# Ti-iLSTM: A TinyDL Approach for Logic-Level Anomaly Detection in Industrial Water Treatment Systems

arXiv: https://arxiv.org/abs/2605.15874 · HTML: https://mlsanity.com/paper/2605.15874/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 44 references that are in the map.
- First posted on arXiv 15 May 2026.

## Builds on (most cited first, 6 of 6)

- [Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning](https://mlsanity.com/paper/1709.05342/) (2017)
- [pCAMP: Performance Comparison of Machine Learning Packages on the Edges](https://mlsanity.com/paper/1906.01878/) (2019)
- [A Continual and Incremental Learning Approach for TinyML On-device Training Using Dataset Distillation and Model Size Adaption](https://mlsanity.com/paper/2409.07114/) (2024)
- [Causal Digital Twins for Cyber-Physical Security: A Framework for Robust Anomaly Detection in Industrial Control Systems](https://mlsanity.com/paper/2510.09616/) (2025)
- [Cloud-Edge Collaborative Data Anomaly Detection in Industrial Sensor Networks](https://mlsanity.com/paper/2204.09942/) (2022)
- [Improving SIEM for Critical SCADA Water Infrastructures Using Machine Learning](https://mlsanity.com/paper/1904.05724/) (2019)

## Abstract (arXiv)

Industrial Water Treatment Systems (IWTS) are safety critical cyber-physical infrastructures and due to increased connectivity, these systems are exposed to cyber threats that can manipulate process behaviour without creating obvious devices outliers. In particular, logic-layer deception anomalies can preserve numerically plausible measurements while breaking expected cause-and-effect relationships in the control process. These attacks are difficult to detect using threshold-based monitoring or require heavy server-oriented anomaly detection models. This paper explores the potential of Tiny Deep Learning (TinyDL) to provide lightweight on-device logic-level anomaly detection for resource constrained Programmable Logic Controllers (PLCs). We propose a novel framework, TinyDL-based incremental LSTM (Ti-iLSTM) which optimises the memory and space foot print of Long Short-Term Memory (LSTM), to detect logic-layer inconsistencies in Programmable Logic Controller (PLC) based Industrial Water Treatment Systems (IWTS). Experiments on the publicly available SWaT dataset show that the optimised model achieves high detection performance (F1-score=0.983 and ROC-AUC=0.998). A deployment-style validation on the WADI dataset confirms that the proposed light-weight framework remains applicable beyond a single dataset. The research demonstrates that combining logic-aware supervision with Tiny Deep Learning (TinyDL) sequence learning creates an efficient and accurate anomaly detection suitable for resource constrained Programmable Logic Controllers (PLCs) in industrial environments.