Quantifying and Prioritizing Stealthy Source-Manipulation Threats Against Multi-Source Anomaly Detectors

arXiv:2610.36693v1 [cs.CR] 27 Oct 2026

Quantifying and Prioritizing Stealthy Source-Manipulation Threats Against Multi-Source Anomaly Detectors Indraveni Chebolu

Seema Panghal

Information Security Group Centre for Development of Advanced Computing Hyderabad, Telangana, India indravenik@cdac.in

Information Security Group Centre for Development of Advanced Computing Hyderabad, Telangana, India seemap@cdac.in

Arnab Mallick

Ch A S Murty

Information Security Group Centre for Development of Advanced Computing Hyderabad, Telangana, India arnabm@cdac.in

Information Security Group Centre for Development of Advanced Computing Hyderabad, Telangana, India chasmurty@cdac.in

Abstract—Security pipelines often fuse several data sources and protect a downstream model with a cross-source anomaly detector. Such detectors are usually judged by their clean falsepositive rate and by how well they catch random corruption. Neither metric captures an adversary who controls some sources and targets a specific downstream decision. We propose a threat-quantification score, the task-conditioned visibility margin, defined as the least detector evidence a manipulation must reveal per unit of harm to the downstream task. The margin has a closed form, takes about 85 µs per certificate, yields a minimum-evidence attack, and identifies task-relevant directions the detector cannot see. On a 17-channel industrial telemetry benchmark, a detector that flags 82.8% of random single-channel corruptions is first-order blind on 64.7% of task/subset pairs in an audit of one- to four-channel subsets. Task-conditioned manipulations cause more than twice as many falsely reassuring errors as generic stealthy ones, and more of them evade the alarm on four of five splits, mainly at small budgets. Used to prioritize audits on held-out subsets, the margin finds a median of four verified failures in ten checks, compared with none for random order and two for alarmbased ranking, and performs comparably to the task-gradient baseline. It also ranks vulnerable configurations of the learned GDN and TranAD detectors and of a five-source crop-yield panel.

1. Introduction Analysts rarely have the budget to verify every data source that feeds a model. When several sources are fused and checked by a cross-source anomaly detector, a practical question follows: which source subsets should be audited first? Standard detector metrics do not answer it. A detector

can flag most random corruptions and still miss the coordinated change that a downstream decision depends on. The mechanism is geometric. A detector constrains only the directions its residual responds to; when the task depends on the remaining directions, a coordinated change across sources moves the decision while the residual barely moves. This is the static, task-conditioned form of unobservable false-data injection [1]. We turn it into a per-subset threat score for learned, nonlinear detectors and downstream models, and use the score to rank audits. Contributions. • Threat score. For any compromised source subset, the margin ΓM measures the minimum whitened detector evidence per unit of downstream harm. It has a closed form, gives a minimum-evidence attack, and equals the slope of the optimal nonlinear evidence– harm trade-off for small attacks. • Explanation. The margin separates exact blind spots from weakly visible directions and shows why the same detector carries different risk for different downstream tasks. • Prioritization. On held-out source subsets, ranking by ΓM finds verified failures ahead of random and alarm-based orderings and comparably to the taskgradient baseline, while also diagnosing which detector directions make the subsets vulnerable. • Evaluation. We test principal-component-analysis (PCA), reconstruction, GDN, and TranAD detectors on industrial telemetry and a crop-yield panel with adaptive finite attacks. The artifact [2] is public.

2. Threat Model The state x ∈ Rk concatenates source blocks. The detector computes a residual vector g(x) ∈ Rr and raises an

alarm when a score of g(x) crosses a threshold calibrated at the 95th validation percentile. The downstream task is a differentiable scalar f (x), such as a regression output or class margin, signed so that increasing it is harmful. The adversary controls a declared subset M of sources, for example through a compromised acquisition, calibration, or reporting path. Its actions are parameterized by b ∈ Rm through a map ϕx,M with ϕx,M (0) = x; sources outside M stay fixed. We write GM (b) = g(ϕx,M (b)),

FM (b) = f (ϕx,M (b)).

The adversary seeks a large task change FM (b) − FM (0) with a small detector change GM (b) − GM (0) under a Euclidean norm budget ∥b∥2 ≤ ρ. The defender’s objective is to prioritize source subsets for verification. Controls and attacker knowledge. Controlling a source means altering the input values delivered during the evaluated window, not the ground truth, other sources, model parameters, or alarm threshold. In Hydraulic telemetry, each compromised channel permits a gain and a bias on its original trace; summary features are recomputed from that trace (Appendix B). This models a compromised input path, not arbitrary editing of derived features. The defender computes the margin using its own models and tests attacks under white-box access; Section 5.5 examines transfer to surrogate-model attackers. Physical compromise and fully black-box attacks are outside these experiments.

3. Quantifying the Threat Let JM = DGM (0) be the restricted detector Jacobian, uM = ∇FM (0) the restricted task gradient, Ω ≻ 0 the residual weighting (the noise covariance, or I for standardized ⊤ −1 residuals), and AM = JM Ω JM the local detector information. Here Proj denotes Euclidean orthogonal projection and † denotes the Moore–Penrose pseudoinverse. Exact blind spots. If Projker JM uM ̸= 0, the adversary can change the task while the detector output stays constant to first order. Theorem 1 (Harmful blind manifold). If GM is C 1 with constant rank rM near zero, its level set through zero is locally a manifold of dimension m − rM with tangent space ker JM . If hM = ∥ Projker JM uM ∥2 > 0, a unit-speed curve on this level set changes the task at first-order rate hM . Graded visibility. Exact blind spots are the limiting case of a broader phenomenon: directions that the detector observes only weakly. The margin grades this continuum, from exactly blind (ΓM = 0) to strongly observed. Definition 2 (Task-conditioned visibility margin). For uM ̸= 0, ΓM = inf ∥JM b∥Ω−1 , u⊤ M b=1

∥z∥2Ω−1 = z ⊤ Ω−1 z.

(1)

A small ΓM means that a unit of first-order task change requires little linearized detector evidence. If uM = 0, no first-order task change is possible on that subset, and the case is excluded from ranking.

Theorem 3 (Closed form and minimum-evidence attack). ΓM = 0 if and only if hM > 0. Otherwise † Γ2M = u⊤ M AM uM

−1

,

b∗ (∆) = ∆

A†M uM † u⊤ M AM uM

, (2)

and b∗ (∆) minimizes first-order detector evidence among attacks with first-order task shift ∆. The margin is a local quantity, and it also governs the true nonlinear trade-off for small attacks. Theorem 4 (Local frontier). Suppose FM and GM are C 2 and ΓM > 0. Fix any constant C > ∥b∗ (1)∥2 . For ∆ > 0, define the minimum observable evidence as VM (∆) :=

min FM (b)−FM (0)=∆ ∥b∥2 ≤C∆

∥GM (b) − GM (0)∥Ω−1 .

(3)

Then, as ∆ ↓ 0, VM (∆) = ΓM ∆ + O(∆2 ).

(4)

Proofs are in Appendix A. Theorem 4 concerns small attacks: curvature affects its O(∆2 ) remainder, while ΓM alone does not account for a finite norm budget or the available alarm slack. A low margin therefore need not imply a feasible undetected attack; every reported failure is tested against the full nonlinear pipeline. The margin is invariant under smooth, locally invertible changes of attack coordinates. It also cannot decrease when an independent check contributes a positive-semidefinite information matrix BS ⪰ 0 to AM . We standardize task outputs to compare margins across tasks. Why task conditioning matters. The smallest singular value σmin of JM is task-agnostic, whereas ΓM uses the task gradient. Two tasks can therefore share the same detector and Jacobian spectrum but have different margins (Table 1). What the task-gradient baseline omits. The norm ∥uM ∥2 measures task change per unit control magnitude but ignores detector sensitivity. For example, let Ω = I , JM = diag(1, ϵ), 0 < ϵ < 1, and let e1 , e2 be standard basis vectors. Tasks with gradients e1 and e2 have equal norms but margins 1 and ϵ: the second is less visible to the detector. Conversely, if AM = αI for a common α > 0, √ then ΓM = α/∥uM ∥2 ; sorting by increasing margin is equivalent to sorting by decreasing task-gradient norm. The margin’s additional value is to expose detector visibility, even when both scores yield similar empirical audit rankings. Audit prioritization. For a fixed task and accepted state, the defender ranks candidate subsets by increasing ΓM and verifies selected cases with finite attacks. Each certificate uses a singular-value decomposition (SVD) and a pseudoinverse. It costs about 85 µs, around 70 times less than one numerical attack optimization (5.9 ms).

4. Evaluation Setup Industrial telemetry. The UCI Hydraulic Systems rig [3] provides 2,205 cycles from 17 channels. Each channel contributes its mean, standard deviation, root-meansquare (RMS), minimum, and maximum (85 features). Four downstream tasks predict cooler, valve, pump, and accumulator condition. We use five seeded contiguous-block 60/20/20 splits with standardized multi-output ridge and multilayer-perceptron (MLP) task models (balanced accuracy .791 and .914). The PCA detector projects standardized features onto the r lowest-variance principal directions, with residual dimension r ∈ {1, 2, 4, 8, 85} (r = 85 is the full residual), and alarms on the squared residual norm, the square of the evidence in Eq. (1) when Ω = I . The adversary applies a fractional gain and a bias to each compromised channel, and all five summaries are recomputed exactly (Appendix B). Learned detectors. We repeat the audit with GDN [4] and TranAD [5] on per-second 17-channel sequences, with the native point score aggregated by its maximum over each cycle. Here JM is the central-difference Jacobian (step 10−4 ) of the full signed residual sequence, scaled per channel by its training median and interquartile range and evaluated at the training-mean cycle. The max-aggregated alarm is non-smooth, so for these detectors we use the margin as a ranking score and validate it with finite attacks. Crop-yield panel. The ICRISAT panel [6] has five sources (rainfall, temperature, irrigated area, nitrogen fertilizer, acreage) and reported yield as the target. We use a temporal split (train through 2008, validate on 2009–2010, test on 2,002 later rows), a ridge or contextual MLP task model, and a PCA or reconstruction detector. Attacks. All attacks share a source support M , norm budget ∥b∥2 ≤ ρ, and detector threshold. A0 uses a random direction; A1 follows the task gradient; A2 follows the detector’s least visible direction regardless of harm (generic stealth); A4 follows the task-conditioned direction b∗ of Eq. (2), rescaled to the budget. The matched comparison uses the 17 single-channel and 43 evaluated twochannel subsets. These supports are first-order identified (ker JM = {0}), so no nonzero control is perfectly invisible to first order; the artifact [2] also implements an exact-kernel attack (A3) for blind subsets. Sequential leastsquares programming (SLSQP) supplies a constrained finiteattack reference. Numerical rank counts singular values above 10−10 max(m, r) max(σ1 , 1), where σ1 is the largest singular value of JM . Outcome. A verified failure is a feasible finite attack that turns an initially correct, accepted prediction into a falsely reassuring one, i.e., a healthier condition than the true one (such as full cooler efficiency when the cooler is degraded), without raising an alarm. In Table 2, Adverse is the rate of newly caused falsely reassuring errors, Alarm is the rate of flagged attacks, and Joint is the rate of adverse errors without alarms, all among initially correct, accepted cases. Thresholds, supports, and budgets are fixed on training and validation data; test data is used once.

TABLE 1. O NE SUBSET (TS4+VS1), FOUR TASKS . R ANK AND THE SMALLEST JACOBIAN SINGULAR VALUE ARE TASK - AGNOSTIC ; A4 HARM IS A REALIZED STANDARDIZED TASK CHANGE .

Task Cooler Valve Pump Accumulator

Rank

σmin

ΓM

A4 harm

4 4 4 4

−8

−4

.0008 .0794 .0185 .1301

7.69×10 7.69×10−8 7.69×10−8 7.69×10−8

1.69×10 5.73×10−7 2.31×10−6 3.71×10−7

TABLE 2. M ATCHED H YDRAULIC OUTCOMES (%): FIVE - SPLIT MEDIAN [ RANGE ]. Joint IS A NEWLY CAUSED FALSELY REASSURING ERROR WITHOUT AN ALARM . Attack

Alarm

Joint

A0 random 18.3 [14.1, 20.5] 95.9 [89.3, 96.5] A1 task gradient 46.3 [40.9, 52.8] 97.9 [94.8, 98.1] A2 generic stealth 6.6 [5.1, 7.3] 36.5 [18.7, 41.7] A4 task conditioned 14.5 [11.9, 16.9] 49.2 [30.9, 53.2]

Adverse

0.20 [0.05, 0.74] 0.22 [0.11, 0.99] 2.02 [1.38, 3.25] 2.31 [1.76, 5.35]

5. Results 5.1. Detectors That Catch Random Corruption Have Blind Spots With residual dimension r = 8, the Hydraulic detector has a test false-positive rate (FPR) of 3.18% and flags 82.8% of random single-channel gain/bias corruptions at radius .5. Over the reference-split audit of source subsets of size one to four, the same detector is first-order blind on 64.7% of task/subset pairs. With r ≤ 4 the blind fraction is at least 98.9%, as expected: most audited subsets have three or four channels and hence six or eight controls, more than the r residual coordinates. The full residual (r = 85) has no blind pair. Table 1 compares the same two-channel subset, TS4 (temperature) and VS1 (vibration), across four tasks. The rank and σmin of JM are identical, while ΓM spans almost three orders of magnitude; the margin’s ordering agrees with the reported realized A4 harm. The last column records the finite A4 task-output change in standardized task units.

5.2. Task-Conditioned Attacks We compare attacks on identical tuples of split, state, subset, task, budget, and threshold. The population contains 1,229–1,369 initially correct, accepted task–cycle units per split, over 17 single-channel and 43 evaluated two-channel subsets and five budgets. Table 2 summarizes the outcomes. A4 causes more adverse outcomes than A2 on every split (11.9–16.9% versus 5.1–7.3%). A1 has the highest adverse-outcome rate, but its attacks also trigger detector alarms in at least 94.8% of evaluated cases. On the joint endpoint, A4 exceeds A2 on four of five splits, with the gain concentrated at budgets .1– .5; at larger budgets both attacks trigger more alarms and converge (Fig. 1).

adverse outcome without alarm

0.07 0.06

A0

A2

A1

A4

is 0.6 (interval [0, 1.8]). This comparison uses within-split count differences: it need not equal the difference of the separately reported medians, both of which are four at ten checks. At budgets 25, 50, and 100, the medians are 9, 13, and 15 for the margin, versus 8, 13, and 16 for gradient norm (Table 3). The two rankers therefore perform comparably on held-out cases; the margin additionally identifies weakly monitored task directions (Table 1). Residual whitening by identity, diagonal, or Ledoit–Wolf covariance gives the same margin-ranker medians.

0.05 0.04 0.03 0.02 0.01

5.4. Learned Detectors

0.00 0.2

0.4 0.6 0.8 L2 parameter budget

1.0

Figure 1. Joint adverse-without-alarm rate by attack budget. Lines are fivesplit medians; bands span the splits. TABLE 3. M EDIAN HELD - OUT VERIFIED FAILURES FOUND WITHIN AN AUDIT BUDGET (94 FAILURES AMONG 680 HELD - OUT CASES ).

Ranker

10

25

50

100

Random order Alarm slack / scalar score Task-gradient norm Combined (validation-selected) ΓM (ours)

0 2 4 2 4

3 3 8 9 9

6 4 13 13 13

13 13 16 16 15

The margin also explains where the A4 advantage concentrates. Low-margin directions trade detector evidence for control magnitude (median ∥b∗ (1)∥2 = 11.4 over matched cases), so at small budgets A4 achieves its task effect while staying closest to the residual floor, which matches the gains at budgets .1–.5 in Fig. 1. Certificates use one Jacobian at the training-mean cycle, while alarms are evaluated on each test cycle; these per-cycle deviations account for alarms beyond the first-order prediction.

5.3. Audit Prioritization An audit case is a tuple of split, source subset, task, and one fixed initially correct, accepted state. We partition cases by hashed subset identity: 520 development cases select tie rules and a combined ranker, while 680 cases from disjoint subsets are held out. A finite search at budgets .1, .25, and .5 labels 94 of the held-out cases as verified failures. It starts from zero, the task-gradient direction, and b∗ , so the labels do not favor either informed ranker. Alarm slack ranks cases by their clean distance to the threshold. Table 3 and Fig. 2 report the results. Within ten audits, ΓM finds a median of four failures, compared with zero for random order and two for both alarm-slack ranking and the combined ranker. Its advantage over alarm-slack ranking is 2.2 failures (paired bootstrap interval [1.0, 3.2]). Compared with task-gradient ranking, the reported paired difference

Across four independently trained splits and 128 subset/task combinations, neither GDN nor TranAD has an exact first-order blind direction, yet margins on the reference split span from .0029 to 1138 for GDN and from .010 to 3112 for TranAD. At budget .5, the Spearman association between the margin and the joint outcome is negative on all four splits: −.675 to −.229 for GDN and −.655 to −.325 for TranAD. Task-conditioned attacks expose 24–34 GDN and 24–39 TranAD vulnerable configurations per split; on the reference split, generic stealth exposes 12 and 19. Fig. 3 shows that auditing in margin order finds these failures faster than random order.

5.5. Gray-Box Transfer We repeat the Hydraulic attacks with surrogate task models and detectors on 60 fixed two-channel subsets. White-box attacks have median standardized harm .155. Surrogates with the same architecture, trained on 10–100% of the data or with independent weights, retain median harm .058 to .156, with median first-order detector leakage below 10−6 . Here leakage denotes the target detector’s linearized residual change under the transferred control, ∥JM b∥Ω−1 . A different-architecture surrogate retains harm .089 with leakage 1.7 × 10−5 . Detector mismatch affects leakage, whereas task-gradient mismatch affects transferred harm. These tests evaluate imperfect model knowledge for fixed source supports.

5.6. Crop-Yield Panel and Local Accuracy The linear crop detector has six harmful blind subsets among all 31. Adding a direct check on fertilizer leaves two, and adding acreage removes all of them. With the nonlinear task model and reconstruction detector, the margin is negatively associated with A4 harm for every one of five model seeds (Spearman −.561 to −.212), and A4 exceeds A2 in median harm for every seed. The finite-attack optimization also agrees with the local prediction of Theorem 4: at task effect ∆ = .01, optimized nonlinear evidence per unit harm differs from ΓM by a median of 5.1% across 40 fixed states (Spearman .994).

combined

20

random ΓM

25 verified joint failures

verified joint failures

25

task gradient

15 10 5 0

20 15 10 5 0

0

20

40 60 80 finite verifications

100

0

25 50 75 100 125 150 screening + verification time (s)

fraction of failures found

Figure 2. Held-out audit allocation by number of verifications (left) and by screening-plus-verification time (right). Curves are five-split medians; bands span the splits.

1.00 0.75 0.50 0.25

GDN TRANAD random order

0.00 0.0 0.2 0.4 0.6 0.8 1.0 fraction audited, smallest margin first

Figure 3. GDN and TranAD audit allocation at budget .5, with configurations ordered by increasing margin.

6. Related Work Stealthy false-data injection. Liu et al. [1] showed that an attacker who knows the measurement model of DC state estimation can inject a change in the column space of the measurement matrix that leaves the bad-data residual unchanged. Later work quantified and defended against this attack. Security indices give the fewest measurements an attacker must corrupt [7], [8]. Kosut et al. [9] characterize unobservable attacks and design detectors for them. Bobba et al. [10] and Kim and Poor [11] choose which measurements to protect so that no unobservable attack remains. In dynamic systems, Pasqualetti et al. [12] characterize undetectable attacks through system zeros. Fawzi et al. [13] bound how many sensors can be corrupted while the state remains recoverable. Mo and Sinopoli [14] bound the degradation a stealthy attacker can cause. The output-to-output gain of Teixeira et al. [15] is closest to our score: for a static scalar task, 1/ΓM plays the same role. Theorem 1 is a nonlinear, task-restricted analogue of the column-space condition. Our monotonicity property parallels the measurement-protection results: in our crop

panel, a direct check on acreage removes every harmful blind subset (Section 5.6). These works assume a known linear or linearized physical model and measure harm on a state estimate. Our detectors and task models are learned from data, harm is measured on a downstream prediction, and the score is used to rank source subsets for audit. Evading anomaly detectors in industrial systems. Urbina et al. [16] showed that stealthy attackers can cause substantial damage against widely deployed industrial control system (ICS) detectors, and proposed an impact metric under a false-alarm budget. Erba et al. [17], [18] optimize manipulations that conceal real process anomalies from reconstruction-based detectors, including in white-box settings. Giraldo et al. [19] survey physics-based detection and how it is evaluated. These works ask whether an existing anomaly can be hidden, and they evaluate one attack at a time. We ask which source subsets let an attacker create a harmful downstream change, and we give a closed-form screen per subset before any attack is run. Sensor fusion. Attacks on autonomous-driving perception show that fused systems fail when an adversary controls a subset of sources. Shen et al. [20] exploit GPS spoofing against multi-sensor localization, and Cao et al. [21] construct objects that are invisible to both camera and LiDAR. Each of these attacks is built by hand for one system. ΓM is a generic screen for which subsets of a fused pipeline are weakly cross-checked. Adaptive evaluation and robustness scores. Test-time evasion [22] and adaptive attacks on defenses [23], [24], [25] show that detectors must be attacked as complete systems. For this reason, every failure we report is verified by a finite attack against the full pipeline. Certified defenses [26], [27] bound how much a single classifier’s output can change under norm-bounded perturbations. CLEVER [28] estimates a local robustness score from gradient norms. ΓM is likewise a cheap first-order score, but it measures a trade-off between two models (a downstream task and a separate detector), and it is restricted to perturbations that a compromised source can actually realize. Benchmarking time-series detectors. Wu and Keogh [29] show that common anomaly benchmarks

contain trivial or mislabeled anomalies. Kim et al. [30] show that point-adjusted F1 can overstate detector quality. GDN [4] and TranAD [5], which we audit, are evaluated by clean detection metrics. Our results add a separate axis: clean false-positive rate and recall on random corruption reveal little about task-targeted manipulation (Section 5.1). Threat prioritization. Defenders rank vulnerabilities in several ways: • • •

by severity (CVSS [31]); by likelihood of exploitation (EPSS [32]); by stakeholder-specific decision trees (SSVC [33]), which recent work automates with LLMs [34].

Attack graphs [35] rank paths through a network. These methods prioritize known vulnerabilities from their descriptions or from network reachability. ΓM instead prioritizes data sources by how weakly a detector constrains taskrelevant manipulation of them, and it can be computed before any vulnerability is reported. Estimation and optimal design. Under Gaussian residual noise with covariance Ω, AM is the Fisher information of the attack controls. Γ2M in Eq. (2) is therefore the Fisher information on the scalar task shift u⊤ M b [36]. Maximizing ΓM over added checks is the local analogue of c-optimal experimental design [37]. We use this classical structure to screen and explain. The monotonicity property suggests the margin could also guide where to add checks.

Ethics All experiments use public datasets and controlled offline manipulations, and the artifact supports defensive auditing.

LLM Usage Statement LLMs assisted with artifact preparation, manuscript language editing.

References [1]

Y. Liu, P. Ning, and M. K. Reiter, “False data injection attacks against state estimation in electric power grids,” in Proceedings of the 16th ACM Conference on Computer and Communications Security, 2009, pp. 21–32.

[2]

A. Mallick, “Arnab-m1/blind-spots-in-cross-source-ml-integritymonitoring: Blind spots in cross source ml integrity monitoring,” Oct. 2026. [Online]. Available: https://doi.org/10.5281/zenodo.23682852

[3]

N. Helwig, E. Pignanelli, and A. Schütze, “Condition monitoring of hydraulic systems,” UCI Machine Learning Repository, 2015. [Online]. Available: https://archive.ics.uci.edu/dataset/447/condition+ monitoring+of+hydraulic+systems

[4]

A. Deng and B. Hooi, “Graph neural network-based anomaly detection in multivariate time series,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 35, no. 5, pp. 4027–4035, 2021.

[5]

S. Tuli, G. Casale, and N. R. Jennings, “TranAD: Deep transformer networks for anomaly detection in multivariate time series data,” Proceedings of the VLDB Endowment, vol. 15, no. 6, pp. 1201–1214, 2022.

Because ΓM is a local first-order screen rather than a global predictor of finite-budget damage across heterogeneous operating states, the pooled state-and-attack margin– harm rank correlation on Hydraulic is weak (−.075). Accordingly, ΓM is used to prioritize verification within an audit, not to estimate calibrated failure probabilities. Our evaluation covers a laboratory hydraulic rig and a five-source crop-yield panel across PCA, reconstruction, GDN, and TranAD detectors; broader architectures, physical process constraints, and time-varying source compromise remain to be evaluated. Clean anomaly detection and resistance to targeted source manipulation are distinct properties. The margin makes the local task–detector trade-off explicit and directs finite verification toward the most weakly monitored cases.

[6]

S. Mohapatra, “ICRISAT district-level data: Heterogeneous climate effect on crop yield and associated risks to water security in india,” 2023. [Online]. Available: https://doi.org/10.17632/ywp3y5j9vv.1

[7]

H. Sandberg, A. Teixeira, and K. H. Johansson, “On security indices for state estimators in power networks,” in Preprints of the First Workshop on Secure Control Systems, 2010.

[8]

J. M. Hendrickx, K. H. Johansson, R. M. Jungers, H. Sandberg, and K. C. Sou, “Efficient computations of a security index for false data attacks in power networks,” IEEE Transactions on Automatic Control, vol. 59, no. 12, pp. 3194–3208, 2014.

[9]

O. Kosut, L. Jia, R. J. Thomas, and L. Tong, “Malicious data attacks on the smart grid,” IEEE Trans. Smart Grid, vol. 2, no. 4, pp. 645– 658, 2011.

Ethics

[11] T. T. Kim and H. V. Poor, “Strategic protection against data injection attacks on power grids,” IEEE Trans. Smart Grid, vol. 2, no. 2, pp. 326–333, 2011.

All experiments use public datasets and controlled offline manipulations, and the artifact supports defensive auditing.

[12] F. Pasqualetti, F. Dörfler, and F. Bullo, “Attack detection and identification in cyber-physical systems,” IEEE Trans. Automatic Control, vol. 58, no. 11, pp. 2715–2729, 2013.

LLM Usage Statement

[13] H. Fawzi, P. Tabuada, and S. Diggavi, “Secure estimation and control for cyber-physical systems under adversarial attacks,” IEEE Trans. Automatic Control, vol. 59, no. 6, pp. 1454–1467, 2014.

LLMs assisted with artifact preparation and manuscript language editing.

[14] Y. Mo and B. Sinopoli, “On the performance degradation of cyberphysical systems under stealthy integrity attacks,” IEEE Trans. Automatic Control, vol. 61, no. 9, pp. 2618–2624, 2016.

7. Limitations and Conclusion

[10] R. B. Bobba, K. M. Rogers, Q. Wang, H. Khurana, K. Nahrstedt, and T. J. Overbye, “Detecting false data injection attacks on DC state estimation,” in Preprints of the First Workshop on Secure Control Systems, 2010.

[15] A. Teixeira, H. Sandberg, and K. H. Johansson, “Strategic stealthy attacks: The output-to-output ℓ2 -gain,” in 54th IEEE Conference on Decision and Control. IEEE, 2015, pp. 2582–2587. [16] D. I. Urbina, J. Giraldo, A. A. Cardenas, N. O. Tippenhauer, J. Valente, M. Faisal, J. Ruths, R. Candell, and H. Sandberg, “Limiting the impact of stealthy attacks on industrial control systems,” in Proc. ACM CCS, 2016. [17] A. Erba, R. Taormina, S. Galelli, M. Pogliani, M. Carminati, S. Zanero, and N. O. Tippenhauer, “Constrained concealment attacks against reconstruction-based anomaly detectors in industrial control systems,” in Annual Computer Security Applications Conference. ACM, 2020, pp. 480–495. [18] A. Erba and N. O. Tippenhauer, “White-box concealment attacks against anomaly detectors for cyber-physical systems,” in Detection of Intrusions and Malware, and Vulnerability Assessment, ser. Lecture Notes in Computer Science, vol. 13959. Springer, 2023, pp. 111– 131.

[33] J. M. Spring, A. Householder, E. Hatleback, A. Manion, M. Oliver, V. Sarvapalli, L. Tyzenhaus, and C. Yarbrough, “Prioritizing vulnerability response: A stakeholder-specific vulnerability categorization (version 2.0),” Carnegie Mellon University Software Engineering Institute, Tech. Rep., 2021. [34] O. Al Haddad, M. Ikram, E. Ahmed, and Y. Lee, “Prompting the priorities: A first look at evaluating LLMs for vulnerability triage and prioritization,” arXiv:2510.18508, 2025. [35] O. Sheyner, J. Haines, S. Jha, R. Lippmann, and J. M. Wing, “Automated generation and analysis of attack graphs,” in Proc. IEEE S&P, 2002. [36] S. M. Kay, Fundamentals of Statistical Signal Processing: Estimation Theory. Prentice Hall, 1993. [37] F. Pukelsheim, Optimal Design of Experiments. Society for Industrial and Applied Mathematics, 2006.

[19] J. Giraldo, D. Urbina, A. Cardenas, J. Valente, M. Faisal, J. Ruths, N. O. Tippenhauer, H. Sandberg, and R. Candell, “A survey of physics-based attack detection in cyber-physical systems,” ACM Computing Surveys, vol. 51, no. 4, 2018.

Appendix A. Proofs

[20] J. Shen, J. Y. Won, Z. Chen, and Q. A. Chen, “Drift with devil: Security of multi-sensor fusion based localization in high-level autonomous driving under GPS spoofing,” in Proc. USENIX Security, 2020.

A.1. Theorem 1: Harmful Blind Manifold

[21] Y. Cao, N. Wang, C. Xiao, D. Yang, J. Fang, R. Yang, Q. A. Chen, M. Liu, and B. Li, “Invisible for both camera and LiDAR: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks,” in Proc. IEEE S&P, 2021.

LM = {b ∈ Rm : GM (b) = GM (0)}.

[22] B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Šrndić, P. Laskov, G. Giacinto, and F. Roli, “Evasion attacks against machine learning at test time,” in Proc. ECML PKDD, 2013. [23] N. Carlini and D. Wagner, “Adversarial examples are not easily detected: Bypassing ten detection methods,” in Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, 2017, pp. 3–14. [24] A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in Proc. ICML, 2018.

Proof. Let

Since GM has constant rank rM near zero, the constant-rank level-set theorem makes LM a local manifold of dimension m − rM , with tangent space T0 LM = ker JM .

Every tangent vector is the initial velocity of a local curve in LM . When hM > 0, choose v=

Projker JM uM , hM

∥v∥2 = 1.

[25] F. Tramèr, N. Carlini, W. Brendel, and A. Madry, “On adaptive attacks to adversarial example defenses,” in Advances in Neural Information Processing Systems, vol. 33, 2020.

Along a curve with initial velocity v , the detector output remains constant, while the chain rule gives the task’s firstorder change:

[26] E. Wong and J. Z. Kolter, “Provable defenses against adversarial examples via the convex outer adversarial polytope,” in Proc. ICML, 2018.

d FM (b(t)) = u⊤ M v = hM . dt t=0

[27] J. Cohen, E. Rosenfeld, and J. Z. Kolter, “Certified adversarial robustness via randomized smoothing,” in Proc. ICML, 2019.

Reparameterizing by arc length gives the claimed unit-speed curve.

[28] T.-W. Weng, H. Zhang, P.-Y. Chen, J. Yi, D. Su, Y. Gao, C.-J. Hsieh, and L. Daniel, “Evaluating the robustness of neural networks: An extreme value theory approach,” in Proc. ICLR, 2018. [29] R. Wu and E. J. Keogh, “Current time series anomaly detection benchmarks are flawed and are creating the illusion of progress,” IEEE Trans. Knowledge and Data Engineering, vol. 35, no. 3, 2023. [30] S. Kim, K. Choi, H.-S. Choi, B. Lee, and S. Yoon, “Towards a rigorous evaluation of time-series anomaly detection,” in Proc. AAAI, 2022.

A.2. Theorem 3: Closed Form and MinimumEvidence Attack Proof. Because Ω ≻ 0, b⊤ AM b = ∥JM b∥2Ω−1 ,

ker AM = ker JM .

[31] FIRST, “Common vulnerability scoring system version 4.0: Specification document,” Forum of Incident Response and Security Teams, Tech. Rep., 2023. [Online]. Available: https://www.first.org/c vss/v4.0/specification-document

Blind case. Suppose z = Projker AM uM ̸= 0. Then 2 u⊤ z M = ∥z∥2 , so z b0 = ∥z∥22

[32] J. Jacobs, S. Romanosky, B. Edwards, I. Adjerid, and M. Roytman, “Exploit prediction scoring system (EPSS),” Digital Threats: Research and Practice, vol. 2, no. 3, 2021.

has u⊤ M b0 = 1 and JM b0 = 0. Hence ΓM = 0 when hM > 0.

Positive-margin case. If hM range(AM ). For every feasible b, †/2

=

0, then uM

∈

1/2

⊤ 1 = u⊤ M b = (AM uM ) (AM b)
1/2 ⊤
1/2 † ≤ u⊤ b AM b , M AM u M

where the inequality is Cauchy–Schwarz. Consequently,
−1 † b⊤ AM b ≥ u⊤ . M AM uM The vector b∗ (1) in Eq. (2) is feasible and attains this bound. Scaling it by ∆ gives the stated minimum-evidence attack for first-order task shift ∆.

A.3. Theorem 4: Local Frontier ∗ Proof. Write w∗ = b∗ (1), so u⊤ M w = 1. Upper bound. The inverse-function theorem applied to FM (tw∗ ) − FM (0) gives, for small ∆ > 0, a scalar

t(∆) = ∆ + O(∆2 )

such that

Appendix B. Realizable Telemetry Controls

FM (t(∆)w∗ ) − FM (0) = ∆.

Since C > ∥w∗ ∥2 , this attack also satisfies ∥t(∆)w∗ ∥2 ≤ C∆ for sufficiently small ∆. Taylor expansion then yields VM (∆) ≤ ∥GM (t(∆)w∗ ) − GM (0)∥Ω−1 = ∆ΓM + O(∆2 ).

Lower bound. Every feasible attack obeys ∥b∥2 ≤ C∆. Uniform C 2 Taylor bounds therefore give constants KF , KG for which 2 |u⊤ M b − ∆| ≤ KF ∆ , ∥GM (b) − GM (0) − JM b∥Ω−1 ≤ KG ∆2 .

By the definition of ΓM and the reverse triangle inequality, ∥GM (b) − GM (0)∥Ω−1 ≥ ∥JM b∥Ω−1 − KG ∆2 2 ≥ ΓM |u⊤ M b| − KG ∆ ≥ ∆ΓM − (KG + ΓM KF )∆2 .

Taking the infimum over feasible b proves VM (∆) = ∆ΓM + O(∆2 ).

A.4. Invariance and Monotonicity Invariance under a change of controls. Let b = ψ(c), where R = Dψ(0) is invertible. The Jacobian and task gradient in the new coordinates are JeM = JM R, u eM = R⊤ uM . The substitution b = Rc is a bijection between the linearized unit-effect feasible sets, and it preserves the detector evidence. Therefore the infimum in Eq. (1) is unchanged. Monotonicity under an added check. Suppose an independent check contributes BS ⪰ 0 to the information matrix. For every b satisfying u⊤ M b = 1, b⊤ (AM + BS )b ≥ b⊤ AM b.

Taking infima over the same feasible set shows that adding the check cannot decrease ΓM .

For channel j , let aj be the fractional gain, βj the normalized bias, and sj the training standard deviation of the channel’s cycle mean. The manipulated trace is ′ yjt = (1 + aj )yjt + sj βj .

When 1 + aj ≥ 0, the corresponding summaries transform as µ′j = (1 + aj )µj + sj βj , σj′ = (1 + aj )σj , (rj′ )2 = (1 + aj )2 rj2 + s2j βj2 + 2(1 + aj )sj βj µj .

Here rj denotes the root-mean-square (RMS) summary. The minimum and maximum obey the same affine transformation as the mean. The certificates use the derivative of this feature map at zero. Finite attacks and alarm evaluations instead use the exact map.

Appendix C. Numerical Robustness Certificate and derivative checks. Certificates are cross-checked against a constrained optimizer. MLP Jacobians are independently checked using central differences. Numerical sensitivity. On the linear crop audit, rank tolerances from 10−12 to 10−6 and diagonal shrinkage up to 10−2 produce the same six blind subsets. In the auditallocation study, identity, diagonal, and Ledoit–Wolf fullcovariance whitening give the same median numbers of verified failures: 10 25 50 100 Audit budget Median failures 4 9 13 15 Attack feasibility. Every returned matched attack satisfies its support and norm constraints. The maximum constraint residual is 2.22 × 10−16 .

Related documents

• Quantifying and Prioritizing Stealthy Source-Manipulation Threats Against Multi-Source Anomaly Detectors#1468017
• Analysis of Federated Aggregation under Model Poisoning and Backdoor Attacks: A Reconstructed Cross-Dataset and Cross-Architecture Benchmark#447890
• Leakage-free evaluation of task-aware Nyström sampling for IoMT intrusion detection.#1330064
• The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators#1118651
• Robust Unsupervised Network Intrusion Detection via Federated Learning with Selective Aggregation under Anomalous Sample Contamination#410993