Attack Detection using Time Series Foundation Models

Attack Detection using Time Series Foundation Models

arXiv:2606.06347v1 [eess.SY] 4 Jun 2026

Sribalaji C. Anand, Anh Tung Nguyen, and George J. Pappas Abstract— This paper addresses the problem of attack detection in cyber-physical systems without any knowledge of the plant model or its structure. A remotely located plant transmits sensor measurements to an operator over a network that is assumed to be under attack. We consider two classes of attacks: model-free replay attacks and model-based stealthy attacks. For the latter, we derive closed-form expressions for the optimal stealthy attack policy against a χ2 detector, for both linear and nonlinear systems. We then propose a modelstructure-free detector based on TimesFM, a time-series foundation model developed by Google Research, which serves as a surrogate residual generator operating in a zero-shot fashion. We show empirically that the TimesFM-based detector achieves a comparable or superior attack detection performance. The efficacy of the proposed approach is demonstrated numerically on the IEEE 14-bus power system. We also demonstrate that TimesFM predictions can serve as a substitute for corrupted measurements, a practical mitigation technique when classical redundancy assumptions fail.

I. I NTRODUCTION Attack detection in Cyber-Physical Systems (CPSs) has received considerable research attention in recent years [1]. In general, attack detection in CPSs proceeds in two stages: a residual signal is first constructed from the received output signal, and a statistical hypothesis test, such as a χ2 test and a cumulative-sum test [2], is then applied to the residual to flag anomalies. Both stages, however, rely critically on model knowledge. This raises a natural question: Can we design an efficient attack detector without any explicit knowledge of the system model structure or parameters? Driven by seminal works on data-driven control [3], there has been a growing body of literature on data-driven attack detection [4]–[6]. For instance, [4] derives conditions for the existence of a data-driven perfectly undetectable attack and develops a corresponding data-driven detector. The work [6] considers attack detection in the noiseless case where signals are watermarked. However, none of these works address the detection of optimal attacks that are designed based on model and detector knowledge. In this work, we aim to design a model-structure-free1 detector for generic nonlinear systems in the presence of noise that can detect both model-free and model-based stealthy attacks (see Fig. 1). In the spirit of the Swiss Cheese Model of risk management [7], the proposed model-structure-free detector is intended to serve as a second layer of defense, deployed alongside existing This work is supported by the Swedish Research Council under the grant 2024-00185. Sribalaji C. Anand, and George J. Pappas are with the University of Pennsylvania, United States. Sribalaji C. Anand is also affiliated with KTH Royal Institute of Technology, Sweden. Anh Tung Nguyen is with Uppsala University, Sweden. (e-mail: [email protected], [email protected], [email protected]) 1 In the sequel, model-structure-free refers to the absence of any knowledge of the plant model, neither its structure nor its parameters.

detectors (possibly already) present in traditional CPSs. To this end, we depart from traditional control-theoretic tools, such as Willems’ fundamental lemma [8], and adopt foundation models as surrogate residual generators. In particular, we employ the TimesFM model developed by Google [9]. Concretely, we consider a dynamical system located remotely, transmitting sensor measurements over a network for monitoring purposes (see Fig. 1). An attacker is assumed to tamper with the measurements received by the operator. We consider two attacker types: a model-free attacker that conducts replay attacks [10], and a model-based attacker that exploits full system knowledge to construct stealthy attacks [11]. The main contributions of this paper are as follows 1) Optimal stealthy attack construction: We consider the case where the operator employs a model-based χ2 detector. Assuming the attacker has full model knowledge, we derive closed-form expressions for stealthy attacks that maximally bias the state estimate while remaining stealthy, for both linear and nonlinear systems. 2) Model-free detection via foundation models: We leverage TimesFM as a surrogate residual generator and apply a χ2 test to its prediction errors (Algorithm 1). Monte-Carlo empirical results show that model-based stealthy attacks can be reliably detected by TimesFM, raising the bar for simultaneous evasion. For modelfree replay attacks, we show empirically that TimesFM achieves comparable or superior detection performance. 3) Practical heuristic for overcoming fundamental limitations: Resilient state estimation requires detectability under any subset of N −2M sensors [12]2 . We empirically show that a reliable state estimate can be obtained using TimesFM even when this assumption fails. We illustrate the efficacy of our detector on the IEEE 14bus power system. To the best of our knowledge, this is the first work to propose a foundation-model-based, modelstructure-free zero-shot detector against both replay attacks and model-based stealthy attacks, in the presence of noise. Related works: The attack detection literature is vast, and a comprehensive review is beyond the scope of this paper. We instead position our work precisely within this landscape. Broadly, let us consider two players: the attacker and the detector, each of which may be model-based or model-free. Traditionally, a model-based detector can be used to detect model-free replay attacks [13]. In the worst-case scenario, if the attacker has access to the system model, model-based attacks can be designed to be stealthy [11], which we establish formally and illustrate in this paper. By contrast, thanks to the fact that TimesFM has no closed2 Here, attackers compromise any unknown M sensors from N sensors.

Layer 1 protection Network y[k]

Model-Based Detector

alarm

+

Plant

attack

TimesFM-Based Detector

alarm

Layer 2 protection

Fig. 1. A schematic representation of the problem setup. form innovation structure for the attacker to exploit, attacks designed to be stealthy against the model-based detector are much harder to be stealthy against TimesFM. There is also a growing body of work using machine learning architectures for attack detection [14], [15]. However, these approaches require task-specific training data, hyperparameter tuning, and retraining whenever the system changes. By contrast, TimesFM operates in a zero-shot fashion; no training, retraining, or hyperparameter tuning is required, and the same model applies regardless of the system or context/memory length. This makes it a true plug-and-play solution for model-structure-free attack detection. Notation: Let A ∈ Rn×n , then ρ(A) R ∞denotes its spectral radius. Given x ∈ R, x > 0, Γ(x) = 0 tx−1 e−t dt denotes the gamma function. Given x, y ∈ R and y > 0, the Regularised Lower Incomplete (RLIG) function is R x y−1Gamma 1 −t t e dt ≜ q, and P −1 (q; y) given as P (x, y) = Γ(y) 0 represents the inverse of the RLIG function for a given y > 0. II. P ROBLEM F ORMULATION In this section, we formalize the CPS setup for studying attack detection, where a remotely located plant periodically transmits its outputs to the plant operator over a network. This communication network is assumed to be under attacks. A. Plant and detector Consider a discrete-time dynamical system of the form x[k + 1] = f (x[k]) + w[k], y[k] = h(x[k]) + v[k] (1) where x[k] ∈ Rn is the state of the plant, y[k] ∈ Rm is the iid iid plant output, and w[k] ∼ N (0, Σw ) and v[k] ∼ N (0, Σv ) are Gaussian process disturbance and Gaussian measurement noise, respectively. We assume the operator has access to a state estimator of the form  ⊤ x̂p [k]⊤ ŷp [k]⊤ = Φ(y[k], ·), (2) where x̂p [k] and ŷp [k] denote the estimated state and output, respectively, and Φ encodes the plant dynamics (see Remark 1). Using Φ, the operator employs a primary χ2 detector of the form gp [k] > τp =⇒ alarm, gp [k] ≤ τp =⇒ no alarm, (3) 2 where gp [k] ≜ zp [k]⊤ Σ−1 p zp [k] is the χ detection statistic, zp [k] ≜ y[k]−ŷp [k] is the residue signal, Σp is the residue covariance, and τp is chosen to achieve a desired nominal FAR αp . As discussed in the introduction, model-based attacks can be designed to be stealthy against gp by construction. The operator therefore also deploys a secondary, model-structurefree detector gs based solely on historically observed data gs (·, k) > τs =⇒ alarm, gs (·, k) ≤ τs =⇒ no alarm,

where τs is chosen to achieve a desired nominal FAR αs . The design of both τp and τs is discussed in detail later. Remark 1. The primary estimator and detector in (2) and (3) are assumed to characterize the optimal stealthy attacks in Theorems 1 and 2. The TimesFM-based detector operates independently of gp ; attacks designed to be stealthy against gp are, in practice, detectable by monitoring gs . ◁ B. Attacker We consider an attacker that corrupts the sensor measurements transmitted to the operator as follows ỹi [k] ≜ φi (yi [k]), ∀ i ∈ {1, . . . , m}, ∀ k ≥ ka , (4) where φi : R → R and ka is the time at which the attack begins. We consider two classes of attacks: model-free replay attacks and model-based stealthy attacks. 1) Model-free replay attacks: Replay attacks are of particular practical relevance, as real-world instances, such as the Stuxnet malware [10], have demonstrated their potential to cause catastrophic consequences in CPSs. Thus, let us consider an attacker that records sensor data during the time interval [κ0 , κ1 ], with T = κ1 − κ0 + 1. Then, the replay attack takes the attack policy (4) in the following form   φi (yi [k]) ≜ yi κ0 + (k − ka ) mod T , ∀ i ∈ {1, . . . , m}, for all k ≥ ka , where ka ≥ κ1 and mod stands for the modulus operator. The attacker loops through the recorded sequence {yi [κ0 ], . . . , yi [κ1 ]}, possibly indefinitely, so the operator continuously receives a repeating window of legitimate-looking data while the true plant state evolves freely. Such attacks require no model knowledge and exploit the fact that the system operates in steady state. 2) Model-based maximum-impact stealthy attacks: From a risk management perspective, one must consider the worstcase scenario in which the attacker has exact model knowledge. In this case, attacks that maximally degrade the operator’s state estimate while remaining undetected by gp can be designed. Taking the attack policy (4) in the additive form φi (yi [k]) ≜ yi [k]+ai [k], the attack design problem becomes
   sup E w⊤ ϵp [T ] P gpa [k] > τp ≤ αp + ∆αp , ∀ k ≥ ka (5) a

where w ∈ Rn is a weighting vector, ϵp [T ] ≜ x̂ap [T ] − x̂p [T ] is the attack-induced estimation deviation at the time T , x̂ap [k] is the state estimate under attack, gpa [k] is the χ2 detection statistic under attack, and ∆αp ≥ 0 is the allowed increase in false alarm rate. In practice, τp is chosen to yield the nominal FAR αp asymptotically; over any finite window, the empirical FAR may deviate from αp , making a small increase ∆αp indistinguishable from natural fluctuations [16]. We next provide closed-form solutions to (5). Remark 2. The design problem (5) is formulated with respect to the primary detector gp ; the attacker is assumed to have no knowledge of the secondary detector gs . This asymmetry in attacker knowledge is analogous to the role of watermarking schemes [13] that enable attack detection. ◁ C. Problem statement Before formally stating the problem, we briefly introduce the TimesFM foundation model used throughout this paper.

TimesFM [9] is a time-series foundation model developed by Google, trained on billions of real-world time-series data points spanning diverse domains. Given a history of observations, TimesFM predicts the next values of a time series along with an associated variance, enabling uncertainty-aware forecasting. Crucially, the model operates in a zero-shot fashion, meaning no retraining or fine-tuning on plant data is required. However, the model is univariate in the sense that each output channel yi [k] is forecast independently, without explicitly modelling inter-channel correlations. We are now ready to formally state the problem studied in this paper. Problem 1. Can time-series foundation models be used to realize the secondary detector gs , so as to detect attacks on dynamical systems without any model knowledge, including attacks that are specifically designed to be stealthy against the primary model-based detector gp ? ◁ III. O PTIMAL M ODEL - BASED ATTACKS This section is organized as follows. In Proposition 1, we adopt a result from [2] to derive the detector threshold τp for the χ2 detector given a desired nominal FAR. In Theorem 1, we derive the closed-form solution to the optimization problem (5) for LTI systems. Finally, in Theorem 2, we derive the solution to (5) for nonlinear systems. Proposition 1. Suppose when there are no attacks, it holds iid that zp [k] ∼ N (0, Σp ). Then the threshold τp yielding a
, 1 − α , where desired FAR αp is given by τp = 2P −1 m p 2 P −1 (·, ·) is the inverse of the RLIG function. □ Remark 3. The residual decomposes as zp [k] = v[k] + ε[k], where ε[k] ≜ h(x[k]) − ŷp [k] is the predictor error and v[k] is the measurement noise in (1). In the absence of process noise (w[k] = 0), the state x[k] evolves deterministically, so ε[k] is a function of past outputs and is therefore independent of the current measurement noise v[k]. Under this independence, if ε[k] is approximately Gaussian with covariance Σε , then zp [k] ∼ N (0, Σv + Σε ), justifying the assumption in Proposition 1 with Σp ≜ Σv + Σε . ◁ Proposition 1 provides the threshold design for the χ2 detector under Gaussianity of the detection statistic, independently of any assumption on the plant dynamics. We next use this threshold to derive the optimal attack policy. A. Optimal attacks against LTI systems We now solve the optimization problem (5) for the case where the plant is LTI of the form f (x[k]) = Ax[k], h(x[k]) = Cx[k] where ρ(A) ≤ 1. To this end, we consider that Φ(·) in (2) the following form x̂p [k + 1] = Ax̂p [k] + Kzp [k], (6) zp [k] = ỹ[k] − C x̂p [k], ŷp [k] = C x̂p [k], where zp [k] is the residual signal and K is the observer gain. The gain K may represent a fixed Luenberger gain or the steady-state Kalman gain, the latter being applicable when Σw ≻ 0 and the Kalman gain has converged to its steady-state value. Hence, it holds that ρ(A − KC) < 1. The following theorem presents a closed-form solution to (5).

Theorem 1. Consider the system (1) in its LTI form and the iid corresponding observer (6). Suppose that zp [k] ∼ N (0, Σp ), and define the attack budget  ∆τp∗ ≜ sup λ ≥ 0 : 1 − Fχ2 (m,λ) (τp ) ≤ αp + ∆αp , (7) where Fχ2 (m,λ) is the cumulative distribution function of the non-central χ2 distribution. Then the solution to (5) is given by a⋆ [k] = Cϵp [k] + δ ⋆ [k], where δ ⋆ [k] =
⊤ p ∗ Σ c[k] ∆τp √ p⊤ , and c[k] ≜ K ⊤ AT −1−k w. c[k] Σp c[k]

Proof: Under attack, zpa [k] = ỹ[k] − C x̂ap [k]. By basic algebra, it follows that zpa [k] = zp [k] + δ[k], where δ[k] ≜ a[k] − C(x̂ap [k] − x̂p [k]). Subtracting the nominal observer from the attacked observer dynamics gives ϵp [k + 1] = Aϵp [k] + Kδ[k], ϵp [ka ] = 0, which unrolls as ϵp [T ] = PT −1 T −1−k Kδ[k]. Since δ[k] is the attacker’s design k=ka A variable, we restrict attention to deterministic δ[k]. Taking expectation on both sides, and using PT −1linearity of expectation, it follows that E[w⊤ ϵp [T ]] = k=ka c[k]⊤ δ[k], where c[k] is given in the theorem statement. Since zp [k] ∼ N (0, Σp ) and δ[k] is deterministic, zpa [k] = −1/2 zp [k] + δ[k] ∼ N (δ[k], Σp ). Define z̃pa [k] ≜ Σp zpa [k] ∼ −1/2 N (Σp δ[k], Im ). Then gpa [k] = ∥z̃pa [k]∥2 which is the sum of squares of m independent Gaussian random variables with −1/2 unit variance and means (Σp δ[k])i . By definition of the 2 non-central χ distribution gpa [k] ∼ χ2 (m, λ), λ ≜ ∥Σ−1/2 δ[k]∥2 = δ[k]⊤ Σ−1 p p δ[k]. a Therefore P (gp [k] > τp ) = 1 − Fχ2 (m,λ) (τp ). Since 1 − Fχ2 (m,λ) (τp ) is strictly increasing in λ, the constraint P (gpa [k] > τp ) ≤ αp + ∆αp is equivalent to λ ≤ ∆τp∗ , i.e., ∗ δ[k]⊤ Σ−1 p δ[k] ≤ ∆τp , which decouples across time steps, then problem (5) also decouples as ∗ max c[k]⊤ δ[k] s.t. δ[k]⊤ Σ−1 p δ[k] ≤ ∆τp . δ[k]

Applying the Cauchy–Schwarz inequality in the Σ−1 p weighted inner product gives q p p ∗p c[k]⊤ δ[k] ≤ c[k]⊤ Σp c[k] · δ[k]⊤ Σ−1 ∆τp c[k]⊤ Σp c[k]. p δ[k] ≤ √ ∗ 1/2 ∆τ Σ c[k] −1/2 , giving Equality holds when Σp δ[k] = √ p ⊤ p c[k] Σp c[k]

δ ⋆ [k] in the theorem statement, completing the proof. ■ Theorem 1 provides a closed-form stealthy attack policy for the case where the operator employs a static observer. We now extend this result to the nonlinear setting, where the operator employs an Extended Kalman Filter (EKF) and the attack design must account for the time-varying gain. B. Optimal attacks against nonlinear systems We now address (5) for the case where the plant is nonlinear. To this end, we consider that Φ(·) in (2) is an EKF in the numerically stable Joseph form as follows x̂p [k|k − 1] = f (x̂p [k − 1|k − 1]), Pk|k−1 = Fk Pk−1|k−1 Fk⊤ + Σw , Sk = Hk Pk|k−1 Hk⊤ + Σv , Kk = Pk|k−1 Hk⊤ Sk−1 , zp [k] = ỹ[k] − h(x̂p [k|k − 1]),

(8)

x̂p [k|k] = x̂p [k|k − 1] + Kk zp [k],

Algorithm 1 Attack Detection using TimesFM

⊤ Pk|k = Gk Pk|k−1 G⊤ k + Kk Σv Kk ,

where Gk = I − Kk Hk , Fk = ∂f /∂x|x̂p [k−1|k−1] and Hk = ∂h/∂x|x̂p [k|k−1] are the Jacobians of f and h evaluated at the current estimates, Pk|k−1 is the predicted error covariance, Sk is the innovation covariance, and Kk is the time-varying EKF gain. Let x̂ap [k|k] denote the EKF state estimate under attack, and define the update deviation ϵp [k|k] ≜ x̂ap [k|k] − x̂p [k|k]. We are now ready to state the main result. Theorem 2. Consider the system (1) and the corresponding EKF (8). Suppose that the EKF has converged and that the innovation sequence satisfies zp [k] ≈ N (0, Sk ), where Sk is the innovation covariance from (8). Consider the attack budget in (7), and suppose that the attack-induced deviation ϵp [k|k] remains small enough. Then an approximate solution to (5) is given by a⋆ [k] = h(x̂p [k|k − √ 1] + ϵp [k|k − 1]) − h(x̂p [k|k − 1]) + δ ⋆ [k], where δ ⋆ [k] = ∆τ ∗ √ Sk⊤c[k] , c[k] Sk c[k]

with c[k] computed via the backward recursion λ[T ] = w, c[k] = Kk⊤ λ[k + 1], λ[k] = Fk⊤ λ[k + 1], k = T − 1, . . . , ka .

Proof: Under attack, adding and subtracting h(x̂p [k|k−1]) from the attacked innovation gives zpa [k] = zp [k] + δ[k], where δ[k] ≜ a[k]−(h(x̂p [k|k−1]+ϵp [k|k−1])−h(x̂p [k|k− 1])). Applying a first-order linearization of the deviation dynamics around the nominal trajectory gives ϵp [k + 1|k] ≈ Fk ϵp [k|k − 1] + Kk δ[k], and introducing the backward recursion λ[T ] = w, λ[k] = Fk⊤ λ[k + 1], c[k] = Kk⊤ λ[k + 1] PT −1 gives E[w⊤ ϵp [T |T − 1]] ≈ k=ka c[k]⊤ δ[k]. Since zp [k] ≈ N (0, Sk ), the stealthiness constraint P (gpa [k] > τp ) ≤ αp + ∆αp is equivalent to δ[k]⊤ Sk−1 δ[k] ≤ ∆τ ∗ by the same argument as in the proof of Theorem 1, with Σp replaced by Sk . The remainder of the proof follows identically and is omitted due to space limitations. ■ Theorem 2 provides a closed-form attack policy for nonlinear systems. We next show that such attacks are in practice stealthy against model-based detectors, and we introduce a TimesFM-based algorithm to enhance detection. Remark 4. While the small-deviation assumption in Theorem 2 is difficult to verify analytically, the numerical results on the IEEE 14-bus system confirm that the constructed attack is consistently stealthy against the EKF-based detector across all trials, validating the approximation in practice. ◁ IV. TimesFM- BASED ATTACK D ETECTION In this section, we present a data-driven attack detection algorithm using TimesFM to realize the secondary detector gs . The algorithm is inspired by the classical χ2 detector, but replaces the model-based residuals with prediction residuals generated by TimesFM. As summarized in Algorithm 1, the approach proceeds in three phases. In the first phase, a warmup period allows TimesFM to observe sufficient data to form meaningful predictions. Specifically, the oracle TimesFM takes a window of L past sensor outputs and predicts the next output ŷ (line 5 in Algorithm 1). In the second phase, a clean window of sensor data is used to estimate the covariance of the TimesFM prediction

Require: Sensor outputs ỹi [k], context length L, warmup length Tw , clean window length Tc , FAR αs Ensure: Alarm signal at each time step k 1: for k = 1, . . . , Tw do ▷ Warmup 2: Store ỹ[k] in buffer B 3: end for 4: for k = Tw + 1, . . . , Tw + Tc do
5: r[k] ← ỹ[k] − TimesFM B[k−L : k−1] ; update B 6: end for PTw +Tc ⊤ 7: Σ̂ ← T 1−1 k=Tw +1 r[k]r[k] ; set τs via Proposition 1 c 8: for k = Tw + Tc + 1, . . . do
▷ Online detection 9: ŷ[k] ← TimesFM B[k−L : k−1] 10: gs [k] ← (ỹ[k]−ŷ[k])⊤ Σ̂−1 (ỹ[k]−ŷ[k]) 11: if gs [k] > τs then raise alarm 12: else update B with θỹ[k] + (1−θ)ŷ[k] 13: end if 14: end for residuals under nominal operation. In the third phase, this estimated covariance is used to construct a χ2 -type test statistic for attack detection. Crucially, the context buffer is only updated when no alarm is raised, preventing corrupted measurements from contaminating future predictions (line 12 in Algorithm 1). The algorithm applies to both linear and nonlinear systems, requiring no model knowledge. We next depict the efficacy of Algorithm 1 using numerical experiments. The code to reproduce all the results can be found in https://github.com/balajianand1994/ Attack_detection_using_TFM.git A. Numerical results: Linear case We consider an undamped mass-spring system of the form (1) with f (x[k]) = Ax[k] and h(x[k])  = Cx[k], where    1 0 sin(ω∆t) cos(ω∆t) ω A= , C =  0.31 −0.48 , −ω sin(ω∆t) cos(ω∆t) −0.21 0.43  ⊤ with ω = 0.3, ∆t = 1, and x[0] = 1 0 . Here, the state x[k] ∈ R2 represents the displacement and velocity of the mass, and y[k] ∈ R3 represents three linear sensor measurements of the state. We assume no process noise and Gaussian measurement noise with standard deviation σ = 0.01. For the primary detector, we design a Luenberger observer with gain K placing the closed-loop poles of A − KC at 0.5 ± 0.1j, with threshold τp = 12.838 corresponding to a nominal FAR of 0.5%. For the secondary detector, we use Algorithm 1 with L = 50, Tw = 51, Tc = 20, and θ = 0.8. 1) Model-free replay attacks: We consider a replay attack on all sensors simultaneously, which is particularly challenging to detect since no sensor provides a clean reference. The attacker records data over [κ0 , κ1 ] = [50, 70] and begins replaying at ka = 71. The detection results and the attacked sensor trajectory are shown in Fig. 2. During nominal operation, TimesFM achieves a FAR of 0.5%, compared to 2.8% for the observer-based detector. Under attack, TimesFM consistently raises alarms from k = 91 onward, while the observer-based detector raises alarms only over k ∈ [91, 93],

Fig. 3. Mean and standard deviation of the state reconstruction error across 20 trials for the unprotected observer (red) and the TimesFM-protected observer (blue), where corrupted measurements are replaced by TimesFM point predictions upon detection.

Fig. 2. Evaluation of Algorithm 1 under replay attacks (top three rows) and stealthy attacks constructed using Theorem 1 (bottom three rows). For each attack type: (Top) sensor output y1 [k] during nominal operation and attack phase; (Middle) mean and standard deviation of the test statistic across 20 trials alongside threshold τp , for the TimesFM-based detector under nominal operation (left) and under attack (right); (Bottom) same for the observer-based detector.

which can be dismissed as false alarms given its higher nominal FAR. Overall, TimesFM achieves both a lower FAR and more sustained attack detection. 2) Model-based stealthy attacks: We consider a stealthy attack constructed using Theorem 1 with ∆τp = 0.385, starting at ka = 81 and running until k2 = 100. The results are shown in Fig. 2. During nominal operation, the FAR of TimesFM remains consistent with the replayattack scenario. Under attack, the EKF-based detector raises alarms indistinguishably from its nominal FAR, as expected by construction. In contrast, the TimesFM-based detector successfully detects the attack, demonstrating that attacks designed to be stealthy against model-based detectors are not stealthy against TimesFM. 3) Robust state estimation: We   now consider a singlesensor setting with C = 1 0 , where the only available sensor is under attack. Note that existing model-based secure state estimation methods do not apply due to the fundamental limitation [12] as they require sufficient observability redundancy. Instead, we suggest a different mitigation approach: once an attack is detected by Algorithm 1, we replace the corrupted measurement with the TimesFM point prediction

and feed this into the observer. The results are shown in Fig. 3. Even when the only sensor is compromised, the TimesFM-protected observer consistently achieves a lower state reconstruction error than the unprotected observer, demonstrating the practical value of TimesFM as a mitigation tool beyond detection alone. 4) Robustness against an adaptive attacker: We now consider an attacker with black-box query access to gs , who simultaneously attempts to evade both detectors. We design attacks via SPSA [17], warm-started using the attack in Theorem 1 and refined over 20 iterations, scaled to satisfy the empirical FAR constraint   on gs . We consider the singlesensor setting C = 1 0 over N = 10 trials. The oblivious attacker of Theorem 1, designed against gp alone, achieves a state deviation of 0.637. Under simultaneous evasion, the mean state deviation is 0.007, a reduction of 91×, confirming that gs severely limits the adaptive attacker’s impact even under query access. B. Numerical results: IEEE 14-bus power system We next demonstrate the efficacy of Algorithm 1 on the nonlinear IEEE 14-bus power system, which consists of 14 buses and 20 transmission lines. The dynamics of bus i ∈ {1, . . . , 14} are governed by the swing equation P mi p̈i + hi ṗi = − j∈Ni Bij sin(pi − pj ), where mi > 0 and hi ≥ 0 are the inertia and damping coefficients of bus i, Bij > 0 is the susceptance of the line connecting buses i and j, and pi denotes the phase angle of bus i. Bus 1 is the reference bus with p1 ≡ 0, and the system is discretized with step ∆t = 0.02 s via forward Euler. The measurement vector y[k] ∈ R34 consists of all 14 bus frequencies and all 20 line active power flows, with measurement noise covariance Σv = diag(σω2 114 , σf2 120 ), where σω = 0.035 and σf = 0.050. For the primary detector, we design an EKF in (8) with αp = 0.1%. For Algorithm 1 we use L = 100, Tw = 110, θ = 1, and Tc = 200. Remark 5. The threshold τs in Algorithm 1 is designed assuming approximately Gaussian residuals under nominal operation. A Shapiro-Wilk test on the nominal residuals confirms this: 32 (31) out of 34 channels pass at the 5% significance level for the EKF (TimesFM)-based detector, with W ∈ [0.990, 0.998] across all channels, indicating only mild departures from Gaussianity. ◁ 1) Model-free replay attacks: We consider a replay attack applied simultaneously to all sensors. The attacker records

V. C ONCLUSIONS In this paper, we proposed a TimesFM-based, modelstructure-free attack detector. We derived closed-form optimal attack policies against a χ2 detector for both LTI and nonlinear systems, and showed that such attacks, while stealthy by construction against the model-based detector, can be reliably detected by the proposed TimesFM-based secondary detector. Finally, we showed that TimesFM predictions can serve as a mitigation tool, enabling robust state estimation even when all sensors are under attack. An important direction for future work is a rigorous characterization of adversaries with black-box query access to gs ; a preliminary empirical investigation is provided in Section IV-A.4. R EFERENCES

Fig. 4. Evaluation of Algorithm 1 on the IEEE 14-bus system under replay attacks (top three rows) and stealthy attacks constructed using Theorem 2 (bottom three rows). For each attack type: (Top) bus frequency ω2 [k] during nominal operation and attack phase; (Middle) mean and standard deviation of the test statistic across 10 trials alongside threshold τp , for the TimesFM-based detector under nominal operation (left) and under attack (right); (Bottom) same for the EKF-based detector.

data over [κ0 , κ1 ] = [60, 70] and begins replaying at ka = 71. The detection results and the attacked sensor trajectory are shown in Fig. 4. Under attack, TimesFM consistently raises alarms throughout the attack period. The EKF-based detector raises alarms only during the initial phase of the attack, after which the replayed data becomes indistinguishable from nominal behaviour in the model-based residual. We note that the nominal FAR of TimesFM is slightly elevated in this experiment due to the limited covariance estimation horizon; a longer clean window Tc is expected to reduce it. 2) Model-based stealthy attacks: We consider a stealthy attack constructed using Theorem 2 with ∆τp = 5.87, starting at ka = 111 and running until k2 = 161. The results are shown in Fig. 4. Under attack, the EKF-based detector raises no alarms, as expected. In contrast, the TimesFMbased detector consistently detects the attack across all trials, demonstrating that attacks designed to be stealthy against model-based detectors are not stealthy against TimesFM, even for nonlinear systems.

[1] J. Giraldo, D. Urbina, A. Cardenas, J. Valente, M. Faisal, J. Ruths, N. O. Tippenhauer, H. Sandberg, and R. Candell, “A survey of physicsbased attack detection in cyber-physical systems,” ACM Computing Surveys (CSUR), vol. 51, no. 4, pp. 1–36, 2018. [2] C. Murguia and J. Ruths, “Cusum and chi-squared attack detection of compromised sensors,” in 2016 IEEE Conference on Control Applications (CCA), pp. 474–480, IEEE, 2016. [3] H. J. Van Waarde, M. K. Camlibel, and H. L. Trentelman, Data-based linear systems and control theory. Amazon, 2025. [4] V. Krishnan and F. Pasqualetti, “Data-driven attack detection for linear systems,” IEEE Control Systems Letters, vol. 5, no. 2, pp. 671–676, 2020. [5] Z. Zhao, Y. Xu, Y. Li, Z. Zhen, Y. Yang, and Y. Shi, “Data-driven attack detection and identification for cyber-physical systems under sparse sensor attacks,” IEEE Transactions on Automatic Control, vol. 68, no. 10, pp. 6330–6337, 2022. [6] T. Shinohara, K. H. Johansson, and H. Sandberg, “Detection and identification of sensor attacks using data,” arXiv preprint arXiv:2510.02183, 2025. [7] J. Reason, E. Hollnagel, and J. Paries, “Revisiting the swiss cheese model of accidents,” Journal of Clinical Engineering, vol. 27, no. 4, pp. 110–115, 2006. [8] J. C. Willems, P. Rapisarda, I. Markovsky, and B. L. De Moor, “A note on persistency of excitation,” Systems & Control Letters, vol. 54, no. 4, pp. 325–329, 2005. [9] A. Das, W. Kong, R. Sen, and Y. Zhou, “A decoder-only foundation model for time-series forecasting,” in Proceedings of the 41st Intl. Conference on Machine Learning, pp. 10148–10167, 2024. [10] N. Falliere, L. O. Murchu, and E. Chien, “W32. stuxnet dossier,” White paper, Symantec Corp., Security Response, vol. 5, no. 6, p. 29, 2011. [11] D. Umsonst and H. Sandberg, “Experimental evaluation of sensor attacks and defense mechanisms in feedback systems,” Control Engineering Practice, vol. 124, p. 105178, 2022. [12] Y. Nakahira and Y. Mo, “Attack-resilient H2 , H∞ , and ℓ1 state estimator,” IEEE Transactions on Automatic Control, vol. 63, no. 12, pp. 4353–4360, 2018. [13] S. Weerakkody, Y. Mo, and B. Sinopoli, “Detecting integrity attacks on control systems using robust physical watermarking,” in 53rd IEEE Conference on Decision and Control, pp. 3757–3764, IEEE, 2014. [14] A. Nanduri and L. Sherry, “Anomaly detection in aircraft data using Recurrent Neural Networks (RNN),” in 2016 Integrated Communications Navigation and Surveillance (ICNS), pp. 5C2–1, Ieee, 2016. [15] M. Kravchik and A. Shabtai, “Detecting cyber attacks in industrial control systems using convolutional neural networks,” in Proceedings of the 2018 workshop on cyber-physical systems security and privacy, pp. 72–83, 2018. [16] J. Miloševič, T. Tanaka, H. Sandberg, and K. H. Johansson, “Analysis and mitigation of bias injection attacks against a Kalman filter,” IFACPapersOnLine, vol. 50, no. 1, pp. 8393–8398, 2017. [17] S. Bhatnagar, H. Prasad, and L. Prashanth, Stochastic Recursive Algorithms for Optimization: Simultaneous Perturbation Methods. Springer, 2013.