Why did it move? Rain, a dead sensor, or an attack

Ask about a reading and a stretch of time, in the console or through your own AI assistant. You get one of four answers, the weather, the instrument, a change of operation, or a reading that no longer fits its neighbours, each with the numbers behind it. Or you get “I can’t tell”, with the reason. The answer is worked out from the plant’s own readings; no language model decides it.

It is built to avoid the costliest mistake first: blaming a dead sensor on the rain, so that nobody goes out to a pump that is fine while the real fault stays. And it never says “you are under attack”. When a reading looks healthy but no longer fits the readings around it, it says so, says it could be an attack or a sensor failing slowly, and asks you to check it on site.

These are the explainer’s own words on public data, the first example of each kind in the set it was built on, so they show what an answer looks like, not how often it is right. That is measured below, on plants it had never seen.

What it does not claim. It is not an intrusion detection system and does not replace one. An attacker who replays old readings, or who moves the neighbouring readings too, is not claimed to be caught. And a person who changes a setting without it being on record can look like an attack; that is why it says “check who changed it”, not “attack”.

Tested on plants it had never seen

A level jumps. Was it the rain, a sensor that died, someone changing a setpoint, or someone who should not be in the system? We built an explainer that expects each reading from its own past, its neighbours, the rain gauges and the setpoints, and names a cause with its reasons, or says it cannot tell. No language model decides; one may only put the reasons into words. We tested it on 165 deviations on three public plants it had never seen, chosen and locked before the test: two real wastewater networks, in Austria and England, and an industrial security testbed with recorded attacks.

On the two networks it was right on 56 of 98 deviations and wrong on 2; the checks we already ship were right on 62 and wrong on 8, so overall it did not beat them. The difference is in the costliest mistake, blaming a dead sensor on the rain: our checks did that 7 times, the explainer 1 time. Four small local language models, given the same evidence, were wrong on 32 to 93 of every 100.

On the security testbed it hardly answered. Its export came in several files, and our reader kept only the first one of each reading, so on 63 of 67 deviations it saw too little history and said it could not tell. It said attack once, and was right; that is no test of finding attacks. The reader will be fixed and tested on new locked data, not on this.

P54, written down before the held-out run: PARTIAL. Finding attacks: FALSIFIED.