Technical Summary: Pseudo-Feature Padding for FDIA Defense in Power Grids

1. Problem Statement

Deep Neural Networks (DNNs) are increasingly deployed in Cyber-Physical Systems (CPS), particularly for state estimation in power grids, to detect False Data Injection Attacks (FDIA). However, the unique infrastructure of power grids renders these DNNs vulnerable to sophisticated adversarial perturbations. Traditional defense mechanisms, such as residual-based detectors or standard machine learning classifiers, often fail because FDIA vectors are constructed to satisfy the stealth condition $Ba = 0$ (where $B$ is the projection residual matrix), making polluted measurements indistinguishable from legitimate ones.

Existing defense strategies face significant limitations:

• Adversarial Training and Distillation: These methods often require substantial modifications to the training pipeline or model architecture and can be computationally intensive. They may also perform poorly in CPS settings where attackers prioritize stealth over minimal perturbation size.
• Fixed Padding (e.g., Zero-Padding): While simple, fixed padding strategies are vulnerable in white-box scenarios where attackers are aware of the padding values and can exploit this knowledge to craft transferable attacks.
• Hardware Constraints: Many proposed solutions require sensor redeployment or hardware changes, which are impractical in distributed CPS environments.

The core challenge is to develop a defense that is lightweight, model-agnostic, and capable of disrupting the structural conditions attackers rely on without degrading the performance of the underlying DNN on benign data.

2. Methodology: Pseudo-Feature Padding

The paper proposes a Pseudo-Feature Padding framework. This approach introduces an additional input layer that dynamically augments input samples with "pseudo-features" derived from the statistical distribution of the input data itself.

Core Mechanism

1. Feature Importance Analysis: For each input sample, a tree-based model (e.g., a decision tree) is used to rank feature importance. Features falling below a specific threshold $\theta$ are identified as "less important" (low-saliency).
2. Statistical Distribution Fitting: Statistical distributions are pre-fitted to each feature across the entire dataset.
3. Dynamic Padding Generation:
   • Training: For each sample, pseudo-features are sampled from the fitted distributions corresponding to the identified low-importance features. These are concatenated with the original input, creating multiple augmented variants per sample.
   • Inference: When a sample (clean or adversarial) is presented, a fresh pseudo-feature vector is sampled and concatenated. This ensures the input structure varies unpredictably during inference.
4. Mathematical Disruption:
   • In standard FDIA, the attacker constructs a vector $a$ such that $Ba = 0$, where $B = P - I$ and $P$ is the projection matrix onto the column space of the system Jacobian $H$.
   • The proposed padding transforms the system matrix to $H' = [H | P_{pad}]$, where $P_{pad}$ contains the sampled pseudo-features.
   • This changes the projection matrix to $P'$ and the residual matrix to $B'$. Consequently, the null space structure changes ($N(B) \neq N(B')$). An attack vector $a$ designed to satisfy $Ba=0$ will generally fail to satisfy $B'a'=0$ because the padded features introduce structural uncertainty and shift the null space.
   • Since pseudo-features are randomly sampled at inference, reconstructing the effective system matrix $H'$ is computationally infeasible for an attacker, rendering crafted perturbations non-transferable.

Algorithm Overview

The framework operates as a preprocessing step:

1. Identify low-importance features for a specific sample.
2. Sample synthetic values from the pre-fitted distributions of these features.
3. Concatenate these values to the original input vector.
4. Feed the augmented vector into the existing DNN architecture.

3. Key Contributions

The paper outlines the following primary contributions:

• Novel Defense Strategy: A method that mitigates FDIA effects by padding inputs with pseudo-features, increasing input dimensionality and complicating the generation of accurate attack vectors.
• Model Agnosticism and Deployability: The framework is lightweight and requires no modifications to the core DNN architecture, facilitating easy integration into existing CPS detection pipelines.
• No Hardware Overhead: The solution addresses the impracticality of securing all physical sensors by operating purely on the data processing layer, requiring no sensor redeployment.
• Performance Preservation: The method maintains the performance integrity of the DNN with negligible accuracy drop compared to baseline models.
• Comprehensive Validation: The framework is validated through simulations on four standard IEEE test systems (14-bus, 30-bus, 118-bus, and 300-bus) under adversarial settings.

4. Experimental Results

The framework was evaluated using a feed-forward DNN (four fully connected layers) on datasets generated via MATPOWER. The evaluation compared the proposed method against Plain DNNs, Adversarial Training, Adversarial Distillation, and Zero-Padding.

• Detection Accuracy: The proposed Pseudo-Feature Padding achieved significantly higher attack detection accuracy compared to baseline and other defense methods. For instance, on the 14-bus system, it achieved 94.2% accuracy, outperforming Adversarial Training (62.0%) and Zero Padding (93.5%). Similar high performance was observed across 30, 118, and 300-bus systems (ranging from 92.0% to 96.1%).
• Robustness Metrics:
  • Bias L2-Norm: The proposed method resulted in higher Bias L2-Norm values (e.g., 168.7 for 14-bus vs. 50.6 for Adversarial Training), indicating that the model successfully detected larger deviations caused by attacks.
  • Valid L2-Norm: The method yielded lower Valid L2-Norm values (e.g., 55.1 for 14-bus vs. 113.7 for Adversarial Training), suggesting that the effective strength of the adversarial perturbations was neutralized.
• Scalability: Performance improved or remained stable as the system size increased (from 14-bus to 300-bus), demonstrating the framework's scalability.
• Computational Overhead: While training time increased slightly due to the feature generation and padding steps (35s vs. 10s for Plain DNN), the inference cost remained low (0.9ms), and the overall overhead was classified as "Low-Mod," significantly better than the "High" overhead of Adversarial Training.

5. Significance and Claims

The paper claims that Pseudo-Feature Padding offers a practical and effective defense solution for real-world CPS applications where physical sensor security is infeasible.

• Disruption of Attack Mechanics: By introducing randomized, data-aware padding, the method breaks the attacker's ability to maintain the stealth condition ($Ba=0$) without needing to know the specific padding values in advance.
• Mitigation of Transferability: The non-deterministic nature of the padding at inference prevents adversarial examples crafted for one model instance from transferring effectively to another, a common weakness in white-box attacks.
• Practicality: Unlike methods requiring hardware changes or complex architectural retraining, this approach is a lightweight preprocessing step that preserves the original model's structure.
• Limitations: The authors acknowledge that the current work focuses on white-box threats where the attacker knows the model but not the padding. Adaptive and partial-information attacks are noted as areas for future work, though the non-deterministic padding is expected to provide robustness against them.

In conclusion, the paper demonstrates that augmenting input data with statistically derived pseudo-features is a viable strategy to enhance the robustness of DNNs against FDIA in power grids, offering a balance between high detection accuracy, low computational cost, and ease of deployment.