{"id":"56ed66b3-e591-49db-b540-6d80e7c91132","arxiv_id":"1908.07689","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"An FDI attack for generator dynamic state estimation is built from the known condition a=Hc and shown to degrade CKF estimates on IEEE 9-bus and 68-bus systems.","lead":"This paper shows how false data can be injected into measurements used for tracking generator behavior, so that the attack evades standard bad-data detection. It demonstrates on two test power grids that such attacks degrade state estimates made by cubature Kalman filters.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (16)-(17) assume \\x98_a=\\x98+c, but the CKF/RCKF update (32) gives \\x98_a=\\x98+WHc; since WH≠I, a=Hc changes the residual and the undetectability proof fails.","rationale":"The reader identified the same load-bearing assumption: residual invariance requires \\x98_a=\\x98+c, which is not established for the CKF/RCKF filters. I agree, and the concern is stronger than 'unproven': the filter's gain structure makes the assumption false even for a linear Kalman filter. Injecting a=Hc shifts the estimate by WHc, and since WH≠I, the attacked residual differs from the original by H(I-WH)c. Hence the claimed equality in Eq. (17) does not hold, and the central undetectability result is invalid as stated. The simulations show that the attack degrades CKF estimates, which is consistent with a generic measurement perturbation, but they do not demonstrate that residual-based detection would fail; no attacked residuals are shown and B_J is tuned post hoc. The paper would need a substantially different attack construction or explicit verification of residual invariance for the actual filter dynamics. As written, I consider the central claim not established, so moving from CONDITIONAL to REJECT is appropriate. The reader's weakest_assumption is the same concern, so agreement_with_reader is 'agree'.","tokens_in":15379,"tokens_out":10311,"duration_ms":104127,"concrete_test":"Reproduce the IEEE 9-bus Case 3 setup, but freeze one attack instant just before the filter update. Compute H from Eq. (13), pick c=(0,0,1,0)^T, form a=Hc, and run one CKF update via Eqs. (29)-(32) with and without a. Compare the actual estimate shift Δ\\x98=\\x98_a-\\x98 with c, and compare the standardized residual after attack with the no-attack residual. If Δ\\x98≠c, or if the residual changes by more than the B_J=2.0 threshold used in §5.3, Eq. (17) is contradicted and the undetectability claim is unsupported. Equivalently, evaluate H(I-WH)c for the filter's gain and show it is nonzero.","verdict_should_be":"REJECT","load_bearing_attack":"The paper's central undetectability claim rests on Eq. (17), which follows from Eq. (16) only under the assumption that injecting a=Hc shifts the estimate by exactly c. This is not merely unproven for the filters used; it is generally false for any Kalman-type filter. The CKF measurement update, Eq. (32), is \\x98_{k+1|k+1} = \\x98_{k+1|k} + W(z_{k+1} - \\x7az_{k+1|k}). If the measurement is attacked as z_a = z + Hc, the posterior becomes \\x98_a = \\x98 + WHc, not \\x98 + c. For the Kalman gain W = P H^T (H P H^T + R)^{-1}, WH is not the identity (in a scalar case, WH = h^2P/(h^2P+R) < 1). Consequently the attacked residual is r_a = z + Hc - H(\\x98 + WHc) = r + H(I - WH)c, so Eq. (17) holds only if H(I-WH)c = 0, a condition that is neither stated nor true for the 3x4 Jacobian used here. The subsequent bound in Eq. (18) addresses only the term a-Hc and does not fix the mismatch H(I-WH)c. Thus the paper does not establish that conventional residual-based bad data detection cannot detect the attack; whether the residual stays below the threshold B_J is a separate, magnitude-dependent question. No attacked-residual plots are reported, so the simulations demonstrate estimation degradation but not stealth. Because undetectability is the paper's claimed contribution, this flaw is load-bearing for the central claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a false data injection (FDI) attack method targeting generator dynamic state estimation. The authors linearize the generator measurement equation with a Taylor expansion, define the attack vector as a = Hc, where H is the measurement Jacobian and c is a state-error vector, and claim that because the measurement residuals before and after the attack are equal (Eq. 17), conventional residual-based bad data detection cannot identify the false data. Three attack severities are tested with the cubature Kalman filter (CKF) and a robust cubature Kalman filter (RCKF) on the IEEE 9-bus system and the New England 16-machine 68-bus system; the simulations show CKF estimates degrading under attack while RCKF estimates remain close to the true values.","tokens_in":15723,"tokens_out":3924,"duration_ms":43804,"significance":"If the residual-invariance claim were valid, the proposed attack would be a simple and practical way to compromise generator dynamic state estimation while evading residual-based bad data detection, which is a relevant concern for PMU-based monitoring and control. The paper also delivers a consistent simulation demonstration that an attack of the form a = Hc degrades CKF estimates while RCKF retains some robustness. However, the central theoretical claim of undetectability is not established: it relies on an assumption about how the filter's state estimate shifts under attack that is generally false for the CKF and RCKF used in the paper. The contribution as a stealth-attack method is therefore not supported; what remains is an empirical study of estimation degradation under a particular attack injection.","major_comments":[{"comment":"The residual-invariance derivation assumes that after the attack the state estimate becomes \\hat{x}_a = \\hat{x} + c. This is not true for the CKF and RCKF estimators used in Section 5. From the CKF measurement update, Eq. (32), the attacked posterior is \\hat{x}_a = \\hat{x} + W(z_a - \\hat{z}) = \\hat{x} + W(z - \\hat{z}) + WHc, so the attacked residual is r_a = z_a - H\\hat{x}_a = r + H(I - WH)c. Equality of residuals holds only if H(I-WH)c = 0, a condition that is neither stated nor satisfied for the 3x4 Jacobian in Eq. (13). The proof of undetectability therefore fails for the actual estimators used in the simulations.","section":"Section 2, Eqs. (16)-(17)"},{"comment":"The bound in Eq. (18) controls only the term a - Hc, which is zero by construction, but the actual residual increment under the Kalman-type update is H(I-WH)c, as shown above. That increment is not bounded or controlled in the manuscript. Consequently, the threshold condition in Eq. (19), r_a <= J_B, is not established; whether the attack evades detection is a magnitude-dependent question that depends on the gain W, the matrix H, and the size of c.","section":"Section 2, Eqs. (18)-(19)"},{"comment":"The simulation section reports estimation error metrics \\tau_1 and \\tau_2 and plots of estimated power angle and angular velocity, but it never reports the attacked measurement residual r_a or compares it with the detection threshold J_B. The metrics used measure estimation accuracy, not stealth. Therefore the simulations demonstrate that the attack degrades CKF estimates, but they do not demonstrate the paper's central claim that the attack is invisible to residual-based bad data detection. This missing evidence is load-bearing because the title and abstract emphasize the avoidance of conventional bad data detection.","section":"Section 5, Figs. 3-21 and Tables 2-3"}],"minor_comments":[{"comment":"The typeset version of Eq. (10) and the surrounding derivation of the linearized measurement equation are garbled, with repeated and misplaced partial derivatives, which makes it difficult to verify the construction of the Jacobian H.","section":"Section 2, Eq. (10)"},{"comment":"The bad data detection threshold J_B is set empirically to 2.0 for the IEEE 9-bus system and 1.5 for the 16-machine 68-bus system, and the RCKF prior thresholds C_i are chosen by visual inspection of residual plots; no sensitivity analysis or systematic selection procedure is given.","section":"Section 5.3 and 5.4"},{"comment":"The claim that this is the first FDI attack method for generator dynamic state estimation is too strong without a more precise comparison to the existing FDI literature for static state estimation and to related dynamic-estimation attack work, such as the Kalman-filter attack studies cited in the introduction.","section":"Abstract and Section 0"},{"comment":"The denominator of \\tau_2 sums squared differences involving z_{it}, which appears to be a measurement value, while the numerator uses the true state; the definition should be clarified to avoid confusion about what the ratio measures.","section":"Section 5.2, Eq. (44)"}],"recommendation":"reject","confidential_remarks":"The paper is within the scope of the journal, and the empirical comparison of CKF and RCKF under the proposed attack is potentially useful. However, the central claim of undetectability via residual invariance is mathematically unsupported for the dynamic estimators used, and the simulations do not provide the missing residual evidence. The flaw is not a minor fix; it would require either a different theoretical setting (e.g., static linear estimation) or a substantially weaker claim about approximate stealth with controlled residual bounds. I recommend rejection, though the authors might rework the paper as an empirical analysis of attack-induced degradation and resubmit."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this paper adapts the textbook FDI condition a=Hc to generator dynamic state estimation with PMUs, and shows via simulation that CKF estimates degrade under the attack while RCKF stays close to truth. The simulation work is honest and useful. The problem is the paper's central claim—that the attack evades residual-based bad data detection—rests on an assumption that is false for the CKF/RCKF update, so the stealth argument does not hold as written.\n\nWhat is actually new is modest. The attack vector is the classical Liu-Ning-Reiter construction, restated with a generator-specific Jacobian. The \"for the first time\" claim is undercut by the cited literature, which already considers FDI attacks in dynamic estimation settings. What the paper does well: it linearizes the generator measurement equation cleanly, builds the 3x4 Jacobian H, sets up three attack severities with increasing sigma_c, and runs CKF vs RCKF on IEEE 9-bus and 68-bus systems. The tables show a clear monotone degradation of CKF estimates as attack strength grows, while RCKF remains close to truth. That is credible evidence that the injected measurements affect CKF-based DSE.\n\nThe main soft spot is Eq. (16)-(17). The residual invariance r_a = r holds only if the post-attack state estimate shifts by exactly c. For a static linear unbiased estimator, that is true. For CKF/RCKF, the update is xhat_a = xhat_pred + W(z + Hc - H xhat_pred) = xhat + WHc. Since WH is not the identity, the attacked residual is r_a = r + H(I - WH)c, not r. Eq. (18)-(19) do not repair this; they only bound the term a-Hc, which is zero by construction. The paper does not report attacked residual traces, so the simulations demonstrate estimation degradation but not stealth. The thresholds B_J and C_i are chosen post hoc, and no code or data are provided. These are fixable: report residual traces, derive the actual residual shift for the CKF update, and either show that the shift stays below the detection threshold or restrict the stealth claim to the static linearized estimator.\n\nWho this is for: readers wanting a quick example of FDI in generator DSE, or a baseline comparing CKF and RCKF under measurement attack. It deserves a serious referee because the application and simulations are concrete, but a referee should push for a correct stealth analysis and honest novelty claims.","headline":"A competent but low-novelty application of the standard a=Hc FDI attack to generator dynamic state estimation; the simulation evidence is real, but the undetectability proof is flawed for the Kalman-type filters actually used.","tokens_in":16282,"tokens_out":3770,"would_cite":false,"duration_ms":41673,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"An attack vector built from the measurement Jacobian hides false data from residual-based detectors in generator dynamic state estimation.","keywords":["false data injection attack","generator dynamic state estimation","cubature Kalman filter","robust cubature Kalman filter","residual-based bad data detection","PMU data","power system cyber security"],"falsifier":"Run the same CKF or RCKF estimator on the generator model, inject a known attack vector $a=Hc$ with nonzero $c$, and compute the post-attack estimate $\\hat{x}_a$; if $\\hat{x}_a-\\hat{x}$ differs from $c$ by more than the residual threshold $B_J$ over time, the residual-invariance identity fails and the attack becomes detectable. A direct residual check comparing $r_a=z_a-H\\hat{x}_a$ with $r=z-H\\hat{x}$ in the nonlinear filter would settle the claim.","tokens_in":15152,"feed_emoji":"⚡","tokens_out":6948,"duration_ms":57135,"temperature":0.7,"pith_summary":"This paper tries to show that an attacker can corrupt generator dynamic state estimation, the real-time estimate of a machine's power angle, speed, and internal voltages, without being caught by standard residual-based bad-data detection. The attack vector is built as $a=Hc$, where $H$ is the Jacobian of the linearized generator measurement equation and $c$ is a small error added to the state estimate; the paper argues that under this choice the measurement residuals before and after the attack are equal, so the injected data looks normal. The authors describe this as the first FDI attack model aimed at generator dynamic state estimation, and test it with the cubature Kalman filter (CKF) and a robust variant (RCKF) under three attack strengths on two test systems. If correct, this means an adversary with knowledge of the measurement model can quietly degrade the situational-awareness data that operators use for monitoring and control.","feed_headline":"Jacobian-built attack slips past power-grid bad-data checks","feed_subtitle":"Residuals stay unchanged when attack vector equals Jacobian times state error, so dynamic estimates degrade silently.","key_machinery":"The load-bearing object is the attack vector $a=Hc$, formed from the Jacobian $H$ of the linearized generator measurement equation and a state-error vector $c$. The argument turns on the residual-invariance identity $r_a=z_a-H\\hat{x}_a=(z+Hc)-H(\\hat{x}+c)=z-H\\hat{x}=r$, which holds when the post-attack state estimate equals $\\hat{x}+c$; the Taylor expansion of the measurement function makes $H$ available, and the residual-based bad-data detector with threshold $B_J$ is the mechanism the attack exploits by keeping the residual below the detection threshold. In the simulations, CKF supplies the nonlinear filtering, and RCKF modifies the measurement-noise covariance through median-based robust estimation to resist outliers.","core_discovery":"The paper's central claim is that false data can be injected into generator dynamic state estimation by choosing the attack vector $a=Hc$, where $H$ is the Jacobian matrix obtained by Taylor-linearizing the generator measurement equation and $c$ is a vector of errors that the attack introduces into the estimated states. Equation (17) states the key identity: after the attack the measurement residual becomes $r_a=z_a-H\\hat{x}_a=z-H\\hat{x}=r$, so the residual is unchanged and residual-based bad data detection cannot flag the data. The paper then treats $c$ as a zero-mean Gaussian vector with three standard deviations (0.01, 0.1, 1) and simulates the attack through CKF and RCKF dynamic state estimation on the IEEE 9-bus and New England 16-machine 68-bus systems. In both systems the CKF estimates of power angle and angular velocity deviate increasingly from the true values as attack strength grows, while RCKF estimates shift less but still show rising error, which the paper reads as confirming that the proposed FDI attack is effective against both filters.","pith_inferences":["Editorial inference: the residual-invariance identity is exact for a linear estimator, but for the nonlinear CKF/RCKF the paper assumes rather than proves that the post-attack estimate shifts by exactly $c$; measuring the actual shift in a nonlinear filter would show how far the stealth guarantee degrades.","Editorial inference: the attack requires knowing the measurement equation and its Jacobian, so it targets a well-informed adversary; a defender could respond by making the measurement model uncertain or by checking consistency between PMU channels over time rather than relying on instantaneous residuals.","Editorial inference: the same $a=Hc$ construction should extend to other derivative-based nonlinear estimators such as extended or unscented Kalman filters, since it only uses the linearized measurement map.","Editorial inference: the paper sets the detection threshold $B_J$ empirically; an adaptive threshold calibrated from residual history might detect these attacks even though a fixed threshold does not."],"forward_implications":["An attacker who knows the generator measurement Jacobian can corrupt dynamic state estimates while the residual-based bad-data detector reports normal operation.","Stronger attacks, modeled by a larger standard deviation of $c$, push the CKF estimates of power angle and angular velocity farther from the true values in both test systems.","The robust CKF reduces but does not eliminate the attack's effect, so robust filtering alone does not fully protect generator dynamic state estimation.","Because the same construction is tested on a 9-bus and a 16-machine 68-bus system, the attack is not specific to one small test network.","The computation time of both filters stays well below the PMU sampling interval in the simulations, so the attack and its effects are compatible with real-time dynamic state estimation."],"supporting_citations":[{"why":"Supplies the CKF algorithm and the generator dynamic state estimation model used throughout the paper.","marker":"[1]"},{"why":"Provides the generator measurement equations for power angle, angular velocity, and electrical power that are linearized to build the Jacobian $H$.","marker":"[3]"},{"why":"Gives the residual-invariance principle for false data injection that the attack vector construction relies on.","marker":"[9]"},{"why":"Establishes the classic FDI attack construction against power system state estimation, which the paper adapts to generator dynamic state estimation.","marker":"[10]"},{"why":"Provides the New England 16-machine 68-bus test system used to show the attack transfers beyond the smaller 9-bus case.","marker":"[16]"},{"why":"Defines the residual equation and the residual-based bad data detection that the attack is designed to bypass.","marker":"[22]"},{"why":"Supplies the choice of the state-error vector $c$ as a zero-mean Gaussian distribution for the attack scenarios.","marker":"[23]"}],"fun_headline_variants":["Residual-equal attack fools power-grid bad-data checks","Generator state attack leaves residuals untouched","Attack vector from Jacobian foils bad-data detector","FDI attack exploits residual equality to evade detection"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's stealth rests on the assumption that after injecting $a=Hc$, the dynamic estimator's state estimate becomes exactly $\\hat{x}+c$; this shift-by-$c$ property is proven for linear static estimators but is assumed without proof for the nonlinear CKF and RCKF filters in this paper.","fun_headline_variants_meta":{"raw":{"variants":["Residual-equal attack fools power-grid bad-data checks","Generator state attack leaves residuals untouched","Attack vector from Jacobian foils bad-data detector","FDI attack exploits residual equality to evade detection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000845,"raw_usage":{"total_tokens":3695,"prompt_tokens":975,"completion_tokens":2720,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":591,"completion_tokens_details":{"reasoning_tokens":2661}},"tokens_in":591,"tokens_out":2720,"duration_ms":19918,"temperature":1.0,"reasoning_tokens":2661,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:45:21.105277+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same CKF or RCKF estimator on the generator model, inject a known attack vector $a=Hc$ with nonzero $c$, and compute the post-attack estimate $\\hat{x}_a$; if $\\hat{x}_a-\\hat{x}$ differs from $c$ by more than the residual threshold $B_J$ over time, the residual-invariance identity fails and the attack becomes detectable. A direct residual check comparing $r_a=z_a-H\\hat{x}_a$ with $r=z-H\\hat{x}$ in the nonlinear filter would settle the claim.","supporting_citations":[{"cited_title":"基于容积卡尔曼滤波的发电 机 动 态 状 态 估 计 [J]","cited_arxiv_id":null,"evidence_quote":"Supplies the CKF algorithm and the generator dynamic state estimation model used throughout the paper."},{"cited_title":"基于平方根容积卡尔曼滤波 的 发 电 机 动 态 状 态 估 计[J]","cited_arxiv_id":null,"evidence_quote":"Provides the generator measurement equations for power angle, angular velocity, and electrical power that are linearized to build the Jacobian $H$."},{"cited_title":"False data injection attacks against state estimation in electric power grids[J]","cited_arxiv_id":null,"evidence_quote":"Establishes the classic FDI attack construction against power system state estimation, which the paper adapts to generator dynamic state estimation."},{"cited_title":"基于无迹变换强跟踪滤波 的发电机动态状态估计 [J]","cited_arxiv_id":null,"evidence_quote":"Provides the New England 16-machine 68-bus test system used to show the attack transfers beyond the smaller 9-bus case."},{"cited_title":"输电网虚假数据攻击研究综 述[J]","cited_arxiv_id":null,"evidence_quote":"Defines the residual equation and the residual-based bad data detection that the attack is designed to bypass."},{"cited_title":"基于拉格朗日乘子法的虚假 数据攻击策略[J]","cited_arxiv_id":null,"evidence_quote":"Supplies the choice of the state-error vector $c$ as a zero-mean Gaussian distribution for the attack scenarios."}],"review_version":1}