Robustness of Centralised, Localised, and Vertical Federated Anomaly Detection Against Data Manipulation Attacks

Industrial Control Systems (ICS) increasingly use machine learning-based anomaly detectors to identify deviations from expected cyber-physical behaviour. However, compromised programmable logic controllers or edge components may manipulate a local subset of sensor and actuator measurements, creating new attack surfaces during training and inference.nThis paper evaluates the robustness of autoencoder-based anomaly detection under mean masking, anomaly injection, and replay attacks. Using the BATADAL water distribution dataset, we compare centralised, localised, and vertical federated learning (VFL) architectures under equivalent training conditions and a localised attacker model in which only one edge area is compromised.nThe results show that the localised architecture generally experiences the largest reduction in detection performance. In particular, replay attacks effectively conceal anomalies from local detectors by replacing relevant measurements with previously observed benign values. Centralised and VFL architectures exhibit similar and generally stronger robustness. This could be the case because measurements from areas outside of the attackers reach remain uncompromised and preserve information about the underlying physical anomaly. These findings indicate that combining information across distributed system areas may improve resilience against localised data manipulation. VFL therefore provides a promising compromise between centralised detection, which benefits from a system-wide view, and the oftentimes practical requirement in industrial systems that data should remain distributed across local components, areas, or operators.