Adversarial Process Disturbances at a Deployable Alarm Budget: Detector Evaluation on a Simulator and a Real Plant

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

1

Adversarial Process Disturbances at a Deployable Alarm Budget: Detector Evaluation on a Simulator and a Real Plant

arXiv:2610.38786v1 [cs.CR] 28 Oct 2026

Benjamin Blakely, Senior Member, IEEE

Abstract—Industrial anomaly detection is evaluated largely on simulators, and recent work reports large drops, with unstable rankings, on real plant data. We ask whether that extends to the security case. We evaluate eleven detectors across classical, neural, dependency and causal families on a simulated chemical process and a sodium thermal-hydraulic facility: different processes sharing no equipment, but both continuous, at steady state, and perturbed only through temperature, pressure, flow and valve, never composition. Three conditions prior work does not cover: disturbances authored against a threat model rather than native faults; one construction applied to both processes; and detection read at a declared false-alarm budget. The drop persists throughout. The simulator panel looks deployable, neural matching classical; on plant telemetry detection collapses and the neural family trails, a gap that in-sample thresholds likely understate. Which detector wins transfers between the two processes; how often it fires does not. Two results hold on both. Sequential valve manipulation defeats the whole panel: at tier 2 no detector flags more than 0.17 of its perturbed samples, against 0.89 or better for most disturbances. And the plant’s collapse is not merely that its disturbances are weaker, though they are by about twelvefold; matched on measured strength, the plant is never the better detected. Index Terms—Anomaly detection, industrial control systems, operational technology, evaluation methodology, process monitoring.

I. I NTRODUCTION† Cybersecurity anomaly detection for operational technology has largely inherited its methods, and its evaluation habits, from information technology. That inheritance has costs which the literature documents rather than disputes: regulatory qualification burden in safety-critical settings [1], [2], inference cost on embedded control hardware [3], [4], the scarcity of labeled This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible. B. Blakely is with Argonne National Laboratory, Lemont, IL 60439 USA (e-mail: bblakely@anl.gov). This work was funded by the U.S. Department of Energy, Office of Nuclear Energy, Advanced Reactor Safeguards and Security program, and was partially supported by the U.S. Department of Energy, Office of Science under DOE contract number DE-AC02-06CH11357. The submitted manuscript has been created in part by UChicago Argonne, LLC, operator of Argonne National Laboratory. Argonne, a DOE Office of Science laboratory, is operated under Contract No. DE-AC02-06CH11357. The U.S. Government retains for itself, and others acting on its behalf, a paid-up nonexclusive, irrevocable worldwide license in said article to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government. † AI-assisted content, in this and every section marked †; see the Acknowledgment [36]–[42].

incident data [4]–[6], and degradation when a model meets a process other than the one it was fitted to, which obliges the operator to retrain and requalify it there [7]–[11]. Those costs would pay for themselves if the added capacity bought detection performance where the detector is deployed. The difficulty is that most of the evidence that it does is produced somewhere the detector is not deployed. Simulators and public benchmarks dominate the evaluation literature, and the field already documents their weaknesses [5], [9], [12]– [14], while the relative ranking of methods is known to shift with the dataset [8], [9], [11]. The concern is not a new one: the simulated-to-real gap in industrial anomaly detection is an established result, benchmarked across thirty methods and three processes by Hartung et al. and described below [9], [15]. What is not established is whether it survives the conditions a security evaluation imposes. Three differences matter. First, the prior result uses each process’s own process faults; an adversary is not a fault, and a disturbance constructed to stay inside a plant’s admissible envelope is a different object from a valve sticking. Second, comparing one process’s faults against another’s leaves the disturbance and the telemetry varying together; applying one construction to both removes the disturbance design as a variable, though not the realized magnitudes, which each process’s own envelope sets. Third, performance was assessed with F1 and area under the precision–recall curve, which aggregate over thresholds an operator would never select. We therefore ask a narrower question than the prior work answered: does the transfer failure persist for adversarial disturbances, under an identical disturbance construction, at a false-alarm rate a control room could staff? 1 It does. A second question follows from it, and the two are separable: whether the detector ranking that holds under a threshold-free metric still holds at a budget an operator would actually choose. A companion technical report covers the corpus construction and the single-process results in more detail than is reproduced here [18]. Our contributions are four: 1) A tiered, physics-admissible disturbance framework with declared per-channel bounds, portable across process data models, which lets the same adversary model be 1 Adversarial here means attacker-authored within an admissibility envelope, not optimized against a deployed detector: an adversary who queries the detector or maximizes impact beneath its threshold [16], [17] is a stronger one than we instantiate, and Section VIII says so.

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

instantiated on two processes that share no equipment (Section IV). 2) Confirmation that the simulated-to-real transfer failure [9] extends to adversarial disturbances, under one disturbance construction applied to both processes rather than each process’s own faults (Section VI). 3) A separation between two things often reported together: the detector ranking transfers across the two processes, positively at every operating point examined, while the absolute detection rate does not (Section VI). 4) A disturbance no detector flags reliably per sample, on either process. At tier 2 none flags more than 0.17 of sequential valve manipulation’s perturbed samples, 0.10 on the plant and 0.17 on the simulator, where most disturbances have a detector at or above 0.89. Because it holds on both, it does not depend on either process being representative (Section VI). Read per episode rather than per sample the same cell reports alarms in 196 of 204, which is why the granularity has to be stated rather than assumed. II. BACKGROUND AND R ELATED W ORK† Multivariate statistical process monitoring. Process industries have monitored plants with multivariate statistics for decades. The procedure was established in the process-control literature by the early 1990s: project correlated sensor readings onto a low-dimensional subspace by principal component analysis (PCA) or partial least squares, fit that subspace to a reference period defining normal operation, and monitor new observations both within the subspace, by score statistics, and against it, by squared prediction error, with limits taken from the reference distribution [19]. That the approach remains in use at plant scale, and that fault isolation built on it is still current, is documented in reviews in the time since [20]–[22]. That tradition is the baseline here, not a contribution of this work. Learned detectors are the field’s center of gravity in industrial control systems (ICS) and cyber-physical systems (CPS) alike. Autoencoders, recurrent and convolutional reconstruction models, graph and transformer architectures have all been applied to industrial control and cyber-physical telemetry, and the surveys covering them are numerous enough to have their own review literature [4], [7], [10], [12], [23]. The case for them is a real one: they require no explicit model of the process, they capture nonlinear and temporal structure that a static projection cannot, and they have posted strong results on the standard benchmarks [24]. The question is not whether these methods work, but where the evidence that they work was collected. That evidence comes overwhelmingly from a small number of simulated and public benchmark datasets, and the field says so itself. Reviews of time-series anomaly detection report that evaluation protocols vary enough to make published numbers hard to compare, that benchmark datasets carry artifacts that inflate reported detection, and that fair comparison against classical baselines is scarcer than the volume of the literature suggests [14], [23], [25], [26]. Within industrial control

2

specifically, the same observation recurs, and authors routinely motivate their own contributions by it [15], [27], [28]. Where the comparison is made, the classical baseline is not reliably the weaker: Kravchik and Shabtai report PCA attaining high attack-detection rates across three public ICS datasets given appropriate preprocessing and feature selection, alongside the lightweight neural detectors that are the paper’s subject [29]. The result here is a similar finding on a real plant, at a declared operating point, against disturbances constructed identically for both processes. The papers cited observe the gap and use it to justify their own work; they do not jointly establish a quantitative claim about how large it is, and no argument here rests on one. The narrower question is what an aggregate score conceals at a fixed false-alarm budget. Simulated versus real evaluation. The closest prior work to this paper establishes the effect we observe. Hartung et al. benchmark thirty anomaly-detection methods (twenty-six deep and four classical) through one preprocessing, model-selection and evaluation pipeline, on the simulated Tennessee Eastman process and on two continuously operated pilot plants, and report average scores on real data far below those commonly published for the simulator, with no method consistently best and rankings that depend on both the metric and the process scenario [9]. On breadth of methods that result exceeds this one: thirty methods against eleven, and three facilities against our two processes. It is confined to native process faults and to threshold-free scoring, and that is the opening Section VI addresses. Real-plant evidence otherwise rests largely on public testbeds carrying deliberate attacks, chiefly SWaT, WADI and HAI [30]–[32]. Those are purpose-built and attacked by their own operators; the plant here is an operating facility whose record was not produced for a security study. III. T HREAT M ODEL† Our evaluation works by perturbation of collected benign data, and the tiers used throughout this paper are a property of what gets perturbed. We take telemetry recorded while a process ran normally, apply synthetic disturbances to it, and ask whether a detector trained on the unperturbed record flags the result. A disturbance is a named pattern (a sensor drifting, a valve sequence driven out of order, an oscillation induced in a control loop) intended to represent a prototypical cyber attack, realized as a modification to specific channels over a specific interval. Each one is generated at four severity tiers, and a tier is defined relative to what that process’s own telemetry and declared bounds permit rather than as an absolute magnitude. That relative definition is what lets the same disturbance be generated on two processes sharing no equipment. Section IV gives the construction; this section defines the adversary each tier corresponds to. We define the adversary by what they know, and map it onto the severity ladder. Table I gives the mapping. Its third column determines which rung a detector is the marginal control for and therefore which rung the results should lead with. A tier is a probability distribution over magnitudes, not a range of them. T1 through T3 draw from the same per-

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

TABLE I A DVERSARY KNOWLEDGE BY TIER , AND THE CHEAPEST CONTROL THAT DETECTS IT. Tier

Adversary knows

Caught by

T1

the observed telemetry envelope

nothing cheaper at a comparable alarm rate nothing cheaper at a comparable alarm rate a limit alarm, for the disturbances that leave the range a limit alarm in unbounded mode, again only for those

T2

process physics and channel coupling

T3

physics; willing to sit at the declared limits

T4

nothing (unconstrained control condition)

TABLE II T HE ELEVEN DISTURBANCES . T HREE CANNOT BE BOUND ON THE SIMULATOR , WHICH HAS NO EQUIPMENT TO FILL THEIR SLOTS . FDI IS FALSE - DATA INJECTION . Disturbance

What it does

Coordinated thermocouple

moves several thermocouples together so the spatial pattern stays plausible reports a valve state its position feedback does not support drives values outside physical possibility; positive control at T3 and T4

Phantom valve Physics violation Flow oscillation Operator mimicry Oscillatory instability

channel range and differ only in where the weight sits inside it, so their draws overlap and a single T1 draw can exceed a single T3 one. What separates them is how much exposure the adversary will accept: T1 keeps the disturbance where normal operation already sits, T2 spreads the impact outside historical observations while remaining inside the declared bounds, T3 pushes probability mass to those bounds, and T4 alone widens the range past them. Section IV gives the parameterization. T1 is by construction hard to separate from observed variation, since its distribution was fitted to that variation. T3 and T4 concentrate at or beyond the declared limits, where a plant’s own limit alarm is the relevant control for the disturbances that actually leave the range, though the limit-alarm check below finds that is fewer of them than the tier label suggests. T2 is the tier whose draws are routinely far from normal operation and, by construction, never outside the physics: nothing simpler than a model of normal behavior has anything to trip an alarm. IV. M ETHOD† Both processes are read through one telemetry schema modeled on ISA-95 and the OPC Unified Architecture (OPC UA) information model, with a per-process adapter converting from the native format on ingest. Every stage downstream of ingest (perturbation, detection, scoring) sees only the unified form and contains no process-specific branch. If each process carried its own field names and grouping, a difference in detection could be attributed to the data model instead of to the data, and there would be no way to separate the two from the outside. Placing the only process-specific code at ingest makes the rest of the pipeline provably identical across the two. Disturbance construction. A disturbance function is authored once and applied to each process’s recorded telemetry, which is what allows the same one to run on two plants sharing no equipment. It has three parts. The first is a set of slots: the parts an instrument plays in that disturbance, named by function rather than by tag. A flow-oscillation disturbance, for example, declares a slot for the flow it oscillates, one for a pressure that should respond, and one for a pump signal that should not. Slots are filled per process from a registry of instrument roles, written in the same ISA-95 vocabulary as the telemetry schema: seventy-six roles

3

Physics consistent Precision trust decay Replay FDI Sensor drift Sequential valve

induces an artificial oscillation in flow channels small, infrequent setpoint changes, each plausible as operator action drives a control loop toward unstable behavior moves coupled channels together so the physical relations still hold degrades sensor precision and injects noise over time replays an earlier window of readings in place of live ones slow drift combined with intermittent dropouts a timed sequence of valve changes that violates normal procedure

Sim.

✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓

are declared for the real plant and fifty-five for the simulator, and a per-process binding file maps each slot to the roles that can fill it. A disturbance whose slots cannot all be filled does not run there, which is why three of the eleven are structurally absent on the simulator rather than merely not evaluated. Table II lists the eleven and what each does. They are not invented for this study: each is derived from a control flaw identified by a systems-theoretic process analysis of the facility [33], in the security-extended form that treats a compromised controller or sensor as one more way for a control action to be unsafe [34]. The companion report gives the flaw-byflaw mapping [18]. Between them the eleven reach the sensor side and the actuator side, single instruments and coordinated groups, and they are deliberately uneven in subtlety: one is a positive control that puts values outside physical possibility, while others are built to survive an operator’s inspection. The second part of the disturbance function is a transform, drawn from a library of eighteen primitives: offsets and scalings, oscillation, replay of an earlier window, delay, injected noise, degraded precision, dropped or suppressed updates, spikes, state toggles, and propagation of a change along a declared physical relationship. A disturbance is one or more of these applied to its filled slots. The third part is the magnitude, which is where the tiers enter. Each slot names a magnitude reference, a channel whose envelope statistics set the scale for that slot, so a disturbance asks for a deviation sized to the instrument it is perturbing rather than an absolute value carried over from wherever it was authored. The admissibility envelopes below give how a tier turns that reference into a number, and the tiering rules how magnitude, rate and duration compose. Admissibility envelopes. An admissibility envelope records, per channel, the range that channel has been observed to

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

TABLE III T HE TIERS AS INPUTS TO (1)–(2), FOR ONE SIMULATOR CHANNEL WITH MEAN AT 0.551 OF ITS DECLARED RANGE . α AND β ARE THAT CHANNEL’ S , NOT CONSTANTS OF THE TIER . Tier

Target variance σ⋆2

T1 T2 T3 T4

σ 2 , the channel’s own (1/6)2 shape set directly as T3, range widened

α

β

53.63 4.36 0.44 0.42

43.73 3.55 0.36 0.38

occupy and a ceiling above it. Bounds come from a declared source where one exists and from the channel’s own observed statistics otherwise. The envelope is the only place a disturbance learns how far it may move a given signal, and it is what turns a tier into a number. Write ℓ and S for the lower bound and width of a channel’s declared range, and µ and σ for its mean and standard deviation as fractions of that range. Every tier draws from: x = ℓ + S b,

b ∼ Beta(α, β),

(1)

and the tiers differ only in how they set (α, β). T1 and T2 match moments to a target variance σ⋆2 :   µ(1 − µ) − 1, ν α = µν, β = (1 − µ)ν, ν = max 0 , σ⋆2 (2) taking σ⋆2 = σ 2 for T1 and the channel-independent σ⋆2 = (1/6)2 for T2. The concentration ν = α + β is what the target buys: the variance is µ(1 − µ)/(ν + 1), so tiers loosen as ν falls. The floor ν0 (2 for T1, 1 for T2) prevents a degenerate draw. T3 and T4 set the shape directly instead, at α = max(0.8µ, 0.1) and β = max(0.8(1 − µ), 0.1). Both parameters fall below one on any channel, inverting the curve so mass collects at the two ends rather than the middle. They differ only in range: T4 widens it to [ℓ − 10σS, ℓ + S + 10σS] and recomputes µ within it, which is the only way a draw can leave the declared bounds. Because µ enters both parameters, a tier fixes a rule rather than a shape: the curve leans toward the end each channel normally operates near, so the same tier means a different absolute magnitude on every one. That is what makes a single disturbance construction comparable across processes sharing no equipment. A disturbance whose signature is a rate rather than a displacement draws from a ladder built the opposite way around: the shape stays a symmetric bell (α = β = 2) and the support expands, reaching at T1 through T4 the channel’s observed 99th percentile, its observed maximum, the declared ceiling, and that ceiling plus ten rate standard deviations. Both the range and that ceiling are therefore per channel, and they have to be: a global constant gives every channel the same admissible interval, which is defensible only where every channel measures the same quantity in the same units. The simulator is not such a case – its per-channel rate ceilings span a factor of 5,201, from 0.053 to 275.67 per second, across kscmh/s, kPa/s, mol%/s and %/s – and under one ceiling T3 and T4 would key off the same scalar and stop differing. An envelope that hard-codes one process’s answer is silently

4

wrong on the next rather than visibly absent. Section VIII states how much of each process’s envelope is independently sourced and how much is empirical. Tiering and clamping. A disturbance is realized by drawing a magnitude from that channel’s tier distribution and applying the transform. Timing is not derived from that magnitude: each primitive carries its own base duration – an outage length, a replay window, a toggle interval – scaled by a per-tier severity factor, since a blackout and a drift share no unit in which one duration rule could be written. Once a magnitude is drawn, the disturbance can meet the envelope in two ways. In bounded clamping mode every perturbed value is checked against its channel’s admissible support. At T4 a value outside that support is clamped back inside, and that clamp is the contrast the mode exists to create. At T1, T2 and T3 a value outside it means the tier contract is broken rather than that something needs correcting, so generation halts, the exception being a channel whose baseline leaves no admissible room for the draw at all, which is clamped and counted separately. In unbounded mode none of this runs. Every detector result reported here is bounded, the limitalarm baseline of Section VI excepted for the reason given there, because bounded is the mode in which the tier definitions are enforced rather than merely intended: a T1 corpus generated unbounded carries no guarantee of admissibility, the one property T1 is named for. Not hypothetically – the check, once reachable, found tier-1 draws outside the envelope on four of the eleven disturbances, from generators deriving a magnitude on one channel’s scale and applying it to another. The choice costs something at T4, the only tier whose draws are meant to leave the admissible range. The plant was run both ways. Comparing the two arms there, the clamp alters 15.8% of modified values at T4 against about 5% at T1 and T2, so T4 keeps most of its excursion rather than collapsing onto T3, but it is a softer positive control than the unclamped definition describes. The choice does not move the results, which Section VI reports. The simulator was run bounded only, and the asymmetry is in what the two processes can bound against. The plant’s severe tiers are set against declared engineering limits, so removing the clamp there means exceeding a limit that exists independently of the data. The simulator has no such limits available: apart from two channels with documented operating constraints, its tier-3 and tier-4 ceilings are derived from the simulator’s own observed behavior, at twice each channel’s measured maximum. Unclamping against a ceiling computed from the same record would not test what unclamping tests on the plant, so the arm was not generated. The cross-process comparison is bounded on both sides. Detector suite and fairness protocol. Eleven detectors span four families. The classical family is Hotelling’s T 2 , PCA reconstruction, isolation forest and change-point detection. The neural family is an autoencoder and a long short-term memory (LSTM) forecaster. The dependency family is a Bayesian network and a correlation and Granger-based dependencyviolation detector. The causal family is DYNOTEARS, NTSNOTEARS (nonlinear time-series NOTEARS) and PCMCI+,

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

a constraint-based conditional-independence method. Appendix A gives each configuration. All eleven see the same preprocessed corpus and the same splits, and none is tuned per disturbance, per tier or per process. Each trains only on unperturbed data from its own process. Six have a random step in their scoring path and are replicated across seeds; the other five are deterministic and run once, since replicating them would measure nothing. Replication is complete on the real plant, where all six run at five seeds. On the simulator it is not: four of the six run at five seeds and DYNOTEARS and PCMCI+ at one. That gap is an artifact of what was run rather than a design choice, and it is why the seed analysis in Section VI is reported for the real plant only. One asymmetry in the inputs survives. Four of the eleven detectors see fewer channels than the rest: the three causal detectors at 20 to 30 of that process’s channels, and the Bayesian network at 25. The causal detectors are capped because the cost of learning a graph grows steeply in the number of channels, steeply enough that full width was not affordable for all of them. Which channels they see matters: a capped detector that cannot observe the disturbed instrument scores zero by construction. Selecting the highest-variance channels admitted no commandable channel on this plant, so selection was changed to stratify by equipment group and assign round-robin. PCMCI+ did not complete even a 20-channel fit inside a thirty-minute cap, against fifty seconds for DYNOTEARS at the same width. We raised the two detectors that could be raised to the panel’s full width, reran them, and measured what the cap had been costing; Section VI reports the answer. PCMCI+ and the Bayesian network were not raised, so their results stand at a reduced budget whose cost is unmeasured. Evaluation protocol. Detection is reported as true-positive rate (TPR) at a declared false-positive rate (FPR) budget, not as area under the receiver operating characteristic curve (ROC, and AUC for the area under it). Both rates are per sample throughout: a TPR is the fraction of perturbed instants flagged, which is not the same as the fraction of disturbances noticed, and the sequential-valve result below shows how far the two can diverge. Both the budget and the decision to report at it were fixed before any result was seen. This is not a departure from process-monitoring practice so much as a return to it. The founding reference in multivariate statistical process monitoring already frames the design problem as a tradeoff against alarm rate: too narrow a reference set and the procedure alarms too often, too wide and its sensitivity to abnormal operation is impaired [19]. Reporting at a declared budget makes that tradeoff explicit rather than integrating over it. Operating points are read off the ROC as the staircase it is. The false-positive rate jumps each time the threshold crosses another normal sample’s score, so the points a deployed threshold can occupy are the corners and nothing between them; we report the true-positive rate at the last corner inside the budget. Reading the sloped line a plotting routine draws between two corners instead reports a detector no threshold produces, and does so exactly where a tight budget falls,

5

since that is where the steps are widest. Computing AUC over those same connected corners is not inconsistent with this. An operating point is a configuration someone deploys; AUC is a summary over every threshold at once, equal to the probability that a perturbed sample outscores a normal one with ties counted as half, and the connecting segments are how that calculation handles ties. The budget is set from the sampling cadence rather than chosen for convenience, and both processes share it: the plant historian is resampled to a 30-second grid and the simulator’s 1 Hz output downsampled to the same, so a given false-positive rate is the same alarm load on each. A detector deciding once per thirty-second sample makes about 2,880 decisions a day, so a false-positive rate of 0.1% costs roughly three false alarms a day and 1% costs roughly twenty-nine. We report at 0.1% throughout and show 1% alongside it where the difference matters, so that the tenfold difference in alarm load stays visible instead of being integrated away. Three a day is a small enough load to argue about; what a particular control room will tolerate is a site decision, and what the cadence supplies is the conversion that lets a site make it. The budget is a ceiling on the alarm rate rather than a count of alarms. Some detectors score every sample; others score once per sliding window of samples, and on the same cell the LSTM emits about one score for every nineteen a per-sample detector emits. A detector that decides less often raises fewer alarms at the same false-positive rate, so the budget fixes where each detector sits statistically, not how many interruptions it causes. Those cells also rest on correspondingly fewer independent measurements. No adequacy threshold is applied to the detection rate. The budget is declared because it follows from the cadence, which is fixed before any result is seen; any line separating "adequate" from "inadequate" detection would instead be chosen after seeing the numbers. One property of the design bears directly on what the numbers mean. The evaluated window lies inside the training period rather than after it, so these are not measurements of temporal generalization. The estimand is a paired counterfactual: a perturbed window scored against the matched clean twin of the same period, by a model trained on unperturbed data that includes that period. That is the right comparison for the question asked here, which is whether a disturbance is distinguishable from the process’s own normal behavior, and it is the wrong one for asking whether a detector transfers forward in time. It does assume the paired period’s presence in training is not itself what produces the score, and because a high-capacity model fits its training data more tightly than a low-capacity one, that assumption bears unequally on the families being compared. In-sample optimism grows with the capacity to fit, so it favours the neural and causal detectors over Hotelling’s T 2 and PCA, which makes the family ordering reported here a lower bound on the gap rather than an estimate of it. That is a direction argued from how the detectors differ, not a measured correction; Section VIII says why a held-out block cannot settle it here.

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

V. E XPERIMENTAL D ESIGN† The real facility is a sodium thermal-hydraulic test loop with 143 channels; the simulated one is the Tennessee Eastman process (TEP), which is public, with 53. Eleven disturbances are scored on the plant in two clamping modes and eight on the simulator in one, giving 3,080 and 864 scored cells; the cross-process comparison is the eight-disturbance bounded intersection. Pairing a chemical process with a sodium loop invites the objection that the two are not comparable at all. What is compared is narrower than the processes. Across the eight shared disturbances, every channel perturbed on either side is a temperature, pressure, flow or valve position, and not one is a composition measurement: the simulator’s eleven feed, purgegas and product analyzers, which are what make it distinctively a chemical process, are never touched. Its perturbed channels include the reactor and condenser cooling-water loops. That is a flow driven to remove heat, read through temperature and flow, which is functionally the element the plant consists of. The chemistry is not in the comparison; the thermal-hydraulic instrumentation both processes carry is. What the argument uses from the real facility is its channel count, its instrument families and the disturbances its topology admits. The plant description, instrumentation inventory and pipeline schematic are in the companion technical report [18]; no argument here depends on them. Three of the eleven disturbances cannot be expressed on the simulated facility at all: it has no thermocouple gradients, no valve position transmitters and none of the cold-trap auxiliaries the remaining three target. They are structurally absent, not unrun, and we report that gap in the panel instead of working around it. Every run is executed in a pinned container, seeded, and recorded with the commit that produced it. Each stage writes under a version identifier hashed from its own version and configuration, and each scored cell records fingerprints of the input it read and the corpus that input derived from, so a cell reusing a corpus built under a superseded envelope is visible rather than producing a plausible number nothing would flag. That is what lets us assert every cell behind Section VI read the corpus for the process currently selected. The plant record is segmented into operating regimes before anything else runs, to establish the study’s scope by measurement rather than assuming it. The procedure fixes no thresholds by hand: it segments the record by changepoint detection on per-channel z-score, volatility and rate of change, clusters the segments with the cluster count chosen by Bayesian information criterion, and labels each cluster by its nearest archetype among steady state, transient, startup, shutdown and trouble, or unknown where none wins by a margin. A segment containing an operator setpoint change is labeled transient regardless of where it clusters. Of 2,796 labeled segments, 96.4% are steady state and 3.4% transient, with no startup, shutdown or trouble segments at all. These results therefore describe a process observed almost entirely at one operating point, with the consequences taken up in Section VII.

6

The labels describe the record; they do not select from it. Detectors train on the full unperturbed history and the negative class is sampled from it without regard to regime, which is deliberate rather than an omission: a detector trained only on the most common regime learns to flag the rarer ones as anomalous, and would then appear to detect any disturbance that happened to land in a transient window. Admitting every regime costs some sharpness in the baseline and removes that confound. VI. R ESULTS† The panel on a simulated process. Read the right-hand block of Table IV alone and the panel looks deployable. At an alarm rate a control room could staff, the classical family reaches the ceiling on most disturbances and the neural family matches it on several. This is the result that conventional evaluation practice would produce, and it would support the conclusion that model capacity is both affordable and effective, now under adversarial disturbances rather than the native process faults of the prior benchmark [9]. The same panel on real plant telemetry. The left-hand block is the same pipeline, the same disturbance construction, the same tiers and the same budget. What differs is the telemetry and the per-channel envelopes drawn from it, the control the prior comparison could not have, since each process there contributes its own faults, so disturbance and telemetry vary together. Detection collapses, and the relationship between families inverts: here the neural family trails the classical one rather than matching it, exceeding a true-positive rate of 0.10 on one disturbance out of eleven. The direction reproduces [9] on a different pair of processes, a different disturbance class and a different metric. Figure 1 shows the full ladder at every budget, with curves drawn faint where few independent measurements stand behind them. Results are reported at tier 2 throughout, for the reason Section III gives, but the ladder supports one further observation. Detection rises across the ladder for nine of the eleven detectors on the real facility, in the sense that tier 4 exceeds tier 1; seven of those nine are monotone, and the two that are not (change-point detection and NTS-NOTEARS) dip once before recovering. The remaining two detectors are flat rather than inverted. The ladder therefore largely behaves as constructed under that metric. It is not uniformly monotone at the operating points: over the five budgets and eleven detectors, 13 of the 55 detector-budget curves reverse somewhere on the plant and 9 of 55 on the simulator, mostly by less than the seed spread of the replicated detectors. Monotonicity is therefore a property of the ladder overall rather than a guarantee for every detector at every budget. It rules out one alternative explanation: the collapse at tier 2 on plant telemetry is not the disturbances failing to disturb at all, because the same construction at tiers 3 and 4 is detected by the same detectors on the same data. That is an argument about order within one process and says nothing about whether a tier delivers the same disturbance on both, which the disturbance-strength check measures separately and answers in the negative. What survives the disagreement. Doubt that a simulator stands in for a plant discounts the simulator result; doubt that

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

7

TABLE IV B EST DETECTION WITHIN EACH FAMILY, AT TIER 2 AND A 0.001 FALSE - POSITIVE BUDGET. C LS = CLASSICAL , N EU = NEURAL , D EP = DEPENDENCY, C AU = CAUSAL ; FDI = FALSE - DATA INJECTION . FAMILIES ARE UNEQUAL AT FOUR , TWO , TWO AND THREE MEMBERS , SO A BEST- OF FAVOURS THE LARGER . ‡ MARKS A MEDIAN THAT MOVES BY MORE THAN 0.06 ACROSS SEEDS . Real plant

Real plant bounded

TEP simulator

Disturbance

Cls

Neu

Dep

Cau

Cls

Neu

Dep

Cau

Coordinated thermocouple Flow oscillation Operator mimicry Oscillatory instability Phantom valve Physics consistent Physics violation Precision trust decay Replay FDI Sensor drift Sequential valve

1.00 0.04 1.00 0.79 0.01 1.00 1.00 1.00 0.00 1.00 0.10

0.02 0.00 0.03 0.00 0.01 0.02 0.76‡ 0.00 0.00 0.02 0.00

0.00 0.00 0.74 0.03 0.00 0.02 0.01 1.00 0.00 0.02 0.00

1.00 0.09 0.05 0.89 0.00 0.89‡ 0.05 0.00 0.00 0.36 0.00

— 1.00 1.00 1.00 — 1.00 — 1.00 0.02 1.00 0.17

— 0.50 0.91 1.00 — 0.12 — 1.00 0.00 1.00 0.03

— 0.93 0.73 1.00 — 1.00 — 1.00 0.08 1.00 0.12

— 0.70 0.00 1.00 — 0.00 — 1.00 0.00 1.00 0.00

per-sample TPR vs FPR budget. Dotted rules mark the 0.1% and 1% budgets. Faint curves: one result per batch of readings, so few results behind the rate 1.0

T1

within observed envelope

T2

outside observed envelope, inside declared bounds

T3

could be off by more than 0.05. ran at 20-30 of 143 channels. PCMCI+ omitted: only one usable point on its curve.

approaching physical limits

T4

beyond physical limits

median per-sample TPR

0.8 0.6 0.4 0.2 0.0 10 4

10 3

FPR budget

10 2

10 1 10 4

10 3 CPD

TEP simulator bounded

T²

FPR budget IF

10 1 10 4

10 2 PCA

AE

10 3

LSTM

DV

FPR budget BN

per-sample TPR vs FPR budget. Dotted rules mark the 0.1% and 1% budgets. Faint curves: one result per batch of readings, so few results behind the rate 1.0

T1

within observed envelope

T2

outside observed envelope, inside declared bounds

T3

10 1 10 4

10 2

DYN

10 3

FPR budget

10 2

10 1

NTS

could be off by more than 0.05. ran at 20-30 of 53 channels. PCMCI+ omitted: only one usable point on its curve.

approaching the declared ceiling

T4

beyond the declared ceiling

median per-sample TPR

0.8 0.6 0.4 0.2 0.0 10 4

10 3

FPR budget

10 2

10 1 10 4

10 3 CPD

T²

FPR budget IF

10 1 10 4

10 2 PCA

AE

LSTM

10 3 DV

FPR budget BN

10 1 10 4

10 2

DYN

10 3

FPR budget

10 2

10 1

NTS

Fig. 1. Per-sample detection against false-alarm budget, plant above and simulator below, by tier; rules mark the 0.1% and 1% budgets. CPD change-point detection, IF isolation forest, AE autoencoder, DV dependency violation, BN Bayesian network, DYN DYNOTEARS, NTS NTS-NOTEARS.

one sodium loop is typical discounts the plant result. Either objection sets the central comparison aside. One result survives both objections, because it holds on both processes. Most disturbances in Table IV are caught outright somewhere in the panel: five of the eight run on both processes have a detector at 0.89 or above on each. Sequential valve manipulation has none. Its best is 0.10 of perturbed samples on the plant and 0.17 on the simulator, so it stays low on the process where the panel otherwise does well as much as on the one where it does not. A rate of 0.10 sounds like the disturbance goes unnoticed. It does not, and the reason is that it runs in bursts rather than continuously. Sequential valve manipulation is active for 1.1% of the record, spread over 204 separate episodes. An episode averages 51 samples, about twenty-five minutes. A detector flagging a tenth of the samples in an episode therefore raises about five alarms inside it, which is enough to be seen. The

same detector at the same threshold raises at least one alarm during 196 of the 204. The control is the clean stretch of the same cell, cut into 644 windows of that same length. Two of them contain an alarm. The detector is not simply quiet on clean data: it fires 31 times across 32,887 clean samples, which is the full 0.1% budget. All 31 fall inside those two windows. False alarms come in bursts as well, which is why only two windows are affected instead of the thirty an even spread would hit. Two is therefore a loose bound rather than an estimate: a few bursts landing differently would change it severalfold. An operator watching this detector is alerted during almost every episode, while anything reading one sample at a time sees nine out of ten perturbed samples go unflagged. Both are true, and which matters depends on what is being asked. The measurement covers one cell, the panel’s best detector on the plant at tier 2, so it is not a second panel-wide result; what it rules out is that the flagged samples pile into a few episodes

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

8

TEP simulator bounded per-sample TPR at FPR 0.001 T2 outside observed envelope, inside declared bounds

.00

.99

.01

.03

.74

.01

.05

.00

osc_instab

.39

phantom_valve phys_consist

1.00

.00

.01

.01

.01

.00

.00

.00

.00

.01

1.00

.02

.00

.00

.02

.89

.00

phys_viol

.00

.06

.02

1.00

.76

.07

.00

.01

.05

.00

prec_trust

1.00

1.00

.05

.52

.00

.00

.00

1.00

.00

.00

.00

.00

.00

.00

.00

.00

.00

.00

1.00

.01

.98

.02

.01

.00

.02

.36

.00

seq_valve

.01

.00

.00

.10

.00

.00

.00

.00

.00

.00

ran at 20-30 of 143 channels, unlike every unmarked detector hatched: one result per batch of readings, so few results behind this rate

0.6

0.4

0.2

0.0

S

.00

.01

LS

.00

CP

replay_fdi sensor_drift

NT

.00

.00

DY N

.00

BN

.02

DV

.89

TM

.03

AE

.00

A

.00

PC

.00

IF

.53

T²

.01

D

.79

0.8

could be off by more than 0.05

1.00

.37

.99

op_mimicry

.00

osc_instab

1.00

1.00

.93

1.00

1.00

1.00

1.00

phys_consist

.00

1.00

.11

1.00

prec_trust

1.00

1.00

1.00

replay_fdi

.00

.00

sensor_drift

.14

seq_valve

.13

.50

.00

.93

.73

.91

.00

.73

.00

.00

1.00

1.00

.00

1.00

1.00

1.00

.06

.12

.00

1.00

.00

.00

1.00

1.00

1.00

.00

1.00

1.00

.43

.00

.02

.00

.00

.00

.08

.00

.00

1.00

1.00

1.00

1.00

1.00

.00

1.00

1.00

1.00

.01

.00

.00

.17

.03

.00

.00

.12

.00

.00

ran at 20-30 of 53 channels, unlike every unmarked detector hatched: one result per batch of readings, so few results behind this rate

.70

1.0

.00

0.8

median per-sample TPR at FPR 0.001

1.00

1.00

0.6

0.4

0.2

0.0

S

.00

flow_osc

NT

op_mimicry

1.0

DY N

.00

BN

.00

.09

DV

1.00

.00

TM

.00

.00

LS

.00

.00

AE

.02

.00

A

.02

.04

PC

.95

.01

IF

.02

.01

T²

1.00

.00

CP

1.00

flow_osc

median per-sample TPR at FPR 0.001

coord_thermo

D

Real plant bounded per-sample TPR at FPR 0.001 T2 outside observed envelope, inside declared bounds

could be off by more than 0.05

Fig. 2. Per-detector detection at tier 2 and a 0.001 budget, plant left and simulator right, grouped by family. Cells are per-sample rates: dark means few perturbed instants flagged, not that the disturbance passed unnoticed. Abbreviations as in Fig. 1.

and the rest pass in silence. A detector can only see what it measures. A second result holds on both processes. Change-point detection works from how fast each channel is changing: it scores a weighted sum of the first difference, the second difference and a rolling variance (Table VII). Two of our disturbances never change that quantity, and the detector misses both. Figures here are AUC rather than the true-positive rate used elsewhere: what is at issue is whether the detector separates the classes at all, and a detector at chance has no operating point worth reading. The first is a constant offset. Shifting a channel by a fixed amount moves every sample equally, so the differences between consecutive samples stay exactly as they were. Physicsconsistent manipulation applies such an offset, and changepoint detection reads an AUC of 0.500, chance, on the plant and on the simulator, at all four tiers, even though the offset grows severalfold from the weakest tier to the strongest. The second is saturation. Physics violation pins sensors to a fixed value, and a pinned sensor stops changing altogether. It is therefore calmer than a healthy channel, which always carries some noise. The detector ranks it as less suspicious than normal data, giving an AUC of 0.432 to 0.437: below chance, not at it. This is specific to what the detector measures rather than a general weakness. The same detector reaches 1.000 on three other disturbances and 0.85 on sequential valve manipulation, where most of the panel does much worse. On physics violation, change-point detection is the only one of eleven detectors below chance at every tier; NTSNOTEARS dips below at two of four and recovers to 0.96 at tier 4, where change-point detection stays flat. The level-based detectors are unaffected: PCA reconstruction reads 0.9999, Hotelling’s T 2 0.9918 and the autoencoder 0.9916. A sensor frozen far from its normal value is obvious to a detector that compares levels and invisible to one that compares consecutive samples. Both gaps can be predicted from the scoring rule without running anything, so any detector built on rates of change will share them.

TABLE V R AISING THE CAUSAL DETECTORS FROM A REDUCED CHANNEL BUDGET TO PARITY WITH THE REST OF THE PANEL . ∆ AUC Detector DYNOTEARS NTS-NOTEARS PCMCI+

Plant

TPR cells better/worse TEP

Plant

TEP

+0.009 +0.000 12/39 6/0 +0.084 +0.069 12/10 12/5 not raised to full width; see the detector suite

Our cost comparison points away from structure learning, and the overall result invites the conclusion that a few classical detectors are enough. That conclusion is safe only if the detectors kept do not all measure the same kind of quantity. A detection rate averaged over disturbances would not show the difference, because the disturbance one detector cannot see is one another catches perfectly. Table V reports what the reduced channel budget of the detector suite was costing the two causal detectors that could be raised out of it. Every comparison is paired per cell on mode, disturbance and tier: pooling the cells instead and comparing a before median against an after median can show movement when no individual cell has changed, and on these data it does. At the operating point, giving these detectors more channels helps on the simulator and does not help on the plant. On the simulator DYNOTEARS improves in 6 of its 32 cells and degrades in none, and NTS-NOTEARS improves in 12 and degrades in 5. On the plant DYNOTEARS degrades in 39 of 88 cells and improves in only 12, while NTS-NOTEARS is a wash at 12 against 10. That is the same split as the main result, produced by varying something with nothing to do with detector family. The counts carry it rather than the central estimate, because the paired medians are all within 0.001 of zero. Under AUC the same experiment says something else. Raising NTS-NOTEARS to full width improves its AUC on both processes, by a paired median of +0.084 on the plant and +0.069 on the simulator, and DYNOTEARS barely moves

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

TABLE VI R ANK CORRELATION BETWEEN THE PROCESSES , BY OPERATING POINT. ρ IS S PEARMAN ’ S , τb K ENDALL’ S TIE - CORRECTED COEFFICIENT, AND THE INTERVAL A PERCENTILE BOOTSTRAP OVER DISTURBANCES . n IS THE DETECTORS RANKED : ELEVEN UNDER AUC, TEN WITH A RESOLVABLE OPERATING POINT BELOW. Metric

n

ρ

τb

95% CI on τb

AUC TPR at FPR = 0.001 TPR at FPR = 0.005 TPR at FPR = 0.010 TPR at FPR = 0.020 TPR at FPR = 0.050

11 10 10 10 10 10

0.782 0.644 0.596 0.644 0.806 0.745

0.527 0.494 0.405 0.539 0.689 0.511

[+0.18, +0.75] [+0.12, +0.74] [+0.09, +0.76] [+0.03, +0.73] [+0.07, +0.87] [+0.02, +0.69]

on either (+0.009 and +0.000). Read that way the channel budget shows no process split at all. Which conclusion the experiment supports depends on which metric is read. That is a disagreement local to this experiment rather than a property of the two measures in general: the transfer result finds them agreeing on rank transfer. Transfer of the ranking. Table VI ranks the eleven detectors best to worst on each facility and compares the two orderings, at every operating point and under AUC. Spearman’s ρ and Kendall’s τb are both 1 if the orderings agree exactly, 0 if unrelated and negative if inverted. Both are reported because at a tight budget most plant detectors sit at or near zero, and ρ overstates agreement on a largely tied vector. The b in τb is that correction: pairs tied on either process are excluded from the count of agreements and discounted in the normalising total, instead of being credited as agreement. It is the lower of the two throughout. Two questions follow: how uncertain those coefficients are, and whether they could arise by chance. Each detector’s entry is already a median over the eight disturbances both processes share, so what would differ on a repeat of this study is which disturbances were drawn, not which detectors. The intervals therefore resample disturbances. A Fisher-z interval would instead treat those medians as exact and the eleven detectors as the sample, describing uncertainty about a population of detectors we did not draw from. Every interval excludes zero. The five budgets read the same curves at five points, so they are not five independent tests and are not assessed as five. Shuffling which detector is which, with the same shuffle applied at every budget, puts the observed mean τb of 0.53 at p = 0.010. Computed separately for each of the eight disturbances rather than over pooled medians, τb is positive in all eight. This is where our result and the nearest prior work part company. Hartung et al. report rankings that shift with both metric and scenario [9]; we find a rank correlation that stays positive across two processes at every operating point examined, though never a preserved ordering: at τb near 0.5 about a quarter of detector pairs still swap. The designs differ in a way that predicts the difference: their rankings move across scenarios, each process contributing its own faults, whereas one construction is applied to both processes here, so what varies is the telemetry and not the disturbance. Our own data carry the second half rather than inheriting

9

it. Comparing detector orderings between two disturbances within one process, at the same budget and on the same perdisturbance basis as the cross-process figure, the median τb is 0.115 on the plant and 0.302 on the simulator, against 0.468 across processes. A ranking is thus more stable under a change of plant than under a change of what is being detected, which is the reverse of the expected robustness order, and it reconciles the two papers: their rankings moved because their scenarios did. The ranking, then, largely transfers even where the detection rate does not. Which detector will be relatively stronger on the other process is predictable from this one; how well it will actually do there, as the two process results above show, is not. Those are compatible and separately useful, and the second does not follow from the first: a panel can keep its internal order across a move that costs every member most of its detection rate. How far the estimates can be pushed is limited by the panel. Ten or eleven detectors is a small sample for a rank statistic, the intervals all overlap, and the ordering across budgets carries no information: what the table supports is that the correlation is positive throughout, not any particular value at any particular budget. PCMCI+ is ranked under AUC and held out of the operating-point rows, because it produces about eleven distinct scores across twenty-two thousand baseline points: enough for a full curve, but leaving it essentially one usable vertex at a tight budget, where its rank would report where those few steps happen to fall. Figures 1 and 2 exclude it on the same grounds. Including it lowers ρ at the three tightest budgets, to 0.466, 0.392 and 0.465, and raises it at the two loosest, to 0.664 and 0.809; every estimate stays positive, so the exclusion changes the size of the correlation rather than its sign. Robustness checks. Five checks bear on whether the result above is an artifact of the measurement rather than of the data. Four use the real facility alone, where the seed and mode replication exists; the disturbance-strength check compares the two. Seed variation. On the real plant, where the replication is, six detectors have a random step in their scoring path and are run at five seeds; the other five are deterministic and are run at one. We report the latter as not applicable rather than as a standard deviation of zero, because replicating a detector that cannot vary measures nothing and a printed zero would read as the most stable result in the table. One detector separates sharply from the others. NTS-NOTEARS averages an acrossseed standard deviation of 0.060 in AUC and reaches 0.149 in its worst cell, three to thirty times every other replicated detector, and its results should be read with that in mind in the tier ladder and the channel-parity counts above, the two places they bear on an argument. The remaining five sit at or below 0.019, smaller than any difference this paper rests an argument on. Five seeds can show that a detector varies; they cannot show that one does not. A spread as large as NTS-NOTEARS’s is hard to draw by chance five times over, so its instability is established, and its contribution to any result here could be an accident of its seed. A small spread is consistent with a

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

larger one that five draws happened to miss, so the other five are bounded loosely rather than shown to be stable. Those figures are AUC, while results are reported at an operating point, and the two disagree. Over all 264 replicated cells the operating point looks the more stable (0.0004 against 0.0103), but that is a floor effect: 61 cells return zero at every seed and a statistic pinned at zero cannot vary. Over the 64 cells that detect anything here, a median TPR above 0.05, the ordering reverses to 0.0440 against 0.0167, a TPR at a tight budget being one vertex of a step function that jumps where the area barely moves. An AUC-based seed check therefore understates sensitivity where detection is happening. Two medians behind Table IV inherit it and are marked there; no other reported cell moves by more than 0.06. Both are among the strongest non-classical results on the plant, so the instability qualifies the family comparison rather than supporting it. The cheaper control. Table I claims a limit alarm handles the severe tiers, and that claim is what makes tier 2 the tier worth reporting, so we measured it rather than asserting it. Scoring a limit alarm as a detector, on the same per-sample basis as the panel, physics violation is flat at 0.157 through tier 2 and rises to 0.667 and 0.821 at tiers 3 and 4, which is the behavior the table describes. Across the panel the median rises only from 0.056 at tier 2 to 0.175 at tier 4, so most disturbances at those tiers are not caught cheaply, and the table says "the disturbances that leave the range" rather than naming the tiers. Three things qualify it. The alarm’s false-alarm rate reaches 4.0%, some forty times the budget the panel is held to, so the two are not read at comparable operating points and the cheap control is not free. It is not uniformly weak at the tiers the paper reports either: on sequential valve it reaches 0.098 at tier 2, matching the panel’s own 0.097 on that disturbance while spending that far looser alarm rate to do it. Declared limits also exist only for sensors, so an actuatorside disturbance is outside what a limit check can look at, rather than something it looks at and misses. Most of that false-alarm rate is one channel. The sodium flow rate reads outside its own declared bounds during normal operation, the instrument having drifted to a small negative reading the envelope does not admit. Its bounds are therefore wrong, and any tier drawn against them would be miscalibrated; it is a slot target for one disturbance, not among the eleven reported here, so no result in this paper draws a magnitude against it. Disturbance strength across processes. A tier is defined against each process’s own envelope, so the two need not deliver the same disturbance. Measured as the amplitude actually applied divided by that channel’s standard deviation in normal operation, which puts both in units of the channel’s own variation, the plant’s disturbances are the weaker by a median ratio of 0.08 over the 32 paired cells, about twelve times. The simulator is the quieter of the two, its dimensionless channel noise running 0.012 against the plant’s 0.044, which accounts for part of that difference but not most of it. What produces the remainder we do not establish.

10

The gap is not confined to the tiers whose ceiling differs between processes. It is widest at tier 2, ratio 0.04, which draws against declared bounds on both. The ladder is largely but not uniformly implicated: realized magnitude rises at every step of the simulator’s pooled median and at three of four on the plant’s, where tier 2 sits marginally below tier 1, and three of the eight disturbances are non-monotone on each process. What differs between the processes is the level, not the ordering. A weaker disturbance is on its own a sufficient explanation for the collapse, so we tested it. Pairing each disturbance’s plant tier against the simulator tier whose realized effect size is closest, the plant is never the better detected: worse on four of the eight shared disturbances, tied at the ceiling on the other four. Three of those four losses are the informative ones, because the matched magnitudes are close and the detection gap is not. Each pair carries two numbers: how far the disturbance actually moved the channel, in the units of that channel’s own variation used above, and the best per-sample true-positive rate any detector in the panel reached on it at the 0.001 budget. The matching picks a tier on each side independently, so these are not the tier-2 figures of Table IV and should not be read against them. Writing each as plant against simulator, sequential valve manipulation moved 2.08 standard deviations at T2 against 2.16 at T3 and was detected at 0.10 against 0.18; flow oscillation moved 0.41 at T3 against 0.47 at T1 and was detected at 0.12 against 1.00; physics-consistent manipulation moved 4.44 at T1 against 5.19 at T1 and was detected at 0.09 against 1.00. The flow-oscillation figure on the plant is PCA reconstruction rather than the autoencoder, whose regime confound the next check examines. So a magnitude deficit of four to fifteen percent goes with a detection deficit of two to eleven times. The fourth pair is the one the matching fails on, T3 on the plant against T4 on the simulator: there the plant’s disturbance really is fourteen times the weaker, and it settles nothing. With four losses out of four at p = 0.06 on a sign test, the gap is consistent with a residual effect beyond magnitude. The plant is therefore not shown to be intrinsically harder: part of its lower detection is that the same tier delivers less there. That is not a confound to be corrected away. A tier is defined against each process’s own envelope, so a simulator whose envelope admits a larger disturbance at the same nominal severity is itself one of the ways simulator evaluation overstates what a plant will see, and the matched comparison says a gap survives once it is removed. One result is sharpened by the same measurement. Sequential valve manipulation’s low rate invites the reading that it is simply a gentle disturbance. It is not: at tier 4 on the plant it moves channels by a median of 8.4 standard deviations and the panel’s best still reaches 0.12, its highest anywhere being 0.21. So the low per-sample rate is a statement about the detectors rather than about the disturbance’s size. Clamping mode. Paired per-seed comparison of mean AUC between the two modes of the tiering rules puts the largest perdetector difference at 0.009, with none reaching significance, though at n = 5 the smallest attainable two-sided Wilcoxon

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

p is 0.0625, so this is a weak null and not a demonstration of equivalence. Bounded is used throughout and no argument here depends on that. Operating-regime confound. One subsystem at the real facility cycles on and off during steady-state operation, and flow oscillation is the disturbance whose detection could most plausibly track that cycle rather than the disturbance. The subsystem’s state is recoverable from a damper position in the telemetry, which the facility’s operators identified as the indicator of the cycle; partitioning each cell’s scoring windows on it, without retraining, separates the two. For seven of the eight detectors the partition makes little difference: median gaps run from +0.016 to +0.102 AUC. The autoencoder is the exception and the gap is large and consistent: a median of −0.450, negative in all twenty of its cells and ranging only from −0.407 to −0.496. Its flow-oscillation result is substantially worse when the subsystem is active, so for that detector and that disturbance the score is partly reporting operating regime. The confound stands uncorrected: the partition covers one disturbance, the active state is a median 4.7% of windows, and separating a flow-specific effect from a general regime effect would require the same partition on the other ten disturbances, which we did not run. VII. D ISCUSSION† Detector performance measured on a simulated facility should not be taken at face value as evidence of performance on a real one. That was already established for process faults under threshold-free scoring [9]. The failure is not an artifact of those choices: it persists for adversarial disturbances, under one construction applied to both processes, and at a declared false-alarm budget. Cost bears on this at family level, the only level at which our measurement reproduced: scoring one cell with the training cache disabled, the three causal detectors are the three slowest in both runs with no other detector inside their range, while the neural detectors do not separate from the classical ones. The objection that inference cost rules out learned detectors therefore does not select against the neural family here; it selects against structure learning. It would be a misreading to take this as an argument that statistical methods win. They won here, on two processes held at steady state, against disturbances that are perturbations of a stationary operating point. The narrower and more defensible statement is about where evidence comes from: the returns on model capacity are far easier to demonstrate on a simulator than on a plant, while the costs enumerated in Section I (qualification burden, inference budget, labeled-data scarcity, and requalification at each new facility) all fall due on the plant. A panel evaluated only on a simulator will overstate what a plant gets. The conditions we would most expect to reverse the conclusion are absent from this record, and absent by what the processes did rather than by our choice. As Section V reports, 96.4% of the plant’s labeled segments are steady state and none at all are startup, shutdown or trouble. A process in transition (startup, shutdown, a grade or campaign change,

11

multi-mode operation) breaks the stationarity that makes a fixed projection and a residual threshold adequate, and there the ability to learn a nonlinear, regime-dependent model of normal operation stops being surplus capacity and becomes the requirement. We would expect the ordering reported here to invert. Nothing in our design tests it, because the record contains almost none of it. For a plant that spends much of its life in transition this paper is out of scope rather than contrary evidence. The consequence we would press at design time follows from the sequential-valve result rather than from the divergence between processes. Security arguments routinely depend on detection: a protocol decision, an access-control boundary or a residual-risk acceptance gets justified on the grounds that monitoring would catch the resulting exposure. Such an argument needs a number for the exposure in question, at the granularity it uses. Sequential valve manipulation is the case in point. On the same plant data at tier 2 it reads as 0.097 of perturbed samples flagged and as 196 of 204 episodes containing an alarm, and Section VI gives both. An argument that cites the first to conclude the exposure is invisible, or the second to conclude it is handled, is citing the wrong number for the claim it is making, against a known weakness of the standard protocol whose proposed correctives are themselves contested [13], [35]. A limit check on declared bounds is not the cheaper way out either: it reaches 0.098 on this disturbance, matching the panel, and spends some forty times the false-alarm budget to do it. VIII. L IMITATIONS AND T HREATS TO VALIDITY† The simulator’s bounds are mostly empirical. Two channels, reactor pressure and reactor temperature, take value limits from the process description; the other fifty-one use their own observed range with padding, and the per-channel rate ceilings sit at twice each channel’s observed maximum rate, an auditable heuristic rather than a physics derivation. Its tier machinery is therefore calibrated against what that process has been seen to do, and the claim that its severest tier violates the process’s physics is not supported and is not made. Disturbances are synthetic on both processes, which is what makes the comparison controlled, one construction applied to both with magnitudes drawn from each process’s own admissible support; it is not a claim about disturbances observed in the wild. Nor is any of them adaptive. Each is derived from a control flaw and drawn against an admissibility envelope; none is optimized against a detector, and no attack here responds to what is deployed. An adversary who can query a deployed detector, or who maximizes process impact subject to staying under its threshold [16], is a stronger threat than anything measured here; concealment attacks constructed against reconstructionbased detectors are the concrete demonstration [17]. The rates in Section VI are therefore upper bounds with respect to such an adversary rather than estimates of what one would achieve. Actuator-side disturbances are injected open loop. Values are written into recorded telemetry after the fact, so a controller that would have responded to a valve command or a setpoint

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

change does not, and the downstream channels carry no compensating motion. Whether that makes such a disturbance easier or harder to detect is not determined: the absence of a response removes a cue, and the absence of compensation leaves the primary deviation larger. The simulator could be driven closed loop and was not, which would mean regenerating its corpora. Holding a configuration constant across processes is not the same as holding it neutral. The top-k aggregation described in Appendix A is the clearest case: a fixed k is a larger share of the simulator’s channels than of the plant’s, so the same nominal setting is more selective on the plant. Varying it per process would have put a tuning difference into a comparison premised on identical configuration, so it was left alone. Thresholds are set on data the detectors were trained on, so the false-positive rate is estimated on scores the model has already seen. That makes it optimistic, and more so for the higher-capacity detectors, which is why the family ordering is reported as a lower bound. A held-out block would settle it: blocked time-ordered cross-validation inside the training span is standard and would work, and was not run for compute reasons, so the lower-bound direction is reasoning and not measurement. It also cuts both ways: the same optimism inflates the simulator panel that the simulator result calls deployable. Each detector also runs at a single tuning budget, and four at a reduced channel budget, whose cost was measured for two of them (Table V) and not for PCMCI+ or the Bayesian network.

12

transition is a different question, and one with more room for learned capacity to earn its cost. A PPENDIX A D ETECTOR C ONFIGURATION† Table VII gives one configuration per detector, used for every cell and fixed before the comparison. That is what makes the panel comparable, and also a limitation: a detector that would do better with process-specific tuning is reported without it. TABLE VII D ETECTOR CONFIGURATION , IDENTICAL ACROSS BOTH PROCESSES . T OP -k 30 AND PCMCI+’ S LAG 2 COME FROM SWEEPS , THE CHANNEL CEILINGS ARE COMPUTE BUDGETS , AND THE ESTIMATOR COUNT, EXPLAINED - VARIANCE FRACTION , α AND SELECTION CRITERION ARE LIBRARY DEFAULTS . T HE REST, INCLUDING EVERY NEURAL HYPERPARAMETER , WAS SET ONCE AND NEVER SWEPT. Detector

Configuration

Hotelling’s T 2 PCA reconstruction

window 500, stride 250, threshold pct. 95 explained variance 0.95, top-k 30, window 500, stride 250, threshold pct. 85 100 estimators, max samples auto, window 500, stride 250 weighted first difference, second difference and rolling variance (0.5/0.3/0.2), top-k 30 over sensors, threshold pct. 85 latent 4, dropout 0.1, batch norm, lr 10−3 , batch 32, 20 epochs, top-k 30 hidden 40, dropout 0.25, lr 10−3 , batch 16, 20 epochs, patience 8, sequence 50, top-k 30 correlation threshold 0.3, Granger lags 1–10, ≤ 100 pairs ≤ 25 sensors, ≤ 3 parents, Bayesian information criterion, window 500 ≤ 30 channels, lag 3, edge threshold 0.01, λW = λA = 0.05 ≤ 30 channels, lag 3, hidden 16, kernel 3, λW = λA = 0.05 ≤ 20 channels, lag 2, α = 0.05, partialcorrelation independence test

Isolation forest Change-point detection

Autoencoder LSTM Dependency violation

IX. C ONCLUSION†

Bayesian network

On the two processes studied here, anomaly detection evaluated on a simulated process did not transfer to a real one. That was already known for native process faults scored without a threshold; it survives the three changes a security evaluation makes, to attacker-authored disturbances, one construction across both processes, and a declared false-alarm budget. What does transfer is the ranking. Which detector is relatively stronger is largely predictable across the two processes, correlating positively at every operating point examined; how well any of them performs is not. The same split appears on a variable unrelated to detector family, raising the causal detectors to full channel access helping on the simulator and not on the plant. One result holds on both processes, so it does not rest on either being representative: nothing in the panel flags sequential valve manipulation reliably per sample, 0.10 of perturbed samples on the plant and 0.17 on the simulator, its highest anywhere being 0.21, and that at eight standard deviations. Read per episode instead of per sample the same cell says the opposite, which is why a security argument resting on detection has to say which of the two it means. The scope is narrow. Two processes held almost entirely at steady state, the plant by measurement and the simulator by construction, and only a partial account of what causes the collapse, of which a weaker realized disturbance on the plant is one measured part. A plant that spends much of its life in

DYNOTEARS NTS-NOTEARS PCMCI+

Four detectors produce one score per sensor per timepoint and must reduce that to a single score, and how they reduce it affects what they can detect. The autoencoder, LSTM, PCA reconstruction and change-point detection all take the mean of the 30 largest per-sensor scores at each timepoint. The first three standardize each sensor against its own baseline median and absolute deviation before selecting, so a noisy channel cannot dominate on scale alone; change-point detection selects on its raw scores. Selection is redone at every timepoint, so it is not a fixed subset. The value 30 comes from a sweep over k ∈ {3, 10, 20, 30, 50} on the plant, in which k = 10 and k = 20 were worse than either end of the range. Change-point detection adopted it later to match the other three, having until then reduced by maximum, which is k = 1 and meant that a disturbance missing whichever channel happened to be loudest contributed nothing to its score at all. One consequence carries into the cross-process comparison: a fixed k is a different share of each channel set, about a fifth of the plant’s 143 against more than half of the simulator’s 53.

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

The channel caps carried by four detectors are a separate restriction, on what the model sees rather than on how persensor scores are combined; Section IV describes them. ACKNOWLEDGMENT Generative AI was used in preparing every section of this article, including its text, figures, tables and analysis code. Anthropic Claude [36] wrote and revised the analysis software and drafted and edited text; OpenAI GPT [37] and Google Gemini [38] reviewed the code and manuscript; and a literature-screening tool built on those models and on Qwen [39], Granite [40], Llama [41] and BGE [42] searched and assessed related work. The author reviewed, verified and revised all AI-generated content and takes full responsibility for it. Every quantitative result was regenerated by running the analysis code rather than taken from model output. R EFERENCES [1] M. Muhlheim, P. Ramuhalli, A. Huning, A. Guler Yigitoglu, and A. Saxena, “Status Report on Regulatory Criteria Applicable to the Use of Artificial Intelligence (AI) and Machine Learning (ML),” Oak Ridge National Laboratory, Tech. Rep. ORNL/SPR-2023/3072, 2007715, Sep. 2023. [2] S. Suman, “Artificial Intelligence in Nuclear Industry: Chimera or Solution?” Journal of Cleaner Production, vol. 278, p. 124022, Jan. 2021. [3] L. Cheng, K. Tian, D. D. Yao, L. Sha, and R. A. Beyah, “Checking is Believing: Event-Aware Program Anomaly Detection in Cyber-Physical Systems,” IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 2, pp. 825–842, Mar. 2021. [4] H. Huang, P. Wang, J. Pei, J. Wang, S. Alexanian, and D. Niyato, “Deep Learning Advancements in Anomaly Detection: A Comprehensive Survey,” IEEE Internet of Things Journal, vol. 12, no. 21, pp. 44 318– 44 342, Nov. 2025. [5] M. Landauer, F. Skopik, B. Stojanović, A. Flatscher, and T. Ullrich, “A review of time-series analysis for cyber security analytics: From intrusion detection to attack prediction,” International Journal of Information Security, vol. 24, no. 1, p. 3, Feb. 2025. [6] J. Chen, T. Li, J. Wang, K. Zhang, Z. Zhang, and W. Shen, “Closing the Simulation-to-Reality Gap for Fault Diagnosis in Unknown Environment: A Sim2Real Knowledge Transfer Approach With Contrastive Learning,” IEEE/ASME Transactions on Mechatronics, vol. 31, no. 1, pp. 663–674, Feb. 2026. [7] P. Yan, A. Abdulkadir, P.-P. Luley, M. Rosenthal, G. A. Schatte, B. F. Grewe, and T. Stadelmann, “A Comprehensive Survey of Deep Transfer Learning for Anomaly Detection in Industrial Time Series: Methods, Applications, and Directions,” IEEE Access, vol. 12, pp. 3768–3789, 2024. [8] U. A. Usmani, I. Abdul Aziz, J. Jaafar, and J. Watada, “Deep Learning for Anomaly Detection in Time-Series Data: An Analysis of Techniques, Review of Applications, and Guidelines for Future Research,” IEEE Access, vol. 12, pp. 174 564–174 590, 2024. [9] F. Hartung, A. Muraleedharan, M. Kloft, and J. Burger, “Beyond Tennessee Eastman: Benchmarking Deep Anomaly Detection on RealWorld Pilot-Scale Continuous Distillation Data,” in Proceedings of the 36th European Symposium on Computer Aided Process Engineering, Sheffield, United Kingdom, Jun. 2026, pp. 1728–1736. [10] B. Lindemann, B. Maschler, N. Sahlab, and M. Weyrich, “A survey on anomaly detection for technical systems using LSTM networks,” Computers in Industry, vol. 131, p. 103498, Oct. 2021. [11] C.-Y. Lee, K. Chang, and C. Ho, “Autoencoder-based detector for distinguishing process anomaly and sensor failure,” International Journal of Production Research, vol. 62, no. 19, pp. 7130–7145, Oct. 2024. [12] K. Choi, J. Yi, C. Park, and S. Yoon, “Deep Learning for Anomaly Detection in Time-Series Data: Review, Analysis, and Guidelines,” IEEE Access, vol. 9, pp. 120 043–120 065, 2021. [13] G.-Y. Kim, S.-M. Lim, and I.-C. Euom, “A Study on Performance Metrics for Anomaly Detection Based on Industrial Control System Operation Data,” Electronics, vol. 11, no. 8, p. 1213, Apr. 2022.

13

[14] M. Mudasir, Y. Asiri, I. Ameer, M. S. A. Reshan, H. Almansour, K. A. Awan, and A. Shaikh, “RBC-AD: Conformal anomaly detection with explicit false-alarm control for the Tennessee Eastman Process,” Connection Science, vol. 38, no. 1, p. 2707826, Dec. 2026. [15] F. Hartung, B. J. Franks, T. Michels, D. Wagner, P. Liznerski, S. Reithermann, S. Fellenz, F. Jirasek, M. Rudolph, D. Neider, H. Leitte, C. Song, B. Kloepper, S. Mandt, M. Bortz, J. Burger, H. Hasse, and M. Kloft, “Deep Anomaly Detection on Tennessee Eastman Process Data,” Chemie Ingenieur Technik, vol. 95, no. 7, pp. 1077–1082, Jul. 2023. [16] D. I. Urbina, J. A. Giraldo, A. A. Cardenas, N. O. Tippenhauer, J. Valente, M. Faisal, J. Ruths, R. Candell, and H. Sandberg, “Limiting the Impact of Stealthy Attacks on Industrial Control Systems,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. Vienna Austria: ACM, Oct. 2016, pp. 1092– 1105. [17] A. Erba and N. O. Tippenhauer, “Assessing Model-free Anomaly Detection in Industrial Control Systems Against Generic Concealment Attacks,” in Proceedings of the 38th Annual Computer Security Applications Conference. Austin TX USA: ACM, Dec. 2022, pp. 412–426. [18] B. Blakely, Y. Li, A. Dave, and R. Vilim, “Anomaly Detector Robustness Under Physics-Bounded Process Perturbations: A Multi-Paradigm Evaluation on Research Facility Telemetry,” Argonne National Laboratory, Tech. Rep. ANL-26/38, Sep. 2026, DOE OSTI technical report; OSTI ID 17138815. [19] J. V. Kresta, J. F. Macgregor, and T. E. Marlin, “Multivariate statistical monitoring of process operating performance,” The Canadian Journal of Chemical Engineering, vol. 69, no. 1, pp. 35–47, 1991. [20] Q. P. He and J. Wang, “Statistical process monitoring as a big data analytics tool for smart manufacturing,” Journal of Process Control, vol. 67, pp. 35–43, Jul. 2018. [21] Z. Ge, “Review on data-driven modeling and monitoring for plant-wide industrial processes,” Chemometrics and Intelligent Laboratory Systems, vol. 171, pp. 16–25, Dec. 2017. [22] S. Yoon and J. F. MacGregor, “Fault diagnosis with multivariate statistical models part I: Using steady state fault signatures,” Journal of Process Control, vol. 11, no. 4, pp. 387–400, Aug. 2001. [23] Z. Zamanzadeh Darban, G. I. Webb, S. Pan, C. Aggarwal, and M. Salehi, “Deep Learning for Time Series Anomaly Detection: A Survey,” ACM Computing Surveys, vol. 57, no. 1, pp. 1–42, Jan. 2025. [24] Á. L. Perales Gómez, L. Fernández Maimó, A. Huertas Celdrán, and F. J. García Clemente, “An interpretable semi-supervised system for detecting cyberattacks using anomaly detection in industrial scenarios,” IET Information Security, vol. 17, no. 4, pp. 553–566, Jul. 2023. [25] F. Rewicki, J. Denzler, and J. Niebling, “Is It Worth It? Comparing Six Deep and Classical Methods for Unsupervised Anomaly Detection in Time Series,” Applied Sciences, vol. 13, no. 3, p. 1778, Jan. 2023. [26] B. Yu, J. Yao, Q. Fu, Z. Zhong, H. Xie, Y. Wu, Y. Ma, and P. He, “Deep Learning or Classical Machine Learning? An Empirical Study on Log-Based Anomaly Detection,” in Proceedings of the IEEE/ACM 46th International Conference on Software Engineering. Lisbon Portugal: ACM, Feb. 2024, pp. 1–13. [27] B. Kim, M. A. Alawami, E. Kim, S. Oh, J. Park, and H. Kim, “A Comparative Study of Time Series Anomaly Detection Models for Industrial Control Systems,” Sensors, vol. 23, no. 3, p. 1310, Jan. 2023. [28] J. Giraldo, D. Urbina, A. Cardenas, J. Valente, M. Faisal, J. Ruths, N. O. Tippenhauer, H. Sandberg, and R. Candell, “A Survey of Physics-Based Attack Detection in Cyber-Physical Systems,” ACM Computing Surveys, vol. 51, no. 4, pp. 1–36, Jul. 2019. [29] M. Kravchik and A. Shabtai, “Efficient Cyber Attack Detection in Industrial Control Systems Using Lightweight Neural Networks and PCA,” IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 4, pp. 2179–2197, Jul. 2022. [30] A. P. Mathur and N. O. Tippenhauer, “SWaT: A water treatment testbed for research and training on ICS security,” in 2016 International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater). Vienna, Austria: IEEE, Apr. 2016, pp. 31–36. [31] J. Goh, S. Adepu, K. N. Junejo, and A. Mathur, “A Dataset to Support Research in the Design of Secure Water Treatment Systems,” in Critical Information Infrastructures Security, G. Havarneanu, R. Setola, H. Nassopoulos, and S. Wolthusen, Eds. Cham: Springer International Publishing, 2017, vol. 10242, pp. 88–99. [32] C. M. Ahmed, V. R. Palleti, and A. P. Mathur, “WADI: A water distribution testbed for research in the design of secure cyber physical systems,” in Proceedings of the 3rd International Workshop on CyberPhysical Systems for Smart Water Networks. Pittsburgh Pennsylvania: ACM, Apr. 2017, pp. 25–28. [33] N. Leveson and J. Thomas, STPA Handbook. MIT PSAS, 2018.

PREPRINT SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

[34] I. Friedberg, K. McLaughlin, P. Smith, D. Laverty, and S. Sezer, “STPASafeSec: Safety and security analysis for cyber-physical systems,” Journal of Information Security and Applications, vol. 34, pp. 183–196, Jun. 2017. [35] A. Huet, J. M. Navarro, and D. Rossi, “Local Evaluation of Time Series Anomaly Detection Algorithms,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. Washington DC USA: ACM, Aug. 2022, pp. 635–645. [36] Anthropic, “Claude,” Large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://www.anthropic.com/claude [37] OpenAI, “GPT-5,” Large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://platform.openai.com/docs/models [38] Google DeepMind, “Gemini,” Large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://deepmind.google/ models/gemini/ [39] Qwen Team, Alibaba, “Qwen,” Open-weight large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://github. com/QwenLM [40] IBM, “Granite,” Open-weight large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://www.ibm.com/granite [41] Meta, “Llama,” Open-weight large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://www.llama.com/ [42] Beijing Academy of Artificial Intelligence, “BGE embedding and reranking models,” Open-weight text embedding model family, 2026, accessed Oct. 2026. [Online]. Available: https://huggingface.co/BAAI

Benjamin Blakely (Senior Member, IEEE) is a cybersecurity and artificial intelligence researcher at Argonne National Laboratory, where he leads the Applied Research group within the Strategic Security Sciences division. His work centers on how AI and control systems behave under adversarial conditions, and what it takes to trust automated decision-making for critical infrastructure protection. Over 20 years across industry, government, and academia he has built and led teams in information security and data science, and he serves as a subject matter expert for United States departments and agencies including Energy, NNSA, Homeland Security, State, and Defense. He holds PhD and BS degrees in computer engineering from Iowa State University and is a CISSP through ISC2 .

14

Related documents

• Adversarial Process Disturbances at a Deployable Alarm Budget: Detector Evaluation on a Simulator and a Real Plant#1489856
• Automated Batch Distillation Process Simulation for a Large Hybrid Dataset for Deep Anomaly Detection#799999
• Distribution-free false-alarm calibration and chance-corrected spatial evaluation for industrial anomaly detection#612517
• Distribution-free false-alarm calibration and chance-corrected spatial evaluation for industrial anomaly detection#611040
• NFAD: Nuisance-Filtered Anomaly Detection Under Distribution Shift#793334