# Poisoning Attacks on Cyber Attack Detectors for Industrial Control Systems

arXiv: https://arxiv.org/abs/2012.15740 · HTML: https://mlsanity.com/paper/2012.15740/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Dec 2020.

## Built on by (most cited first, 8 of 8)

- [Analysis of Label-Flip Poisoning Attack on Machine Learning Based Malware Detector](https://mlsanity.com/paper/2301.01044/) (2023)
- [Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems](https://mlsanity.com/paper/2105.10707/) (2021)
- [Evaluating the Cybersecurity Risk of Real World, Machine Learning Production Systems](https://mlsanity.com/paper/2107.01806/) (2021)
- [Attack Rules: An Adversarial Approach to Generate Attacks for Industrial Control Systems using Machine Learning](https://mlsanity.com/paper/2107.05127/) (2021)
- [Adversarial Machine Learning Threat Analysis and Remediation in Open Radio Access Network (O-RAN)](https://mlsanity.com/paper/2201.06093/) (2022)
- [Adversarial Sample Generation for Anomaly Detection in Industrial Control Systems](https://mlsanity.com/paper/2505.03120/) (2025)
- [Attack Pattern Mining to Discover Hidden Threats to Industrial Control Systems](https://mlsanity.com/paper/2508.04561/) (2025)
- [Robustness of Anomaly Detection Models for Industrial Control Systems under Training-Time Data Contamination](https://mlsanity.com/paper/2608.23547/) (2026)

## Abstract (arXiv)

Recently, neural network (NN)-based methods, including autoencoders, have been proposed for the detection of cyber attacks targeting industrial control systems (ICSs). Such detectors are often retrained, using data collected during system operation, to cope with the natural evolution (i.e., concept drift) of the monitored signals. However, by exploiting this mechanism, an attacker can fake the signals provided by corrupted sensors at training time and poison the learning process of the detector such that cyber attacks go undetected at test time. With this research, we are the first to demonstrate such poisoning attacks on ICS cyber attack online NN detectors. We propose two distinct attack algorithms, namely, interpolation- and back-gradient based poisoning, and demonstrate their effectiveness on both synthetic and real-world ICS data. We also discuss and analyze some potential mitigation strategies.