{"id":"838dac60-1977-41db-a450-80b7144775b3","arxiv_id":"2506.19302","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"FGSM adversarial perturbations on remote measurements can fool ML-based FDIA detectors in differential relays up to 99.7% of the time; adversarial training lowers the fooling rate.","lead":"Deep-learning models used to detect false data injection attacks on power line differential relays can be fooled by small adversarial changes to remote current measurements, and retraining on such attacks partially restores detection. A real-time hardware test backs the timings.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Fooling rate in Eq. (13) omits the LCDR trip condition; the dual-success rate the abstract reports is not actually measured.","rationale":"The reader's CONDITIONAL verdict is appropriate, but for a more immediate reason than simulation representativeness. The paper's novelty claim is the dual objective: a successful attack must bypass the DL classifier and trip the physical relay. The only numeric evidence for this is the fooling rate, Eq. (13), which as written counts only misclassification. The trip condition is part of the threat model and of the attack-generation constraints, but no reported table, figure, or metric independently verifies that the perturbed samples still satisfy (4). Without that check, the empirical rates in the abstract and Section IV are not established. A focused recomputation using the released dataset and the LCDR operating equations would settle this directly. It is likely that many or most perturbed samples still trip, because the original FDIA samples were deep in the trip region and perturbations are bounded; if so, the qualitative conclusion survives and the main fix is reporting. But if a material fraction fails the trip check, the central quantitative claim is overstated. For these reasons I would keep the verdict at CONDITIONAL, not REJECT, while insisting on the trip-aware metric and a corrected Algorithm 2 before acceptance. The reader's emphasis on PSCAD realism is a valid external-validity concern, but it is secondary to verifying that the measured quantity matches the claimed attack objective.","tokens_in":17238,"tokens_out":10847,"duration_ms":116109,"concrete_test":"Recompute the reported fooling rates on the released dataset (https://github.com/AhmadMSGit/Data_Adversarial_DL_LCDRs) using the full dual-success criterion: for every adversarial FDIA candidate x' in D'_test, evaluate the LCDR equations (1)-(4) with the stated settings (i_d0=0.05 kA, i_b=0.585 kA, m1=0.2, m2=0.4) and count a success only if the DLS predicts 'fault' and ||i_1 + i_2'|| ≥ i_op. If the trip-filtered rates differ materially from Figs. 8-10 and Table II (e.g., the MLP rate drops below 90%), the headline claim is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires a dual success criterion: the adversarial FDIA must be misclassified as a fault by the DLS and must actually trigger the LCDR trip condition (4). Section III-B states this criterion, but the quantitative evaluation does not implement it. Eq. (13) defines the fooling rate using only I(y_i ≠ ŷ(x') and ŷ(x') = y_target); there is no term checking ||i_d|| ≥ i_op. Algorithm 2's \"Ensure problem constraints\" step is unspecified, and the pseudocode's while loop returns on the first iteration regardless of N_itr, so the generation process that supposedly enforces trip satisfaction cannot be verified. Since the original FDIA samples were constructed to satisfy (1)-(4), a small FGSM perturbation could move the operating point out of the trip region; if this happened, a misclassified sample would not trip the relay. The abstract's \"bypass ... while also triggering the LCDR to trip\" and the >99.7% success rate therefore rest on an evaluation that is not shown to measure the claimed outcome. The internal inconsistency between the 99.74% MLP attack success rate in Section IV-E2 and the 97.24% poisoned samples in Table II reinforces this concern.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies adversarial false-data injection attacks against deep-learning-based FDIA detectors embedded in line current differential relays. It formulates an FGSM-based attack that perturbs only remote measurements, with a stated dual success criterion of both misclassifying the manipulated sample as a fault and triggering the LCDR trip condition. The authors evaluate four DLS architectures (MLP, CNN, LSTM, ResNet) on a PSCAD-simulated CIGRE microgrid, report high fooling rates, propose adversarial training as a defense, and validate detection latency on a real-time HIL testbed. The central claim is that all evaluated DL-based FDIA detectors are vulnerable to the proposed adversarial FDIAs, with MLP the most vulnerable and ResNet the least.","tokens_in":17508,"tokens_out":5580,"duration_ms":59758,"significance":"If the reported results are reproduced, the paper identifies a practically important vulnerability class: small perturbations to remote current measurements can make DL-based FDIA detectors classify an attack as a fault while the protected line trips. The comparison of four architectures, the public dataset, and the real-time HIL latency validation are concrete strengths. The adversarial-training results are useful as a first robustness check, though their current evaluation is limited to FGSM. The paper's contribution is significant for smart-grid cybersecurity because LCDRs are safety-critical protection devices, and the authors correctly emphasize the dual physical-and-learning success condition that is often missing in adversarial-attack studies on power systems.","major_comments":[{"comment":"The class-label mapping is stated inconsistently: Section II-B says ŷ=0 and ŷ=1 denote a legitimate fault and a malicious FDIA, respectively, while the same paragraph says y=0 and y=1 denote an FDIA and a fault, respectively. Algorithm 3's condition 'if (ŷ(x)=1) and (y=1)' is therefore either vacuous or, under the intended label convention, selects fault samples rather than FDIA samples for adversarial-sample generation. This makes the defense procedure ambiguous and must be corrected before the adversarial-training results can be reproduced.","section":"Section II-B / Algorithm 3"},{"comment":"Equation (13) defines the fooling rate using only model misclassification to the target class; it contains no term checking ||i_d|| ≥ i_op from Eq. (4), despite Section III-B's constraint 3 requiring the dual success criterion and the abstract's claim that the attack also triggers the LCDR to trip. Because an FGSM perturbation can move an initially tripping sample out of the trip region, the reported success rates, including the >99.7% figure, may count samples that would not actually trip the relay. The metric should be revised, or the authors should provide a post-hoc verification that every counted sample satisfies Eq. (4).","section":"Section III-B / Eq. (13)"},{"comment":"Algorithm 2's pseudocode cannot execute as written: the while loop returns in both branches of the inner if on the first iteration, so the loop over N_itr never iterates, and the 'Ensure problem constraints' step is left unspecified without referencing Eq. (4). This makes the attack-generation procedure and the adversarial-training augmentation in Algorithm 3 non-reproducible. The pseudocode should be corrected to iterate properly and to explicitly check the LCDR trip condition.","section":"Section III-B / Algorithm 2"},{"comment":"The threat model is internally inconsistent. Section III-A3 states that the adversary applies FGSM 'in a black-box manner, i.e., without accessing the exact model parameters,' but Eq. (10) requires the loss gradient ∇_x J(θ,x,y) with respect to the model parameters, and Algorithm 2 takes f_θ as input. The authors should clarify whether the attack is white-box or black-box; if black-box, they should describe the surrogate model and report transferability results.","section":"Section III-A3 / Section III-B"},{"comment":"The adversarial-training evaluation is non-adaptive: the defense is trained and tested using only FGSM-generated samples with the same ε values, and no results are reported against PGD, C&W, or adaptive attacks. The paper's conclusion that adversarial training makes models 'robust to adversarial FDIAs' is therefore stronger than the evidence supports; the claim should be scoped to robustness against FGSM-style attacks.","section":"Section VI / Algorithm 3"},{"comment":"The attack-success numbers are not reconciled with each other. Section IV-E2 reports an MLP attack success rate of 99.74%, Table II reports 97.24% poisoned samples for MLP, and Fig. 10 reports FR reaching 97.44% at ε≥0.5 for MLP. These may reflect different definitions, but the paper does not explain the relationship, and all values are single-point estimates with no confidence intervals or multiple-seed variation, which is insufficient for a security claim of this strength.","section":"Section IV-E2 / Table II / Fig. 10"}],"minor_comments":[{"comment":"The equation contains a long ellipsis placeholder ('..............') that should be removed in the final typeset version.","section":"Eq. (13)"},{"comment":"Reference [49] displays 'M ˛ adry' and should be corrected to 'Madry'.","section":"References"},{"comment":"The term 'Poisoned Samples' is ambiguous because it normally refers to training-data poisoning; here it appears to mean the fraction of FDIA samples successfully turned into adversarial samples, and this should be stated explicitly.","section":"Table II"},{"comment":"The list of investigated models begins at item '2) CNNs', so item 1) for the MLP appears to be missing.","section":"Section II-B"},{"comment":"For ResNet, 'successfully detecting 90.2% of adversarial FDIA samples' and Table II's 9.78% poisoned samples are complements, but the text does not state this relation, which initially reads as a contradiction.","section":"Section IV-E2"},{"comment":"The authors note that protocol-specific latency, packet loss, and synchronization errors were not modeled; this limitation should also appear in the conclusion or abstract, since it bounds the real-world applicability of the latency claim.","section":"Section VI-B"}],"recommendation":"major_revision","confidential_remarks":"The paper makes a plausible and potentially important claim about LCDR security, and the HIL validation and public dataset are positive elements. However, the load-bearing evaluation metric does not implement the stated dual success criterion, the attack-generation pseudocode is not executable, and the threat-model statement contradicts itself on white-box versus black-box access. These issues are fixable within the scope of a revision, so I recommend major revision rather than rejection. I would also ask the editor to ensure the authors address the label-mapping inconsistency in Section II-B and the non-adaptive nature of the adversarial-training evaluation in the revised version."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThis is the first paper I've seen that targets DL-based FDIA detection in line current differential relays with adversarial examples, and that alone makes it worth a look. The setup is sensible: FGSM perturbations on remote measurements only, four DL architectures, a simulated CIGRE microgrid, and a defense via adversarial training. The dataset is public and they include a hardware-in-the-loop timing check, which is more than most papers in this area bother with.\n\nThe soft spots are real and they hit the headline claim. The metric in Eq. (13) defines fooling rate using only misclassification to the fault class; the LCDR trip condition (||i_d|| >= i_op) is absent from the formula, even though the text says it's included. The abstract promises 'while also triggering the LCDR to trip' and quotes success rates over 99.7%. As written, the evaluation does not demonstrate the trip condition is satisfied. Algorithm 2's pseudocode returns on the first iteration no matter what, and the 'Ensure problem constraints' step is unspecified, so the generation process that supposedly enforces the physical constraint cannot be verified. There's also a numerical tension: Table II says 97.24% of MLP FDIA samples were successfully poisoned, while Section IV-E2 claims 99.74% attack success; these are different definitions, but the paper doesn't reconcile them. And the threat model contradicts itself: Section III-A3 says FGSM is applied in a black-box manner without model parameters, but the same section gives the attacker full access to architecture, parameters, and training data, and FGSM needs gradients.\n\nThese issues are fixable, but they are not cosmetic, because the paper's main quantitative conclusion is not tied to the dual-success criterion it advertises. The underlying phenomenon is plausible—these detectors are simple classifiers and adversarial examples transfer well—so I don't doubt the qualitative direction. But the specific numbers need to be re-derived with a metric that actually checks the trip condition, and the pseudocode and threat model need to be made consistent.\n\nI'd send this to referees, but I'd ask for major revision rather than acceptance. It's a useful paper for anyone working on smart grid protection and machine learning, and it would make for a good reading group discussion on evaluation pitfalls in adversarial ML. I wouldn't cite the numbers as they stand.\n\nRecommendation: engage with it, but treat the reported success rates with caution.","headline":"Useful first demonstration of adversarial attacks on DL-based FDIA detection in differential relays, but the reported dual-success rates are not actually measured by the paper's metric.","tokens_in":17988,"tokens_out":3710,"would_cite":false,"duration_ms":37201,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adversarial remote-measurement tweaks fool grid relay AI up to 99.7%","keywords":["adversarial attacks","false data injection attacks","line current differential relay","deep learning detection","Fast Gradient Sign Method","adversarial training","smart grid security"],"falsifier":"A concrete test is to replay the reported attacks on a hardware-in-the-loop differential relay using real sampled-value packets (IEC 61850 SV) with communication latency and measurement noise typical of field deployments, and measure the fooling rate under the same $\\epsilon=0.5$ and five-iteration budget. If the fooling rates fall substantially below the reported figures—especially the 99.74% MLP figure—the claimed vulnerability is an artifact of the simulated waveforms rather than a property of operational LCDRs.","tokens_in":17037,"feed_emoji":"⚡","tokens_out":8163,"duration_ms":77553,"temperature":0.7,"pith_summary":"Deep-learning-based false data injection detectors in line current differential relays can be defeated by adversarial attacks that modify only the remote current measurements. Using an iterative Fast Gradient Sign Method, the paper crafts samples that the detector misclassifies as legitimate faults while the relay's own trip logic is simultaneously satisfied, causing a false trip. On a simulated medium-voltage microgrid, all four tested models (MLP, CNN, LSTM, ResNet) were vulnerable, with the MLP fooled in more than 99% of adversarial cases and the ResNet the least affected. The paper further shows that adversarial training, in which the attack generator is run on the training set and the successful samples are added as labeled FDIAs, substantially restores detection accuracy without degrading fault detection. The point is that ML-based FDIA detection in differential relays is not robust under an attacker who controls remote measurements, and that a specific defense can measurably improve it.","feed_headline":"Adversarial remote-measurement tweaks fool grid relay AI up to 99.7%","feed_subtitle":"With up to 99.74% success on MLP, deep-learning trip-blocking in differential relays can be silently bypassed.","key_machinery":"The load-bearing object is an iterative FGSM attack specialized to the LCDR setting. Its perturbation is $\\delta_x = \\epsilon \\cdot \\mathrm{sign}(\\nabla_x J(\\theta, x', y)) \\cdot a$, where $a$ is the maximum absolute value of the input sample, only features originating from remote measurements are perturbed, and the updated sample is clipped so that no element leaves the original sample's minimum-maximum range. The iteration accepts an adversarial sample only if the DL model outputs the fault class and the manipulated remote currents satisfy the relay's operating criterion $i_d \\ge i_{op}$, so a successful attack satisfies two independent checks. The defense is adversarial training: the same attack generator is run on the training set, successful adversarial samples are relabeled as FDIAs and added to the training data, and the model is retrained for ten epochs, producing a detector that classifies the adversarial perturbations as attacks.","core_discovery":"The paper's central claim is that an attacker who fully controls the communication link carrying remote current measurements can craft adversarial false-data-injection attacks that evade deep-learning FDIA detection in line current differential relays and cause a false trip. The attack generates perturbations with the Fast Gradient Sign Method, scaling the sign-gradient step by the sample's amplitude, applying it only to remote-measurement features, clipping to the original value range, and iterating until the sample is misclassified as a legitimate fault while the relay's trip condition holds. On a simulated inverter-based microgrid, the fooling rate reaches 99.74% for the MLP detector proposed in prior LCDR work, whereas the ResNet blocks about 90% of the adversarial samples. The paper therefore concludes that the proposed DLS architectures are not robust under this threat model and that adversarial training materially recovers performance.","pith_inferences":["Editorial inference: because the paper evaluates white-box attacks where the adversary knows the model, a natural next test is whether the same fooling rates survive black-box transfer attacks or smaller perturbation budgets; the paper's own sensitivity results suggest the risk is reduced but not eliminated at lower $\\epsilon$.","Editorial inference: since a successful sample must also satisfy the relay's trip condition, defense-in-depth that independently validates the physical plausibility of the trip could break the attack even when the classifier is fooled.","Editorial inference: the paper's fixed observation window, noise range, and single benchmark microgrid imply that retraining on different noise levels, window lengths, or line configurations would test whether adversarial training generalizes beyond the exact dataset used here."],"forward_implications":["The MLP-based FDIA detector proposed in prior LCDR literature should not be deployed against an adversary who can modify remote measurements; its fooling rate under the stated threat model exceeds 99%.","ResNet is the most robust of the four architectures tested, but even it is not immune: 9.78% of adversarial samples evade it, so architecture choice alone does not solve the problem.","Adversarial training recovers most of the detection capability against FGSM-crafted adversarial FDIAs while preserving high fault-detection accuracy, according to the paper's confusion-matrix results.","Attack success increases with perturbation magnitude $\\epsilon$, so an operator that bounds admissible perturbation amplitudes can reduce, but not eliminate, the risk.","The added inference delay (0.755 to 1.37 ms, under 2 ms in real-time simulation) is small next to the relay's 1.5-to-2-cycle operating time, so the defense does not obviously slow protection."],"supporting_citations":[{"why":"Supplies the MLP-based FDIA detection scheme and the integration algorithm (Algorithm 1) that the adversarial attack targets.","marker":"[10]"},{"why":"Introduces the Fast Gradient Sign Method that the paper adapts to generate adversarial FDIA samples.","marker":"[11]"},{"why":"Defines the full communication-channel attacker model that justifies modification of remote measurements while local measurements stay secure.","marker":"[44]"},{"why":"Supplies the benchmark medium-voltage microgrid test system used to simulate faults and FDIAs.","marker":"[50]"},{"why":"Provides the relay operating settings and trip equation used in the simulation, setting the threshold that adversarial samples must satisfy.","marker":"[53]"},{"why":"Supplies the deep-learning model implementations that define the MLP, CNN, LSTM, and ResNet architectures evaluated in the paper.","marker":"[55]"}],"fun_headline_variants":["Adversarial tweaks fool grid relay AI up to 99.7%","Silent FDIA attacks bypass deep-learning relay detection","FGSM attacks trip differential relays through AI blind spots","Adversarial training hardens relay AI against FDIA threats"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole evaluation depends on the electromagnetic transient simulation of the benchmark medium-voltage microgrid, with its specific relay settings, measurement noise, sampling rate, and four-cycle observation window, being representative enough of real line current differential relays that the measured attack success rates and the adversarial-training gains transfer to field conditions.","fun_headline_variants_meta":{"raw":{"variants":["Adversarial tweaks fool grid relay AI up to 99.7%","Silent FDIA attacks bypass deep-learning relay detection","FGSM attacks trip differential relays through AI blind spots","Adversarial training hardens relay AI against FDIA threats"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000384,"raw_usage":{"total_tokens":2042,"prompt_tokens":963,"completion_tokens":1079,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":579,"completion_tokens_details":{"reasoning_tokens":1007}},"tokens_in":579,"tokens_out":1079,"duration_ms":10152,"temperature":1.0,"reasoning_tokens":1007,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T23:07:15.445150+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete test is to replay the reported attacks on a hardware-in-the-loop differential relay using real sampled-value packets (IEC 61850 SV) with communication latency and measurement noise typical of field deployments, and measure the fooling rate under the same $\\epsilon=0.5$ and five-iteration budget. If the fooling rates fall substantially below the reported figures—especially the 99.74% MLP figure—the claimed vulnerability is an artifact of the simulated waveforms rather than a property of operational LCDRs.","supporting_citations":[{"cited_title":"Cyber-immune line current differential relays,","cited_arxiv_id":null,"evidence_quote":"Supplies the MLP-based FDIA detection scheme and the integration algorithm (Algorithm 1) that the adversarial attack targets."},{"cited_title":"On the security of public key protocols,","cited_arxiv_id":null,"evidence_quote":"Defines the full communication-channel attacker model that justifies modification of remote measurements while local measurements stay secure."},{"cited_title":"Design of benchmark of medium voltage distribution network for investigation of dg integration,","cited_arxiv_id":null,"evidence_quote":"Supplies the benchmark medium-voltage microgrid test system used to simulate faults and FDIAs."},{"cited_title":"Development of a cyber- resilient line current differential relay,","cited_arxiv_id":null,"evidence_quote":"Provides the relay operating settings and trip equation used in the simulation, setting the threshold that adversarial samples must satisfy."},{"cited_title":"TSAI - a state-of-the-art deep learning library for time series and sequential data,","cited_arxiv_id":null,"evidence_quote":"Supplies the deep-learning model implementations that define the MLP, CNN, LSTM, and ResNet architectures evaluated in the paper."}],"review_version":1}