Filtering Approaches for Dealing with Noise in Anomaly Detection

Eduardo Verdugo German; Jonatan Pena Ramirez; Justin Ruths; Navid Hashemi

REVIEW 3 major objections 5 minor 14 references

Filtering Approaches for Dealing with Noise in Anomaly Detection

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Filtering the anomaly-detection residual shrinks its nominal covariance by a factor of $\tau\omega_c/(2\sqrt{2})$, so the chi-squared threshold stays valid while small attacks become far easier to detect.

desk verdict Useful and honest paper on filtering residuals for attack detection, but the load-bearing covariance formula is only a first-order truncation and the paper never says how small the sampling time must be. read the letter →

arxiv 1909.01477 v1 pith:ZKRGCIIO submitted 2019-09-03 eess.SY cs.SY

Navid Hashemi , Eduardo Verdugo German , Jonatan Pena Ramirez , Justin Ruths This is my paper · ORCID

classification eess.SYcs.SY MSC 93B1293C0593C57

keywords anomalydetectioncyber-physicalsystemsecuritychi-squareddetectorButterworthfilterlow-passfilteringsliding-modeobserverstealthyattacksresidual-based

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether the standard workhorse of attack detection, the residual-based chi-squared detector, can be made more sensitive by first low-pass filtering the residual. It argues yes: when a zero-mean Gaussian residual passes through a bank of second-order Butterworth filters, the filtered output is again zero-mean Gaussian with covariance scaled by $\tau\omega_c/(2\sqrt{2})$, so the same threshold-tuning lemma still achieves the desired false alarm rate while small attacks become much easier to see. The paper also shows that a sliding-mode observer's filtered discontinuous term approximates $\ddot{\delta}+a\delta+b\dot{\delta}$, so the anomaly can not only be detected but reconstructed. The payoff is a detection scheme that exploits the frequency separation between noise and attacks without disturbing the statistical calibration of the detector.

What carries the argument

The machinery that carries the argument is a bank of $p$ identical second-order Butterworth low-pass filters in state-space form, discretized with a first-order Euler step $\Phi_d = I + \Phi\tau$ and $\Psi_d = \Psi\tau$. Steady-state Riccati equations on each subblock give the filtered covariance elementwise, and dropping higher-order terms in $\tau\omega_c$ yields (18). The normalized distance measure built from $\rho_k$ is the chi-squared statistic, and the equivalent-control method of sliding-mode theory converts the filtered sign term of the observer into an attack reconstruction.

What would settle it

Compute the exact steady-state covariance of the discretized Butterworth filter keeping all terms in $\tau\omega_c$, form the normalized distance measure (25), and compare its empirical false alarm rate with the Lemma 1 threshold: if the rates depart from $A^*$ for $\tau\omega_c$ near 0.1-1, the small-$\tau\omega_c$ assumption fails and the detector is miscalibrated.

Watch

Extended reading notes

Core claim

Theorem 1 is the load-bearing result: for a residual $r_k \sim \mathcal{N}(0,\Sigma_r)$ passed through the second-order Butterworth filter (16)-(17) with bandwidth $\omega_c$ and sampling time $\tau$, the output $\rho_k$ is zero-mean Gaussian with covariance $\Sigma_\rho = \frac{\tau\omega_c}{2\sqrt{2}}\Sigma_r$. Because the filtered distance measure (25) normalizes by this smaller covariance, it remains chi-squared with $p$ degrees of freedom, so Lemma 1 supplies the threshold and the false alarm rate is preserved while the attack's effect on the statistic is magnified. A second claim, equation (39), is that filtering the discontinuous term of a robust sliding-mode observer yields $y_f \approx \ddot{\delta}+a\delta+b\dot{\delta}$, turning the detector into an attack reconstructor: for constant attacks the filter output is approximately $a\delta_0$, which could be fed back to nullify the attack.

Load-bearing premise

Theorem 1's covariance formula assumes the sampling interval $\tau$ is small enough that all terms of order $(\tau\omega_c)^2$ and higher vanish, and the paper gives no bound on $\tau\omega_c$ for when this truncation is accurate.

Editorial extensions

If this is right

The same threshold from Lemma 1 applies to the filtered detector, so upgrading an existing chi-squared detector requires no re-tuning of the false alarm rate.
Small constant attacks that change the alarm rate only from 5% to 7% without filtering push the filtered detector's alarm rate to 55%, making previously invisible attacks visible.
Stealthy attacks on the filtered detector must respect frequency content, not just amplitude, so high-frequency attack components are attenuated by the filter.
The robust observer with filter reconstructs smooth attacks as $y_f \approx \ddot{\delta}+a\delta+b\dot{\delta}$, enabling mitigation such as canceling constant attacks via feedback.
Because the filtered detector inherits the chi-squared calibration, its threshold remains meaningful even though the nominal covariance is much smaller.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The covariance law (18) likely extends in spirit to higher-order Butterworth filters with a different numerical constant, giving a family of detectors with tunable noise rejection; this is not shown in the paper.
Because the scaling is linear in the cutoff frequency $\omega_c$, lowering $\omega_c$ shrinks the nominal covariance but also attenuates low-frequency attacks, so an optimal cutoff must balance detection sensitivity against attack bandwidth; the paper does not solve this tradeoff.
The same filtering idea could be applied to CUSUM or windowed chi-squared detectors, where the reduced nominal covariance would sharpen change-point statistics; the paper leaves this open.
An analytic threshold for the observer-based detector could replace the empirical $L_\infty$-norm calibration, making its false alarm rate predictable; the paper explicitly leaves $\alpha_f$ numeric.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

You should know two things. First, the paper does something genuinely new: it analyzes what happens when you low-pass filter the residual before feeding it into the standard chi-squared detector, and it gives an explicit formula for the filtered covariance. That formula plus the normalized statistic (25) is the core contribution, and it is not in the cited attack-detection literature. Second, the proof of that formula is approximate in a way that is acknowledged but not quantified, and the example section omits the filter cutoff frequency, which is exactly the parameter that determines whether the approximation is good. So the paper is worth reading and citing, but the headline numbers should be taken with a grain of salt until the truncation error is bounded.

The good parts. Section III is a clear, honest treatment. The idea of retrofitting a filter to shrink the nominal residual covariance is simple and appealing, and the analytical covariance derivation (18) is the kind of thing practitioners want. The stealthy-attack discussion, while explicitly deferred for the filtered detector, correctly points out that the conventional zero-alarm attacks remain zero-alarm and that high-frequency attack content gets attenuated. Section IV reframes the sliding-mode disturbance estimation of [12] as an attack detector and validates (39) numerically; the measured and predicted residuals match in Fig. 3. The paper is also candid about its own limitations, which counts for a lot.

The soft spots. The main one is Theorem 1. The proof obtains the exact Euler-discretized covariance and then drops everything beyond first order in a = τωc, with no bound on a. The un-truncated expression in the proof shows the retained formula is O(a) accurate; the paper just says "small enough τ." That is a load-bearing approximation because (25) and the Lemma 1 threshold inherit it. If the example uses T=0.001 and ωc is, say, a few rad/s, the error is negligible; if ωc is large, it is not. Not reporting ωc in Section V-A is a simple omission that makes the 55%-vs-7% alarm rate comparison impossible to reproduce. The Section IV threshold α_f is empirical and the false-alarm rate under noise is not characterized; the paper says this openly, but it means that detector is a demonstration, not a tuned method. None of these flaws are fatal to the central idea, but they need tightening.

Who this is for: anyone working on model-based attack detection in control systems. A serious referee should see it; the right outcome is likely major revision with a bounded truncation error and a reproducible example.

Referee Report

3 major / 5 minor

Summary. The paper proposes two ways to use low-pass filtering to improve anomaly/attack detection in LTI control systems with Gaussian measurement noise. The first is a "filtered chi-squared detector": residual signals are passed through a bank of second-order Butterworth filters, and the paper derives (Theorem 1) that the steady-state covariance of the filtered residual is proportional to the unfiltered residual covariance, Σρ = (τωc/(2√2))Σr. This covariance is used to normalize a filtered distance measure so that it remains chi-squared with p degrees of freedom, allowing the standard Lemma 1 threshold to set the false alarm rate. The second approach uses a discontinuous (sliding-mode) observer whose filtered switching term approximates a smooth attack signal, giving yf ≈ δ̈ + aδ + bδ̇, and an anomaly detector based on the magnitude of yf. The paper demonstrates both methods on a second-order numerical example, reporting that the filtered chi-squared detector raises alarms at 55% under a small constant attack whereas the unfiltered detector raises alarms at only 7%, and that the sliding-mode observer reconstructs time-varying and constant attacks in the noise-free case.

Significance. If Theorem 1 is correct, the filtered chi-squared detector is a simple and potentially useful retrofit: filtering reduces the nominal covariance of the detection statistic, making low-frequency attacks easier to separate from noise while preserving the threshold-setting procedure of the standard chi-squared detector. The sliding-mode observer section offers a genuinely different detection paradigm, namely attack reconstruction via the filtered discontinuous term, and the noise-free comparison in Fig. 3 between measured and predicted residuals is a credible validation of equation (39). The analytical covariance computation is a parameter-free derivation from the stated stochastic assumptions rather than a curve fit, which is a strength. However, the central claim is currently supported only by a first-order truncation with no quantified error bound, so the quantitative 55%-versus-7% comparison rests on an unverified regime of validity. The overall idea is promising and within scope for the journal, but the missing error control and the empirically tuned threshold in Section IV are load-bearing limitations that require attention.

major comments (3)

[Section III-B, Theorem 1 (Eqs. (23)-(24))] The proof of Theorem 1 obtains the exact covariance of the Euler-discretized filter, as exhibited before Eq. (24), and then drops all terms of order O((τωc)^2) and higher with the statement "if the sampling time is taken small enough the higher order terms vanish." No quantitative bound on τωc is given, and the text does not state the cutoff frequency ωc used in the Section V-A experiment. Because Eq. (25) uses the truncated covariance to normalize the filtered residual and because Lemma 1's threshold is valid only when the normalized statistic is exactly chi-squared, the claimed false alarm rate A*=5% and the reported 55% alarm rate under attack are not guaranteed unless the truncation error is negligible at the chosen parameters. Please provide either a rigorous error bound on the covariance approximation or a numerical validation that the distribution of the left-hand side of (25) is sufficiently close to chi-squared at the parameters used in Fig. 1, and report ωc for that example.
[Section IV-A, Eq. (40)] The threshold αf for the discontinuous-observer detector is not derived from a false alarm specification but is set empirically to the L∞-norm of the filter output measured under normal noisy operation. As the paper states, there is no formal procedure for determining αf. Consequently, the claim that attacks (44)-(45) "can be identified" in the noisy case is not accompanied by any characterization of the false alarm rate or the detection probability, so it cannot be compared quantitatively with the residual-based detectors. At minimum, the paper should report the empirical false alarm rate for the chosen αf and discuss how the threshold should be adjusted if the noise level changes.
[Section IV, Eqs. (30)-(39)] The derivation leading to yf ≈ δ̈ + aδ + bδ̇ assumes η=0 and assumes that the system is on the sliding surface (e1 = ė1 = 0). In the noisy example, the detector is applied directly to a noisy output without an analytic extension of the equivalent-control result, so the relationship between the filter output and the attack under noise (including the effect of finite c3 and chattering) is not established. Please clarify under what noise conditions and observer gains (39) remains a valid approximation, or restrict the claim to the noise-free case and treat the noisy case as purely empirical.

minor comments (5)

[Title] The title contains a typo: "Dete ction" should be "Detection."
[Introduction, paragraph 4] The phrase "The recent work to to tune classical detectors" contains a duplicated "to."
[Section III-B, first paragraph] "apriori" should be written as "a priori."
[Section IV-A, first paragraph] "worth nothing" should be "worth noting."
[Section V-A, Fig. 1] Please report the number of Monte Carlo runs or the time horizon used to estimate the empirically reported alarm rates, since the rates are compared to four decimals (e.g., 7% and 55%).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Theorem 1 is a parameter-free covariance calculation, and the Section IV threshold is an explicitly empirical calibration rather than a fitted input presented as a prediction.

full rationale

The main load-bearing result, Theorem 1, derives the filtered-residual covariance from the stated Gaussian assumption, the chosen Butterworth filter, and the discrete-time Riccati equation; equation (25) then normalizes by that derived covariance, so the chi-squared claim follows algebraically rather than by construction. Lemma 1 is cited from prior work by one of the authors, but it is a standard inverse-gamma threshold relation with stated assumptions that do not include the filtered result, so it is independent support and not a load-bearing self-citation chain. The Section IV detector threshold alpha_f is admittedly 'numerically determined by directly measuring the output of the filter' and taken as the L-infinity norm; this is an openly empirical calibration, not a fitted parameter renamed as a prediction, and the subsequent attack-detection claim depends on the attack-induced filter output exceeding that threshold rather than on the calibration itself. The Fig. 3 comparisons use the analytically derived residuals (39) and (41) against a Simulink simulation, so no fitted values are being recycled. The genuine weakness is a correctness risk rather than circularity: Theorem 1 keeps only first-order terms in tau*omega_c with no stated bound, and Remark 1's claim that the filtered covariance is 'significantly smaller' depends on that unquantified truncation. No step in the derivation reduces to its own input by definition or by a self-citation chain.

Assumptions & free parameters 2 free parameters · 7 assumptions · 0 invented entities

The paper introduces no new physical entities. Its central results rest on standard LTI observer theory, the frequency-separation assumption, and a small-sample-time approximation. The main externally supplied numbers are the filter cutoff (not reported for the Section V-A experiment) and the empirically fitted Section IV threshold.

free parameters (2)

Filter cutoff frequency ω_c = 12 rad/s in Section V-B example; not stated for Section V-A example
The cutoff shapes both the covariance reduction (18) and the attenuation of attack content. The paper gives no tuning rule, and the headline improvement in Section V-A depends on a value that is not reported.
Threshold α_f of the discontinuous-observer detector = 1.55 (empirically calibrated)
The threshold is fit to the L∞ norm of the filter output under nominal noise, so the false alarm rate is not analytically controlled and the threshold may not transfer to other noise realizations or operating points.

assumptions (7)

domain assumption Measurement noise η is zero-mean Gaussian and is substantially higher frequency than attack/anomaly signals.
Motivates low-pass filtering; introduced in the abstract and Section III-B. If attackers inject high-frequency content, the filter attenuates the attack as well as the noise.
standard math The pairs (A,C) and (A,B) are detectable and stabilizable, respectively.
Section II standing assumptions that justify the observer and controller designs.
domain assumption Sampling time τ is small enough that the Euler discretization Φ_d = I + Φτ is accurate and higher-order terms can be dropped.
Used in the proof of Theorem 1, equation (18), with no quantitative bound given.
domain assumption For the discontinuous observer, measurements are noise-free (η=0) and the sliding surface e1=ė1=0 is reached.
Section IV derivation of (32)-(34); with noise the approximation yf ≈ δ̈+aδ+bδ̇ is only approximate.
standard math The equivalent control method [14] gives the averaged value of the discontinuous term.
Invoked in Section IV to obtain (34).
domain assumption Plant parameter a is known to the detector user.
Needed in (41) to reconstruct a constant attack; the paper acknowledges this in Remark 2.
standard math Observer gains c1, c2, c3 can be chosen as in [12] to make the observation error globally asymptotically stable in the noise-free, attack-free case.
Section V-B relies on [12] for stability of the sliding-mode observer.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Filtering Approaches for Dealing with Noise in Anomaly Detection." pith.science (2026). https://pith.science/paper/ZKRGCIIO

@misc{pith2026190901477,
  author       = {Pith},
  title        = {Pith review of: Filtering Approaches for Dealing with Noise in Anomaly Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZKRGCIIO}},
  note         = {Machine review of arXiv:1909.01477}
}

read the original abstract

The leading workhorse of anomaly (and attack) detection in the literature has been residual-based detectors, where the residual is the discrepancy between the observed output provided by the sensors (inclusive of any tampering along the way) and the estimated output provided by an observer. These techniques calculate some statistic of the residual and apply a threshold to determine whether or not to raise an alarm. To date, these methods have not leveraged the frequency content of the residual signal in making the detection problem easier, specifically dealing with the case of (e.g., measurement) noise. Here we demonstrate some opportunities to combine filtering to enhance the performance of residual-based detectors. We also demonstrate how filtering can provide a compelling alternative to residual-based methods when paired with a robust observer. In this process, we consider the class of attacks that are stealthy, or undetectable, by such filtered detection methods and the impact they can have on the system.

Figures

Figures reproduced from arXiv: 1909.01477 by the authors.

**Figure 2.** The probability density functions, since they are no [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** Residual signal for the noise free case. a) Residual fo [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

14 extracted references · 14 canonical work pages

[12]

Robust observation and identiﬁcation of ndof lagrangian systems,

D. I. Rosas Almeida, J. Alvarez, and L. Fridman, “Robust observation and identiﬁcation of ndof lagrangian systems,” International Journal of Robust and Nonlinear Control, vol. 17, no. 9, pp. 842–861. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/10.1002/rnc.1156

work page doi:10.1002/rnc.1156
[1]

Chen and R

J. Chen and R. J. Patton, Robust Model-based Fault Diagnosis for Dynamic Systems. Norwell, MA, USA: Kluwer Academic Publishers, 1999

work page 1999
[2]

At- tacks against process control systems: Risk assessment, de tection, and response,

A. C´ ardenas, S. Amin, Z. Lin, Y . Huang, C. Huang, and S. Sa stry, “At- tacks against process control systems: Risk assessment, de tection, and response,” in Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security , 2011, pp. 355–366

work page 2011
[3]

Detecting integr ity attacks on scada systems,

Y . Mo, R. Chabukswar, and B. Sinopoli, “Detecting integr ity attacks on scada systems,” IEEE Transactions on Control Systems Technology, vol. 22, no. 4, pp. 1396–1407, 2014

work page 2014
[4]

On the performance degradation of cyber- physical systems under stealthy integrity attacks,

Y . Mo and B. Sinopoli, “On the performance degradation of cyber- physical systems under stealthy integrity attacks,” IEEE Transactions on Automatic Control , vol. 61, pp. 2618–2624, 2016

work page 2016
[5]

Optimal Linea r Cyber- Attack on Remote State Estimation,

Z. Guo, D. Shi, K. H. Johansson, and L. Shi, “Optimal Linea r Cyber- Attack on Remote State Estimation,” IEEE Transactions on Control of Network Systems , vol. PP , no. 99, pp. 1–10, 2016

work page 2016
[6]

Quantifying the impact of cyber-attack strategies for con trol systems equipped with an anomaly detector,

J. Miloˇ sevi´ c, D. Umsonst, H. Sandberg, and K. H. Johans son, “Quantifying the impact of cyber-attack strategies for con trol systems equipped with an anomaly detector,” in 2018 European Control Conference (ECC) . IEEE, 2018, pp. 331–337

work page 2018
[7]

Anomaly detector metrics fo r sensor data attacks in control systems,

D. Umsonst and H. Sandberg, “Anomaly detector metrics fo r sensor data attacks in control systems,” in 2018 Annual American Control Conference (ACC). IEEE, 2018, pp. 153–158

work page 2018

Show all 14 references

[8]

On reachable sets of hidden cps s ensor attacks,

C. Murguia and J. Ruths, “On reachable sets of hidden cps s ensor attacks,” in 2018 Annual American Control Conference (ACC) . IEEE, 2018, pp. 178–184

2018
[9]

Tuning windowed chi- squared detectors for sensor attacks,

R. Tunga, C. Murguia, and J. Ruths, “Tuning windowed chi- squared detectors for sensor attacks,” in 2018 Annual American Control Conference (ACC). IEEE, 2018, pp. 1752–1757

2018
[10]

A comparison of st ealthy sensor attacks on control systems,

N. Hashemi, C. Murguia, and J. Ruths, “A comparison of st ealthy sensor attacks on control systems,” in 2018 Annual American Control Conference (ACC). IEEE, 2018, pp. 973–979

2018
[11]

Generalized chi-squared dete ctor for lti systems with non-gaussian noise,

N. Hashemi and J. Ruths, “Generalized chi-squared dete ctor for lti systems with non-gaussian noise,” in 2019 Annual American Control Conference (ACC). IEEE, 2019

2019
[13]

Cusum and chi-squared attack d etection of compromised sensors,

C. Murguia and J. Ruths, “Cusum and chi-squared attack d etection of compromised sensors,” in proceedings of the IEEE Multi-Conference on Systems and Control (MSC) , 2016

2016
[14]

V . I. Utkin, Sliding Modes in Control and Optimization . Springer- V erlag Berlin Heidelberg, 1992

1992

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [12]

Robust observation and identiﬁcation of ndof lagrangian systems,

D. I. Rosas Almeida, J. Alvarez, and L. Fridman, “Robust observation and identiﬁcation of ndof lagrangian systems,” International Journal of Robust and Nonlinear Control, vol. 17, no. 9, pp. 842–861. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/10.1002/rnc.1156

work page doi:10.1002/rnc.1156

[2] [1]

Chen and R

J. Chen and R. J. Patton, Robust Model-based Fault Diagnosis for Dynamic Systems. Norwell, MA, USA: Kluwer Academic Publishers, 1999

work page 1999

[3] [2]

At- tacks against process control systems: Risk assessment, de tection, and response,

A. C´ ardenas, S. Amin, Z. Lin, Y . Huang, C. Huang, and S. Sa stry, “At- tacks against process control systems: Risk assessment, de tection, and response,” in Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security , 2011, pp. 355–366

work page 2011

[4] [3]

Detecting integr ity attacks on scada systems,

Y . Mo, R. Chabukswar, and B. Sinopoli, “Detecting integr ity attacks on scada systems,” IEEE Transactions on Control Systems Technology, vol. 22, no. 4, pp. 1396–1407, 2014

work page 2014

[5] [4]

On the performance degradation of cyber- physical systems under stealthy integrity attacks,

Y . Mo and B. Sinopoli, “On the performance degradation of cyber- physical systems under stealthy integrity attacks,” IEEE Transactions on Automatic Control , vol. 61, pp. 2618–2624, 2016

work page 2016

[6] [5]

Optimal Linea r Cyber- Attack on Remote State Estimation,

Z. Guo, D. Shi, K. H. Johansson, and L. Shi, “Optimal Linea r Cyber- Attack on Remote State Estimation,” IEEE Transactions on Control of Network Systems , vol. PP , no. 99, pp. 1–10, 2016

work page 2016

[7] [6]

Quantifying the impact of cyber-attack strategies for con trol systems equipped with an anomaly detector,

J. Miloˇ sevi´ c, D. Umsonst, H. Sandberg, and K. H. Johans son, “Quantifying the impact of cyber-attack strategies for con trol systems equipped with an anomaly detector,” in 2018 European Control Conference (ECC) . IEEE, 2018, pp. 331–337

work page 2018

[8] [7]

Anomaly detector metrics fo r sensor data attacks in control systems,

D. Umsonst and H. Sandberg, “Anomaly detector metrics fo r sensor data attacks in control systems,” in 2018 Annual American Control Conference (ACC). IEEE, 2018, pp. 153–158

work page 2018