# AttackLLM: LLM-based Attack Pattern Generation for an Industrial Control System

arXiv: https://arxiv.org/abs/2504.04187 · HTML: https://mlsanity.com/paper/2504.04187/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 27 references that are in the map.
- First posted on arXiv 5 Apr 2025.

## Builds on (most cited first, 6 of 6)

- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [LLaMA: Open and Efficient Foundation Language Models](https://mlsanity.com/paper/2302.13971/) (2023)
- [The Rise and Potential of Large Language Model Based Agents: A Survey](https://mlsanity.com/paper/2309.07864/) (2023)
- [Attack Rules: An Adversarial Approach to Generate Attacks for Industrial Control Systems using Machine Learning](https://mlsanity.com/paper/2107.05127/) (2021)
- [Scanning the Cycle: Timing-based Authentication on PLCs](https://mlsanity.com/paper/2102.08985/) (2021)
- [Architectural Selection Framework for Synthetic Network Traffic: Quantifying the Fidelity-Utility Trade-off](https://mlsanity.com/paper/2410.16326/) (2024)

## Built on by (most cited first, 4 of 4)

- [CritBench: A Framework for Evaluating Cybersecurity Capabilities of Large Language Models in IEC 61850 Digital Substation Environments](https://mlsanity.com/paper/2604.06019/) (2026)
- [Attack Pattern Mining to Discover Hidden Threats to Industrial Control Systems](https://mlsanity.com/paper/2508.04561/) (2025)
- [PLCBench: Can Autonomous LLM Agents Turn PLC Access into Sustained Physical Impact?](https://mlsanity.com/paper/2608.26882/) (2026)
- [Large Language Models in the Loop: A Stability- and Network-Aware Survey in Networked Control, Cyber-Physical, and Multi-Agent Systems](https://mlsanity.com/paper/2609.16599/) (2026)

## Abstract (arXiv)

Malicious examples are crucial for evaluating the robustness of machine learning algorithms under attack, particularly in Industrial Control Systems (ICS). However, collecting normal and attack data in ICS environments is challenging due to the scarcity of testbeds and the high cost of human expertise. Existing datasets are often limited by the domain expertise of practitioners, making the process costly and inefficient. The lack of comprehensive attack pattern data poses a significant problem for developing robust anomaly detection methods. In this paper, we propose a novel approach that combines data-centric and design-centric methodologies to generate attack patterns using large language models (LLMs). Our results demonstrate that the attack patterns generated by LLMs not only surpass the quality and quantity of those created by human experts but also offer a scalable solution that does not rely on expensive testbeds or pre-existing attack examples. This multi-agent based approach presents a promising avenue for enhancing the security and resilience of ICS environments.