Anti-Target Controllers in Adversarial Systems

• Anti-Target Controller is a control design that counteracts non-cooperative or hostile targets using strategies such as anti-synchronization and moving-target defenses.
• Researchers use range-only sensing, decentralized coordination, and barrier functions to enforce safety and guarantee performance under adversarial conditions.
• Methodologies incorporate robust estimation and predictive game-theoretic formulations, validated via simulation and real-world UAV experiments.

An anti-target controller denotes, in the recent literature, a controller or control architecture whose purpose is to counter a non-cooperative, erratic, hostile, or adversarial target rather than merely regulate motion relative to a cooperative reference. The term is used in several closely related senses: as an anti-synchronization-based aerial encirclement and interception law for hostile UAVs; as a safety filter that minimally modifies nominal tracking commands to avoid collision with a non-cooperative target; and as a moving-target defense mechanism that turns a protected control system into an unpredictable target for an attacker. This variety suggests that the term does not yet have a single canonical meaning, but the associated designs recurrently rely on range-only sensing, decentralized coordination, safe-set or barrier-function enforcement, observability under limited sensing, and Lyapunov- or optimization-based guarantees (Liu et al., 11 Aug 2025).

1. Terminological scope and problem classes

The contemporary usage of anti-target controller spans several technical problem classes. In airborne robotics, it refers to controllers that protect a friendly target, encircle a hostile target, intercept an intruder, or maintain safety during pursuit and following. In target-defense games, it refers to decentralized or predictive feedback laws that coordinate defenders against an intruder under sensing and communication constraints. In cyber-physical security, the phrase appears in connection with moving-target defenses and adversarial control formulations, where either the defender makes the plant difficult to model or the attacker seeks to drive the system to a target state while evading detection. The literature therefore covers collision avoidance, circumnavigation, interception, neutralization, jamming, reach-avoid synthesis, and integrity-attack detection rather than a single fixed controller template (Panja et al., 2023).

A recurring distinction is between cooperative and non-cooperative targets. Several formulations explicitly assume that the target does not communicate its state, can maneuver erratically, or can execute short-duration high-speed escapes. Others treat the target as hostile because it threatens a protected asset or because it behaves adversarially relative to the controller’s safety objective. This distinction affects the sensing model, the estimator structure, and the admissible guarantees.

2. Anti-synchronization encirclement and interception

A prominent recent line of work formulates anti-target control through anti-synchronization (AS). In the stochastic moving-target encirclement problem, two agents rely only on onboard distance measurements to a non-cooperative target that is capable of escaping the circle containment by boosting its speed to maximum for a short duration. The estimator exploits the difference in squared distances,

$$\varpi(k)=p_{12}^T(k)s(k)=-\frac{1}{2}\left(d_{1s}^2(k)-d_{2s}^2(k)-p_1^T(k)p_1(k)+p_2^T(k)p_2(k)\right),$$

and updates

$$\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].$$

The corresponding distributed anti-synchronization controller (DASC) is

$$u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),$$

so that the agents maintain anti-symmetric placement on the encirclement ring while tracking the target (Liu et al., 8 Feb 2025).

The aerial extension introduces an Anti-Synchronization-based Anti-Target Controller (ASATC) for two guardians that protect a friendly target, estimate a hostile target from noisy range measurements, and transition among three operational modes: encirclement of the protected target, encirclement/interception of the hostile target, and neutralization. The AS trajectory is a 3D “vibrating string,”

$$\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\ \cos(\rho k\pi)\ h(k)\end{bmatrix},$$

and the unified controller is

$$u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),$$

with automatic mode switching driven by the estimated hostile–protected target distance $\hat{d}^{12}$. Input constraints are handled explicitly through the scaling function

$$g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),$$

which keeps the commanded acceleration within vehicle capabilities (Liu et al., 11 Aug 2025).

A closely related 3D range-only framework uses two guardian UAVs, X–Y circular motion, and vertical jitter,

$$\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,$$

to estimate and encircle a hostile drone. The decision logic is zone-based: $\Omega_1$ for monitoring/protection, $\Omega_2$ for warning, and $$\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].$$0 for attack/interception. In the inner zone, the encirclement radius shrinks dynamically, and the abstract states that the UAVs may even employ a suicide attack to neutralize the hostile target (Liu et al., 16 Jun 2025).

These AS-based controllers couple geometry and estimation: anti-symmetric motion keeps the agents on opposite sides of the target, while the time-varying encirclement pattern supplies the excitation required by range-only estimation.

3. Safety filters, barrier functions, and engagement-aware constraints

A second major interpretation of anti-target control is safety enforcement against a non-cooperative target. In autonomous airborne tracking and following, a control-barrier-function quadratic program (CBF-QP) safety controller acts as an anti-target controller by filtering the nominal tracking command only when collision risk appears. The safe set is

$$\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].$$1

with $$\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].$$2. Safety is enforced through the barrier inequality

$$\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].$$3

while the QP minimizes deviation from the nominal input $$\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].$$4. When the target moves away or is not threatening safety, the controller is passive; when the target approaches erratically, it may reduce speed, move in the opposite direction, or temporarily deviate from the tracking trajectory. Simulation results reported mean distance values $$\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].$$5 of $$\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].$$6, $$\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].$$7, $$\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].$$8, and $$\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].$$9 m for $$u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),$$0, $$u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),$$1, $$u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),$$2, and $$u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),$$3, respectively (Panja et al., 2023).

Safe and secure target circumnavigation provides a different barrier-based formulation. For a unicycle robot using only local range measurements, the joint Lyapunov function combines a quadratic potential

$$u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),$$4

with an asymmetric barrier Lyapunov function $$u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),$$5 that keeps the radial error $$u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),$$6 strictly inside $$u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),$$7, where $$u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),$$8 and $$u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),$$9. The dynamic output feedback controller,

$$\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\ \cos(\rho k\pi)\ h(k)\end{bmatrix},$$0

uses only the measured range $$\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\ \cos(\rho k\pi)\ h(k)\end{bmatrix},$$1 and the auxiliary filter state $$\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\ \cos(\rho k\pi)\ h(k)\end{bmatrix},$$2, with

$$\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\ \cos(\rho k\pi)\ h(k)\end{bmatrix},$$3

The barrier construction enforces both an inner safety distance $$\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\ \cos(\rho k\pi)\ h(k)\end{bmatrix},$$4 and an outer sensing limit $$\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\ \cos(\rho k\pi)\ h(k)\end{bmatrix},$$5 (Singh et al., 14 Jan 2025).

A further constraint-based development appears in engagement-zone-aware interception. Instead of enforcing safety through a conservative maximum-range stand-off distance, the controller uses defender-induced engagement zones,

$$\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\ \cos(\rho k\pi)\ h(k)\end{bmatrix},$$6

and aggregates multiple defender threats with the smooth log-sum-exp safety index

$$\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\ \cos(\rho k\pi)\ h(k)\end{bmatrix},$$7

The guidance law blends interception and safety,

$$\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\ \cos(\rho k\pi)\ h(k)\end{bmatrix},$$8

while actuator bounds are handled through augmented saturation dynamics and a time-varying safe-set tightening parameter $$\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\ \cos(\rho k\pi)\ h(k)\end{bmatrix},$$9. This suggests a broader anti-target interpretation in which counter-target guidance is constrained not only by geometry but also by defender capability and input saturation (Ranjan et al., 24 Mar 2026).

4. Cooperative defense, consensus, and predictive game formulations

In cooperative target defense, anti-target control appears as coordinated feedback over multi-agent networks. One decentralized strategy transforms simultaneous intruder capture into a nonlinear consensus problem. Each defender moves according to

$$u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),$$0

where $$u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),$$1 encodes communication and $$u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),$$2 indicates whether defender $$u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),$$3 senses the intruder. A sufficient condition for simultaneous capture is

$$u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),$$4

with the finite-time bound

$$u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),$$5

An important point in this literature is that more sensing alone does not always improve success; strong inter-defender communication is described as critical (Maity et al., 2024).

Nonlinear model predictive control (NMPC) provides a second class of anti-target strategies. In the target-attacker-defender game, the target-defender pair solves

$$u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),$$6

subject to $$u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),$$7, bounded inputs, and $$u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),$$8. The attacker state is estimated by an EKF from noisy range and line-of-sight measurements. Reported simulation comparisons gave interception times of $$u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),$$9, $\hat{d}^{12}$0, and $\hat{d}^{12}$1 s for NMPC, A-CLOS, and CLOS, and average control efforts of $\hat{d}^{12}$2, $\hat{d}^{12}$3, and $\hat{d}^{12}$4, respectively (Manoharan et al., 2022).

A related 2T2A game asks two cooperative targets to lure two attackers into collision. The finite-horizon objective minimizes inter-attacker distance $\hat{d}^{12}$5, alignment angles $\hat{d}^{12}$6 and $\hat{d}^{12}$7, and maximizes distances $\hat{d}^{12}$8 and $\hat{d}^{12}$9 from the individual pursuers: $$g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),$$0 The survival analysis is expressed through Apollonius-circle intersections: survival is possible if and only if $$g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),$$1, $$g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),$$2, and $$g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),$$3 (Manoharan et al., 2021).

A different predictive architecture uses a wave-equation potential field to intercept an intelligent evader in a stationary cluttered environment. The PDE stage solves

$$g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),$$4

and the ODE stage applies a gradient-based action law derived from $$g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),$$5. The paper states that, relative to quasi-static Laplace and diffusion-field strategies, the wave potential was able to follow the target under rapid sinusoidal oscillation (Masoud, 2016).

5. Estimation, observability, and stability guarantees

The anti-target literature is unusually dependent on estimator design because several controllers assume range-only sensing, GPS denial, clutter, or partial communication. In stochastic encirclement, the range-only estimator uses least squares with exponential forgetting. The Lyapunov function

$$g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),$$6

yields bounded estimation error when the forgetting factor satisfies $$g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),$$7. For the controller error state

$$g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),$$8

the Lyapunov function $$g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),$$9 gives bounded anti-symmetric encirclement provided $$\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,$$0. The reported MATLAB sample showed spikes during high-speed escape, followed by rapid reconvergence, with $$\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,$$1 and $$\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,$$2 (Liu et al., 8 Feb 2025).

In ASATC, persistent excitation of the 3D AS trajectory establishes uniform observability for the range-based linear time-varying estimation model. The hostile target state is estimated by a Kalman filter,

$$\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,$$3

and the paper states that under uniform observability and bounded noise,

$$\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,$$4

The AS encirclement error is defined as $$\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,$$5, with exponential mean-square boundedness

$$\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,$$6

In the reported simulations, target estimation errors remained within $$\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,$$7 m for position and $$\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,$$8 m for velocity, while the hostile-target encirclement error remained within $$\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,$$9 m (Liu et al., 11 Aug 2025).

For tracking and jamming a rogue drone, uncertainty is modeled at the target-existence level through a Bernoulli random finite set. Each agent estimates the existence probability $\Omega_1$0 and spatial density $\Omega_1$1, with prediction

$\Omega_1$2

and Bayesian update equations that include clutter, detection probability, and measurement likelihood. This estimator design is coupled to a distributed GRASP procedure for joint mobility and transmit-power selection under mutual-interference constraints, showing that anti-target control can include electronic effects as part of the control objective (Papaioannou et al., 2023).

6. Cyber-physical and adversarial-control interpretations

In cyber-physical security, anti-target control acquires a different meaning. The moving-target approach augments the plant with external states $\Omega_1$3 and unknown linear time-varying dynamics,

$\Omega_1$4

with outputs $\Omega_1$5. The matrices $\Omega_1$6 are known only to the defender and change randomly, so a fully capable adversary cannot cancel its influence on the extraneous sensors. Detection is based on the innovation

$\Omega_1$7

and the $\Omega_1$8 statistic

$\Omega_1$9

The paper explicitly describes this moving-target design as an “Anti-Target Controller” because it makes the defended system an ever-changing target for the adversary (Weerakkody et al., 2017).

Formal adversarial control appears in reach-avoid synthesis for discrete-time linear time-varying systems with an $\Omega_2$0-budgeted adversary,

$\Omega_2$1

The adversary’s effect is separated from nominal dynamics through the ellipsoidal leverage set

$\Omega_2$2

where $\Omega_2$3 is the controllability Gramian associated with $\Omega_2$4. Strengthening the safe and goal sets reduces synthesis to a quantifier-free SMT problem, with second-order cone programming used to compute the tightened constraints (Huang et al., 2015).

The attacker-side dual appears in control-objective attacks on CPS. There, the attacker chooses sensor and actuator manipulations to move the system toward a target state $\Omega_2$5 while keeping the innovation small. The cost

$\Omega_2$6

is solved by dynamic programming, producing an optimal linear-feedback attack law,

$\Omega_2$7

This use of “target” reverses the defender-centric interpretation: the target is the state the attacker wants to impose, not an external vehicle to be intercepted (Chen et al., 2016).

7. Experimental validation, misconceptions, and broader significance

The literature includes both simulation and hardware validation. DASC was tested in MATLAB and on real Tello drones, with the paper stating that the agents successfully locate, track, and enclose the evasive target while maintaining anti-symmetry after escape attempts. The CBF-QP safety controller was implemented in AirSim over PX4 and validated on straight-line and multiple-turn scenarios. The range-only circumnavigation controller was validated in simulation and on a Khepera IV robot with MoCap tracking. The 3D guardian frameworks report real-world UAV experiments, including real-time updates at $\Omega_2$8–$\Omega_2$9 Hz, and the jamming framework was evaluated through extensive simulation under target appearance, disappearance, clutter, and interference constraints (Liu et al., 16 Jun 2025).

Several misconceptions are directly contradicted by the cited work. First, anti-target control is not identical to aggressive interception: in some papers the controller’s role is to keep the target at a safe distance, not to collide with or neutralize it. Second, more sensing is not automatically better; one decentralized defense result states that more sensing alone does not always improve success and emphasizes the role of strong communication. Third, fixed maximum-range stand-off constraints are not the only safety formalism; engagement-zone-aware guidance was introduced specifically to quantify the conservatism of maximum-range-based formulations. Fourth, range-only sensing is not treated as a mere simplification: several papers build the estimator, the excitation trajectory, and the convergence proof around that sensing restriction (Maity et al., 2024).

A plausible implication is that “anti-target controller” is best understood as a family of adversarially oriented control designs rather than a single algorithmic object. Within that family, three motifs dominate: geometry-aware encirclement and interception, safety-preserving modification of nominal pursuit commands, and defender-aware estimation or secrecy mechanisms that deny an adversary the informational symmetry assumed in standard tracking problems.