As industrial control systems (ICS) become increasingly reliant on artificial intelligence to spot problems early, new research reveals a critical vulnerability: the training data used to teach these AI models can be compromised, leading to less reliable detection of anomalies. This matters because ICS manage vital infrastructure like water treatment plants and power grids, where undetected faults or cyberattacks could have serious consequences. The study, recently published on arXiv, explores how different types of contamination in training data affect various machine-learning-based anomaly detection models, shedding light on which approaches are more resilient and which are alarmingly fragile.
Key Takeaways
- Training data contamination—such as injected attack samples or noisy data—can significantly reduce the effectiveness of anomaly detection models in industrial control systems.
- Not all models are equally vulnerable: local-density and distance-based detectors suffer the most from contamination, while methods like PCA, SVM, HBOS, and Isolation Forest tend to be more robust.
- Introducing noise to normal training samples has a smaller impact on model performance compared to injecting actual attack data.
- Robustness to contaminated training data cannot be reliably predicted from how well models perform on clean data alone.
The researchers focused on anomaly detection systems designed to identify unusual behavior in ICS environments, using a well-known benchmark dataset from a secure water treatment testbed. Anomaly detection models are trained on historical data labeled as ‘normal’ to learn typical system behavior. However, in real-world settings, this training data can be corrupted intentionally or accidentally—through compromised logs, incorrect labels, or manipulation of recorded system states—potentially misleading the AI into misclassifying threats.
To simulate these scenarios, the team introduced three types of contamination during the training phase: random injection of attack samples, targeted injection of attack samples similar to normal data, and the addition of subtle Gaussian noise to normal samples. Unlike some advanced poisoning attacks that use gradient-based techniques to fool models, these contamination methods are simpler but still realistic in industrial contexts. The researchers tested 11 different anomaly detection algorithms, ranging from classical statistical methods like Principal Component Analysis (PCA) and Support Vector Machines (SVM) to more recent neural network approaches.
By evaluating model performance on clean validation and test datasets after training with contaminated data, the study found that contamination impacts varied widely depending on the detection method. Distance-based and local-density detectors, which rely heavily on measuring how far or dense data points are relative to each other, showed the greatest degradation when attack samples were injected into the training set. In contrast, PCA, SVM, Histogram-Based Outlier Score (HBOS), and Isolation Forest (IForest) algorithms maintained relatively stable performance, indicating stronger resilience to corrupted training data. Neural network models showed moderate vulnerability, performing better than the most affected methods but worse than the robust ones.
These findings underscore the importance of ensuring the integrity of training data in industrial AI applications. Since robustness cannot be inferred simply by testing models on clean data, organizations should carefully consider which anomaly detection approaches to deploy and invest in data validation and cleaning processes. The research also highlights that contamination through injected attack samples poses a more significant threat than noise, suggesting targeted data tampering could be particularly damaging.
Looking ahead, the study opens the door for further exploration into defenses against training-time contamination and more robust model designs. As industrial systems become more interconnected and AI-dependent, safeguarding the quality of training data will be crucial to maintaining reliable, secure operations. This paper provides a timely reminder that the security of AI in critical infrastructure depends not only on sophisticated algorithms but also on trustworthy data foundations.
Based on research published on arXiv by Mustafa Umut Ozbek, Taiwo Ojo, Pooria Madani et al..