Systematic Integration of Digital Twins and Constrained LLMs for Interpretable Cyber-Physical Anomaly Detection

Abstract: Cyber attacks targeting Industrial Control Systems (ICS) have become increasingly sophisticated and hard to identify. Detecting such attacks requires integrating low-level behavioral cues with high-level semantic interpretation, a capability that traditional anomaly detectors lack. This paper presents a Digital Twin (DT)-driven hybrid detection approach that combines deterministic heuristics with systematic, constrained LLM reasoning to achieve real-time incident detection. The DT maintains a synchronized, feature-enriched representation of the Secure Water Treatment (SWaT) process, deriving behavioral descriptors. Heuristics identify characteristic signatures of spoofing, valve forcing, denial-of-service, and bias drift, while the LLM is invoked only when heuristics abstain. A constrained JSON schema and semantic plausibility filters ensure physically consistent LLM outputs, and a temporal smoothing layer stabilizes the final decision signal. Evaluation on four canonical SWaT attack scenarios shows that the proposed detector precisely localizes each attack interval with low time-to-detect and zero False Positives (FPs) in the evaluated benign region. Results are consistent across both a local LLaMA model and a cloud-based GPT model, demonstrating the robustness of the constrained hybrid architecture. The findings highlight the potential of DT-guided LLM reasoning as a reliable and interpretable approach to ICS anomaly detection.

• The paper presents a hybrid detection pipeline that integrates Digital Twin synchronization with constrained LLM reasoning to enable interpretable ICS anomaly detection.
• It employs deterministic heuristics for real-time anomaly flags while invoking LLM analysis only when needed, effectively reducing false positives.
• Experiments on the SWaT system demonstrate exact attack localization and superior performance with zero false positives over 1,400 benign samples.

Systematic Integration of Digital Twins and Constrained LLMs for Interpretable Cyber-Physical Anomaly Detection

Introduction

The paper "Systematic Integration of Digital Twins and Constrained LLMs for Interpretable Cyber-Physical Anomaly Detection" (2604.03790) presents a hybrid detection architecture for Industrial Control Systems (ICS) security, aiming to bridge the gap between low-level process anomaly detection and high-level, interpretable attack classification. The method utilizes a Digital Twin (DT) to maintain a synchronized, feature-enriched model of the Secure Water Treatment (SWaT) process and orchestrates a tightly-coupled interplay between deterministic process heuristics and a constrained LLM reasoning module. This approach addresses the shortcomings of traditional detection strategies that either lack semantic interpretability or generate high false positive (FP) rates due to unconstrained LLM hallucinations.

Digital Twin Architecture

The detection pipeline hinges on a Digital Twin-based architecture, wherein the DT operates as a continuously synchronized, window-based behavioral replica of the physical process. The DT employs a replay engine that streams 30-second sliding telemetry windows, aligning virtual state with real-world SWaT system dynamics. Critically, the DT augments raw telemetry by computing a set of behavioral descriptors—such as derivatives, variances, ranges, and actuator toggling statistics—that facilitate both interpretable diagnosis and efficient feature extraction for downstream modules.

This enriched state enables deterministic heuristics to identify Indicators of Compromise (IoC) such as spoofing, valve forcing, bias drift, and sensor freezing via process-relevant thresholds and coupling patterns. When the heuristics abstain from decision-making due to insufficient confidence, windowed features are forwarded to the LLM. The LLM is forced to respect a rigid JSON schema, and its outputs are processed through semantic plausibility constraints ensuring physical consistency, followed by temporal smoothing to suppress short-term fluctuations and noise-induced instability.

Figure 1: High-level depiction of the DT-driven architecture, demonstrating the flow from synchronized telemetry streams, through feature extraction and heuristic analysis, to constrained LLM invocation and temporal smoothing.

Hybrid Detection Methodology

The core operational pipeline is modular and composed of the following:

• Replay and Synchronization Layer: Handles streaming, temporally-aligned plant state using the SWaT dataset, delivering 30-second, multivariate, synchronized telemetry snapshots.
• Feature Extraction Module: Calculates first-order sensor slopes, rolling variances, actuator toggling counts, freeze ratios, and amplitude metrics tailored to SWaT plant dynamics—attributes that collectively amplify the temporal and behavioral signatures of canonical ICS attacks.
• Heuristic Detector: Implements deterministic detection logic for four prevalent attack archetypes (spoofing, valve forcing, bias drift, and DoS via sensor freezing). These rules yield rapid, interpretable flags while minimizing costly LLM queries.
• Constrained LLM Reasoning Agent: Invoked only on heuristic abstention, with the LLM forced to emit structured, schema-conforming JSON outputs specifying high-level attack tactics, plausible manipulation paths, and mitigative suggestions. Semantic filters reject hallucinated or physically infeasible outputs, substantially reducing FP rates.
• Temporal Smoothing and Fusion: Aggregates and stabilizes decision signals across sliding windows, enforcing majority-vote smoothing to guarantee responsiveness while damping stochastic misfires.

  Figure 2: Example of time windowing over LIT101 telemetry, illustrating sequential 30-second analysis intervals for feature extraction and decision pipeline activation.

Experimental Validation

The system was rigorously evaluated across four canonical SWaT attack scenarios—sensor spoofing, valve forcing, bias drift, and sensor-freezing denial-of-service—over both locally hosted (LLaMA-3.1-8B) and cloud-based (GPT-4.1-mini) LLM platforms. The testbed consists of 1,400 sequential, labeled samples containing both benign and attack intervals.

Strong claims include:

• Exact attack window localization: Alarms are reliably triggered only within ground-truth attack intervals, with no spillover into benign regions.
• Consistent Time-To-Detect (TTD): Most alarms are raised within the first window following attack onset (TTD 0 or 1), including for bias drift which is traditionally challenging for statistical detectors.
• Zero false positives: Across the entire 1,400-sample benign region, no benign interval yielded a spurious alarm for the DT-driven method, in stark contrast to a standard Isolation Forest baseline which produced 273 scattered false positives (≈19.5%).
• Backend-agnosticism: Detection performance is stable across both LLaMA and GPT backends, with negligible differences post-fusion, validating that architectural constraints and gating dominate over backend-specific model idiosyncrasies.

Technical Implications and Discussion

The research demonstrates that embedding LLMs as a secondary, semantically-constrained layer atop robust, process-aware heuristics yields a highly stable and interpretable detection mechanism. By regulating LLM output via schema enforcement and domain-specific plausibility filters, the architecture circumvents issues of hallucinated attack claims and explanation instability that challenge direct LLM application in operational cyber-physical environments.

The deterministic heuristic layer shouldered most detection responsibility, relegating the LLM to a deliberative role for ambiguous or novel phenomena, thus containing the attack surface and supporting real-time operation. This division enables explanation-rich alerts while maintaining the operational reliability demanded by critical ICS domains.

The findings suggest that such hybrid, DT-guided architectures are promising for domains requiring temporally-stable, physically interpretable monitoring, and that choice of LLM backend can be dictated by operational considerations (e.g., local/private deployment versus cloud efficiency), with minimal performance tradeoff if backend is tightly constrained.

Limitations and Future Directions

While the results are strong for SWaT-specific dynamics and attacks, detection heuristics are finely tuned and may require adaptation for broader ICS settings or zero-day threats. The DT in this study focuses on behavioral mirroring rather than explicit physics-based simulation, which could further enhance the detector's ability to reject physically impossible or adversarial scenarios. Extension to larger-scale systems, dynamic adaptation under process drift, and exploration of multi-agent LLM decision fusion are identified as future work.

Conclusion

The integration of Digital Twin synchronization, process-coupled heuristic logic, and strictly constrained LLM-based semantic reasoning comprises a robust, low-FP detection pipeline for ICS environments. The architecture exhibits immediate and accurate incident localization with consistent behavior across heterogeneous LLM backends and entirely suppresses hallucination-driven false alarms. These results reinforce the value of DT-guided, explainable AI in safety-critical cyber-physical applications and provide a technical blueprint for interpretable, resilient anomaly detection systems amenable to regulatory scrutiny and operational deployment.