Pith. sign in

REVIEW 4 major objections 5 minor 3 references

A One-Class Explainable AI Framework for Identification of Non-Stationary Concurrent False Data Injections in Nuclear Reactor Signals

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A neural forecaster trained only on normal reactor data, with dual residual windows, detects replayed false data injections at over 93% accuracy and under 1% false positives.

desk verdict Real-data replay attack demo on a licensed reactor, but in-sample threshold tuning and an inconsistent Table 6 mean the headline accuracy is not yet established. read the letter →

arxiv 2508.12428 v1 pith:EI4KOCGW submitted 2025-08-17 eess.SY cs.SY

Zachery Dahm , Vasileios Theos , Konstantinos Vasili , William Richards , Konstantinos Gkouliaras , Stylianos Chatzidakis This is my paper · ORCID
classification eess.SYcs.SY
keywords falsedatainjectionreplayattacknuclearreactorcybersecurityanomalydetectiongatedrecurrentunitexplainableAISHAPresidualanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a monitoring system built from a gated recurrent unit (GRU), trained exclusively on normal operating data from a research reactor, can detect replay-based false data injections in real time. The detection signal is a forecast residual: the GRU predicts neutron counts five seconds ahead, and a point is flagged when either a five-second or sixty-second rolling average of the prediction error crosses a threshold. The paper further claims that this windowed residual analysis distinguishes injected false scrams from genuine scrams and fast transients, and that a modified SHAP analysis plus rule-based correlations identifies which sensors were falsified. On test recordings of one-, two-, and five-signal replay attacks, the reported accuracy is above 0.93 with fewer than 1% false positives. If these claims hold, a passive monitor could be layered onto digital reactor instrumentation without watermarking or modifying process data.

What carries the argument

The load-bearing mechanism is a two-time-scale residual check on a one-class forecaster. A GRU—a gated recurrent unit, chosen after comparing ANN, RNN, and LSTM variants—maps a 30-second window of eight reactor signals to a forecast of the neutron count five seconds ahead; because it is trained only on normal data, its error rises when injected signals violate the learned relationships among neutron counts, neutron change rate, and control-rod positions. The residual check labels a point anomalous if either the 5-second rolling average of absolute error exceeds 0.07 or the 60-second rolling average exceeds 0.04, so abrupt injections trip the short window and subtle or prolonged ones accumulate in the long window. Around this core sit the interpretability modules: a modified WindowSHAP occlusion scheme that replaces occluded values with a moving baseline (current power level, zero change rate, zero rod motion) rather than a global mean, and rule-based correlations that flag inconsistencies between rod position and rod active state, between neutron counts and reported change rate, and between change-rate variance and rod motion.

What would settle it

Split the 65,000 seconds of non-normal recordings into a tuning set and a held-out test set, tune the two residual thresholds and the three rule thresholds on the tuning set only, then measure accuracy and false-positive rate on the held-out set; if the held-out numbers fall below 0.93 accuracy or above 0.01 false positives, the claimed generalization is not established.

Watch

Extended reading notes

Core claim

Working with 265,000 seconds of recorded operations from a fully digital research reactor, the authors build a one-class predictive model: a GRU that takes a sliding 30-second window of eight reactor signals and forecasts the neutron count five seconds ahead, trained only on 200,000 seconds of normal operation. The evaluation sets include three replay-attack scenarios that falsify one, two, or five signals to make the reactor appear to be scramming while it is actually still at power, alongside genuine scram and fast-transient recordings. The central finding is that a dual-window residual check—flagging any point whose five-second mean absolute error exceeds 0.07 or whose sixty-second mean absolute error exceeds 0.04—achieves over 93% accuracy on the attack datasets and under 1% false positives on the normal, transient, and scram datasets. The paper also reports that the modified SHAP explanations show falsified signals carrying negative contributions while unaffected signals stay near zero, and that rule-based correlations between control-rod motion, rod position, neutron count, and reported change rate break consistently for injected data.

Load-bearing premise

The detection thresholds and rule parameters were chosen and measured on the same datasets, so the reported accuracy and false-positive rates may not hold once the thresholds are fixed before seeing attack data.

Editorial extensions

If this is right

  • An operator-facing monitor of this type could run on existing sensor streams in a digital reactor control room, adding a passive detection layer with no watermarking or control perturbation.
  • Because the forecaster trains on normal operation only, the method does not require labeled attack data; a new plant could deploy it after collecting routine operating logs.
  • The dual-window residual design gives two detection speeds: near-immediate response to abrupt injections and slower, accumulating evidence against gradual or subtle ones.
  • The SHAP and rule-based layers would let operators see not only that an alarm fired but which sensor channels are implicated, supporting faster diagnosis and shorter outage.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Extension beyond the paper: the threshold values (0.07 over 5 s, 0.04 over 60 s) and the rule cutoffs (0.7 cm, 2%/s, 0.75 standard deviation) were selected and evaluated on the same recordings, so a true out-of-sample test would tune them on a disjoint subset before scoring.
  • Extension beyond the paper: the correlation rules encode how control-rod motion drives neutron population in this particular reactor; porting the framework to a plant with different control mechanisms would require rewriting those rules, though the residual and SHAP components would transfer.
  • Extension beyond the paper: the replay episodes tested last 70 seconds and start from genuine operation; shorter, smoother, or longer injection profiles may be harder or easier to catch, and the dual-window thresholds would need retuning per profile.
  • Extension beyond the paper: combining the SHAP attribution with a physics-based state estimator could extend this passive approach to other integrity attacks such as sensor drift or scaling attacks, which the paper names as future work.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The manuscript describes a one-class explainable AI framework for detecting replay-based false data injection (FDI) attacks in nuclear reactor sensor signals. The framework consists of a GRU forecasting model trained only on normal operation data, a residual analysis module with short- and medium-term rolling-average thresholds, a modified WindowSHAP module for feature attribution, and rule-based correlation checks. The authors evaluate on data from the PUR-1 research reactor, using a normal dataset and five evaluation datasets (transients, scrams, and three FDI scenarios). They report over 93% accuracy with under 1% false positives, successful differentiation of FDIs from normal transients and scrams, and identification of the falsified signals' origin.

Significance. If the empirical results are correct, this work would provide a practical, passive defense against replay FDI in digital instrumentation and control systems, with the notable strengths of one-class training (no attack data required), real-world PUR-1 data, explainability via a nonstationary adaptation of SHAP, and publicly available code and data. The combination of forecasting residuals with two complementary time windows is a sensible detection strategy, and the rule-based correlation layer offers an interpretable complement. However, the current evidence does not establish the headline accuracy and false-positive claims because the evaluation is in-sample, the metrics in Table 6 are internally inconsistent, and the source-identification result is only qualitative.

major comments (4)
  1. [Model Selection and Results (Table 6)] The reported detection performance is an in-sample estimate. The GRU was selected as the primary model based on its performance on the evaluation datasets (Table 3, which includes the same datasets later used for accuracy reporting), and the adaptive-window thresholds (error threshold 0.07 over a 5-second window and 0.04 over a 60-second window) are described as 'optimized' without any held-out validation split or independent tuning procedure. Similarly, the rule thresholds (0.7 cm, 2%/s, 0.75 std) are said to be 'developed from experience with PUR-1 data' and are applied to the same datasets. A proper protocol is needed: a validation fold for threshold selection, a cross-event split, or pre-specified thresholds, before the >0.93 accuracy and <0.01 false-positive claims can be accepted.
  2. [Table 6 and attack construction (Data collection)] The numbers in Table 6 are internally inconsistent. With Precision=1 and Recall=0.8066 on the FDI datasets, the Accuracy value of 0.9348 implies that approximately 33.7% of the dataset is positively labeled (because accuracy = 1 - (1 - Recall) * prevalence when false positives are zero). However, the attack design described in the data-collection section is 120 seconds of normal operation, a 10-second transition, and 70 seconds of injected shutdown data in 1560-second datasets, i.e., about 5% positive seconds. In addition, the text states that false positives usually occur at the initiation of the FDI, which contradicts Precision=1. The ground-truth labeling (point-level, event-level, or windowed) must be stated precisely and all metrics recomputed, because Table 6 as reported cannot be verified.
  3. [Rule-based correlations and Table 7] The source-identification and FDI-differentiation claims are not quantitatively evaluated. Table 7 reports the fraction of anomaly points that break each correlation rule, but this is not a sensor-level attribution accuracy or a confusion matrix for FDI versus non-FDI. Moreover, the rules were developed from experience with PUR-1 data and target exactly the inconsistencies that the authors inserted into the FDI datasets (e.g., neutron change rate deviating from hand-calculated change rate, control rod position changes inconsistent with active states), so Table 7 partly reflects the construction of the attack data rather than an independent test. The authors should provide a held-out attack scenario or an explicit evaluation of attribution accuracy, and should temper the claim that the framework 'identifies the origin of the falsified signals' accordingly.
  4. [Data collection and Table 1] The data accounting is inconsistent. The text states that 265,000 seconds were collected, with 200,000 seconds used for the normal dataset and 'the remaining 65,000 datapoints' used for additional datasets. Table 1, however, lists 19,800 + 1,560 + 1,560 + 1,560 + 1,560 = 26,040 points for datasets #2 through #6, which does not match 65,000 or the total of 265,000. This discrepancy affects all per-second rate computations and must be resolved.
minor comments (5)
  1. [Figure 13 caption] The caption states 'SHAP contribution for SS2 position in dataset where it is falsified FDI-A,' but in FDI-A only neutron counts are falsified; the reference should likely be to FDI-C or be corrected.
  2. [Table 3] The column headers 'FDI #1' and 'FDI #2' do not match the dataset names FDI-A and FDI-B used elsewhere; please align the terminology.
  3. [Module 2, Definition] The definition of successful FDI detection gives epsilon < ||Delta X(t)|| <= epsilon_H, where epsilon_H is defined as the minimum deviation required to cause harm; this appears to be a typo, since detection before harm should require ||Delta X(t)|| < epsilon_H. Please clarify.
  4. [References] The reference 'Lawson-Jenkins, n.d.' is incomplete; please provide a full citation with year and source.
  5. [Throughout] Several equations contain Unicode artifacts (e.g., subscript characters rendered as Latin letters) that will not typeset correctly; please ensure all mathematics uses proper notation.

Circularity Check

2 steps flagged · score 6.0 of 10

Detection thresholds and rule thresholds are tuned on the same datasets used to report accuracy, so the 0.93/<0.01 claim and the Table 7 origin pattern are partly in-sample by construction.

  1. fitted input called prediction [Results, adaptive windowing paragraph after Figure 12, culminating in Table 6]
    "To improve detection, we use an optimized combination of a short-term averaging window (error threshold 0.07 and 5 second window) and a medium-term thresholding window (error threshold 0.04 and 60 second window). ... Table 6 shows that applying multiple rolling average windows improves accuracy on all datasets relative to the single per-second error threshold. The adaptive windowing method provides 93% accuracy in the FDI datasets and less than 1% false positives on all normal datasets."

    The thresholds (0.07 over 5 s and 0.04 over 60 s) are described as 'optimized' and are then evaluated on the same six datasets that produced Table 6. No validation fold, cross-event split, or independent attack dataset is documented for threshold selection. The reported accuracy and false-positive rate therefore measure in-sample fit to the test datasets: the 0.93/<0.01 result is the score of a threshold chosen on that same data, not a prospective prediction of performance on unseen attacks.

  2. fitted input called prediction [Results, Rule-based correlations, paragraph immediately before Table 7; cf. Methodology Module 4]
    "The rules were developed from experience with PUR-1 data, and were made to target moments where the neutron change rate sensor significantly deviates from the hand-calculated change rate, when the control rod active state sensors significantly deviate from the actual change in control rod position, or when change rate has high variance without control rod movements."

    The rule thresholds and conditions are hand-tuned on the same PUR-1 datasets and target the exact correlation breaks inserted into the synthetic FDI scenarios (falsified neutron counts, change rate, and control rod positions during a replayed shutdown). Table 7 then reports the fraction of anomaly points violating those rules on those same datasets (e.g., 1.0 for Counts-Change Rate in FDI-A and 0.940 for Control Rods in FDI-C). The pattern is therefore partly a consequence of the attack construction and the hand-picked thresholds (0.7 cm, 2%/s, 0.75 std), not an independent validation of origin identification on unseen attack data.

full rationale

The core forecasting module is not circular: the GRU is trained only on normal operational data and the residual signal is computed on datasets that include synthetic FDI events, so the residual detector has genuine independent content. No load-bearing self-citation chain is present; the one self-citation (Theos et al., 2023) is peripheral. However, the headline detection metrics reduce partly by construction because the adaptive-window thresholds are 'optimized' and scored on the same six datasets with no separated selection set, and the rule-based origin-identification module is explicitly 'developed from experience with PUR-1 data' to flag the same inconsistencies engineered into the FDI datasets. Table 6 also contains an internal consistency issue that is a correctness concern rather than a circularity: precision=1, recall=0.8066, and F1=0.8929 are mutually consistent, but the reported accuracy of 0.9348 implies a much larger positive fraction than the stated 120 s normal + 70 s injected construction would give. Overall the central detection claim is partially in-sample, warranting score 6 rather than a higher score because the residual framework itself is independently trained and evaluated on data distinct from its training distribution.

Assumptions & free parameters 10 free parameters · 4 assumptions · 0 invented entities

The framework's results rest on several hand-set thresholds and domain assumptions. The most consequential are the detection thresholds (0.07/5s and 0.04/60s), which are tuned without a described held-out procedure, and the rule thresholds, which are explicitly derived from PUR-1 data. No new physical entities are introduced.

free parameters (10)
  • Short-window error threshold = 0.07
    Used with a 5-second rolling average of residual MAE; reported as 'optimized' but no selection procedure or held-out data is described.
  • Medium-window error threshold = 0.04
    Used with a 60-second rolling average; same tuning concern.
  • Short window length = 5 seconds
    Chosen by hand as part of the adaptive windowing scheme.
  • Medium window length = 60 seconds
    Chosen to detect subtler attacks with delay.
  • Control rod position change threshold = 0.7 cm
    Rule 2-3 in Module 4; hand-set based on PUR-1 data.
  • Neutron change rate deviation threshold = 2
    Rule 2 in counts-change rate check; hand-set.
  • Change rate standard deviation threshold = 0.75
    Rule 2 in change rate-rods check; hand-set.
  • Neutron validity threshold = 1000 counts
    Rule 1 in counts-change rate check; hand-set.
  • GRU hyperparameters = lr=0.0001, units=100, window=30, epochs=50, batch=4
    Selected by grid search on the validation split of normal data; listed in Table 2.
  • Modified SHAP moving baseline = first-second values for counts/positions, zero for rates/active states
    Hand-chosen to represent constant-power baseline; affects source attribution patterns.
assumptions (4)
  • domain assumption The GRU forecaster trained on normal operational data generalizes to all non-stationary normal behaviors (startup, transients, scrams), so residual spikes indicate FDI rather than normal dynamics.
    Invoked throughout Module 1 and the evaluation in Table 6; if this fails, false positives on transients/scrams would break the differentiation claim.
  • domain assumption An adversary can falsify sensor data at Layer 1 but has no knowledge of the AI system, and cannot falsify control rod active states in the considered attacks.
    State in Use Case assumptions; the method's rule checks rely on active states being trustworthy.
  • domain assumption The prediction residual (X_pred - X_obs) is a reliable proxy for the injection deviation ΔX, so the theoretical detection condition epsilon < ||ΔX|| <= epsilon_H can be evaluated with residual thresholds.
    The paper defines detection via ΔX (Methodology) but measures MAE of the GRU forecast; the link is asserted, not proven.
  • domain assumption Control rod position, active state, neutron count, and neutron change rate obey fixed physical correlations during normal operation, so a violation implies FDI.
    This is the basis of Module 4's rule-based classifier; the thresholds are reactor-specific.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A One-Class Explainable AI Framework for Identification of Non-Stationary Concurrent False Data Injections in Nuclear Reactor Signals." pith.science (2026). https://pith.science/paper/EI4KOCGW

@misc{pith2026250812428,
  author       = {Pith},
  title        = {Pith review of: A One-Class Explainable AI Framework for Identification of Non-Stationary Concurrent False Data Injections in Nuclear Reactor Signals},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EI4KOCGW}},
  note         = {Machine review of arXiv:2508.12428}
}
read the original abstract

The transition of next generation advanced nuclear reactor systems from analog to fully digital instrumentation and control will necessitate robust mechanisms to safeguard against potential data integrity threats. One challenge is the real-time characterization of false data injections, which can mask sensor signals and potentially disrupt reactor control systems. While significant progress has been made in anomaly detection within reactor systems, potential false data injections have been shown to bypass conventional linear time-invariant state estimators and failure detectors based on statistical thresholds. The dynamic, nonlinear, multi-variate nature of sensor signals, combined with inherent noise and limited availability of real-world training data, makes the characterization of such threats and more importantly their differentiation from anticipated process anomalies particularly challenging. In this paper, we present an eXplainable AI (XAI) framework for identifying non-stationary concurrent replay attacks in nuclear reactor signals with minimal training data. The proposed framework leverages progress on recurrent neural networks and residual analysis coupled with a modified SHAP algorithm and rule-based correlations. The recurrent neural networks are trained only on normal operational data while for residual analysis we introduce an adaptive windowing technique to improve detection accuracy. We successfully benchmarked this framework on a real-world dataset from Purdue's nuclear reactor (PUR-1). We were able to detect false data injections with accuracy higher than 0.93 and less than 0.01 false positives, differentiate from expected process anomalies, and to identify the origin of the falsified signals.

Figures

Figures reproduced from arXiv: 2508.12428 by the authors.

Figure 1
Figure 1. Framework Used for Identifying FDIs [PITH_FULL_IMAGE:figures/full_fig_p009_1.png] view at source ↗
Figure 2
Figure 2. PUR-1 facility (left), fully digital control console (center), real-time data [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. Architecture for injecting false data. The following assumptions were considered when implementing the use case:  It is assumed that an adversary has access down to Layer 1 (but not Layer 0).  It is assumed that an adversary has no knowledge about the AI/ML system.  It is assumed that the AI/ML models are located on a workstation in Layer 4 and that AI/ML model training and data processing takes place in a workst… view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Architecture for injecting false data. Data collection All the data used to form the training and testing datasets is collected from PUR-1. 265,000 seconds of operation data were collected and processed between August 2022 and June 2023. Data was extracted using the R-…
Figure 5
Figure 5. Figure 5: Full normal dataset containing training, validation, and testing sections (a); Neutron [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]
Figure 6
Figure 6. Figure 6: Flowchart showing preprocessing steps [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 7
Figure 7. Figure 7: Example showing the sliding window approach and separation between inputs and [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: Diagram of GRU cell (Right) and GRU model (Left) showing layer output dimensions [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]
Figure 9
Figure 9. Figure 9: Training and Validation Loss Over 500 Training Epochs for All Models [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 10
Figure 10. Figure 10: Comparison Between Power Values, Custom Moving Baseline, and Global Mean [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: GRU Model Predictions and Error on Normal Dataset (a); GRU Model Predictions [PITH_FULL_IMAGE:figures/full_fig_p022_11.png]
Figure 12
Figure 12. Figure 12: Relationship between the Error Threshold and the Proportion of Datapoints Labelled [PITH_FULL_IMAGE:figures/full_fig_p023_12.png]
Figure 13
Figure 13. Figure 13: (Top Left) SHAP contributions for neutron count change rate in dataset where it is not [PITH_FULL_IMAGE:figures/full_fig_p025_13.png]
Figure 14
Figure 14. Figure 14: Averaged SHAP Feature Contributions for Each FDI Dataset [PITH_FULL_IMAGE:figures/full_fig_p025_14.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

3 extracted references · 2 canonical work pages

  1. [3]

    Front Energy Res

    Prognostics and Health Management in Nuclear Power Plants: An Updated Method- Centric Review With Special Focus on Data-Driven Methods. Front Energy Res. https://doi.org/10.3389/fenrg.2021.696785 Zhao, Y., Smidts, C., 2020. A control-theoretic approach to detecting and distinguishing replay attacks from other anomalies in nuclear power plants. Progress in...

    work page arXiv 2021

  2. [328]

    A data-based private learning framework for enhanced security against replay attacks in cyber-physical systems

    https://doi.org/10.1016/j.apenergy.2022.120107 Zhai, L., Vamvoudakis, K.G., 2021. A data-based private learning framework for enhanced security against replay attacks in cyber-physical systems. International Journal of Robust and Nonlinear Control 31, 1817–1833. https://doi.org/10.1002/rnc.5040 Zhang, F., Hines, J.W., Coble, J.B., 2020. A Robust Cybersecu...

    work page arXiv 2022

  3. [2021]

    Ann Nucl Energy 150

    Development and assessment of a nearly autonomous management and control system for advanced reactors. Ann Nucl Energy 150. https://doi.org/10.1016/j.anucene.2020.107861 Liu, H., Mo, Y., Yan, J., Xie, L., Johansson, K.H., 2020. An Online Approach to Physical Watermark Design. IEEE Trans Automat Contr 65, 3895–3902. https://doi.org/10.1109/TAC.2020.2971994...

    arXiv 2020

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.