. Each rule is parameterized by features and a time interval [t1,t2][t_1,t_2] and encodes a physically meaningful constraint on feature trajectories. STL-based Guidance Signal Construction Rules for Secure CPS φ1:=□[t1,t2]((xt(j)≥c1)∧¬(xt(j)≥c2)) _1:= _[t_1,t_2] ((x^(j)_t≥ c_1) (x^(j)_t≥ c_2) ) Stability(x(j),[t1,t2])(x^(j),[t_1,t_2]) enforces physically valid ranges and prevents false high or low values outside feasible limits over time. φ2:=□[t1,t2](¬((xt(j)≥c1)∧¬(xt(j+1)≥c2))) _2:= _[t_1,t_2] ( ((x^(j)_t≥ c_1) (x^(j+1)_t≥ c_2) ) ) Associativity(x(j),x(j+1),[t1,t2])(x^(j),x^(j+1),[t_1,t_2]) encapsulates the correlational associativity across features over time. φ3:=¬(xt(j)≥c1)[t1,t2](xt(j+1)≥c2) _3:= (x^(j)_t≥ c_1)\,U_[t_1,t_2]\,(x^(j+1)_t≥ c_2) Propagation(x(j),x(j+1),[t1,t2])(x^(j),x^(j+1),[t_1,t_2]) strengthens upstream and downstream system behavior between two sensor locations or across temporally related events. φ4:=□[t1,t2](¬(|x¯[t−w1,t](j)−x¯[t−w1−w2,t−w1](j)|≥c1)) _4:= _[t_1,t_2] ( (| x^(j)_[t-w_1,t]- x^(j)_[t-w_1-w_2,t-w_1]|≥ c_1 ) ) Smoothness(x(j),[t1,t2],w1,w2)(x^(j),[t_1,t_2],w_1,w_2) bounds the change in mean between adjacent windows of widths w1w_1 and w2w_2, detecting persistent changes in feature behavior. φ5:=□[t1,t2](¬((xt(j)≥c1)∧¬◊[d1,d2](xt(j+1)≥c2))) _5:= _[t_1,t_2] ( ((x^(j)_t≥ c_1) _[d_1,d_2](x^(j+1)_t≥ c_2) ) ) Latency(x(j),x(j+1),[t1,t2],[d1,d2])(x^(j),x^(j+1),[t_1,t_2],[d_1,d_2]) enforces that whenever feature x(j)x^(j) reaches level c1c_1, feature x(j+1)x^(j+1) reaches level c2c_2 at some time within the future window [d1,d2][d_1,d_2]. φ6:=◊[t1,t2]□[0,d]((xt(j)≥c1)∧¬(xt(j)≥c2)) _6:= _[t_1,t_2]\, _[0,d] ((x^(j)_t≥ c_1) (x^(j)_t≥ c_2) ) Recovery(x(j),[t1,t2],d)(x^(j),[t_1,t_2],d) requires the feature to eventually enter and remain within a safe operational band for a duration of at least d time units. More specific examples specifications are listed under App. H. In practice, multiple STL rules can be combined through logical conjunction. We use φ to denote the set of rules applied for input reconstruction, and φ′ to denote the set of rules applied for output-side residual repair and reconstruction. In many applications, these rules can be specified directly by system engineers; alternatively, several existing tools like TeLEx and Quivr can infer or construct such rules from sample data or query specifications [Jha et al., 2019, Mell et al., 2023]. Guidance Signal Construction. We have established several categories of rules that define secure system behavior. We now describe how a logic specification is grounded into a guidance signal for diffusion-based reconstruction. Following prior work [Ma et al., 2020], we project the attacked signal x∗x onto the φ -feasible set, yielding a logic-consistent reference trajectory. We define the projection operator as Pφ(x),P_ (x), such that it yields the closest satisfying trace in ℓ1 _1 distance. The projection treats logical and temporal operators compositionally through the quantitative STL semantics. For an atomic predicate μ=(xt≥c)μ=(x_t≥ c), the projection clamps each violating time point upward to the threshold, xt′=max(xt∗,c)x _t= (x _t,c), while the satisfying points are unchanged. For □[a,b]μ _[a,b]μ operator, which requires μ to hold at every t∈[a,b]t∈[a,b], we apply this clamping at every time point in the interval, xt′=max(xt∗,c)x _t= (x _t,c) for all t∈[a,b]t∈[a,b]. For the ◊[a,b]μ _[a,b]μ operator, which requires μ to hold at some t∈[a,b]t∈[a,b], we identify the time point already closest to satisfaction, t^=argmint∈[a,b]∣xt∗−c∣ t= _t∈[a,b] x _t-c , and clamp only that point, xt^′=max(xt^∗,c)x _ t= (x _ t,c). For the μ1[a,b]μ2 _1U_[a,b] _2 operator, which requires μ1 _1 to hold up to some time t^∈[a,b] t∈[a,b] at which μ2 _2 holds, we select t t to minimize the joint projection distance, then enforce μ1 _1 on [a,t^][a, t] and μ2 _2 at t t via the projections above. For Boolean operators, the conjunction φ1∧φ2 _1 _2 requires both subformulas to hold and is projected by sequentially applying the projection of each conjunct, Pφ1∧φ2(x∗)=Pφ2(Pφ1(x∗))P_ _1 _2(x )=P_ _2(P_ _1(x )); the disjunction φ1∨φ2 _1 _2 requires either subformula to hold and is projected toward the cheaper of the two, Pφ1∨φ2(x∗)=argmini∈1,2‖Pφi(x∗)−x∗‖1P_ _1 _2(x )= _i∈\1,2\\|P_ _i(x )-x \|_1. We obtain the final guidance signal xlogic=Pφ(x∗)x_logic=P_ (x ) by iteratively performing operator-level projections over the syntax tree of φ . 3.2 Logic-Conditioned Diffusion Reconstruction Once the specification-faithful projection of the corrupted input time-series signal x∗x is obtained, we employ a diffusion reconstruction process to recover x~ x. We now describe this process under the discrete-time DDPM formulation. Forward Diffusion. We start from the attacked input x0=x∗x_0=x and gradually add Gaussian noise according to a β schedule over N steps, where x1,…,xNx_1,…,x_N denote the intermediate latent variables. The forward diffusion process is then formulated as q(xn∣xn−1)=(xn,1−βnxn−1,βn).q(x_n x_n-1)=N(x_n; 1- _n\,x_n-1,\, _nI). This is equivalent to the closed-form expression q(xn∣x0)=(xn,α¯nx0,(1−α¯n)),q(x_n x_0)=N(x_n; α_n\,x_0,\,(1- α_n)I), where αn=1−βn _n=1- _n, and α¯n α_n is the cumulative product of noise retention at step n, α¯n=∏i=1nαi α_n= _i=1^n _i. Logic-Conditioned Reverse Diffusion. For the reverse diffusion process, standard DDPM defines pθ(xn−1∣xn)=(xn−1,μθ(xn,n),σθ2(xn,n)).p_θ(x_n-1 x_n)=N(x_n-1; _θ(x_n,n), _θ^2(x_n,n)I). Following this formulation, we incorporate the conditioning signal cxc_x and obtain pθ(xn−1∣xn,cx)=(xn−1,μθ(xn,n,cx),σθ2(xn,n)).p_θ(x_n-1 x_n,c_x)=N(x_n-1; _θ(x_n,n,c_x), _θ^2(x_n,n)I). Here, the mean function μθ _θ is parameterized through a noise predictor ϵθ(xn,n,cx) _θ(x_n,n,c_x) and the variance follows the standard DDPM schedule. Rather than iterating this transition over all N steps, we leverage the one-shot x0x_0-estimate implicit in the noise-prediction parameterization: x^=xn−1−α¯nϵθ(xn,n,cx)α¯n=x∗+1−α¯nα¯n(ϵ−ϵθ). x= x_n- 1- α_n\, _θ(x_n,n,c_x) α_n=x + 1- α_n α_n(ε- _θ). Here, x x approximates the conditional mean [x0∣xn,cx]E\,[x_0 x_n,c_x]. To further encourage the repaired sequence to be both data-plausible and specification-consistent, we form the input-side repair as x~=αx^+(1−α)xlogic x=α\, x+(1-α)\,x_logic, where α∈(0,1)α∈(0,1) is a learnable weight. Logic-Conditioned Diffusion Refinement on Outputs. The repaired input x~ x is passed to the forecasting module FωF_ω to produce an initial forecast y^init=Fω(x~) y_init=F_ω( x). To refine y^init y_init and account for residual errors, we then apply a second logic-conditioned diffusion on y^init y_init. Mirroring the first diffusion behavior, we project y^init y_init onto the φ′ -feasible set to obtain ylogicy_logic, and form the conditioning signal cyc_y. The forward process noises y^init y_init over M steps following the same DDPM schedule as above. We use a separate noise predictor ϵθ′ _θ and conditioning encoder for the output stage. The conditioned reverse process yields a one-shot estimate of the underlying ground-truth forecast, y^=ym−1−α¯mϵθ′(ym,m,cy)α¯m. y= y_m- 1- α_m\, _θ (y_m,m,c_y) α_m. We y y combine with ylogicy_logic to produce the final refined forecast y~=α′y^+(1−α′)ylogic y=α \, y+(1-α )\,y_logic, where α′∈(0,1)α ∈(0,1) is a learnable weight. 3.3 End-to-End Training and Inference We train the bi-stage pipeline end-to-end with a joint objective that directly instantiates the defense goal in Section 2. At the input stage, the objective encourages the repaired trajectory x~ x to remain close to the clean signal x while achieving high robustness with respect to the input-side STL specification φ . At the output stage, it encourages the final forecast y~ y to remain accurate relative to the target forecast and to achieve high robustness with respect to the output-side STL specification φ′ . Each desideratum is realized through explicit loss terms. We supervise the induced clean estimates x x and y y via the reparameterization trick in Ho et al. [2020], which maps predicted noise to the corresponding x0x_0-estimate. In practice, the reverse models are still parameterized through noise predictors ϵθ _θ and ϵθ′ _θ . On the input side, a reconstruction loss ℒdiffx=‖x−x^‖22L_diff^x=E\|x- x\|_2^2 pulls the diffusion estimate toward the clean signal, while a smoothed STL penalty ℒstlx=[softplus(−ρ~φ(x^,0))]L_stl^x=E\,[softplus(- ρ_ ( x,0))] discourages residual specification violations. On the output side, a reconstruction loss ℒdiffy=‖y−y^‖22L_diff^y=E\|y- y\|_2^2 aligns the diffusion estimate with the ground-truth forecast, a smoothed STL penalty ℒstly=[softplus(−ρ~φ′(y^,0))]L_stl^y=E\,[softplus(- ρ_ ( y,0))] encourages output-side feasibility, and a forecasting loss ℒpred=‖y−y~‖22L_pred=E\|y- y\|_2^2 ensures that the final blended forecast remains accurate. Here, ρ~ ρ denotes the smooth surrogate of STL robustness [Leung et al., 2023], and the softplus function provides stable gradients. The full training objective is given by ℒtotal=λxℒdiffx+λyℒdiffy+λpℒpred+λρxℒstlx+λρyℒstly,L_total= _xL_diff^x+ _yL_diff^y+ _pL_pred+ _ρ^xL_stl^x+ _ρ^yL_stl^y, where the coefficients λ(⋅) _(·) balance reconstruction quality, forecasting accuracy, and specification compliance across the two stages. 4 Evaluation 4.1 Experimental Setup Datasets. We evaluate LogiC-Diff on two CPS domains. Our primary dataset is a smart city corpus constructed from the Caltrans PeMS system [Chen, 2002] for the Los Angeles region. It contains hourly traffic features, including total flow, average occupancy, and average speed, augmented with hourly air-quality and emissions measurements (NOxNO_x, NO2NO_2, ozone, and PMx) from the California Air Resources Board [California Air Resources Board, n.d.]. The data span 2024–2025 and contain d=7d=7 features. Each sample uses m=24m=24 hours of history to forecast the next H=6H=6 hours. We also consider the San Francisco region of PeMS to compare with the benchmark used by Liu et al. [2023] for sparse indirect attacks. Our second domain is UAV flight telemetry from the ALFA dataset [Keipour et al., 2021], which contains 47 fixed-wing flights with real mid-flight engine and actuator faults. We use seven channels that capture the closed-loop dynamics, including GPS groundspeed, altitude, measured and commanded roll and pitch, and throttle output. Forecaster and metrics. We use a multivariate time-series Transformer [Li et al., 2019] as the forecasting backbone (App. G). We report two metrics: mean squared error (MSE) over the forecast horizon and Sat%, the average percentage of logic specifications satisfied by each prediction: Sat%=1Ns∑i=1Ns[ρi≥0]×100Sat\%= 1N_s _i=1^N_s1[ _i≥ 0]× 100, where NsN_s is the number of specifications and ρi _i is the robustness value of the i-th specification. MSE captures forecasting accuracy, while Sat% measures how well the forecast preserves the system level properties used to characterize secure behavior. The complete specification set is provided in App. H. Baselines. We compare LogiC-Diff with baselines representing several defense strategies. Default is the undefended forecaster [Vaswani et al., 2017]. Inherent (STL) is a logic-regularized model based on STLNet [Ma et al., 2020], which incorporates STL constraints during training but does not perform inference-time repair. Adversarial training includes AT (Madry) [Madry et al., 2018] and AT (TRADES) [Zhang et al., 2019]. Adversarial purification is represented by AP (DiffPure) [Nie et al., 2022], which denoises corrupted inputs through reverse diffusion without using system specifications. Randomized smoothing (RS) [Cohen et al., 2019, Liu et al., 2023] averages predictions over Gaussian-perturbed inputs. To separate the effect of logic conditioning from direct feasibility enforcement, we also include three projection-only variants that apply the STL projection PφP_ to the model input (pre-hoc), after inference (post-hoc), or at both stages, without diffusion-based repair or logic conditioning. Table 2: Robust performance under physical attacks. MSE and STL Sat% reported as mean±95%CImean_± 95\%~CI. Dropout FDI Replay Mixed Method MSE↓ Sat%↑ MSE↓ Sat%↑ MSE↓ Sat%↑ MSE↓ Sat%↑ Default 0.469±.0170.469_±.017 77.3±3.777.3_± 3.7 0.197±.0080.197_±.008 84.2±2.284.2_± 2.2 0.538±.0210.538_±.021 80.5±2.880.5_± 2.8 0.283±.0170.283_±.017 84.5±2.284.5_± 2.2 Inherent (STL) 0.470±.0170.470_±.017 77.2±3.577.2_± 3.5 0.207±.0090.207_±.009 84.3±2.284.3_± 2.2 0.551±.0230.551_±.023 79.6±2.679.6_± 2.6 0.295±.0190.295_±.019 84.4±2.084.4_± 2.0 AT (Madry) 0.484±.0150.484_±.015 78.2±3.578.2_± 3.5 0.175±.0070.175_±.007 86.1±2.486.1_± 2.4 0.459±.0180.459_±.018 80.7±2.980.7_± 2.9 0.281±.0160.281_±.016 84.6±2.584.6_± 2.5 AT (TRADES) 0.489±.0160.489_±.016 78.7±3.778.7_± 3.7 0.205±.0080.205_±.008 85.1±2.685.1_± 2.6 0.438±.0160.438_±.016 80.8±3.280.8_± 3.2 0.287±.0130.287_±.013 83.7±2.783.7_± 2.7 AP (DiffPure) 0.473±.0170.473_±.017 77.4±3.777.4_± 3.7 0.186±.0080.186_±.008 84.5±2.284.5_± 2.2 0.525±.0210.525_±.021 80.5±2.880.5_± 2.8 0.276±.0170.276_±.017 84.3±2.384.3_± 2.3 RS (Cohen) 0.468±.0170.468_±.017 77.4±3.777.4_± 3.7 0.201±.0080.201_±.008 84.3±2.384.3_± 2.3 0.529±.0210.529_±.021 80.9±2.880.9_± 2.8 0.290±.0180.290_±.018 84.7±2.284.7_± 2.2 LogiC-Diff 0.246±.0100.246_±.010 84.8±2.984.8_± 2.9 0.162±.0070.162_±.007 87.9±2.287.9_± 2.2 0.207±.0090.207_±.009 88.5±2.388.5_± 2.3 0.187±.0080.187_±.008 87.6±2.287.6_± 2.2 Threat model and attacks. We organize the attacks according to the CPS layer they target and the attacker’s level of knowledge. At the physical layer, attacks directly corrupt the sensor stream and do not require access to the forecasting model. We consider four sensor-level attacks, each controlled by an attack-specific scalar budget ε : Dropout (ε=5 =5), which zeros a contiguous outage window for each sensor to simulate temporary disconnection; False Data Injection (FDI, ε=1 =1), which adds a signed bias of up to ±1σ± 1σ at each timestep; Replay (ε=0.5 =0.5), which replaces the trailing half of the window with earlier genuine measurements; and Mixed (ε=2 =2), which samples one of the three attacks for each input to model uncertainty in the fault type. At the cyber layer, attacks perturb the model input directly under an ℓ2 _2 budget of ε=1.0 =1.0. We consider white-box gradient attacks including PGD [Madry et al., 2018] with 2020 iterations and relative step size α=0.25εα=0.25 , MIM [Dong et al., 2018] with momentum decay 1.01.0, CW [Carlini and Wagner, 2017] with 200200 Adam iterations and learning rate 0.010.01, and APGD from AutoAttack [Croce and Hein, 2020], adapted to forecasting by using MSE as the objective while retaining its adaptive step-size schedule, 100100 iterations, and 55 restarts. Because LogiC-Diff contains a projection PφP_ , gradient-based attacks against the full pipeline use BPDA [Athalye et al., 2018] to approximate gradients through the projection. We further consider stronger defense-aware settings. Proj.-PGD assumes white-box access to PφP_ and alternates loss-ascent steps with re-projection onto the logic-feasible set, while BPDA/EOT averages gradients over K=20K=20 stochastic forward passes. We consider the query-only Square Attack [Andriushchenko et al., 2020], which removes gradient access entirely and is evaluated with 273273, 500500, and 10001000 proposal steps (query accounting in App. F). Lastly, the sparse indirect attack of [Liu et al., 2023] perturbs correlated series rather than the target series itself. Clean performance. Before considering attacks, we first compare clean forecasting performance. Default achieves 0.154±.0060.154_±.006 MSE and 87.5±2.187.5_± 2.1% Sat; Inherent (STL) achieves 0.164±.0060.164_±.006 / 88.1±1.988.1_± 1.9; AT (Madry) 0.172±.0060.172_±.006 / 87.1±2.487.1_± 2.4; AT (TRADES) 0.200±.0070.200_±.007 / 85.3±2.685.3_± 2.6; AP (DiffPure) 0.157±.0060.157_±.006 / 87.3±2.187.3_± 2.1; RS 0.153±.0060.153_±.006 / 87.7±2.187.7_± 2.1; and LogiC-Diff 0.155±.0060.155_±.006 / 88.1±.288.1_±.2. Thus, LogiC-Diff preserves clean forecasting accuracy while tying for the highest clean Sat%. In contrast, both adversarial-training baselines incur some loss in clean forecasting accuracy. We next evaluate how these methods behave under attack. 4.2 Robustness Across Various CPS Attack Models We begin by evaluating whether LogiC-Diff improves robustness across the two attack surfaces considered in our CPS setting: physical-layer attacks that corrupt sensor measurements and cyber-layer attacks that directly manipulate the model input. For the cyber setting, we also consider adaptive attackers that explicitly account for the defense. Physical-layer attacks. We first evaluate robustness to four sensor-level attacks in Table 2. LogiC-Diff achieves the lowest MSE and highest Sat% across all four settings. The gain is modest under FDI, where adversarial training is already effective, but becomes much larger under Dropout and Replay, reducing MSE from 0.4680.468 to 0.2460.246 and from 0.4380.438 to 0.2070.207, respectively. The advantage also persists under Mixed attacks, where the corruption type varies across samples. This result suggests that LogiC-Diff is less tied to a specific perturbation model than the competing defenses. Rather than targeting one attack mechanism, the embedded specifications provide a system-level prior over valid CPS behavior that remains useful across heterogeneous forms of sensor corruption. This is particularly helpful for temporally structured attacks, where individual sensor values may appear plausible while the overall trajectory violates expected temporal relationships. Table 3: Robust performance under cyber attacks (ℓ2 _2, ε=1.0 =1.0). (a) Gradient-based white-box attacks. MSE and STL Sat% are reported as mean±95%CImean_± 95\%~CI for the main baselines; projection-based baselines added during the extended evaluation are reported using point estimates. (b) Defense-aware and query-based attacks (MSE): Proj.-PGD, BPDA/EOT, and the gradient-free Square Attack at 273273, 500500, and 10001000 proposal steps (query accounting in App. F). (a) Gradient-based white-box attacks PGD MIM CW APGD Method MSE↓ Sat%↑ MSE↓ Sat%↑ MSE↓ Sat%↑ MSE↓ Sat%↑ Default 0.324±.0110.324_±.011 83.1±2.483.1_± 2.4 0.320±.0110.320_±.011 82.9±2.482.9_± 2.4 0.290±.0120.290_±.012 84.2±2.384.2_± 2.3 0.325±.0110.325_±.011 83.0±2.483.0_± 2.4 Inherent (STL) 0.316±.0120.316_±.012 83.4±2.283.4_± 2.2 0.312±.0120.312_±.012 83.5±2.283.5_± 2.2 0.283±.0130.283_±.013 84.9±2.284.9_± 2.2 0.317±.0120.317_±.012 83.4±2.283.4_± 2.2 AT (Madry) 0.226±.0090.226_±.009 85.3±2.585.3_± 2.5 0.225±.0090.225_±.009 85.3±2.685.3_± 2.6 0.186±.0090.186_±.009 86.6±2.486.6_± 2.4 0.226±.0090.226_±.009 85.3±2.585.3_± 2.5 AT (TRADES) 0.244±.0090.244_±.009 84.4±2.784.4_± 2.7 0.244±.0090.244_±.009 84.4±2.784.4_± 2.7 0.210±.0080.210_±.008 85.1±2.685.1_± 2.6 0.244±.0090.244_±.009 84.4±2.784.4_± 2.7 AP (DiffPure) 0.301±.0110.301_±.011 83.4±2.483.4_± 2.4 0.297±.0110.297_±.011 83.4±2.483.4_± 2.4 0.265±.0120.265_±.012 85.0±2.385.0_± 2.3 0.300±.0110.300_±.011 83.5±2.483.5_± 2.4 RS (Cohen) 0.311±.0110.311_±.011 83.5±2.483.5_± 2.4 0.307±.0110.307_±.011 83.5±2.483.5_± 2.4 0.278±.0120.278_±.012 84.7±2.384.7_± 2.3 0.311±.0110.311_±.011 83.6±2.483.6_± 2.4 LogiC-Diff 0.197±.0080.197_±.008 86.9±2.486.9_± 2.4 0.197±.0080.197_±.008 86.9±2.486.9_± 2.4 0.179±.0080.179_±.008 87.6±2.387.6_± 2.3 0.197±.0090.197_±.009 86.9±2.486.9_± 2.4 Projection-based Baselines Pre-hoc Projection 0.277±.0.0100.277_±.0.010 88.0±2.488.0_± 2.4 0.274±.0.0100.274_±.0.010 87.8±2.487.8_± 2.4 0.239±.0.0100.239_±.0.010 88.8±2.388.8_± 2.3 0.278±.0.0100.278_±.0.010 88.0±2.588.0_± 2.5 Post-hoc Projection 0.225±.0.0110.225_±.0.011 100.0100.0 0.222±.0.0110.222_±.0.011 100.0100.0 0.203±.0.0110.203_±.0.011 100.0100.0 0.228±.0.0110.228_±.0.011 100.0100.0 Pre-hoc & Post-hoc 0.221±.0.0110.221_±.0.011 100.0100.0 0.218±.0.0110.218_±.0.011 100.0100.0 0.200±.0.0110.200_±.0.011 100.0100.0 0.224±.0.0110.224_±.0.011 100.0100.0 LogiC-Diff-Post-hoc 0.173±.0.0080.173_±.0.008 100.0100.0 0.173±.0.0080.173_±.0.008 100.0100.0 0.162±.0.0080.162_±.0.008 100.0100.0 0.174±.0.0080.174_±.0.008 100.0100.0 (b) Defense-aware and query-based attacks Method Proj.-PGD BPDA/EOT Sq@273 Sq@500 Sq@1000 Default 0.3218±.0110.3218_±.011 0.3551±.0250.3551_±.025 0.2212±.00950.2212_±.0095 0.2464±.00990.2464_±.0099 0.2613±.01020.2613_±.0102 AT (Madry) 0.2393±.0090.2393_±.009 0.2913±.0190.2913_±.019 0.1935±.00800.1935_±.0080 0.2029±.00810.2029_±.0081 0.2103±.00840.2103_±.0084 AT (TRADES) 0.2304±.0090.2304_±.009 0.2817±.0180.2817_±.018 0.1972±.00800.1972_±.0080 0.2041±.00800.2041_±.0080 0.2092±.00820.2092_±.0082 AP (DiffPure) 0.2975±.0110.2975_±.011 0.3388±.0240.3388_±.024 0.1934±.00900.1934_±.0090 0.2141±.00930.2141_±.0093 0.2232±.00950.2232_±.0095 RS (Cohen) 0.3092±.0110.3092_±.011 0.3468±.0240.3468_±.024 0.2003±.00880.2003_±.0088 0.2228±.00910.2228_±.0091 0.2342±.00940.2342_±.0094 LogiC-Diff 0.2005±.0080.2005_±.008 0.2375±.0170.2375_±.017 0.1723±.00770.1723_±.0077 0.1782±.00780.1782_±.0078 0.1833±.00790.1833_±.0079 Cyber-layer attacks. We next evaluate ℓ2 _2-bounded white-box attacks at ε=1.0 =1.0 in Table 3. The main result is that LogiC-Diff consistently improves robustness over adversarial training across different gradient-based attack objectives, while logic regularization or diffusion purification alone provides little protection. Compared with the strongest baseline, AT-Madry, LogiC-Diff reduces MSE from 0.2260.226 to 0.1970.197 under PGD, from 0.2250.225 to 0.1970.197 under MIM, and from 0.2260.226 to 0.1970.197 under APGD, with a smaller improvement from 0.1860.186 to 0.1790.179 under CW. The similar gains across PGD, MIM, and APGD suggest that the improvement is not specific to a particular attack optimizer. LogiC-Diff also maintains slightly higher specification satisfaction than AT-Madry (86.9%86.9\% vs. 85.3%85.3\% under PGD), suggesting that the reduction in forecasting error also improves specification compliance in practice. Projection alone is less effective. Table 3 also shows that directly enforcing STL feasibility is not sufficient to obtain the robustness of LogiC-Diff. Under PGD, applying PφP_ before inference, after inference, or at both stages yields 0.3200.320, 0.3220.322, and 0.3190.319 MSE, respectively, only marginally different from the undefended model. Applying a hard projection after diffusion-based input repair performs better, but does not compare with the full LogiC-Diff model. This suggests that feasibility is a necessary but insufficient condition for accurate reconstruction. Rather than only projecting predictions into the feasible set, LogiC-Diff uses the specifications to guide training and repair, steering the model toward accurate trajectories within that set and providing benefits beyond minimum feasibility enforcement. Adaptive and query-based attacks. We further evaluate stronger attackers that explicitly account for the defense (Table 3(b)). In particular, we design Proj.-PGD, a defense-aware variant of PGD that incorporates the STL projection PφP_ into the attack loop by alternating gradient-ascent updates with re-projection onto the logic-feasible set and the ε -ball. LogiC-Diff remains the strongest method under this attack, achieving 0.20050.2005 MSE compared with 0.23040.2304 for the best baseline. We additionally strengthen BPDA with EOT over stochastic forward passes and evaluate the Square Attack; LogiC-Diff retains the lowest MSE in both settings. These results show that its advantage persists when the attacker explicitly accounts for the projection mechanism or avoids gradient information altogether. Finally, under the gradient-free Square Attack, LogiC-Diff remains best across all query budgets and degrades only modestly as the budget increases, from 0.17230.1723 MSE at 273273 proposal steps to 0.18330.1833 at 10001000. Table 4: Robustness evaluation following the sparse indirect attack setting of Liu et al. (a) Sparse indirect attacks on our smart-city dataset under deterministic and probabilistic variants. (b) Evaluation on a seven-series subset of the traffic benchmark used by Liu et al. under the probabilistic attack. (a) reports MSE on the target series; (b) reports point-forecast normalized deviation of the target lane. Dataset and metric details are provided in App. E and App. F. Lower is better for both. (a) Sparse indirect attack on Caltrans PeMS (District 7) Deterministic Probabilistic Method κ=2κ=2 κ=4κ=4 κ=2κ=2 κ=4κ=4 Default 0.2542±.0160.2542_±.016 0.2755±.0170.2755_±.017 0.2523±.0160.2523_±.016 0.2757±.0170.2757_±.017 Inherent (STL) 0.2561±.0160.2561_±.016 0.2745±.0160.2745_±.016 0.2537±.0160.2537_±.016 0.2748±.0160.2748_±.016 AT (Madry) 0.1754±.0120.1754_±.012 0.1829±.0120.1829_±.012 0.1738±.0120.1738_±.012 0.1830±.0120.1830_±.012 AT (TRADES) 0.1750±.0110.1750_±.011 0.1794±.0110.1794_±.011 0.1737±.0110.1737_±.011 0.1795±.0110.1795_±.011 AP (DiffPure) 0.2355±.0160.2355_±.016 0.2491±.0160.2491_±.016 0.2341±.0160.2341_±.016 0.2516±.0170.2516_±.017 RS (Cohen) 0.2397±.0160.2397_±.016 0.2570±.0160.2570_±.016 0.2381±.0160.2381_±.016 0.2575±.0160.2575_±.016 LogiC-Diff 0.1226±.0080.1226_±.008 0.1286±.0080.1286_±.008 0.1217±.0080.1217_±.008 0.1287±.0080.1287_±.008 (b) Sparse indirect attack on Caltrans PeMS (District 4 [Liu et al., 2022]) κ Default AT (TRADES) LogiC-Diff – 0.1505±.01100.1505_±.0110 0.1511±.00920.1511_±.0092 0.1392±.00960.1392_±.0096 1/61/6 0.2234±.01310.2234_±.0131 0.1753±.01010.1753_±.0101 0.1567±.01020.1567_±.0102 2/62/6 0.2336±.01340.2336_±.0134 0.1852±.01050.1852_±.0105 0.1644±.01040.1644_±.0104 3/63/6 0.2377±.01360.2377_±.0136 0.1893±.01070.1893_±.0107 0.1678±.01060.1678_±.0106 5/65/6 0.2454±.01380.2454_±.0138 0.1980±.01090.1980_±.0109 0.1748±.01080.1748_±.0108 6/66/6 0.2476±.01380.2476_±.0138 0.2003±.01100.2003_±.0110 0.1770±.01090.1770_±.0109 Sparse indirect attacks. Finally, we consider an attacker that cannot modify the target series directly. Following Liu et al. [2023], the attacker instead perturbs a sparse subset of correlated series and degrades the target forecast through the dependencies learned by the model. This setting is particularly relevant to LogiC-Diff, since the embedded specifications capture relationships across signals rather than treating each series independently. Table 4 reports results on both our smart-city dataset and the original benchmark of Liu et al. [2023]. LogiC-Diff achieves the lowest target error in every setting, across both deterministic and probabilistic variants and all sparsity levels, improving over the strongest baseline by 2828–30%30\% on our dataset and by 1111–12%12\% on the original benchmark, where it is also the most accurate method on clean data. 4.3 Generalizability Across Attack Severity, Access, and CPS Domains We next test how well this robustness carries beyond that setting along three dimensions: stronger attacks, unseen attack mechanisms, and a different CPS domain. Together, these experiments ask whether the advantage of LogiC-Diff depends on a particular perturbation budget, attack used during training, or dataset. Figure 2: LogiC-Diff achieves the lowest median MSE across all attack budgets and types. Left: median per-sample MSE versus attack budget ε for PGD and Mixed attacks. Right: cumulative distributions of per-sample MSE at four budgets per attack family. Annotations show LogiC-Diff’s median MSE and the percentage reduction relative to the best-performing baseline at each budget. Vertical dashed lines mark per-method medians. Increasing attack strength. We first keep the attacks and dataset fixed while increasing the perturbation budget. Figure 2 evaluates PGD with ε∈1.5,1.75,2,2.25 ∈\1.5,1.75,2,2.25\ and Mixed physical attacks with ε∈1.5,1.75,2.25,2.5 ∈\1.5,1.75,2.25,2.5\. LogiC-Diff achieves the lowest median MSE in all eight settings, outperforming the strongest baseline by 7.3%7.3\%–28.8%28.8\%. More importantly, its advantage does not disappear as the attack becomes stronger: the margin reaches 14.0%14.0\% at the largest PGD budget and increases from 14.3%14.3\% to 28.8%28.8\% across the Mixed attacks. The effect is especially pronounced for Mixed attacks, where the median MSE of LogiC-Diff remains nearly flat while all baselines degrade. The CDFs show the same pattern across the test distribution, indicating that the improvement is not driven by a small subset of samples. Table 5: Generalization of robustness. (a) Cross-attack generalization: each method is adversarially trained on the opposite attack within the same category. For cyber attacks, the training budget is ℓ∞ _∞ with ε=0.1 =0.1; for physical attacks, we use the same budgets as in Tables 2 and 3. TRADES on MIM-ℓ∞ _∞ is omitted as a non-standard configuration. Best per train scenario in bold. Metrics reported as mean ± 95% CI. (b) Cross-domain transfer: robust MSE on the ALFA UAV dataset across physical and cyber attacks; lower is better. (a) Cross-attack generalization (Caltrans PeMS Smart City) MIM-ℓ2 _2 PGD-ℓ2 _2 Replay Dropout Method MSE↓ Sat%↑ MSE↓ Sat%↑ MSE↓ Sat%↑ MSE↓ Sat%↑ AT (Madry) 0.245±.0090.245_±.009 84.4±2.684.4_± 2.6 0.249±.0090.249_±.009 85.0±2.585.0_± 2.5 0.582±.0210.582_±.021 77.0±3.177.0_± 3.1 0.499±.0190.499_±.019 76.9±4.076.9_± 4.0 AT (TRADES) 0.232±.0090.232_±.009 85.1±2.585.1_± 2.5 – – 0.646±.0270.646_±.027 78.6±2.878.6_± 2.8 0.550±.0200.550_±.020 76.5±3.876.5_± 3.8 LogiC-Diff 0.213±.0090.213_±.009 87.3±2.387.3_± 2.3 0.205±.0090.205_±.009 86.5±2.486.5_± 2.4 0.275±.0140.275_±.014 87.2±2.287.2_± 2.2 0.276±.0140.276_±.014 85.4±2.985.4_± 2.9 (b) Cross-domain transfer (ALFA UAV) Physical Attacks Cyber Attacks Method Dropout FDI Replay Mixed PGD MIM CW APGD Default 0.3036±.02710.3036_±.0271 0.2351±.01360.2351_±.0136 1.2283±.09091.2283_±.0909 0.6246±.05940.6246_±.0594 0.5036±.02190.5036_±.0219 0.4876±.02210.4876_±.0221 0.3476±.01380.3476_±.0138 0.5350±.02170.5350_±.0217 Inherent (STL) 0.2958±.03090.2958_±.0309 0.2523±.01370.2523_±.0137 1.2774±.09161.2774_±.0916 0.7305±.06980.7305_±.0698 0.5086±.02020.5086_±.0202 0.4867±.02030.4867_±.0203 0.3496±.01370.3496_±.0137 0.5362±.01960.5362_±.0196 AT (Madry) 0.3663±.03340.3663_±.0334 0.1549±.01070.1549_±.0107 1.2051±.08711.2051_±.0871 0.5780±.05900.5780_±.0590 0.2554±.01470.2554_±.0147 0.2534±.01470.2534_±.0147 0.2040±.01420.2040_±.0142 0.2560±.01470.2560_±.0147 AT (TRADES) 0.4304±.03120.4304_±.0312 0.1727±.01430.1727_±.0143 1.1387±.08221.1387_±.0822 0.5542±.05620.5542_±.0562 0.2637±.01720.2637_±.0172 0.2627±.01720.2627_±.0172 0.2213±.01750.2213_±.0175 0.2639±.01720.2639_±.0172 AP (DiffPure) 0.3457±.03080.3457_±.0308 0.2140±.01320.2140_±.0132 1.2045±.08861.2045_±.0886 0.5890±.05500.5890_±.0550 0.4358±.02020.4358_±.0202 0.4203±.02050.4203_±.0205 0.3111±.01520.3111_±.0152 0.4525±.02030.4525_±.0203 RS (Cohen) 0.3276±.02980.3276_±.0298 0.2387±.01420.2387_±.0142 1.2135±.08981.2135_±.0898 0.6595±.06810.6595_±.0681 0.4899±.02060.4899_±.0206 0.4740±.02120.4740_±.0212 0.3462±.01390.3462_±.0139 0.5149±.02060.5149_±.0206 LogiC-Diff 0.1795±.01750.1795_±.0175 0.1613±.01650.1613_±.0165 0.3324±.02660.3324_±.0266 0.2197±.01870.2197_±.0187 0.2248±.01910.2248_±.0191 0.2252±.01910.2252_±.0191 0.2063±.01870.2063_±.0187 0.2243±.01910.2243_±.0191 Unseen attacks. We next ask whether robustness transfers when the attack at test time differs from the one used during adversarial training. Table 5(a) changes both the attack mechanism and, for cyber attacks, the perturbation norm: models trained on PGD-ℓ∞ _∞ are evaluated on MIM-ℓ2 _2 and vice versa, while physical models transfer between Dropout and Replay. The main finding is that LogiC-Diff transfers substantially better than conventional adversarial training. On cyber attacks, it reaches 0.2130.213 MSE on MIM-ℓ2 _2 and 0.2050.205 on PGD-ℓ2 _2, compared with 0.2320.232 and 0.2490.249 for the strongest AT baselines. The contrast is larger for physical attacks: LogiC-Diff reaches 0.2750.275 under Replay and 0.2760.276 under Dropout, reducing MSE by 52.7%52.7\% and 44.7%44.7\%, respectively, relative to the best AT baseline. In fact, adversarial training on the mismatched physical attack performs worse than the undefended model. This difference reflects an important distinction between the two approaches: adversarial training learns robustness to a particular perturbation distribution, whereas the specifications in LogiC-Diff describe valid system behavior independently of how that behavior is corrupted. Cross-domain transfer. Finally, we evaluate whether the same mechanism remains useful in a physically different CPS. Table 5(b) repeats the evaluation on the ALFA UAV dataset using the same pipeline and rule families, with specification thresholds re-synthesized from clean flight data. Despite the change in signals, system dynamics, and data scale, LogiC-Diff achieves the lowest MSE in six of the eight attacked settings. The largest gains again occur under temporally structured corruption: MSE decreases from 1.1391.139 to 0.3320.332 under Replay, from 0.5540.554 to 0.2200.220 under Mixed attacks, and from 0.2960.296 to 0.1800.180 under Dropout. Under FDI and CW, the differences from AT-Madry are small and their confidence intervals overlap, showing that the advantage is not uniform across every attack. ALFA also contains roughly three orders of magnitude fewer training windows than the smart-city dataset; for this setting, we use per-sample input-bound calibration. The same qualitative pattern therefore appears in two very different CPS domains: the largest gains occur when attacks disrupt temporal behavior, while additive or optimization-based perturbations leave less room over strong adversarial-training baselines. This provides evidence that the benefit comes from specification-guided repair rather than from characteristics specific to the traffic dataset. 4.4 Understanding the Sources of Robustness We next examine which parts of LogiC-Diff contribute most to its robustness and how sensitive the framework is to specification quality. Table 6 reports the corresponding ablations. Table 6: Component and logic-rule ablation of LogiC-Diff under Dropout, Mixed, PGD, and CW attacks. Each variant removes one mechanism or rule family from the full pipeline; metrics are reported as mean ± 95% CI. Dropout Mixed PGD CW Variant MSE↓ Sat%↑ MSE↓ Sat%↑ MSE↓ Sat%↑ MSE↓ Sat%↑ -Rule (Input) 0.496±.0200.496_±.020 79.7±3.279.7_± 3.2 0.234±.0110.234_±.011 86.5±2.286.5_± 2.2 0.250±.0100.250_±.010 85.8±2.685.8_± 2.6 0.210±.0100.210_±.010 87.3±2.487.3_± 2.4 -Rule (Output) 0.250±.0100.250_±.010 84.9±3.084.9_± 3.0 0.194±.0080.194_±.008 87.2±2.287.2_± 2.2 0.203±.0080.203_±.008 86.3±2.586.3_± 2.5 0.185±.0080.185_±.008 87.0±2.487.0_± 2.4 -Rule Loss ℒstlL_stl 0.260±.0100.260_±.010 84.6±3.184.6_± 3.1 0.203±.0080.203_±.008 87.2±2.387.2_± 2.3 0.219±.0080.219_±.008 86.4±2.586.4_± 2.5 0.197±.0080.197_±.008 87.3±2.487.3_± 2.4 -Stability 0.269±.0120.269_±.012 85.1±3.085.1_± 3.0 0.205±.0080.205_±.008 87.7±2.287.7_± 2.2 0.224±.0090.224_±.009 87.1±2.387.1_± 2.3 0.201±.0090.201_±.009 87.8±2.287.8_± 2.2 -Associativity 0.248±.0100.248_±.010 86.0±3.186.0_± 3.1 0.193±.0080.193_±.008 88.0±2.388.0_± 2.3 0.229±.0080.229_±.008 87.2±2.687.2_± 2.6 0.211±.0080.211_±.008 87.7±2.587.7_± 2.5 Full LogiC-Diff 0.246±.0100.246_±.010 84.8±2.984.8_± 2.9 0.187±.0080.187_±.008 87.6±2.287.6_± 2.2 0.197±.0080.197_±.008 86.9±2.486.9_± 2.4 0.179±.0080.179_±.008 87.6±2.387.6_± 2.3 Pipeline components. The input-side repair mechanism has the largest effect. Removing it increases Dropout MSE from 0.2460.246 to 0.4960.496, Mixed MSE by 25%25\%, and PGD MSE by 27%27\%. Removing output-stage rule conditioning causes a smaller but consistent degradation, while removing the STL loss also hurts both forecasting accuracy and specification satisfaction. Together, these results suggest that robustness comes primarily from repairing the corrupted input, with training-time logic supervision and output refinement providing additional gains. Specification families. Different rule families contribute to different threats. Removing Stability degrades performance across all attacks, while removing relational rules such as Associativity has a larger effect on PGD and CW. This suggests that envelope constraints help detect implausible individual trajectories, while relational constraints are particularly useful when multiple signals are perturbed jointly or indirectly. Sensitivity to specification quality. The framework is relatively tolerant of loose or incomplete specifications, but much more sensitive to incorrect ones. Widening bounds or removing a moderate fraction of rules has little effect, whereas overly tight, mismatched, or contradictory specifications noticeably degrade performance. Very limited calibration data also hurts, although performance recovers quickly with more calibration samples. Overall, missing guidance is less harmful than misleading guidance. Discussion. Our evaluation demonstrates the performance of our method across four settings: fixed-budget physical and cyber attacks, increasing attack budgets, component and rule ablations, and cross-attack generalization under specification guidance, particularly compared with adversarial training baselines. We find that our bi-stage, logic-guided reconstruction and repair mechanism achieves significant performance gains over a wide range of baselines. More importantly, the embedded specifications and overall architecture allow the model to degrade less drastically under increasing attack strength and to generalize more robustly to unseen attacks. Each rule type contributes meaningfully to overall performance, which indicates that broad non-conflicting specification coverage is usually preferable to relying on any single logic family. Limitations. We further discuss a few potential limitations. First, our evaluation is limited to two important attack families. However, additional threat models, such as training time data poisoning or model extraction would provide more comprehensive security guarantees. Second, STL specifications used by our framework are learned from clean training data and reflect domain assumptions. However, miscalibrated or incomplete specifications could systematically bias predictions in ways that propagate to downstream control. 5 Related Work Adversarial Robustness for Forecasting and CPS. Prior research has shown that attacks can occur across the CPS sensing, communication, and learning pipeline [Liu et al., 2023, Wu et al., 2022, Siddiqui et al., 2020, Yu et al., 2023], including sensor tampering [Chen et al., 2023], surrogate-based attacks [Karim et al., 2020, Liu et al., 2023], and white-box adaptive attacks [Carlini and Wagner, 2017]. Existing defenses span CPS-level methods such as detection, resilient estimation, secure control, and fault-tolerant control [Dibaji et al., 2019], as well as ML defenses such as adversarial training [Madry et al., 2018, Zhang et al., 2019] and randomized smoothing [Cohen et al., 2019]. However, CPS deployments may face mixtures of physical and cyber attacks, making single-family defenses insufficient [Duo et al., 2022]. Our framework handles physical-layer sensor attacks and cyber-layer gradient attacks under a unified defense. Diffusion-Based Adversarial Defenses and Logic-Aware ML. Generative defenses repair corrupted inputs by moving them toward the clean data distribution, with diffusion models [Sohl-Dickstein et al., 2015, Ho et al., 2020] becoming especially effective. Methods such as Denoised Smoothing [Salman et al., 2020], DiffPure [Nie et al., 2022], AudioPure [Wu et al., 2023], and AAOpt [Wesego and Rooshenas, 2025] use diffusion priors or denoising to improve adversarial robustness, but rely mainly on distributional plausibility under p(x)p(x) rather than CPS semantics. Separately, logic-aware methods incorporate prior knowledge through training regularization, output filtering, or verification [Scott et al., 2020, Yang et al., 2022a, Ma et al., 2020, Meng et al., 2022], and in security settings are often used to constrain training, verify outputs, or filter predictions [Nguyen et al., 2024, Chen et al., 2025]. Our work bridges these directions by using logic as semantic guidance within diffusion-based repair, steering reconstruction toward trajectories that are both data-plausible and consistent with CPS security specifications. 6 Conclusion In this paper, we propose a new bi-stage, logic-guided, diffusion-based framework for preventatively enhancing the security of CPS forecasting by embedding formal specifications directly into the prediction pipeline. We identify a broad set of security properties and show how they can be incorporated both before forecasting, through input-side repair, and after forecasting, through output-side refinement. Across more than one hundred specifications in our evaluation, we demonstrate the benefits of the proposed method from multiple perspectives, including forecasting accuracy, specification compliance, robustness under stronger attacks, component and rule ablations, and cross-attack generalization. Overall, the results suggest that the embedded rules provide three main benefits: they improve overall robustness and predictive performance, help the model degrade more gracefully as attack strength increases, and transfer better to unseen attacks. In future work, additional security properties can be formally specified and incorporated within the same framework. Therefore, this work represents an important step toward embedding security properties into CPS forecasting models and suggests that logic-guided repair has strong potential to extend to a broader range of CPS domains. References An et al. (2024) Z. An, T. T. Johnson, and M. Ma Formal logic enabled personalized federated learning through property inference. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38, p. 10882–10890. Cited by: §1. Andriushchenko et al. (2020) M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein Square attack: a query-efficient black-box adversarial attack via random search. In Computer Vision – ECCV 2020, p. 484–501. Cited by: Appendix F, §4.1. Athalye et al. (2018) A. Athalye, N. Carlini, and D. Wagner Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples. In International conference on machine learning, p. 274–283. Cited by: Appendix G, §4.1. Bartocci et al. (2018) E. Bartocci, J. Deshmukh, A. Donzé, G. Fainekos, O. Maler, D. Ničković, and S. Sankaranarayanan Specification-based monitoring of cyber-physical systems: a survey on theory, tools and applications. In Lectures on Runtime Verification: Introductory and Advanced Topics, p. 135–175. Cited by: §1. Cai et al. (2021) Z. Cai, Z. Xiong, H. Xu, P. Wang, W. Li, and Y. Pan Generative adversarial networks: a survey toward private and secure applications. ACM Computing Surveys (CSUR) 54 (6), p. 1–38. Cited by: §1. California Air Resources Board (n.d.) California Air Resources Board Air quality and emissions data. Note: Accessed: 2026-04-24 External Links: Link Cited by: Appendix E, §4.1. Carlini and Wagner (2017) N. Carlini and D. Wagner Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), p. 39–57. Cited by: §2, §4.1, §5. Chen (2002) C. Chen Freeway performance measurement system (pems). University of California, Berkeley. Cited by: Appendix E, §1, §4.1. Chen et al. (2025) X. Chen, S. Feng, Z. Xiong, S. An, Y. Mao, L. Yan, G. Tao, W. Guo, and X. Zhang Temporal logic-based multi-vehicle backdoor attacks against offline rl agents in end-to-end autonomous driving. arXiv preprint arXiv:2509.16950. Cited by: §5. Chen et al. (2023) Z. Chen, I. Li, H. Zhang, S. Preum, J. A. Stankovic, and M. Ma CitySpec with shield: a secure intelligent assistant for requirement formalization. Pervasive and Mobile Computing 92, p. 101802. External Links: ISSN 1574-1192, Document, Link Cited by: §5. Cohen et al. (2019) J. Cohen, E. Rosenfeld, and Z. Kolter Certified adversarial robustness via randomized smoothing. In international conference on machine learning, p. 1310–1320. Cited by: §4.1, §5. Croce and Hein (2020) F. Croce and M. Hein Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, p. 2206–2216. Cited by: §2, §4.1. Dibaji et al. (2019) S. M. Dibaji, M. Pirani, D. B. Flamholz, A. M. Annaswamy, K. H. Johansson, and A. Chakrabortty A systems and control perspective of cps security. Annual reviews in control 47, p. 394–411. Cited by: §5. Dmitry et al. (2022) N. Dmitry, I. Eugene, and C. Ivan On a formal verification of machine learning systems. International Journal of Open Information Technologies 10 (5), p. 30–34. Cited by: §1. Dong et al. (2018) Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, p. 9185–9193. Cited by: §2, §4.1. Donzé and Maler (2010) A. Donzé and O. Maler Robust satisfaction of temporal logic over real-valued signals. In Formal Modeling and Analysis of Timed Systems (FORMATS), p. 92–106. Cited by: Appendix C, §2. Duo et al. (2022) W. Duo, M. Zhou, and A. Abusorrah A survey of cyber attacks on cyber physical systems: recent advances and challenges. IEEE/CAA Journal of Automatica Sinica 9 (5), p. 784–800. Cited by: Appendix D, §1, §2, §5. Goodfellow et al. (2014) I. J. Goodfellow, J. Shlens, and C. Szegedy Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. Cited by: §2. Hein and Andriushchenko (2017) M. Hein and M. Andriushchenko Formal guarantees on the robustness of a classifier against adversarial manipulation. Advances in neural information processing systems 30. Cited by: §1. Ho et al. (2020) J. Ho, A. Jain, and P. Abbeel Denoising diffusion probabilistic models. Advances in neural information processing systems 33, p. 6840–6851. Cited by: §1, §2, §2, §3.3, §5. Hu et al. (2016) Z. Hu, X. Ma, Z. Liu, E. Hovy, and E. Xing Harnessing deep neural networks with logic rules. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 2410–2420. Cited by: §1. Jha et al. (2019) S. Jha, A. Tiwari, S. A. Seshia, T. Sahai, and N. Shankar TeLEx: learning signal temporal logic from positive examples using tightness metric. Formal Methods in System Design 54 (3), p. 364–387. Cited by: §3.1. Karim et al. (2020) F. Karim, S. Majumdar, and H. Darabi Adversarial attacks on time series. IEEE transactions on pattern analysis and machine intelligence 43 (10), p. 3309–3320. Cited by: §5. Keipour et al. (2021) A. Keipour, M. Mousaei, and S. Scherer ALFA: a dataset for uav fault and anomaly detection. The International Journal of Robotics Research 40 (2-3), p. 515–520. Cited by: Appendix E, §1, §4.1. Koymans (1990) R. Koymans Specifying real-time properties with metric temporal logic. Real-Time Systems 2 (4), p. 255–299. External Links: Document Cited by: §1. Leung et al. (2023) K. Leung, N. Aréchiga, and M. Pavone Backpropagation through signal temporal logic specifications: infusing logical structure into gradient-based methods. The International Journal of Robotics Research 42 (6), p. 356–370. Cited by: §3.3. Li et al. (2019) S. Li, X. Jin, Y. Xuan, X. Zhou, W. Chen, Y. Wang, and X. Yan Enhancing the locality and breaking the memory bottleneck of transformer on time series forecasting. Advances in neural information processing systems 32. Cited by: §4.1. Liu et al. (2022) F. Liu, H. Liu, and W. Jiang Practical adversarial attacks on spatiotemporal traffic forecasting models. Advances in Neural Information Processing Systems 35, p. 19035–19047. Cited by: §1, Table 4. Liu et al. (2023) L. Liu, Y. Park, T. N. Hoang, H. Hasson, and L. Huan Robust multivariate time-series forecasting: adversarial attacks and defense mechanisms. In The Eleventh International Conference on Learning Representations, Cited by: Appendix E, Appendix F, Appendix F, §4.1, §4.1, §4.1, §4.2, §5. Ma et al. (2020) M. Ma, J. Gao, L. Feng, and J. Stankovic STLnet: signal temporal logic enforced multivariate recurrent neural networks. Advances in Neural Information Processing Systems 33, p. 14604–14614. Cited by: §1, §3.1, §4.1, §5. Madry et al. (2018) A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, Cited by: §2, §4.1, §4.1, §5. Maler and Nickovic (2004) O. Maler and D. Nickovic Monitoring temporal properties of continuous signals. In Formal Techniques, Modelling and Analysis of Timed and Fault-Tolerant Systems (FORMATS), p. 152–166. Cited by: §1, §2. Mell et al. (2023) S. Mell, F. Bastani, S. Zdancewic, and O. Bastani Synthesizing trajectory queries from examples. In International Conference on Computer Aided Verification, p. 459–484. Cited by: §3.1. Meng et al. (2022) M. H. Meng, G. Bai, S. G. Teo, Z. Hou, Y. Xiao, Y. Lin, and J. S. Dong Adversarial robustness of deep neural networks: a survey from a formal verification perspective. IEEE Transactions on Dependable and Secure Computing. Cited by: §5. Mengash et al. (2023) H. A. Mengash, L. A. Alharbi, S. S. Alotaibi, S. AlMuhaideb, N. Nemri, M. M. Alnfiai, R. Marzouk, A. S. Salama, and M. Al Duhayyim Deep learning enabled intelligent healthcare management system in smart cities environment.. Computers, Materials & Continua 74 (2). Cited by: §1. Nguyen et al. (2024) D. T. Nguyen, Z. An, T. T. Johnson, M. Ma, and K. Leach Formal logic-guided robust federated learning against poisoning attacks. arXiv preprint arXiv:2411.03231. Cited by: §5. Nie et al. (2022) W. Nie, B. Guo, Y. Huang, C. Xiao, A. Vahdat, and A. Anandkumar Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460. Cited by: §4.1, §5. Pnueli (1977) A. Pnueli The temporal logic of programs. In Proceedings of the 18th Annual Symposium on Foundations of Computer Science, p. 46–57. External Links: Document Cited by: §1. Salman et al. (2020) H. Salman, M. Sun, G. Yang, A. Kapoor, and J. Z. Kolter Denoised smoothing: a provable defense for pretrained classifiers. Advances in Neural Information Processing Systems 33, p. 21945–21957. Cited by: §1, §5. Samangouei et al. (2018) P. Samangouei, M. Kabkab, and R. Chellappa Defense-gan: protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv:1805.06605. Cited by: §1. Scott et al. (2020) J. Scott, M. Panju, and V. Ganesh LGML: logic guided machine learning (student abstract). In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 34, p. 13909–13910. Cited by: §5. Sefati et al. (2023) S. S. Sefati, B. Arasteh, S. Halunga, O. Fratu, and A. Bouyer Meet user’s service requirements in smart cities using recurrent neural networks and optimization algorithm. IEEE Internet of Things Journal 10 (24), p. 22256–22269. Cited by: §1. Siddiqui et al. (2020) S. A. Siddiqui, A. Dengel, and S. Ahmed Benchmarking adversarial attacks and defenses for time-series data. In International Conference on Neural Information Processing, p. 544–554. Cited by: §5. Sohl-Dickstein et al. (2015) J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Ganguli Deep unsupervised learning using nonequilibrium thermodynamics. In International conference on machine learning, p. 2256–2265. Cited by: §1, §2, §5. Song et al. (2020) Y. Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456. Cited by: §2. Swaroop et al. (2024) A. Swaroop, A. Singh, G. Chandra, S. Prakash, S. K. Yadav, T. Yang, and R. S. Rathore A comprehensive overview of formal methods and deep learning for verification and optimization. In 2024 International Conference on Decision Aid Sciences and Applications (DASA), p. 1–6. Cited by: §1. Vaswani et al. (2017) A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin Attention is all you need. Advances in neural information processing systems 30. Cited by: §4.1. Wesego and Rooshenas (2025) D. Wesego and P. Rooshenas Adversary aware optimization for robust defense. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, Cited by: §1, §5. Wu (2021) S. Wu Spatiotemporal dynamic forecasting and analysis of regional traffic flow in urban road networks using deep learning convolutional neural network. IEEE transactions on intelligent transportation systems 23 (2), p. 1607–1615. Cited by: §1. Wu et al. (2023) S. Wu, J. Wang, W. Ping, W. Nie, and C. Xiao Defending against adversarial audio via diffusion model. arXiv preprint arXiv:2303.01507. Cited by: §1, §5. Wu et al. (2022) T. Wu, X. Wang, S. Qiao, X. Xian, Y. Liu, and L. Zhang Small perturbations are enough: adversarial attacks on time series prediction. Information Sciences 587, p. 794–812. Cited by: §1, §5. Yang et al. (2022a) Y. Yang, J. C. Kerce, and F. Fekri Logicdef: an interpretable defense framework against adversarial examples via inductive scene graph reasoning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 36, p. 8840–8848. Cited by: §5. Yang et al. (2022b) Z. Yang, Z. Zhao, B. Wang, J. Zhang, L. Li, H. Pei, B. Karlaš, J. Liu, H. Guo, C. Zhang, et al. Improving certified robustness via statistical learning with logical reasoning. Advances in Neural Information Processing Systems 35, p. 34859–34873. Cited by: §1. Yao et al. (2019) H. Yao, Y. Liu, Y. Wei, X. Tang, and Z. Li Learning from multiple cities: a meta-learning approach for spatial-temporal prediction. In The world wide web conference, p. 2181–2191. Cited by: §1. Yu et al. (2023) Z. Yu, H. Gao, X. Cong, N. Wu, and H. H. Song A survey on cyber–physical systems security. IEEE Internet of Things Journal 10 (24), p. 21670–21686. Cited by: §2, §5. Zhang et al. (2019) H. Zhang, Y. Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, p. 7472–7482. Cited by: §4.1, §5. Appendix A General Information Code availability. Code implementation is available at https://anonymous.4open.science/r/rpc-817A/. Computation resouces. All experiments were conducted on a machine equipped with 128 GB of RAM, an AMD Ryzen Threadripper Pro 7975WX CPU, and an NVIDIA RTX 6000 Ada GPU. Broader Impact. This paper develops methods for improving the security of forecasting models deployed in safety-critical CPS, with direct applications in transportation infrastructure, air-quality monitoring, and autonomous mobility, domains where prediction errors propagate to physical control actions and carry real-world consequences. By embedding formal Signal Temporal Logic specifications directly into a diffusion-based repair pipeline, LogiC-Diff reduces the risk of unsafe downstream behavior under both physical sensor faults (e.g., dropout, replay, false data injection) and adaptive cyber attacks, while degrading more gracefully than purely data-driven defenses as attack strength increases. The framework also generalizes substantially better than adversarial training to attacks not seen during training, which is operationally important for deployments where the threat landscape evolves faster than retraining cycles. We do not foresee direct negative societal impact from this work, as our contributions are defensive in nature. Two indirect risks merit acknowledgment, however. First, like all logic-guided methods, the framework’s behavior depends on the correctness and completeness of the specifications it enforces; miscalibrated or biased specifications could systematically distort predictions in ways that propagate to control decisions, especially in subpopulations underrepresented in the training data used to calibrate feasibility bounds. Second, no defense provides absolute guarantees, and over-reliance on any single robustness mechanism in safety-critical deployments is itself a hazard. We encourage operators to combine logic-guided repair with continued monitoring, redundant sensing, and conventional CPS safety mechanisms. Appendix B Notations Table 7 contains core notations used in this paper. Table 7: Notations used in this paper. Symbol Description Signals and data x∈ℝm×dx ^m× d Clean input history window of d-dimensional signals over m timesteps. xt(j)x^(j)_t Value of the j-th feature at time t. x∗x^* Adversarially perturbed (attacked) input sequence, x∗=x+δx^*=x+δ. x~ x Repaired input after input-stage logic-conditioned diffusion. xnx_n Forward-diffusion latent state at diffusion step n, with n∈0,…,Nn∈\0,…,N\. x x One-shot x0x_0-estimate from the input-stage reverse diffusion. xlogicx_logic Input-stage logic projection, xlogic=Pφ(x∗)x_logic=P_ (x^*). y Ground-truth forecast target. y^init y_init Initial forecast from FωF_ω before output-stage refinement. y y One-shot y0y_0-estimate from the output-stage reverse diffusion. ylogicy_logic Output-stage logic projection, ylogic=Pφ′(y^init)y_logic=P_ ( y_init). y~ y Final blended forecast after output-stage refinement. δ Adversarial perturbation, with ‖δ‖2≤ε\|δ\|_2≤ for ℓ2 _2-bounded attacks. STL specifications φ Single STL formula. φ , φ′ Input-side and output-side STL specification sets, respectively. μ Atomic predicate of the form f(xt)≥cf(x_t)≥ c. ρφ(x,t) _ (x,t) STL robustness of signal x with respect to φ at time t. ρ~φ ρ_ Smooth surrogate of STL robustness used during training. Pφ(⋅)P_ (·) STL projection operator returning the closest φ -feasible trace in ℓ1 _1 distance. Models and diffusion process Fω(⋅)F_ω(·) Forecasting model (transformer-based) with parameters ω. Φθ(⋅) _θ(·) Full end-to-end logic-conditioned diffusion repair pipeline with parameters θ. ϵθ(xn,n,cx) _θ(x_n,n,c_x) Input-stage noise predictor conditioned on cxc_x. ϵθ′(ym,m,cy)ε _θ(y_m,m,c_y) Output-stage noise predictor conditioned on cyc_y. cx,cyc_x,c_y Logic-derived conditioning signals for input and output stages, respectively. βn,αn,α¯n _n, _n, α_n DDPM noise schedule parameters at diffusion step n. α,α′α,α Learnable blending coefficients for input- and output-stage repair. Training objective ℒdiffx,ℒdiffyL_diff^x,L_diff^y Input- and output-side diffusion reconstruction losses. ℒstlx,ℒstlyL_stl^x,L_stl^y Input- and output-side smoothed STL feasibility losses. ℒpredL_pred Forecasting loss on the final blended forecast y~ y. λx,λy,λp,λρx,λρy _x, _y, _p, _ρ^x, _ρ^y Loss weighting coefficients. Appendix C Signal Temporal Logic Semantics This section provides additional background on STL, expanding on the inductive definition introduced in Section 2. We give the full qualitative (Boolean) and quantitative (robustness) semantics Donzé and Maler [2010], which together support both monitoring and gradient-based optimization over STL formulas. Throughout this section, x denotes a signal trace, μ an atomic predicate of the form f(xt)≥cf(x_t)≥ c, and φ , φ1 _1, φ2 _2 denote STL formulas. Definition C.1 gives the qualitative semantics, where (x,t)⊧φ(x,t) reads “signal x satisfies φ at time t.” Definition C.1 (STL Qualitative Semantics). (x,t) (x,t) ⊧μ μ ⇔f(xt)≥c f(x_t)≥ c (x,t) (x,t) ⊧¬φ ⇔(x,t)⊧̸φ (x,t) (x,t) (x,t) ⊧φ1∧φ2 _1 _2 ⇔(x,t)⊧φ1and(x,t)⊧φ2 (x,t) _1\;and\;(x,t) _2 (x,t) (x,t) ⊧◊[a,b]φ _[a,b] ⇔∃t′∈[t+a,t+b],(x,t′)⊧φ ∃ t ∈[t+a,\,t+b],\;(x,t ) (x,t) (x,t) ⊧□[a,b]φ _[a,b] ⇔∀t′∈[t+a,t+b],(x,t′)⊧φ ∀ t ∈[t+a,\,t+b],\;(x,t ) (x,t) (x,t) ⊧φ1[a,b]φ2 _1\,U_[a,b]\, _2 ⇔∃t′∈[t+a,t+b],(x,t′)⊧φ2 ∃ t ∈[t+a,\,t+b],\;(x,t ) _2 and∀t′∈[t,t′],(x,t′)⊧φ1 \;\,∀ t ∈[t,\,t ],\;(x,t ) _1 While the qualitative semantics provide a Boolean evaluation of property satisfaction, the quantitative semantics yield a real-valued measure of how strongly a signal satisfies or violates a formula. As introduced in Section 2, the STL robustness function ρφ(x,t)∈ℝ _ (x,t) measures the signed margin by which x satisfies or violates φ at time t, with positive values denoting satisfaction and negative values denoting violation. Definition C.2 gives the inductive computation. Definition C.2 (STL Robustness ρ). ρμ(x,t) _μ(x,t) =f(xt)−c =f(x_t)-c ρ¬φ(x,t) _ (x,t) =−ρφ(x,t) =- _ (x,t) ρφ1∧φ2(x,t) _ _1 _2(x,t) =minρφ1(x,t),ρφ2(x,t) = \ _ _1(x,t),\; _ _2(x,t) \ ρ◊[a,b]φ(x,t) _ _[a,b] (x,t) =maxt′∈[t+a,t+b]ρφ(x,t′) = _t ∈[t+a,\,t+b]\, _ (x,t ) ρ□[a,b]φ(x,t) _ _[a,b] (x,t) =mint′∈[t+a,t+b]ρφ(x,t′) = _t ∈[t+a,\,t+b]\, _ (x,t ) ρφ1[a,b]φ2(x,t) _ _1\,U_[a,b]\, _2(x,t) =maxt′∈[t+a,t+b]minρφ2(x,t′),mint′∈[t,t′]ρφ1(x,t′) = _t ∈[t+a,\,t+b] \ _ _2(x,t ),\; _t ∈[t,\,t ] _ _1(x,t ) \ The robustness ρφ _ is non-differentiable due to the min and max operations. For gradient-based optimization, we use the smooth surrogate ρ~φ ρ_ , which replaces these with differentiable approximations (e.g., soft-min and soft-max) and is the form used in the STL training losses ℒstlxL_stl^x and ℒstlyL_stl^y. Appendix D Background on Physical Attack Models We consider adversarial cyber-physical attacks Duo et al. [2022] that perturb multivariate spatiotemporal inputs. Following the formulation in Section 2, let x∈ℝm×dx ^m× d denote the clean input window of d-dimensional signals over m timesteps, and x∗=x+δx^*=x+δ denote the adversarially perturbed input, where δ is a perturbation bounded in both pattern and magnitude. Under attack, the forecaster FωF_ω produces an erroneous prediction Fω(x∗)F_ω(x^*) over the horizon H. The attacker’s objective is to manipulate the input in a way that induces violations of task-specific logic constraints, thereby degrading both predictive accuracy and specification compliance. In multivariate settings, the attacker may perturb all features at a given timestamp or selectively target individual ones. Letting xt=[xt(1),xt(2),…,xt(d)]x_t=[x^(1)_t,x^(2)_t,…,x^(d)_t] denote the d-dimensional observation at time t, we distinguish two perturbation modes: • Feature-wise attacks, which perturb each feature independently, xt∗(j)=xt(j)+δt(j),x^*(j)_t=x^(j)_t+δ^(j)_t, targeting specific sensor channels (e.g., a compromised speed sensor while flow remains untouched). • Global attacks, which apply coordinated perturbations across all features, xt∗=xt+δt,x^*_t=x_t+ _t, affecting the full observation simultaneously. Appendix E Dataset Preparation We describe the construction of the forecasting windows used in Section 4.1. All three prepared datasets contain d=7d=7 channels, with an input length of m=24m=24, a forecast horizon of H=6H=6, and a sliding-window stride of one. The saved arrays have shape (Ns,m,d)(N_s,m,d) for inputs and (Ns,H,d)(N_s,H,d) for targets; the evaluation code transposes them to channel-first tensors. Unless otherwise stated, forecasting errors and attack budgets are measured in standardized feature coordinates. Smart-City Traffic and Air Quality. The smart-city data combine hourly Caltrans PeMS District 7 measurements with air-quality observations for the Los Angeles region over 2024–2025 [Chen, 2002, California Air Resources Board, n.d.]. The feature order is total flow, average occupancy, average speed, NO2NO_2, NOxNO_x, ozone, and PM2.5; the last channel is denoted PMx in the main text. Traffic stations are matched to the nearest air-quality site within 5050 km using geographic distance, and records are joined by site and timestamp. In the window-generation script, missing traffic values are filled with station-specific hour-of-day means. Missing air-quality values are forward-filled and backward-filled within station, with station-specific hour-of-day means used for remaining missing entries. Windows are constructed independently for each station within each monthly source file. The temporal split boundaries are the 7070th and 8585th percentiles of the source timestamps, and each window is assigned according to the timestamp of its final forecast target. The prepared arrays contain 12,191,90412,191,904, 2,653,0742,653,074, and 2,650,2932,650,293 training, validation, and test windows, respectively. The current preprocessing script fits a feature-wise standardizer over all imputed source files before assigning windows to splits. Consequently, this preprocessing uses aggregate statistics beyond the training period; moreover, assigning windows by their final target timestamp does not impose a gap between adjacent splits. These details distinguish the current offline protocol from a strictly training-only, temporally disjoint preprocessing protocol. UAV Flight Telemetry. The ALFA dataset [Keipour et al., 2021] contains 47 fixed-wing flight sequences. We use GPS groundspeed, relative altitude, measured and commanded roll, measured and commanded pitch, and throttle PWM output. The asynchronous channels are aligned to a 44 Hz grid using the most recent observation at or before each grid time, with a maximum staleness of 1.51.5 s. Rows with an unavailable or stale channel are removed. Windows are formed from consecutive retained rows; their nominal input and output durations are 66 s and 1.51.5 s, respectively, although removing invalid rows can introduce temporal gaps. The earliest recorded failure-status timestamp defines fault onset. A window is classified as clean only when its final target precedes this onset, or when no onset is recorded. Recording sessions, identified by their common flight timestamp, are assigned wholly to one split so that subsequences of the same physical flight cannot appear in different splits. The assignment is deterministic and stratified by fault family, yielding 34/5/8 sequences and 10,63410,634/1,6251,625/2,9072,907 clean windows for training/validation/test. Standardization is fitted on the clean training input windows and applied unchanged to targets and other splits. Validation and test windows are shuffled with seed 0 before selecting evaluation subsets. The 840 test windows reaching or following a recorded fault onset are stored separately from the clean-window synthetic-attack evaluation. Traffic Benchmark for Sparse Indirect Attacks. For Table 4(b), we use a seven-series adaptation of the GluonTS traffic dataset used by Liu et al. [2023], rather than reproducing their complete forecasting setup. The source contains 862 hourly lane-occupancy series, truncated to their common length of 14,03614,036 observations. We select seven correlated series using the first 5,0005,000 hours: start with the series of greatest mean correlation to the others, then greedily add the series of greatest mean correlation to the selected set. The resulting zero-based series indices are 3939, 165165, 669669, 775775, 821821, 834834, and 835835; these identifiers indicate selected correlated series, not a verified spatial ordering of neighboring lanes. The selected multivariate sequence is split chronologically into 70%70\%/15%15\%/15%15\% segments before windowing. A standardizer fitted on the training segment is reused for validation and test. Windows do not cross segment boundaries, giving 9,7969,796, 2,0762,076, and 2,0772,077 windows, respectively. Validation and test windows are shuffled with seed 0. The sparse attack targets the first selected series, lane_039, while perturbing a subset of the other six series. Evaluation Subsets and Specification Calibration. The extended attack evaluations use the first 1,0001,000 saved test windows for Proj.-PGD, Square Attack, and each sparse indirect experiment, and the first 150150 for the BPDA/EOT comparison. Thus, attack columns with different subset sizes should not be interpreted as a controlled ranking of attack strength. For these evaluations, the input-side repair bounds are calibrated separately from each unperturbed test input, using two-step windows. Output-side bounds and auxiliary thresholds are pooled from the first 2,0002,000 test target windows. Proj.-PGD additionally constructs a shared attacker-side specification from the first 2,0002,000 clean test inputs. These specifications are held fixed during attack optimization. The per-sample input bounds require a clean reference, and the pooled output calibration uses held-out target information; this is an offline reference-calibrated evaluation, not a training-only specification or an assumption that clean reference signals are available under deployment-time attack. Appendix F Attack Implementation and Settings All attacks operate on input tensors of shape (B,d,m)(B,d,m), where B denotes the batch size, d the number of features, and m the input window length. Each attack is parameterized by a scalar ε that controls attack strength; the precise interpretation of ε varies by attack family. All attacks preserve tensor shape and are applied independently per batch. We group the attacks into two families: (i) black-box physical-layer attacks that simulate sensor faults and do not require model gradients, and (i) white-box gradient-based attacks that require gradient access to the evaluated forecasting pipeline. For a defended method, the attacked function includes its inference-time defense, with BPDA used for non-differentiable repair operations. We additionally describe sparse indirect and query-only attacks below. Physical-Layer Attacks. • False Data Injection (FDI). An ℓ0 _0-bounded additive bias attack. For each (sample, sensor) trace, naff=max(1,⌈min(ε,1)m⌉)n_aff= (1, ( ,1)\,m ) timesteps are chosen uniformly at random without replacement and perturbed by s⋅us· u, where s∈−1,+1s∈\-1,+1\ is a random sign and u∼(0,αmax)u (0, _ ) with αmax=εσ^(x) _ = \, σ(x) and σ^(x) σ(x) denoting the standard deviation over the input batch. The parameter ε jointly controls the attacked support (saturating at 100% of the window for ε≥1 ≥ 1) and the per-step magnitude ceiling (e.g., ε=1.0 =1.0 corresponds to all timesteps perturbed at ±1σ± 1σ). • Temporal Replay. A causal record-and-replay attack. The first ℓ=clip(⌈εm⌉,1,m/2) =clip ( m ,1,m/2 ) timesteps of each (sample, sensor) trace are copied verbatim onto the trailing ℓ timesteps; the middle of the sequence is left unmodified. The replay length is capped at m/2m/2 to avoid degenerate full-sequence shifts, so ε∈(0,0.5] ∈(0,0.5] is the meaningful range. • Data Dropout. Simulates a sensor disconnect or communication-loss failure. For each (sample, sensor) trace, independently with probability pout=min(1,ε/3)p_out= (1, /3), a single contiguous outage of length ℓout=clip(⌈4ε⌉,1,m) _out=clip ( 4 ,1,m ) is placed at a uniformly random start position, and the affected timesteps are set to zero. The parameter ε thus controls both the per-sensor failure probability and the outage duration; ε≥3 ≥ 3 saturates the failure probability so that every sensor fails. • Mixed. A randomized ensemble used both at evaluation time and as a physical-layer adversarial-training mode. For each sample in the batch, one attack is drawn uniformly from FDI,Temporal Replay,Dropout\FDI,Temporal Replay,Dropout\ and applied at the shared ε . This setting evaluates robustness under unknown attack-type distributions. Gradient-Based Attacks. All four attacks below maximize the per-sample MSE between the forecaster’s prediction and the ground-truth horizon, subject to a hard ℓp _p budget ‖δ‖p≤ε\|δ\|_p≤ . The target model is held in evaluation mode. Both ℓ2 _2 and ℓ∞ _∞ variants are provided for PGD, MIM, and APGD; CW is implemented for ℓ2 _2 only. Unless stated otherwise, perturbations are initialized uniformly at random inside the ε -ball. • PGD. Projected gradient descent on δ with 2020 iterations and relative step size α=0.25εα=0.25\, . The ℓ2 _2 variant uses normalized-gradient steps δ←δ+α∇δℒ/‖∇δℒ‖2δ←δ+α\, _δL/\| _δL\|_2; the ℓ∞ _∞ variant uses sign-gradient steps. After every step, δ is hard-projected onto the ε -ball. • MIM. Momentum Iterative Method. Identical outer loop to PGD, but the gradient at each step is ℓ1 _1-normalized and accumulated as an exponential moving average gn=μgn−1+∇δℒ/‖∇δℒ‖1g_n=μ\,g_n-1+ _δL/\| _δL\|_1 with decay μ=1.0μ=1.0. The step direction is gn/‖gn‖2g_n/\|g_n\|_2 for ℓ2 _2 and sign(gn)sign(g_n) for ℓ∞ _∞. We use 2020 iterations. • CW-ℓ2 _2. The Carlini–Wagner ℓ2 _2 attack: minimize ‖δ‖22+c⋅f(x+δ,y)\|δ\|_2^2+c· f(x+δ,y) with Adam (learning rate 0.010.01, c=10c=10) for 200200 iterations, where f is the negative regression MSE for the untargeted setting. To remain budget-comparable with PGD and MIM, δ is hard-projected onto the ε -ball after each Adam step. The best adversarial δ encountered along the trajectory (largest MSE under the budget, per sample) is returned. • APGD. Auto-PGD with adaptive step size, momentum-blended updates xn+1=0.75⋅projε(xn+αngn)+0.25⋅(xn−xn−1),x_n+1=0.75·proj_ (x_n+ _n\,g_n)+0.25·(x_n-x_n-1), and restart-from-best on plateau detection. The step size is initialized at 2ε2 and halved whenever the loss fails to improve over a sliding window. We use 100100 iterations and 55 random restarts; the worst-case (largest-MSE) adversarial example across restarts is reported. BPDA Wrapping for the LogiC-Diff Pipeline. The full LogiC-Diff pipeline Φθ _θ contains a non-differentiable STL projection operator PφP_ . To attack the full pipeline rather than a differentiable surrogate, all gradient-based attacks above are wrapped in the BPDA approximation: the forward pass uses the true PφP_ , while the backward pass treats it as the identity. This is the same protocol used to report the robust-MSE results in Table 3. EOT Variants for Stochastic Defenses. For models with stochastic inference (e.g., diffusion-based purification with noise re-injection), each gradient-based attack has an Expectation-over-Transformations variant that averages the gradient over K independent stochastic forward passes before each PGD, MIM, APGD update. For deterministic models the K gradients are identical and the EOT variant reduces to the base attack. BPDA/EOT Evaluation Protocol. The BPDA/EOT column of Table 3(b) uses PGD with an ℓ2 _2 budget ε=1.0 =1.0, 2020 iterations, step size 0.25ε0.25 , one random initialization, and K=20K=20 gradient samples per update. Let G(x,ξ)G(x;ξ) denote the complete evaluated predictor with inference randomness ξ. The attack uses gk=1K∑r=1K∇δℒ(G(x+δk,ξr),y),δk+1=Πε(δk+0.25εgk‖gk‖2),g_k= 1K _r=1^K _δL (G(x+ _k; _r),y ), _k+1= _ ( _k+0.25 \, g_k\|g_k\|_2 ), where Πε _ projects each sample’s complete perturbation onto the ℓ2 _2 ball. Both LogiC-Diff repair hooks use the true repair in the forward pass and an identity backward approximation. When stochastic passes are evaluated as a tiled batch, the per-sample input bounds are repeated in the same order, preserving each replica’s conditioning. LogiC-Diff is evaluated with deterministic one-shot inference and no injected diffusion noise in this comparison; EOT therefore reduces to its base gradient attack. DiffPure uses fresh purification noise with scale 0.10.1, while randomized smoothing averages 1010 forecasts with Gaussian input noise of standard deviation 0.250.25 per predictor call. Their final errors are averaged over 2020 independent predictor calls, computing the expectation of MSE rather than the MSE of an averaged forecast. The attack initialization is seeded with 0. The comparison uses 150150 test windows, with the calibration protocol in App. E. Projection-Aware PGD. Proj.-PGD alternates loss ascent with input-side logic repair and perturbation-budget projection. Let PφgP_ _g denote the shared attacker-side repair operator, distinct from the per-sample input bounds used by LogiC-Diff. Starting from a random point in the ℓ2 _2 ball, each iteration computes uk=δk+0.25ε∇δℒ(G(x+δk),y)‖∇δℒ(G(x+δk),y)‖2,δk+1=Πε(Pφg(x+uk)−x).u_k= _k+0.25 \, _δL(G(x+ _k),y)\| _δL(G(x+ _k),y)\|_2, _k+1= _ (P_ _g(x+u_k)-x ). We use ε=1.0 =1.0, 2020 iterations, one random initialization, and the final iterate. The outer logic repair is applied outside the gradient graph; BPDA remains active inside the defended predictor. Applying the budget projection last enforces the norm constraint, but can undo logic feasibility, so the procedure does not guarantee that the final input belongs to the intersection of both constraint sets. The shared attacker-side specification contains 186 compiled constraints in the saved experiment. Table 3(b) uses 1,0001,000 test windows. Query-Based Square Attack. We adapt the score-based random search of Andriushchenko et al. [2020] to forecasting by maximizing per-sample MSE without using gradients. Each proposal modifies a contiguous block of one feature channel. Initialization assigns an independent random sign to each channel, constant over its input history, then projects the full perturbation onto the ℓ2 _2 ball of radius ε=1.0 =1.0. For a block of length h, the proposal replaces its perturbation by a Gaussian vector normalized to length 0.5ε0.5 , followed by projection of the complete perturbation onto the budget ball. Each sample accepts a proposal only if its queried loss exceeds its incumbent loss. This is a time-series adaptation with budget projection, rather than the original image attack’s exact ℓ2 _2 budget-transfer procedure. The block length is h=max(1,round(pm))h= (1,round(pm)), initially p=0.3p=0.3; p is halved after 5%5\%, 20%20\%, 40%40\%, 60%60\%, and 80%80\% of the proposal budget. Each budget is evaluated independently with proposal seed 0 and no additional restarts. The saved runs use 273273, 500500, and 10001000 proposal steps on the same 1,0001,000 test windows. There is one additional initialization query and a separate final evaluation call; the proposal budget therefore excludes these two calls. For DiffPure and randomized smoothing, each query averages 2020 independently sampled predictor outputs before computing the MSE used for acceptance, and final evaluation uses the same averaged predictor. Randomized smoothing itself uses 1010 noisy backbone forecasts per predictor call. Thus, one averaged query requires 2020 predictor calls for DiffPure and 200200 backbone forecasts for randomized smoothing; the table’s budgets count proposals, not individual backbone forward passes. Deterministic methods, including the LogiC-Diff configuration above, use one predictor call per query. Sparse Indirect Attack: Threat Model. Following Liu et al. [2023], the attacker perturbs auxiliary series to corrupt the forecast of protected target series. Let I be the target-channel set and s(δ)=|j:‖δ(j)‖2>0|s(δ)=|\j:\|δ^(j)\|_2>0\| count perturbed channels. Our untargeted regression adaptation solves maxδℒI(G(x+δ),y)s.t.δ(j)=0(j∈I),s(δ)≤κ,‖δ‖2≤1, _δ\;L_I (G(x+δ),y ) .t. δ^(j)=0\ (j∈ I), s(δ)≤κ, \|δ\|_2≤ 1, where ℒIL_I is MSE averaged over the forecast horizon and target channels only. Sparsity is imposed over entire feature histories, not individual timestamps. The attack is constructed separately against each evaluated method; LogiC-Diff includes both repair stages with BPDA, and its specifications remain fixed during optimization. Sparse Indirect Attack: Solvers. We implement two support-selection procedures inspired by Liu et al. [2023]: • Deterministic. Initialize a random perturbation inside the ℓ2 _2 ball, zero the protected channels, and perform 2020 normalized-gradient ascent steps with step size 0.250.25. Retain the κ eligible channels of greatest temporal perturbation norm, project back to the budget ball, and refine for 1010 additional steps on this fixed support. Protected channels are zeroed and the norm budget is enforced after every update. One initialization is used, and the final refined perturbation is returned. • Probabilistic. Jointly optimize a raw perturbation v and per-channel logits γj _j with Adam for 100100 iterations at learning rate 0.050.05. A relaxed mask is sampled as aj=sigmoid((γj+loguj−log(1−uj))/τ)a_j=sigmoid(( _j+ u_j- (1-u_j))/τ), with uj∼(0,1)u_j (0,1) and τ=0.5τ=0.5. Protected channels are masked out, and v⊙av a is projected onto the budget ball before each forward pass. The minimized objective is −ℒI+10max(0,∑j∉Isigmoid(γj)−κ)-L_I+10 (0, _j∉ Isigmoid( _j)-κ). Logits start at zero and v starts from Gaussian noise with standard deviation 0.0010.001. At termination, keep the κ eligible channels with the greatest learned probabilities, apply this hard mask to v, and project onto the budget ball. The hard mask enforces the final channel budget even though the relaxed optimization uses a soft sparsity penalty. Here, “probabilistic” refers to the attack’s support-selection mechanism, not to a probabilistic forecasting model. Both solvers maximize target-channel error; they do not use an attacker-specified target trajectory. Sparse Indirect Attack: Dataset-Specific Settings. In Table 4(a), I comprises flow, occupancy, and speed, which remain unmodified. The attacker can perturb at most κ∈2,4κ∈\2,4\ of the four air-quality channels. We report target-channel MSE on 1,0001,000 standardized test windows. In Table 4(b), the protected target is lane_039, and the probabilistic solver can perturb k∈1,2,3,5,6k∈\1,2,3,5,6\ of the other six selected traffic series. The displayed sparsity fractions are k/6k/6; the clean row uses k=0k=0. This experiment also uses 1,0001,000 test windows and the same ℓ2 _2 budget and probabilistic-solver settings. For the traffic benchmark, predictions and targets are inverse-standardized before scoring. With pitp_it and yity_it denoting the target-series prediction and observation in original units, the reported normalized deviation is ND=∑i=1Ns∑t=1H|yit−pit|∑i=1Ns∑t=1H|yit|.ND= _i=1^N_s _t=1^H|y_it-p_it| _i=1^N_s _t=1^H|y_it|. This is the point-forecast normalized absolute error, equal to weighted quantile loss at quantile 0.50.5; no distinct predictive quantiles are estimated in this adaptation. For Table 4(a), the reported interval is 1.961.96 times the standard error of per-window target MSE. For Table 4(b), we resample the 1,0001,000 windows with replacement 2,0002,000 times using seed 0, recompute the ratio of sums, and report 1.961.96 times its bootstrap standard deviation. These are window-level intervals and do not account for dependence between overlapping windows. Table 8: Attack types targeting smart-city and cyber-physical predictive pipelines. We focus on adversarial manipulations of inputs to prediction models and organize attacks by increasing operational complexity. Attack and Description Affected Components Temporal Pattern Representative Techniques Data (Input) Level Attacks Data Suppression. Suppress or delay genuine events by selectively dropping measurements or interrupting data streams. Sensors, gateways, edge aggregators, and time synchronization services. Periodic gaps or bursty outages aligned with critical events. Selective packet loss, jitter injection, induced clock drift. Data Replay. Reinject previously valid measurements to misrepresent the current system state. Sensors and data ingestion pipelines feeding prediction models. Event-triggered (e.g., congestion or demand spikes). Timestamp-consistent replay, sliding-window or delayed injection. False Data Injection. Inject fabricated or biased sensor values to systematically mislead predictions. Loop detectors, CCTV counts, floating-car data, air-quality sensors, communication links. Single-shot, periodic, adaptive, or event-driven. Value biasing, context-aware perturbations constrained to nominal ranges. GNSS Spoofing. Manipulate physical sensing modalities to distort perceived system state. GNSS receivers, Bluetooth and Wi-Fi probes, radar or loop-based traffic sensors. Adaptive, often synchronized with traffic peaks. RF spoofing, reflective interference, density inflation or deflation. Model-Level Attacks Sequential Adversarial Examples. Craft structured perturbations over input sequences to maximize downstream prediction error. Sequence predictors (e.g., LSTM, Transformer) and feature normalization layers. Inference-time, per prediction window. Gradient-based sequence attacks, constraint-aware perturbations. Backdoor Poisoning. Corrupt training data to induce targeted misbehavior when a trigger pattern is present. Training pipelines, federated learning clients and aggregators, historical datasets. Training-time insertion, with trigger activated at inference. Label manipulation, trigger stamping, gradient or parameter perturbation. Appendix G Framework Implementation Notes We describe the full architecture and hyperparameter settings of LogiC-Diff used in all experiments. Following the formulation in Section 3, the pipeline Φθ _θ consists of three components: (i) an input-stage diffusion U-Net ϵθ _θ that purifies the (possibly attacked) input window x∗∈ℝB×m×dx^* ^B× m× d into a repaired signal x~ x; (i) a sequence-to-sequence forecaster FωF_ω that produces an initial horizon prediction y^init∈ℝB×H×d y_init ^B× H× d; and (i) an output-stage diffusion U-Net ϵθ′ε _θ that refines the forecast residual. STL-guided correction is applied at both diffusion stages through the ℓ1 _1-projection operator PφP_ (input side) and Pφ′P_ (output side), which produce the conditioning signals cxc_x and cyc_y (Section 3). Throughout the experiments we use d=7d=7 features (flow, occupancy, average speed, NOx, NO2, ozone, PMx), input window length m=24m=24, and forecast horizon H=6H=6. Diffusion U-Net. Both diffusion stages instantiate the same 1D U-Net (DDPM-style ϵε-predictor). When logic conditioning is enabled, the noisy latent and the conditioning signal cxc_x (or cyc_y) are concatenated along the channel dimension before the input projection. • Input channels: d=7d=7 (or 2d=142d=14 when conditioned) • Hidden channels: C=32C=32 • Number of levels: L=2L=2, channel multipliers (1,2)(1,2) • Time embedding: 256-dim sinusoidal → MLP • Conv kernel: 3, padding 1; activation: SiLU; normalization: GroupNorm • Down/up sampling: strided convolution (down), nearest-neighbor upsampling (up) The input-stage U-Net operates on temporal length m=24m=24; the output-stage U-Net operates on horizon length H=6H=6. Both follow the standard DDPM encoder–bottleneck–decoder structure with residual blocks and skip connections at every level. The input-stage U-Net (conditioned, m=24m=24) maps (B,14,24)(B,14,24) through an initial Conv1D (14→3214→ 32), two downsampling stages (32→3232→ 32 at length 1212; 32→6432→ 64 at length 66), a residual bottleneck at (B,64,6)(B,64,6), two upsampling stages with skip connections (64+64→3264+64→ 32; 32+32→3232+32→ 32), and a final Conv1D (32→732→ 7) producing (B,7,24)(B,7,24). The output-stage U-Net follows the same channel topology applied to the horizon-shaped tensor (B,14,6)→(B,7,6)(B,14,6)→(B,7,6). Diffusion Process. We use a discrete-time DDPM formulation: • Number of diffusion steps: N=10N=10 (input stage), M=10M=10 (output stage) • Linear β schedule: βn∈[10−4, 2×10−2] _n∈[10^-4,\,2× 10^-2] • Forward: q(xn∣x0)=(α¯nx0,(1−α¯n))q(x_n x_0)=N\! ( α_n\,x_0,\;(1- α_n)I ) • Inference: a single-step x0x_0-estimate at a fixed step n⋆=N/2=5n =N/2=5, recovered from one noise prediction via the closed-form x^=xn⋆−1−α¯n⋆ϵθ(xn⋆,n⋆,cx)α¯n⋆. x= x_n - 1- α_n \, _θ(x_n ,n ,c_x) α_n . The output stage uses the analogous formula with m⋆=M/2m =M/2 and ϵθ′ε _θ. The U-Nets are trained with the standard ϵε-prediction objective. The choice of fixed inference step is examined in the ablation study (Section 4), which sweeps n⋆∈1,3,5,7,9n ∈\1,3,5,7,9\ on the same trained model. STL-Guided Logic Correction. At each diffusion call, the U-Net produces the one-shot estimate x x (or y y on the output side), which is passed through the STL projection operator PφP_ (or Pφ′P_ ) to produce the logic-feasible signal xlogicx_logic (or ylogicy_logic). These projected signals serve as both the conditioning input to the diffusion stage and as the reference trajectory for the final blend x~=αx^+(1−α)xlogic x=α x+(1-α)x_logic. Since PφP_ is non-differentiable, gradients are propagated through it via straight-through estimation during adversarial-training inner loops, following the BPDA convention Athalye et al. [2018]. Sequence-to-Sequence Forecaster. The forecaster FωF_ω is an encoder–decoder transformer that consumes the repaired input x~∈ℝB×m×d x ^B× m× d and produces an initial forecast y^init∈ℝB×H×d y_init ^B× H× d. • Model dimension: dmodel=128d_model=128 • Encoder layers: 33 • Decoder layers: 33 • Attention heads: 44 • Feed-forward dimension: 512512 • Dropout: 0.10.1 Each block uses RMSNorm, multi-head self-attention, optional cross-attention in the decoder, and a SiLU-activated feed-forward sub-block. Sinusoidal positional encodings are added at the encoder and decoder inputs. The decoder is initialized with a learned start token and unrolled auto-regressively over H steps with a causal self-attention mask. Total trainable parameters are approximately 22M, dominated by the transformer; each U-Net contributes roughly 5050K parameters. End-to-End Forward Pass. For an input x∗x^*, the full pipeline Φθ _θ executes the following steps: 1. Input-stage repair: x~←αx^+(1−α)xlogic x←α\, x+(1-α)\,x_logic, where x x is the U-Net’s one-shot estimate and xlogic=Pφ(x∗)x_logic=P_ (x^*). 2. Forecasting: y^init←Fω(x~) y_init← F_ω( x). 3. Output-stage refinement: y~←α′y^+(1−α′)ylogic y←α \, y+(1-α )\,y_logic, where y y is the output U-Net’s one-shot estimate of y from y^init y_init and ylogic=Pφ′(y^init)y_logic=P_ ( y_init). The blending coefficients α,α′∈(0,1)α,α ∈(0,1) are learnable. Appendix H Security-Oriented Logic Formulas We formalize security-relevant attack patterns and system consistency constraints using STL, expressed in the same notation as the main-paper templates in Table 1. All formulas are defined over bounded temporal intervals [t1,t2][t_1,t_2] and use the atomic predicate form xt(j)≥cx^(j)_t≥ c from Section 2, where xt(j)x^(j)_t denotes the value of the j-th feature at time t. We use the implication shorthand p→q≡¬(p∧¬q)p→ q≡ (p q) for readability; all formulas are equivalent to compositions of operators in our defined grammar. Adversarial Behavior Models. The following formulas characterize the attack patterns in our threat model (Section 2.3). They are not enforced as constraints but used to describe and reason about adversarial signal manipulations. • Data suppression. Periodic suppression of feature values over fixed durations: whenever the sampling phase aligns with the suppression schedule, the feature stays below the operational floor c1c_1 for at least τ time units, formalized as □[t1,t2]((t≡(modΔ))→□[0,τ](¬(xt(j)≥c1))) _[t_1,t_2] ((t≡ 0\!\!\! )→ _[0,τ]( (x^(j)_t≥ c_1)) ). • Replay attack. Reuse of stale measurements following a triggering condition on feature x(k)x^(k): when the trigger fires at time t, the feature value at t matches its value τ steps prior within tolerance c2c_2, formalized as □[t1,t2]((xt(k)≥c1)→¬(|xt(j)−xt−τ(j)|≥c2)) _[t_1,t_2] ((x^(k)_t≥ c_1)→ (|x^(j)_t-x^(j)_t-τ|≥ c_2) ). • False data injection. Periodic injection of bounded perturbations relative to the clean signal x(j)∗tx^(j) _t: at injection times, the deviation from the clean signal stays below c1c_1, formalized as □[t1,t2]((t≡(modΔ))→¬(|xt(j)−xt(j)∗|≥c1)) _[t_1,t_2] ((t≡ 0\!\!\! )→ (|x^(j)_t-x^(j) _t|≥ c_1) ). • Sensor spoofing. Substitution of measurements with crafted values st(j)s^(j)_t when detection confidence on feature x(k)x^(k) is low: whenever confidence falls below c1c_1, the feature matches the spoofed signal within c2c_2, formalized as □[t1,t2](¬(xt(k)≥c1)→¬(|xt(j)−st(j)|≥c2)) _[t_1,t_2] ( (x^(k)_t≥ c_1)→ (|x^(j)_t-s^(j)_t|≥ c_2) ). • Adversarial perturbation (inference-time). Bounded perturbations applied during high-uncertainty windows: when the model uncertainty utu_t exceeds c1c_1, the perturbation magnitude stays below c2c_2, formalized as □[t1,t2]((ut≥c1)→¬(|xt(j)−xt(j)∗|≥c2)) _[t_1,t_2] ((u_t≥ c_1)→ (|x^(j)_t-x^(j) _t|≥ c_2) ). • Backdoor poisoning. Conditional manipulation activated by a trigger feature ptp_t: when the trigger fires, the input matches the manipulated signal x~t(j) x^(j)_t within c2c_2, formalized as □[t1,t2]((pt≥c1)→¬(|xt(j)−x~t(j)|≥c2)) _[t_1,t_2] ((p_t≥ c_1)→ (|x^(j)_t- x^(j)_t|≥ c_2) ). System Consistency Specifications. The following formulas instantiate the rule families from Table 1 for specific CPS domains and serve as guidance signals during logic-conditioned repair. Each is annotated with the rule family it belongs to. • Physical validity (Stability). Feature values remain within feasible physical ranges [c1,c2][c_1,c_2]: □[t1,t2]((xt(j)≥c1)∧¬(xt(j)≥c2)) _[t_1,t_2]((x^(j)_t≥ c_1) (x^(j)_t≥ c_2)). • Capacity constraint (Stability). Traffic flow cannot exceed physical capacity c1c_1: □[t1,t2](¬(xt(j)≥c1)) _[t_1,t_2]( (x^(j)_t≥ c_1)). • Queue storage limit (Stability). Queue length stays within storage bound c1c_1: □[t1,t2](¬(xt(j)≥c1)) _[t_1,t_2]( (x^(j)_t≥ c_1)). • Zone-based speed regulation (Stability, conditional). Speed in zone z respects limit c2c_2 whenever the vehicle is in-zone: □[t1,t2]((xt(k)≥c1)→¬(xt(j)≥c2)) _[t_1,t_2]((x^(k)_t≥ c_1)→ (x^(j)_t≥ c_2)). • Bounded temporal variation (Smoothness, first order). Consecutive values cannot change abruptly: □[t1,t2](¬(|xt+1(j)−xt(j)|≥c1)) _[t_1,t_2]( (|x^(j)_t+1-x^(j)_t|≥ c_1)). • Travel-time progression (Smoothness, first order). Travel time changes between adjacent samples stay within c1c_1: □[t1,t2](¬(|xt+1(j)−xt(j)|≥c1)) _[t_1,t_2]( (|x^(j)_t+1-x^(j)_t|≥ c_1)). • Temporal smoothness (second order) (Smoothness). Acceleration and trend changes remain bounded: □[t1,t2](¬(|xt+1(j)−2xt(j)+xt−1(j)|≥c1)) _[t_1,t_2]( (|x^(j)_t+1-2x^(j)_t+x^(j)_t-1|≥ c_1)). • Cross-sensor consistency (Associativity, value-level). Co-located sensors agree within tolerance c1c_1: □[t1,t2](¬(|xt(j)−xt(k)|≥c1)) _[t_1,t_2]( (|x^(j)_t-x^(k)_t|≥ c_1)). • Flow conservation (Associativity, value-level). Inflow and outflow stay balanced within c1c_1: □[t1,t2](¬(|xt(j)−xt(k)|≥c1)) _[t_1,t_2]( (|x^(j)_t-x^(k)_t|≥ c_1)). • Upstream-downstream correlation (Associativity, value-level). Connected segments remain correlated within c1c_1: □[t1,t2](¬(|xt(u)−xt(d)|≥c1)) _[t_1,t_2]( (|x^(u)_t-x^(d)_t|≥ c_1)). • Spillback constraint (Propagation). Upstream flow stays bounded by c2c_2 until downstream congestion clears: ¬(xt(u)≥c2)[t1,t2]¬(xt(d)≥c1) (x^(u)_t≥ c_2)\,U_[t_1,t_2]\, (x^(d)_t≥ c_1). • Sampling consistency (Liveness). A valid measurement arrives within every interval of length Δt _t: □[t1,t2](◊[0,Δt](xt(j)≥c1)) _[t_1,t_2]( _[0, _t](x^(j)_t≥ c_1)). • Post-disturbance recovery (Recovery). After a transient excursion, the feature returns to and remains within a safe band [c1,c2][c_1,c_2] for at least d time units: ◊[t1,t2]□[0,d]((xt(j)≥c1)∧¬(xt(j)≥c2)) _[t_1,t_2]\, _[0,d]((x^(j)_t≥ c_1) (x^(j)_t≥ c_2)). Appendix I Training Configurations and Hyperparameters We document the training configuration for all evaluated models, covering optimization, schedules, adversarial-training protocols, and early stopping. The settings below are the script defaults used to reproduce all reported results. Optimizer and Schedule. All models (LogiC-Diff and transformer baselines) are trained with AdamW, initial learning rate 2×10−42× 10^-4, and weight decay 1×10−41× 10^-4. The learning rate is held constant throughout training. Batch Size and Epochs. Default batch size is 128128 on CUDA-enabled devices and 6464 on CPU. The default training budget is 5050 epochs on CUDA and 2020 on CPU. More training epochs can be used by setting the corresponding training option. Loss Weights. The total training loss follows Section 3: ℒtotal=λxℒdiffx+λyℒdiffy+λpℒpred+λρxℒstlx+λρyℒstly.L_total= _xL_diff^x+ _yL_diff^y+ _pL_pred+ _ρ^xL_stl^x+ _ρ^yL_stl^y. Default coefficients: λx=λy=0.5 _x= _y=0.5, λp=1.0 _p=1.0, λρx=λρy=0.1 _ρ^x= _ρ^y=0.1. The two diffusion losses ℒdiffx,ℒdiffyL_diff^x,L_diff^y supervise x x and y y via the reparameterization trick; the two STL losses ℒstlx,ℒstlyL_stl^x,L_stl^y apply a softplus penalty to negative robustness ρ~φ(x^,0) ρ_ ( x,0) and ρ~φ′(y^,0) ρ_ ( y,0); and ℒpredL_pred is the MSE on the final blended forecast y~ y. Early Stopping. We monitor validation MSE and stop training when no improvement is observed for 1010 consecutive epochs. The checkpoint with the lowest validation MSE is used for all reported evaluations. Adversarial Training. The adversarial mode is selected from data-level,PGD-AT,MIM-AT,TRADES\data-level,PGD-AT, -AT, \. Default attack injection probability per step is 1.01.0 for the gradient-based modes and 0.50.5 for the data-level mode. Default inner-loop budgets are ε=0.1 =0.1 (PGD/MIM, ℓ∞ _∞), 77 inner steps with relative step size 0.30.3, and TRADES β=6.0β=6.0 with 1010 steps. The data-level mode samples from the physical-attack suite described in Section 2 (FDI, replay, dropout, mixed) with the same ε schedule. Baselines. Transformer-based baselines (AT-Madry, AT-TRADES, AP-DiffPure, undefended) share the same optimizer settings, batch size, epoch budget, and early-stopping policy as LogiC-Diff. The undefended transformer is trained on clean data only; AT-Madry and AT-TRADES use the inner-loop budgets above; AP-DiffPure is trained on clean data and purifies at inference. For the cross-attack generalization experiment (Table 5(a)), LogiC-Diff is trained with the same adversarial-training recipe as AT methods.