REVIEW 5 major objections 5 minor 1 cited by
Leveraging Digital Twin and Machine Learning Techniques for Anomaly Detection in Power Electronics Dominated Grid
T0 review · 5 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash
Pith's one-line read Adding a digital twin's virtual voltage and frequency measurements to raw grid data improves machine learning detection of man-in-the-middle attacks, with LSTM accuracy rising from 86.9% to 91.6%.
desk verdict A plausible proof-of-concept that DT features help ML attack detection, but the underspecified MITM attack and the DT's dependence on the same IED measurements leave the main claim unproven. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The carrying mechanism is the averaged real-time digital twin model. The inverter is modeled in grid-following mode as a current source with a D-Q decoupled PI current-control loop, a phase-locked loop, and an LCL output filter; loads follow $P_l = P_0(V/V_0)^{n_p}$ and $Q_l = Q_0(V/V_0)^{n_q}$; and transmission lines are represented by simplified series impedances. The twin takes the measured power values from the IEDs as references for loads and inverters and produces virtual voltage and frequency estimates at six feeder nodes. These virtual measurements are the extra features supplied to the Random Forest and LSTM classifiers, which are trained with z-score normalization, SMOTE balancing, Gaussian augmentation, and 10-fold cross-validation.
What would settle it
An ablation that feeds the digital twin with pre-attack recorded power references while the physical system is under attack, then compares detection accuracy, would settle whether the twin's virtual measurements flag the attack or merely mirror corrupted measurements.
Extended reading notes
Core claim
On the authors' own terms, the central result is that integrating DT-enhanced data significantly improved the accuracy and overall metrics for both the Random Forest and LSTM models. With virtual voltage estimates (V1 to V6) and frequency estimates (F1 to F6) from the digital twin added to the IED power measurements, Random Forest accuracy increased from 74.34% to 86.92% and recall from 0.77 to 0.8748, while LSTM accuracy increased from 86.88% to 91.59%, precision from 0.8325 to 0.9417, and F1 score from 0.8254 to 0.9028. The DT is an averaged real-time model of the feeder's inverters, loads, and transmission lines that mirrors the physical grid's state; the measured power values received from the IED act as reference points for loads and inverters in the twin.
Load-bearing premise
The claim collapses if the twin's virtual readings add no information beyond the raw measurements from grid devices, especially because the twin uses those same measured power values as its reference inputs and could therefore inherit corrupted data during an attack.
Editorial extensions
If this is right
- If the reported gains hold, adding a digital twin's virtual node voltages and frequencies to field measurements gives microgrid operators a low-cost way to widen sensing coverage without installing new physical sensors.
- A validated twin could generate labeled normal and attack datasets for training, easing the data scarcity that limits data-driven intrusion detection in real grids.
- The same DT-plus-ML pipeline should transfer to other false-data injection and fault scenarios beyond the man-in-the-middle case tested here.
- Since LSTM gained more consistently than Random Forest, models that exploit temporal structure benefit most from the twin's additional time-series features.
Reading between the lines
- Beyond the paper, the twin's virtual measurements could be cross-checked against physical sensors at the same nodes to localize the attacked feeder segment; the paper does not perform that localization.
- If an attacker can compromise the same communication channel that feeds measured power values into the twin, the method's advantage depends on virtual voltages and frequencies arriving through a separate, tamper-evident path, which the paper does not establish.
- A natural stress test is a coordinated attack that falsifies both the IED power data and the reference values sent to the twin; the observed accuracy gain would likely shrink, revealing how much of the current result relies on the twin seeing clean inputs.
- The virtual measurements may also serve as a consistency prior for physics-informed anomaly detectors, combining model-based residuals with learned classifiers; the paper leaves that combination unexplored.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a digital twin (DT) plus machine learning approach for detecting anomalies, specifically man-in-the-middle attacks, in a power-electronics-dominated grid. A hardware-in-the-loop testbed is described in which an RTDS simulator emulates the physical grid and an OPAL-RT machine runs an averaged real-time model as the digital twin. Random Forest and LSTM classifiers are trained on IED measurements alone and on IED measurements augmented with DT virtual voltage and frequency estimates (V1-V6, F1-F6). Table I reports that adding DT features improves accuracy from 0.7434 to 0.8692 for Random Forest and from 0.8688 to 0.9159 for LSTM, and the paper concludes that DT-enhanced data significantly improve threat detection.
Significance. If the claimed improvement is real and attributable to genuinely independent information from the digital twin, the result would be a useful practical contribution to cyber-physical security for inverter-dominated grids. The paper has some strengths: it uses a realistic real-time hardware-in-the-loop testbed (RTDS and OPAL-RT), implements standard and reproducible ML classifiers, and reports a clear head-to-head comparison in Table I. However, the current evidence is not sufficient to support the central claim: the attack scenario is unspecified, the digital twin is driven by the same IED measurements that the attack corrupts, no uncertainty quantification is provided, and the DT fidelity is not validated. The paper is best viewed as a proof-of-concept description rather than a validated empirical demonstration.
major comments (5)
- [§IV.D, Table I] The central claim that DT-enhanced data 'significantly improved' accuracy is not supported by any statistical analysis. Table I reports single point estimates for each metric, and although §III.B mentions 10-fold cross-validation, no per-fold results, standard deviations, confidence intervals, or significance tests are reported. Without these, the observed differences (e.g., RF accuracy 0.7434 vs. 0.8692) could plausibly be within the noise of a single data split. Please report the mean and standard deviation across folds, or an equivalent uncertainty measure, for every metric and both conditions.
- [§IV, §IV.A] The attack model is not described, which makes the reported detection results impossible to interpret or reproduce. The paper states only that a man-in-the-middle attack was simulated, but does not specify which IED messages were modified, by what magnitude, over what time window, how many attack instances were generated, or whether the analog PCC voltage channel was also affected. These details are essential because they determine the difficulty of the detection problem and the meaning of the with-DT versus without-DT comparison. Please provide an explicit attack model and describe how it was implemented in the testbed.
- [§IV, first paragraph; §IV.A] The digital twin is driven by the same IED measurements that a MITM attacker can corrupt, so the observed accuracy gain may reflect leakage of the attack signal through the DT rather than independent physical information. The manuscript says 'The measured power values received act as reference points for the loads and power inverters in the DT,' and the power features (P_pv, Q_pv, P_batt, Q_batt, P_w, Q_w, P_n, Q_n) are all received from IEDs. If an attacker modifies those IED messages, the corrupted values propagate into the DT, and the virtual voltage and frequency features V1-V6 and F1-F6 become nonlinear transformations of the same compromised measurements. To support the claim that the DT contributes independent information, the authors should either (i) protect or authenticate the DT input channel in the attack scenario, (ii) demonstrate with an explicit attack model that the V/F features respond differently from the raw IED features, or (iii) otherwise quantify the independence of the DT features from the attacked measurements.
- [§III.A, data preprocessing] The preprocessing applies SMOTE before splitting the data into training and test sets, which can leak synthetic minority-class samples into the test set and inflate the reported accuracy and F1-scores. The text says SMOTE was applied to balance the class distribution and then 'we divided the dataset into training and testing sets using stratified sampling.' This ordering is methodologically problematic; SMOTE should be applied only to the training portion of each cross-validation fold, after the split. Please re-run the experiments with SMOTE applied inside the cross-validation loop and report whether the conclusions change.
- [§IV, §IV.A, §II] The digital twin fidelity is asserted but never validated, and the dataset is not characterized. The manuscript claims the DT 'accurately mirror[s] the current state of the power system' and 'guarantees that the overall DT model accurately represents the real-time condition,' but no comparison between DT virtual measurements and physical RTDS measurements is provided, no error metrics are given, and the load and inverter model parameters are not tied to the specific devices in the testbed. Furthermore, the dataset description lacks the number of samples, the normal-to-attack class ratio, the total duration of the recordings, and the number of attack episodes. These omissions prevent the reader from assessing whether the DT is a faithful representation and whether the ML evaluation is meaningful.
minor comments (5)
- [Table I heading] The table heading contains a typo: 'PERFOMANCE' should be 'PERFORMANCE'.
- [§II, first paragraph] The reference marker '[E]' appears in the text but is not defined anywhere in the reference list; this should be replaced with a proper citation.
- [§III.A, feature selection] The phrase 'enhance model performance and interoperability' should likely read 'interpretability' in the context of feature selection based on Gini impurity decrease.
- [References] The reference list contains duplicate numbering: two entries are labeled [7], and reference [22] appears to be misdated (a 2010 citation for digital twin work on a vanadium redox flow battery is implausible). Please renumber and verify all references.
- [Abstract and §V] The abstract and conclusion state that the DT 'can accurately track and simulate' the grid, but the validation results needed to support this claim are not presented in the paper; the wording should be softened or supported by the required fidelity comparison.
Circularity Check
No significant circularity: the DT+ML accuracy improvement is an empirical test-bench result, not a derived identity, fitted parameter renamed as prediction, or self-citation chain.
full rationale
The paper's central claim is that adding digital-twin-derived virtual measurements (V1-V6, F1-F6) to IED measurements improves Random Forest and LSTM anomaly detection. This is presented as an empirical comparison on a hardware-in-the-loop test bench, not as a derivation: no equation defines the DT output in terms of the ML attack labels, and no fitted parameter is later relabeled as a prediction. The DT is an averaged inverter/load/line model (Eqs. 1-2) driven by the analog PCC voltage and IED power references; it is not trained on the normal/attack labels. The ML models are standard Random Forest and LSTM classifiers evaluated with k-fold cross-validation. There are self-citations ([1], [4], [13], [22], [23]), but none is load-bearing: they support standard inverter modeling, simulation practice, or prior DT-application context, not the accuracy gain itself, and none is invoked as a uniqueness theorem or as the sole justification for the anomaly-detection result. A genuine validity concern exists but is not circularity: Section IV states that 'the measured power values received act as reference points for the loads and power inverters in the DT,' so under a MITM attack on IED communications the corrupted power values also feed the DT, making the virtual features partially redundant encodings of the attacked measurements; and SMOTE is applied before the train/test split, which can leak synthetic samples into test evaluation. These issues bear on whether the reported gain isolates independent DT information, but they do not amount to the paper's result being equal to its inputs by construction. Editorial gaps (the unresolved citation '[E]' in Section II and duplicated reference numbering) are completeness issues, not circularity. Hence no circular steps are identified and the score is 0.
Assumptions & free parameters
assumptions (4)
- domain assumption The averaged real-time DT model faithfully represents the detailed electromagnetic transient model of the microgrid.
- domain assumption Man-in-the-middle attack instances are correctly labeled and detectable in the recorded features.
- domain assumption The load model with voltage exponents np and nq between 1 and 3 is adequate for the simulated feeder.
- standard math Standard supervised learning assumptions, including z-score normalization and stratified train-test splitting, hold for the dataset.
Cite this review
Pith. "Pith review of Leveraging Digital Twin and Machine Learning Techniques for Anomaly Detection in Power Electronics Dominated Grid." pith.science (2026). https://pith.science/paper/KH5DOUPE
@misc{pith2026250113474,
author = {Pith},
title = {Pith review of: Leveraging Digital Twin and Machine Learning Techniques for Anomaly Detection in Power Electronics Dominated Grid},
year = {2026},
howpublished = {\url{https://pith.science/paper/KH5DOUPE}},
note = {Machine review of arXiv:2501.13474}
}
read the original abstract
Modern power grids are transitioning towards power electronics-dominated grids (PEDG) due to the increasing integration of renewable energy sources and energy storage systems. This shift introduces complexities in grid operation and increases vulnerability to cyberattacks. This research explores the application of digital twin (DT) technology and machine learning (ML) techniques for anomaly detection in PEDGs. A DT can accurately track and simulate the behavior of the physical grid in real-time, providing a platform for monitoring and analyzing grid operations, with extended amount of data about dynamic power flow along the whole power system. By integrating ML algorithms, the DT can learn normal grid behavior and effectively identify anomalies that deviate from established patterns, enabling early detection of potential cyberattacks or system faults. This approach offers a comprehensive and proactive strategy for enhancing cybersecurity and ensuring the stability and reliability of PEDGs.
Forward citations
Cited by 1 Pith paper
-
We Need to Rethink Benchmarking in Anomaly Detection
Evaluating anomaly detection by averaging over diverse datasets is misleading; the paper proposes scenario-based benchmarking organized by shared structural properties.
Reference graph
Works this paper leans on
-
[10]
Shafei, H., Li, L., Aguilera, R.P. (2023). A Comprehensive Review on Cyber-Attack Detection and Control of Microgrid Systems. In: Haes Alhelou, H., H atziargyriou, N., Dong, Z.Y. (eds) Power Systems Cybersecurity. Power Systems. Springer, Cham. https://doi.org/10.1007/978-3-031-20360-2_1
-
[1]
Y. Khan, I. Idrisov, M. Pugach, and F. Martin Ibanez, “Real -Time Analysis of Battery State of Health in Supercapacitor -Battery Hybrid Systems for Electric Motorcycles,” IEEE Access, vol. 12, pp. 151403– 151414, 2024, doi: 10.1109/ACCESS.2024.3478375
arXiv 2024
-
[2]
A Comparative Study of Energy Storage Systems based on Modular Multilevel Converters,
F. D. Hernandez, F. Ibanez, R. Samanbakhsh, and R. Velazquez, “A Comparative Study of Energy Storage Systems based on Modular Multilevel Converters,” in IECON 2021 – 47th Annual Conference of the IEEE Industrial Electronics Society, Toronto, ON, Canada: IEEE, Oct. 2021, pp. 1–5. doi: 10.1109/IECON48115.2021.9589539
arXiv 2021
-
[3]
A. Ipakchi and F. Albuyeh, “Grid of the future,” IEEE Power Energy Mag., vol. 7, no. 2, pp. 52 –62, Mar. 2009, doi: 10.1109/MPE.2008.931384
-
[4]
Paralleled Modified Droop -Based Voltage Source Inverter for 100% Inverter - Based Microgrids,
A. A. Nazeri, P. Zacharias, F. M. Ibanez, and I. Idrisov, “Paralleled Modified Droop -Based Voltage Source Inverter for 100% Inverter - Based Microgrids,” in 2021 IEEE Industry Applicati ons Society Annual Meeting (IAS), Oct. 2021, pp. 1 –8. doi: 10.1109/IAS48185.2021.9677128
-
[5]
On the Stability of the Power Electronics-Dominated Grid: A New Energy Paradigm,
A. Khan, M. Hosseinzadehtaher, M. B. Shadmand, S. Bayhan, and H. Abu-Rub, “On the Stability of the Power Electronics-Dominated Grid: A New Energy Paradigm,” IEEE Ind. Electron. Mag., vol. 14, no. 4, pp. 65–78, Dec. 2020, doi: 10.1109/MIE.2020.3002523
arXiv 2020
-
[6]
Secure Metering Data Aggregation With Batch Verification in Industrial Smart Grid,
Y. Ding, B. Wang, Y. Wang, K. Zhang, and H. Wang, “Secure Metering Data Aggregation With Batch Verification in Industrial Smart Grid,” IEEE Trans. Ind. Inform., v ol. 16, no. 10, pp. 6607 –6616, Oct. 2020, doi: 10.1109/TII.2020.2965578
arXiv 2020
-
[7]
Data-Centric Hierarchical Distributed Model Predictive Control for Smart Grid Energy Management,
A. Saad, T. Youssef, A. T. Elsayed, A. Amin, O. H. Abdalla, and O. Mohammed, “Data-Centric Hierarchical Distributed Model Predictive Control for Smart Grid Energy Management,” IEE E Trans. Ind. Inform., vol. 15, no. 7, pp. 4086 –4098, Jul. 2019, doi: 10.1109/TII.2018.2883911
arXiv 2019
Show all 26 references
-
[8]
The 2015 Ukraine Blackout: Implications for False Data Injection Attacks,
G. Liang, S. R. Weller, J. Zhao, F. Luo, and Z. Y. Dong, “The 2015 Ukraine Blackout: Implications for False Data Injection Attacks,” IEEE Trans. Power Syst. , vol. 32, no. 4, pp. 3317 –3318, Jul. 2017, doi: 10.1109/TPWRS.2016.2631891
2015
-
[9]
Cyber attack impact on power system blackout,
Su Sheng, Wang Yingkun, Long Yuyi, Li Yong, and Jiang Yu, “Cyber attack impact on power system blackout,” in IET Conference on Reliability of Transmission and Distribution Net works (RTDN 2011), London, UK: IET, 2011, pp. 3B3-3B3. doi: 10.1049/cp.2011.0520
2011
-
[11]
CONSUMER: A Novel Hybrid Intrusion Detection System for Distribution Networks in Smart Grid,
C.-H. Lo and N. Ansari, “CONSUMER: A Novel Hybrid Intrusion Detection System for Distribution Networks in Smart Grid,” IEEE Trans. Emerg. Top. Comput., vol. 1, no. 1, pp. 33 –44, Jun. 2013, doi: 10.1109/TETC.2013.2274043
2013
-
[12]
Detection of False Data Injection Attacks in Smart Grids Based on Graph Signal Processing,
E. Drayer and T. Routtenberg, “Detection of False Data Injection Attacks in Smart Grids Based on Graph Signal Processing,” IEEE Syst. J., vol. 14, no. 2, pp. 1886 –1896, Jun. 2020, doi: 10.1109/JSYST.2019.2927469
2020
-
[13]
Imitatsionnoe modelirovanie sistem elektrosnabzheniya v programme MATLAB,
M. AlSadat and F. M. Ibanez, “Imitatsionnoe modelirovanie sistem elektrosnabzheniya v programme MATLAB,” in 2021 IEEE Power & Energy Society General Meeting (PESGM), Jul. 2021, pp. 1–5. doi: 10.1109/PESGM46819.2021.9638164
2021
-
[14]
False Data Injection Cyber-Attacks Detection for Multiple DC Microgrid Clusters,
S. Tan, P. Xie, J. M. Guerrero, and J. C. Vasquez, “False Data Injection Cyber-Attacks Detection for Multiple DC Microgrid Clusters,” Appl. Energy, vol. 310, p. 118425, Mar. 2022, doi: 10.1016/j.apenergy.2021.118425
2022
-
[15]
Improved Estimation for Well-Logging Problems Based on Fusion of Four Types of Kalman Filters,
S. Soltani, M. Kordestani, P. K. Aghaee, and M. Saif, “Improved Estimation for Well-Logging Problems Based on Fusion of Four Types of Kalman Filters,” IEEE Trans. Geosci. Remote Sens., vol. 56, no. 2, pp. 647–654, Feb. 2018, doi: 10.1109/TGRS.2017.2752460
2018
-
[16]
Detecting False Data Injection Attacks Against Power System State Estimation With Fast Go -Decomposition Approach,
B. Li, T. Ding, C. Huang, J. Zhao, Y. Yang, and Y. Chen, “Detecting False Data Injection Attacks Against Power System State Estimation With Fast Go -Decomposition Approach,” IEEE Trans. Ind. Inform., vol. 15, no. 5, pp. 2892 –2904, May 2 019, doi: 10.1109/TII.2018.2875529
-
[17]
Machine Learning Methods for Attack Detection in the Smart 6 Grid,
M. Ozay, I. Esnaola, F. T. Yarman Vural, S. R. Kulkarni, and H. V. Poor, “Machine Learning Methods for Attack Detection in the Smart 6 Grid,” IEEE Trans. Neural Netw. Learn. Syst., vol. 27, no. 8, pp. 1773– 1786, Aug. 2016, doi: 10.1109/TNNLS.2015.2404803
2016
-
[18]
Detection of False Data Injection Cyber -Attacks in DC Microgrids Based on Recurrent Neural Networks,
M. R. Habibi, H. R. Baghaee, T. Dragicevic, and F. Blaabjerg, “Detection of False Data Injection Cyber -Attacks in DC Microgrids Based on Recurrent Neural Networks,” IEEE J. Emerg. Sel. Top. Power Electron., vol. 9, no. 5, pp. 5294 –5310, Oct. 2021, doi: 10.1109/JESTPE.2020.2968243
2021
-
[19]
Microgrid Digital Twins: Concepts, Applications, and Future Trends,
N. Bazmohammadi, A. Madary, J. C. Vasquez, B. Khan, and J. M. Guerrero, “Microgrid Digital Twins: Concepts, Applications, and Future Trends,” vol. 10, 2022
2022
-
[20]
Digital twin of a Fresnel solar collector for solar cooling,
D. O. Machado et al., “Digital twin of a Fresnel solar collector for solar cooling,” Appl. Energy, vol. 339, p. 120944, Jun. 2023, doi: 10.1016/j.apenergy.2023.120944
2023
-
[21]
Machine Learning -Based Digital Twin for Predictive Modeling in Wind Turbines,
M. Fahim, V. Sharma, T. -V. Cao, B. Canberk, and T. Q. Duong, “Machine Learning -Based Digital Twin for Predictive Modeling in Wind Turbines,” IEEE Access, vol. 10, pp. 14184 –14194, 2022, doi: 10.1109/ACCESS.2022.3147602
2022
-
[22]
Digital Twin for State of Charge Estimation of a Vanadium Redox Flow Battery,
Ildar Idrisov, “Digital Twin for State of Charge Estimation of a Vanadium Redox Flow Battery,” in Paths to Sustainable Energy, InTech, 2010. doi: 10.5772/13338
2010 doi
-
[23]
Improving the power sharing transients in droop -controlled inverters with the introduction of an angle difference limiter,
F. Ibanez, A. Mahmoud, V. Yaroslav, V. Peric, and P. Vorobev, “Improving the power sharing transients in droop -controlled inverters with the introduction of an angle difference limiter,” Int. J. Electr. Power Energy Syst., vol. 153, p. 109371, Nov. 2023, doi: 10.1016/j.ijepes...
2023
-
[24]
Imitatsionnoe modelirovanie sistemelektrosnabzheniya v programme MATLAB [Simulation modeling of power supplysystems in MATLAB],
Kostyuchenko, L.P. “Imitatsionnoe modelirovanie sistemelektrosnabzheniya v programme MATLAB [Simulation modeling of power supplysystems in MATLAB],” Krasnoyar. gos. agrar. un -t [Krasno yarsk State AgrarianUniversity], Krasnoyarsk, Krasnoyarsk State Agrarian University Publ., ...
2012
- [25]
-
[26]
Long Short-term Memory,
S. Hochreiter and J. Schmidhuber, “Long Short-term Memory,” Neural Comput., vol. 9, pp. 1735 –80, Dec. 1997, doi: 10.1162/neco.1997.9.8.1735
1997 doi
Reviewed August 10, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.