A new attack can throw off industrial intrusion detection systems just by shifting when packets arrive, not what's in them.
Researchers describe the Phantom State Attack, or PSA, in a paper on arXiv. Most machine learning intrusion detection systems for Industrial Internet of Things networks don't just look at individual packets. They bucket traffic into time windows and reconstruct what the system was doing from there. PSA exploits that bucketing. It nudges the timing of an attack flow's own packets by a small, calibrated amount, just enough to push observations across a window boundary. No packets are altered, no features are perturbed, and the detector is never queried. The researchers tested PSA against Random Forest, MLP, and XGBoost classifiers on two datasets, ToN-IoT and CIC IIoT 2025, and found it degrades detection on flows with enough packets to be redistributed across windows.
Most adversarial research against intrusion detection assumes the attacker can query the model repeatedly or has learned what normal traffic looks like. PSA needs neither. That matters because it lowers the bar: an attacker doesn't need gradient access or a model of benign behavior, just knowledge of how the monitoring pipeline buckets time. A query-based attack in the same study got higher raw success rates, but it needed many queries per window. PSA needed none.
The catch is that PSA's effect is conditional. It only works on flows with enough packets to be meaningfully redistributed; sparse flows are barely affected. That's a real limitation, not a universal bypass, but it still points to windowing itself, a design choice baked into nearly every streaming detection pipeline, as an underexamined weak point worth auditing before anyone touts it as a complete defense.