City pedestrian counting systems now feed economic indicators, planning decisions and safety operations, yet most digital twins treat the incoming counts as ground truth. This work investigates the consequences when the counts are tampered with and formalises stealthy false data injection (FDI) for city‑scale pedestrian sensing. Unlike power and water networks, the mapping from latent pedestrian flow to observations is highly rank‑deficient, making existing stealth analyses inapplicable. Our twin estimates directed flows on a pedestrian street graph, assimilates counts via a learned graph‑localised gain, and is trained against a flow‑conservation residual that couples metered and unmetered segments. Detection combines the innovation with this residual, and the alarm threshold is set by adaptive conformal calibration rather than manual tuning. To quantify the benefit of physics constraints we define the attack margin – the relative reduction in worst‑case corruption of the estimated flow field against a white‑box adversary that optimises directly through the twin. Experiments on six years of Melbourne data show the margin reaches 0.54 for a single compromised device and drops to 0.19 when a third of the fleet is compromised, even though only 1.18% of walkable segments are metered. Replacing the street graph with a distance graph collapses the margin to 0.09, indicating that the conservation law, not locality, provides the main robustness gain.
Review