Digital Twin Degradation: Detecting Cyber Physical Attacks via Temporal Inconsistencies

Konstantinos E. Kampourakis; Vasileios Gkioulos; Sokratis Katsikas

Source-linked AI summary

Digital Twin Degradation: Detecting Cyber Physical Attacks via Temporal Inconsistencies

Konstantinos E. Kampourakis, Vasileios Gkioulos, Sokratis Katsikas

arXiv:2608.16159v1Aug 17, 2026cs.CRcs.AIcs.LG

TL;DR

Degraded digital-twin views can create temporal inconsistencies that existing security methods may not interpret reliably. The proposed unsupervised framework models residuals over time and detects sustained deviations, consistently identifying most attacks across three ICS datasets with low false-positive rates and small delays.

Problem
Existing digital-twin security approaches often assume faithful synchronization, while degraded views and scarce attack labels limit temporal inconsistency detection.
Method
The framework trains a predictor on normal behavior, extracts multi-horizon residual features, models normal consistency unsupervised, and detects sustained deviations sequentially.
Results
Across SWaT, HAI, and BATADAL, the framework detects most attack events with low false-positive rates and small delays relative to attack durations.
Takeaways & Limitations
Temporal inconsistencies remain useful security signals under partially degraded observations and can complement traditional intrusion detection systems.
Takeaways & Limitations
Performance depends on representative normal training data, while structural model drift and heterogeneous cyber-physical systems remain insufficiently validated.

Abstract

from arXiv · show

Digital Twins (DTs) are increasingly used to monitor and analyze Cyber Physical Systems (CPS). However, in adversarial environments, the fidelity of a DT cannot be assumed. Communication delays, data manipulation, sensor degradation, or partial information loss may cause the DT state to diverge from the physical process it represents. Such divergence creates temporal inconsistencies that may reveal cyber physical attacks. This paper proposes a detection framework that monitors temporal consistency between the physical system and a potentially degraded DT view. A DT predictor is trained exclusively on normal system behavior to model short-term system dynamics. During operation, discrepancies between predicted and observed states are transformed into multi-horizon temporal features capturing the magnitude, persistence, and evolution of prediction residuals. An unsupervised density model characterizes normal consistency patterns, while a sequential change detection mechanism identifies sustained deviations indicative of attacks. The approach is evaluated on three widely used Industrial Control System (ICS) datasets, SWaT, HAI, and BATADAL, under multiple DT degradation scenarios, including time desynchronization and partial observability loss. Results show that temporal inconsistency patterns enable reliable event-level attack detection with bounded false alarm rates and low detection latency. The proposed method achieves up to 98% detection reliability on SWaT and false alarm rates below 2%. Unlike conventional anomaly detection methods, the proposed framework does not require attack signatures or labeled attack data and remains effective even when the DT view is degraded. These results suggest that DT degradation, often treated as a limitation, can instead serve as a useful signal for cyber physical security monitoring.

1 Introduction

The paper reframes degradation of a Digital Twin (DT) from a limitation into a security signal by detecting sustained temporal inconsistencies between DT predictions and observed physical-system states. It proposes an unsupervised framework using predictive DTs, multi-horizon residual features, density modeling, and sequential change detection, evaluated under realistic degradation scenarios.

Motivation: Digital Twins provide continuous estimates of expected system dynamics and increasingly influence safety- and security-critical decisions in critical infrastructure.
Problem: Communication delays, packet loss, partial observability, sensor faults, and data manipulation can make a DT an unsynchronized or degraded view of the physical system.
Security Signal: Sustained deviations between DT predictions and observed states form structured temporal patterns whose magnitude, persistence, and evolution can reveal cyber–physical attacks.
Method: The proposed framework trains a predictive DT on normal behavior, converts residuals into multi-horizon temporal features, models normal consistency with an unsupervised density model, and applies sequential change detection.
Evaluation: The evaluation uses SWaT, HAI, and BATADAL datasets under time desynchronization and partial information loss, emphasizing event-level detection, latency, and false-alarm behavior.
Result: Temporal inconsistency patterns enable reliable cyber–physical attack detection even when the DT itself is degraded.

2 Related Work

Prior CPS security research spans residual-pattern scoring, DT-driven detection, forecasting-error representations, weakly supervised learning, GANs, and prediction-based residual analysis. The proposed framework instead treats temporal inconsistency between physical observations and a DT reference as a sequential change-detection signal.

Prior anomaly detection: N2RE addresses stealthy anomalies with nearest-neighbor scoring over residual patterns, improving F1 score by approximately 19% across SWaT, WADI, and HAI.The method emphasizes similarity rather than residual magnitude, addressing unreliable threshold-based detection when anomalies resemble normal behavior.
DT-based monitoring: ATTAIN combines a timed-automaton DT, continuous updates, and a GAN detector whose generated labels supervise detection on SWaT, WADI, and BATADAL.It improves F1 score and detection performance over LSTM-CUSUM and MAD-GAN but introduces architectural complexity, modeling dependence, and GAN-related computational overhead.
Prior anomaly detection: SOMAD learns normal forecasting-error patterns with Self-Organizing Maps and identifies anomalies through hypothesis testing on distances to learned normal prototypes.Its structured errors come from sequence models including seq2seq, MDN, and RNN, and it is evaluated on SWaT and HAI.
Prior anomaly detection: Other approaches augment CPS anomaly detection through DT-generated normal data with weak supervision, model multivariate temporal dependencies using GANs, or detect statistical deviations between predicted and observed sensor values.These include clustering and Siamese Autoencoder methods, MAD-GAN with a combined DR-score, and deep prediction models where 1D CNNs outperform LSTMs on SWaT.
Research gap and contribution: Unlike prior methods, the proposed framework makes physical-system–DT temporal inconsistency the core signal and aggregates deviations over time for sequential, event-level detection.This contrasts with approaches centered on data-driven detection, DT-assisted augmentation, static classification, or reconstruction.

3 Problem Formulation & Threat Model

The problem is to detect persistent temporal inconsistencies between predictions from a normal-trained digital twin and observed CPS behavior when the twin may receive delayed or incomplete information. The threat model includes attacks on sensors, actuators, control logic, or communication, while detection prioritizes early alarms, bounded false positives, and robustness to transient degradation.

Problem Formulation: The digital twin fθ(·) is trained exclusively on normal-operation data and compares multi-step predictions with observed measurements to produce residuals.Residuals quantify discrepancies between predicted system evolution and actual behavior.
Threat Model: DT degradation denotes delayed, lost, or incomplete information while the physical process evolves normally, whereas attacks alter physical dynamics, measurements, actuators, or control logic.Attacks and DT degradation may also occur simultaneously, creating inconsistencies from both synchronization errors and adversarial manipulation.
Detection Objective: The detector targets persistent inconsistencies rather than explicitly classifying benign degradation, adversarial manipulation, or their combination.Sequential aggregation separates sustained abnormal deviations from transient inconsistencies caused solely by moderate benign degradation.
Feature Construction: Multi-horizon residual features capture prediction-error persistence, growth across horizons, and temporal variability instead of relying only on instantaneous residual magnitude.Features also include auxiliary indicators such as delay magnitude and invariant violations.
Detection Objective: The objective is early detection of sustained attacks while bounding false alarms and suppressing alarms from transient fluctuations and noise.Unsupervised density-model anomaly scores are processed by sequential change detection to distinguish sustained deviations from isolated outliers.

4 Methodology

The framework detects cyber–physical attacks under degraded Digital Twin conditions by combining a normal-data predictive DT, multi-horizon residual features, unsupervised density modeling, and sequential change detection. It separates modeling, feature extraction, scoring, and decision-making into distinct stages.

Predictive Digital Twin: A sequence-to-one DT predictor is trained exclusively on normal operation data to capture nominal system dynamics for deployment-time reference.The predictor uses a sliding window of length K and minimizes mean squared prediction error.
Temporal Residual Analysis: The DT is rolled forward across multiple horizons, with residuals measuring discrepancies between predicted and observed system states and their accumulation over time.The specified horizons are h ∈ {1, 3, 5, 10}.
Feature Extraction: Residuals are transformed into multi-horizon features covering residual magnitudes, inter-horizon error growth, rolling short-horizon statistics, delays, invariant violations, and degraded-input handling.Missing or invalid features caused by degraded inputs are handled using median imputation.
Anomaly Scoring: An unsupervised density model trained on valid normal feature vectors estimates likelihood and reduces the high-dimensional representation to a univariate anomaly score.Larger anomaly-score values indicate stronger deviation from nominal behavior and preserve sensitivity to distributional changes.
Sequential Decision-Making: Standardized anomaly scores are temporally aggregated with a two-sided CUSUM procedure to identify sustained deviations while limiting noise- or degradation-induced alarms.A hold interval extends alarms, and a cooldown period suppresses immediate retriggering.

5 Experimental Setup

The experiments validate the framework on SWaT, HAI, and BATADAL using a normal-data-only LSTM predictor, controlled DT degradation, multi-horizon residual modeling, GMM scoring, and CUSUM detection. Evaluation uses event-level metrics on clean and degraded views without retraining.

Datasets: Experiments use SWaT, HAI, and BATADAL, covering water treatment, industrial control, and water distribution attack scenarios.SWaT provides synchronized sensor-actuator measurements, HAI contains labeled cyber–physical events, and BATADAL derives from a water distribution simulation.
DT configuration: The DT is a two-layer LSTM with hidden dimension 128 and input window length K = 50, trained with Adam and validation-loss early stopping.Only normal data are used for training; 80% supports DT training and 20% supports validation and detector calibration while preserving temporal order.
DT degradation: Inference degradation introduces delayed observations and intermittent missing data, including a high-severity fixed delay of 10 time steps, while affecting only the DT input.This models communication latency, clock drift, packet loss, or partial observability without altering the physical-system information.
Feature extraction and scoring: Residuals at horizons h ∈{1, 3, 5, 10} form temporal features, with robust median imputation handling missing predictions before four-component diagonal-covariance GMM scoring.The GMM is trained on normal-operation features and computes anomaly scores as negative log-likelihoods.
Sequential detection and evaluation: Standardized scores feed a two-sided CUSUM detector calibrated on normal validation data, with fixed parameters k = 0.05, h = 3.0, hold= 10, and cooldown= 50.The detector is evaluated on clean and degraded DT views without retraining, isolating degradation effects.
Evaluation metrics: Performance is measured with event-level segment detection, event recall, false alarm onset rate, mean detection delay, and Reliability = Recall × (1 −FPR).Event-level evaluation reflects that industrial attacks span intervals and should be detected as events rather than isolated anomalous samples.

6 Results

Across SWaT, HAI, and BATADAL, temporal inconsistency detection provides event-level attack detection under clean and degraded DT views, with dataset-dependent performance and bounded false-positive rates. Sequential aggregation suppresses transient noise while exposing persistent attack deviations, and DT degradation can sometimes improve attack observability.

SWaT results: SWaT achieves perfect event detection under clean and desynchronized DT views, with Recall = 1.00 and detection delays of ∼22 and ∼26 time-steps, respectively.The clean-view FPR remains below 2%, while desynchronization slightly increases delay without changing event detection.
Temporal detection behavior: Sequential detection prevents frequent short-term anomaly-score fluctuations during normal operation from causing persistent alarms, while sustained attack elevations trigger detection.Temporal aggregation across prediction horizons converts persistent structured deviations into consistent divergence signals.
HAI results: HAI detection improves under desynchronization from SegDet = 48/50 and Recall = 0.96 to SegDet = 49/50 and Recall = 0.98.Under clean conditions, FPR is 0.48%, reliability is 0.955, and delay is ∼28 time-steps; desynchronization increases delay to ∼44 time-steps.
BATADAL results: BATADAL detection improves under desynchronization from Recall = 0.40 to SegDet = 4/5 and Recall = 0.80, while FPR rises to 1.67%.Clean conditions detect 2 out of 5 segments with FPR of 0.50% and reliability of 0.396; desynchronized delay is ∼12 time-steps.
Overall findings: Across datasets, event-level metrics show that the framework detects most attack segments while maintaining bounded FPR, with DT degradation not preventing detection and sometimes increasing observability.The results support practical monitoring of DT inconsistencies for industrial cyber–physical security.

7 Discussion

The discussion frames the framework as a complementary, event-level monitoring layer that detects persistent inconsistencies between a physical process and its predictive digital twin. It remains effective under moderate degradation but depends on representative normal data and does not cover full digital-twin compromise or broader degradation types.

Scope and evaluation: The framework targets quick and reliable event-level attack detection rather than precise timestamp labeling of individual abnormal samples.Event detection rates, false alarms, and detection delays are identified as the more meaningful performance measures.
Detection mechanism: CUSUM-based sequential aggregation requires sustained deviations, suppressing transient fluctuations and noise while emphasizing consistent structural changes.The pipeline combines a predictor trained only on normal operation with an unsupervised density model and sequential change detection.
Robustness to degradation: Moderate digital-twin degradation does not prevent detection, and temporal desynchronization can increase the visibility of persistent attack-induced inconsistencies.Benign delays or missing observations tend to create short-lived fluctuations, whereas attacks typically produce structured deviations that persist over time.
Assumptions and scope: The approach assumes attacks may manipulate sensors, actuators, or communication timing and persist for multiple time steps, but excludes simultaneous compromise of the physical process and digital twin.A full digital-twin compromise is outside the scope, and extremely short perturbations may not allow inconsistencies to accumulate.
Limitations: Limitations include predictive rather than causal modeling, dependence on representative normal data, and limited evaluation of degradation beyond temporal desynchronization and partial observability.Structural model drift remains to be studied, and individual alarms have limited interpretability.
Contribution: The method complements rather than replaces traditional intrusion detection by operating directly on system dynamics and physical-process–digital-twin inconsistencies.Its contribution is distinct from protocol analysis, attack signatures, and control-logic semantics.

8 Conclusion

The paper concludes that temporal inconsistencies between physical systems and degraded Digital Twins can provide a practical, unsupervised signal for detecting cyber-physical attacks. Evaluations across three ICS datasets show reliable event detection with low false alarms and short delays, including under moderate degradation.

Conclusion: The framework detects cyber-physical attacks by using prediction residuals and their temporal structure rather than attack signatures, protocol semantics, or supervised learning.A predictive Digital Twin is trained exclusively on normal behavior, and multi-horizon residuals capture inconsistency magnitude, persistence, and evolution.
Conclusion: An unsupervised GMM models temporal features, while a sequential CUSUM detector identifies sustained deviations with controlled false alarm rates.This combination supports detection without labeled attack data and focuses on persistent inconsistencies.
Conclusion: Across SWaT, HAI, and BATADAL, the framework detects most attack events while maintaining low FPR and small delays relative to attack durations.These event-level results support operational monitoring across widely used ICS datasets.
Conclusion: Moderate DT degradation does not prevent detection, and temporal desynchronization can increase the visibility of attack-induced inconsistencies.Imperfect synchronization can therefore remain a useful security signal rather than only a limitation.
Conclusion: Future work will address adaptive degradation modeling, improved interpretability, and evaluation across broader CPS operating conditions.The stated goal is to assess generalization under different system dynamics and conditions.