PaperlayerView exact revision on arXiv

Source-linked AI summary

Robust Industrial Cyber Physical Classification Using Neuromorphic Temporal Embeddings and Hybrid SNN XGBoost Under Machine Unlearning Attacks

Ammar Kamoona, Sajad Koushkbaghi, Mahdi Jalili, Peter McTaggart, Xinghuo Yu

arXiv:2609.09564v1cs.LGcs.CRcs.NE

TL;DR

Power-grid IDSs must detect and classify attacks efficiently despite computational constraints and vulnerability to poisoning during periodic retraining. The paper uses a frozen SNN temporal feature extractor with a periodically retrained XGBoost classifier, achieving strong detection and delayed target-class collapse under label poisoning. The evaluation supports improved resilience, while the authors identify assumptions and scope boundaries including secured initial training data, extreme-poisoning collapse, and single-dataset unlearning evaluation.

  • Problem

    Power-grid IDSs need accurate, low-overhead attack classification, while periodic retraining exposes conventional systems to machine-unlearning attacks that can degrade targeted-class detection.

  • Method

    A Direct-SNN with LIF neurons is trained once on verified clean data to produce fixed temporal embeddings, while XGBoost is periodically retrained as the only adaptive component.

  • Results

    The hybrid achieves 99.9% accuracy on Synchrophasor and 95.0% on MSU/ORNL, while losing only 0.9% F1-macro at 10% label poisoning and delaying target-class collapse from 60% to 70%.

  • Takeaways & Limitations

    Separating physics-grounded temporal feature extraction from classifier updates provides improved resilience to label poisoning within the evaluated power-grid intrusion-detection setting.

  • Takeaways & Limitations

    The defence assumes verified, secured initial training data; all models collapse at poisoning levels ≥70%, and unlearning robustness was evaluated on a single dataset.

Abstract

from arXiv · show

The digitalisation of electrical distribution networks has increased the exposure of power-grid infrastructure to cyber attacks. Existing intrusion detection systems (IDSs), however, often rely on computationally expensive deep learning models that are difficult to deploy at the edge. Periodic retraining also exposes these systems to machine unlearning attacks, where selective data removal can degrade detection performance. We propose a hybrid Spiking Neural Network (SNN) and XGBoost architecture that combines efficient temporal encoding with a lightweight classifier and provides structural resilience to such attacks. The SNN is trained once on clean data and used as a fixed feature extractor, while only the XGBoost classifier is retrained during model updates. Evaluated on two real-world public power-system datasets, the proposed method achieves 99.9\% accuracy (F1-macro 0.999) on the Synchrophasor dataset and 95.0\% accuracy (F1-macro 0.943) on the MSU/ORNL dataset, outperforming standalone baselines. Under selective label-flipping attacks, the hybrid model loses only 0.9\% F1-macro at 10\% poisoning and delays target-class collapse from 60\% to 70\% poisoning compared with raw models. These results demonstrate that neuromorphic temporal encoding can provide both accurate cyber-attack detection and improved resilience to data poisoning in cyber-physical systems.

I. INTRODUCTION

Power-grid cyber-physical systems need accurate, low-overhead attack classification across heterogeneous data, yet existing approaches face computational, adaptability, and poisoning-resilience challenges. The paper addresses these challenges with a hybrid SNN–XGBoost design that separates fixed temporal representation learning from classifier updates.

  • Motivation: Accurate power-grid intrusion detection must classify diverse attacks while operating with low latency and limited computational overhead near physical infrastructure.Practical systems may also need to process both continuous electrical measurements and structured communication traffic.
  • Prior approaches: Existing detection methods include rule-based, model-based, and data-driven approaches, with deep learning offering learned attack representations but requiring substantial computation and memory.The supplied passages describe conventional deep-learning architectures including convolutional, recurrent, and graph neural networks.
  • Research gap: SNNs offer event-driven, sparse, temporally dynamic processing for intrusion detection, but prior work has emphasized detection or efficiency rather than resilience to learned-data manipulation.Prior SNN studies cited in the passages include dynamic FDI detection and network intrusion detection.
  • Proposed approach: The proposed architecture uses a Direct-SNN with LIF neurons to generate temporal membrane-potential embeddings, while XGBoost is periodically retrained on those fixed representations.The SNN is trained once on verified clean data and then frozen, separating representation learning from classifier adaptation.
  • Results: 99.9% accuracy and F1-macro 0.999 are achieved on the Synchrophasor dataset, while 95.0% accuracy and F1-macro 0.943 are achieved on MSU/ORNL, outperforming standalone baselines.The contribution passage reports both dataset-level results and comparisons against standalone models.

C. Adversarial Robustness of IDS

The paper frames adversarial robustness as a training-time problem distinct from inference-time evasion and uses SNN membrane dynamics to encode label-independent physical structure. Its LIF recurrence integrates decayed temporal state, input current, and threshold-triggered spikes.

  • Threat model: Inference-time adversarial-robustness methods do not address training-time poisoning, which directly targets the data used to update an IDS.The supplied passage distinguishes evasion attacks from manipulation of training data.
  • Robustness mechanism: SNN membrane dynamics provide structural robustness by encoding physical signal properties that are independent of labels.The paper extends the use of model structure for robustness to neuromorphic architectures.
  • Research gap: The paper combines neuromorphic temporal features with explicit training-data-manipulation evaluation, unlike the cited prior SNN and machine-unlearning approaches.The comparison identifies separated feature extraction as a distinguishing design element.
  • LIF model: The LIF membrane potential combines decayed prior state, weighted input current, and a reset term tied to the previous spike and firing threshold.The recurrence uses β for decay, W for synaptic weights, I[t] for input current, S[t−1] for the prior spike, and Uthr for threshold.
  • LIF model: β = 0.85 balances temporal integration and responsiveness for the framework’s 15-timestep window.Values near 1 retain information longer, whereas smaller values respond faster and forget prior evidence sooner.

B. Surrogate Gradient Learning

The method uses surrogate gradients to train spiking neurons through time while separating a frozen feature extractor from a retrainable classifier for poisoning resilience.

  • B. Surrogate Gradient Learning: Surrogate gradients replace the zero-gradient Heaviside derivative during backpropagation while retaining discrete spikes in the forward pass.This enables Backpropagation Through Time across all timesteps.
  • B. Surrogate Gradient Learning: The attack randomly replaces selected target-class labels with labels from other classes, then retrains the IDS on the corrupted dataset.The attack succeeds when target-class recall drops significantly while other metrics remain reasonable.
  • B. Surrogate Gradient Learning: End-to-end training propagates corrupted labels into both feature representations and classifier decision boundaries, distorting embedding-space geometry.The proposed decomposition prevents later classifier retraining from altering the frozen embedding geometry.
  • B. Surrogate Gradient Learning: The architecture trains the SNN once on verified clean data, freezes it, and periodically retrains only the XGBoost classifier.The classifier operates on 1,350-dimensional SNN embeddings and is the only component exposed to potentially corrupted labels.
  • B. Surrogate Gradient Learning: The architecture is presented as a hybrid SNN+XGBoost design for machine-unlearning resilience, combining a fixed neuromorphic frontend with an adaptable classifier.The comparison table identifies the work as combining neuromorphic temporal features with explicit machine-unlearning robustness evaluation.

A. Data Preprocessing Pipeline

The preprocessing pipeline reduces PMU dimensionality, normalizes features, and constructs overlapping temporal windows while preserving information needed for membrane integration.

  • A. Data Preprocessing Pipeline: The preprocessing design reduces dimensionality while preserving temporal structure required for SNN membrane integration.The selected representation feeds a temporally organized input into the neuromorphic model.
  • A. Data Preprocessing Pipeline: Features are min-max normalized to [0, 1] using training-set statistics, with the same transformation applied to validation and test data.The normalization uses ϵ = 10^-8 to prevent division by zero for constant features.
  • A. Data Preprocessing Pipeline: 128 raw PMU features are reduced to 50 selected features using mutual information before temporal window construction.Mutual information is preferred because it captures nonlinear feature-class dependencies while preserving individual feature identities.
  • A. Data Preprocessing Pipeline: Each sample is represented as a stride-1 window of T = 15 consecutive timesteps, preserving temporal structure across the window axis.The window contains 15 × 50 = 750 values per sample.
  • A. Data Preprocessing Pipeline: The T = 15 window spans approximately 2.4 membrane time constants when β = 0.85, capturing transient onset and sustained-state behavior.The effective time constant is approximately 6.1 timesteps.

B. Direct-SNN Architecture

The Direct-SNN architecture injects normalized features directly as continuous currents into LIF neurons, avoiding an intermediate spike-encoding step.

  • B. Direct-SNN Architecture: Direct-SNN treats each timestep of a sliding window as a distinct continuous input current to LIF neurons.The input is X_win ∈ R^T×d rather than a spike-encoded representation.
  • B. Direct-SNN Architecture: The design avoids rate, latency, and delta spike encoding because those schemes are described as introducing an information bottleneck for flat power-system features.The paper states that direct injection preserves continuous feature information for the ablation study.
  • B. Direct-SNN Architecture: The SNN uses membrane dynamics to integrate the continuous currents across the temporal window.This integration supplies the temporal processing mechanism for the architecture.
  • B. Direct-SNN Architecture: The proposed Direct-SNN is designed specifically for power-grid intrusion detection using genuine time-varying input.The architecture receives sliding windows rather than static feature vectors.

C. Temporal Membrane Embedding Extraction

The model extracts membrane-potential trajectories from the SNN, concatenates layer-level features into fixed embeddings, and supplies them to a periodically retrained XGBoost classifier.

  • C. Temporal Membrane Embedding Extraction: Membrane trajectories are recorded for each hidden layer and combined into a full embedding.The resulting embedding summarizes temporal responses across the SNN layers.
  • C. Temporal Membrane Embedding Extraction: The [256, 128, 64] SNN architecture with C = 3 output classes produces a 1,350-dimensional embedding.The embedding is formed from the extracted layer features.
  • C. Temporal Membrane Embedding Extraction: XGBoost is selected to handle high-dimensional structured embeddings, provide feature-importance rankings, and support lightweight retraining.The classifier is described as computationally lightweight for periodic updates.
  • C. Temporal Membrane Embedding Extraction: XGBoost receives each 1,350-dimensional embedding as input and the potentially corrupted label as its training target.Each tree split operates on one embedding dimension.
  • C. Temporal Membrane Embedding Extraction: The deployment procedure trains the SNN once on clean data, freezes and signs its parameters, then repeatedly retrains XGBoost on newly extracted embeddings.The SNN remains fixed while updated classifiers are deployed after each retraining cycle.
  • C. Temporal Membrane Embedding Extraction: Embedding dimensions represent physically meaningful responses to temporal patterns, giving individual tree splits a physical interpretation.The representation is tied to membrane responses of specific neurons.

E. Why Temporal Embeddings Resist Label Poisoning

Temporal embeddings resist label poisoning because they encode signal dynamics independently of corrupted labels, while structured representations make classifier boundaries less sensitive to mislabeled points.

  • Physics-grounded clustering: Physics-grounded membrane trajectories distinguish attack transients from natural disturbances through their temporal signal characteristics.Examples include voltage drops, frequency excursions, and anomalous phase angles.
  • Label-independent feature extraction: Frozen SNN embeddings remain unchanged during retraining, so label corruption shifts only XGBoost decision boundaries.This differs from end-to-end models, where corruption affects both representations and classifiers.
  • Structured embedding space: Structured 1,350-dimensional embeddings provide temporal derivative-like, sustained-activity, and integration features for XGBoost tree splits.These representations are described as less susceptible to individual mislabeled points shifting decision boundaries than raw flattened features.
  • Evaluation setting: The evaluation uses real public power-grid datasets containing measurements from actual equipment, including Synchrophasor and MSU/ORNL PMU data.

B. Baselines and metrics

The study compares the hybrid framework with neural, tree-based, and rule-based baselines using accuracy, class-balanced F1, MCC, and per-class precision and recall.

  • Baselines: Seven baselines span deep learning, tree ensembles, and rule-based detection, including MLP, LSTM, 1D-CNN, GNN, Random Forest, XGBoost, and a rule-based detector.
  • Metrics: Four reported metrics are overall accuracy, F1-macro, Matthews Correlation Coefficient, and per-class precision and recall.Parameter count is also reported as a proxy for neuromorphic deployability.
  • Metrics: F1-macro weights all classes equally regardless of class support.Per-class F1 is the harmonic mean of precision and recall.
  • Metrics: MCC provides a balanced, correlation-based measure that remains informative under class imbalance and reaches +1 for perfect classification.Its multiclass definition uses correct predictions, true-class counts, and predicted-class counts.

C. Implementation details

The implementation normalizes inputs, uses sliding windows and dataset-specific feature selection, then evaluates a fixed SNN architecture and hybrid classifier on clean data across two datasets.

  • Preprocessing: Preprocessing applies Min-Max normalization, reduces MSU/ORNL features from 128 to 50, and constructs sliding windows of T = 15 samples.Baseline experiments use a 70/15/15 split, while unlearning experiments use 70/30 with fixed random seeds.
  • SNN architecture: The Direct-SNN uses [256, 128, 64] LIF layers, 15 simulation timesteps, dropout p = 0.2, and 44,803 total parameters.Training uses surrogate-gradient BPTT with balanced class weights.
  • Clean-data results: Table VII compares hybrid SNN+XGBoost performance with standalone SNN and tree models across two real public power-grid datasets.
  • Clean-data results: The hybrid achieves 99.9% accuracy on Synchrophasor and 95.0% on MSU/ORNL.These correspond to improvements of +4.2% and +4.9% over raw XGBoost, respectively.

MSU/ORNL (128 feat.)

On the MSU/ORNL dataset, the hybrid SNN+XGBoost combines temporal embeddings with tree-based classification and maintains stronger detection under label poisoning than raw-feature baselines.

  • The hybrid uses 1,350-dimensional SNN embeddings, whereas raw XGBoost and Random Forest use 750-dimensional flattened window features.
  • At 10% attack, the hybrid maintains target-class F1 of 0.954, compared with 0.938 for raw XGBoost and 0.900 for Random Forest.The hybrid’s baseline target-class F1 is 0.959, corresponding to 0.5% degradation.
  • Target-class F1 remains above 0.5 until 70% poisoning for the hybrid, compared with 60% for both raw models.The collapse threshold is defined as the attack percentage where target-class F1 drops below 0.5.
  • Across 0%–70% attack, the hybrid achieves the highest target-class F1 and recall, with the advantage most pronounced at 20%–50% poisoning.
  • The SNN embeddings encode temporal voltage and current structure that is determined by physical measurements rather than corrupted labels.Consequently, label poisoning does not change the frozen embeddings.

C. Ablation Study: The Encoding Bottleneck

The ablation study identifies a structural encoding bottleneck: spike-encoded variants reach the same 70.53% ceiling because repeated snapshots provide no temporal variation for the SNN to process.

  • The ablation compares rate, latency, delta-modulation, temporal-contrast, and burst encoding methods across baseline architectures.
  • 70.53% accuracy is shared across five configurations varying architecture, capacity, encoding, decay, and threshold.The configurations span 9,734–43,911 parameters, rate-to-latency encoding, decay 0.85–0.95, and threshold 0.8–1.0.
  • Repeating one measurement snapshot across T = 25 timesteps gives the SNN statistically identical input frames.
  • Because the repeated input contains no temporal structure, the SNN cannot learn temporal patterns regardless of parameters or recurrent connections.

D. Computational cost and deployability

The hybrid is designed for edge deployment: its one-time SNN training is followed by rapid XGBoost updates, low CPU inference latency, and a 140 MB footprint, while limitations remain under extreme poisoning and limited evaluation scope.

  • 8.4 minutes of CPU training is required for one-time SNN commissioning on verified clean data.This is comparable to LSTM at 12.1 minutes and 1D-CNN at 5.8 minutes.
  • 4.7-second XGBoost retraining updates only the classifier, compared with 3–12 minutes for retraining an entire deep-learning pipeline.The separation avoids the stale-model or unavailable-system interval during full retraining.
  • The hybrid’s total inference latency is 0.45 ms per sample on CPU, operating at approximately 74× real-time at a 30 Hz PMU reporting rate.SNN embedding extraction accounts for 0.42 ms and XGBoost classification for 0.03 ms.
  • The complete pipeline requires 140 MB of memory, including 95 MB for the frozen SNN and 45 MB for XGBoost.
  • Embedding extraction scales linearly with sample count, while XGBoost training scales as O(N · d · K · log N).For 78,377 samples, embedding extraction takes 32.9 seconds and XGBoost training remains under 5 seconds.
  • The defence assumes verified, secured initial clean data, and all models collapse at poisoning levels ≥70%; evaluation also uses one dataset for unlearning experiments.
Loading 2609.09564v1…