In this paper, we address the problem of constructing a robust stealthy attack that compromises uncertain cyber-physical systems having unstable zeros. We first interpret the (non-robust) conventional zero-dynamics attack based on Byrnes-Isidori normal form, and then present a new robust zero-dynamics attack for uncertain plants. Different from the conventional strategy, our key idea is to isolate the real zero-dynamics from the plants input-output relation and to replace it with an auxiliary nominal zero-dynamics. As a result, this alternative attack does not require the exact model knowledge anymore. The price to pay for the robustness is to utilize the input and output signals of the system (i.e., disclosure resources). It is shown that a disturbance observer can be employed to realize the new attack philosophy when there is a lack of model knowledge. Simulation results with a hydro-turbine power system are presented to verify the attack performance and robustness.
