{"ID":3083620,"CreatedAt":"2026-06-05T06:46:15.197025399Z","UpdatedAt":"2026-06-07T06:54:00.442624098Z","DeletedAt":null,"paper_url":"https://arxiv.org/abs/2606.06347","arxiv_id":"2606.06347","title":"Attack Detection using Time Series Foundation Models","abstract":"This paper addresses the problem of attack detection in cyber-physical systems without any knowledge of the plant model or its structure. A remotely located plant transmits sensor measurements to an operator over a network that is assumed to be under attack. We consider two classes of attacks: model-free replay attacks and model-based stealthy attacks. For the latter, we derive closed-form expressions for the optimal stealthy attack policy against a $χ^2$ detector, for both linear and nonlinear systems. We then propose a model-structure-free detector based on TimesFM, a time-series foundation model developed by Google Research, which serves as a surrogate residual generator operating in a zero-shot fashion. We show empirically that the TimesFM-based detector achieves a comparable or superior attack detection performance. The efficacy of the proposed approach is demonstrated numerically on the IEEE 14-bus power system. We also demonstrate that TimesFM predictions can serve as a substitute for corrupted measurements, a practical mitigation technique when classical redundancy assumptions fail.","short_abstract":"This paper addresses the problem of attack detection in cyber-physical systems without any knowledge of the plant model or its structure. A remotely located plant transmits sensor measurements to an operator over a network that is assumed to be under attack. We consider two classes of attacks: model-free replay attacks...","url_abs":"https://arxiv.org/abs/2606.06347","url_pdf":"https://arxiv.org/pdf/2606.06347v1","authors":"[\"Sribalaji C. Anand\",\"Anh Tung Nguyen\",\"George J. Pappas\"]","published":"2026-06-04T16:19:24Z","proceeding":"eess.SY","tasks":"[\"eess.SY\",\"cs.LG\"]","methods":"[]","has_code":false}