Fake Inverters: Surrogate Models & Cyber Attacks

• Fake inverters are devices that either use surrogate models to replicate proprietary inverter dynamics or have their control behavior compromised by malicious interventions.
• Physics-informed learning approaches, like latent neural ODE models, accurately capture inverter dynamics and improve simulation metrics by over 30% for voltage and 60% for frequency errors.
• Adversarial attacks that tamper with firmware, Volt-VAr controls, or droop settings can destabilize grids, highlighting the need for integrated detection and mitigation solutions.

“Fake inverters” denotes two distinct but increasingly connected constructs in contemporary power-systems research. In one sense, the term refers to a learned surrogate that emulates the proprietary dynamics of an inverter closely enough to support grid dynamic studies without access to original equipment manufacturer internals; in another, it refers to a smart inverter whose firmware, communicated parameters, or cyber-physical control signals have been maliciously altered so that the device no longer enforces the intended control law. Recent work places these meanings within a common technical frame: opacity of internal inverter behavior motivates surrogate modeling, while exposure of control firmware and remote parameterization motivates detection, mitigation, and system-level risk analysis (Kwon et al., 21 Jul 2025, Kuruvila et al., 2020, Saber et al., 2023, Khan et al., 2021, Prasad et al., 2024, Hui et al., 20 May 2025).

1. Dual usage and conceptual scope

In grid dynamic studies, operators increasingly need accurate inverter models for time-domain simulation, stability analysis, and controller gain tuning, yet original equipment manufacturers rarely disclose proprietary control architectures or parameter values. One line of work therefore addresses “fake” inverters as deliberately constructed surrogates: models learned from time-series data that reproduce the dynamics of proprietary inverter-based resources, especially grid-forming inverters, while embedding known physical structure (Kwon et al., 21 Jul 2025).

A different line of work uses the term for compromised devices. In microgrids and distribution systems, malicious firmware, controller modification, setpoint tampering, denial-of-service, and false-data injection can make an inverter appear operational while causing it to obey adversarial logic. This includes attacks on embedded firmware, remote manipulation of Volt-VAr curves, falsification of measurements in distributed secondary control, and time-varying tampering of primary frequency-control droop coefficients (Kuruvila et al., 2020, Saber et al., 2023, Khan et al., 2021, Prasad et al., 2024).

This suggests that the common denominator is not authenticity of hardware but authenticity of behavior. In the surrogate setting, a “fake” inverter is intentionally engineered to reproduce authentic dynamics for analysis. In the adversarial setting, a “fake” inverter is a genuine or apparently genuine device whose closed-loop behavior no longer matches the intended physics, grid code, or supervisory commands.

2. Physics-informed surrogate inverters for proprietary dynamics

The most explicit constructive treatment of fake inverters appears in the Physics-Informed Latent Neural ODE Model (PI-LNM), developed to learn an accurate surrogate directly from time-series data while embedding known physics (Kwon et al., 21 Jul 2025). Training and validation are performed on trajectories of measured or observed signals

$x = [\theta, \omega, V^e, V, P^n, Q^n],$

where $\theta$ is angle, $\omega$ is frequency, $V^e$ is the voltage control error, $V$ is internal voltage magnitude, and $P^n, Q^n$ are active and reactive power delivered to the network.

The latent ODE has dimension $24$. The first four latent dimensions are tied to the physically meaningful states $[\theta, \omega, V^e, V]$, while the remaining latent coordinates capture unmodeled or proprietary behavior, including inner control loops, limiters, and sampling or transport delays. An ODE-RNN encoder processes batches of observation sequences $\{x_i,t_i\}$, producing a hidden summary $h_T$, and a neural network $\theta$0 maps $\theta$1 to posterior parameters of the initial latent state,

$\theta$2

A decoder $\theta$3 maps latent states back to the observation space, with the latent states obtained by integrating the latent ODE.

The central modeling choice is the separation of known physics and learned residuals. In latent form,

$\theta$4

In physical coordinates, the model uses

$\theta$5

where $\theta$6 are inputs or disturbances and $\theta$7 learns the unmodeled part. The embedded physics uses a representative grid-forming inverter structure with droop- or REGFM_A1-like outer-loop behavior and uncertain parameters, while the residual compensates for mismatched gains and proprietary details. In the reported case study, the embedded droop and voltage-control gains are perturbed by $\theta$8 relative to the unknown proprietary values.

The known structure can incorporate dq-frame filter dynamics,

$\theta$9

together with droop or virtual synchronous machine relations such as

$\omega$0

or

$\omega$1

and dq-frame power relationships

$\omega$2

Training uses a variational objective maximizing the evidence lower bound, optionally augmented with physics residual penalties and parameter regularization. Data generation applies sudden load changes at $\omega$3 spanning $\omega$4–$\omega$5 p.u.; trajectories are recorded for $\omega$6 seconds at $\omega$7 s. The dataset contains $\omega$8 samples, each with six trajectories. Optimization uses batch size $\omega$9, initial learning rate $V^e$0, and $V^e$1 iterations.

The reported quantitative comparison is against an RNN trained purely on data without physics guidance. Voltage RMSE decreases from $V^e$2 p.u. to $V^e$3 p.u., a $V^e$4 reduction, and frequency RMSE decreases from $V^e$5 Hz to $V^e$6 Hz, a $V^e$7 reduction. The surrogate remains robust across $V^e$8–$V^e$9 p.u. load steps despite the $V$0 parameter uncertainty. Because the model retains a physics skeleton plus learned residuals, it can be dropped into a grid simulator for transient studies, disturbance response analysis, stability assessment, and gain tuning without access to OEM internals.

3. Compromised inverters as adversarial behavioral forgeries

In the adversarial literature, fake inverters arise when control behavior is altered at the firmware, parameter, or communication level. One attack class modifies firmware binaries or update images on consumer-grade smart inverter controllers, enabling controller modification, setpoint tampering, or denial-of-service. In this setting, primary and secondary control loops, protection logic, or communications handling are changed without authorization, and the device may inject unintended real or reactive power or fail to actuate control tasks (Kuruvila et al., 2020).

For droop-controlled inverters, controller and setpoint modification directly perturb the usual laws

$V$1

Reducing or increasing $V$2 and $V$3 changes power sharing and oscillatory tendencies; biasing $V$4 or $V$5 induces sustained frequency or voltage deviations. The same work notes the standard approximations

$V$6

which clarify how controller changes that alter $V$7, $V$8, or $V$9 propagate into power-flow deviations (Kuruvila et al., 2020).

A second attack surface is remote parameterization of Volt-VAr control. A canonical piecewise $P^n, Q^n$0 law is defined by four breakpoints $P^n, Q^n$1, or equivalently $P^n, Q^n$2, with a deadband and negative-sloped regions. The paper on malicious Volt-VAr control parameters writes

$P^n, Q^n$3

and specifies a scaled piecewise mapping from local voltage to $P^n, Q^n$4. Attackers can narrow the deadband, steepen slopes, shift thresholds, or invert the curve, causing reactive power oscillation and undesirable voltage oscillations. In the reported demonstration on the 9-bus Canadian urban benchmark distribution system, DG1 has baseline parameters $P^n, Q^n$5, $P^n, Q^n$6, $P^n, Q^n$7, $P^n, Q^n$8 and nominal $P^n, Q^n$9 pu; at $24$0 s, shifting $24$1 and $24$2 places the operating point in a sloped region and triggers persistent reactive injection (Saber et al., 2023).

A third mechanism operates through distributed cooperative control. In a four-DG microgrid, false data injection on communication links alters neighbor information used by distributed secondary voltage and frequency controllers. The compromised feedback is modeled as

$24$3

with either a non-periodic scaling attack,

$24$4

or a periodic modulation,

$24$5

Because the distributed controller uses neighbor signals through consensus terms, a compromised node behaves as a fake agent whose falsified measurements propagate through the cooperative layer (Khan et al., 2021).

A fourth mechanism targets primary frequency control in inverter-based resources by changing droop coefficients in real time. The attacked inverter contribution becomes

$24$6

instead of the nominal proportional droop law. In the RL-based study, the adversary can tamper with only one inverter per time step and chooses $24$7, thereby reversing droop, removing stabilizing action, or applying a non-nominal positive droop at selected times (Prasad et al., 2024).

4. Dynamical mechanisms and grid-level consequences

The local dynamical consequence of a fake inverter depends on the control surface being manipulated. For Volt-VAr attacks, the relevant mechanism is the coupling between feeder voltage and inverter reactive power. Around an operating voltage $24$8, the paper linearizes the interaction as

$24$9

so that

$[\theta, \omega, V^e, V]$0

with local stability requiring $[\theta, \omega, V^e, V]$1. Malicious parameter choices that make $[\theta, \omega, V^e, V]$2 large or shift $[\theta, \omega, V^e, V]$3 into a steep segment can violate this condition and produce sustained or growing oscillations (Saber et al., 2023).

At the wide-area level, coordinated attacks on distributed PV inverters act primarily through frequency. The Australian assessment models the aggregate rate of change of frequency as

$[\theta, \omega, V^e, V]$4

with $[\theta, \omega, V^e, V]$5 Hz, and models reserve ramping as

$[\theta, \omega, V^e, V]$6

The central observation is that midday distributed PV output reduces synchronous plant dispatch, so both contingency reserves and system inertia are low exactly when distributed PV output is high (Hui et al., 20 May 2025).

The reported vulnerable regime is quantitatively specific. Distributed PV can reach approximately $[\theta, \omega, V^e, V]$7 of load at noon. In representative windows, ESS Raise is approximately $[\theta, \omega, V^e, V]$8 GW while DPV is approximately $[\theta, \omega, V^e, V]$9–$\{x_i,t_i\}$0 GW. A coordinated DPV loss of approximately $\{x_i,t_i\}$1 GW, corresponding to approximately $\{x_i,t_i\}$2–$\{x_i,t_i\}$3 of DPV and approximately $\{x_i,t_i\}$4–$\{x_i,t_i\}$5 of total load at the moment, is enough to drive frequency to the UFLS threshold in approximately $\{x_i,t_i\}$6–$\{x_i,t_i\}$7 seconds, depending on inertia. Conversely, a DPV hike of approximately $\{x_i,t_i\}$8 GW, approximately $\{x_i,t_i\}$9–$h_T$0 of DPV, can reach OFGS in approximately $h_T$1–$h_T$2 seconds under low-inertia scenarios. The paper therefore concludes that significant impact is only observed under careful planning and orchestration, but that a relatively low share of active DPV can be impactful when timed to coincide with low ESS-to-DPV ratios and low RoCoF control (Hui et al., 20 May 2025).

The RL-based primary-frequency-control study complements this by showing that timing and target selection matter even under a one-target-per-step constraint. Enumerating all time-invariant attacks over a 5 s horizon yields a best cumulative reward of $h_T$3 by perturbing G7 with $h_T$4. Three PPO runs on the time-varying action space produce $h_T$5, $h_T$6, and $h_T$7, with the strongest policy primarily targeting G6 and switching intermittently to G7 and G3. This indicates that time-varying schedules aligned with natural oscillations can be more damaging than a constant manipulation (Prasad et al., 2024).

5. Detection, verification, and mitigation architectures

Detection and mitigation approaches differ according to whether the objective is runtime attestation, parameter screening, or resilient closed-loop control. For firmware attacks, one approach instruments inverter controllers with custom design-for-security hardware performance counters. These HPCs periodically measure the order of various instruction types executed by the firmware, and machine-learning classifiers detect deviations from benign instruction-order profiles. The work reports that firmware modifications are successfully identified by custom-built HPCs utilizing various machine learning-based classifiers, and positions this as a complement to secure boot, runtime attestation, network intrusion detection, and power-signal anomaly detection (Kuruvila et al., 2020).

For malicious Volt-VAr updates, detection is performed at the point of receipt using only local inverter measurements. The feature set includes the new VVC parameters $h_T$8, magnitudes of three-phase voltages and currents, dq-frame quantities $h_T$9, and an oscillation proxy

$\theta$00

with $\theta$01 and $\theta$02. A compact MLP is trained offline with forward pass

$\theta$03

and binary cross-entropy plus $\theta$04 regularization. The best-performing model uses three layers with $\theta$05, $\theta$06, and $\theta$07 neuron, with $\theta$08. On the held-out $\theta$09 test set, the reported metrics are accuracy $\theta$10, precision $\theta$11, recall $\theta$12, and F1-score $\theta$13, with false positive rate approximately $\theta$14 and false negative rate approximately $\theta$15 (Saber et al., 2023).

Mitigation can also be integrated directly into the secondary controller rather than separated into detection and fallback. In the cooperative microgrid study, the baseline distributed secondary controller uses

$\theta$16

and

$\theta$17

The proposed mitigation replaces the PI-based distributed secondary voltage controller with a single-hidden-layer feedforward neural network with input size $\theta$18, hidden layer $\theta$19 neurons with tansig activation, and output layer $\theta$20 neuron with purelin activation. Trained offline on normal and attack scenarios sampled at $\theta$21 ms, the ANN generates resilient voltage references that preserve nominal operation under both non-periodic and periodic false-data injection initiated at $\theta$22 s (Khan et al., 2021).

The defensive implications are layered rather than singular. Secure defaults, authenticated updates, secure boot, and rate-limited parameter changes reduce exposure; runtime attestation and HPC-based monitoring target firmware execution; local-learning schemes verify candidate control curves; and resilient controllers maintain operation when communication-layer measurements are falsified. This suggests that fake-inverter defense is structurally a defense-in-depth problem rather than a single-classification problem.

6. Limits, assumptions, and research directions

The surrogate-model literature emphasizes that fidelity depends on informative excitation, observability, and regularization. The PI-LNM case study assumes training data generated by sudden load changes spanning $\theta$23–$\theta$24 p.u., recorded for $\theta$25 seconds at $\theta$26 s; poorly excited or noisy data may reduce accuracy, weakly observable internal dynamics make residual learning harder, and larger discrepancies than the demonstrated $\theta$27 parameter mismatch may require stronger residual capacity or parameter-estimation loops. The same framework is described as naturally extensible to grid-following inverters, different filter topologies, multiple OEM units, protections, and multi-inverter interaction (Kwon et al., 21 Jul 2025).

The security literature imposes its own assumptions. HPC-based detection requires access to instruction-order information and relatively stable benign instruction-order signatures; legitimate firmware updates can change those signatures and trigger false positives, and portability across MCU, DSP, and SoC architectures requires retraining (Kuruvila et al., 2020). The Volt-VAr detector is demonstrated on a 9-bus urban feeder with four distributed generators, and extension to different topologies, higher PV penetrations, other control modes such as Volt-Watt and frequency-watt, and one-class or hybrid rule/ML detection is presented as future work (Saber et al., 2023). The ANN-based secondary-control paper is mitigation-by-design rather than explicit detection, provides no formal Lyapunov or passivity-based stability proof, and does not model communication delays, packet losses, or noise (Khan et al., 2021). The RL attack-discovery study includes no explicit detector in the loop, uses relatively simple discrete actions, and notes a rough reward landscape with substantial variance across PPO runs (Prasad et al., 2024). The Australian system-level assessment notes uncertainty in load-inertia estimation, operational difficulty of covertly coordinating thousands of devices, and limited data transparency outside the Australian context, even though the broader lesson is the misalignment of contingency capacity and inertia with distributed-PV output (Hui et al., 20 May 2025).

Taken together, these limitations indicate that fake inverters are not a unitary object but a research boundary spanning system identification, cyber-physical security, embedded monitoring, local control verification, and market-aware stability analysis. A plausible implication is that future work will increasingly couple these layers: physics-informed surrogates for hidden controls, device-level behavioral attestation, local screening of remotely communicated settings, resilient secondary control, and system-level reserve design that explicitly accounts for adversarially manipulated inverter fleets.