Telemetry, Model, Command: Attack Vectors Against Cyber-Physical Systems

This article is based on two scientific publications and a laboratory testing report:

Zero-trust cybersecurity framework for AI-driven Energy Internet and smart grid systems — detecting falsified measurements and managing trust in power system participants.

Domain adaptation affects adversarial robustness in autonomous steering models — how adapting steering models affects their behavior under adversarial attacks.

From Digital to Physical: The AI Threat Is Here — testing AI agents in Booz Allen’s laboratory IT/OT environment, including controlled physical effects on equipment.

The Path to the Equipment

A control system makes decisions based on measurements, predictions, and the current state of the equipment. Altering the readings can distort its understanding of what is happening and thereby produce an incorrect control output. Gaining access to the right interface makes it possible to send a command directly to a device or through a supervisory control system.

In all these cases, a digital intervention can potentially lead to physical effects. But the path differs: in some cases, the attacker needs control over measurements; in others, over the model’s input; and in others, over an account or a network route to a control service. The points at which the action can still be stopped also differ.

The selected materials let us examine these paths using the examples of a power system, an automotive control model, and an industrial testbed. AI plays different roles in them — helping detect false data, processing an attacked input itself, or performing tasks on the attacker’s side. These mechanisms can overlap, so they should not be treated as three strictly isolated classes of vulnerabilities.

At the same time, a calculation error, a dangerous command, and an executed movement of equipment are different outcomes. Between them lie control logic, access permissions, operating modes, and protective constraints. These transitions determine how far the intervention can go.

Telemetry

Zero-trust cybersecurity framework for AI-driven Energy Internet and smart grid systems addresses a specific problem — an attacker falsifies some of the measurements used to calculate the state of the electrical grid. This is done through False Data Injection (FDI) — the injection of false data.

The control center receives measurements of voltages, power, and power flows. State estimation connects them to a mathematical model of the grid and reconstructs a consistent picture of its operation. Checks can reveal that some readings do not fit this picture well. In other words, there is a discrepancy between an incoming measurement and the value implied by the estimated state.

Simple, crude falsification can leave a noticeable trace. But an informed attacker can select changes that account for the grid’s interrelationships, making the false data look more plausible to the checks. A measurement arriving from a known device over an authorized connection does not automatically make it true.

Access and Knowledge

In the main threat model, the authors assume that the attacker knows the mathematical model of the electrical grid and can modify a limited set of measurements within a single zone. Measurements outside this set remain beyond the attacker’s control. Breaking into the device, obtaining credentials, or infecting the system are not part of the experiment — the ability to falsify measurements is already assumed as an initial condition.

This matters when interpreting the result. The study shows how estimation and detection behave under a deliberately prepared falsification attack. It does not establish how easy it is to obtain the necessary access at a real substation.

For the physical process, the following chain is of interest:

access to measurements → consistent falsification of telemetry → distorted state estimate → possible incorrect control decision

For example, a false picture could prevent an overload from being noticed or affect the choice of the grid’s operating mode. These are possible consequences of the mechanism. The study does not test subsequent control of an operating facility or demonstrate equipment damage. Linking an estimation error to specific damage would require separately accounting for the control algorithm, the state of the grid, and the operation of protective systems.

A neural network does not need to be integrated into control for this problem to arise, and the authors themselves work with classical power system state estimation. Machine learning in the proposed architecture helps identify signs of falsification.

The Physics of the Process

The authors propose combining physics-based checks with continuous trust assessment. The grid is divided into observability zones. In addition to a global check of measurements, inconsistencies in power flow measurements on links between zones are analyzed. In the main setup, these boundary measurements are outside the set controlled by the attacker and help check how well the internal picture of a zone agrees with the rest of the grid.

The features are fed into a trainable risk assessment model — logistic regression. Its parameters are aggregated from models trained across zones, without centrally collecting the raw data. The risk estimate, together with information about a participant’s authentication and behavior, influences its trust score. The access policy links this score to allowing an action, requiring an additional check, or denying it.

This is how zero trust takes on a meaning tied to the industrial process here — trust in a device depends, among other things, on how consistent its readings are with the physical model.

However, the independence of the verification data has its limits. If the attacker controls enough measurements and the remaining measurements outside their control no longer allow the state to be uniquely determined, it becomes possible to coordinate the falsification so that the checks cannot distinguish it. In a separate experiment that expands the set of compromised measurements, the authors show detection falling to the false-alarm level. Additional layers of checking are useful as long as the system retains information to which the attacker cannot assign an arbitrary value.

The architecture is evaluated in simulations of standard IEEE 14-, 30-, and 118-bus systems with synthetic measurement noise. The results allow detectors to be compared under the specified conditions, but they do not replace testing on telemetry from an operating facility. The robustness of federated learning to poisoned updates from a compromised zone is not tested in this study either.

The Cost of Distrust

The paper contains a result that may matter just as much for operations as detecting falsification. If fresh evidence about a participant’s state stops arriving, its trust gradually declines toward a conservative baseline. When the value becomes low enough, access is revoked.

In a simulation with 60 participants over 300 steps, this policy is sensitive to message loss. At a 10% probability of losing an update, the average proportion of legitimate participants whose access is mistakenly revoked is 1.8%, but at 20% it is already 56.4%, and at 30% it reaches 99.4%. These results are reported in a table and averaged over 20 runs with different random initial conditions for each loss level.

It is an unpleasant situation: communication deteriorates, evidence becomes stale, and the protection mechanism starts revoking access on a massive scale. The authors acknowledge this shortcoming and propose introducing an intermediate “unverified” state, with a more gradual response to missing data.

This does not mean that every access denial will bring the power system to a halt. The study did not test that causal chain. But deployment will require defining which operations are blocked, how essential control functions are maintained, and what happens when communication is lost. A policy that is good at catching an intruder must also allow functioning equipment to operate under imperfect conditions.

Testing Under Attack

In Domain adaptation affects adversarial robustness in autonomous steering models, the target is the input to a neural network model that predicts the steering wheel angle from a road image.

The authors study the adaptation of models from American right-hand traffic data to Australian left-hand traffic conditions. They compare PilotNet and ResNet-18, with four training configurations for each architecture: training on the original American data, training on horizontally flipped data, fine-tuning the first variant on Australian data, and doing the same with the second.

Adaptation itself is a normal engineering task. The question is how it changes the model’s response to a deliberately crafted perturbation.

The Weights Stay the Same, the Input Changes

In the experiment, the attacker modifies the input image to increase prediction error. This is an attack at inference time. The model’s weights are not rewritten during the attack, and the training data is not poisoned.

The methods used are FGSM (Fast Gradient Sign Method) and PGD (Projected Gradient Descent). The first takes a single step based on the error gradient; the second constructs the perturbation iteratively within a specified constraint. The main experiments are white-box: the information about the target model needed to compute the gradient is available when constructing the perturbation. Transfer between architectures is also tested — an example is prepared using one model and fed to another without using the target model’s gradients. Transferred perturbations also increase error, but are generally weaker than the corresponding white-box attacks. The result depends on which model was used to prepare the perturbation and which became the target.

The changes are applied after preprocessing, in the normalized YUV (Luminance, Chroma Blue, Chroma Red) input representation. This is therefore a controlled digital manipulation of the model’s input. Gaining access to that input in a vehicle, placing a physical sticker on the road, or altering an image in a way imperceptible to a person are not demonstrated here.

For a real attack, one must explain how the prepared perturbation will appear in the exact representation the model receives. The ability to compute a suitable array of pixels does not, by itself, provide the ability to deliver it into the system.

Different Behavior

The evaluation uses 3000 images of Australian highways taken from a separate video and not used for fine-tuning or validation. On clean data, fine-tuning substantially improves accuracy. Under attack, the result depends on the architecture, the adaptation method, and the chosen perturbation.

The example of two fine-tuned PilotNet variants is revealing. The table below gives the mean absolute error in the predicted steering wheel angle. PGD uses ten iterations and a perturbation budget of ε = 0.03 in the normalized input space.

On clean data, the results are almost identical. In the selected test, the response to the attack differs substantially. For these model instances, checking clean accuracy alone would not have revealed this difference.

However, this example cannot be turned into a rule that “pretraining on flipped data makes models vulnerable.” Each combination of architecture and adaptation method was trained once. The confidence intervals and statistical comparisons describe variation across test images, not across a set of independently trained models. PGD also used a single random attack initialization, so the result is not a guaranteed worst-case estimate.

The authors separately examine the trap of relative metrics. Their RS (Robustness Score) is the ratio of mean squared error (MSE) on clean data to MSE under attack. After fine-tuning, clean error can become very small. Even a moderate error under attack will then produce a low RS, although in absolute terms the model may still make smaller errors than its poorly adapted predecessor.

The conclusion that “robustness has deteriorated” therefore needs clarification, because there is no clear-cut answer — does this refer to the increase in error relative to the model’s own baseline, or to the magnitude of error under attack? For control, the magnitude itself, the frequency of large deviations, and the conditions in which they arise all matter.

Model Robustness

The mechanism can be represented as follows:

access to the model’s input → deliberately crafted image modification → incorrect angle prediction → possible effect on movement

The study measures prediction error. It does not test a physical vehicle or closed-loop driving, where actions change subsequent observations. Nor was the model’s output constrained to the physically permissible angle range before the metrics were calculated. Therefore, the 70° error in the table cannot be turned into a claim that a vehicle actually performed the corresponding maneuver.

The physical consequence will depend on how the prediction is used, the vehicle’s dynamics, the duration of the attack, and the checks performed before execution. A single incorrect estimate and a sequence of incorrect commands while driving create different conditions. The model studied is one component of a possible control system.

For industrial applications, this raises a useful question: what happens to robustness after a model is transferred to another camera, installation, or operating mode? This is an engineering generalization of the results, rather than an industrial scenario tested by the authors. But it sets a concrete task — after adaptation, evaluate not only accuracy on normal data but also behavior under input changes available to the attacker, and then test the consequences within the full control loop.

AI Assistant

In Booz Allen’s report From Digital to Physical: The AI Threat Is Here, the target is the infrastructure through which equipment can be controlled. AI agents explore the environment, find accessible systems, choose ways to gain access, and carry out actions through tools.

The tests took place in an isolated laboratory with equipment from different manufacturers. The testbed modeled an enterprise: a corporate segment, an industrial DMZ, and operational and production zones. It included controllers, HMI, SCADA, engineering and operator workstations, a variable-frequency drive, a motor, and a robotic arm. The authors specifically note imperfect segmentation and configuration characteristics typical of industrial infrastructure that has been in service for a long time.

Operators provided subnet boundaries and tasks in plain text. According to the methodology, the agents were not given source code, engineering documentation, or detailed OT instructions. However, human approval was required before running an exploit or taking an action with a physical effect. In other words, this was a controlled laboratory test, but with real equipment.

Sequence of Actions

The agents identified devices and their roles, explored interfaces and protocols, matched information about systems against known vulnerabilities, and changed their approach after failures. In this chain, AI helped connect individual technical tasks: reconnaissance results became the basis for the next step, while an error provided new information about the environment.

In the robotic arm test, the agent discovered the device, identified its API, gained administrative access, determined its motion limits, and, after receiving approval, executed a movement. For this scenario, the path from digital access to physical action was indeed completed on the testbed’s equipment.

Another example concerns SCADA. Initially, the agents modified the wrong version of the operator interface, and the expected effect did not appear on the screens. They investigated active sessions, identified the version in use, and adjusted their actions, successfully changing what was displayed on the operator screens.

At the same time, they discovered that SCADA maintained already authenticated connections to 14 OT devices, including the identified controllers. This is a significant architectural feature: a single compromised service can have both broad visibility into the process and ready-made paths for sending commands.

The authors consider the possibility of simultaneously affecting equipment and distorting the operator’s view. The described episode demonstrates changes to the interface and the presence of control connections. For risk analysis, the combination of these capabilities at a single accessible point already matters.

Standard Commands

The report explicitly states that, at the OT device level, agents frequently used standard protocols and commands. Previously obtained access allowed them to interact with the equipment in the intended way. Exploiting vulnerabilities could help them reach the necessary segment or application, while the actual intervention was carried out through a normal control interface.

The chain here therefore looks like this:

access to the environment → exploration of devices and connections → obtaining the necessary privileges or reaching an unprotected interface → control command → physical action

Executing this chain requires specific conditions — a network path, an accessible service, suitable permissions or insufficient command validation, and a device mode that permits remote intervention. AI helps find and use these conditions. The presence of an agent does not, by itself, make an inaccessible interface accessible or override hardware constraints.

For defense, this means that detecting known exploits is not enough. Controller mode changes, program and configuration uploads, operations that force values, SCADA project changes, and unusual use of standard control connections all matter. A formally valid command needs to be checked in context: who sent it, from where, for which operation, and under what process conditions.

Where the Demonstration Ends

Booz Allen reports that the objectives of all eight controlled scenarios were achieved. In one test, the transition from perimeter compromise to actions in the control segment took just over 16 minutes. This is the time for a particular episode with a specific starting point and testbed configuration. Of course, it does not mean that any factory can be hacked in 16 minutes, but it still gives pause for thought.

Nor do eight achieved objectives establish a universal probability of a successful attack. The public report does not provide enough information about the specific models, the number of repetitions of each scenario, or the conditions of all runs to make such an estimate. It also provides no controlled comparison with a human team performing identical tasks. The authors link their observations to reductions in time and the need for specialized knowledge.

At the same time, the report contains useful examples of constraints that worked. One controller initially rejected a stop request, and local control mode prevented a remote motor start in one of the runs. Firewalls, segmentation, and endpoint protection also blocked or slowed individual actions. In some cases, the agents found another way to proceed.

The result therefore depends on the entire available chain. A rejected command can indeed prevent a specific effect. To protect the process, one must also check whether another interface, trusted application, or network path leaves the same effect achievable.

Finally, human approval in the laboratory constrained the actions the agents themselves were allowed to take. It matters when interpreting the tests, but it is not a barrier an attacker will necessarily encounter at a production facility. The facility’s protective barriers remain its own access mechanisms, control modes, and execution constraints.

Conclusion

All three materials can be considered through a common question: how does an intervention available to an attacker become the basis for an equipment action? The entry points differ, but the potential outcome is the same — an unwanted change in the physical process.

In the first study, the attacker falsifies telemetry and thereby distorts the system’s understanding of the electrical grid’s state. The mathematical model and estimation algorithm can remain unchanged. It is enough to influence the data from which they reconstruct the picture of what is happening. If subsequent control relies on this picture, an incorrect estimate can affect the decisions made.

In the second study, the intervention targets the input to a neural network model. Its parameters also remain unchanged, but a deliberately modified image leads to an incorrect prediction of the steering wheel angle.

The third material examines gaining access directly to the control infrastructure. An AI agent helps explore the environment, find accessible interfaces, and obtain the ability to send commands to equipment. Here, the attacker can specify an action through a control service, including by using standard protocols.

Thus, a physical process can be influenced through data about its state, through the input to a model that produces predictions for control, or by sending a command directly to a device. In every case, the crucial point is when an attacker-controlled change begins to determine the equipment’s behavior.

This leads to a general conclusion for defense: assess whether a change available to an attacker can turn into an unwanted equipment action, and which independent checks and constraints can stop that transition. This requires considering the state of the process, how the data is used, and whether a particular command is permissible.

A false measurement can appear consistent. An incorrect prediction can fit the permitted format. An unwanted command can arrive over a standard protocol from a familiar server. That is why the entire chain should be checked — all the way to what the equipment will actually be able to do.