这篇论文深入探讨了工业控制系统异常检测模型的鲁棒性，对于关注数据安全和模型稳定性的读者来说，这是一篇值得关注的论文。
本研究评估了在训练时间数据污染下，11种异构异常检测模型在Secure Water Treatment基准上的鲁棒性。评估了三种污染策略：随机注入、相似性目标注入和特征噪声注入。结果显示，鲁棒性高度依赖于模型，且不能仅从干净数据的性能预测。基于注入的污染对局部密度和距离检测器的降级影响最大，而特征噪声污染的影响相对有限。PCA、SVM、HBOS和IForest相对稳定，而调整后的神经网络检测器表现出中等鲁棒性。
Robustness of Anomaly Detection Models for Industrial Control Systems under Training-Time Data Contamination
Machine-learning-based anomaly detection is increasingly used in industrial control systems (ICS), yet most studies assume that detector training data is trustworthy. In practice, training data may be corrupted through compromised logs, labeling errors, manipulated historian records, or unsafe retraining processes. This paper evaluates the robustness of offline ICS anomaly-detection pipelines on the Secure Water Treatment (SWaT) benchmark under training-time contamination. We assess 11 heterogeneous anomaly detectors under three contamination strategies: random injection, similarity-targeted injection, and feature-noise injection. The first two insert attack samples into the nominal training pool, while the third adds bounded Gaussian noise to selected normal training samples. These attacks are contamination-based rather than gradient-driven poisoning methods. Contamination budgets from 1% to 10% are evaluated using clean validation and test sets under a unified offline protocol. The results show that robustness is strongly model-dependent and cannot be predicted from clean-data performance alone. Injection-based contamination causes the greatest degradation, particularly for local-density and distance-based detectors, whereas feature-noise contamination has a comparatively limited effect. PCA, SVM, HBOS, and IForest remain relatively stable, while the tuned neural detectors demonstrate intermediate robustness. Overall, the findings highlight the importance of training-data integrity in ML-enabled ICS monitoring, subject to the evaluated dataset, models, and threat assumptions.