Embodiments described herein provide a design architecture for co-designing a controller and a watermarking signal for a cyber-physical system. During operation, the architecture can determine, in conjunction with each other, respective values of a first set of parameters indicating operations of the controller and a second set of parameters representing the watermarking signal. Here, the watermarking signal is combinable with a control signal from the controller for monitoring an output signal of the cyber-physical system for detecting malicious data at different time instances. Subsequently, the architecture can determine a state manager for determining the states of the cyber-physical system from the monitored output signal based on the first and second sets of parameters. The architecture can also determine a detector capable of identifying presence of an attack from the states of the cyber-physical system at a plurality of time instances using the watermarking signal.