Multiplicative Attack Mechanisms

• Multiplicative attack is a family of adversarial methods that use inherent multiplication (scaling, affine transformations, and masking) to manipulate states and signals.
• In cyber-physical control and adversarial machine learning, these attacks preserve nominal system behavior while distorting physical reality or input representations.
• In cryptographic hardware and resilience analysis, multiplication-based approaches expose leakage and model superadditive degradation, necessitating robust countermeasures.

Across recent literature, the term multiplicative attack is applied to several distinct but related constructions. This suggests that it is best understood as a family of adversarial mechanisms in which multiplication, affine transformation, multiplicative masking, or multiplicative coupling is intrinsic to the attack model rather than an incidental implementation detail. In cyber-physical control, the multiplicative component appears as an affine transformation on commands and observables; in adversarial machine learning, it appears as elementwise scaling or masking of inputs; in cryptographic engineering, attacks frequently target the implementation or leakage of multiplication routines; and in resilience analysis, multiplicative terms are used to model superadditive degradation under coordinated attack conditions (Ueda et al., 2024, Yang et al., 2019, Lo et al., 2020, Velek et al., 12 Jan 2026, Romero et al., 23 Apr 2026).

1. Conceptual scope

The reviewed literature uses multiplicative structure in at least five recurrent ways: as a transformation of state, control, or observations; as a signal-dependent perturbation of learned inputs; as a matched covert mechanism against watermarking; as a neutralization or compensation signal in communications; and as an analytic representation of coupled attack impact. These usages are not identical, but they share a common formal trait: the adversary or defender acts through multiplication, matrix products, or multiplicative scaling rather than purely additive injection.

Domain	Multiplicative mechanism	Representative paper
Robotic control	Affine transformation of measurements and commands	(Ueda et al., 2024)
CPS watermarking	Matched covert attack against multiplicative filters	(Gallo et al., 26 Feb 2025)
Deep learning	Elementwise multiplicative perturbation or masking	(Yang et al., 2019)
Video recognition	Ratio-bounded multiplicative adversarial example	(Lo et al., 2020)
Cryptographic hardware	Leakage during polynomial or field multiplication	(Velek et al., 12 Jan 2026)

A useful distinction follows from this survey. In some papers, the multiplicative object is the attack itself, as in affine false-data injection or multiplicative adversarial examples. In others, the multiplicative object is the attacked primitive or the defensive mechanism, as in polynomial multiplication side-channel leakage or multiplicative watermarking. This suggests that the encyclopedia entry must cover both attack law and attack locus.

2. Affine multiplicative false-data injection in robotic manipulators

A direct and rigorous formulation appears in the study of perfectly undetectable false data injection attacks against networked kinematic control of robotic manipulators. For a manipulator with joint angle vector $\bm{q} \in \mathbb{R}^n$ and control command vector $\bm{u} \in \mathbb{R}^n$, the compromised observable and control channels are modeled as

$$\bm{\tilde{q}} = \bm{S}_x \bm{q} + \bm{d}_x, \qquad \bm{\tilde{u}} = \bm{S}_u \bm{u} + \bm{d}_u.$$

Here $\bm{S}_x$ and $\bm{S}_u$ are constant invertible matrices, and $\bm{d}_x$, $\bm{d}_u$ are constant vectors. The paper gives scaling, reflection, and shearing as concrete multiplicative examples. The undetectability theorem requires three conditions:

$$\bm{S}_x \bm{S}_u = \bm{I}^{n \times n}, \qquad \bm{q}(0) = \bm{S}_x \bm{q}(0) + \bm{d}_x, \qquad \bm{d}_u = 0.$$

Under these conditions, any controller or attack detector that uses only the compromised measurements and commands observes nominal dynamics and nominal initial conditions, even though the physical plant is manipulated. The only stated attacker requirement is knowledge of the initial state $\bm{q}(0)$ in order to set $\bm{d}_x$ accordingly (Ueda et al., 2024).

The experimental validation uses a 6-DOF FANUC IR Mate 200iD/7L robot controlled through RoboDK and MATLAB with a Jacobian transpose-based velocity controller tracking a “smiley face” path. The nominal trial produces mean observed end-effector error $\bm{u} \in \mathbb{R}^n$0. A detectable attack consisting of scaling on the control command only, with $\bm{u} \in \mathbb{R}^n$1 and uncompromised observables, is estimated by the adaptive detector, with $\bm{u} \in \mathbb{R}^n$2, and the error temporarily increases to $\bm{u} \in \mathbb{R}^n$3 until adaptation. By contrast, the three undetectable affine scenarios satisfy the stated conditions: scaling with $\bm{u} \in \mathbb{R}^n$4 and $\bm{u} \in \mathbb{R}^n$5, reflection with $\bm{u} \in \mathbb{R}^n$6 and $\bm{u} \in \mathbb{R}^n$7, and shearing with upper triangular matrices satisfying $\bm{u} \in \mathbb{R}^n$8. In all three, the attack detector is fooled, $\bm{u} \in \mathbb{R}^n$9 converges to $$\bm{\tilde{q}} = \bm{S}_x \bm{q} + \bm{d}_x, \qquad \bm{\tilde{u}} = \bm{S}_u \bm{u} + \bm{d}_u.$$0, and the observed end-effector error matches the nominal value $$\bm{\tilde{q}} = \bm{S}_x \bm{q} + \bm{d}_x, \qquad \bm{\tilde{u}} = \bm{S}_u \bm{u} + \bm{d}_u.$$1, even though the physical trajectory is distorted, reflected, or sheared (Ueda et al., 2024).

The significance of this formulation lies in its exactness. The attack is not merely low-observable; it is perfectly undetectable from the controller’s viewpoint when the matrix and initial-condition constraints are met. The paper characterizes this as a cyber-physical vulnerability of linear velocity-level manipulator control and notes that the attacker need not know the control law or desired trajectory.

3. Matched covert attacks and multiplicative watermarking in cyber-physical systems

A related but distinct use of multiplicative structure appears in active defense for cyber-physical systems. Switching multiplicative watermarking uses invertible, time-varying linear filters on both directions of the communication channel. Because the encoding is exactly decodable when filters are matched, the scheme is described as lossless, in contrast to additive watermarking. The adversarial model is a worst-case matched covert attack in which an attacker with full knowledge of the closed-loop system injects a stealthy attack of bounded energy and synchronizes attack dynamics to the previous watermark parameters. The sensor-side attack is engineered as feedback of the attacker’s internal model, so that the watermark is effectively canceled while the filters remain matched (Gallo et al., 26 Feb 2025).

The principal result is not the existence of a multiplicative attack law alone, but the demonstration that switching the watermark parameters exposes the attack. Optimality is evaluated through the output-to-output gain of the closed-loop system including attack dynamics, under actuator-energy and residual constraints. The proposed algorithm takes watermark filter parameters at one time instant and provides optimal next-step parameters; the analysis also shows that by initializing certain parameters outside the algorithm, multiplicative watermarking parameters can be randomized. In the reported simulation on a power plant model, keeping the parameters constant leaves the attack covert and degrades performance, whereas switching parameters with the proposed design causes a spike in the detection residual and reduces the attacker’s impact on performance (Gallo et al., 26 Feb 2025).

This line of work clarifies an important boundary case. A multiplicative mechanism may be defensive rather than offensive, while the attack consists of matching, learning, or canceling that mechanism. It also shows that perfect concealment can depend on temporal synchronization: a matched covert attack remains stealthy only until the watermark parameters switch.

4. Multiplicative perturbations in adversarial learning and video recognition

In adversarial machine learning, multiplicative attack models depart from the standard additive perturbation $$\bm{\tilde{q}} = \bm{S}_x \bm{q} + \bm{d}_x, \qquad \bm{\tilde{u}} = \bm{S}_u \bm{u} + \bm{d}_u.$$2 by using elementwise scaling or masking. In xAT and xVAT, the perturbed input is

$$\bm{\tilde{q}} = \bm{S}_x \bm{q} + \bm{d}_x, \qquad \bm{\tilde{u}} = \bm{S}_u \bm{u} + \bm{d}_u.$$3

where $$\bm{\tilde{q}} = \bm{S}_x \bm{q} + \bm{d}_x, \qquad \bm{\tilde{u}} = \bm{S}_u \bm{u} + \bm{d}_u.$$4 is a binary mask or, more generally, may take values in $$\bm{\tilde{q}} = \bm{S}_x \bm{q} + \bm{d}_x, \qquad \bm{\tilde{u}} = \bm{S}_u \bm{u} + \bm{d}_u.$$5. The optimization is defined to maximize divergence between the prediction on $$\bm{\tilde{q}} = \bm{S}_x \bm{q} + \bm{d}_x, \qquad \bm{\tilde{u}} = \bm{S}_u \bm{u} + \bm{d}_u.$$6 and the prediction on $$\bm{\tilde{q}} = \bm{S}_x \bm{q} + \bm{d}_x, \qquad \bm{\tilde{u}} = \bm{S}_u \bm{u} + \bm{d}_u.$$7, with an $$\bm{\tilde{q}} = \bm{S}_x \bm{q} + \bm{d}_x, \qquad \bm{\tilde{u}} = \bm{S}_u \bm{u} + \bm{d}_u.$$8 penalty on the mask. The paper emphasizes that these multiplicative perturbations are more perceptible and interpretable than additive perturbations, and that they can be generated transductively or inductively, whereas the standard AT and VAT support only a transductive implementation. Across MNIST, SVHN, CIFAR-10, and CIFAR-100, xAT and xVAT match or outperform state-of-the-art classification accuracies while being about $$\bm{\tilde{q}} = \bm{S}_x \bm{q} + \bm{d}_x, \qquad \bm{\tilde{u}} = \bm{S}_u \bm{u} + \bm{d}_u.$$9 faster than their additive counterparts, and the resulting networks exhibit distinct weight distributions (Yang et al., 2019).

The video setting generalizes this formulation through Multiplicative Adversarial Videos (MultAV), which use

$\bm{S}_x$0

To bound perceptibility, the paper introduces a ratio bound rather than a conventional $\bm{S}_x$1-norm budget. For the $\bm{S}_x$2 version, the update is expressed through iterative multiplicative scaling by $\bm{S}_x$3 followed by clipping under the ratio-bound constraint. The perturbation is therefore signal-dependent: the multiplicative form can be rewritten as an additive perturbation whose magnitude scales with the current input. Experiments on UCF101 with 3D ResNet-18 show that models adversarially trained against additive attacks are less robust to MultAV, and feature denoising does not substantially improve robustness and sometimes degrades clean accuracy (Lo et al., 2020).

These studies establish multiplicative perturbation as a distinct adversarial geometry rather than a trivial reparameterization of additive noise. In xAT/xVAT, the perturbation removes salient information by masking; in MultAV, it rescales the signal under a ratio constraint and challenges defenses tailored to additive perturbation distributions. A plausible implication is that robustness guarantees tied only to additive threat models do not transfer automatically to multiplicative ones.

5. Wireless jamming and multiplicative interaction in infrastructure attack analysis

In OFDM-based 5G NR, the relevant attack is jamming that disrupts subcarrier orthogonality and induces inter-carrier interference. The multiplicative object in this case is a receiver-side countermeasure rather than the jammer itself. After detecting attacked subcarriers through a loss-of-orthogonality test based on $\bm{S}_x$4 and the trace of a constructed matrix $\bm{S}_x$5, the receiver generates a multiplicative signal

$\bm{S}_x$6

and multiplies the received signal by it. The index $\bm{S}_x$7 is chosen so that the jammer’s condition for loss of orthogonality is not satisfied, thereby restoring orthogonality. The paper states that the approach is frequency-domain based rather than power-based and is therefore independent of the jammer’s transmitted power (Kazemian, 2024).

A different use of multiplicative structure appears in resilience analysis for power systems under multi-vector attack scenarios. The Multidimensional Resilience Index decomposes degradation into physical, operational, digital-cyber, climatic, and regulatory dimensions and introduces an explicit multiplicative interaction term for endogenous dimensions:

$\bm{S}_x$8

The full index is then scaled by exogenous multiplicative amplifiers,

$\bm{S}_x$9

For the IEEE 39-bus system under two attack scenarios derived from the December 2025 cyberattack on the Polish energy infrastructure, the observed degradation exceeds linear expectations by a factor of $\bm{S}_u$0, the endogenous coupling term contributes an additional $\bm{S}_u$1, and exogenous climatic and regulatory factors amplify the result by an additional $\bm{S}_u$2; calibration yields $\bm{S}_u$3 (Romero et al., 23 Apr 2026).

Taken together, these results show two different roles for multiplicativity in communications and infrastructure security. In one, multiplication is an operational tool for neutralizing an attack. In the other, it is the correct analytic form for quantifying greater-than-linear degradation under coordinated attack conditions. This suggests that multiplicative structure is often needed when simultaneity or coupling, rather than isolated disturbance, is the security-critical phenomenon.

6. Side-channel attacks centered on field and polynomial multiplication

Cryptographic hardware research uses the language of multiplicative attack in two closely related senses: attacks on multiplication implementations and attacks whose success depends on the multiplication formula. In ECC over $\bm{S}_u$4, five scalar-multiplication accelerators differing only in the partial multiplier structure were synthesized in 130 nm and 250 nm technologies and analyzed under horizontal DPA. The study concludes that the implemented multiplication formula influences the success of horizontal attacks significantly, but that the effect differs from technology to technology. The classical multiplication formula is the most resistant in both technologies; in 130 nm, no key candidates are extracted with correctness above $\bm{S}_u$5. At the same time, the paper explicitly states that using different multiplication formulae as the single countermeasure is not sufficient to protect cryptographic designs against horizontal DPA attacks (Kabin et al., 2022).

A companion study examines countermeasures targeted directly at the field multiplier. It investigates three techniques: different multiplication formulae including the classical formula, randomization of the sequence of partial-product calculations, and use of the partial polynomial multiplier itself as a countermeasure. All investigated protection means decrease the attack success rate significantly; combining the classical multiplication formula with randomized partial-product order lowers key correctness from $\bm{S}_u$6 to $\bm{S}_u$7 in 250 nm CMOS. The same paper notes that point blinding, key blinding, or their combination do not significantly hinder horizontal DPA (Kabin et al., 2022).

At the architectural level, a unified field multiplier for ECC based on the 4-segment Karatsuba multiplication method is presented as inherently resistant against selected horizontal attacks. The design is unified across two different Galois-field types and attributes its resistance to the fixed, operand-independent schedule and structure of the multiplier rather than to explicit masking or randomization (Kabin et al., 2022).

Post-quantum cryptography provides an even more direct attack on multiplication. A single-trace Simple Power Analysis attack against HQC exploits power-consumption leakage during polynomial multiplication at the beginning of decryption, specifically in the computation $\bm{S}_u$8. The attack targets a recursive Karatsuba implementation whose base case processes 64-bit secret limbs through a lookup-table method. Using ChipWhisperer-Lite on an STM32F303, the attack achieves a $\bm{S}_u$9 success rate over $\bm{d}_x$0 attempts. Proposed countermeasures include removing lookup tables, using direct lookup, and masking; the paper evaluates their time complexity and notes the trade-off between SPA resistance and cache-timing resistance (Velek et al., 12 Jan 2026).

The common lesson is narrow but important. In these cryptographic settings, multiplicative attack does not primarily mean multiplying the external input. It refers to the fact that multiplication is the dominant leakage site, the implementation choice that modulates leakage, or the arithmetic primitive that the attacker reverse-engineers from a single trace.

7. Cross-domain properties, misconceptions, and significance

A common misconception is that multiplicative attack is simply additive attack expressed in another coordinate system. The literature reviewed here does not support that simplification. In robotic control, perfect undetectability depends on an exact matrix identity, an initial-state alignment constraint, and zero additive attack on the command channel; the attack succeeds because the controller’s observed dynamics are preserved, not because the disturbance is merely “small” (Ueda et al., 2024). In MultAV, the adversary is governed by a ratio bound rather than a conventional additive norm, and the perturbation is explicitly signal-dependent (Lo et al., 2020). In xAT/xVAT, the attack law is sparse adversarial masking rather than additive displacement in input space (Yang et al., 2019).

Another misconception is that multiplicative methods are uniformly offensive. In 5G NR, the multiplicative signal is a neutralization mechanism applied by the receiver after detecting attacked subcarriers, and its effectiveness is stated to be independent of jammer power (Kazemian, 2024). In CPS watermarking, multiplicative filters are part of the defense, while the attack is a matched covert strategy that learns or exploits the watermark parameters (Gallo et al., 26 Feb 2025). In power-system resilience, multiplicativity is the structure of the degradation model rather than the adversarial injection law (Romero et al., 23 Apr 2026).

A further misconception is that changing the multiplication formula alone secures cryptographic hardware. The ECC studies explicitly reject that conclusion: multiplication formulae influence leakage, the classical formula may be the most resistant among the tested designs, and randomization of partial-product order helps, but multiplication-formula selection by itself is not sufficient as a countermeasure (Kabin et al., 2022, Kabin et al., 2022).

The broader significance of multiplicative attack research is therefore methodological as much as operational. Across the surveyed domains, multiplicativity is used when the adversary aims to preserve a nominal view while altering physical reality, to create signal-dependent perturbations that evade additive defenses, to exploit the dominant arithmetic kernel of a cryptosystem, or to quantify cross-domain amplification under simultaneous attack. This suggests that multiplicative attack is best treated as a structural category of adversarial action, characterized by product-based coupling, scaling, or invertible transformation, rather than by any single application domain or detection paradigm.