# Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

arXiv: https://arxiv.org/abs/2105.10707 · HTML: https://mlsanity.com/paper/2105.10707/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 30 of its 80 references that are in the map.
- First posted on arXiv 22 May 2021.

## Builds on (most cited first, 30 of 30)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [Adversarial Attacks on Neural Network Policies](https://mlsanity.com/paper/1702.02284/) (2017)
- [Audio Adversarial Examples: Targeted Attacks on Speech-to-Text](https://mlsanity.com/paper/1801.01944/) (2018)
- [Crafting Adversarial Input Sequences for Recurrent Neural Networks](https://mlsanity.com/paper/1604.08275/) (2016)
- [Multivariate Industrial Time Series with Cyber-Attack Simulation: Fault Detection Using an LSTM-based Predictive Data Model](https://mlsanity.com/paper/1612.06676/) (2016)
- [Crafting Adversarial Examples For Speech Paralinguistics Applications](https://mlsanity.com/paper/1711.03280/) (2017)
- [Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities](https://mlsanity.com/paper/2003.13213/) (2020)
- [Detecting Cyberattacks in Industrial Control Systems Using Convolutional Neural Networks](https://mlsanity.com/paper/1806.08110/) (2018)
- [Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning](https://mlsanity.com/paper/1709.05342/) (2017)
- [Advbox: a toolbox to generate adversarial examples that fool neural networks](https://mlsanity.com/paper/2001.05574/) (2020)
- [Threat analysis of IoT networks Using Artificial Neural Network Intrusion Detection System](https://mlsanity.com/paper/1704.02286/) (2017)
- [Poisoning Attacks on Cyber Attack Detectors for Industrial Control Systems](https://mlsanity.com/paper/2012.15740/) (2020)
- [RNN-based Early Cyber-Attack Detection for the Tennessee Eastman Process](https://mlsanity.com/paper/1709.02232/) (2017)
- [Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System](https://mlsanity.com/paper/1801.00903/) (2018)
- [Adversarial Attacks on Cognitive Self-Organizing Networks: The Challenge and the Way Forward](https://mlsanity.com/paper/1810.07242/) (2018)
- [Anomaly Detection for Water Treatment System based on Neural Network with Automatic Architecture Optimization](https://mlsanity.com/paper/1807.07282/) (2018)
- [Log-based Anomaly Detection of CPS Using a Statistical Method](https://mlsanity.com/paper/1701.03249/) (2017)
- [A Deep Learning-based Framework for Conducting Stealthy Attacks in Industrial Control Systems](https://mlsanity.com/paper/1709.06397/) (2017)
- [Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences](https://mlsanity.com/paper/1909.05410/) (2019)
- [Towards Learning and Verifying Invariants of Cyber-Physical Systems by Code Mutation](https://mlsanity.com/paper/1609.01491/) (2016)
- [Active Fuzzing for Testing and Securing Cyber-Physical Systems](https://mlsanity.com/paper/2005.14124/) (2020)
- [No Need to Know Physics: Resilience of Process-based Model-free Anomaly Detection for Industrial Control Systems](https://mlsanity.com/paper/2012.03586/) (2020)
- [Assessing the Effectiveness of Attack Detection at a Hackfest on Industrial Control Systems](https://mlsanity.com/paper/1809.04786/) (2018)
- [NoiSense: Detecting Data Integrity Attacks on Sensor Measurements using Hardware based Fingerprints](https://mlsanity.com/paper/1712.01598/) (2017)
- [Toward `verifying' a Water Treatment System](https://mlsanity.com/paper/1712.04155/) (2017)
- [Towards Systematically Deriving Defence Mechanisms from Functional Requirements of Cyber-Physical Systems](https://mlsanity.com/paper/2007.03651/) (2020)
- [LSTM for Model-Based Anomaly Detection in Cyber-Physical Systems](https://mlsanity.com/paper/2010.15680/) (2020)

## Built on by (most cited first, 6 of 6)

- [Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations](https://mlsanity.com/paper/2202.11917/) (2022)
- [Attack Rules: An Adversarial Approach to Generate Attacks for Industrial Control Systems using Machine Learning](https://mlsanity.com/paper/2107.05127/) (2021)
- [Robustness Testing of Data and Knowledge Driven Anomaly Detection in Cyber-Physical Systems](https://mlsanity.com/paper/2204.09183/) (2022)
- [Code Integrity Attestation for PLCs using Black Box Neural Network Predictions](https://mlsanity.com/paper/2106.07851/) (2021)
- [Attack Pattern Mining to Discover Hidden Threats to Industrial Control Systems](https://mlsanity.com/paper/2508.04561/) (2025)
- [Towards a Resilience-Theoretic Foundation for Adversarial Robustness in Industrial Control System Anomaly Detection](https://mlsanity.com/paper/2609.07244/) (2026)

## Abstract (arXiv)

The threats faced by cyber-physical systems (CPSs) in critical infrastructure have motivated research into a multitude of attack detection mechanisms, including anomaly detectors based on neural network models. The effectiveness of anomaly detectors can be assessed by subjecting them to test suites of attacks, but less consideration has been given to adversarial attackers that craft noise specifically designed to deceive them. While successfully applied in domains such as images and audio, adversarial attacks are much harder to implement in CPSs due to the presence of other built-in defence mechanisms such as rule checkers(or invariant checkers). In this work, we present an adversarial attack that simultaneously evades the anomaly detectors and rule checkers of a CPS. Inspired by existing gradient-based approaches, our adversarial attack crafts noise over the sensor and actuator values, then uses a genetic algorithm to optimise the latter, ensuring that the neural network and the rule checking system are both deceived.We implemented our approach for two real-world critical infrastructure testbeds, successfully reducing the classification accuracy of their detectors by over 50% on average, while simultaneously avoiding detection by rule checkers. Finally, we explore whether these attacks can be mitigated by training the detectors on adversarial samples.