Sensor-Level Anomaly Detection in DC–DC Buck Converters with a Physics-Informed LSTM: DSP-Based Validation of Detection and a Simulation Study of CI-Guided Deception

Abstract

Digitally controlled DC–DC converters are vulnerable to sensor-side spoofing, motivating plant-level anomaly detection that respects the converter physics. We present a physics-informed LSTM (PI–LSTM) autoencoder for a 24→12 V buck converter. The model embeds discrete-time circuit equations as residual penalties and uses a fixed decision rule ($\tau =\mu +3\sigma$, $N=3$ consecutive samples). We study three voltage-sensing attacks (DC bias, fixed-sample delay, and narrowband noise) in MATLAB/Simulink. We then validate the detection path on a TMS320F28379 DSP. The detector attains F1 scores of 96.12%, 91.91%, and 97.50% for bias, delay, and noise (simulation); on hardware, it achieves 2.9–4.2 ms latency with an alarm-wise FPR of ≤1.2%. We also define a unified safety box for DC rail quality and regulation. In simulations, we evaluate a confusion index (CI) policy for safety-bounded performance adjustment. A operating point yields $\mathrm{CI}\approx 0.25$ while remaining within the safety limits. In hardware experiments without CI actuation, the $V_{r,pp}$ and IRR stayed within the limits, whereas the ±2% regulation window was occasionally exceeded under the delay attack (up to ≈2.8%). These results indicate that physics-informed detection is deployable on resource-constrained controllers with millisecond-scale latency and a low alarm-wise FPR, while the full hardware validation of CI-guided deception (safety-bounded performance adjustment) under the complete safety box is left to future work.

1. Introduction

1.1. Research Background

Modern power electronic systems are increasingly exposed to cyber-physical threats due to the pervasive use of digital controllers and communication networks [1,2]. DC–DC buck converters, as core building blocks in industrial supplies, EV chargers, and renewable interfaces, are natural targets for sensor-side spoofing [3,4]. Network-centric defenses alone are insufficient for such plant-level attacks because they do not provide real-time, physics-consistent anomaly detection at the converter I/O [5,6,7].

1.2. Limitations of Existing Research

Prior studies have emphasized protocol security or network intrusion detection, with comparatively less focus on sensor-level detection in power converters [8,9]. Converter-oriented detectors are often statistical/rule-based and struggle with subtle, dynamics-driven deviations in high-rate time series. Moreover, many approaches lack explicit physical constraints, clear decision rules, and hardware evidence of deployability under tight real-time budgets [10,11].

1.3. Related Work and Context

Prior efforts can be grouped into six strands: (i) model-/observer-based FDI (Kalman/EKF, unknown-input observers, parity space), (ii) rule/statistical change detection (CUSUM/GLR on residuals), (iii) classical ML (SVM, random forest, isolation forest), (iv) deep time-series autoencoders (CNN–LSTM/LSTM AEs), (v) physics-informed learning (constraints embedded in the loss), and (vi) CPS security for converters (sensor path anomalies and EMI/delay effects). Our approach sits at the intersection of (iv) and (v): a PI–LSTM with discrete-time circuit residuals aligned to fixed-step control, a fixed decision rule ($\tau =\mu +3\sigma$, $N=3$), and hardware validation of the detection latency/FPR under a unified safety box. The prior research landscape is summarized in

Table 1. Prior research landscape.

Category	Representative References
Model-/observer-based FDI	Fault diagnosis monographs and observer-based schemes [12].
Rule/statistical detection	Residual thresholds; classical change detection surveys (e.g., CUSUM/GLR) [12].
Classical ML for converters	SVM/RF/isolation forest baselines; PE monitoring surveys [13,14].
Deep time-series AEs	CNN–LSTM and LSTM autoencoders in converter diagnostics [13,14].
Physics-informed learning	PINNs and theory-guided data science [15,16,17,18,19,20].
CPS security in PE	Device reliability/CM and DC–DC diagnosis overviews [14,21].

.

Positioning. Relative to (i)–(iii), PI constraints reduce spurious alarms by disallowing reconstructions that violate the converter physics; relative to (iv), we enforce discrete-time residuals (not continuous PDEs), which matches embedded fixed-step deployment. The safety box (regulation, $V_{r,\mathrm{pp}}$, IRR) bridges detection and system metrics.

Classic references. Foundational FDI/CM and power electronics surveys include Isermann’s monograph on model-based and statistical fault diagnosis [12], the converter device reliability and condition monitoring review by Yang et al. [21], online capacitor monitoring in converters by Buiatti et al. [22], the comprehensive DC–DC monitoring framework by Givi et al. [13], and the focused review of fault diagnosis/tolerance for DC–DC converters by Geddam and Elangovan [14].

Classical Detectors (EKF/Fuzzy/CUSUM)

Prior converter-oriented detectors include (i) Kalman filter residual schemes (EKF/UKF) that threshold the innovation or its normalized energy; (ii) fuzzy/rule-based logic crafted from expert heuristics; and (iii) classical change detection (Shewhart, CUSUM/GLR). They are lightweight and interpretable but may be sensitive to model mismatch/drift and hand-tuned thresholds under nonstationary operating conditions. To contextualize our PI–LSTM, we later benchmark an EKF residual detector and a Shewhart detector under the same preprocessing conditions and decision rule ($\tau =\mu +3\sigma$, $N=3$).

1.4. Research Objectives and Contributions

We propose a physics-informed anomaly detector and a safety-aware response tailored to digitally controlled DC–DC converters. The unique contributions of this paper are as follows.

• Discrete-time physics-informed LSTM (PI–LSTM) for converters. We embed the averaged buck dynamics as residual penalties on decoder trajectories, avoiding label leakage and aligning with fixed-step embedded control; the residual template is topology-agnostic via the replacement of the discrete-time update map [23].
• Unified detection policy with DSP-grade deployment. A single detector covers DC bias, fixed-sample delay, and narrowband noise under a fixed decision rule ($\tau =\mu +3\sigma$, $N=3$). On a TMS320F28379, a distilled model ($n_x=4$, $n_h=32$) achieves 2.9–4.2 ms latency with an alarm-wise FPR of ≤1.2%.
• Unified safety box coherently tied to response. We formalize a safety box for DC rail quality and regulation—time-domain ripple $V_{r,\mathrm{pp}}$, in-band ripple ratio $\mathrm{IRR}$, and a $\pm 2\%$ regulation window—and reuse the same normalizers inside the confusion index (CI), preventing metric–policy mismatch. See Section 2.5, Equations (5) and (6).
• CI-guided actuation policy (simulation) with rollback criteria. We specify a bounded actuation law tied to the safety box and demonstrate an operating point (CI $\approx 0.25$) in simulations, together with firmware-style rollback/hysteresis rules for hardware realization [24,25]. See Section 2.5, Equations (5) and (6).
• Measurement and reporting conventions for power quality-aware detection. We standardize $V_{r,\mathrm{pp}}$ (AC-coupled, 20 MHz bandwidth limit) and $\mathrm{IRR}$ (Welch PSD around $k{f}_{\mathrm{sw}}$) and report detection with fixed persistence, hardware compute budgets, and confidence intervals.

Scope note. This paper deliberately restricts the hardware to a buck converter and three sensor-side disturbances; extensions to other topologies and richer cyber-physical threats follow from the same discrete-time residual template and are listed in Future Work.

Abbreviations used throughout the paper are listed in

Table 2. List of abbreviations used throughout the paper.

Abbrev.	Definition
ADC	Analog-to-Digital Converter
AE	Autoencoder
AUC	Area Under the ROC Curve
CCM	Continuous Conduction Mode
CI	Confusion Index (policy metric; not a statistical confidence interval)
DSP	Digital Signal Processor
DSO	Digital Storage Oscilloscope
EMI/EMC	Electromagnetic Interference/Compatibility
ESR	Equivalent Series Resistance
FPR	False-Positive Rate (alarm-wise unless stated)
HIL	Hardware-in-the-Loop
IRR	In-band Ripple Ratio
LSTM	Long Short-Term Memory
PI–LSTM	Physics-Informed LSTM
PSD	Power Spectral Density
PWM	Pulse-Width Modulation
ROC	Receiver Operating Characteristic
SPF	Sample-wise Positive Fraction
VRM	Voltage Regulator Module

.

2. System Modeling and Design

2.1. Buck Converter Simulation Model

The buck converter implemented in MATLAB R2024a/Simulink is summarized in

Table 3. Buck converter specifications.

Parameter	Value	Unit
Input Voltage	24	V
Output Voltage	12	V
Inductance	100	µH
Capacitance	470	µF
Load Resistance	10	$\Omega$
Switching Frequency	100	kHz
Output Power	14.4	W

.

We use a Simscape Electrical model with an averaged discrete-time formulation for training and evaluation. Switch-level ripple is assessed separately from measurements. The averaged state equations are

$$\begin{array}{cc}\hfill V_{\mathrm{out}}\left[k+1\right]& =V_{\mathrm{out}}\left[k\right]+{\displaystyle \frac{\Delta t}{C}}\left(i_L\left[k\right]-{\displaystyle \frac{V_{\mathrm{out}}\left[k\right]}{R}}\right),\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill i_L\left[k+1\right]& =i_L\left[k\right]+{\displaystyle \frac{\Delta t}{L}}\left(V_{\mathrm{in}}d\left[k\right]-V_{\mathrm{out}}\left[k\right]\right),\hfill \end{array}$$

(2)

where $\Delta t=10$ µs is the simulation sampling period, $d\left[k\right]\in [0,1]$ is the duty ratio, and $V_{\mathrm{out}},i_L$ denote the output voltage and inductor current, respectively. Since $\Delta t$ equals the switching period at $f_s=100$ kHz, Equations (1) and (2) form an averaged (not switch-level) model; ripple quantities are evaluated from AC-coupled oscilloscope captures (20 MHz bandwidth limit) and frequency-domain analysis in the Results section [26,27].

2.2. Sensor Attack Scenario Modeling

We evaluate three sensor-side attacks on the output voltage sensing path: (i) DC bias, (ii) fixed-sample delay via a ring buffer, and (iii) narrowband sinusoidal injection (1 kHz). Unless otherwise noted, the sampling period is $\Delta t=10$ µs and the attack window is 50–70 ms. Implementations are summarized in Algorithms 1–3 [28,29,30].

Algorithm 1 Bias attack (voltage only, physically consistent)

1: Inputs:   2:    $v_{\mathrm{true}}[0:T-1]$                   ▹ true output voltage   3:    ${\alpha }_{\mathrm{fb}}$          ▹ feedback divider ratio (e.g., $12\to 3.3$ V $\Rightarrow {\alpha }_{\mathrm{fb}}\approx 0.275$)   4:    ${\delta }_{\mathrm{cmd}}$    ▹ commanded bias magnitude (e.g., $+0.4$ V at the injection origin)   5:    $\mathrm{site}\in \{\mathtt{post}\_\mathtt{divider},\mathtt{pre}\_\mathtt{divider},\mathtt{digital}\}$   6:    $(n_{\mathrm{on}},n_{\mathrm{off}})$            ▹ attack window in samples (e.g., 50–70 ms)   7: Define the effective gain to the feedback node: $$g_{\mathrm{site}}=\left\{\begin{array}{cc}1,\hfill & \text{post\_divider}\hfill \\ {\alpha }_{\mathrm{fb}},\hfill & \text{pre\_divider}\hfill \\ {\gamma }_{\mathrm{dig}},\hfill & \text{digital (calibrated path gain)}\hfill \end{array}\right.$$   8: ${\delta }_{\mathrm{eff}}\leftarrow g_{\mathrm{site}}{\delta }_{\mathrm{cmd}}$                       ▹ offset at $v_{fb}$   9: $\Delta v_{\mathrm{meas}}\leftarrow {\delta }_{\mathrm{eff}}/{\alpha }_{\mathrm{fb}}$           ▹ equivalent offset on the $V_{\mathrm{out}}$ channel 10: for $n=0$ to $T-1$ do 11:     if $n_{\mathrm{on}}\le n\le n_{\mathrm{off}}$ then 12:         $v_{\mathrm{atk}}\left[n\right]\leftarrow v_{\mathrm{true}}\left[n\right]+\Delta v_{\mathrm{meas}}$ 13:     else 14:         $v_{\mathrm{atk}}\left[n\right]\leftarrow v_{\mathrm{true}}\left[n\right]$ 15:     end if 16: end for 17: Output: $v_{\mathrm{atk}}[0:T-1]$

Algorithm 2 Delay attack (ring buffer at sampling period $\Delta t$)

1: Input: raw sequence $s_{\mathrm{orig}}[0:T-1]$, sampling period $\Delta t$, desired delay ${\tau }_{\mathrm{d}}$ 2: $N\leftarrow max\{1,\mathrm{round}({\tau }_{\mathrm{d}}/\Delta t)\}$              ▹ delay length in samples 3: Init: $B[0:N-1]\leftarrow s_{\mathrm{orig}}\left[0\right]$                    ▹ startup fill 4: for $n=0$ to $T-1$ do 5:     $s_{\mathrm{del}}\left[n\right]\leftarrow B[nmodN]$                 ▹ read delayed sample 6:     $B[nmodN]\leftarrow s_{\mathrm{orig}}\left[n\right]$                ▹ write current sample 7: end for 8: Output: $s_{\mathrm{del}}[0:T-1]$                   ▹ pure delay $\approx N\Delta t$

Algorithm 3 Noise attack (narrowband sinusoidal injection)

1: Parameters: $\Delta t=10\mu$s, T samples, $f_{\mathrm{atk}}=1$ kHz, $V_{\mathrm{pp}}=0.5$ V 2: $A_{\mathrm{atk}}\leftarrow V_{\mathrm{pp}}/2$ 3: for $n=0$ to $T-1$ do 4:     $n_{\mathrm{atk}}\left[n\right]\leftarrow A_{\mathrm{atk}}sin\left(2\pi f_{\mathrm{atk}}n\Delta t\right)$ 5:     $s_{\mathrm{noisy}}\left[n\right]\leftarrow s_{\mathrm{orig}}\left[n\right]+n_{\mathrm{atk}}\left[n\right]$ 6: end for 7: Output: $s_{\mathrm{noisy}}[0:T-1]$

2.2.1. Bias Attack Modeling

A DC bias is injected on the voltage-sensing channel with scaling determined by the feedback divider and the injection site.

Note. With integral action (no saturation), the steady-state output shift follows $\Delta V_{\mathrm{out}}\approx -{\delta }_{\mathrm{eff}}/{\alpha }_{\mathrm{fb}}$; a positive bias at $v_{fb}$ causes the controller to perceive a higher voltage, reducing the duty and lowering $V_{\mathrm{out}}$.

2.2.2. Delay Attack Modeling

A fixed sensor path delay is realized by inserting a ring buffer operating at the sampling period.

Note. The effective pure delay is ${\tau }_{\mathrm{d}}\approx N\Delta t$. In experiments, we used $f_s=1/\Delta t=100$ kHz and $N=102$ (${\tau }_{\mathrm{d}}\approx 1.02$ ms).

2.2.3. Noise Injection Attack Modeling

Periodic interference is emulated by superimposing a narrowband sinusoid on the sensed voltage (or current).

2.2.4. Rationale for Attack Parameter Choices

Narrowband jamming at 1 kHz. (i) The tone lies inside the voltage loop bandwidth and well below the inference Nyquist (10 kHz/2), producing a measurable closed-loop response without aliasing; (ii) at $f_{\inf }=10$ kHz with $L=30$ (3.0 ms window), 1 kHz provides ≈3 cycles per decision window, stabilizing the score; (iii) it is spectrally far from switching harmonics at $k{f}_{\mathrm{sw}}$ (100 kHz, $k\ge 1$), so its effect appears in time-domain ripple $V_{r,pp}$ and regulation rather than the IRR defined around $k{f}_{\mathrm{sw}}$ bands.

Fixed delay $\tau \approx 1.02$ ms. Implemented by a ring buffer of length $N=102$ at $f_s=100$ kHz, this value purposefully erodes the phase margin to reveal the low-frequency modulation (∼120–130 Hz) predicted by ${\varphi }_{\mathrm{delay}}\left(f\right)=-{360}^{\circ }f\tau$ and corroborated in the hardware, while remaining safe for the rig.

Bias magnitude. The commanded offset was chosen so that the effective feedback-node bias yields a steady-state output shift $\Delta V_{out}\approx -{\delta }_{\mathrm{eff}}/{\alpha }_{\mathrm{fb}}\approx -0.21$ V at 12 V (about $1.75\%$), i.e., near but within the $\pm 2\%$ regulation limit, exercising the detector without violating the safety box.

Attack window (50–70 ms) and amplitude. A 20 ms window covers ∼20 cycles at 1 kHz and allows a consistent latency estimate under the $N=3$ rule; amplitudes are set so that the closed-loop $V_{r,pp}$ and DC regulation remain within the limits in the no CI actuation hardware runs.

Figure 1 summarizes the pathway from physical sensor manipulation to the internal control response.

2.2.5. Real-World Scenarios (EV/PV/ESS)

We consider field-plausible disturbances that affect the same safety box metrics ($V_{r,pp}$, IRR, ±2% regulation) and the detector’s score: (i) supply-side ripple/jamming on $V_{in}$ (hundreds of Hz–few kHz; within loop bandwidth), (ii) sensor bias/drift at the divider or ADC path, (iii) a fixed sensor path delay from buffering/firmware (sub-ms–few ms), (iv) narrowband EMI on sense lines (e.g., ∼1 kHz). All cases are evaluated with the same decision rule ($\tau =\mu +3\sigma$, $N=3$).

Real-world scenarios and their primary effects are summarized in

Table 4. Real -world scenarios and primary effects.

Domain	Typical Disturbance (Site)	Primary Effect
EV (12/48 V)	Supply ripple on $V_{in}$; harness/ground; 0.5–5 kHz	$V_{r,pp}\uparrow$, IRR $\uparrow$; small regulation error unless severe; score rises at tone(s).
PV DC-link	MPPT/load transitions; sensor bias/drift (divider/ADC)	Transient regulation excursions; DC shift per bias; score increases after onset.
ESS/Industrial	Fixed delay $\tau$ (buffer/firmware); sense -line EMI (≈1 kHz)	Phase margin loss ⇒ ∼${10}^2$ Hz modulation (delay); narrowband component; few ms detection latency.

Notes. Arrows denote direction/effect: ↑ = increase, ↓ = decrease, and ⇒ = “leads to/manifests as.” “tone(s)” indicates narrowband spectral components at the disturbance frequency (and harmonics/sidebands) observed in the ripple metrics.

.

2.3. Physics-Informed LSTM Model Structure

We adopt an LSTM autoencoder that embeds the buck converter physics as discrete-time residual constraints. The offline model uses an encoder (64→32) and a decoder (32→64) with input window length $L=30$ samples. For real-time deployment, we use a distilled single-layer PI–LSTM ($n_x=4$, $n_h=32$) derived from the same objective [31,32,33].

2.3.1. Time-Base Convention (Simulation vs. Hardware)

The simulation uses the controller-rate stream with $\Delta t$ = 10 µs ($f_s=100$ kHz) and  $L=30$ (window $0.30$ ms). On hardware, the ADC runs at 100 kHz but inference uses decimation by $M=10$ ($f_{\inf }=10$ kHz), so the same $L=30$ spans $3.0$ ms. Decisions advance every $0.1$ ms and adopt an $N=3$ consecutive-samples rule (lower-bound add-on $\approx 0.2$ ms).

Figure 2 shows the architecture of the proposed PI–LSTM autoencoder.

The training hardware, dataset size, optimization settings, wall clock time, and memory footprint are summarized in

Table 5. PI–LSTM training resources and time (single-GPU run).

Item	Value
GPU/CPU/RAM	RTX 5070Ti (12 GB)/Core7 255HX/64 GB
Framework	PyTorch 2.2 (CUDA 12); data via MATLAB R2024a
Dataset windows ($L=30$)	∼180,000 (80/10/10 split)
Batch/LR schedule	128/${10}^{-3}\to {10}^{-4}$ (cosine)
Early stopping	Patience 10 epochs
Epochs (median)	35–55 (42)
Wall clock (median)	65–85 min (74 min)
Peak GPU memory	2.1–2.4 GB (FP32)
Checkpoint size	∼7.5 MB (offline model)
Distillation time	10–15 min → $(n_x=4,n_h=32)$

.

2.3.2. Hyperparameter Selection and Validation Protocol

Invariants. The decision rule (threshold $\tau =\mu +3\sigma$ from benign data; $N=3$ consecutive samples) and the input window $L=30$ were fixed to preserve real-time latency and ensure fair comparison across methods.

Search space. We considered hidden size $n_h\in \{16,32,64\}$, physics weight ${\lambda }_{\mathrm{phys}}\in \{0,0.05,0.10,0.20\}$, batch size $\in \{64,128\}$, initial learning rate $\in \{{10}^{-3},5\times {10}^{-4}\}$ with either cosine decay to ${10}^{-4}$ or a 0.1 step at 75% of the max epochs, dropout $\in \{0,0.1\}$ (on the LSTM output), weight decay $\in \{0,{10}^{-5}\}$, and optimizer $\in \left\{\mathrm{Adam}\right({\beta }_1=0.9,$ ${\beta }_2=0.999),\mathrm{SGD}(\mathrm{mom}.=0.9)\}$.

Protocol. Data were split 80/10/10 (train/val/test). For each candidate, we trained up to 80 epochs with early stopping (patience 10). Model selection used the validation macro-F1 (averaged over the three attacks) under the constraint “alarm-wise FPR $\le 2\%$”; latency served as a tiebreaker. Each configuration was repeated with three random seeds; we chose the median performer.

Chosen configuration. Adam with cosine decay (initial ${10}^{-3}\to {10}^{-4}$), batch 128, $n_h=32$, ${\lambda }_{\mathrm{phys}}=0.10$, dropout 0, weight decay ${10}^{-5}$. This offline model is then distilled to the runtime single-layer PI–LSTM $(n_x=4,n_h=32)$ used on the DSP (Section 4.2).

2.3.3. Cross-Validation and Leakage Control

Fold construction. We use grouped, stratified 5-fold cross-validation on the simulation corpus. Folds are created at the run/trajectory level (not per window) to prevent temporal leakage; class balance (benign vs. each attack) and operating point diversity are preserved across folds.

Per-fold protocol. For each fold, models are trained on 4 folds with early stopping (patience 10). The decision rule is identical to deployment: threshold $\tau =\mu +3\sigma$ computed from benign data of the training side only and an $N=3$ consecutive-samples policy. Hyperparameters follow the selected configuration (Adam with cosine decay, $n_h=32$, ${\lambda }_{\mathrm{phys}}=0.10$, batch 128), i.e., we assess the generalization of the chosen setting rather than retuning in each fold.

Reporting. We aggregate per-fold metrics as mean ±95% confidence intervals: macro-F1 (averaged over bias/delay/noise), alarm-wise FPR, and detection latency (median [IQR]). A 5-fold outcome is macro-F1 $94.9\pm 0.6\%$, FPR $1.0\pm 0.3\%$, and latency $3.2$ ms [2.8–3.9] under the fixed rule. Hardware results remain reported separately and unchanged.

Inputs/outputs. Inputs are $[V_{\mathrm{in}},V_{\mathrm{out}},i_L,d]$; the decoder reconstructs $[\widehat{V_{\mathrm{in}}},\widehat{V_{\mathrm{out}}},\widehat{i_L},\widehat{d}]$. The anomaly score is the reconstruction error; the decision rule is fixed ($\tau =\mu +3\sigma$, $N=3$).

Discrete-time physical constraints (no label leakage). Let $N_b$ denote the number of time steps summed over a batch. The total loss is the weighted sum of data loss and physics residual loss; residuals are evaluated on decoder outputs at k and $k+1$:

$$\begin{array}{cc}\hfill L_{\mathrm{total}}& =L_{\mathrm{data}}+{\lambda }_{\mathrm{phys}}{L}_{\mathrm{phys}},\hfill \\ \hfill L_{\mathrm{phys}}& ={\displaystyle \frac{1}{N_b}}\sum _{k=0}^{N_b-2}{\left(\widehat{V_{\mathrm{out}}}\left[k+1\right]-\widehat{V_{\mathrm{out}}}\left[k\right]-\frac{\Delta t}{C}\left(\widehat{i_L}\left[k\right]-\frac{\widehat{V_{\mathrm{out}}}\left[k\right]}{R}\right)\right)}^2\hfill \end{array}$$

(3)

$$\begin{array}{cc}\hfill & +{\left(\widehat{i_L}\left[k+1\right]-\widehat{i_L}\left[k\right]-\frac{\Delta t}{L}\left(\widehat{V_{\mathrm{in}}}\left[k\right]\widehat{d}\left[k\right]-\widehat{V_{\mathrm{out}}}\left[k\right]\right)\right)}^2.\hfill \end{array}$$

(4)

We use ${\lambda }_{\mathrm{phys}}=0.1$. (Optionally, midpoint collocation between k and $k+1$ can be added to reduce discretization errors).

2.4. Physics-Informed Learning Framework

The PI–LSTM enforces the discrete-time converter dynamics during training, which (i) improves generalization beyond the training distribution, (ii) reduces noise sensitivity, and (iii) enhances interpretability by checking the physical consistency of reconstructions. The discrete-time formulation aligns with fixed-step Simulink solvers and is compatible with real-time deployment [34,35,36].

Context in the Broader PINN Literature

Physics-informed learning has been widely adopted beyond power electronics, e.g., forward/inverse PDEs in fluids and solids [15,16,17,18], with landmark demonstrations such as hidden fluid mechanics [19]. More broadly, theory-guided data science argues for embedding domain constraints directly into learning objectives [20]. Our PI–LSTM follows the same principle by enforcing discrete-time circuit residuals (rather than continuous PDEs), aligning with fixed-step control implementations.

2.5. CI-Guided Intentional Performance Degradation (Unified with DC Rail Ripple Metrics)

When the anomaly score $s_k$ exceeds the threshold $\tau$ for N consecutive samples, we enable a safety-bounded performance adjustment. The confusion index (CI) aggregates efficiency deviation and DC rail ripple metrics (time-domain $V_{r,\mathrm{pp}}$ and frequency-domain $\mathrm{IRR}$) using normalizers identical to the safety box limits [37,38]:

$$\begin{array}{cc}\hfill z& =[\eta ,V_{r,\mathrm{pp}},\mathrm{IRR}],{\eta }^{\star }=\mathrm{nominal}\mathrm{efficiency},\hfill \\ \hfill p_{\eta }& =clip\left(\frac{{\eta }^{\star }-\eta }{{\eta }^{\star }},0,1\right),p_{r,\mathrm{time}}=clip\left(\frac{V_{r,\mathrm{pp}}}{240\mathrm{mV}},0,1\right),p_{r,\mathrm{freq}}=clip\left(\frac{\mathrm{IRR}}{2\%},0,1\right),\hfill \\ \hfill \mathrm{CI}& =w_{\eta }{p}_{\eta }+w_{r,\mathrm{time}}{p}_{r,\mathrm{time}}+w_{r,\mathrm{freq}}{p}_{r,\mathrm{freq}},w_{\eta }+w_{r,\mathrm{time}}+w_{r,\mathrm{freq}}=1.\hfill \end{array}$$

(5)

Safety box (also used as CI normalizer).

$$\begin{array}{cccc}\hfill |V_{\mathrm{out}}-V^{\star }|& \le \pm 2\%,\hfill & \hfill V_{r,\mathrm{pp}}& \le 240\mathrm{mV},\hfill \\ \hfill \mathrm{IRR}& \le 2\%,\hfill & \hfill I_L^{\mathrm{rms}}& \le I_{max},T_j\le T_{j,max}.\hfill \end{array}$$

(6)

IRR convention. Unless otherwise noted, the IRR is computed via the Welch PSD (Hann, 50% overlap) integrating $\pm \Delta f=0.5$ kHz around the first $K=5$ switching harmonics; the same $(\Delta f,K)$ and limit $2\%$ are used in both the safety box and CI.

Actuation law (bounded by safety margins).

$$\begin{array}{cc}\hfill \alpha & =sat\left(\mathrm{CI}\right),\alpha \in [0,{\alpha }_{max}],\hfill \\ \hfill V_{\mathrm{ref}}& \leftarrow V_{\mathrm{ref}}(1-k_v\alpha ),d\leftarrow d(1-k_d\alpha ),f_{sw}\leftarrow f_0(1\pm k_f\alpha ),\hfill \end{array}$$

(7)

with immediate backoff when any constraint in Equation (6) approaches violation.

The CI-guided deception routine under the unified safety box is summarized in Algorithm 4.

Algorithm 4 CI-guided deception under a unified safety box

Require:  score $s_k$, threshold $\tau$, persistence N, hysteresis $T_{\mathrm{hys}}$   1: if $s_{k-N+1},\dots ,s_k>\tau$ then   2:     $p_{\eta }\leftarrow clip(({\eta }^{\star }-\eta )/{\eta }^{\star },0,1)$   3:     $p_{r,\mathrm{time}}\leftarrow clip(V_{r,\mathrm{pp}}/240\mathrm{mV},0,1)$   4:     $p_{r,\mathrm{freq}}\leftarrow clip(\mathrm{IRR}/2\%,0,1)$   5:     $\mathrm{CI}\leftarrow w_{\eta }{p}_{\eta }+w_{r,\mathrm{time}}{p}_{r,\mathrm{time}}+w_{r,\mathrm{freq}}{p}_{r,\mathrm{freq}}$   6:     $\alpha \leftarrow sat\left(\mathrm{CI}\right)$                          ▹$\alpha \in [0,{\alpha }_{max}]$   7:     $V_{\mathrm{ref}}\leftarrow V_{\mathrm{ref}}(1-k_v\alpha )$;   $d\leftarrow d(1-k_d\alpha )$;   $f_{sw}\leftarrow f_0(1\pm k_f\alpha )$   8:     if any limit in Equation (6) is near violation then $\alpha \leftarrow \beta \alpha$ end if   ▹$0<\beta <1$   9: else 10:     if $s_k<\tau$ for $T_{\mathrm{hys}}$ then ramp $\alpha \to 0$ and restore nominal settings end if 11: end if

The unified CI weights, ripple limits, and actuation gains are listed in

Table 6. CI weights, limits, and actuation gains (unified with the safety box).

Item	Value	Note
$w_{\eta },w_{r,\mathrm{time}},w_{r,\mathrm{freq}}$	$0.5,0.3,0.2$	for $[\eta ,V_{r,\mathrm{pp}},\mathrm{IRR}]$
$240\mathrm{mV},2\%$	$240\mathrm{mV}$, $2\%$	also used as CI normalizers
${\alpha }_{max}$	$0.35$	deception cap
$k_v,k_d,k_f$	$0.04,0.03,0.05$	ref/duty/freq gains
$N,T_{\mathrm{hys}}$	3 samples, 10 ms	persistence/hysteresis

.

3. Simulation Results and Analysis

3.1. Simulation Environment Setup

Simulations were conducted in MATLAB R2024a. Key settings are summarized in

Table 7. Simulation parameters.

Parameter	Value	Unit
Simulation time	0.1	s
Sampling interval	10	µs
Total samples	10,000	—
Attack start time	50	ms
Attack duration	20	ms
Sampling frequency	100	kHz
Measurement noise	1	%

Decision rule: see Section 4.3 for the fixed decision rule.

.

Classical Baselines (EKF Residual and Shewhart)

EKF residual. Using the averaged buck model, the innovation $r_k=y_k-C{\widehat{x}}_{k|k-1}$ with covariance $S_k=C{P}_{k|k-1}{C}^{\top }+R$ yields the normalized statistic $z_k=r_k^{\top }{S}_k^{-1}{r}_k$. A binary alarm is raised when $z_k$ exceeds a fixed threshold $\tau =\mu +3\sigma$ estimated from benign data, with an $N=3$ consecutive-samples rule (identical to PI–LSTM).

Shewhart detector. As a lightweight classical baseline, we apply a Shewhart test on the scalarized residual norm $\parallel r_k{\parallel }_2$ (or an equivalent sample-wise statistic) using the same decision policy (see Section 4.3 for the fixed decision rule). Both baselines use exactly the same signal windows, normalization, and evaluation metrics as for PI–LSTM (F1, alarm-wise FPR, latency), ensuring a fair comparison.

Figure 3 shows deviations from the nominal trajectory for the three sensor-side attacks. The mean detection latencies reported later in

Table 8. Attack detection performance in simulation (mean over $n=1000$ runs per attack).

Metric	Bias	Delay	Noise
Accuracy (%)	96.24	91.98	97.51
Precision (%)	94.83	90.12	96.89
Recall (%)	97.45	93.78	98.12
F1 score (%)	96.12	91.91	97.50
Detection latency after onset (ms)	2.88	3.95	2.59

Decision rule and time base: see Section 4.3 for the fixed decision rule. Hardware uses the 10 kHz inference stream with the same window $L=30$ (3.0 ms).

(2.88 ms, 3.95 ms, 2.59 ms for bias, delay, noise) are computed as the arithmetic mean over $n=1000$ runs; the corresponding standard deviations ($\pm 0.15$–$0.22$ ms) confirm statistical consistency under the fixed decision rule above.

3.2. Benchmark Dataset Domain Alignment (Auxiliary Evaluation)

We primarily evaluate in-domain (DC–DC buck converters) data from simulations and our DSP-based prototype. To probe cross-domain generalization on public data, we additionally use an inverter-driven PMSM dataset (Zenodo) [39]. Because the PMSM domain differs from a DC–DC buck, we treat it strictly as an auxiliary benchmark and apply the following protocol before training/evaluation.

1.

Signal mapping. Select PMSM signals that are physically analogous to our inputs $[v_{\mathrm{in}},$$v_{\mathrm{out}},i_L,d]$ (e.g., DC bus voltage/current and duty or normalized gate command). Exclude non-analogous mechanical variables from the core feature set.

2.

Sampling (no upsampling). Use all PMSM signals at their native 10 Hz sampling rate (no upsampling or resampling). Apply per-window mean removal (AC coupling) and z-score normalization computed on benign segments. The decision rule is identical to the buck study: threshold $\tau =\mu +3\sigma$ and an $N=3$ consecutive-samples policy.

3.

Attack semantics. When labels exist (bias/delay/noise), retain them. Otherwise, inject attacks consistent with our threat model (bias at the sensor tap; fixed-sample delay; a narrowband sinusoid at a frequency resolvable under 10 Hz Nyquist) to preserve semantic alignment.

4.

Metrics separation. DC rail power quality metrics ($V_{r,\mathrm{pp}}$, IRR) are not computed for PMSM. We report only detection metrics (accuracy, F1, AUC, alarm-wise FPR) for PMSM, and we do not compare the absolute latencies between the PMSM and buck domains.

We emphasize that all principal claims (e.g., safety box compliance and CI analysis) are supported by the buck domain. The PMSM results serve only as an auxiliary generalization check under a standardized preprocessing pipeline.

3.2.1. Auxiliary PMSM Dataset: Sampling Rate Disclosure and Verification

To avoid ambiguity about the public PMSM drive dataset used in the auxiliary evaluation, we explicitly consume it at its native time base. We verified from the provided time stamps that the inter-sample interval was effectively constant at $\Delta t=0.10$ s (10 Hz) up to file-level rounding tolerance. Accordingly, we perform no upsampling/resampling; all preprocessing (per-window mean removal; z-score normalization on benign segments) operates on the 10 Hz stream. When labels are absent and synthetic perturbations are injected to align with our threat model, their frequencies are chosen to be resolvable under the 5 Hz Nyquist limit (i.e., $f_{\mathrm{atk}}<5$ Hz) with durations exceeding three periods. As emphasized in the main text, DC rail quality metrics ($V_{r,pp}$, IRR) and millisecond-scale latency are not computed for this dataset; only detection metrics are reported.

3.2.2. Detector Configuration at Low Rate

For PMSM, the detector window is $L=30$ samples at 10 Hz (3.0 s). With the same $N=3$ rule, the alarm persistence is approximately 0.3 s.

3.3. Attack Detection Performance Analysis

We evaluate the detection performance for each attack via Monte Carlo simulation with $n=1000$ runs per attack type [40,41]. Table 8 reports aggregate metrics.

Classical detectors under the identical decision protocol are summarized in

Table 9. Classical detectors under an identical decision protocol ($\tau =\mu +3\sigma$, $N=3$).

Method	Accuracy (%)	FPR (%)	Latency (ms)	Hardware (Target/Footprint)
EKF (residual)	90.5	3.8	3.6–5.0	MCU/DSP; state+cov <10 kB
Shewhart (residual norm)	88.0	6.7	3.8–5.2	MCU/DSP; negligible
Fuzzy logic (rule-based)	89.0	5.4	3.5–5.0	MCU/DSP; ∼10–20 rules
PI–LSTM (ours)	∼95.24	≤1.2	2.9–4.2	TMS320F28379; ∼18.5 kB params

Protocol: All methods use identical windows, preprocessing, and the same decision persistence ($N=3$). PI–LSTM macro-average follows Table 8 (per attack: 96.24% bias, 91.98% delay, 97.51% noise).

.

Additional Baselines: SVM and Random Forest

Featurization and fairness. For classical classifiers, each window ($L=30$) is vectorized by stacking the $[V_{\mathrm{in}},V_{\mathrm{out}},i_L,d]$ samples (z-scored per channel), yielding a $4\times 30$ vector. SVM (linear) and random forest (200 trees, depth $\le 8$) are trained in a supervised manner on benign/attack labels; decisions follow the same alarm policy (see Section 4.3 for the fixed decision rule); the class score threshold is 0.5. Windows, normalization, and metrics match those for PI–LSTM.

Windowed classifiers (SVM, RF) under the identical decision protocol are summarized in

Table 10. Windowed classifiers (SVM, RF) under an identical decision protocol.

Method	Accuracy (%)	FPR (%)	Latency (ms)	Hardware (Target/Footprint)
SVM (linear)	92.0	3.2	3.4–4.5	MCU/DSP; weights <50 kB
Random Forest (200×, $d\le 8$)	93.2	2.5	3.3–4.3	MCU-class feasible; ∼300 kB
PI–LSTM (ours)	∼95.24	≤1.2	2.9–4.2	TMS320F28379; ∼18.5 kB

Notes. Same windows/normalization; for decision policy, see Section 4.3 for the fixed decision rule (classifier score threshold 0.5).

.

ROC summary. AUCs are 0.984 (bias), 0.921 (delay), and 0.991 (noise); delay is comparatively harder to detect. Under the same decision rule, the alarm-wise false-positive rates in the simulation are 0.8% (bias), 1.2% (delay), and 0.6% (noise); hardware measurements are ≤1.2% (see Section 4.3).

Figure 4 shows the ROC curves of the PI–LSTM for the three attacks; the AUCs are 0.984 (bias), 0.921 (delay), and 0.991 (noise), indicating that the delay is comparatively harder to determine. The diagonal line marks random guessing; curves closer to the upper-left corner indicate better detection.

Figure 5 shows clear benign/attack separation relative to the benign-only threshold ($\tau =\mu +3\sigma$; Section 4.3); the delay exhibits the largest overlap, consistent with the lower AUC. In Figure 6, latencies are ordered as noise < bias < delay with tight IQRs over n = 1000 runs, aligning with Table 8.

3.4. Public Benchmark Comparison

For auxiliary validation, we use the Comprehensive Dataset for Fault Detection and Diagnosis in Inverter-Driven PMSM Systems (Zenodo) [39]. This PMSM drive dataset provides multi-sensor measurements at a native 10 Hz sampling rate across multiple operating conditions and fault modes. We treat it strictly as a cross-domain benchmark: signals are used at their native rate (no upsampling), channels are standardized (z-score on benign segments) with per-window mean removal, and we report detection metrics only (accuracy, F1, AUC, alarm-wise FPR). No $V_{r,\mathrm{pp}}$, IRR, or millisecond latency comparisons are computed for this dataset [42,43].

We compare four methods:

• ARIMA (residual $\mu +3\sigma$ threshold);
• Isolation Forest (100 trees, 4 features);
• CNN–LSTM Autoencoder (1D-CNN→LSTM; reimplementation of [44]);
• Proposed PI–LSTM (${\lambda }_{\mathrm{physics}}=0.1$).

Hyperparameters (batch size {64, 128}, learning rate {${10}^{-3}$, ${10}^{-4}$}) are selected by grid search. Each method is evaluated over five independent training trials; we report the mean and 95% confidence intervals (AUC CIs via bootstrap, $B=1000$).

The auxiliary PMSM benchmark with classical baselines (native 10 Hz, no upsampling) is summarized in

Table 11. Auxiliary PMSM benchmark (classical baselines; native 10 Hz; no upsampling).

Method	Accuracy (%)	F1 (%)	AUC	FPR (%)
ARIMA	$85.3\pm 1.2$	$83.7\pm 1.5$	$0.912\pm 0.005$	$12.8\pm 1.0$
Isolation Forest	$88.1\pm 0.9$	$86.9\pm 1.0$	$0.934\pm 0.004$	$9.5\pm 0.8$

Notes. Decision rule: $\tau =\mu +3\sigma$ with $N=3$ consecutive samples. Confidence intervals follow the same procedure as in the main text.

.

The auxiliary PMSM benchmark (native 10 Hz, no upsampling) is summarized in

Table 12. Auxiliary PMSM benchmark (neural and proposed methods; native 10 Hz; no upsampling).

Method	Accuracy (%)	F1 (%)	AUC	FPR (%)
CNN–LSTM AE	$92.5\pm 0.7$	$91.8\pm 0.8$	$0.961\pm 0.003$	$6.2\pm 0.6$
PI–LSTM (proposed)	$\mathbf{96}.\mathbf{4}\pm \mathbf{0}.\mathbf{5}$	$\mathbf{95}.\mathbf{9}\pm \mathbf{0}.\mathbf{6}$	$\mathbf{0}.\mathbf{987}\pm \mathbf{0}.\mathbf{002}$	$\mathbf{3}.\mathbf{5}\pm \mathbf{0}.\mathbf{4}$

Notes. Same decision rule ($\tau =\mu +3\sigma$, $N=3$). For this auxiliary dataset, DC rail ripple metrics and ms-scale latency are not reported.

.

The proposed PI–LSTM improves the F1 by 4.0–12.2 percentage points and the AUC by 0.026–0.075 versus the baselines, while more than halving the alarm-wise FPR relative to ARIMA/isolation forest, indicating robust cross-domain generalization under a consistent decision rule [45,46].

3.5. CI-Guided Deception Under a Unified Safety Box (Simulation Only)

Normalization and limits follow the unified safety box and CI definitions. See Section 2.5, Equations (5) and (6). The decision rule matches detection (threshold $\tau =\mu +3\sigma$, $N=3$, refractory $T_{\mathrm{hys}}=10$ ms).

Canonical reference. All mentions of the “safety box”, its limits/normalizers, and CI normalization elsewhere in the paper refer to Equations (5) and (6) in this subsection.

CI weighting: rationale and sensitivity. Weights $(w_{\eta },w_{r,\mathrm{time}},w_{r,\mathrm{freq}})$ prioritize safety box margins while penalizing efficiency loss; the baseline $(0.5,0.3,0.2)$ in Table 6 reflects (i) user-visible ripple ($V_{r,\mathrm{pp}}$), (ii) spectral in-band content (IRR), and (iii) energy overhead via $p_{\eta }$. We ablate alternative weightings at the operating point used in

Table 13. Performance degradation under CI actuation (simulation; limits reused for normalization).

Metric	Normal	After Detection	Normalized Value
Efficiency (%)	92.3	85.0	$p_{\eta }={\displaystyle \frac{0.923-0.850}{0.923}}\approx 0.08$
IRR (%)	0.15	0.30	$p_{r,\mathrm{freq}}={\displaystyle \frac{0.30}{2\%}}=0.15$
Output ripple $V_{r,\mathrm{pp}}$ (mV)	30	144	$p_{r,\mathrm{time}}={\displaystyle \frac{144}{240\mathrm{mV}}}=0.60$
Confusion index	0	$0.5·0.08+0.3·0.60+0.2·0.15\approx 0.25$	–

Normalization/limits per the unified safety box; the point stays within bounds. See Section 2.5, Equations (5) and (6).

.

CI sensitivity to weight choices at the representative point is summarized in

Table 14. CI weight sensitivity at a point (same $p_{\eta },p_{r,\mathrm{time}},p_{r,\mathrm{freq}}$ as Table 13: $0.08$, $0.60$, $0.15$).

Weights	${\mathit{w}}_{\mathit{\eta }}$	${\mathit{w}}_{\mathit{r},\mathbf{time}}$	${\mathit{w}}_{\mathit{r},\mathbf{freq}}$	CI (Computed)
Baseline (Table 6)	0.50	0.30	0.20	0.25
Ripple-heavy	0.30	0.40	0.30	0.27
Efficiency-heavy	0.60	0.20	0.20	0.24
Equal weights	0.33	0.33	0.34	0.26

Notes: CI varies within $\pm 0.03$ across these settings; safety constraints remain satisfied, ${\alpha }_{max}$ is unchanged, and attack severity ranking did not change in our runs. An extended grid and per-scenario traces are provided in Supplementary File S3.

.

Figure 7 shows that, under CI-guided actuation, the trajectory remains within the unified safety box and returns to the nominal region after the attack. See Section 2.5, Equations (5) and (6). Letter markers denote phases (N: nominal; A: under attack; D: actuation engaged; R: recovery). Actuation is triggered when $\mathrm{CI}>\tau$ for $N=3$ consecutive samples and then drives the operating point toward lower $V_{r,\mathrm{pp}}$ and lower $\mathrm{IRR}$ until re-entry; after release with hysteresis, the point returns to N. Short segments near A and R may visually overlap due to the sampling step; the letter markers disambiguate the phase transitions even when path segments appear superimposed.

Scope and Hardware Linkage

The hardware experiments in this paper validate the detection path only (latency/FPR). Without CI actuation on hardware, the $V_{r,\mathrm{pp}}$ and IRR stayed within the limits, while the $\pm 2\%$ regulation window was occasionally exceeded under delay (peak $\approx 2.8\%$; see Section 4.3). Demonstrating CI-guided actuation under the full safety box on hardware is left to future work.

3.6. Effect of Physical Constraints

We compare a conventional data-driven LSTM with the proposed physics-informed LSTM (PI–LSTM) to quantify the benefit of enforcing discrete-time converter dyna- mics [47,48].

Table 15. Conventional LSTM vs. PI–LSTM.

Metric	Conventional LSTM	PI–LSTM
F1 score (%)	89.3	95.2
FPR (alarm-wise, %, $N=3$)	12.4	5.8
PVR (%)	15.2	2.1

reports average test metrics; “FPR” is the alarm-wise false-positive rate with the $N=3$ consecutive-samples rule, and “PVR” (physical violation rate) is the fraction of time steps whose reconstructions violate the discrete-time residual constraints beyond a fixed tolerance.

Figure 8 summarizes the aggregate test metrics for the two models. Consistent with Table 15, the PI–LSTM attains a higher F1 score (95.2 vs. 89.3) and substantially lower false-positive rate (5.8% vs. 12.4%) and physical violation rate (2.1% vs. 15.2%). Interpreting the axes, higher is better for the F1, whereas lower is better for the FPR and PVR. The relative changes shown in Equations (8)–(10) quantify these gains.

Relative changes are as follows:

$$\begin{array}{cc}\hfill \mathrm{F}1\mathrm{improvement}& ={\displaystyle \frac{95.2-89.3}{89.3}}\times 100\%\approx 6.61\%,\hfill \end{array}$$

(8)

$$\begin{array}{cc}\hfill \mathrm{FPR}\mathrm{reduction}& ={\displaystyle \frac{12.4-5.8}{12.4}}\times 100\%\approx 53.23\%,\hfill \end{array}$$

(9)

$$\begin{array}{cc}\hfill \mathrm{PVR}\mathrm{reduction}& ={\displaystyle \frac{15.2-2.1}{15.2}}\times 100\%\approx 86.18\%.\hfill \end{array}$$

(10)

These results indicate that the PI–LSTM improves the anomaly detection accuracy while substantially lowering false alarms and physics law violations, supporting deployability on real hardware [49,50].

Figure 9 contrasts the normalized reconstruction error trajectories of a conventional LSTM and the proposed PI–LSTM under a delay attack at $f_s=100\mathrm{kHz}$ with window $L=30$ ($N=3$ rule). The PI–LSTM exhibits fewer spurious excursions above its threshold, consistent with the lower FPR in Table 15.

4. Experimental Setup and Results

4.1. Experimental Setup

A 24 V→12 V buck converter prototype was built to validate the simulation findings. Hardware parameters matched the simulation: $V_{in}=24$ V, $V_{out}=12$ V, $R_{\mathrm{load}}\approx 10\Omega$, $f_{sw}=100$ kHz (CCM), $L=100$ µH, and $C=470$ µF. Figure 10 shows the experimental setup used for hardware evaluation.

Real-time inference ran on a TMS320F28379 DSP. We deployed a distilled single-layer PI–LSTM ($n_x=4$, $n_h=32$) on a decimated stream ($M=10$, $f_{\inf }=10$ kHz). The anomaly score is the reconstruction error. We use the same decision rule as in the simulation ($\tau =\mu +3\sigma$, $N=3$), with hysteresis $T_{\mathrm{hys}}=10$ ms. Sensing used isolated differential amplifiers for $v_{out}$ and a Hall effect sensor for $i_L$. Signals were sampled at $f_s=100$ kHz and processed in FP32. Matrix multiplications used DSPLib; activations used branch-free piecewise-linear approximations. The DSP TMU was not used for neural activations [51,52].

We injected three sensor path attacks with an auxiliary module placed between the sensors and the ADC:

1.

DC bias with calibrated mapping to the feedback path;

2.

Fixed sample delay $\tau \approx 1.02$ ms (FIFO at $f_s=100$ kHz);

3.

Narrowband sinusoidal injection at 1 kHz ($0.5$ ${\mathrm{V}}_{\mathrm{pp}}$).

4.1.1. Measurement Protocol and Definitions

A DSO with a 20 MHz bandwidth limit was used under AC coupling for switching ripple ($V_{r,pp}$), whereas DC coupling was used for DC regulation and for step/bias/delay tests. For frequency-domain assessment, the in-band ripple ratio (IRR) was computed from a Welch PSD (Hann, 50% overlap). Unless otherwise noted, we used $\Delta f=0.5$ kHz and $K=5$, a scope sampling rate ≥10 MS/s, and records ≥1 Mpts; the same $(\Delta f,K)$ are used in the confusion index (CI) calculation.

$$\begin{array}{cc}\hfill {\tilde{v}}_o\left(t\right)& =v_o\left(t\right)-(at+b),\text{(local linear detrend on an AC-coupled gate)}\hfill \end{array}$$

(11)

$$\begin{array}{cc}\hfill V_{r,pp}& =\underset{\mathcal{W}}{max}{\tilde{v}}_o-\underset{\mathcal{W}}{min}{\tilde{v}}_o,\mathcal{W}:N_{\mathrm{sw}}=5\text{–}10\mathrm{periods}\hfill \end{array}$$

(12)

$$\begin{array}{cc}\hfill V_{\mathrm{inband},\mathrm{rms}}^2& =\sum _{k=1}^K{\int }_{k{f}_{\mathrm{sw}}-\Delta f}^{k{f}_{\mathrm{sw}}+\Delta f}{S}_{vv}\left(f\right)df,\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill \mathrm{IRR}& ={\displaystyle \frac{V_{\mathrm{inband},\mathrm{rms}}}{V_{\mathrm{out},\mathrm{DC}}}}.\hfill \end{array}$$

(14)

Standard alignment for DC voltage quality and ripple. Our DC rail measurements follow widely used guidance: automotive DC voltage quality and superimposed ripple per ISO 16750-2 (electrical loads, including superimposed AC) [53] and ISO 21780 (48 V supply ranges and slow transients) [54]; product/EMC requirements for switch-mode PSUs per IEC 61204-3 [55]; and ripple/noise measurement practice using a 20 MHz oscilloscope bandwidth limit with local bypass at the connector, as in the Intel ATX12V design guide and oscilloscope vendor application notes. Accordingly, $V_{r,\mathrm{pp}}$ is taken on an AC-coupled trace with a 20 MHz limit and a short ground spring, and the $\mathrm{IRR}$ is reported as a frequency-domain complement with explicit settings in

Table 16. IRR computation settings used in hardware measurements.

Item	Setting
Scope sampling rate	≥10 MS/s
Record length	≥1 Mpts
Welch estimator	Hann, 50% overlap
Integration band	$\pm 0.5$ kHz around $k{f}_{\mathrm{sw}}$ ($k=1\dots 5$)
Normalization	$V_{\mathrm{out},\mathrm{DC}}$ (mean of DC-coupled record)
Time-domain ripple	$V_{r,pp}$ from AC-coupled trace (20 MHz limit)

. (To our knowledge, no formal standard defines $\mathrm{IRR}$; we therefore state its definition and parameters explicitly [56,57]).

4.1.2. Compliance and Interpretation

DC regulation uses the DC-coupled record: $V_{\mathrm{out},\mathrm{DC}}$ is the mean of $v_o$ over an observation window (typically $T_{\mathrm{reg}}\ge 10$ ms); a violation occurs if $|V_{\mathrm{out},\mathrm{DC}}-V^{\star }|/V^{\star }>2\%$. The ripple metrics $V_{r,pp}$ (Equation (12)) and IRR (Equation (14)) are evaluated on AC-coupled data as defined above with limits per the safety box. (See Section 2.5, Equations (5) and (6)). By construction, the IRR excludes low-frequency components (e.g., the 120–130 Hz component observed under the delay attack), which instead contribute to the DC regulation error.

4.2. Real-Time Inference Budget on TMS320F28379

This deployment is an architecture-reduced variant of the offline autoencoder in Section 2.3, keeping the same score definition and decision rule ($\tau =\mu +3\sigma$, $N=3$). Signals are sampled at $f_s=100$ kHz ($\Delta t=10\mu$s); the streaming detector runs on a decimated stream with factor $M=10$ ($f_{\inf }=10$ kHz) using a fixed window $L=30$ (3.0 ms).

4.2.1. Analytic Complexity (per LSTM Layer)

For input size $n_x$ and hidden size $n_h$,

$$\mathrm{MAC}/\mathrm{step}=4n_h(n_x+n_h),\#{\theta }_{\mathrm{LSTM}}=4\left(n_h{n}_x+n_h^2+n_h\right),$$

(15)

and ≈5$n_h$ activation calls (four gates plus $tanh\left(c_t\right)$) per time step. Parameter memory is $b·\#\theta$ with $b=4$ B for FP32 (or 2 B for Q15).

4.2.2. Cycle Model

Let $c_{\mathrm{mac}}$ be cycles per MAC for GEMM and $c_{\mathrm{act}}$ be cycles per activation. The per-step cost is

$$C_{\mathrm{step}}\approx c_{\mathrm{mac}}·\mathrm{MAC}/\mathrm{step}+c_{\mathrm{act}}·\left(5n_h\right).$$

(16)

For $N_L$ layers over a window of length L, $C_{\inf }\approx {\sum }_{\ell =1}^{N_L}L{C}_{\mathrm{step}}^{(\ell )}$ [58].

4.2.3. Deployment Configuration (Example)

On a TMS320F28379 (200 MHz), we deploy a single-layer PI–LSTM with $(n_x,n_h)=(4,32)$ in FP32, GEMM via DSPLib, and branch-free PWL activations. Using $c_{\mathrm{mac}}\approx 2.0$ cycles/MAC and $c_{\mathrm{act}}\approx 10$ cycles,

$$\mathrm{MAC}/\mathrm{step}=4·32·(4+32)=4608,5n_h=160,$$

(17)

$$C_{\mathrm{step}}\approx 2.0\times 4608+10\times 160\approx 11\mathrm{kcycles}\Rightarrow \approx 55\mu \mathrm{s}/\mathrm{step}\mathrm{at}200\mathrm{MHz},$$

(18)

within the $0.1$ ms tick budget at $f_{\inf }=10$ kHz. Parameter memory is $\approx 18.5$ kB (FP32). The DSP TMU is not used for neural activations [52,59,60].

4.2.4. On-Board Measurement Protocol

We toggle a GPIO around lstm_step() and record the median over ${10}^4$ calls with compiler optimizations enabled. Latency is reported in absolute time from attack onset; the simulation uses $f_s=100$ kHz with $L=30$ ($0.30$ ms window), and hardware uses $f_{\inf }=10$ kHz with the same $L=30$ ($3.0$ ms window).

The DSP configuration and analytic compute/memory budget are summarized in

Table 17. DSP deployment: configuration and analytic budget.

Item	Value
Model config $(n_x,n_h)$	$(4,32)$
Arithmetic/activations	FP32/PWL (DSPLib GEMM)
Per-step MACs	4608
Per-step cycles (estimate)	≈11 kcycles
Per-step time @ 200 MHz (estimate)	≈55 µ$\mathrm{s}$
Parameter memory (FP32)	≈18.5 kB

.

On-board DSP deployment performance (TMS320F28379, 200 MHz) is summarized in

Table 18. DSP deployment: measured on-board performance (TMS320F28379, 200 MHz).

Item	Value
Measured step time (median)	54–58 µs (${10}^4$ calls, optimized build)
Jitter (peak-to-peak)	<4 µs
CPU load (LSTM only)	≈55%
Streaming predictor	$f_s=100$ kHz; decim. $M=10$ ($f_{\inf }=10$ kHz); $L=30$
Decision rule	$\tau =\mu +3\sigma$; $N=3$; $T_{\mathrm{hys}}=10$ ms

.

4.2.5. Bias Injection and Scaling

Let the feedback divider be $V_{fb}={\alpha }_{\mathrm{fb}}{V}_{out}$ with ${\alpha }_{\mathrm{fb}}=\frac{R_2}{R_1+R_2}$ (e.g., $12\mathrm{V}\to 3.3\mathrm{V}$ gives ${\alpha }_{\mathrm{fb}}\approx 0.275$). A software bias command ${\delta }_{\mathrm{cmd}}$ maps to an effective offset at the feedback node $V_{fb}$ as

$${\delta }_{\mathrm{eff}}=\left\{\begin{array}{cc}\beta {\delta }_{\mathrm{cmd}},\hfill & \mathrm{analog}\mathrm{injection}\mathrm{after}/\mathrm{before}\mathrm{the}\mathrm{divider}\hfill \\ {\displaystyle \beta \frac{{\kappa }_{\mathrm{dig}}}{k_{\mathrm{ADC}}}{\delta }_{\mathrm{cmd}},}\hfill & \mathrm{digital}\mathrm{path}\mathrm{via}\mathrm{ADC}\mathrm{codes},\mathrm{scaling}{\kappa }_{\mathrm{dig}}/k_{\mathrm{ADC}}\hfill \end{array}\right.$$

(19)

where $\beta =1$ if injected at $V_{fb}$ (post-divider) and $\beta ={\alpha }_{\mathrm{fb}}$ if injected pre-divider. Under integral action without saturation, the steady-state output shift follows

$$\Delta V_{out}\approx -{\displaystyle \frac{{\delta }_{\mathrm{eff}}}{{\alpha }_{\mathrm{fb}}}}.$$

(20)

Example. In our setup, a $+0.4$ V command yielded ${\delta }_{\mathrm{eff}}\approx 58$ mV at $V_{fb}$ and $\Delta V_{out}\approx -0.21$ V, consistent with Equation (20).

4.2.6. Delay Injection: Implementation and Validation

A fixed pure delay is introduced in the sensing pipeline (ADC→DMA→ISR→PI) via a ring buffer of length N at sampling frequency $f_s$:

$${\tau }_{\mathrm{est}}={\displaystyle \frac{N}{f_s}}.$$

(21)

With $f_s=100\mathrm{kHz}$ and $N=102$, we obtain ${\tau }_{\mathrm{est}}=1.02$ ms (≈100 $T_s$ for $T_s=10$ µs). Oscilloscope step-to-actuation timing (trigger at the reference step, measure gate driver change) gave

$${\tau }_{\mathrm{meas}}=1.02\pm 0.03\mathrm{ms}(n=10).$$

(22)

The additional phase lag from a pure delay is

$${\varphi }_{\mathrm{delay}}\left(f\right)=-2\pi f\tau \left[\mathrm{rad}\right]=-{360}^{\circ }f\tau \left[\mathrm{deg}\right],$$

(23)

which reduces the phase margin and can excite low-frequency oscillation when loop crossover shifts downward under delay stress.

4.2.7. Oscilloscope and Probing Settings

Unless otherwise noted, waveforms were acquired as follows.

• $v_{out}$: 10:1 passive probe with spring ground; bandwidth limit 20 MHz. AC coupling for ripple ($V_{r,pp}$); DC coupling for step/bias/delay tests.
• $i_L$: 20 MHz current probe, deskewed to the $v_{out}$ probe using a common step.
• Time windows: ripple at 5–10 switching periods (50–100 $\mu$s); low-frequency oscillation at 50–100 ms.
• Triggering: rising edge of the attack window marker or reference step; memory depth ≥1 Mpts; sample rate ≥10 MS/s (ripple captures often at 200 MS/s).

4.3. Detection Metrics: Latency and False Positives

Let $s\left[n\right]$ denote the anomaly score sampled at $\Delta t=1/f_s$. A fixed threshold $\tau$ is set from benign validation data as $\tau =\mu +3\sigma$. Decisions use an N-consecutive rule with an optional refractory period $T_{\mathrm{hys}}$

$$\mathrm{alarm}\mathrm{at}n\iff s[n+i]\ge \tau \forall i=0,\dots ,N-1,$$

(24)

and, once an alarm is issued, further alarms are suppressed for $T_{\mathrm{hys}}$.

4.3.1. Detection Latency

Let $t_0$ be the known attack onset and $t_a$ the earliest time index that satisfies the N-consecutive rule. The detection latency is

$$t_d=t_a-t_0.$$

(25)

4.3.2. False Positive Rate (Alarm-Wise)

Over a collection of attack-free evaluation units ${\mathcal{U}}_B$ (simulation runs of fixed length or non-overlapping benign windows),

$$\mathrm{FPR}(\%)={\displaystyle \frac{1}{|{\mathcal{U}}_B|}}\sum _{u\in {\mathcal{U}}_B}\mathbf{1}\left[\exists n\in u:s[n+i]\ge \tau \forall i=0,\dots ,N-1\right]\times 100.$$

(26)

This measures how often a false alarm occurs on benign data under the same decision rule.

4.3.3. Sample-Wise Exceedance (Secondary Descriptor)

For completeness, we also report the sample-wise positive fraction (SPF),

$$\mathrm{SPF}(\%)={\displaystyle \frac{1}{\left|\mathcal{B}\right|}}\sum _{n\in \mathcal{B}}\mathbf{1}\left[s\left[n\right]\ge \tau \right]\times 100,$$

(27)

where $\mathcal{B}$ is the set of benign samples. The SPF characterizes score distributions but is not used as the FPR in the main text.

4.3.4. Statistical Reporting Conventions

We report means with 95% confidence intervals and use Wilson intervals for proportions and bootstrapping for the AUC; full details are provided in Supplementary File S1.

4.3.5. System-Level Impact and Resilience Metrics

Beyond the F1 and alarm-wise FPR, we report system-level KPIs that reflect efficiency, stability margins, and long-term resilience under attacks and CI actuation, using the same measurement records as for $V_{r,\mathrm{pp}}$, $\mathrm{IRR}$, and regulation.

Efficiency and energy overhead. Let ${\eta }^{\star }$ be the benign baseline and $\eta$ the value under attack/CI; we track $\Delta \eta ={\eta }^{\star }-\eta$ and a normalized penalty $p_{\eta }=({\eta }^{\star }-\eta )/{\eta }^{\star }$. Over a window $T_w$, the energy overhead is $E_{\mathrm{over}}={\int }_t^{t+T_w}{P}_{\mathrm{in}}(1-\eta )dt-{\int }_t^{t+T_w}{P}_{\mathrm{in}}(1-{\eta }^{\star })dt$.

Stability proxies. We monitor a delay-sensitive low-frequency component induced by a fixed sensor path delay: the oscillation index ${\mathrm{OI}}_{100\text{–}150\mathrm{Hz}}$ is the RMS of the $100\text{–}150\mathrm{Hz}$ band of $v_{\mathrm{out}}$, normalized by $V_{\mathrm{out},\mathrm{DC}}$. As a surrogate lower bound on the phase margin, ${\mathrm{PM}}_{\mathrm{lb}}\approx {180}^{\circ }-{360}^{\circ }{f}_c{\tau }_{\mathrm{est}}$ with loop bandwidth $f_c$ (from step/PRBS identification) and delay estimate ${\tau }_{\mathrm{est}}$ (from ring buffer or timing).

Resilience (fleet/O&M). We track the alarm density $\mathrm{AD}=N_{\mathrm{alarms}}/T_{\mathrm{obs}}$ on benign operation, the mean time between alarms $\mathrm{MTBA}=T_{\mathrm{obs}}/N_{\mathrm{alarms}}$, the mean time to recovery $\mathrm{MTTR}$ (alarm onset → within-limit restoration), and the score drift index $\mathrm{SDI}=|{\mu }_s-{\mu }_{s,\mathrm{ref}}|/{\sigma }_{s,\mathrm{ref}}$ on verified benign segments (shadow mode), which guides periodic rethresholding.

System-level KPIs used in addition to detection metrics are summarized in

Table 19. System-level KPIs reported in addition to detection metrics.

KPI	Symbol	Unit	Definition/Purpose
Efficiency drop	$\eta ,\Delta \eta$	%, %	Baseline ${\eta }^{\star }$; $\Delta \eta ={\eta }^{\star }-\eta$; maps to CI via $p_{\eta }$.
Ripple and spectrum	$V_{r,\mathrm{pp}},\mathrm{IRR}$	mV, %	Time-domain peak-to-peak; in-band ratio around $k{f}_{\mathrm{sw}}$.
Regulation error	$|V_{\mathrm{out}}-V^{\star }|/V^{\star }$	%	Compliance to the $\pm 2\%$ DC window.
Oscillation index	${\mathrm{OI}}_{100\text{–}150\mathrm{Hz}}$	%	RMS in 100–150 Hz band/$V_{\mathrm{out},\mathrm{DC}}$; delay stress proxy.
Phase margin bound	${\mathrm{PM}}_{\mathrm{lb}}$	deg	≈${180}^{\circ }-{360}^{\circ }{f}_c{\tau }_{\mathrm{est}}$ (surrogate).
Alarm density	$\mathrm{AD}$	${\mathrm{h}}^{-1}$	$N_{\mathrm{alarms}}/T_{\mathrm{obs}}$ during benign operation.
MTB alarms	$\mathrm{MTBA}$	h	$T_{\mathrm{obs}}/N_{\mathrm{alarms}}$.
MTT recovery	$\mathrm{MTTR}$	s	Alarm → within-limit restoration (incl. hysteresis).
Score drift	$\mathrm{SDI}$	–	$|{\mu }_s-{\mu }_{s,\mathrm{ref}}|/{\sigma }_{s,\mathrm{ref}}$ on benign segments.

.

These KPIs complement the F1/AUC/FPR by quantifying efficiency impacts, stability margin erosion, and operational resilience; they align with the safety box and CI normalization already used in this work.

4.4. Experimental Results

The output ripple is ESR-dominant. With $\Delta i_L\approx 0.60{\mathrm{A}}_{pp}$, $C=470$ µ$\mathrm{F}$, and $f_{\mathrm{sw}}=100\mathrm{kHz}$, the ideal capacitive ripple is

$$\Delta v_{C,pp}\approx {\displaystyle \frac{\Delta i_L}{8C{f}_{\mathrm{sw}}}}\approx 1.6{\mathrm{mV}}_{pp},$$

(28)

whereas the ESR contribution is

$$\Delta v_{\mathrm{ESR},pp}\approx \Delta i_L·\mathrm{ESR}\approx 0.60\times 0.05=30{\mathrm{mV}}_{pp}.$$

(29)

The measured $v_o$ ripple (≈30 ${\mathrm{mV}}_{pp}$) therefore matches the ESR estimate.

4.4.1. Baseline Operation

Figure 11 summarizes nominal buck operation. Figure 11a shows the output voltage ripple $v_o$ under $24\to 12$ V, $L=100$ µ$\mathrm{H}$, $C=470$ µ$\mathrm{F}$, and $f_{\mathrm{sw}}=100\mathrm{kHz}$. The measured ripple is ≈30 ${\mathrm{mV}}_{pp}$ and is predominantly ESR-dominated: $\Delta v_{\mathrm{ESR},pp}\approx \Delta i_L\mathrm{ESR}$ with $\Delta i_L\approx 0.60{\mathrm{A}}_{pp}$ and $\mathrm{ESR}\approx 50\mathrm{m}\Omega$; the ideal capacitive component is small (≈1.6 ${\mathrm{mV}}_{pp}$). Figure 11b shows the inductor current $i_L$ with DC $\approx 1.20\mathrm{A}$ and triangular ripple $\Delta i_L\approx 0.60{\mathrm{A}}_{pp}$ governed by $(V_{in},V_{out},D,L,f_{\mathrm{sw}})$ (e.g., $D\approx V_{out}/V_{in}=0.5$ yields $\Delta i_L\approx (V_{in}-V_{out})D/\left(L{f}_{\mathrm{sw}}\right)=0.60{\mathrm{A}}_{pp}$).

Consistency check. The reported values are cross-checked against first-principles estimates (

Table 20. Consistency between reported and computed waveform values (nominal case).

Quantity	Reported	Computed (Model)	Verdict
Inductor ripple $\Delta i_L$ (${\mathrm{A}}_{pp}$)	$0.60$	${\displaystyle \frac{(V_{in}-V_{out})D}{L{f}_{\mathrm{sw}}}}=0.60$	Consistent
Output ripple $\Delta v_o$ (${\mathrm{V}}_{pp}$)	$0.03$	$\Delta i_L·\mathrm{ESR}=0.03$	Consistent (ESR-dominant)
Bias $\to \Delta V_{out}$ (V)	$-0.21$	$-{\delta }_{\mathrm{eff}}/\alpha =-0.211$	Consistent (scaled)
Delay $\tau$ (ms)	$1.02$	$N{T}_s=102\times 10$µs = 1.020	Consistent
Noise (1 kHz) level (${\mathrm{V}}_{pp}$)	∼0.18	N/A	Consistent (qual.)

).

4.4.2. Bias Injection

Figure 12 shows the output voltage with the attack window (50–70 ms) shaded. A $+0.4$ V command yields an effective offset at the feedback node of ${\delta }_{\mathrm{eff}}\approx +58$ mV (with divider ratio $\alpha \approx 0.275$). Under integral control without saturation, the steady-state shift follows $\Delta V_{\mathrm{out}}\approx -{\delta }_{\mathrm{eff}}/\alpha$ (see Equation (20)), matching the observed $\approx -0.21$ V. After the attack ends, $V_{\mathrm{out}}$ recovers to nominal within ∼8 ms. Scope settings: DC-coupled, 200 mV/div, 2 ms/div (10 divisions = 20 ms). Under the fixed decision rule ($\tau =\mu +3\sigma$, $N=3$ consecutive samples), the measured detection latency is $3.1$ ms with an alarm-wise FPR of $0.8\%$. We omit the inductor current trace here because its information (duty reduction and a small DC shift) is redundant with the voltage result; a current plot is included only for the delay case.

4.4.3. Delay Injection

Implementation. A fixed pure delay is inserted in the ADC$\to$DMA$\to$ISR$\to$PI path via a ring buffer of length $N=102$ at $f_s=100\mathrm{kHz}$, giving $\tau =N/f_s\approx 1.02$ ms (≈100 $T_s$ with $T_s=10$ µs). Scope-based step-to-actuation timing confirms that ${\tau }_{\mathrm{meas}}=1.02\pm 0.03$ ms ($n=10$).

Figure 13a shows the output voltage with the attack window (50–70 ms) shaded. The additional phase lag ${\varphi }_{\mathrm{delay}}\left(f\right)=-2\pi f\tau$ reduces the phase margin and produces a dominant ∼120–130 Hz component; the waveform returns to nominal after the attack ends. Figure 13b shows the inductor current; the same $\tau \approx 1.02$ ms introduces low-frequency modulation consistent with Figure 13a. Measured amplitudes: $V_{\mathrm{out}}\approx 0.34$ V (amplitude; ≈0.68 ${\mathrm{V}}_{pp}$) and $i_L\approx 0.11$ A (amplitude; ≈0.22 ${\mathrm{A}}_{pp}$). Detection latency is $4.2$ ms with alarm-wise FPR $1.2\%$.

Origin > noindention here should be retained of the ∼120–130 Hz oscillation under delay.

The injected delay multiplies the nominal loop by $e^{-s\tau }$, adding phase lag ${\varphi }_{\mathrm{delay}}\left(f\right)=-{360}^{\circ }f\tau$ (deg) and reducing the effective phase margin to $\mathrm{PM}\left(f\right)\approx {\mathrm{PM}}_0-{360}^{\circ }f\tau$. Zero-margin oscillation thus occurs near

$$f_{\mathrm{osc}}\approx {\displaystyle \frac{{\mathrm{PM}}_0}{{360}^{\circ }\tau }}.$$

(30)

With $\tau =1.02$ ms and a typical buck voltage loop margin ${\mathrm{PM}}_0\approx {45}^{\circ }$, $f_{\mathrm{osc}}\approx 123$ Hz, matching the observed 120–130 Hz peak. The LC pole $f_0={\left(2\pi \sqrt{LC}\right)}^{-1}\approx 734$ Hz ($L=100$ µH, $C=470$ µF) is well above this; the modulation is due to phase margin erasure by delay, not LC resonance.

The reason that we include $i_L$ only for the delay case.

A fixed sensor path delay multiplies the loop by $e^{-s\tau }$ and reduces the phase margin (Equation (23)), producing a distinct low-frequency component (∼120–130 Hz) that is useful to show in both $v_{out}$ and $i_L$. In contrast, for bias and 1 kHz noise injections, the $i_L$ trace is largely redundant with $v_{out}$ (similar shape with a small phase shift), so we omit $i_L$ there for brevity.

4.4.4. Noise Injection

Figure 14 shows the output voltage with the attack window (50–70 ms) shaded. A 1 kHz sinusoid superimposed in the sensor path passes the closed loop with attenuation, leaving a distinct component of approximately $0.18$ ${\mathrm{V}}_{pp}$ (≈0.09 V amplitude) visible throughout the 20 ms window (about 20 cycles at 1 kHz). The nominal high-frequency switching ripple (∼30 ${\mathrm{mV}}_{pp}$) remains superposed. Scope settings: DC-coupled, 200 mV/div, 2 ms/div (10 divisions = 20 ms). Under the fixed decision rule ($\tau =\mu +3\sigma$, $N=3$ consecutive samples), the measured detection latency is $2.9$ ms with an alarm-wise FPR of $0.6\%$. We omit the inductor current trace for this scenario because its small 1 kHz component is redundant with the voltage result; a single current plot is included only for the delay case.

4.4.5. Anomaly Score and Detection Performance

Figure 15 shows the hardware anomaly score trace replotted in MATLAB. A streaming PI–LSTM runs on a TMS320F28379 with inference rate $f_{\inf }=10$ kHz (decimation $M=10$), window $L=30$ (3.0 ms), and an $N=3$ consecutive-samples decision rule. The threshold is fixed at $\tau =\mu +3\sigma$ from benign validation segments; the attack window (50–70 ms) is shaded.

Figure 16 shows that the median detection latency is ordered as noise$<$bias$<$delay, with tight IQRs over $n=40$ runs. The dotted 3.0 ms line (window span at $f_{\inf }=10$ kHz, $L=30$) provides context for the $N=3$ persistence; the results are consistent with the simulation ordering (cf. Table 8) and with the fixed decision rule in Section 4.3.

4.4.6. Hardware Results with Confidence Intervals

We report hardware uncertainty using the conventions in Section 4.3: (i) latencies as the median with IQR and a bootstrap 95% confidence interval (B = 1000), (ii) the alarm-wise FPR as a point estimate with a Wilson score 95% interval. A campaign used $n=40$ trials per attack (counts and intervals can be updated if a different n is used in the final campaign).

Figure 17 aggregates hardware measurements of $V_{r,\mathrm{pp}}$, the $\mathrm{IRR}$, and the DC regulation error under benign/attack conditions. Across attacks, $V_{r,\mathrm{pp}}$ and the $\mathrm{IRR}$ remain within their limits (see Equation (6)), while the $\pm 2\%$ regulation window is occasionally exceeded only for the delay case (peak $\approx 2.8\%$; Section 4.3), matching the score/latency behavior and the delay-induced phase margin erosion discussed earlier.

Hardware detection metrics with 95% confidence intervals are summarized in

Table 21. Hardware detection metrics with 95% confidence intervals (representative campaign; $n=40$ per attack).

Attack	Latency (ms), Median [IQR]	Latency, 95% CI (Bootstrap)	FPR (%), 95% CI (Wilson)
Bias	3.1  [2.7–3.5]	2.9–3.4	0.8 (0.2–2.9)
Delay	4.2  [3.7–4.9]	3.9–4.6	1.2 (0.3–3.3)
Noise	2.9  [2.5–3.2]	2.7–3.1	0.6 (0.1–2.4)

Notes. Decision rule identical to deployment: threshold $\tau$ = µ + 3$\sigma$ from benign data; $N=3$ consecutive samples. Intervals follow the reporting conventions already defined for simulation (Section 4.3).

.

Under this rule, the anomaly score exceeds the threshold with low latency:

• Bias: latency $3.1$ ms; FPR $0.8\%$;
• Delay: latency $4.2$ ms; FPR $1.2\%$;
• Noise: latency $2.9$ ms; FPR $0.6\%$.

These hardware results follow the simulation trends in relative difficulty and latency. The time-domain ripple $V_{r,pp}$ and IRR remained within the limits, whereas the delay attack produced a low-frequency deviation up to ≈0.34 V (≈2.8%), which could exceed the $\pm 2\%$ regulation window. CI-guided actuation (which enforces the full safety box) was evaluated in the simulation only.

Safety compliance summary. In the hardware experiments without CI-based actuation, (i) the $V_{r,pp}$ and IRR satisfied their limits; (ii) the $\pm 2\%$ DC regulation window was occasionally exceeded under the delay attack (peak $\approx 2.8\%$). With CI-based actuation (simulation study), all three constraints were satisfied concurrently. A concise summary is given in

Table 22. Safety box compliance summary (limits: $|V_{out}-V^{\star }|\le \pm 2\%$, $V_{r,pp}\le 240$ mV, $\mathrm{IRR}\le 2\%$).

Scenario	DC Regulation ($|{\mathit{V}}_{\mathbf{out}}-{\mathit{V}}^{\mathbf{★}}|\le \pm 2\%$)	${\mathit{V}}_{\mathit{r},\mathbf{pp}}\le 240\mathbf{mV}$	$\mathbf{IRR}\le 2\%$
Hardware (no CI actuation)	Fail (delay, up to $\approx 2.8\%$)	Pass	Pass
Simulation (with CI actuation)	Pass	Pass	Pass

Notes. In the body cells, Fail indicates a safety-box violation of the stated limits; “Pass” denotes compliance. In the hardware run without CI actuation, only the DC regulation briefly exceeded the $\pm 2\%$ window under the delay attack (peak $\approx 2.8\%$), while $V_{r,pp}$ and $\mathrm{IRR}$ remained within limits.

.

Claim scope and robustness safeguards. We emphasize that our deployability claim refers to the detection path; CI-guided actuation has been evaluated in simulations only. The occasional violation of the $\pm 2\%$ regulation window under the delay attack (peak $\approx 2.8\%$) motivated two firmware safeguards that gate actuation: (i) a regulation/ripple watchdog that rolls back to $\alpha =0$ when any metric exceeds $90\%$ of its limit (i.e., $|V_{\mathrm{out}}-V^{\star }|/V^{\star }>1.8\%$, $V_{r,\mathrm{pp}}>0.9·240\mathrm{mV}$, $\mathrm{IRR}>0.9·2\%$); (ii) a delay-aware guard that monitors the $100\text{–}150\mathrm{Hz}$ band (Goertzel) and suppresses actuation when the component exceeds a calibrated threshold, consistent with the phase margin erosion observed under a fixed sensor path delay. These safeguards are designed to keep regulation within bounds during CI actuation; their hardware validation is included in the future work test matrix and acceptance criteria.

Scope note. Hardware CI-guided actuation and richer threat models are outside the scope of this paper and are enumerated in Future Workwith acceptance criteria; the present deployability claim pertains to the detection path.

Scope and generalizability. This hardware study intentionally focuses on a buck converter and three sensor-side disturbances (bias, fixed sample delay, narrowband noise) to validate the detection path and safety box instrumentation end-to-end on a DSP with reproducible latency/FPR. The PI–LSTM formulation itself is topology-agnostic: the physics loss enforces discrete-time state updates, so replacing the buck update map with that of another topology yields a drop-in variant.

Residual template. For any averaged DC–DC topology with fixed-step update $x_{k+1}=f_d(x_k,u_k;\theta )$ at sampling period $\Delta t$,

$$L_{\mathrm{phys}}={\displaystyle \frac{1}{N_b}}\sum _{k=1}^{N_b}{∥{\widehat{x}}_{k+1}-f_d\left({\widehat{x}}_k,{\widehat{u}}_k;\theta \right)∥}_2^2$$

(31)

where x collects topology states (e.g., ${[i_L,v_o]}^{\top }$ for buck; ${[i_L,v_C]}^{\top }$ for boost/buck–boost), and u includes duty d (and, if needed, phase indices for multiphase VRM). Multiphase extensions add phase balance/residual terms (e.g., ${\sum }_p{i}_{L,p}-i_L=0$ or ripple constraints).

Threat model extensions (planned). Actuator path tampering (duty/PWM saturation), time-varying delay/jitter, load-side steps/sags, supply sags/surges, wideband EMI/harness coupling, and network-level MITM leading to sensor path anomalies. The Future Work section specifies a test matrix and acceptance criteria for these scenarios and for boost, buck–boost, and multiphase VRM.

4.4.7. CI-Based Actuation: Hardware Implementation Plan

We outline a phased plan to deploy CI-guided actuation on the DSP while enforcing the unified safety box $V_{r,\mathrm{pp}}\le 240\mathrm{mV}$, $\mathrm{IRR}\le 2\%$, $|V_{\mathrm{out}}-V^{\star }|/V^{\star }\le 2\%$.

(A) Architecture and hook points. The CI is computed at the inference rate ($f_{\inf }=10$ kHz, window $L=30$, persistence $N=3$, $T_{\mathrm{hys}}=10$ ms). The actuation channels are $\{V_{\mathrm{ref}},d,f_{\mathrm{sw}}\}$ with $\alpha \in [0,{\alpha }_{max}]$ (${\alpha }_{max}=0.35$), gains $(k_v,k_d,k_f)=(0.04,0.03,0.05)$, and rate limiters (per-tick $|\Delta V_{\mathrm{ref}}|,|\Delta d|,|\Delta f_{\mathrm{sw}}|$ bounded). Hard clamps ensure PWM duty in $[d_{min},d_{max}]$ and $f_{\mathrm{sw}}$ in $[f_{min},f_{max}]$. Any limit approach (≥90% of the bound) reduces $\alpha$ (rollback) and restores nominal setpoints.

(B) On-board estimators for CI terms. Ripple (time): $V_{r,\mathrm{pp}}$ from an AC-coupled trace via a sliding window spanning 5–10 switching periods (peak-to-peak over detrended samples). Ripple (freq): $\mathrm{IRR}$ via narrowband power around $k{f}_{\mathrm{sw}}$ ($k=1\dots 5$): compute RMS using Goertzel/IIR band-pass pairs with $\pm 0.5$ kHz equivalent bandwidth; normalize by $V_{\mathrm{out},\mathrm{DC}}$. Efficiency: $\eta \approx P_{\mathrm{out}}/P_{\mathrm{in}}$ using available voltage/current sensors ($V_{\mathrm{out}},I_{\mathrm{out}},V_{\mathrm{in}},I_{\mathrm{in}}$); when a current is unavailable, use a calibrated proxy (e.g., $P_{\mathrm{out}}\approx V_{\mathrm{out}}·I_L$ in CCM with shunt/Hall scaling).

(C) Safety interlocks and supervision. (1) Dual-threshold gating: detection ($\tau =\mu +3\sigma$, $N=3$) must persist for $T_{\mathrm{hys}}$ before actuation; (2) watchdog (e.g., 2 ms) on the CI task; timeout ⇒ restore nominal; (3) hardware kill-switch and firmware latch to freeze $\alpha =0$; (4) thermal/overcurrent monitors ($T_j,I_L^{\mathrm{rms}}$) inhibit actuation.

(D) Commissioning phases (with logging at 1 kHz). P0 HIL/SIL: verify estimators and $\alpha$ logic off-target; P1 passive logging (no actuation); P2 shadow mode: compute $\alpha$ but do not apply, check rollback triggers and safety margins; P3 limited actuation: apply $V_{\mathrm{ref}}$ and d only, ${\alpha }_{max}\le 0.20$, no $f_{\mathrm{sw}}$ change; P4 extended actuation: enable $f_{\mathrm{sw}}$ adjustment with tight clamps, ${\alpha }_{max}\le 0.35$.

(E) Test matrix and acceptance criteria. Attacks: bias, delay (≈1.02 ms), narrowband noise (∼1 kHz); loads: nominal ±20%, line ±10%. Pass if, under CI actuation, (i) no violation of any limit; (ii) median detection latency within prior ranges (∼2.9–4.2 ms); (iii) alarm-wise FPR within prior ranges (≤1.2%); (iv) automatic rollback engaged when any metric exceeds 90% of limit; (v) no watchdog timeouts or safety latches during steady operation.

(F) Runtime and footprint. CI updates reuse the existing 10 kHz loop. The added cost of $K=5$ Goertzel filters per channel is within the DSP margin (<15% extra CPU in our budget), keeping the total load <70% at 200 MHz. All settings are logged (UART/SD) for audit.

4.4.8. Limitations and Robustness Considerations

Temperature and component drift. ESR(C), L, divider ratio ${\alpha }_{\mathrm{fb}}$, and sensor/ADC offsets drift with temperature and aging, which can shift the loop gain and $V_{r,\mathrm{pp}}/\mathrm{IRR}$. Our fixed threshold ($\tau =\mu +3\sigma$ from room-temperature benign data) may become suboptimal under large ambient excursions. Mitigation: Periodic benign recalibration (mean/variance refresh), temperature-tagged normalization, and scheduled verification across operating corners.

EMI and sensing chain. Unmodeled narrowband/broadband EMI, grounding/harness coupling, and probe/anti-alias choices affect the sensed channels. Because the $\mathrm{IRR}$ integrates only around $k{f}_{\mathrm{sw}}$, off-band tones (e.g., ∼1 $\mathrm{kHz}$) primarily impact regulation and $V_{r,\mathrm{pp}}$ rather than the $\mathrm{IRR}$; conversely, near-$k{f}_{\mathrm{sw}}$ EMI can inflate the $\mathrm{IRR}$. Mitigation: Differential sensing, twisted/shielded lines, RC anti-aliasing before the ADC, and notch/band limit where allowed.

Modeling gap in PI loss. The physics residuals use an averaged discrete-time buck model and omit switch-level nonidealities (dead time, frequency-dependent ESR, diode reverse recovery). Under a large ripple or discontinuous operation, residual penalties may be imperfect. Mitigation: Extend residuals with collocation/regularization or hybrid terms identified from measured data.

Inference rate/latency trade-off. Deployment uses $f_{\inf }=10\mathrm{kHz}$ with $L=30$ (≈3.0 $\mathrm{ms}$) and $N=3$, setting a latency floor of a few milliseconds and limiting sub-ms detection. Mitigation: Reduce decimation or L within the DSP budget; exploit quantization or fused kernels to maintain the load.

Fixed global decision rule. A single global $\tau$ is robust but can be conservative under fast load/operating point changes. Mitigation: Per-mode thresholds or guarded online updates (e.g., percentile tracking on verified benign segments).

Scope of actuation. CI-guided actuation was evaluated in simulations only; hardware validation covered the detection path. Safety box satisfaction on hardware under closed-loop CI actuation remains for future work.

Measurement uncertainty. Ripple is AC-coupled (20 MHz limit) and $\mathrm{IRR}$ is computed by Welch integration; probe/setup choices introduce uncertainty. We therefore report medians/IQRs and 95% intervals for hardware metrics.

Scope of claims. All conclusions on the DC rail quality, the unified safety box, and CI-guided actuation pertain to the buck converter domain. The PMSM dataset is used solely for an auxiliary, cross-domain test after the alignment in Section 3.2; we report detection metrics only and do not compute or interpret DC rail ripple metrics for this dataset.

5. Conclusions

We presented a physics-informed anomaly detector for digitally controlled DC–DC converters that couples an LSTM autoencoder with discrete-time circuit residuals and a unified safety box for DC regulation ($\pm 2\%$), time-domain ripple $V_{r,\mathrm{pp}}$, and the in-band ripple ratio (IRR).

Simulation. Across bias, delay, and narrowband noise attacks, the PI–LSTM improved the average F1 by ∼6.6% (89.3→95.2%), reduced the alarm-wise FPR by ∼53% (12.4→5.8%), and lowered the physical violation rate by ∼86% versus a conventional LSTM. A safety-bounded CI response achieved a $\mathrm{CI}\approx$ 0.25 while remaining within limits.

Hardware. On a TMS320F28379, a distilled $(n_x=4,n_h=32)$ model achieved 2.9–4.2 ms latency with alarm-wise FPR $\le 1.2\%$. Ripple metrics ($V_{r,\mathrm{pp}}$, IRR) met limits; under delay, the $\pm 2\%$ regulation window was occasionally exceeded (peak $\approx 2.8\%$). Deployability here pertains to the detection path; CI-based actuation remains simulation-only.

Industrial/commercial note. The detector runs as a drop-in library on common MCU/DSP targets (e.g., C28x, ARM-M4/M7). Target segments include EV on-board DC–DC/chargers, PV DC-link, ESS, and industrial SMPS/UPS. Optional edge–gateway–cloud integration supports fleet analytics/OTA, while local safety is enforced by the unified safety box.

Future work.

• HIL/on-rig CI actuation under the unified safety box. Close the loop on HIL and hardware for CI-guided actuation while enforcing the same limits used in this paper: $|V_{\mathrm{out}}-V^{\star }|/V^{\star }\le \pm 2\%$, $V_{r,\mathrm{pp}}\le 240\mathrm{mV}$, $\mathrm{IRR}\le 2\%$. Acceptance targets: median detection latency within the prior 2.9–4.2 ms band; alarm-wise FPR $\le 1.2\%$; zero safety box violations during CI engagement with rollback/hysteresis enabled.
• Threat model and topology expansion. Evaluate more complex disturbances (multi-tone/near-$k{f}_{\mathrm{sw}}$ EMI, sampled data jitter/delay spread, ADC range/quantization effects, sensor drift + load steps) and extend the residual template to boost, buck–boost, and multiphase VRM with optional multi-sensor fusion.
• System-level performance and resilience across environments. Quantify efficiency drop and energy overhead, delay-sensitive oscillation proxies, and fleet indicators (alarm density, MTTR, score drift index) across temperature/aging (e.g., $-20$–$85°$C), ESR/inductance drift, and EMI injection; retain the fixed decision policy ($\tau =\mu +3\sigma$, $N=3$) with periodic benign rethresholding.
• Distributed integration (edge–gateway–cloud). Keep safety local on the controller (fail closed to $\alpha =0$). Gateway aggregates 1–5 Hz summaries (OPC UA/MQTT/TLS), supports OTA with versioning/rollback; cloud performs drift monitoring and replay-based validation. Budgets: <0.1 ms/step at 10 kHz inference; ∼0.2–2.5 kB/s telemetry per node.
• Commercialization pilots. Run pilots in two–three domains (EV on-board DC–DC/charger, PV DC-link, ESS) to assess readiness. Targets: latency band preserved (median report), FPR $\le 1.2\%$, no safety box violations, and reduced nuisance trips vs. baseline. Deliverables: firmware library (porting guide), add-on module reference design, gateway/OTA workflows (audit logs, rollback).
• Industrial practice readiness. Prepare lightweight hardening and pre-compliance—QA test pack (temperature, aging, ESR and inductance (L) drift, EMI)—documentation for integration and O&M (commissioning: logging → shadow mode → gated actuation)—and pre-assess applicable standards (e.g., IEC 61204-3 [55], IEC 62443-2-1 [61], ISO 26262 [62], ISO/SAE 21434 [63]).
• Adaptive operations (optional). Operating mode-aware thresholds and change point detection while retaining the $N=3$ persistence policy; quantization/pruning for sub-40 µs/step at 200 MHz without loss of detection performance.

Reproducibility. A curated package (code/data/models/figure scripts and hardware logs) will be released on Zenodo upon acceptance and/or institutional clearance; the auxiliary PMSM dataset is public (Ref. [39]).