Joint Sensor Deployment and Physics-Informed Graph Transformer for Smart Grid Attack Detection

Mariam Elnour; Mohammad AlShaikh Saleh; Rachad Atat; Xiang Huo; Abdulrahman Takiddin; Muhammad Ismail; Hasan Kurban; Katherine R. Davis

cs.NEFeb 16, 2026

Joint Sensor Deployment and Physics-Informed Graph Transformer for Smart Grid Attack Detection

Authors: Mariam Elnour, Mohammad AlShaikh Saleh, Rachad Atat, Xiang Huo, Abdulrahman Takiddin, Muhammad Ismail, Hasan Kurban, Katherine R. Davis, +1 more

Organizations: department of Electrical and Computer Engineering, Texas A&M University, College Station, TX 77840, USA · department of Electrical and Computer Engineering, Texas A&M University at Qatar, Doha, Qatar · department of Computer Science and Mathematics, Lebanese American University, Beirut 1102-2801, Lebanon · department of Electrical and Computer Engineering, Hampton University, 100 E Queen St, Hampton, VA 23669, USA · department of Electrical and Computer Engineering, FAMU-FSU College of Engineering, Florida State University, 2525 Pottsdamer Street. Tallahassee, FL 32310-6046, USA · Cybersecurity Education, Research, and Outreach Center (CEROC) and the department of Computer Science, Tennessee Tech University, Cookeville, TN, USA · College of Science and Engineering, Hamad Bin Khalifa University, Doha 34110, Qatar

Abstract

This paper proposes a joint multi-objective optimization framework for strategic sensor placement in power systems to enhance attack detection. A novel physics-informed graph transformer network (PIGTN)-based detection model is proposed. Non-dominated sorting genetic algorithm-II (NSGA-II) jointly optimizes sensor locations and the PIGTN's detection performance, while considering practical constraints. The combinatorial space of feasible sensor placements is explored using NSGA-II, while concurrently training the proposed detector in a closed-loop setting. Compared to baseline sensor placement methods, the proposed framework consistently demonstrates robustness under sensor failures and improvements in detection performance in seven benchmark cases, including the 14, 30, IEEE-30, 39, 57, 118 and the 200 bus systems. By incorporating AC power flow constraints, the proposed PIGTN-based detection model generalizes well to unseen attacks and outperforms other graph network-based variants (topology-aware models), achieving improvements up to 37% in accuracy and 73% in detection rate, with a mean false alarms rate of 0.3%. In addition, optimized sensor layouts significantly improve the performance of power system state estimation, achieving a 61%--98% reduction in the average state error.

Figures & tables

Ref	Task	Diagnosis Model	Optimization	Objective Function	Constraints	Joint or Standalone?
[ 43 ]	Line fault detection	Model- and Data-based	ILP	Min. number of PMUs	Coverage	Joint (model-based), Standalone (data-driven)
[ 33 ]	Line fault detection	Model-based	ILP	Min. number of PMUs	Coverage, Redundancy	Standalone
[ 21 ]	Line fault localization	Model-based	Greedy	Min. influence of unmeasured on measured buses	N/A	Joint to increase fault localization resolution
[ 3 ]	Fault diagnosis	Data-driven	ILP	Min. number of PMUs	Topological observability	Standalone
[ 22 ]	Anomaly detection	Rule-based	Min–Max	Min. max eigenvalue of sensitivity matrix	Placement feasibility	Standalone
[ 30 ]	FDIA detection	Model-based	Greedy	Min. number of PMUs	Numerical observability	Joint with state estimation

TABLE I : Summary of related works in sensor placement for power systems.

Case	Metric	GraphSAGE	GAT	GCN	GDN	GTN	PIGCN	PIGDN	PIGTN
Case 14	ACC	0.927	0.776	0.871	0.883	0.829	0.922	0.842	0.950
	PREC	0.994	0.933	0.989	0.991	1.000	0.994	0.990	0.997
	TPR	0.860	0.594	0.750	0.772	0.658	0.849	0.690	0.903
	FPR	0.0054	0.042	0.008	0.007	0.000	0.005	0.0069	0.0023
	F1	0.922	0.726	0.853	0.868	0.794	0.916	0.814	0.948
Case 30	ACC	0.886	0.761	0.851	0.876	0.754	0.873	0.830	0.897

TABLE II : Test-set performance of models across different bus system cases.

Panel of Figure 3 — Fig. 1 : Graph representations of cases (nodes colored according to computed importance scores).

Placement method	Case 14	Case 30	Case IEEE 30	Case 39	Case 57
Ours	4,5,10,13	3,6,7,9,10,12,15,25,29	3,6,7,9,10,12,15,25,27	1,2,5,6,10,14,15,18,19,22,26	4,7,10,11,14,16,17,22,23,29,32,37,38,48,49,55,56
Greedy	4,5,7,9	4,6–10,12,15,28	4,6,7,9,10,12,15,22,28	2–5,14–18,25,26	4,7,10,11,13–17,22,23,29,37,38,48,49,55
Yildiz & Abur [ 43 ]	6	9,13,26,30	26,30	6,8,10,20,28,36	7,33

TABLE III : Sensor placements across test cases.

Placement method	Case 118	Case 200
Ours	2,5,9,11,17,20,23,28,35,37,45,47,48,50,51,57,58,60,63,64,67, 68,71,78,79,83,93–98,106,109,118	1,3,7,9,10,14,15,17,22,29,30,36,41,45,46,48,56,61,66,75,81,82,86,89,100–103,107,110,112,113,116–119,121–123,129,131,134,141,142,148,149,156,157,163,178,179–181,184,186–188,192,194,195
Greedy	5,11,17,23,30,35,37,38,45,47,48,50,51,57,58,60,63,64,67–69,71,75,78,79,81–83,94–98,106,118	1,7–10,14,15,29,30,41,45,46,48,55,56,61,66,81,82,86,89,100-103,107,110,112,113,116-119,121-124,128,129,131,133,134,141,142,148,149,156,157,163,178–181,184,186-188,192–195
Yildiz & Abur [ 43 ]	32,43,59,73,111,117	2,4,6,8,10,12,13,16,18,–21,23,24,26,28,30,32,33,35,37,38,40,88,162

Table 5

Panel of Figure 6 — Fig. 2 : Detection performance improvement across test cases compared to the baseline.

Case	Placement Method	$F_{\text{crit}}$	$\mathcal{R}$	$\mathcal{A}_{\text{F1-score}}$	$\overline{\mathrm{ACC}}$	$\overline{\mathrm{F1}}$	$\overline{\mathrm{PREC}}$
Case 14	Ours	2	0.907	0.411	0.799	0.822	0.743
	Greedy	2	0.900	0.401	0.776	0.803	0.724
	Yildiz & Abur	2	0.890	0.401	0.766	0.802	0.704
	Baseline	1	0.876	0.397	0.749	0.795	0.681
Case 30	Ours	1	0.851	0.555	0.672	0.740	0.624
	Greedy	1	0.841	0.550	0.673	0.737	0.629

TABLE IV : Evaluation on robustness under sensor failures across different bus system cases.

Fig. 3 : PSSE performance improvement across test cases.

Explore similar work

Attack Detection using Time Series Foundation Models
Jun 4, 2026Sribalaji C. Anand, Anh Tung Nguyen, George J. PappasCyber-Physical Systems Cybersecurity
University of Pennsylvania, United States · Uppsala University, Sweden
GenAI-FDIA: Physics-Informed Generative Models for False Data Injection Attacks
May 15, 2026Mohammad A. Razzaque, Muta Tah HiraCyber-Physical Systems Physics-Informed Generative Modeling
School of Computing, Engineering and Digital Technologies, Teesside University, UK · Smartifier Ltd, Stockton-on-Tees, UK
Robust Industrial Cyber Physical Classification Using Neuromorphic Temporal Embeddings and Hybrid SNN XGBoost Under Machine Unlearning Attacks
Sep 9, 2026Ammar Kamoona, Sajad Koushkbaghi, Mahdi Jalili +2Cyber-Physical Systems Network Intrusion Detection
Powercor, Melbourne, VIC, Australia

Jun 4, 2026J/K move · Enter open · S save

Attack Detection using Time Series Foundation Models

Sribalaji C. Anand, Anh Tung Nguyen, George J. Pappas

University of Pennsylvania, United States · Uppsala University, Sweden

Cyber-Physical Systems Cybersecurity Time-Series Anomaly Detection

Open paper AskPDF arXiv

This paper addresses the problem of attack detection in cyber-physical systems without any knowledge of the plant model or its structure. A remotely located plant transmits sensor measurements to an operator over a network that is assumed to be under attack. We consider two classes of attacks: model-free replay attacks and model-based stealthy attacks. For the latter, we derive closed-form expressions for the optimal stealthy attack policy against a

χ^2

detector, for both linear and nonlinear systems. We then propose a model-structure-free detector based on TimesFM, a time-series foundation model developed by Google Research, which serves as a surrogate residual generator operating in a zero-shot fashion. We show empirically that the TimesFM-based detector achieves a comparable or superior attack detection performance. The efficacy of the proposed approach is demonstrated numerically on the IEEE 14-bus power system. We also demonstrate that TimesFM predictions can serve as a substitute for corrupted measurements, a practical mitigation technique when classical redundancy assumptions fail.

Abstract

Explore similar work

Attack Detection using Time Series Foundation Models

GenAI-FDIA: Physics-Informed Generative Models for False Data Injection Attacks

Robust Industrial Cyber Physical Classification Using Neuromorphic Temporal Embeddings and Hybrid SNN XGBoost Under Machine Unlearning Attacks