Pseudo-Feature Padding: A Lightweight Defense Against False Data Injection in Power Grids
Source: arXiv:2606.20415 · Published 2026-06-18 · By Farhin Farhad Riya, Shahinul Hoque, Yingyuan Yang, Jinyuan Sun, Kevin Tomsovic
TL;DR
This paper addresses the vulnerability of deep neural networks (DNNs) used in Cyber-Physical Systems (CPS)—specifically in power grid state estimation—to False Data Injection Attacks (FDIAs), which manipulate sensor measurements to evade anomaly detection. Existing defenses either require hardware changes, extensive model modifications, or do not fully mitigate attack transferability due to fixed input transformations. The authors propose a novel, lightweight, and model-agnostic defense called pseudo-feature padding, which augments each input measurement with dynamically generated pseudo-features sampled from statistical distributions of low-importance features. This increases input dimensionality and introduces structured randomness during both training and inference, breaking the stealth conditions attackers rely on and significantly reducing the transferability and success of adversarial perturbations.
They validate the method across multiple IEEE power grid benchmarks (14-bus, 30-bus, 118-bus, and 300-bus systems) under strong white-box FDIA scenarios, demonstrating substantial improvements in attack detection accuracy (e.g., over 90% accuracy compared to below 40% for plain DNNs) and robustness metrics such as Bias L2-Norm and Valid L2-Norm, while maintaining minimal impact on clean data performance. The method is computationally efficient to deploy with low inference overhead, and outperforms or matches state-of-the-art defenses like adversarial training, distillation, and zero-padding, with greater resilience in CPS-specific constrained scenarios.
Key findings
- Pseudo-feature padding raises attack detection accuracy on IEEE 300-bus system to 96.1% versus 40.0% for plain DNN under FDIA.
- Bias L2-Norm (estimation error due to attack) increased from 109 for plain DNN to 174.7 with pseudo-feature padding on 300-bus, indicating reduced attack effectiveness.
- Valid L2-Norm (attack perturbation magnitude) reduced slightly from 179.0 to 48.5 with pseudo-feature padding, showing that attacks require stronger perturbations to succeed.
- Padding size (number of pseudo-features) positively correlates with detection accuracy up to saturation; larger bus systems show more stable improvements (Fig. 3).
- Pseudo-feature padding introduces structural randomness breaking the null-space alignment attack assumption Ba=0, making adversarial attack crafting computationally infeasible.
- Compared to zero-padding, which uses fixed values, randomized data-aware pseudo-feature padding significantly limits attack transferability in white-box settings.
- The method requires no core DNN architectural changes and incurs low inference latency increase (0.9ms vs 0.8ms for plain DNN).
- Adversarial training and distillation methods yield moderate improvements but are less effective and more computationally intensive in CPS scenarios.
Threat model
The attacker is a white-box adversary with full access to the DNN model architecture, parameters, and training data but does not know the randomized pseudo-feature padding applied at inference. The attacker crafts stealthy additive perturbations to sensor measurements constrained to remain undetected in the original system null space. The attacker cannot predict or invert the dynamic padding applied, which breaks the stealth condition and transfers attack crafting to a high-complexity, non-transferable scenario.
Methodology — deep read
The authors start with a white-box threat model where adversaries have full knowledge of the deployed DNN model and training data but not the dynamically randomized pseudo-feature padding applied at inference, making attack transferability fundamentally harder.
They use datasets generated from IEEE power system test cases (14-, 30-, 118-, and 300-bus) simulated via DC power flow models in MATPOWER, creating 40,000 labeled samples evenly split into normal and FDIA-compromised measurements. Attacks are crafted using iterative adversarial projection methods that exploit the linear measurement-to-state Jacobian H matrix properties.
The defense introduces an additional input layer that appends a vector of pseudo-features generated per sample by first ranking feature importance using a decision tree model. Features deemed low-importance (below a threshold) have their empirical statistical distributions fit during preprocessing. For each input, random samples from these distributions form the pseudo-feature vector, which is concatenated to the original input, increasing input dimensionality and data complexity.
This padding is randomized independently for each training and inference sample, causing the effective system matrix to change and thereby altering the null space exploited by stealthy FDIA attacks. Consequently, adversarial perturbations crafted for the original system become ineffective or non-transferable under this transformation.
They train a feed-forward DNN with four fully connected layers (ReLU activation, dropout), outputting binary classification for anomaly detection. Optimization uses Adam with 0.001 learning rate, batch size 128, for 100 epochs. They expand the training set by generating multiple padded versions per sample, increasing dataset size by factor p+1 depending on padding size.
For evaluation, they generate 1000 adversarial samples per test case, varying compromised meter counts, and quantify performance using Attack Detection Accuracy, Bias L2-Norm (estimation error), and Valid L2-Norm (perturbation strength). Baseline comparisons include plain DNN, adversarial training, adversarial distillation, zero-padding, and their pseudo-feature padding. Computational overhead in training and inference is also measured.
The authors provide detailed mathematical justification linking pseudo-feature padding to a changed projection residual operator B1 with a different null space than original B, breaking FDIA stealth constraints. Empirically, they present accuracy and robustness curves across bus sizes and padding parameters (Figures 3-5), showing consistent defense gains. The code and datasets are not publicly released, but the paper gives algorithmic detail enabling reproducibility.
A concrete example end-to-end: For the IEEE 30-bus case, the DNN input vector z is augmented by concatenating pseudo-features sampled from the fitted distributions of features ranked as less important by a decision tree on z. Multiple padded variants are generated per sample during training, increasing data diversity. At inference, padding is randomized freshly for each input. Adversarial samples targeting the original DNN input dimension fail to remain stealthy under the transformed system matrix, achieving up to 92% detection accuracy compared to 30.4% baseline. Attack strength (Bias L2) is higher, indicating the attacker must generate more detectable perturbations. This example workflow highlights the dynamic, data-aware padding that underpins the defense’s robustness.
Technical innovations
- Introduction of input-level pseudo-feature padding that uses statistical distributions of low-importance features to generate randomized, data-dependent padding vectors.
- Demonstration that padding expands input dimensionality and modifies the effective system matrix, altering the null space critical for stealthy FDIA attack construction, thus reducing attack transferability.
- A lightweight, model-agnostic defense requiring no changes to core DNN architectures or hardware, enabling seamless deployment in real-world CPS contexts.
- Empirical validation showing that randomized pseudo-feature padding outperforms fixed zero-padding, adversarial training, and adversarial distillation in CPS FDIA detection.
Datasets
- IEEE 14-bus — 40,000 samples (50% normal, 50% false data) — Synthetic via MATPOWER DC power flow simulation
- IEEE 30-bus — 40,000 samples (50% normal, 50% false data) — Synthetic via MATPOWER DC power flow simulation
- IEEE 118-bus — 40,000 samples (50% normal, 50% false data) — Synthetic via MATPOWER DC power flow simulation
- IEEE 300-bus — 40,000 samples (50% normal, 50% false data) — Synthetic via MATPOWER DC power flow simulation
Baselines vs proposed
- Plain DNN: Attack detection accuracy = 40.0% (on 300-bus) vs proposed pseudo-feature padding: 96.1%
- Adversarial Training: Attack detection accuracy = 64.4% (300-bus) vs proposed: 96.1%
- Adversarial Distillation: Attack detection accuracy = 48.3% (300-bus) vs proposed: 96.1%
- Zero Padding: Attack detection accuracy = 95.0% (300-bus) vs pseudo-feature padding: 96.1%
- Bias L2-Norm (300-bus): Plain DNN = 109, Adversarial Training = 44.2, Zero Padding = 163.8, Pseudo-Feature Padding = 174.7
- Valid L2-Norm (300-bus): Plain DNN = 179.0, Adversarial Training = 125.6, Zero Padding = 45.8, Pseudo-Feature Padding = 48.5
- Inference time overhead: Plain DNN = 0.8 ms, Pseudo-Feature Padding = 0.9 ms
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2606.20415.
Fig 1: Experimental setup: Baseline model performance under no attack and the manifold of false and adv-measurements
Fig 2: Pseudo-Feature Padding input modification
Fig 3: Attack detection accuracy for bus case-14, case-30,
Fig 4: Bias L2-Norm for bus case-14, case-30, case-118 and
Fig 5: Valid L2-Norm for bus case-14, case-30, case-118
Fig 6 (page 4).
Fig 7 (page 4).
Fig 8 (page 4).
Limitations
- Evaluation limited to DC power flow models and IEEE test cases; real-world AC dynamics and larger grids not tested.
- Adversary model excludes adaptive or partial-information attacks that might attempt to estimate or learn pseudo-feature sampling.
- No public code or datasets released, which limits reproducibility by external researchers.
- Effect of padding size saturates and may cause minor accuracy fluctuations; optimal padding size choice requires tuning per system.
- Does not explicitly address temporal or online detection scenarios where attack vector dynamics evolve over time.
- Robustness to other cyber-physical attacks besides FDIA (e.g., topology attacks) not evaluated.
Open questions / follow-ons
- How would the defense perform under adaptive adversaries who attempt to estimate or learn the pseudo-feature padding scheme?
- Can the pseudo-feature padding technique be generalized effectively to other CPS domains beyond power grids, such as transportation or water networks?
- What is the impact of pseudo-feature padding on temporal or streaming state estimation models with sequential dependencies?
- Would combining pseudo-feature padding with adversarial training or other defenses yield complementary robustness benefits?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners, this work illustrates a promising paradigm of augmenting input features dynamically with statistically derived pseudo-features to increase the complexity and randomness of attack surfaces without modifying core model architectures. The principle of randomized padding to break adversarial attack transferability could inspire improved input transformations for CAPTCHA solvers or bot detectors, where attackers rely on subtle perturbations to evade detection. Furthermore, the approach shows how adversarial defenses can be designed to maintain baseline accuracy and exhibit low computational overhead, a critical consideration for real-time authentication and web-based challenge systems. However, the defense relies on domain-specific feature importance and statistical characteristics, which would need contextual adaptation to CAPTCHA-like visual or interaction data distributions.
Cite
@article{arxiv2606_20415,
title={ Pseudo-Feature Padding: A Lightweight Defense Against False Data Injection in Power Grids },
author={ Farhin Farhad Riya and Shahinul Hoque and Yingyuan Yang and Jinyuan Sun and Kevin Tomsovic },
journal={arXiv preprint arXiv:2606.20415},
year={ 2026 },
url={https://arxiv.org/abs/2606.20415}
}