A Reality Gap Taxonomy for Physics-Informed Anomaly Detection in Industrial Control Systems: Cross-Regime Evaluation, Operating-Point and Temporal Distribution Shifts

Physics-informed anomaly detectors for industrial control systems are usually validated on a single synthetic or testbed dataset, which can yield optimistic estimates that do not transfer to deployment-like conditions. This validation-to-deployment discrepancy, the reality gap, is normally treated as one phenomenon and attributed to generic domain shift. We argue that it comprises at least three mechanistically distinct failure modes and propose a taxonomy that separates them by what a practitioner can observe and act on: Type 1, cross-regime evaluation; Type 2, operating-point shift; and Type 3, temporal distribution shift. A single physics-informed framework combining a Kalman-filter validation engine, BiLSTM, β-VAE, and graph attention network with residual sharing is evaluated across HAI 23.05, SWaT, and WADI over five random seeds. The three cases behave differently. Type 1 shows a substantial cross-regime decrease: AI-only falls from 0.774 in the prior synthetic evaluation to 0.493 on HAI, and Full EADE from 0.798 to 0.496. Under the retrospective fixed-FPR comparison on HAI, GNN+BiLSTM has the highest mean F1 at 0.498, although it is not separable from Full_EADE across five seeds. Type 2 collapses to FPR = 0.850 with F1 ≈ 0.237 across configurations; a strongly shifted sensor gives the clearest localized signature, but the failure is driven by aggregate distributional change and is recoverable by global threshold recalibration. Type 3 shows moderate FPR (0.244) and the largest sensitivity to residual occlusion (ΔF1_occl = +0.086), although a trained residual-free ablation shows no corresponding loss on any dataset. The resulting taxonomy links distinct failure signatures to different deployment responses.

Authors

Institutions

Publication Details

Journal
Machine Learning and Knowledge Extraction
Published
2026-09-30
DOI
https://doi.org/10.3390/make8100306
Primary Topic
Anomaly Detection Techniques and Applications
Type
article
Field-Weighted Citation Impact
0.00
Controls
|||
ALL TIME
JAN
FEB
MAR
APR
MAY
JUN
JUL
AUG
SEP
article

A Reality Gap Taxonomy for Physics-Informed Anomaly Detection in Industrial Control Systems: Cross-Regime Evaluation, Operating-Point and Temporal Distribution Shifts

Aleksandar Sandro Cvetković, Dalibor Radovanović, Marko Šarac, Ali Elsadai et al.
Machine Learning and Knowledge Extraction
Anomaly Detection Techniques and Applications
article

A Reality Gap Taxonomy for Physics-Informed Anomaly Detection in Industrial Control Systems: Cross-Regime Evaluation, Operating-Point and Temporal Distribution Shifts

Aleksandar Sandro Cvetković, Dalibor Radovanović, Marko Šarac, Ali Elsadai, Petar Kresoja, Ivan Milovanović
article en

Abstract

Physics-informed anomaly detectors for industrial control systems are usually validated on a single synthetic or testbed dataset, which can yield optimistic estimates that do not transfer to deployment-like conditions. This validation-to-deployment discrepancy, the reality gap, is normally treated as one phenomenon and attributed to generic domain shift. We argue that it comprises at least three mechanistically distinct failure modes and propose a taxonomy that separates them by what a practitioner can observe and act on: Type 1, cross-regime evaluation; Type 2, operating-point shift; and Type 3, temporal distribution shift. A single physics-informed framework combining a Kalman-filter validation engine, BiLSTM, β-VAE, and graph attention network with residual sharing is evaluated across HAI 23.05, SWaT, and WADI over five random seeds. The three cases behave differently. Type 1 shows a substantial cross-regime decrease: AI-only falls from 0.774 in the prior synthetic evaluation to 0.493 on HAI, and Full EADE from 0.798 to 0.496. Under the retrospective fixed-FPR comparison on HAI, GNN+BiLSTM has the highest mean F1 at 0.498, although it is not separable from Full_EADE across five seeds. Type 2 collapses to FPR = 0.850 with F1 ≈ 0.237 across configurations; a strongly shifted sensor gives the clearest localized signature, but the failure is driven by aggregate distributional change and is recoverable by global threshold recalibration. Type 3 shows moderate FPR (0.244) and the largest sensitivity to residual occlusion (ΔF1_occl = +0.086), although a trained residual-free ablation shows no corresponding loss on any dataset. The resulting taxonomy links distinct failure signatures to different deployment responses.

Machine Learning and Knowledge ExtractionVol. 8(10)
Singidunum University (RS), University Sinergija (BA)
Industry, innovation and infrastructure
Openalex Percentile: Top 9%
Anomaly Detection Techniques and Applications
AI Navigator

Ask Laika to Summarize, Analyze, and Connect papers live on the map.

Summarize Papers & Methodologies

Extract key findings, datasets, and comparative methods across publications.

Benchmark Rankings & Visual Analytics

Rank top research institutions, authors, funders, topics, and journals by Field-Weighted Citation Impact (FWCI) and paper volume with instant charts.

Connect Distant Disciplines

Bridge topological clusters on the map to find hidden collaborative intersections.