{"id":"fdb7af21-3c27-4ef2-ab47-ab744ced3f34","arxiv_id":"2411.15229","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A DRL-based adaptive voltage protection scheme is trained against a stealthy load alteration attacker and claimed to mitigate all such attacks via a convex-concave Stackelberg game guarantee.","lead":"This paper trains a reinforcement learning agent to adaptively adjust voltage protection thresholds in a smart grid, defending against stealthy attacks that manipulate air-conditioning loads. The authors claim a game-theoretic guarantee that this adaptive protection stops any such attack, and they demonstrate it in a hardware-in-loop test on an IEEE 14-bus grid.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Claim 1 rests on an unproved and likely false convex-concave payoff: f in Eq. 4 is discontinuous at the threshold boundaries and ΔT enters through dV/dt, so the Stackelberg-equilibrium theorem cannot be invoked.","rationale":"The paper's headline claim is a theoretical guarantee that the learned adaptive protection system mitigates any stealthy load alteration. That guarantee rests entirely on Claim 1 and the identification of the MARL game as a convex-concave Stackelberg game. The reader's weakest-assumption analysis identifies the same region of the paper, but my stress-test focuses on a sharper, more checkable defect: the payoff f in Eq. 4 is not continuous on the defender's action space because c1 and c2 are boolean switches at exactly the thresholds that the defender controls. The second-derivative claim about ΔT is also not a direct computation, since ΔT enters through the grid dynamics in dVi/dt. If this premise fails, the cited equilibrium theorem does not apply, and the paper provides no alternative proof of the 'any' quantifier. The experiments cover one IEEE 14-bus scenario with one trained attacker and one trained defender; even a successful demo does not verify a universal guarantee. The suggested Hessian/continuity audit is a decisive, inexpensive check: if the Hessian signs happen to hold on the actual trajectories and the function is continuous, the convexity objection should be withdrawn, though the reversed inequality, the payoff-to-blackout gap, and the DRL convergence concerns would remain. On balance, the central theoretical claim is unsupported as written, so the REJECT verdict remains appropriate.","tokens_in":10354,"tokens_out":6864,"duration_ms":70766,"concrete_test":"Using the actual IEEE 14-bus Simulink/Opal-RT model and Eq. 4, sample a dense grid of states from μ0 and attacker/defender actions from Alaa × Aavps. Use automatic differentiation (or central finite differences with step 1e-4) to compute ∂²f/∂ΔT² and ∂²f/∂V_u_th² and to evaluate f on both sides of the boundaries Vi = V_l_th and Vi = V_u_th. If any sampled state-action pair gives a positive second derivative in ΔT, a negative second derivative in V_u_th, or a jump discontinuity in f, then Claim 1's convex-concave premise is refuted; if the Hessian signs hold everywhere and f is continuous, this particular objection fails.","verdict_should_be":"REJECT","load_bearing_attack":"The paper's advertised guarantee is Claim 1, which is obtained entirely by classifying Gprot as a convex-concave Stackelberg game. That classification is asserted in Section III-C, not derived. In Eq. 4, c1 is a boolean indicator that is 0 when Vi < V_l_th and 1 otherwise, and c2 is 0 when Vi > V_u_th and 1 otherwise; the terms c1 log(1+exp(-Vi/V_l_th)) and c2 log(1+exp(-V_u_th/Vi)) therefore jump at the threshold boundaries, so f is not continuous and smooth on Aavps. The claim that the second derivative of f with respect to ΔT_i is negative is also unsupported: ΔT_i appears both in log(1+kΔT_i) and through dVi/dt, which depends on ΔT_i via the nonlinear power-flow and generator equations, so the sign of the total second derivative is not fixed by k alone. Without continuity/smoothness and without the required concavity/convexity, the appeal to [15] has no premise. Separately, even if convex-concavity held, the proof's inequality J_{π_laa,π*_avps} ≥ J_{π*_laa,π*_avps} is reversed for a maximizing attacker, and no step links the equilibrium value of f to the blackout condition in the definition of an SLA. The 'any stealthy load alteration' conclusion therefore does not follow from the stated game.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a deep reinforcement learning (DRL)-based adaptive protection system (APS) for smart grids against stealthy load alteration attacks (SLAs). The authors model the interaction between a load alteration attacker (LAA) and an adaptive voltage protection system as a two-player zero-sum Markov game, define a payoff function f, and claim that because the game is convex-concave, a Stackelberg equilibrium exists and the resulting APS policy mitigates any SLA. The method is implemented in a competitive MARL setting with DDPG for the attacker and DQN for the defender, and validated on an IEEE 14-bus model in a hardware-in-the-loop setup.","tokens_in":10787,"tokens_out":2692,"duration_ms":27740,"significance":"If the central theoretical claim were correct, the paper would provide a useful template for designing adaptive protection schemes with formal guarantees against a class of cyber-physical attacks. The HIL implementation and the attempt to connect game-theoretic equilibrium with practical threshold adaptation are commendable. However, the theoretical guarantee is the main advertised contribution, and it rests on several unproved and, as written, incorrect steps: the payoff function is not continuous, convexity/concavity is asserted without derivation, the proof of Claim 1 contains a reversed inequality, and the connection between the equilibrium payoff and the blackout condition is missing. The experimental section also only tests the method against the authors' own learned attacker, so it cannot substantiate the 'any stealthy load alteration' claim. These issues are load-bearing, and the set of results does not support the paper's central claim in its current form.","major_comments":[{"comment":"The assertion that f in Eq. (4) is continuous and smooth in the action spaces is not correct. The boolean variables c1 and c2 are defined as step functions that jump when Vi crosses Vl_th or Vu_th, respectively, so the terms c1 log(1+exp(-Vi/Vl_th)) and c2 log(1+exp(-Vu_th/Vi)) are discontinuous at the threshold boundaries. This discontinuity undermines the invocation of the convex-concave Stackelberg game result from [15], which requires the required regularity and convexity-concavity assumptions. The claim that f is convex in Vu_th and concave in ΔT_i is asserted without derivation, and the dependence of dVi/dt on ΔT_i through nonlinear power-flow and generator equations means the sign of the total second derivative is not fixed by the term k alone.","section":"Section III-C, Completeness"},{"comment":"The inequality in the proof of Claim 1 is reversed for a maximizing attacker. The proof states J_{π_laa,π*_avps} ≥ J_{π*_laa,π*_avps} for any suboptimal π_laa, but since π*_laa is a maximizer, the correct inequality is J_{π*_laa,π*_avps} ≥ J_{π_laa,π*_avps}. As written, the proof's conclusion does not follow from the preceding argument. Moreover, the proof never defines what it means for the mitigator to 'mitigate' an attack in terms of the game payoff; no step links the value of f or J to the blackout condition used in the definition of an SLA, so even a correct equilibrium statement would not establish the paper's advertised guarantee.","section":"Section III-C, Claim 1 proof"},{"comment":"The optimization problem in Eq. (5) uses arg min over π_avps of arg max over π_laa, which is a min-max formulation. However, the text in Section III-A describes the attacker as moving first and the mitigator responding after observing the attack. For a Stackelberg game with the attacker as leader, the appropriate ordering is max over π_laa of min over π_avps (or the relevant leader-follower hierarchy must be explicitly specified). The paper does not justify the min-max order in Eq. (5) or explain why the learned policies, which are updated simultaneously in Algorithm 1, correspond to a Stackelberg equilibrium rather than a Nash equilibrium. This ambiguity affects the central game-theoretic claim.","section":"Section III-C, Eq. (5)"},{"comment":"The soundness argument states that because Q maximization in DDPG/DQN resembles the objective J in Eq. (5), the MARL training in Algorithm 1 converges to a policy that solves Eq. (5). No convergence theorem is provided for this competitive MARL setting, and the references to [15] concern existence of equilibria, not convergence of DDPG/DQN. The claim that the learned policy 'converges to a sound policy π*_avps' is therefore unsupported. The experimental results in Section IV only compare the APS against the trained LAA policy, not against arbitrary or hand-crafted SLA strategies, so they do not provide evidence for the 'any SLA' guarantee.","section":"Section III-C, Soundness"}],"minor_comments":[{"comment":"There is a typo in the policy definitions: both players' policies are written as πlaa : S 7→ Alaa; the mitigator's policy should be πavps : S 7→ Aavps.","section":"Section III-A"},{"comment":"The formal definition of an SLA says the voltage 'deviates from its normal profile, leading to blackout condition,' but 'blackout condition' is never precisely defined. Since the paper's guarantee is about preventing blackouts, a precise formal definition is needed.","section":"Section II, Load Alteration Attack Model"},{"comment":"The notation for thresholds is inconsistent: the game description uses Vl_th and Vu_th, while Section II uses Vl_Thj and Vu_Thj. The relationship Vu_th = α × Vl_th is introduced without stating the domain of α beyond (1,2]; this should be clarified because it affects the action space Aavps.","section":"Section III-A, Eq. (4)"},{"comment":"The false-positive-rate experiment in Fig. 4c is presented as 2/7 based on premature triggering in two of seven noise scenarios, but the text does not specify the criteria for 'premature' or the exact timing tolerance. The figure would benefit from clearer labeling of the noise variance values and the corresponding APS activation times.","section":"Section IV"},{"comment":"The codebase reference [16] is given as an anonymous repository; if this is intended for a double-blind submission, that is fine, but the anonymity should be maintained consistently in any public version.","section":"References"}],"recommendation":"reject","confidential_remarks":"The paper's central claim is a formal guarantee that the learned protection policy mitigates any stealthy load alteration attack. That claim is the main reason for publication, and it fails on multiple technical points that are not local presentation issues: the payoff is not continuous, the convex-concave classification is unsupported, the proof's inequality is reversed, and the evaluation only considers the authors' own DRL attacker. These deficiencies are not fixable by minor edits; they require either a substantially different theoretical argument or a much weaker claim. For these reasons, I recommend rejection, though a future revision that either proves the required properties under explicit assumptions or narrows the claimed guarantee to the empirically demonstrated setting could be reconsidered."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear X,\n\nThe thing to know: this paper is a solid engineering contribution wrapped around a theoretical guarantee that does not hold. The DRL-based adaptive voltage protection idea is sensible, and the HIL demo on the IEEE 14-bus model is real evidence the approach can work in practice. The authors also released code, which is appreciated.\n\nWhat's actually new is the combination: a two-player zero-sum Markov game between a stealthy load-altering attacker and a threshold-adjusting protection agent, with DDPG for the attacker and DQN for the defender, plus an FVSI-based targeting heuristic. That combination is not in the cited prior work, and the problem is well-motivated.\n\nThe soft spots are in the theory, and they are load-bearing. The proof of Claim 1 rests on classifying the game as convex-concave Stackelberg, but that classification is asserted, not demonstrated. The payoff f in Eq. 4 is not continuous, let alone smooth, because c1 and c2 are step indicators at the threshold boundaries. The second derivative conditions are also unsupported: ΔT enters through the nonlinear dV/dt term, so concavity in ΔT can't be inferred from the log(1+kΔT) term alone. Even if convex-concavity held, the proof's inequality for a suboptimal attacker is reversed — the attacker maximizes, so J under a suboptimal policy is ≤, not ≥, the equilibrium value. And there is no step connecting the existence of an equilibrium to the blackout condition in the SLA definition. Separately, Eq. 5 presents the order of min and max incorrectly for the sequential game described in Algorithm 1.\n\nThe experiments are narrow: one grid model, one attack profile, and an FPR statistic based on two premature triggers out of seven noise conditions. That's enough to illustrate the method, not to support 'any stealthy load alteration.'\n\nWho is this for? Researchers working on cyber-physical defense for smart grids, especially those interested in DRL-based protection. They will find the framework and demo useful, but should treat the theoretical claim as a conjecture, not a proof.\n\nMy recommendation: send it to peer review, but with a referee who will press on the game-theoretic claims. The paper deserves a chance to be revised — either fix the proof or reframe the contribution as an empirical adaptive-protection scheme. As it stands, the advertised guarantee should not be accepted.","headline":"A plausible adaptive-protection framework with a real hardware demo, but the advertised game-theoretic guarantee is broken by multiple proof errors.","tokens_in":11208,"tokens_out":3270,"would_cite":false,"duration_ms":30884,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adaptive voltage protection can be trained, in a zero-sum game, to mitigate any stealthy load alteration attack on a smart grid.","keywords":["adaptive voltage protection","load alteration attack","stealthy load alteration","deep reinforcement learning","Stackelberg game","smart grid security","false data injection","hardware-in-the-loop"],"falsifier":"Evaluate the second derivatives of $f$ over the full action ranges on the IEEE 14-bus model: if any point in the attacker's action set has $\\partial^2 f/\\partial \\Delta T^2 \\geq 0$, or any point in the defender's threshold set has $\\partial^2 f/\\partial (V^u_{\\mathrm{Th}})^2 \\leq 0$, the convex-concave premise underlying Claim 1 is false. A second decisive test is to run the learned APS policy against an attacker that switches attack buses adaptively or attacks several buses at once; a blackout in any such scenario would contradict the claim that the policy mitigates any attacker action.","tokens_in":10217,"feed_emoji":"⚡","tokens_out":7330,"duration_ms":64371,"temperature":0.7,"pith_summary":"The paper tries to establish that a smart grid's voltage protection can be made robust against stealthy load alteration attacks by letting a deep reinforcement learning agent adjust the activation thresholds of existing under-voltage and over-voltage relays in real time. The setting is a two-player zero-sum game: an attacker falsifies HVAC temperature readings to increase power demand at the most unstable bus, while the adaptive protection system (APS) tunes thresholds to trip protection before blackout. The authors prove that this game has a Stackelberg equilibrium because the payoff is concave in the attacker's temperature change and convex in the defender's threshold, so a stationary defender policy exists that counters any attacker policy. They support the theory with IEEE 14-bus simulations and hardware-in-the-loop experiments showing the APS keeps bus voltage at a survivable level and triggers protection with low false-positive rate under noise. The intended upshot is that existing fixed-threshold protections can be upgraded without new hardware to meet a class of cyber attacks they were not designed for.","feed_headline":"Game-trained protection thwarts stealthy HVAC load attacks","feed_subtitle":"A defender policy that tunes voltage thresholds provably counters any load-altering attack in a simulated smart grid.","key_machinery":"The load-bearing object is the payoff function $f = \\log(1+k\\Delta T) - \\log(1+(dV_i/dt)/R_{\\mathrm{Th}}) + c_1\\log(1+e^{-V_i/V^l_{\\mathrm{Th}}}) + c_2\\log(1+e^{-V^u_{\\mathrm{Th}}/V_i})$, together with the Fast Voltage Stability Index (FVSI) that selects the attack surface. The first log term rewards extra power consumption; the second penalizes voltage changes beyond the nominal rate-of-change-of-voltage threshold $R_{\\mathrm{Th}}$, which keeps the attack stealthy; the third and fourth terms reward keeping the bus voltage inside the fixed safety band. The defender minimizes $f$ by choosing the upper threshold $V^u_{\\mathrm{Th}}$ (with $V^l_{\\mathrm{Th}}=V^u_{\\mathrm{Th}}/\\alpha$), and the paper's claimed convexity of $f$ in $V^u_{\\mathrm{Th}}$ and concavity in $\\Delta T$ make the game a convex-concave zero-sum Stackelberg game, which is what yields a stationary mitigation policy.","core_discovery":"The central claim is Claim 1 of Section III: in the attacker–mitigator game $\\mathcal{G}_{\\mathrm{prot}}$, there always exists a stationary policy $\\pi^*_{\\mathrm{avps}}$ for the adaptive protection system that mitigates any action of a load alteration attacker, whatever policy the attacker uses. The argument models grid protection as a zero-sum convex-concave Stackelberg game whose objective is the discounted sum of a payoff $f$. Because $f$ is concave in the attacker's action $\\Delta T$ and convex in the defender's threshold $V^u_{\\mathrm{Th}}$, Jensen's inequality preserves these curvature properties under the expectation, and a known existence result for zero-sum stochastic Stackelberg games yields a stationary equilibrium pair. The defender's equilibrium policy, learned by DQN in competition with a DDPG-trained attacker, is then claimed to mitigate every stealthy load alteration the attacker can generate, not only the attacks seen during training.","pith_inferences":["The guarantee is only as strong as the training's convergence to the Stackelberg equilibrium; the paper does not prove convergence for its DDPG/DQN loop, so an implicit open question is whether the learned policy actually reaches $\\pi^*_{\\mathrm{avps}}$ on states far from the training distribution.","The same game-theoretic template could be adapted to under-frequency load shedding and other protection classes, provided the payoff's curvature conditions can be reproduced for frequency-based thresholds.","A natural test the authors do not run is an adaptive adversary that keeps learning during deployment; Claim 1 concerns policies in the modeled game, not a defender re-optimizing against an attacker who changes its strategy class mid-operation."],"forward_implications":["Any stealthy load alteration inside the modeled action space is covered by the learned defense, including attack sequences not seen in training, if the equilibrium-existence claim holds.","Existing under-voltage and over-voltage relays can be retrofitted with learning-adjusted thresholds to avert SLA-induced blackouts without new protection hardware.","The FVSI-guided attacker defines a worst-case adversary for evaluating defenses: a protection policy that survives this attacker should also survive less informed load alteration attacks.","The convex-concave payoff design is a reusable recipe: for other protection schemes, find defender actions that make the payoff convex in defense and concave in attack, and a stationary equilibrium policy is guaranteed.","The noise experiments indicate the APS triggers protection at the right time across most load-profile noise levels, with a false-positive rate of 2/7 over the tested scenarios."],"supporting_citations":[{"why":"Defines the load alteration attack model and shows high-wattage IoT loads can disrupt the grid; the paper's attacker model builds on it.","marker":"[1]"},{"why":"Presents stealthy high-wattage IoT botnet attacks and defenses; the SLA model is designed to outperform this baseline.","marker":"[3]"},{"why":"Supplies the voltage and frequency protection schemes, activation delays, and threshold ranges that the APS adapts.","marker":"[4]"},{"why":"Documents the real HVAC cyber-attack used to motivate HVAC loads as the attack surface.","marker":"[5]"},{"why":"Provides the power-system stability concepts and FVSI index used to choose the most unstable bus.","marker":"[11]"},{"why":"Gives Jensen's inequality for expectations, used to transfer convexity and concavity from the payoff f to the objective J.","marker":"[14]"},{"why":"Establishes existence of stationary Stackelberg equilibrium for zero-sum stochastic games, which supplies Claim 1.","marker":"[15]"}],"fun_headline_variants":["DRL-based grid defense provably beats stealthy attacks","Adaptive voltage thresholds foil stealthy grid attacks","Game-trained defense counters any stealthy load attack","Provable AI shield against hidden grid load attacks","Learned protection thwarts load attacks on smart grids"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The guarantee collapses if the payoff is not actually concave in the attacker's temperature change and convex in the defender's threshold, or if the DDPG/DQN training fails to converge to the game's Stackelberg equilibrium, neither of which the paper proves.","fun_headline_variants_meta":{"raw":{"variants":["DRL-based grid defense provably beats stealthy attacks","Adaptive voltage thresholds foil stealthy grid attacks","Game-trained defense counters any stealthy load attack","Provable AI shield against hidden grid load attacks","Learned protection thwarts load attacks on smart grids"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000852,"raw_usage":{"total_tokens":3703,"prompt_tokens":943,"completion_tokens":2760,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":559,"completion_tokens_details":{"reasoning_tokens":2686}},"tokens_in":559,"tokens_out":2760,"duration_ms":21464,"temperature":1.0,"reasoning_tokens":2686,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T15:30:40.096709+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Evaluate the second derivatives of $f$ over the full action ranges on the IEEE 14-bus model: if any point in the attacker's action set has $\\partial^2 f/\\partial \\Delta T^2 \\geq 0$, or any point in the defender's threshold set has $\\partial^2 f/\\partial (V^u_{\\mathrm{Th}})^2 \\leq 0$, the convex-concave premise underlying Claim 1 is false. A second decisive test is to run the learned APS policy against an attacker that switches attack buses adaptively or attacks several buses at once; a blackout in any such scenario would contradict the claim that the policy mitigates any attacker action.","supporting_citations":[{"cited_title":"{MaDIoT} 2.0: Modern {High-Wattage}{IoT} botnet attacks and defenses,","cited_arxiv_id":null,"evidence_quote":"Presents stealthy high-wattage IoT botnet attacks and defenses; the SLA model is designed to outperform this baseline."},{"cited_title":"Not everything is dark and gloomy: Power grid protections against {IoT} demand attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies the voltage and frequency protection schemes, activation delays, and threshold ranges that the APS adapts."},{"cited_title":"Mitsubishi electric air conditioning system,","cited_arxiv_id":null,"evidence_quote":"Documents the real HVAC cyber-attack used to motivate HVAC loads as the attack surface."},{"cited_title":"Power system stability,","cited_arxiv_id":null,"evidence_quote":"Provides the power-system stability concepts and FVSI index used to choose the most unstable bus."},{"cited_title":"Jensen’s inequality for conditional expectations in banach spaces,","cited_arxiv_id":null,"evidence_quote":"Gives Jensen's inequality for expectations, used to transfer convexity and concavity from the payoff f to the objective J."},{"cited_title":"Zero-sum stochastic stackelberg games,","cited_arxiv_id":null,"evidence_quote":"Establishes existence of stationary Stackelberg equilibrium for zero-sum stochastic games, which supplies Claim 1."}],"review_version":1}