Pith. sign in

REVIEW 4 major objections 5 minor 16 references

Learning-Enabled Adaptive Voltage Protection Against Load Alteration Attacks On Smart Grids

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adaptive voltage protection can be trained, in a zero-sum game, to mitigate any stealthy load alteration attack on a smart grid.

desk verdict A plausible adaptive-protection framework with a real hardware demo, but the advertised game-theoretic guarantee is broken by multiple proof errors. read the letter →

arxiv 2411.15229 v1 pith:RWR5KFLH submitted 2024-11-21 eess.SY cs.CRcs.GTcs.SY

Anjana B. , Suman Maiti , Sunandan Adhikary , Soumyajit Dey , Ashish R. Hota This is my paper · ORCID
classification eess.SYcs.CRcs.GTcs.SY
keywords adaptivevoltageprotectionloadalterationattackstealthydeepreinforcementlearningStackelberggamesmartgridsecurityfalsedatainjectionhardware-in-the-loop
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a smart grid's voltage protection can be made robust against stealthy load alteration attacks by letting a deep reinforcement learning agent adjust the activation thresholds of existing under-voltage and over-voltage relays in real time. The setting is a two-player zero-sum game: an attacker falsifies HVAC temperature readings to increase power demand at the most unstable bus, while the adaptive protection system (APS) tunes thresholds to trip protection before blackout. The authors prove that this game has a Stackelberg equilibrium because the payoff is concave in the attacker's temperature change and convex in the defender's threshold, so a stationary defender policy exists that counters any attacker policy. They support the theory with IEEE 14-bus simulations and hardware-in-the-loop experiments showing the APS keeps bus voltage at a survivable level and triggers protection with low false-positive rate under noise. The intended upshot is that existing fixed-threshold protections can be upgraded without new hardware to meet a class of cyber attacks they were not designed for.

What carries the argument

The load-bearing object is the payoff function $f = \log(1+k\Delta T) - \log(1+(dV_i/dt)/R_{\mathrm{Th}}) + c_1\log(1+e^{-V_i/V^l_{\mathrm{Th}}}) + c_2\log(1+e^{-V^u_{\mathrm{Th}}/V_i})$, together with the Fast Voltage Stability Index (FVSI) that selects the attack surface. The first log term rewards extra power consumption; the second penalizes voltage changes beyond the nominal rate-of-change-of-voltage threshold $R_{\mathrm{Th}}$, which keeps the attack stealthy; the third and fourth terms reward keeping the bus voltage inside the fixed safety band. The defender minimizes $f$ by choosing the upper threshold $V^u_{\mathrm{Th}}$ (with $V^l_{\mathrm{Th}}=V^u_{\mathrm{Th}}/\alpha$), and the paper's claimed convexity of $f$ in $V^u_{\mathrm{Th}}$ and concavity in $\Delta T$ make the game a convex-concave zero-sum Stackelberg game, which is what yields a stationary mitigation policy.

What would settle it

Evaluate the second derivatives of $f$ over the full action ranges on the IEEE 14-bus model: if any point in the attacker's action set has $\partial^2 f/\partial \Delta T^2 \geq 0$, or any point in the defender's threshold set has $\partial^2 f/\partial (V^u_{\mathrm{Th}})^2 \leq 0$, the convex-concave premise underlying Claim 1 is false. A second decisive test is to run the learned APS policy against an attacker that switches attack buses adaptively or attacks several buses at once; a blackout in any such scenario would contradict the claim that the policy mitigates any attacker action.

Watch

Extended reading notes

Core claim

The central claim is Claim 1 of Section III: in the attacker–mitigator game $\mathcal{G}_{\mathrm{prot}}$, there always exists a stationary policy $\pi^*_{\mathrm{avps}}$ for the adaptive protection system that mitigates any action of a load alteration attacker, whatever policy the attacker uses. The argument models grid protection as a zero-sum convex-concave Stackelberg game whose objective is the discounted sum of a payoff $f$. Because $f$ is concave in the attacker's action $\Delta T$ and convex in the defender's threshold $V^u_{\mathrm{Th}}$, Jensen's inequality preserves these curvature properties under the expectation, and a known existence result for zero-sum stochastic Stackelberg games yields a stationary equilibrium pair. The defender's equilibrium policy, learned by DQN in competition with a DDPG-trained attacker, is then claimed to mitigate every stealthy load alteration the attacker can generate, not only the attacks seen during training.

Load-bearing premise

The guarantee collapses if the payoff is not actually concave in the attacker's temperature change and convex in the defender's threshold, or if the DDPG/DQN training fails to converge to the game's Stackelberg equilibrium, neither of which the paper proves.

Editorial extensions

If this is right

  • Any stealthy load alteration inside the modeled action space is covered by the learned defense, including attack sequences not seen in training, if the equilibrium-existence claim holds.
  • Existing under-voltage and over-voltage relays can be retrofitted with learning-adjusted thresholds to avert SLA-induced blackouts without new protection hardware.
  • The FVSI-guided attacker defines a worst-case adversary for evaluating defenses: a protection policy that survives this attacker should also survive less informed load alteration attacks.
  • The convex-concave payoff design is a reusable recipe: for other protection schemes, find defender actions that make the payoff convex in defense and concave in attack, and a stationary equilibrium policy is guaranteed.
  • The noise experiments indicate the APS triggers protection at the right time across most load-profile noise levels, with a false-positive rate of 2/7 over the tested scenarios.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The guarantee is only as strong as the training's convergence to the Stackelberg equilibrium; the paper does not prove convergence for its DDPG/DQN loop, so an implicit open question is whether the learned policy actually reaches $\pi^*_{\mathrm{avps}}$ on states far from the training distribution.
  • The same game-theoretic template could be adapted to under-frequency load shedding and other protection classes, provided the payoff's curvature conditions can be reproduced for frequency-based thresholds.
  • A natural test the authors do not run is an adaptive adversary that keeps learning during deployment; Claim 1 concerns policies in the modeled game, not a defender re-optimizing against an attacker who changes its strategy class mid-operation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a deep reinforcement learning (DRL)-based adaptive protection system (APS) for smart grids against stealthy load alteration attacks (SLAs). The authors model the interaction between a load alteration attacker (LAA) and an adaptive voltage protection system as a two-player zero-sum Markov game, define a payoff function f, and claim that because the game is convex-concave, a Stackelberg equilibrium exists and the resulting APS policy mitigates any SLA. The method is implemented in a competitive MARL setting with DDPG for the attacker and DQN for the defender, and validated on an IEEE 14-bus model in a hardware-in-the-loop setup.

Significance. If the central theoretical claim were correct, the paper would provide a useful template for designing adaptive protection schemes with formal guarantees against a class of cyber-physical attacks. The HIL implementation and the attempt to connect game-theoretic equilibrium with practical threshold adaptation are commendable. However, the theoretical guarantee is the main advertised contribution, and it rests on several unproved and, as written, incorrect steps: the payoff function is not continuous, convexity/concavity is asserted without derivation, the proof of Claim 1 contains a reversed inequality, and the connection between the equilibrium payoff and the blackout condition is missing. The experimental section also only tests the method against the authors' own learned attacker, so it cannot substantiate the 'any stealthy load alteration' claim. These issues are load-bearing, and the set of results does not support the paper's central claim in its current form.

major comments (4)
  1. [Section III-C, Completeness] The assertion that f in Eq. (4) is continuous and smooth in the action spaces is not correct. The boolean variables c1 and c2 are defined as step functions that jump when Vi crosses Vl_th or Vu_th, respectively, so the terms c1 log(1+exp(-Vi/Vl_th)) and c2 log(1+exp(-Vu_th/Vi)) are discontinuous at the threshold boundaries. This discontinuity undermines the invocation of the convex-concave Stackelberg game result from [15], which requires the required regularity and convexity-concavity assumptions. The claim that f is convex in Vu_th and concave in ΔT_i is asserted without derivation, and the dependence of dVi/dt on ΔT_i through nonlinear power-flow and generator equations means the sign of the total second derivative is not fixed by the term k alone.
  2. [Section III-C, Claim 1 proof] The inequality in the proof of Claim 1 is reversed for a maximizing attacker. The proof states J_{π_laa,π*_avps} ≥ J_{π*_laa,π*_avps} for any suboptimal π_laa, but since π*_laa is a maximizer, the correct inequality is J_{π*_laa,π*_avps} ≥ J_{π_laa,π*_avps}. As written, the proof's conclusion does not follow from the preceding argument. Moreover, the proof never defines what it means for the mitigator to 'mitigate' an attack in terms of the game payoff; no step links the value of f or J to the blackout condition used in the definition of an SLA, so even a correct equilibrium statement would not establish the paper's advertised guarantee.
  3. [Section III-C, Eq. (5)] The optimization problem in Eq. (5) uses arg min over π_avps of arg max over π_laa, which is a min-max formulation. However, the text in Section III-A describes the attacker as moving first and the mitigator responding after observing the attack. For a Stackelberg game with the attacker as leader, the appropriate ordering is max over π_laa of min over π_avps (or the relevant leader-follower hierarchy must be explicitly specified). The paper does not justify the min-max order in Eq. (5) or explain why the learned policies, which are updated simultaneously in Algorithm 1, correspond to a Stackelberg equilibrium rather than a Nash equilibrium. This ambiguity affects the central game-theoretic claim.
  4. [Section III-C, Soundness] The soundness argument states that because Q maximization in DDPG/DQN resembles the objective J in Eq. (5), the MARL training in Algorithm 1 converges to a policy that solves Eq. (5). No convergence theorem is provided for this competitive MARL setting, and the references to [15] concern existence of equilibria, not convergence of DDPG/DQN. The claim that the learned policy 'converges to a sound policy π*_avps' is therefore unsupported. The experimental results in Section IV only compare the APS against the trained LAA policy, not against arbitrary or hand-crafted SLA strategies, so they do not provide evidence for the 'any SLA' guarantee.
minor comments (5)
  1. [Section III-A] There is a typo in the policy definitions: both players' policies are written as πlaa : S 7→ Alaa; the mitigator's policy should be πavps : S 7→ Aavps.
  2. [Section II, Load Alteration Attack Model] The formal definition of an SLA says the voltage 'deviates from its normal profile, leading to blackout condition,' but 'blackout condition' is never precisely defined. Since the paper's guarantee is about preventing blackouts, a precise formal definition is needed.
  3. [Section III-A, Eq. (4)] The notation for thresholds is inconsistent: the game description uses Vl_th and Vu_th, while Section II uses Vl_Thj and Vu_Thj. The relationship Vu_th = α × Vl_th is introduced without stating the domain of α beyond (1,2]; this should be clarified because it affects the action space Aavps.
  4. [Section IV] The false-positive-rate experiment in Fig. 4c is presented as 2/7 based on premature triggering in two of seven noise scenarios, but the text does not specify the criteria for 'premature' or the exact timing tolerance. The figure would benefit from clearer labeling of the noise variance values and the corresponding APS activation times.
  5. [References] The codebase reference [16] is given as an anonymous repository; if this is intended for a double-blind submission, that is fine, but the anonymity should be maintained consistently in any public version.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the proof chain is not self-referential; the actual defects are unproved convex-concavity and an invalid inference, not construction.

full rationale

I walked the derivation chain: Eq. (4) defines the payoff f; Section III-C asserts, without derivation, that f is smooth, concave in ΔT_i and convex in V_u_th; Eq. (5) defines the min-max objective; reference [15] is cited for the existence of a Stackelberg equilibrium; Claim 1 is presented as the consequence. Nothing in this chain renames an input as an output. The convex-concave statement is an unsupported premise (and, because of the boolean c1 and c2 terms, probably false), and the inequality J_{πlaa,π*avps} ≥ J_{π*laa,π*avps} has the wrong direction for a maximizing attacker; these are correctness gaps, not circular reductions. R_Th is fitted to normal-operation data, but it is a reward-design parameter and is never relabeled as a predicted quantity; the FPR experiment tests behavior under the fitted threshold rather than predicting it. The self-citations ([6], [12]) support background claims about related work and standard protection-scheme descriptions and are not load-bearing in the proof of Claim 1. The proof does not reduce Eq. (5) to Eq. (4) by construction, and it does not import a uniqueness theorem from the authors' own prior work. Hence there is no significant circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim depends on the hand-designed payoff f, its unproven convex-concave property, and the unverified transfer of a game-theoretic existence result to RL training. No new physical entities are introduced.

free parameters (3)
  • R_Th_i (RoCoV threshold in payoff) = not stated numerically; chosen from normal-operation voltage deviation
    Used in the second term of f and in the FPR experiments; it is fitted to observed nominal noise, not derived.
  • α (ratio V_u_th / V_l_th) = α ∈ (1, 2], choice not specified
    Introduced to reduce defender action space to one dimension; arbitrary design choice affecting the game.
  • k (power-temperature proportionality) = not given
    Assumed relation ∆P_i = k ∆T_i; value not measured or fitted, affecting the magnitude of load alteration.
assumptions (4)
  • standard math Power flow equations (Eq. 1) and FVSI (Eq. 2) accurately model the grid.
    Standard power-system models, take as given.
  • ad hoc to paper f is concave in ∆T and convex in V_u_th (Section III-C, Completeness).
    Asserted without proof; the actual dependency of dV/dt on ∆T makes concavity questionable.
  • domain assumption The convex-concave zero-sum Stackelberg game theorem from [15] applies to Gprot.
    Invoked to claim existence of equilibrium, but the conditions of [15] are not verified.
  • ad hoc to paper DDPG/DQN training in Algo. 1 converges to the equilibrium policy (Section III-C, Soundness).
    No convergence guarantee is proven for this MARL setup; the text asserts the Q-value 'resembles' the cost J.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Learning-Enabled Adaptive Voltage Protection Against Load Alteration Attacks On Smart Grids." pith.science (2026). https://pith.science/paper/RWR5KFLH

@misc{pith2026241115229,
  author       = {Pith},
  title        = {Pith review of: Learning-Enabled Adaptive Voltage Protection Against Load Alteration Attacks On Smart Grids},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RWR5KFLH}},
  note         = {Machine review of arXiv:2411.15229}
}
read the original abstract

Smart grids are designed to efficiently handle variable power demands, especially for large loads, by real-time monitoring, distributed generation and distribution of electricity. However, the grid's distributed nature and the internet connectivity of large loads like Heating Ventilation, and Air Conditioning (HVAC) systems introduce vulnerabilities in the system that cyber-attackers can exploit, potentially leading to grid instability and blackouts. Traditional protection strategies, primarily designed to handle transmission line faults are often inadequate against such threats, emphasising the need for enhanced grid security. In this work, we propose a Deep Reinforcement Learning (DRL)-based protection system that learns to differentiate any stealthy load alterations from normal grid operations and adaptively adjusts activation thresholds of the protection schemes. We train this adaptive protection scheme against an optimal and stealthy load alteration attack model that manipulates the power demands of HVACs at the most unstable grid buses to induce blackouts. We theoretically prove that the adaptive protection system trained in this competitive game setting can effectively mitigate any stealthy load alteration-based attack. To corroborate this, we also demonstrate the method's success in several real-world grid scenarios by implementing it in a hardware-in-loop setup.

Figures

Figures reproduced from arXiv: 2411.15229 by the authors.

Figure 1
Figure 1. Grid operating frequency and voltage waveform [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 3
Figure 3. Our proposed attack mitigation framework [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 4
Figure 4. Real-time simulation results of the IEEE 14 bus model [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

16 extracted references · 15 canonical work pages

  1. [15]

    Zero-sum stochastic stackelberg games,

    D. Goktas, S. Zhao, and A. Greenwald, “Zero-sum stochastic stackelberg games,” Advances in Neural Information Processing Systems , vol. 35, pp. 11 658–11 672, 2022

    work page 2022

  2. [1]

    {BlackIoT}:{IoT} botnet of high wattage devices can disrupt the power grid,

    S. Soltan, P. Mittal, and H. V . Poor, “ {BlackIoT}:{IoT} botnet of high wattage devices can disrupt the power grid,” in 27th USENIX Security Symposium (USENIX Security 18) , 2018, pp. 15–32

    2018

  3. [2]

    Resilient distributed control against false data injection attacks for demand response,

    S. Yang, K.-W. Lao, Y . Chen, and H. Hui, “Resilient distributed control against false data injection attacks for demand response,” IEEE Transactions on Power Systems , vol. 39, no. 2, pp. 2837–2853, 2023

    work page 2023

  4. [3]

    {MaDIoT} 2.0: Modern {High-Wattage}{IoT} botnet attacks and defenses,

    T. Shekari, A. A. Cardenas, and R. Beyah, “ {MaDIoT} 2.0: Modern {High-Wattage}{IoT} botnet attacks and defenses,” in 31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 3539–3556

    work page 2022

  5. [4]

    Not everything is dark and gloomy: Power grid protections against {IoT} demand attacks,

    B. Huang, A. A. Cardenas, and R. Baldick, “Not everything is dark and gloomy: Power grid protections against {IoT} demand attacks,” in 28th USENIX Security Symposium (USENIX Security 19) , 2019, pp. 1115– 1132

    work page 2019

  6. [5]

    Mitsubishi electric air conditioning system,

    C. Toyama, “Mitsubishi electric air conditioning system,” Cybersecurity and Infrastructure Security Agency , 2021

    work page 2021

  7. [6]

    Catch me if you learn: Real-time attack detection and mitigation in learning enabled cps,

    I. Koley, S. Adhikary, and S. Dey, “Catch me if you learn: Real-time attack detection and mitigation in learning enabled cps,” in 2021 IEEE Real-Time Systems Symposium (RTSS) . IEEE, 2021, pp. 136–148

    work page 2021

  8. [7]

    Optimal false data injection attack against automatic generation control in power grids,

    R. Tan, H. H. Nguyen, E. Y . Foo, X. Dong, D. K. Yau, Z. Kalbarczyk, R. K. Iyer, and H. B. Gooi, “Optimal false data injection attack against automatic generation control in power grids,” in 2016 ACM/IEEE 7th International Conference on Cyber-Physical Systems (ICCPS) . IEEE, 2016, pp. 1–10

    work page 2016

Show all 16 references
  1. [8]

    A multistage game in smart grid security: A reinforcement learning solution,

    Z. Ni and S. Paul, “A multistage game in smart grid security: A reinforcement learning solution,” IEEE transactions on neural networks and learning systems , vol. 30, no. 9, pp. 2684–2695, 2019

    2019

  2. [9]

    A deep learning game theoretic model for defending against large scale smart grid attacks,

    J. D. Cunningham, A. Aved, D. Ferris, P. Morrone, and C. S. Tucker, “A deep learning game theoretic model for defending against large scale smart grid attacks,” IEEE Transactions on Smart Grid , vol. 14, no. 2, pp. 1188–1197, 2022

    2022

  3. [10]

    A nash equilibrium-based moving target defense against stealthy sensor attacks,

    D. Umsonst, S. Saritas ¸, and H. Sandberg, “A nash equilibrium-based moving target defense against stealthy sensor attacks,” in 2020 59th IEEE Conference on Decision and Control (CDC) . IEEE, 2020, pp. 3772–3778

    2020

  4. [11]

    Power system stability,

    P. Kundur, “Power system stability,” Power system stability and control, vol. 10, pp. 7–1, 2007

    2007

  5. [12]

    Targeted attack synthesis for smart grid vulnerability analysis,

    S. Maiti, A. Balabhaskara, S. Adhikary, I. Koley, and S. Dey, “Targeted attack synthesis for smart grid vulnerability analysis,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 2576–2590

    2023

  6. [13]

    G. F. Lyon, Nmap network scanning: The official Nmap project guide to network discovery and security scanning . Insecure, 2009

    2009

  7. [14]

    Jensen’s inequality for conditional expectations in banach spaces,

    A. M. Zapała, “Jensen’s inequality for conditional expectations in banach spaces,” 2000

    2000

  8. [16]

    Adaptive Protection System for Smart Grid,

    “Adaptive Protection System for Smart Grid,” https://anonymous. 4open.science/r/Adaptive-Protection-System-for-Smart-Grids-8247/ README.md

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.