Adversarial Sensor Errors for Safe and Robust Wind Turbine Fleet Control

Problem Setup

A protagonist (yaw controller) and adversary (sensor corruptor) interact in a two-turbine wind farm simulated with the Dynamic Wake Meandering model. The adversary observes true state and injects bounded, time-varying measurement biases into wind speed, direction, yaw, and power channels. The protagonist observes only the corrupted signals. The adversary's reward is the negative of the protagonist's, making this a zero-sum game.

Critically, the adversary's perturbations are temporally correlated—it learns to time sensor drift to exploit wake advection delays, coordinating multi-channel attacks that procedural noise cannot produce. The research question: does training through interaction with an adversary agent yield greater protagonist robustness than training with procedurally generated noise?

Three Co-Training Paradigms

Co-training a controller and adversary risks catastrophic forgetting: each generation overfits to its current opponent and loses performance on prior threats or clean conditions. We compare three approaches to managing this instability.

Training Dynamics

Each method was run for 10 iterations of 250k timesteps. The summary plots below compare six metrics across training iterations: protagonist vs. its own adversary (diagonal of the gauntlet matrix), clean-environment performance, mean robustness across all adversaries, and the corresponding adversary-side metrics.

Key observations from these curves:

• Self-Play converges to a state where the adversary dominates—the protagonist never recovers meaningful positive reward.
• SSP yields the highest clean-environment performance for most iterations but catastrophically forgets clean operation after iteration 8.
• Arms Race shows a pronounced forgetting dip at iteration 4, then re-learns robust behaviors in subsequent iterations. The final protagonist achieves the highest mean robustness across all adversary types.
• The Arms Race and SSP adversaries suffer from their own forgetting, drifting to states that do not confound the PyWake expert agent as severely as Self-Play adversaries do.

Arms Race Gauntlet

The evaluation matrix shows mean power gain for each protagonist (row) against each adversary and baseline condition (column), averaged over five standardized inflow episodes. Forgetting is visible at iterations 6 and 9, where protagonists lose performance in clean/procedural conditions. The PyWake expert excels in clean conditions but is confounded by most trained adversaries.

Cross-Method Evaluation

The strongest protagonist from each method (selected by maximum mean performance across all adversaries) is pitted against the strongest adversary from each method, plus procedural noise and clean conditions. This is the definitive comparison.

Failure vs. Robustness Under Attack

To understand what robustness looks like in practice, we compare the procedurally-trained controller and the Arms Race controller under identical attack (Self-Play Adversary #6). The adversary spoofs the downstream turbine's power sensor to read zero, confounding the procedural controller into extreme yaw commands. The Arms Race controller maintains stable operation under the same corruption.

Left columns: upstream turbine. Right columns: downstream turbine. Red dashed: true value. Black solid: sensed (corrupted). Grey bands: maximum allowable error. Rows: wind direction, wind speed, power, yaw.

Discussion

The Arms Race paradigm produces the most robust protagonist and the most formidable adversary in cross-method evaluation. This is somewhat counterintuitive—sequential replacement (discarding prior opponents) outperforms the zoo-based approach that was designed to mitigate forgetting. The likely explanation: the Arms Race creates escalating pressure that forces genuine robustness, while SSP dilutes the curriculum with weak early adversaries.

Limitations. These results are from a single training seed on a two-turbine farm with laminar inflow. There is substantial seed-to-seed variability in RL training, and the relative method rankings may shift with different random seeds or at larger scale. The two-turbine case was chosen to make systematic comparison across three paradigms tractable; scaling to realistic farm sizes is future work. Additionally, the absence of turbulence simplifies the problem—real-world robustness may require additional domain randomization.

Connection to broader adversarial robustness. The dynamics here parallel findings in LLM red-teaming: adversarial training discovers failure modes that random perturbation misses, catastrophic forgetting degrades capability during hardening, and the choice of co-training paradigm determines whether the system actually gets more robust or just more brittle. The Arms Race controller's ability to recover from forgetting suggests iterative hardening can work—if the training schedule is long enough.

Technical Details