# Robustness of Anomaly Detection Models for Industrial Control Systems under Training-Time Data Contamination

arXiv: https://arxiv.org/abs/2608.23547 · HTML: https://mlsanity.com/paper/2608.23547/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 39 references that are in the map.
- First posted on arXiv 24 Aug 2026.

## Builds on (most cited first, 11 of 11)

- [Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks](https://mlsanity.com/paper/1804.00792/) (2018)
- [Certified Defenses for Data Poisoning Attacks](https://mlsanity.com/paper/1706.03691/) (2017)
- [Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization](https://mlsanity.com/paper/1708.08689/) (2017)
- [Towards a Rigorous Evaluation of Time-series Anomaly Detection](https://mlsanity.com/paper/2109.05257/) (2021)
- [Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning](https://mlsanity.com/paper/2205.01992/) (2022)
- [Local Evaluation of Time Series Anomaly Detection Algorithms](https://mlsanity.com/paper/2206.13167/) (2022)
- [Detecting Cyberattacks in Industrial Control Systems Using Convolutional Neural Networks](https://mlsanity.com/paper/1806.08110/) (2018)
- [Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning](https://mlsanity.com/paper/1709.05342/) (2017)
- [Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems](https://mlsanity.com/paper/1911.04278/) (2019)
- [Poisoning Attacks on Cyber Attack Detectors for Industrial Control Systems](https://mlsanity.com/paper/2012.15740/) (2020)
- [Anomaly Detection for Industrial Control Systems Using Sequence-to-Sequence Neural Networks](https://mlsanity.com/paper/1911.04831/) (2019)

## Abstract (arXiv)

Machine-learning-based anomaly detection is increasingly used in industrial control systems (ICS), yet most studies assume that detector training data is trustworthy. In practice, training data may be corrupted through compromised logs, labeling errors, manipulated historian records, or unsafe retraining processes. This paper evaluates the robustness of offline ICS anomaly-detection pipelines on the Secure Water Treatment (SWaT) benchmark under training-time contamination. We assess 11 heterogeneous anomaly detectors under three contamination strategies: random injection, similarity-targeted injection, and feature-noise injection. The first two insert attack samples into the nominal training pool, while the third adds bounded Gaussian noise to selected normal training samples. These attacks are contamination-based rather than gradient-driven poisoning methods. Contamination budgets from 1% to 10% are evaluated using clean validation and test sets under a unified offline protocol. The results show that robustness is strongly model-dependent and cannot be predicted from clean-data performance alone. Injection-based contamination causes the greatest degradation, particularly for local-density and distance-based detectors, whereas feature-noise contamination has a comparatively limited effect. PCA, SVM, HBOS, and IForest remain relatively stable, while the tuned neural detectors demonstrate intermediate robustness. Overall, the findings highlight the importance of training-data integrity in ML-enabled ICS monitoring, subject to the evaluated dataset, models, and threat assumptions.