Defense, security, and critical infrastructure (perimeter sensing, spoofing, triage, ethics)

"A perimeter alarm that cries wolf every night is not a security system. It is an expensive machine for teaching the guards to ignore wolves."

An Unblinking AI Agent

This section assumes you can already build the perception primitives it composes: anomaly and change detection (Chapter 12), radar and RF sensing (Chapter 44 and Chapter 47), thermal imaging (Chapter 45), and cyber-physical anomaly detection for industrial control systems (Chapter 38). Here we assemble them into an adversary-aware system and govern its use.

The perimeter as a layered sensor network

A perimeter intrusion detection system (PIDS) is the canonical security-sensing problem: draw a virtual boundary and decide, continuously, whether something has crossed it that should not have. No single modality is adequate, because every modality has a blind spot an intruder can exploit. Fence-mounted accelerometers and fiber-optic distributed acoustic sensing (DAS) hear a climber or a cut but are provoked by wind and rain. Passive infrared and thermal cameras (Chapter 45) see a warm body in the dark but are defeated by fog and thermal decoys. Ground-based radar tracks movement across an open approach but struggles with clutter and grazing angles. Buried seismic and pressure cables catch a footfall but not a low-and-slow crawl.

The design response is defense in depth: overlapping layers chosen so that the failure mode of one is covered by the strength of another, arranged as concentric detection, assessment, and delay zones. The system-level goal is a high probability of detection \(P_D\) at a tolerable nuisance alarm rate. A useful way to reason about a single sensor is its operating point on a detection-error tradeoff, where lowering the alarm threshold \(\tau\) raises \(P_D\) but also raises the false-alarm rate. For a layered system that fires only when \(k\) of \(n\) independent layers concur within a short spatial-temporal window, the combined nuisance rate falls sharply because uncorrelated nuisances rarely coincide, while a real intrusion trips several layers at once. If layer \(i\) has independent nuisance probability \(p_i\) per window, the probability that at least two of three fire together is $$P_{\text{2-of-3}} = \sum_{S:\,|S|\ge 2}\ \prod_{i\in S} p_i \prod_{j\notin S}(1-p_j),$$ which for small \(p_i\) is dominated by the pairwise products and is therefore orders of magnitude below any single \(p_i\). This is the same fusion logic developed in Chapter 48, applied with an adversary in mind.

Alarm triage: turning a firehose into a queue a human can clear

Triage is the layer between raw detections and the operator. Its job is to suppress, correlate, and rank so that what reaches a human is a short, prioritized queue of assessable events rather than a stream of blips. Three mechanisms do most of the work. Spatio-temporal correlation groups detections from different layers that share a location and time into a single candidate event, so a climber tripping the fence sensor, the thermal camera, and the radar becomes one high-confidence alarm rather than three. Contextual gating suppresses detections explained by benign covariates: a wind gust logged by the anemometer, a scheduled patrol, a known animal corridor. Calibrated ranking attaches a trustworthy confidence to each event so the operator works the queue top-down.

Calibration matters more here than almost anywhere in the book. An operator who learns that "confidence 0.9" alarms are real nine times in ten will triage efficiently; one fed miscalibrated scores learns to distrust all of them. Conformal prediction (Chapter 18) is well suited to this: it can attach a distribution-free guarantee that an event flagged "confirmed intrusion" carries a bounded error rate, which is exactly the contract an assessment operator needs. The confirmation logic below implements the \(k\)-of-\(n\) correlation window that anchors a triage pipeline.

from collections import deque

def confirm_intrusion(detections, k=2, window_s=3.0, radius_m=15.0):
    """Confirm an alarm only when >= k independent sensor layers fire
    within window_s seconds and radius_m metres of each other."""
    buf = deque()                      # recent (t, x, y, layer) detections
    confirmed = []
    for t, x, y, layer in sorted(detections):
        while buf and t - buf[0][0] > window_s:
            buf.popleft()              # drop stale detections
        near = [d for d in buf if (d[1]-x)**2 + (d[2]-y)**2 <= radius_m**2]
        layers = {d[3] for d in near} | {layer}
        if len(layers) >= k:
            confirmed.append((t, x, y, sorted(layers)))
        buf.append((t, x, y, layer))
    return confirmed

raw = [(0.0, 100, 50, "fence"), (0.4, 102, 51, "thermal"),
       (1.9, 300, 10, "radar"),                      # lone radar blip -> nuisance
       (2.1, 101, 49, "radar")]                      # concurs with fence+thermal
for t, x, y, layers in confirm_intrusion(raw):
    print(f"t={t:.1f}s @({x},{y}) confirmed by {layers}")

Code 71.6.1 is deliberately simple because the correlation gate is where most of the nuisance-rate reduction actually comes from; the fancy classifier on each layer matters far less than whether independent layers are forced to agree. Remember the leakage discipline of Chapter 5 when you evaluate such a pipeline: split by site and by time, never by shuffled window, or your reported nuisance rate will be a fantasy.

Spoofing, jamming, and the adaptive adversary

The defining difference between security sensing and every prior domain is that the environment fights back. An intruder can spoof (feed the sensor a false but plausible signal), jam (deny the sensor by drowning it in noise), or evade (exploit a known blind spot). GNSS spoofing feeds a drone or a patrol vehicle counterfeit satellite signals to shift its perceived position (the positioning stack of Chapter 25). Replay attacks record a benign sensor trace and play it back to mask a real event, a threat that is acute for industrial control systems (Chapter 38), where a falsified pressure reading can hide sabotage. Thermal decoys, adversarial patches that fool object detectors, and RF jamming all target specific modalities. The full taxonomy and the functional-safety mindset for defending against it live in Chapter 68; here we note the security-specific reflexes.

Two reflexes recur. The first is cross-modal consistency: a signal that is trivial to forge in one channel is hard to forge consistently across independent physics. A GNSS spoof that teleports a vehicle is contradicted by the inertial measurement unit (Chapter 23), whose dead-reckoned path cannot match the jump; a replayed camera loop is betrayed by a radar return that shows real motion. The same fusion that lowers nuisance rate also raises the cost of a successful spoof, because the attacker now has to defeat several modalities in lockstep. The second reflex is liveness and provenance: challenge-response probes, signed sensor timestamps, and physics-consistency checks (does the claimed target have plausible mass, speed, and thermal signature together?) that a replayed or synthesized signal fails.

Dual-use, proportionality, and human accountability

Every capability in this section is dual-use. A crowd-counting radar protects a stadium and can also track individuals; a gunshot-localization acoustic array saves response time and can also record conversations. The proportionality and consent principles from Chapter 70 are not optional garnish in the security domain, they are load-bearing: choose the coarsest modality that meets the security purpose, minimize retention, and make the surveillance-capable surplus unavailable by construction rather than by promise. Critical-infrastructure sensing usually operates under explicit legal and regulatory regimes (utility, aviation, and defense oversight), and export-controlled dual-use technology carries its own compliance obligations.

The non-negotiable design rule is meaningful human control over consequential action. A sensing system may detect, correlate, rank, and recommend; a human authorizes any response that carries physical or legal weight, from dispatching a patrol to anything more serious. The AI's role is to compress a firehose into an assessable, well-calibrated queue and to preserve an audit trail, not to close the loop autonomously on the use of force. Build the system so that every confirmed alarm carries the evidence that justified it and the identity of the human who acted on it; accountability that is not logged at design time cannot be reconstructed after an incident.

What's Next

In Section 71.7, we step back from individual domains and extract the reusable blueprints that recurred across wearables, robotics, vehicles, smart spaces, environment, and security: the sensing-to-modeling-to-evaluation-to-deployment spine, the leakage-safe evaluation habit, the calibration-and-uncertainty thread, and the proportionality-by-architecture pattern you just applied to a perimeter, distilled into templates you can carry into any new sensing problem.