# Transformer is All You Need: Attention-Based Anomaly Detection and Classification in Inverter-Rich Power Systems

arXiv: https://arxiv.org/abs/2607.13537 · HTML: https://mlsanity.com/paper/2607.13537/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Jul 2026.

## Built on by (most cited first, 2 of 2)

- [A Standardized Framework for Machine Learning in Power System Protection](https://mlsanity.com/paper/2608.20181/) (2026)
- [One-Cycle Fault Classification and Faulted-Line Identification on the PROTECT-90 Dataset: An Initial Application Benchmark](https://mlsanity.com/paper/2610.04155/) (2026)

## Abstract (arXiv)

Inverter-based resources and IEC 61850 process-bus measurements introduce new protection challenges, including nontraditional fault behavior and measurement-domain cyber-physical attacks. This paper evaluates DL-Xformer, an attention-based Transformer classifier for multi-class fault and cyberattack diagnosis, side-by-side with Dynamic State Estimation-Based Protection (DSE-EBP) on identical high-fidelity electromagnetic-transient (EMT) streaming measurements from an IBR-rich power grid. The evaluation uses an 18-class taxonomy covering normal operation, 11 physical faults, and six measurement-domain attacks, including CT/PT ratio manipulation and GPS spoofing, sampled at 4.8 kHz from synchronized upstream and downstream merging units. DSE-EBP detects all streaming anomalies in 0.417-1.660 ms, with a mean detection time of 0.756 ms, while DL-Xformer classifies the same events in 2.50-50.42 ms, with a mean classification time of 13.46 ms. The longest delay occurs in a deliberate stress case where a CT ratio attack is introduced while residual oscillations from a preceding DLG fault have not fully settled; the event-window accuracy drops to 76.1 %, but the stable final classification remains correct. Measurement-level feature attribution shows that the DL-Xformer decision is driven by physically meaningful current and voltage channels at the attacked measurement location. Together, the two methods motivate a layered protection architecture for next-generation inverter-dominated smart grids.