# Attack Detection using Time Series Foundation Models

arXiv: https://arxiv.org/abs/2606.06347 · HTML: https://mlsanity.com/paper/2606.06347/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 5 of its 16 references that are in the map.
- First posted on arXiv 4 Jun 2026.

## Builds on (most cited first, 5 of 5)

- [A decoder-only foundation model for time-series forecasting](https://mlsanity.com/paper/2310.10688/) (2023)
- [Detecting Cyberattacks in Industrial Control Systems Using Convolutional Neural Networks](https://mlsanity.com/paper/1806.08110/) (2018)
- [Attack-Resilient H2, H-infinity, and L1 State Estimator](https://mlsanity.com/paper/1803.07053/) (2018)
- [Data-Driven Attack Detection for Linear Systems](https://mlsanity.com/paper/2003.07949/) (2020)
- [Experimental evaluation of sensor attacks and defense mechanisms in feedback systems](https://mlsanity.com/paper/2111.03407/) (2021)

## Abstract (arXiv)

This paper addresses the problem of attack detection in cyber-physical systems without any knowledge of the plant model or its structure. A remotely located plant transmits sensor measurements to an operator over a network that is assumed to be under attack. We consider two classes of attacks: model-free replay attacks and model-based stealthy attacks. For the latter, we derive closed-form expressions for the optimal stealthy attack policy against a chi2 detector, for both linear and nonlinear systems. We then propose a model-structure-free detector based on TimesFM, a time-series foundation model developed by Google Research, which serves as a surrogate residual generator operating in a zero-shot fashion. We show empirically that the TimesFM-based detector achieves a comparable or superior attack detection performance. The efficacy of the proposed approach is demonstrated numerically on the IEEE 14-bus power system. We also demonstrate that TimesFM predictions can serve as a substitute for corrupted measurements, a practical mitigation technique when classical redundancy assumptions fail.