PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial FDI Attack against AC State Estimation with ANN

Tian Liu, Tao Shu

arXiv:1906.11328v1cs.LGcs.CRstat.ML

TL;DR

ANNs can estimate nonlinear AC power-system states accurately, but adversarial false-data-injection attacks on these models had not been studied. This paper formulates constrained optimization attacks and adapts DE and SLSQP to generate measurement perturbations. DE succeeds in more than 80% of cases even with few compromised meters and low false-injection levels, and outperforms SLSQP in the specific-k-meter scenario.

  • Problem

    The paper investigates whether ANN vulnerability to adversarial examples extends to AC state estimation, where nonlinear measurement-state relationships complicate FDI attack design.

    Source: §1 · p. 2

  • Method

    The authors formulate constrained optimization-based FDI attacks against ANN AC state estimation and adapt DE and SLSQP to generate attack vectors.

    Source: §1 · p. 3, §7 · p. 12

  • Results

    More than 80% of DE attacks succeed, even with few compromised meters and low false-injection levels; DE outperforms SLSQP in the specific-k-meter attack.

    Source: §1 · p. 3, §7 · p. 13

  • Takeaways & Limitations

    The study demonstrates that ANN-based AC state-estimation models are vulnerable to adversarial FDI attacks under the evaluated scenarios.

    Source: §7 · pp. 12–13

    The study considers attacks only during operation after ANN training; perturbing training data or the trained model is out of scope.

    Source: §4.1 · p. 5

Abstract

from arXiv · show

Artificial neural network (ANN) provides superior accuracy for nonlinear alternating current (AC) state estimation (SE) in smart grid over traditional methods. However, research has discovered that ANN could be easily fooled by adversarial examples. In this paper, we initiate a new study of adversarial false data injection (FDI) attack against AC SE with ANN: by injecting a deliberate attack vector into measurements, the attacker can degrade the accuracy of ANN SE while remaining undetected. We propose a population-based algorithm and a gradient-based algorithm to generate attack vectors. The performance of these algorithms is evaluated through simulations on IEEE 9-bus, 14-bus and 30-bus systems under various attack scenarios. Simulation results show that DE is more effective than SLSQP on all simulation cases. The attack examples generated by DE algorithm successfully degrade the ANN SE accuracy with high probability.

1 Introduction

AC state estimation uses nonlinear relationships between measurements and system states, making false-data-injection attacks harder to characterize than in DC models. This paper studies attacks on ANN-based AC state estimation and proposes optimization-based methods to generate them under attacker constraints.

1 Introduction

  • The introduction situates the work in smart-grid security concerns, noting that cyberattacks can disrupt power service and that the 2015 Ukraine outage affected over 225,000 customers.The paper describes identifying threats and proposing countermeasures as important to reducing potential societal losses.Source: §1 · p. 1
  • Unlike DC attacks, AC attacks are complicated by nonlinear measurement-to-state relationships, which make the effects of measurement changes on state errors difficult to identify.Prior AC FDI work described here is limited, with approaches largely adapted from DC attacks or based on WLS.Source: §1 · p. 2
  • The paper is the first study, to the authors’ knowledge, of FDI attacks against ANN-based AC state-estimation models.It examines whether ANN vulnerability to adversarial examples in image classification extends to smart-grid state estimation.Source: §1 · p. 2
  • The attack problem seeks an optimal vector under meter-access and resource constraints, while ANN state estimates are continuous rather than discrete class labels.These structural differences mean image-classification attack results do not directly apply.Source: §1 · p. 2
  • The paper formulates optimization-based AC attacks that accommodate practical attacker constraints, then adapts DE and SLSQP to generate attack vectors for two meter-access scenarios.In the any-k scenario, DE may select the meters; in the specific-k scenario, the meters are fixed.Source: §1 · p. 3
  • DE attacks succeed in more than 80% of cases, even with few compromised meters and low false-injection levels.The simulations cover three test systems and various attack scenarios.Source: §1 · p. 3

2 Preliminaries

AC state estimation relates measurements to system states through nonlinear functions and measurement error. The preliminaries describe WLS estimation and residual-based bad-data detection.

2 Preliminaries

  • In the AC model, measurements satisfy z = h(x)+e, where h relates the state vector x to measurements z nonlinearly and e is normally distributed measurement error.The model is over-determined when the measurement dimension Nm exceeds the state dimension Nn.Source: §2 · p. 3
  • WLS estimates the states in an over-determined system by optimizing a residual function, and bad-data tests use the resulting residual J(ˆx).The residual follows a χ2(K) distribution under the stated normal-error assumption, with K = Nm − Nn degrees of freedom.Source: §2 · p. 3
  • A measurement is identified as bad when its residual J(ˆx) exceeds the predetermined threshold τ.The threshold can be chosen using significance level α, which sets the false-alarm probability to α.Source: §2 · pp. 3–4

3 ANN-based AC SE

The ANN state-estimation models are trained and tested on simulated IEEE 9-, 14-, and 30-bus systems under varied loads and measurement noise. A revised loss improves 30-bus phase-angle estimation, and the models are reported to estimate AC states accurately with few false alarms under regular noise.

3 ANN-based AC SE

  • Training and testing use simulated IEEE 9-, 14-, and 30-bus systems, with 10,000 training and 1,000 testing state-measurement pairs per system.Loads range from 80% to 120%, and independent Gaussian noise is added to measurement readings.Source: §3 · p. 4
  • Adding a state-error penalty reduced voltage phase-angle estimation error in the 30-bus system from 12% to 1.3%.The standard mean WLS loss worked well on 9- and 14-bus systems but did not provide accurate phase-angle estimates on the 30-bus system.Source: §3 · p. 4
  • The ANN models accurately estimate AC states and have a low false-alarm rate under regular measurement noise.Accuracy is evaluated using maximum absolute relative error, with limits of 1% for voltage magnitude and 5% for voltage phase angle; Table 1 summarizes results at α = 0.01.Source: §3 · p. 5, Table 1 · p. 5

4 Adversarial Model and Attack Formulation

The attacker seeks to maximize ANN state-estimation error by altering measurements while evading bad-data detection and respecting access and resource constraints. The paper formulates this as a constrained optimization, assumes a strong attacker, and limits its scope to operational-phase measurement tampering.

4.1 Adversarial Model

  • The attacker optimizes a measurement injection to maximize state-estimation error while remaining stealthy under resource and meter-access constraints.The manipulated measurements are supplied to the ANN state estimator.Source: §4.1 · p. 5, §4.2 · p. 6
  • The attacker is assumed to know grid topology, ANN architecture and parameters, and the detector threshold; this strong model is intended to bound attack impact.The paper notes these assumptions may not represent practical cases.Source: §4.1 · p. 5
  • The study considers only operational-phase attacks on measurement inputs after ANN training, excluding perturbations to training data or the trained model.Training-data and model pollution are left for future work.Source: §4.1 · p. 5

4.2 Attack Formulation

  • The attack vector is added to the measurement vector to form the manipulated input provided to the ANN state estimator.The attack vector is described as a nonzero vector with one entry per measurement.Source: §4.2 · p. 6
  • The formulation constrains the residual to evade bad-data detection and limits compromised meters, injection size, and valid measurement ranges.Meter-specific modification bounds and permitted measurement ranges constrain the attack; limiting changes to accessible meters can avoid excessive errors detectable by univariate analysis.Source: §4.2 · p. 6
  • The measurement-change strength is bounded by attacker resources and meter access, allowing resources to be allocated away from high-precision meters.The paper states that this can improve overall attack outcomes while avoiding excessive errors on those meters.Source: §4.2 · p. 6
  • The attack objective is to maximize changes to voltage phase angles, which the paper identifies as consequential and not easily detected.Voltage magnitudes are described as tightly limited, whereas phase angles vary over a larger range.Source: §4.2 · pp. 6–7

5 Attack Methodology

The attack solvers encode measurement perturbations for differential evolution (DE) or SLSQP optimization. DE searches meter choices and injection amounts, while SLSQP searches amounts for specified meters.

5.1 Solving the Proposed Attack with DE

  • DE uses population mutation, crossover, and pairwise selection to search attack vectors while retaining diversity and preferring feasible solutions.Feasible candidates are ranked by objective value; infeasible candidates are compared by constraint violation.Source: §5.1 · pp. 7–8
  • Each DE perturbation pairs a compromised meter index with an injection amount, allowing the search to vary both or fix indices for specified-meter attacks.The encoding also supports parallel computation.Source: §5.1 · p. 7
  • DE prevents duplicate meter indices and clips post-injection readings to each measurement’s permitted range.Indices are sampled without replacement at initialization and filtered during crossover.Source: §5.1 · p. 7

5.2 Solving the Proposed Attack with SLSQP

  • SLSQP represents injection amounts in a meter-dimension vector and constrains selected meters through element-wise bounds.The paper constructs a Lagrangian for the constrained attack optimization.Source: §5.2 · p. 9
  • SLSQP iteratively forms a quadratic-programming subproblem to obtain an update direction, then optimizes a step size along that direction.The search direction uses a BFGS-updated factorization.Source: §5.2 · p. 9

6 Attack Evaluation

The evaluation tests attacks on IEEE 9-, 14-, and 30-bus systems under any-k and specific-k meter access constraints. DE generally outperforms SLSQP in specific-k attacks, while any-k DE attacks often succeed, including across all tested resource and injection combinations on the 14-bus system.

6 Attack Evaluation

  • Experiments covered IEEE 9-, 14-, and 30-bus systems, with 5%, 10%, or 20% of meters compromised and 2%, 5%, or 10% injection levels.Each experiment used 1,000 measurement instances and was repeated 10 times; success thresholds were above 1% or 5% MARE for voltage magnitude or phase angle, respectively.Source: §6 · pp. 9–10, §6.2 · p. 12

6.1 Any k Meter Attack

  • On the 14-bus system, any-k attacks achieved 100% success across tested resource and injection combinations; 10% compromised meters with 10% injection yielded 80% success overall.Success probability and attack impact generally increased with attacker resources.Source: §6.1 · p. 10
  • On the 30-bus system, compromising 10% of meters had greater impact than compromising 20%, whose performance dropped as injection level rose.The authors suggest the larger search space may require more attempts to find a satisfactory solution.Source: §6.1 · pp. 10–11
  • The first seven cumulative meter frequencies in attack vectors identify readings associated with larger state-variable errors, suggesting targets for focused protection.Figure 3 presents cumulative frequencies of meters appearing in attack vectors.Source: Figure 3 · p. 11, §6.1 · p. 11
  • For any-k attacks, the evaluation tracks average function evaluations and execution time while varying population size and iteration count.Table 2 reports average NFEs and execution time.Source: §6.2 · p. 12, Table 2 · p. 12

6.2 Specific k Meter Attack

  • DE generally outperforms SLSQP in specific-k effectiveness; both attacks finish within 3 seconds, though runtime comparison depends on search budgets.DE runtime depends on function evaluations, while SLSQP runtime depends on its maximum iterations.Source: §6.2 · p. 12

7 Conclusions

This first study evaluates adversarial FDI attacks against ANN-based AC state estimation. DE attacks succeed with high probability in the any-k-meter scenario and outperform SLSQP in the specific-k-meter scenario.

7 Conclusions

  • The paper’s first study of adversarial FDI against ANN-based AC state estimation evaluates adapted DE and SLSQP attacks across two scenarios and three test systems.Source: §7 · p. 12
  • In the any-k-meter attack, DE succeeds with high probability even with few compromised meters and a low false-injection level.Source: §7 · p. 13
  • In the specific-k-meter attack, DE outperforms SLSQP on relative error and success probability.Figure 4 presents relative error in its first row and success probability in its second row.Source: §7 · p. 13, Figure 4 · p. 13
Loading 1906.11328v1…