Adversarial Machine Learning in Industrial IoT: A Systematic Review of Attack Realism, Defense Trade-Offs, and Deployment Gaps
TL;DR
This SLR analyzes 50 research articles to provide a holistic view of AML threats in IIoT systems and identifies seven distinct attack types: gradient-based perturbations, GAN-generated samples, poisoning attacks, reinforcement learning-based (RL) strategies, saliency-based feature manipulation, false data injection, and hybrid approaches.
Abstract
Modern Industrial Internet of Things (IIoT) integrates machine learning models for monitoring and control. However, they remain vulnerable to adversarial machine learning (AML) attacks, where an adversary adds small changes to the input data. These small changes degrade model quality, reduce accuracy, and can ultimately compromise the safety and security of the entire system. AML research in IIoT often focuses on individual attack types, defense methods, and datasets. Existing reviews lack a unified quantitative and system-level perspective. Therefore, a systematic literature review (SLR) is needed to provide a holistic analysis of existing attacks, defenses, and databases. This SLR analyzes 50 research articles to provide a holistic view of AML threats in IIoT systems and identifies seven distinct attack types: gradient-based perturbations, GAN-generated samples, poisoning attacks, reinforcement learning-based (RL) strategies, saliency-based feature manipulation, false data injection, and hybrid approaches. To illustrate the range of observed impacts, selected studies report the following degradation examples: saliency-based attacks cause accuracy reductions of 6–11 percentage points; iterative gradient attacks reduce accuracy from 95–99% to 30–40% in SIEM systems; and RL-based attacks reduce detection rates from 100% to 0% in rule-based IDS settings. In addition to the analysis of attack types, this SLR also evaluates current defense methods to protect IIoT systems. It has been observed that existing defense mechanisms lack generalization and require high computational resources. Moreover, the testing is performed under simplified threat models. The analysis of datasets further shows a clear gap between realistic industrial benchmarks (such as SWaT, WADI, and NSL-KDD) and synthetic datasets used for controlled experiments. By connecting attack behavior, defense performance, dataset characteristics, and system-level effects, this SLR identifies the key research gaps that must be addressed in future work.