PaperlayerView exact revision on arXiv

Source-linked AI summary

TwinGridShield: Consequence-Aware Runtime Authorization for LLM Grid-Agent Actions

Md Fazley Rafy

arXiv:2608.15391v1cs.AIcs.CR

TL;DR

LLM grid agents can issue syntactically valid commands that violate physical constraints. TwinGridShield authorizes typed actions through a deterministic network twin and invariant checker, while the study measured 84.2% unsafe execution under direct execution across 500 attacked trials.

  • Problem

    LLM-generated grid commands can be syntactically valid while violating topology, branch-flow, generator, or load-shedding constraints.

  • Method

    TwinGridShield uses a deterministic network twin and explicit operating invariants to evaluate typed grid actions before release.

  • Results

    84.2% unsafe execution occurred under direct execution across 500 attacked trials, demonstrating that schema-valid commands can still violate physical constraints.

  • Takeaways & Limitations

    Consequence validity requires evaluating proposed actions against network-state constraints rather than relying on typed tool access or text-level filtering.

  • Takeaways & Limitations

    The evaluation is limited to single-step actions on an IEEE 14-bus DC formulation and does not assess AC, dynamic-security, cascading, stale-topology, or multi-step behavior.

Abstract

from arXiv · show

Large language model (LLM)-assisted energy-management tools can translate natural-language context into structured grid commands, but syntactic validity does not imply physical admissibility. This paper presents TwinGridShield, a model-independent runtime authorization layer that evaluates each proposed action in a deterministic network twin before release. The prototype checks connectivity, branch-flow, generator, and load-shedding invariants and records each decision in a hash-chained log. A controlled IEEE 14-bus study evaluates single-step switching, redispatch, and load-shedding actions using DC power flow and experimentally assigned branch ratings. In the matched-model experiment, a stochastic proposal source configured to select an unsafe action with probability p=0.84 produced 421 unsafe proposals in 500 attacked-condition trials, a realized rate of 84.2%. This value characterizes the configured surrogate and is not an empirical measurement of LLM prompt-injection susceptibility. TwinGridShield produced 0 unsafe releases in those 500 trials. Because action labeling and authorization used the same DC model, system state, branch ratings, and encoded constraints, this result verifies conformance of the implementation to its encoded authorization predicate rather than safety under model error. The principal robustness evaluation therefore introduces model mismatch. Unsafe acceptance reached 5.63% under bounded +20% and -20% per-bus load-measurement error and 30.09% when actual branch ratings were 20% below modeled ratings.

ORCID: 0000-0003-3057-9546

LLM agents can turn incorrect answers into actions against cyber-physical infrastructure. Correctly typed grid commands may still miss network-physics and operational consequences such as islanding, thermal limits, generator limits, or critical-service impacts.

  • Failure boundary: LLM-agent errors can become actions against cyber-physical infrastructure, creating a failure boundary beyond incorrect text.The passage frames this risk as a consequence of translating model outputs into grid actions.
  • Failure boundary: Token prediction is not a certified model of network physics, so syntactically valid commands can remain physically inadmissible.The passage identifies this gap as one of two weaknesses meeting at the action boundary.
  • Failure boundary: Action blindness includes missing islanding, thermal-limit, generator-limit, or critical-service consequences in branch-opening, redispatch, and load-shedding commands.The passage names these command types and consequences as a concrete characterization of action blindness.

I. INTRODUCTION

LLM assistants are increasingly being used to formulate and execute power-system tool actions, creating a gap between syntactic proposals and consequence-aware safety. TwinGridShield addresses this gap through formalized action blindness, deterministic authorization, and controlled IEEE 14-bus evaluation.

  • Motivation: LLM assistants are moving from explaining operating procedures toward calling EMS and other power-system software tools.Examples include querying an EMS, summarizing alarms, formulating redispatch, and preparing switching requests.
  • Core framing: TwinGridShield formalizes action blindness as a mismatch between a proposed structured action and a consequence-closed safe set.This formalization frames authorization around the action’s operational consequences rather than proposal syntax alone.
  • Contributions: TwinGridShield combines typed commands, a deterministic network twin, explicit operating invariants, fail-closed enforcement, escalation, and a tamper-evident decision chain.The paper evaluates these mechanisms in a controlled IEEE 14-bus authorization study using a configured stochastic proposal source and matched-model conformance testing.

II. RELATED WORK AND RESEARCH GAP

Prior work advances LLM agents for power-system operation and develops text-level, sandbox, policy, and safe-learning defenses, but does not provide a deterministic runtime gate for physical admissibility. TwinGridShield addresses this gap by authorizing structured actions through modeled grid consequences, complementing injection-focused defenses.

  • Research gap: LLM power-system agents have progressed from advisory Q&A to tool-mediated dispatch, violation remediation, and multifidelity simulation support, without an explicit deterministic physical-consequence gate.This identifies the central research gap in the surveyed work.
  • Existing defenses: Text-level defenses detect direct or indirect instruction attacks, while ToolEmu evaluates risky tool use in an LM-emulated sandbox without exposing a real environment.These approaches address adversarial instructions or red-team evaluation rather than certification of physical grid admissibility.
  • Existing defenses: Runtime enforcement and safe-learning shields constrain policy traces or intervene before environmental interaction, while power-system security research couples cyber actions with physical state.These foundations motivate separating probabilistic action proposal from deterministic consequence authorization.
  • TwinGridShield’s distinction: Physical consequence checking evaluates the post-action network state, so unsafe commands can be rejected despite obfuscated, retrieved, or marker-free inducing prompts.Consequence monitoring and text-level defenses answer complementary assurance questions; neither substitutes for the other.

III. THREAT MODELING & CONSEQUENCE-AWARE RUNTIME ENFORCEMENT

TwinGridShield separates syntactic command formation from consequence-based authorization in a deterministic network twin. Commands are released only when the predicted post-action state satisfies the encoded invariant set; otherwise they become no-ops with violations reported and escalation available.

  • Architecture: The control loop uses an LLM agent, tool broker, runtime monitor, deterministic network twin, and downstream control API for pre-release consequence evaluation.The twin represents the current estimated grid state, including topology, load, generation, and equipment limits, rather than forecasting or adaptive control.
  • Threat model and enforcement: Command formation enforces a closed vocabulary, target identifiers, numeric ranges, and required fields, but syntactic validity does not establish physical admissibility.The authorization stage evaluates consequences such as islanding, overloads, generator-limit violations, and excessive load shedding.
  • Authorization predicate: The modeled safe set requires connectivity and solvability, branch-flow limits, generator bounds, and total and critical-load shedding limits.The monitor implements release through G(•), with the safe set defined by the encoded constraints.
  • Authorization predicate: Only G(xt, at) = 1 releases a command; G(xt, at) = 0 produces a no-op, machine-readable invariant violations, and escalation.The encoded-invariant guarantee assumes every actuator request passes through G(·), the actuator executes only released commands, and the twin exactly predicts the constrained state variables.
  • Threat model and enforcement: Authorization depends on predicted physical consequences rather than string patterns or prompt sources, while exact twin-state prediction is required for the no-violation guarantee.This makes the guarantee conditional on the model assumptions and distinguishes consequence gating from text filtering.
  • Auditability: Hash-chained records support auditability and incident reconstruction, while physical release remains governed by the authorization rule.Changing an interior record alters every subsequent digest after the next trusted checkpoint.

IV. EXPERIMENTAL METHOD

The evaluation uses randomized IEEE 14-bus DC power-flow scenarios with synthetic branch-rating thresholds and a reproducible stochastic threat surrogate. A separate mismatch study measures authorization error when actual loads or branch ratings differ from the guard’s nominal model.

  • Main experiment: 1,000 seeded trials comprise 500 benign and 500 attacked IEEE 14-bus scenarios, with randomized total and selected-bus loads.The system has 14 buses, five generators, and 20 branches.
  • Network model: Synthetic branch ratings set each threshold to max(1.35|f_0k|, 25 MW), creating active constraints for policy comparison.The assigned limits are stress-test thresholds requiring validation against utility transmission-system equipment ratings.
  • Main experiment: 0.84 is the surrogate’s unsafe-action probability under attack, versus 0.06 under benign conditions.These fixed proposal distributions make the authorization experiment reproducible and independent of version-specific LLM behavior.
  • Parameter mismatch: δ ∈ 0, 5, 10, 20% defines mismatch levels in a separate experiment using 1,000 independent proposals.The guard retains its nominal DC model while the evaluation oracle uses perturbed states or limits.
  • Parameter mismatch: 954 load-error trials and 841 rating-error trials remain at 20% mismatch after excluding already-unsafe perturbed states.Conditional unsafe acceptance measures oracle-unsafe actions allowed by the nominal guard; conditional false block measures oracle-safe actions rejected.

V. RESULTS AND ANALYSIS

Typed tool access and schema validation do not ensure physical safety: schema-valid adversarial commands achieved an 84.2% unsafe-proposal execution rate. A text filter reduced this rate to 42.0%, but obfuscated and retrieved-procedure injections remained schema-valid and passed the filter.

  • 84.2% unsafe-proposal execution occurred under both direct execution and schema validation because adversarial commands were intentionally schema-valid.Across 500 attacked trials, this represented 421 unsafe executions, with a 95% Wilson interval of 80.74–87.13%.
  • Syntactic validity did not ensure consequence validity, because valid tool fields could still violate branch, generator, topology, or load-shedding constraints.
  • 42.0% unsafe-proposal execution remained after the text filter blocked explicit and role-play injection strings containing visible markers.Obfuscated and retrieved-procedure injections remained schema-valid and passed the filter, as shown in Fig. 2.

A. Sensitivity to Model Mismatch

Model mismatch causes residual unsafe authorization, with underestimated actual branch ratings producing higher unsafe-acceptance rates than bounded load-measurement error at equivalent mismatch levels.

  • A. Sensitivity to Model Mismatch: 30.09% unsafe acceptance occurred when actual branch ratings were 20% below modeled ratings, compared with 5.63% under 20% per-bus load-measurement error.At 5% and 10% mismatch, unsafe acceptance was 10.24% and 16.85% for branch-rating mismatch, versus 1.94% and 4.02% for load-measurement error.

VI. LIMITATION AND PATH FORWARD

The evaluation is a consequence-aware runtime authorization study, not an empirical measurement of LLM prompt-injection susceptibility. Its benchmark is limited to single-step actions on an IEEE 14-bus DC formulation and motivates broader future testing.

  • Interpretation of results: The 84.2% unsafe-proposal rate characterizes a configured stochastic surrogate’s fixed experimental distribution, not attack success for a deployed LLM.The proposal source is a configured stochastic surrogate.
  • Current scope: The benchmark covers single-step actions using an IEEE 14-bus DC formulation with experimentally assigned branch ratings.The present scope is limited to this formulation and action setting.
  • Current scope: The study does not evaluate AC voltage constraints, reactive-power limits, dynamic-security behavior, cascading effects, stale topology, or multi-step adversarial command sequences.These omissions define the boundary of the current benchmark.
  • Path forward: Future evaluation should use version-pinned LLM agents, a fixed prompt-injection corpus, AC contingency analysis, and hardware-in-the-loop testing.These directions are motivated by the benchmark’s stated limitations.

VII. CONCLUSION

TwinGridShield separates language-based command proposal from physics-based command release through a deterministic network twin and invariant checker. Future work will extend the baseline to richer power-system constraints, security analyses, and temporal policies.

  • Conclusion: TwinGridShield separates typed LLM action proposals from physics-based release decisions made by a deterministic network twin and invariant checker.The checker determines whether an action reaches the control API.
  • Conclusion: Future work will add version-specific LLM-generated actions, a fixed prompt-injection corpus, AC power flow, voltage and reactive-power constraints, and dynamic-security assessment.Planned extensions also include contingency analysis and multi-action temporal policies.
Loading 2608.15391v1…