Physics-Aware Machine Unlearning for Cyber-Physical Systems

Mohammad Zakaria Haider; Muhammad Nadeem; Mohammad Ashiqur Rahman

cs.LGSep 29, 2026

Physics-Aware Machine Unlearning for Cyber-Physical Systems

Authors: Mohammad Zakaria Haider, Muhammad Nadeem, Mohammad Ashiqur Rahman

Organizations: Analytics for Cyber Defense (ACyD) Lab, Florida International University, USA

Abstract

This paper proposes a physics-guided gradient-ascent-based machine unlearning method that couples the forgetting signal with the physical residual of the target cyber-physical systems, ensuring that weight updates during unlearning are steered toward physically feasible regions of the weight space. The physics residual acts as a safety fence during gradient ascent: the model is steered away from the poisoned behavioral basin and simultaneously toward physics-compliant territory, rather than toward an arbitrary alternative that may still violate domain constraints. We evaluate the proposed method against four baselines: naive gradient ascent, exact unlearning, SISA, and full retraining on an IEEE 34-bus distribution system, driven by two physics-informed neural network-based distribution energy resource controllers and validated through high-fidelity OpenDSS power-flow co-simulation. From the evaluation, we found that our proposed physics-guided model simultaneously removes poison and restores physical compliance, which are essential for the safe deployment of safety-critical cyber-physical systems

Figures & tables

Fig. 1: The schematic diagram of the proposed PhyGAMuL for the CPS application

Scenario	Poison MSE $\uparrow$	Clean MSE $\downarrow$	PVR (%) $\downarrow$	VVR (%) $\downarrow$
Baseline	0.51 $\pm$ .01	0.012 $\pm$ .001	0.8 $\pm$ .1	0.0
Poisoned (no defense)	0.003 $\pm$ .001	0.21 $\pm$ .02	34.2 $\pm$ 2.1	61.4 $\pm$ 3.2
Naive GA	0.47 $\pm$ .03	0.018 $\pm$ .002	18.7 $\pm$ 1.9	26.3 $\pm$ 2.4
PhyGAMuL	0.51 $\pm$ .02	0.014 $\pm$ .001	1.4 $\pm$ .3	2.1 $\pm$ .4
Exact Unlearning	0.50 $\pm$ .02	0.015 $\pm$ .001	2.8 $\pm$ .5	3.7 $\pm$ .6
SISA	0.49 $\pm$ .03	0.016 $\pm$ .002	3.9 $\pm$ .7	5.2 $\pm$ .8

TABLE I: Comparison of all scenarios across four metrics

Scenario	VVR (%)	Min $V$ (p.u.)	Losses (kWh)	$\bar{P}_{\text{EVCS}}$ (kW)	$\mathcal{L}_{\text{EVCS}}$	$\bar{P}_{\text{PMS}}$ (kW)	$\mathcal{L}_{\text{PMS}}$	Imbal. (kW)
Baseline	3.47	0.947	5,867	27.0	0.0016	44.2	0.0	230.8
Poisoned	100.0	0.929	7,627	500.0	0.3294	44.6	0.2199	703.5
Naive GA	100.0	0.944	6,181	115.3	0.0554	44.1	0.0	319.2
PhyGAMuL	3.48	0.947	5,867	27.0	0.0007	44.2	0.0	230.9
Exact	3.48	0.947	5,867	27.0	0.0017	44.2	0.0	230.9
SISA	3.48	0.947	5,867	27.0	0.0017	44.2	0.0	230.9

TABLE II: Grid-level simulation results over a 24-hour

Panel of Figure 4 — Fig. 2: Demonstrating (a) minimum bus voltage (worst-case bus) over the 24-hour simulation, which represents only Naive GA and the Poisoned scenario fail to maintain safe voltage across the full window, and (b) aggregated load profile over the 24-hour simulation

	PhyGAMuL	SISA	Exact
Works on deployed model	Yes	No	No
Physics guaranteed	At unlearning	Incidental	Incidental
Data at unlearning	Poison only	Full shard data	Checkpoint + data
Late attack discovery	Yes	N/A	No
Federated-compatible	Per-client	Complex	Complex
Unlearning time (EVCS)	38 s	39 s	2 s

TABLE III: Comparison of physics-compliant unlearning methods

Scenario	Power Balance	Cap. Guard	Over- current	Avg. Viol.
Baseline	25.4%	1.8%	0.0%	6.8%
Poisoned	0.0%	100.0%	0.0%	25.0%
Naive GA	66.3%	0.0%	0.0%	16.6%
PhyGAMuL	15.1%	0.1%	1.1%	4.1%
Exact	25.7%	2.0%	0.1%	6.9%
SISA	18.4%	12.8%	0.3%	7.9%

TABLE IV: EVCS physics violation rates by constraint type.

Scenario	MPPT Exceeded	Night Injection	Reverse Power	Avg. Viol.
Baseline	0.0%	0.0%	0.0%	0.0%
Poisoned	82.1%	3.4%	0.0%	21.4%
Naive GA	0.0%	0.0%	0.0%	0.0%
PhyGAMuL	0.0%	0.0%	0.0%	0.0%
Exact	0.0%	0.0%	0.0%	0.0%
SISA	0.0%	0.0%	0.0%	0.0%

TABLE V: PMS physics violation rates by constraint type.

Panel of Figure 8 — Fig. 3: Unlearning time comparison for (a) EVCS and (b) PMS controllers across all unlearning methods. PhyGAMuL achieves comparable wall-clock time to Naive GA while producing physically compliant results.

Panel of Figure 9 — Fig. 4: Unlearning loss trajectories. Top row: ascent phase showing simultaneous poison forgetting and physics residual reduction under PhyGAMuL for (a) EVCS and (b) PMS. Bottom row: fine-tuning phase showing physics-guided recovery of clean accuracy with maintained physical compliance for (c) EVCS and (d) PMS.

	EVCS			PMS
$\lambda$	Poison MSE $\uparrow$	Clean MSE $\downarrow$	PVR (%) $\downarrow$	Poison MSE $\uparrow$	Clean MSE $\downarrow$	PVR (%) $\downarrow$
0.0 (Naive GA)	0.51 $\pm$ .02	0.046 $\pm$ .003	15.4 $\pm$ 1.8	0.25 $\pm$ .02	0.103 $\pm$ .006	2.8 $\pm$ .5
0.5	0.51 $\pm$ .02	0.041 $\pm$ .002	6.6 $\pm$ 0.9	0.30 $\pm$ .01	0.139 $\pm$ .005	0.5 $\pm$ .3
1.0	0.51 $\pm$ .01	0.042 $\pm$ .002	4.5 $\pm$ 0.6	0.31 $\pm$ .01	0.146 $\pm$ .004	0.0 $\pm$ .0
2.0 (PhyGAMuL)	0.51 $\pm$ .01	0.045 $\pm$ .002	3.6 $\pm$ .4	0.32 $\pm$ .01	0.152 $\pm$ .004	0.0 $\pm$ .0
5.0	0.51 $\pm$ .01	0.052 $\pm$ .003	1.2 $\pm$ .3	0.32 $\pm$ .01	0.156 $\pm$ .005	0.0 $\pm$ .0

TABLE VI: Physics weight

\lambda

sensitivity for EVCS and PMS

	EVCS				PMS
$T_{f}$	PhyGAMuL		Naive GA		PhyGAMuL		Naive GA
$T_{f}$	MSE $\downarrow$	PVR $\downarrow$	MSE $\downarrow$	PVR $\downarrow$	MSE $\downarrow$	PVR $\downarrow$	MSE $\downarrow$	PVR $\downarrow$
200	0.051 $\pm$ .004	5.8 $\pm$ .7	0.047 $\pm$ .003	15.9 $\pm$ 1.7	0.152 $\pm$ .005	0.8 $\pm$ .3	0.103 $\pm$ .006	2.4 $\pm$ .4
500	0.048 $\pm$ .003	5.1 $\pm$ .6	0.046 $\pm$ .003	15.7 $\pm$ 1.7	0.152 $\pm$ .004	0.2 $\pm$ .2	0.103 $\pm$ .006	2.4 $\pm$ .4
800	0.047 $\pm$ .002	4.3 $\pm$ .5	0.046 $\pm$ .003	15.6 $\pm$ 1.6	0.152 $\pm$ .004	0.0 $\pm$ .0	0.103 $\pm$ .006	2.4 $\pm$ .4
1000	0.046 $\pm$ .002	4.0 $\pm$ .5	0.046 $\pm$ .003	15.5 $\pm$ 1.6	0.152 $\pm$ .004	0.0 $\pm$ .0	0.103 $\pm$ .005	2.4 $\pm$ .4

TABLE VII: Fine-tune epoch count

T_{f}

sensitivity for EVCS and PMS

Machine Unlearning

Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.

See all 343 papers

Integrating Physics-Informed Neural Networks for Safe Reinforcement Learning in a 1-DoF Helicopter System
Jul 3, 2026Georg Schäfer, Jakob Rehrl, Stefan HuberRL Control Reinforcement Learning
Josef Ressel Centre for Intelligent and Secure Industrial Automation, Salzburg University of Applied Sciences, Salzburg, Austria · Paris Lodron University of Salzburg, Salzburg, Austria
Safe Reinforcement Learning using Ideas from Model Predictive Control
Jul 8, 2026Georg Schäfer, Jakob Rehrl, Stefan Huber +1Constrained RL Safe RL
Josef Ressel Centre for Intelligent and Secure Industrial Automation, Salzburg University of Applied Sciences, Salzburg, Austria · Department of Artificial Intelligence and Human Interfaces, Paris Lodron University of Salzburg, Salzburg, Austria
Learning Without Adversarial Training: A Physics-Informed Neural Network for Secure Power System State Estimation under False Data Injection Attacks
Apr 3, 2026Solon Falas, Markos Asprou, Charalambos Konstantinou +1False Data Injection Attacks Adversarial Robustness
KIOS Center of Excellence, University of Cyprus · CEMSE, King Abdullah University of Science and Technology (KAUST) · Department of Electrical and Computer Engineering, University of Cyprus

Jul 3, 2026J/K move · Enter open · S save

Integrating Physics-Informed Neural Networks for Safe Reinforcement Learning in a 1-DoF Helicopter System

Georg Schäfer, Jakob Rehrl, Stefan Huber

Josef Ressel Centre for Intelligent and Secure Industrial Automation, Salzburg University of Applied Sciences, Salzburg, Austria · Paris Lodron University of Salzburg, Salzburg, Austria

RL Control Reinforcement Learning Physics-Informed ML Safe RL Physics-Informed RL

Open paper AskPDF arXiv

Deep reinforcement learning (DRL) offers powerful control for industrial cyber-physical systems (ICPSs), but its "black-box" exploration risks violating strict hardware safety limits. Typically, these constraints are managed through complex reward shaping. In this work-in-progress paper, we embed a differentiable physics model directly into the proximal policy optimization (PPO) actor loss function. By simulating short-horizon future trajectories during training, the policy is penalized for anticipated safety violations independent of the task-reward signal. Evaluated on a simulated 1-degree-of-freedom helicopter testbed with strict pitch constraints, our physics-informed soft regularizations substantially reduce constraint violations while maintaining reliable target tracking.

Abstract

Machine Unlearning

Explore similar work

Integrating Physics-Informed Neural Networks for Safe Reinforcement Learning in a 1-DoF Helicopter System

Safe Reinforcement Learning using Ideas from Model Predictive Control

Learning Without Adversarial Training: A Physics-Informed Neural Network for Secure Power System State Estimation under False Data Injection Attacks