AI in Orbit: Why Satellite Cybersecurity Must Protect the Decision Layer

AI Is Moving Onboard

Artificial intelligence is gradually becoming part of spacecraft operations. CubeSats increasingly use machine learning for telemetry monitoring, anomaly detection, system-health assessment, and autonomous decision support. This is especially valuable in low-Earth orbit, where contact with ground stations is intermittent and satellites may need to respond without immediate human intervention.

But moving AI onboard also changes the cybersecurity problem. Traditional satellite security mainly focuses on communication links, command and control, ground infrastructure, software vulnerabilities, and access control. Machine-learning systems introduce another type of exposure: an attacker may manipulate the behavior of the model without compromising the software itself.

This is the domain of adversarial machine learning. In our recent research, we examined four major attack classes affecting onboard telemetry anomaly detection: poisoning, evasion, inference, and model extraction. These attacks can target different stages of the machine-learning lifecycle, from the data used to train the model to the outputs exposed during operation.

For spacecraft, this matters because anomaly detection is not simply an analytical tool. Its outputs may influence alerts, operational reconfiguration, or safe-mode decisions. The machine-learning system therefore becomes part of the spacecraft's operational security boundary.

A Layered Defense

Space systems cannot depend on frequent retraining or heavy model-level defenses. CubeSats operate with limited power, processing capacity, memory, and communication opportunities.

The defense is therefore distributed across the ground and onboard segments. Training, validation, calibration, and protection against poisoning remain on the ground, while the onboard anomaly detector continues to perform its original monitoring role.

Additional controls then protect the onboard decision process through output limitation, query control, temporal voting, hysteresis, and recovery logic.

The objective is to secure the full telemetry-to-decision chain, rather than relying on the model alone.

Reduce What the Attacker Sees

One of the simplest cybersecurity principles is also highly relevant to machine learning: do not expose more information than necessary.

If an anomaly detector continuously exposes detailed numerical scores, an attacker may observe its responses and gradually learn how the system behaves. That information can support inference attacks, where the attacker tries to understand internal thresholds or operational characteristics. It can also support model extraction, where repeated input-output observations are used to approximate the deployed detector.

The defensive interface reduces this exposure. Instead of relying on a rich continuous output, it limits observable information and combines output coarsening, controlled randomization, query limits, temporal voting, hysteresis, and recovery logic.

The objective is not to make the detector invisible. It is to make interaction with the detector less useful to an adversary.

The same mechanisms also increase the difficulty of evasion attacks. In a conventional detector, an attacker may repeatedly modify telemetry inputs and observe the result until an anomaly falls below the detection threshold. With a hardened interface, the attacker no longer receives the same clean feedback after every attempt. Query interaction is restricted, decisions are coupled across time, and temporary changes do not necessarily produce immediate state transitions.

Results Under Space Constraints

The framework was evaluated using real spacecraft telemetry and multiple anomaly-detection approaches. The experiments considered adversarial threats across the machine-learning lifecycle and compared conventional detector interfaces with the hardened decision architecture.

Under the evaluated configurations, the defensive interface reduced membership-inference performance toward random behavior and prevented successful blind evasion. In the multichannel experiment, membership-inference advantage dropped from approximately 0.09 to 0.01, while blind-evasion success fell from around 0.30 to 0.

But algorithmic performance is only part of the problem. A space cybersecurity mechanism must also be practical enough to run onboard.

For this reason, the architecture was implemented on a Xilinx Zynq-7020 FPGA-based CubeSat engineering platform. The engineering model used for the evaluation is functionally equivalent to the flight model for the relevant onboard implementation.

This hardware platform supports deterministic execution, explicit state management, and temporal control, all of which matter when defensive behavior depends on persistence, voting, and hysteresis across consecutive telemetry windows. The result is an approach designed not only to resist adversarial interaction, but also to respect CubeSat operational constraints.

From Model Security to Mission Security

The broader lesson goes beyond one implementation. As spacecraft become more autonomous, cybersecurity must expand from protecting software and communication links to protecting decision processes.

An onboard AI system should not be evaluated only by asking whether its predictions are accurate. Security engineers should also ask what information the system exposes, how often it can be queried, whether an attacker can learn its thresholds, how repeated interaction can influence behavior, and how the system recovers after temporary misclassification.

These questions move cybersecurity from the model level to the system level.

There are still limitations. Publicly available spacecraft telemetry remains limited in scale and diversity, and more sophisticated gradient-free and sequence-level adversarial strategies remain important directions for further evaluation. Ongoing work is therefore moving toward broader validation using operational CubeSat telemetry and more realistic mission conditions.

The next step for space AI security is not simply to design increasingly complex models. It is to build architectures in which AI components operate inside controlled, verifiable, and attack-aware decision environments.

Conclusion

As AI gains authority onboard spacecraft, satellite cybersecurity must protect the full telemetry-to-decision chain — not only the machine-learning model itself.