---
title: Anti-Target Controllers in Adversarial Systems
url: https://www.emergentmind.com/topics/anti-target-controller
type: topic
---

# Anti-Target Controllers in Adversarial Systems

An anti-target controller denotes, in the recent literature, a controller or control architecture whose purpose is to counter a non-cooperative, erratic, hostile, or adversarial target rather than merely regulate motion relative to a cooperative reference. The term is used in several closely related senses: as an anti-synchronization-based aerial encirclement and interception law for hostile UAVs; as a safety filter that minimally modifies nominal tracking commands to avoid collision with a non-cooperative target; and as a moving-target defense mechanism that turns a protected control system into an unpredictable target for an attacker. This variety suggests that the term does not yet have a single canonical meaning, but the associated designs recurrently rely on range-only sensing, decentralized coordination, safe-set or barrier-function enforcement, observability under limited sensing, and Lyapunov- or optimization-based guarantees [2508.08046].

## 1. Terminological scope and problem classes

The contemporary usage of anti-target controller spans several technical problem classes. In airborne robotics, it refers to controllers that protect a friendly target, encircle a hostile target, intercept an intruder, or maintain safety during pursuit and following. In target-defense games, it refers to decentralized or predictive feedback laws that coordinate defenders against an intruder under sensing and communication constraints. In cyber-physical security, the phrase appears in connection with moving-target defenses and adversarial control formulations, where either the defender makes the plant difficult to model or the attacker seeks to drive the system to a target state while evading detection. The literature therefore covers collision avoidance, circumnavigation, interception, neutralization, jamming, reach-avoid synthesis, and integrity-attack detection rather than a single fixed controller template [2312.17215].

A recurring distinction is between cooperative and non-cooperative targets. Several formulations explicitly assume that the target does not communicate its state, can maneuver erratically, or can execute short-duration high-speed escapes. Others treat the target as hostile because it threatens a protected asset or because it behaves adversarially relative to the controller’s safety objective. This distinction affects the sensing model, the estimator structure, and the admissible guarantees.

## 2. Anti-synchronization encirclement and interception

A prominent recent line of work formulates anti-target control through anti-synchronization (AS). In the stochastic moving-target encirclement problem, two agents rely only on onboard distance measurements to a non-cooperative target that is capable of escaping the circle containment by boosting its speed to maximum for a short duration. The estimator exploits the difference in squared distances,
\[
\varpi(k)=p_{12}^T(k)s(k)=-\frac{1}{2}\left(d_{1s}^2(k)-d_{2s}^2(k)-p_1^T(k)p_1(k)+p_2^T(k)p_2(k)\right),
\]
and updates
\[
\hat{s}(k+1)=\hat{s}(k)+K(k+1)\left[\varpi(k+1)-p_{12}^T(k+1)\hat{s}(k)\right].
\]
The corresponding distributed anti-synchronization controller (DASC) is
\[
u_1(k)=\alpha(\hat{p}_{10}(k)+\zeta(r,k)), \qquad
u_2(k)=\alpha(\hat{p}_{20}(k)-\zeta(r,k)),
\]
so that the agents maintain anti-symmetric placement on the encirclement ring while tracking the target [2502.05440].

The aerial extension introduces an Anti-Synchronization-based Anti-Target Controller (ASATC) for two guardians that protect a friendly target, estimate a hostile target from noisy range measurements, and transition among three operational modes: encirclement of the protected target, encirclement/interception of the hostile target, and neutralization. The AS trajectory is a 3D “vibrating string,”
\[
\zeta(k)=r(k)\begin{bmatrix}\sin(\rho k\pi)\\ \cos(\rho k\pi)\\ h(k)\end{bmatrix},
\]
and the unified controller is
\[
u_i=2t^{-2}\left[\bar{\alpha}\,\widetilde{q}_i^j+\zeta_i\right]+2t^{-1}(p_j-v_i),
\]
with automatic mode switching driven by the estimated hostile–protected target distance \(\hat{d}^{12}\). Input constraints are handled explicitly through the scaling function
\[
g^j=\frac{1}{\beta}\left(\frac{U(\beta-1)}{\max\left\{U,(\hat{d}_1^j+\hat{d}_2^j)/2\right\}+1}\right),
\]
which keeps the commanded acceleration within vehicle capabilities [2508.08046].

A closely related 3D range-only framework uses two guardian UAVs, X–Y circular motion, and vertical jitter,
\[
\bm{\zeta}(r,\nu,k)=r(k)\begin{bmatrix}\sin(\nu k\pi),&\cos(\nu k\pi),&g(k)\end{bmatrix}^\top,
\]
to estimate and encircle a hostile drone. The decision logic is zone-based: \(\Omega_1\) for monitoring/protection, \(\Omega_2\) for warning, and \(\Omega_3\) for attack/interception. In the inner zone, the encirclement radius shrinks dynamically, and the abstract states that the UAVs may even employ a suicide attack to neutralize the hostile target [2506.13106].

These AS-based controllers couple geometry and estimation: anti-symmetric motion keeps the agents on opposite sides of the target, while the time-varying encirclement pattern supplies the excitation required by range-only estimation.

## 3. Safety filters, barrier functions, and engagement-aware constraints

A second major interpretation of anti-target control is safety enforcement against a non-cooperative target. In autonomous airborne tracking and following, a control-barrier-function quadratic program (CBF-QP) safety controller acts as an anti-target controller by filtering the nominal tracking command only when collision risk appears. The safe set is
\[
\mathcal{C}=\{x:h(x)\ge 0\}, \qquad h(x)=\lambda-d_{min},
\]
with \(\lambda=\|x_2-x_1\|\). Safety is enforced through the barrier inequality
\[
L_f h(x)+L_g h(x)u \ge -\alpha h(x),
\]
while the QP minimizes deviation from the nominal input \(u_{des}\). When the target moves away or is not threatening safety, the controller is passive; when the target approaches erratically, it may reduce speed, move in the opposite direction, or temporarily deviate from the tracking trajectory. Simulation results reported mean distance values \(\lambda_{\text{mean}}\) of \(2.52\), \(2.71\), \(3.01\), and \(3.30\) m for \(\alpha=0.5\), \(0.8\), \(1\), and \(1.5\), respectively [2312.17215].

Safe and secure target circumnavigation provides a different barrier-based formulation. For a unicycle robot using only local range measurements, the joint Lyapunov function combines a quadratic potential
\[
V_e(\bar e_x,\bar e_y)=\frac{1}{2}(\bar e_x^2+\bar e_y^2)
\]
with an asymmetric barrier Lyapunov function \(V_r(e_r)\) that keeps the radial error \(e_r=r(t)-d\) strictly inside \((-\delta_a,\delta_b)\), where \(\delta_a=d-r_i\) and \(\delta_b=r_o-d\). The dynamic output feedback controller,
\[
\omega(t)=\frac{v}{d}+vk_1\Omega(\beta)+vk_2\left(\frac{r-d}{r}\right)\eta(r),
\]
uses only the measured range \(r(t)\) and the auxiliary filter state \(z(t)\), with
\[
\dot z=-\kappa z+\frac{1}{2}r^2, \qquad \beta=-\kappa z+\frac{1}{2}r^2.
\]
The barrier construction enforces both an inner safety distance \(r_i\) and an outer sensing limit \(r_o\) [2501.08058].

A further constraint-based development appears in engagement-zone-aware interception. Instead of enforcing safety through a conservative maximum-range stand-off distance, the controller uses defender-induced engagement zones,
\[
\rho_i(\sigma_{Ai})=\mu_i R_i\left[\cos \sigma_{Ai}+\sqrt{\cos^2 \sigma_{Ai}-1+\frac{(R_i+c_i)^2}{\mu_i^2R_i^2}}\right],
\]
and aggregates multiple defender threats with the smooth log-sum-exp safety index
\[
h=-\beta\log\left(\sum_{i\in\mathcal D} e^{-b_i/\beta}\right), \qquad b_i=r_{Ai}-\rho_i.
\]
The guidance law blends interception and safety,
\[
a_A^d=\alpha(\psi(a_A^T))a_A^b+\left(1-\alpha(\psi(a_A^T))\right)a_A^T,
\]
while actuator bounds are handled through augmented saturation dynamics and a time-varying safe-set tightening parameter \(\Delta(t)\). This suggests a broader anti-target interpretation in which counter-target guidance is constrained not only by geometry but also by defender capability and input saturation [2603.23649].

## 4. Cooperative defense, consensus, and predictive game formulations

In cooperative target defense, anti-target control appears as coordinated feedback over multi-agent networks. One decentralized strategy transforms simultaneous intruder capture into a nonlinear consensus problem. Each defender moves according to
\[
\dot{x}_i(t)=v_i\,
\frac{\sum_{j=1}^{N} w_{ij}(x_j(t)-x_i(t))+b_i(x_{N+1}(t)-x_i(t))}
{\left\|\sum_{j=1}^{N} w_{ij}(x_j(t)-x_i(t))+b_i(x_{N+1}(t)-x_i(t))\right\|},
\]
where \(w_{ij}\) encodes communication and \(b_i\) indicates whether defender \(i\) senses the intruder. A sufficient condition for simultaneous capture is
\[
v_{\min}\sqrt{\lambda_{\min}(W)}-v_{N+1}\sqrt{\sum_{i=1}^{N} b_i}>0,
\]
with the finite-time bound
\[
t^* \le
\frac{\sqrt{(\xi(0))^\top (W\otimes I_2)\xi(0)}}
{v_{\min}\sqrt{\lambda_{\min}(W)}-v_{N+1}\sqrt{\sum_{i=1}^{N} b_i}}.
\]
An important point in this literature is that more sensing alone does not always improve success; strong inter-defender communication is described as critical [2412.09939].

Nonlinear model predictive control (NMPC) provides a second class of anti-target strategies. In the target-attacker-defender game, the target-defender pair solves
\[
\min J(X,U,t), \qquad
J=\int_t^{t+\tau_h}\left[u_x^2+u_y^2+r+\max(0,e-R)\right]dt,
\]
subject to \(\dot X=f(X,U,t)\), bounded inputs, and \(\sqrt{u_x^2+u_y^2}\le \bar v_T\). The attacker state is estimated by an EKF from noisy range and line-of-sight measurements. Reported simulation comparisons gave interception times of \(4.0\), \(4.3\), and \(4.5\) s for NMPC, A-CLOS, and CLOS, and average control efforts of \(351\), \(3380\), and \(11100\), respectively [2207.09136].

A related 2T2A game asks two cooperative targets to lure two attackers into collision. The finite-horizon objective minimizes inter-attacker distance \(R\), alignment angles \(\delta\) and \(\lambda\), and maximizes distances \(r_1\) and \(r_2\) from the individual pursuers:
\[
\min \int_t^{t+\tau_h}\left(w_1R+w_2\delta+w_3\lambda-w_4r_1-w_5r_2\right)dt.
\]
The survival analysis is expressed through Apollonius-circle intersections: survival is possible if and only if \(Y_1\cap Y\neq \emptyset\), \(Y_2\cap Y\neq \emptyset\), and \(Y_1\cap Y_2\neq \emptyset\) [2108.06276].

A different predictive architecture uses a wave-equation potential field to intercept an intelligent evader in a stationary cluttered environment. The PDE stage solves
\[
\nabla^2 V=\frac{1}{a^2}\frac{\partial^2 V}{\partial t^2},
\]
and the ODE stage applies a gradient-based action law derived from \(V\). The paper states that, relative to quasi-static Laplace and diffusion-field strategies, the wave potential was able to follow the target under rapid sinusoidal oscillation [1608.05864].

## 5. Estimation, observability, and stability guarantees

The anti-target literature is unusually dependent on estimator design because several controllers assume range-only sensing, GPS denial, clutter, or partial communication. In stochastic encirclement, the range-only estimator uses least squares with exponential forgetting. The Lyapunov function
\[
V_1(k)=\tilde s^T(k)\eta^{-1}(k)\tilde s(k), \qquad \tilde s(k)=\hat s(k)-s(k),
\]
yields bounded estimation error when the forgetting factor satisfies \(0<2\gamma_1\le \frac{2}{3}\). For the controller error state
\[
e_s(k)=p_1(k)-s(k)+p_2(k)-s(k),
\]
the Lyapunov function \(V_2(k)=e_s^T(k)e_s(k)\) gives bounded anti-symmetric encirclement provided \(0<3(1+\alpha)^2\ell \le \frac{3}{4}\). The reported MATLAB sample showed spikes during high-speed escape, followed by rapid reconvergence, with \(\|\hat s(k)\|\le 0.12\) and \(\|e_s(k)\|\le 0.38\) [2502.05440].

In ASATC, persistent excitation of the 3D AS trajectory establishes uniform observability for the range-based linear time-varying estimation model. The hostile target state is estimated by a Kalman filter,
\[
\hat{x}_2(k)=A\hat{x}_2(k-1)+K(k)\left[Y(k)-C(k)A\hat{x}_2(k-1)\right],
\]
and the paper states that under uniform observability and bounded noise,
\[
\mathbb{E}\|\hat{x}_2(k)-x_2(k)\|^2 \le \hat{\varepsilon}, \qquad \forall k>K.
\]
The AS encirclement error is defined as \(\bar q_j=q_1^j+q_2^j\), with exponential mean-square boundedness
\[
\mathbb{E}\|\bar q_j(k)\|^2 \le \varepsilon_j.
\]
In the reported simulations, target estimation errors remained within \(0.5\) m for position and \(0.1\) m for velocity, while the hostile-target encirclement error remained within \(0.6\) m [2508.08046].

For tracking and jamming a rogue drone, uncertainty is modeled at the target-existence level through a Bernoulli random finite set. Each agent estimates the existence probability \(e_t\) and spatial density \(s_t\), with prediction
\[
e_{t|t-1}=p_b(1-e_{t-1})+p_s e_{t-1},
\]
and Bayesian update equations that include clutter, detection probability, and measurement likelihood. This estimator design is coupled to a distributed GRASP procedure for joint mobility and transmit-power selection under mutual-interference constraints, showing that anti-target control can include electronic effects as part of the control objective [2303.09884].

## 6. Cyber-physical and adversarial-control interpretations

In cyber-physical security, anti-target control acquires a different meaning. The moving-target approach augments the plant with external states \(\tilde x_k\) and unknown linear time-varying dynamics,
\[
\begin{bmatrix}\tilde x_{k+1}\\ x_{k+1}\end{bmatrix}
=
\mathcal A_k
\begin{bmatrix}\tilde x_k\\ x_k\end{bmatrix}
+\mathcal B_k u_k
+
\begin{bmatrix}\tilde w_k\\ w_k\end{bmatrix},
\]
with outputs \((\tilde y_k,y_k)\). The matrices \(A_{1,k},A_{2,k},B_k,C_k\) are known only to the defender and change randomly, so a fully capable adversary cannot cancel its influence on the extraneous sensors. Detection is based on the innovation
\[
z_k=
\begin{bmatrix}\tilde y_k\\ y_k\end{bmatrix}
-
\mathcal C_k
\begin{bmatrix}\hat{\tilde x}_{k|k-1}\\ \hat x_{k|k-1}\end{bmatrix},
\]
and the \(\chi^2\) statistic
\[
g_k(z_k)=z_k^T \bar{\mathcal P}_k^{-1} z_k.
\]
The paper explicitly describes this moving-target design as an “Anti-Target Controller” because it makes the defended system an ever-changing target for the adversary [1706.08182].

Formal adversarial control appears in reach-avoid synthesis for discrete-time linear time-varying systems with an \(\ell^2\)-budgeted adversary,
\[
x_{t+1}=A_t x_t+B_t u_t+C_t a_t.
\]
The adversary’s effect is separated from nominal dynamics through the ellipsoidal leverage set
\[
R(t)=\left\{x\in\mathbb R^n : x^T W_t^{-1}x\le b\right\},
\]
where \(W_t\) is the controllability Gramian associated with \(C_t\). Strengthening the safe and goal sets reduces synthesis to a quantifier-free SMT problem, with second-order cone programming used to compute the tightened constraints [1501.04925].

The attacker-side dual appears in control-objective attacks on CPS. There, the attacker chooses sensor and actuator manipulations to move the system toward a target state \(x^*\) while keeping the innovation small. The cost
\[
J_\alpha=
\mathbb E\left[\sum_{t=0}^N \alpha(x_t-x^*)^TQ_t(x_t-x^*)+(\nu_t^e)^TR_t\nu_t^e\right]
\]
is solved by dynamic programming, producing an optimal linear-feedback attack law,
\[
e_{\alpha,t}=\mathcal L_{\alpha,t}\xi_t+\mathcal O_{\alpha,t}\nu_t.
\]
This use of “target” reverses the defender-centric interpretation: the target is the state the attacker wants to impose, not an external vehicle to be intercepted [1607.05927].

## 7. Experimental validation, misconceptions, and broader significance

The literature includes both simulation and hardware validation. DASC was tested in MATLAB and on real Tello drones, with the paper stating that the agents successfully locate, track, and enclose the evasive target while maintaining anti-symmetry after escape attempts. The CBF-QP safety controller was implemented in AirSim over PX4 and validated on straight-line and multiple-turn scenarios. The range-only circumnavigation controller was validated in simulation and on a Khepera IV robot with MoCap tracking. The 3D guardian frameworks report real-world UAV experiments, including real-time updates at \(20\)–\(25\) Hz, and the jamming framework was evaluated through extensive simulation under target appearance, disappearance, clutter, and interference constraints [2506.13106].

Several misconceptions are directly contradicted by the cited work. First, anti-target control is not identical to aggressive interception: in some papers the controller’s role is to keep the target at a safe distance, not to collide with or neutralize it. Second, more sensing is not automatically better; one decentralized defense result states that more sensing alone does not always improve success and emphasizes the role of strong communication. Third, fixed maximum-range stand-off constraints are not the only safety formalism; engagement-zone-aware guidance was introduced specifically to quantify the conservatism of maximum-range-based formulations. Fourth, range-only sensing is not treated as a mere simplification: several papers build the estimator, the excitation trajectory, and the convergence proof around that sensing restriction [2412.09939].

A plausible implication is that “anti-target controller” is best understood as a family of adversarially oriented control designs rather than a single algorithmic object. Within that family, three motifs dominate: geometry-aware encirclement and interception, safety-preserving modification of nominal pursuit commands, and defender-aware estimation or secrecy mechanisms that deny an adversary the informational symmetry assumed in standard tracking problems.

Source: https://www.emergentmind.com/topics/anti-target-controller