Ground-Truth Physics Residuals for Detecting Stealthy False Data Injection Attacks in Smart Grids

Stealthy false data injection (FDI) attacks exploit a fundamental weakness of conventional residualbased bad-data detection: a carefully structured measurement perturbation can remain statistically acceptable to the state-estimation residual while moving the reported measurements away from the electrical state represented by the actual network.This paper develops and empirically evaluates a ground-truth physics-residual methodology for identifying that discrepancy.The key idea is to compute electricalconsistency residuals directly from the defender-side network admittance matrix (Ybus), reconstructed voltage phasors, reported active/reactive power, and line-flow balance, and to use these residuals as an explicit feature stream in a spatial-temporal detector.The evaluation uses a corrected benchmark of 2,016 simulation runs spanning IEEE 39-bus and IEEE 118bus systems, 18 balanced scenario cells, and three attacker-knowledge tiers for stealthy FDI.The primary detector combines graph attention, temporal LSTM representation, and the physics-residual stream.On the held-out corrected test split, pooled precision, recall, F1 and ROC-AUC are 0.727, 0.715, 0.721 and 0.815, respectively, compared with F1/ROC-AUC of 0.596/0.569for a Chi-squared bad-data detector and 0.621/0.677for a vanilla LSTM.FDI-specific F1 is 0.910, 0.902 and 0.892 for attacker tiers 1-3.Removing the physics stream reduces F1 by 34.8, 38.2 and 36.0 percentage points for the three FDI tiers.A sequenceposition control achieves F1=0.0 and ROC-AUC=0.5 after correction of an earlier fixed-onset leakage defect.The results provide strong first-pass evidence that explicit electrical-consistency information materially improves stealthy-FDI detection, while also exposing an important topology-dependent false-positive problem: 0% on IEEE 39-bus versus 25.5% on IEEE 118-bus.The paper therefore presents the residual methodology as a reproducible research mechanism rather than as evidence of deployment readiness.