{"id":"942ff4ce-70f7-43cb-8b12-efcce265f8ea","arxiv_id":"2608.01375","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"AdaptoNet, a modular network with a mask-conditioned adaptive module, recovers line-outage detection F1 from below 12% to above 81% under in-region data-denial attacks across four IEEE test systems.","lead":"A new neural network design, AdaptoNet, restores power-grid outage detection accuracy when an attacker blocks a region of measurements while tripping a line. It pairs a frozen, pre-trained model with a small adaptive module that is told which measurements are missing, recovering F1 from under 12% to over 81% in simulations.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No ablation versus a non-modular mask-conditioned baseline; reported gains may stem from mask input alone, not from the frozen-foundation design.","rationale":"I considered the reader's highlighted assumption (known availability mask) and the paper's own caveats (non-convergent branch exclusion, per-region thresholds). The mask assumption is explicit in Section IV-B and is a reasonable part of the threat model: if an adversary blocks data via link-flooding, the SCADA/PMU layer reveals the missing reports. The per-region threshold caveat is partially mitigated because the mask itself identifies the attacked region, making per-region thresholds selectable at test time. The non-convergent branch exclusion is disclosed and justified. The more serious gap is internal validity: the architecture's distinctive feature—freezing the foundational module—is never tested by ablation. Without a non-modular baseline that also receives the mask, we cannot attribute the large F1 recovery to the modular design. This is a standard scientific requirement for a claim of architectural novelty. If the ablation shows no benefit, the paper's main contribution is not supported; if it shows a clear benefit, the conditional acceptance can proceed. Thus I keep the reader's CONDITIONAL verdict and add this requirement.","tokens_in":10076,"tokens_out":9557,"duration_ms":88978,"concrete_test":"Run an ablation on the 30-bus and 118-bus systems: (1) train the same backbone end-to-end from scratch with the mask appended as an extra input channel (and zero-filled missing values), (2) train the full AdaptoNet with the foundational module unfrozen (fine-tuned), and (3) apply a standard imputation baseline (e.g., k-nearest-neighbor fill) followed by the original CNN. Use the same training data, loss, and per-region threshold selection. If the end-to-end mask-conditioned network achieves F1 within 2 points of AdaptoNet on both systems, the modular split is not necessary for the reported recovery.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central architectural claim is that splitting a frozen foundational module from a trainable adaptive module preserves learned grid physics while adapting to missing data (Section IV-B). Yet every reported result compares AdaptoNet only to a zero-filled CNN without a mask (Figs. 4-7, Table II). There is no ablation testing (a) the same network trained end-to-end with the mask concatenated as an input channel, (b) a fine-tuned variant where the foundational weights remain trainable, or (c) a standard imputation baseline such as mean-filling or the Bayesian regression of [21]. Consequently, the observed F1 recovery from <12% to 81-92.5% could be due solely to conditioning on the mask or to retraining on attack data, not to the modular separation. The claim that freezing 'preserves learned physical relationships' (Section IV-B) is asserted but never tested against a non-frozen alternative. This is load-bearing because if a single network with mask input performs similarly, the paper's primary contribution reduces to input augmentation rather than a new modular architecture.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper addresses coordinated cyber-physical attacks in which an adversary blocks measurements in a region while physically tripping a line inside that region (in-region attacks). The authors propose AdaptoNet, a modular architecture consisting of a frozen foundational module trained on complete measurement data and a trainable adaptive module that receives the partially observed measurements together with a binary availability mask. The output is a multi-label line-status vector. The method is evaluated on four IEEE test systems (30-, 39-, 57-, and 118-bus) under Type A (10% of buses denied) and Type B (20% denied) attack regions. The authors report that F1 recovers from below 12% to 81.2–92.5%, approaching the 89–99% complete-data baseline, with inference latencies supporting real-time deployment.","tokens_in":10353,"tokens_out":3521,"duration_ms":37936,"significance":"If the reported improvement is indeed attributable to the modular frozen-foundation design, AdaptoNet would be a practical and novel contribution to power-grid attack detection. The threat model is realistic and clearly stated, the four-system evaluation is useful, and the latency measurements address deployment concerns. The paper also honestly acknowledges several limitations, including the per-region threshold selection and the exclusion of non-convergent branches. However, the central architectural claim—that freezing the foundational module preserves learned physics and that modular separation is what drives the recovery—is not yet supported by the experiments, because no ablation isolates the effect of the mask input or of retraining. The strong reported numbers are therefore suggestive but not conclusive.","major_comments":[{"comment":"The central claim is that splitting a frozen foundational module from a trainable adaptive module preserves learned grid physics and enables adaptation to missing data. Yet all reported comparisons are against a zero-filled CNN without a mask. There is no ablation against (a) the same network trained end-to-end with the mask concatenated as an extra input channel, (b) a variant in which the foundational weights are fine-tuned rather than frozen, or (c) a standard imputation baseline such as mean-filling or the Bayesian regression of [21]. Without these, the observed F1 recovery from below 12% to above 81% could be due solely to conditioning on the mask or to retraining on attack data, rather than to the modular/frozen design. This is load-bearing because the paper's primary contribution is the modular architecture, not the mask input itself.","section":"Section IV-B and Section V-B (Figs. 4–7, Table II)"},{"comment":"The evaluation protocol has three caveats that jointly affect the headline 'approaching baseline' claim. First, per-region decision thresholds are tuned on a validation split, and the text acknowledges this is an upper bound relative to a single-threshold deployment; however, no results are reported with a single conservative threshold, which is the realistic operating mode when the attacked region is unknown. Second, the class mask in Table I excludes 5–31% of lines as non-convergent, and these lines are omitted from both loss and metrics; the 57-bus system excludes 31% of lines, which may materially inflate the reported F1. Third, there are no error bars or per-case distributions across the six evaluation cases, so it is unclear whether the averages are stable or dominated by particular cases/regions. The authors should report single-threshold results, sensitivity to the non-convergent","section":"Section V-B and Table I"},{"comment":"The design assumes the defender knows exactly which measurements are blocked: 'we also assume that we know the data denial region and the corresponding blocked data, which determines the mask variable.' The availability mask is the primary conditioning signal. In practice, the mask may be uncertain, partially wrong, or spoofed (e.g., delayed SCADA/PMU reports or an adversary replaying old data). The paper mentions extensions with fractional mask values but provides no robustness analysis to mask errors. Since the reported F1 recovery depends on feeding the correct mask, the authors should evaluate performance when the mask is imperfect, e.g., with a few mislabeled entries or a coarse block-level mask. Without this, the practical applicability of the method is not established.","section":"Section IV-B"}],"minor_comments":[{"comment":"For the 57-bus and 118-bus systems under CPU 1-thread, the reported end-to-end time is smaller than the forward time (3.18 vs 3.20 ms and 54.68 vs 54.90 ms), which is impossible if end-to-end includes the forward pass. This suggests a measurement or reporting error and should be corrected.","section":"Table III"},{"comment":"The non-convergent branch list is reported only as percentages. Since the class mask removes lines from both training loss and evaluation, it would be helpful to state whether any non-convergent branches appear in the attacked regions and whether the per-region F1 averages are recomputed over a consistent line set across systems.","section":"Section V-A3 and Table I"},{"comment":"The conclusion says 'investigate AdaptoNet's generation to different neural network infrastructures'; 'generation' should be 'generalization'.","section":"Section VI"},{"comment":"No code, data, or trained model is made available. Given the synthetic evaluation pipeline (MATPOWER plus ACTIVSg load profiles), releasing the generation and training code would substantially increase reproducibility and is strongly encouraged.","section":"General"},{"comment":"The text says results are 'averaged across all testable regions and six evaluation cases' but never states the number of regions per system or per attack type. Reporting this count and the per-region variance would help the reader interpret the mean F1 values.","section":"Section V-B"}],"recommendation":"major_revision","confidential_remarks":"The reviewer's and skeptic's core concern is valid: the paper's central modularity claim is untested against a non-modular mask-conditioned baseline. I would make such an ablation a condition for acceptance. The paper is otherwise within scope and the reported gains are potentially significant, but they need to be pinned to the architecture rather than to the mask input or retraining. A comparison with an imputation-based baseline from the cited literature would also strengthen the practical claim."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nRead AdaptoNet. The paper does something real: it shows that a CNN for line-outage detection collapses under in-region data-denial attacks, and that a ControlNet-style frozen-foundation-plus-adaptive-module architecture, conditioned on a binary availability mask, recovers F1 from below 12% to 81–92.5% across four IEEE test systems. The evaluation is built on realistic load profiles, AC-OPF simulation, multiple region sizes, and latency figures on GPU/CPU. That is a solid piece of engineering.\n\nThe soft spot is the one the stress-test note flags, and it is load-bearing. Every comparison is against a zero-filled CNN without a mask. There is no ablation that trains a single network with the mask as an input channel, no fine-tuned variant where the foundational weights are not frozen, and no imputation baseline (mean filling, GAIN, or the Bayesian regression of [21]). So the central architectural claim—that the modular split preserves learned physics while adapting—is asserted but never tested. For all the results show, the entire gain could come from conditioning on the mask alone, or simply from retraining the adaptive weights on the attack distribution. That is not a minor omission; it is the difference between a new architecture and input augmentation.\n\nOther caveats are properly acknowledged but still limit the strength of the results: per-region thresholds tuned on validation are an upper bound; 5–31% of lines are excluded as non-convergent; and there are no error bars across the six evaluation cases. I also think the mask assumption (defender knows exactly what is blocked) is stated clearly, and the paper is right that in practice operators can derive this from the communication layer—so I would not call that fatal, just a boundary condition.\n\nHonest engagement with prior work, a clearly stated threat model, and explicit limitations make this a serious paper. It deserves a real referee, but the referee should insist on the missing ablations and at least one non-mask-conditioned baseline before the central claim can be believed.\n\nFor your purposes: if you work on ML for grid security, worth a look; I would bring it to a reading group only if someone is specifically interested in mask conditioning for CPS.","headline":"A useful empirical paper with a genuine design claim that is left untested: the modular split's contribution is never isolated from simply giving the network the mask.","tokens_in":10784,"tokens_out":1989,"would_cite":false,"duration_ms":19590,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"AdaptoNet: a frozen foundational module plus a mask-conditioned adapter restores line-outage detection under data-denial attacks.","keywords":["cyber-physical attacks","power grid security","line outage detection","conditional neural networks","missing data","modular deep learning","data denial attacks","adaptive detection"],"falsifier":"Run an evaluation where the test-time mask is deliberately perturbed (e.g., flip 10% of mask bits or present a mask that is shifted by one region) while keeping everything else fixed; if AdaptoNet's F1 falls back toward the 12% baseline, the central role of exact mask knowledge is confirmed, and the claim of resilience to data denial would need to be qualified.","tokens_in":10005,"feed_emoji":"⚡","tokens_out":3795,"duration_ms":34449,"temperature":0.7,"pith_summary":"AdaptoNet claims that a modular network can keep detecting transmission-line outages during a coordinated cyber-physical attack in which an adversary blocks measurements in the same region where it trips a line. The paper shows that standard CNN-based line outage detection collapses from 89–99% F1 to below 12% under such data denial. AdaptoNet pairs a frozen foundational module trained on complete measurements with a trainable adaptive module that receives a binary mask of which measurements are missing, recovering F1 to 81–92.5% without retraining the foundational module. The result matters because attackers can realistically deny data via link-flooding, and existing imputation-based defenses assume missing-data randomness that coordinated attacks violate.","feed_headline":"Modular network lifts grid attack detection from 12% to 92%","feed_subtitle":"A frozen complete-data model plus a mask-conditioned adapter restores line-outage F1 scores when attackers block targeted measurements.","key_machinery":"The measurement-availability mask $m$, a binary vector indicating which bus and line measurements are blocked, is the conditioning signal that lets the adaptive module distinguish 'missing' from 'anomalous'. The architecture splits the detector into a frozen foundational module $F_\\theta(z)$ trained on complete data and a trainable adaptive module $A_\\delta(I_\\phi(z, m))$ whose output is fused with the foundational features by $O_\\pi$; the frozen module guarantees learned physics is preserved while the adaptive module learns attack-specific corrections.","core_discovery":"The central claim is that conditioning on measurement availability, rather than imputing missing values or retraining the whole model, is enough to restore line-outage detection under in-region data-denial attacks. The paper demonstrates that a frozen network trained only on complete data retains general knowledge of grid physics, and that a separately trained adaptive module can learn corrections from the discrepancy between expected and observed signals, guided by a binary mask of which measurements are missing. Across four IEEE test systems with up to 20% of buses blocked, AdaptoNet recovers F1 from below 12% to 81–92.5%, approaching but not matching the 89–99% complete-data baseline, wit","pith_inferences":["If the mask can be estimated from communication-layer metadata (dropped SCADA or PMU reports), AdaptoNet could be deployed without explicit attacker labels; the paper leaves this estimation step untested.","The reported per-region thresholds mean the numbers are an upper bound for a practical single-threshold deployment; the paper acknowledges this, but the gap for a fixed global threshold is not quantified.","The same modular conditioning may transfer to other cyber-physical domains where sensors are blocked in a region while a physical fault is induced, since the mechanism is agnostic to the specific physics learned by the foundation module.","A testable extension: train the adaptive module with masks that contain small errors to measure how gracefully performance degrades, since real-world availability masks may be noisy."],"forward_implications":["If correct, grid operators can maintain high outage-detection accuracy under data-denial attacks without retraining existing complete-data models, by adding a mask-conditioned adapter to a frozen detector.","Because the foundational module is frozen, third-party pretrained models (e.g., deep-learning-based state estimators) could serve as the foundation, enabling plug-and-play adaptation.","The mask mechanism extends beyond binary blocking: floating-point masks carrying trust scores or imputation confidence could handle spoofed or partially corrupted data.","The approach points toward a general recipe for making data-driven cyber-physical system monitors robust to missing data when missingness is intentional and spatially correlated, not random."],"supporting_citations":[{"why":"Supplies the architectural inspiration: locked and trainable components combined with conditional inputs in diffusion models.","marker":"[6]"},{"why":"Provides the baseline CNN-based line outage detection method that AdaptoNet builds on and compares against under data denial.","marker":"[18]"},{"why":"Defines the same in-region cyber-physical attack scenario and serves as an existing physics-based approach that AdaptoNet contrasts with.","marker":"[21]"},{"why":"Shares the joint cyber-physical attack setting and uses PMU data for line failure detection, providing another comparison point.","marker":"[22]"},{"why":"Supplies the power-flow simulation tool used to generate all measurement data and line outage scenarios.","marker":"[33]"},{"why":"Provides the realistic hourly load time-series data used to create training and test operating conditions.","marker":"[34]"}],"fun_headline_variants":["AdaptoNet: grid attack detection recovers from 12% to 92%","Neural network adapts to denied data, lifts F1 sevenfold","Mask-conditioned model foils data denial in power grids","Frozen base + adaptive head: resilient grid attack detection","From 12% to 92%: AdaptoNet beats measurement blackouts"],"cache_read_input_tokens":2816,"weakest_assumption_plain":"The defender knows exactly which measurements have been blocked (the availability mask) at test time; if the mask is wrong, spoofed, or only partially known, the conditioning mechanism cannot be fed correctly and the reported recovery is not guaranteed.","fun_headline_variants_meta":{"raw":{"variants":["AdaptoNet: grid attack detection recovers from 12% to 92%","Neural network adapts to denied data, lifts F1 sevenfold","Mask-conditioned model foils data denial in power grids","Frozen base + adaptive head: resilient grid attack detection","From 12% to 92%: AdaptoNet beats measurement blackouts"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000605,"raw_usage":{"total_tokens":2639,"prompt_tokens":705,"completion_tokens":1934,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":449,"completion_tokens_details":{"reasoning_tokens":1839}},"tokens_in":449,"tokens_out":1934,"duration_ms":13289,"temperature":1.0,"reasoning_tokens":1839,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T00:14:17.675862+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an evaluation where the test-time mask is deliberately perturbed (e.g., flip 10% of mask bits or present a mask that is shifted by one region) while keeping everything else fixed; if AdaptoNet's F1 falls back toward the 12% baseline, the central role of exact mask knowledge is confirmed, and the claim of resilience to data denial would need to be qualified.","supporting_citations":[{"cited_title":"Prediction-based data augmentation for smart grid line outage detection,","cited_arxiv_id":null,"evidence_quote":"Provides the baseline CNN-based line outage detection method that AdaptoNet builds on and compares against under data denial."},{"cited_title":"Line failure detection after a cyber-physical attack on the grid using bayesian regression,","cited_arxiv_id":null,"evidence_quote":"Defines the same in-region cyber-physical attack scenario and serves as an existing physics-based approach that AdaptoNet contrasts with."},{"cited_title":"Line failure detection from pmu data after a joint cyber-physical attack,","cited_arxiv_id":null,"evidence_quote":"Shares the joint cyber-physical attack setting and uses PMU data for line failure detection, providing another comparison point."},{"cited_title":"MAT- POWER: Steady-state operations, planning, and analysis tools for power systems research and education,","cited_arxiv_id":null,"evidence_quote":"Supplies the power-flow simulation tool used to generate all measurement data and line outage scenarios."}],"review_version":1}