# Large Language Models for Power System Security: A Novel Multi-Modal Approach for Anomaly Detection in Energy Management Systems

arXiv: https://arxiv.org/abs/2508.10044 · HTML: https://mlsanity.com/paper/2508.10044/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 68 references that are in the map.
- First posted on arXiv 12 Aug 2025.

## Builds on (most cited first, 7 of 7)

- [MOKA: Open-World Robotic Manipulation through Mark-Based Visual Prompting](https://mlsanity.com/paper/2403.03174/) (2024)
- [Leveraging power grid topology in machine learning assisted optimal power flow](https://mlsanity.com/paper/2110.00306/) (2021)
- [ChatGPT and Other Large Language Models for Cybersecurity of Smart Grid Applications](https://mlsanity.com/paper/2311.05462/) (2023)
- [A Unified Industrial Large Knowledge Model Framework in Industry 4.0 and Smart Manufacturing](https://mlsanity.com/paper/2312.14428/) (2023)
- [Advancing Cyber-Attack Detection in Power Systems: A Comparative Study of Machine Learning and Graph Neural Network Approaches](https://mlsanity.com/paper/2411.02248/) (2024)
- [Anomaly Detection Techniques in Smart Grid Systems: A Review](https://mlsanity.com/paper/2306.02473/) (2023)
- [Leveraging Conversational Generative AI for Anomaly Detection in Digital Substations](https://mlsanity.com/paper/2411.16692/) (2024)

## Built on by (most cited first, 1 of 1)

- [Task-Conditional Faithfulness Auditing of Multimodal LLMs for Grid Diagnosis](https://mlsanity.com/paper/2607.24539/) (2026)

## Abstract (arXiv)

This paper elaborates on an extensive security framework specifically designed for energy management systems (EMSs), which effectively tackles the dynamic environment of cybersecurity vulnerabilities and/or system problems (SPs), accomplished through the incorporation of novel methodologies. A comprehensive multi-point attack/error model is initially proposed to systematically identify vulnerabilities throughout the entire EMS data processing pipeline, including post state estimation (SE) stealth attacks, EMS database manipulation, and human-machine interface (HMI) display corruption according to the real-time database (RTDB) storage. This framework acknowledges the interconnected nature of modern attack vectors, which utilize various phases of supervisory control and data acquisition (SCADA) data flow. Then, generative AI (GenAI)-based anomaly detection systems (ADSs) for EMSs are proposed for the first time in the power system domain to handle the scenarios. Further, a set-of-mark generative intelligence (SoM-GI) framework, which leverages multimodal analysis by integrating visual markers with rules considering the GenAI capabilities, is suggested to overcome inherent spatial reasoning limitations. The SoM-GI methodology employs systematic visual indicators to enable accurate interpretation of segmented HMI displays and detect visual anomalies that numerical methods fail to identify. Validation on the IEEE 14-Bus system shows the framework's effectiveness across scenarios, while visual analysis identifies inconsistencies. This integrated approach combines numerical analysis with visual pattern recognition and linguistic rules to protect against cyber threats and system errors.