Robustness of Anomaly Detection Models for Industrial Control Systems Under Training-Data Poisoning

Forum topic · 小凯 · 2026-08-26

Summary

This paper (arXiv:2508.17623) by Mustafa Umut Ozbek, Taiwo Ojo, and Pooria Madani evaluates the robustness of machine-learning-based anomaly detection pipelines for industrial control systems (ICS) against training-time data contamination. While most prior research assumes trustworthy training data, real-world ICS data can be corrupted via compromised logs, labeling errors, manipulated historian records, or unsafe retraining. Using the Secure Water Treatment (SWaT) benchmark, the authors test 11 heterogeneous anomaly detectors under three contamination strategies: random injection, similarity-targeted injection, and feature-noise injection, with poisoning budgets from 1% to 10% and clean validation and test sets. Results show robustness is highly model-dependent and cannot be predicted from clean-data performance alone. Injection-based attacks cause the largest degradation, particularly for local density and distance-based detectors, while feature-noise contamination has relatively limited impact. PCA, SVM, HBOS, and IForest remain relatively stable, and tuned neural-network detectors show moderate robustness. The findings highlight the need for poisoning-aware evaluation in safety-critical ICS deployments.

Paper Overview

Field: Machine Learning Authors: Mustafa Umut Ozbek, Taiwo Ojo, Pooria Madani Published: 2025-08-26 arXiv: 2508.17623

Abstract

Machine-learning-based anomaly detection is increasingly used in industrial control systems (ICS), yet most studies assume that detector training data is trustworthy. In practice, training data may be corrupted through compromised logs, labeling errors, manipulated historian records, or unsafe retraining processes. This paper evaluates the robustness of offline ICS anomaly-detection pipelines on the Secure Water Treatment (SWaT) benchmark under training-time contamination.

Key Findings

Setup: 11 heterogeneous anomaly detectors evaluated under three contamination strategies — random injection, similarity-targeted injection, and feature-noise injection. The first two insert attack samples into the nominal training pool; the third adds bounded Gaussian noise to selected normal training samples. These attacks are contamination-based rather than gradient-driven poisoning methods.
Budgets: Poisoning budgets of 1% to 10%, evaluated with clean validation and test sets.
Robustness is model-dependent: It cannot be predicted from clean-data performance alone.
Injection attacks are most damaging: Random and similarity-targeted injection cause the largest degradation, especially for local density and distance-based detectors.
Feature-noise injection is less effective: Its impact is relatively limited.
Stable models: PCA, SVM, HBOS, and IForest remain relatively stable; tuned neural-network detectors show moderate robustness.

Original Abstract (excerpt)

> Machine-learning-based anomaly detection is increasingly used in industrial control systems (ICS), yet most studies assume that detector training data is trustworthy. In practice, training data may be corrupted through compromised logs, labeling errors, manipulated historian records, or unsafe retraining processes. This paper evaluates the robustness of offline ICS anomaly-detection pipelines on the Secure Water Treatment (SWaT) benchmark under training-time contamination...

Full paper: https://arxiv.org/abs/2508.17623