Redefining Adversarial Dynamics: Co-Evolution of Attack and Defense Strategies in AI-Enabled Power Cyber-Physical Systems

1. Introduction

1.1. Power CPS in the AI Era: Opportunities and New Risks

The evolution of power systems into highly interconnected Power Cyber-Physical Systems (Power CPS) represents one of the most transformative advancements in modern energy infrastructure [1,2,3]. Power CPS tightly integrate physical grid components—such as generators, substations, transmission lines, and distributed energy resources (DERs)—with digital layers of computation, communication, and control [4,5]. This integration enhances the grid’s capability to monitor, optimize, and manage energy flows in real time, supporting emerging paradigms such as smart grids [6], microgrids [7], integrated energy systems [8], and transactive energy markets [9].

The deployment of Artificial Intelligence (AI) technologies has further accelerated this transformation. AI enables Power CPS to process vast amounts of real-time data, automate control strategies, and optimize operations across multiple spatial and temporal scales [10,11,12]. Applications include load forecasting, fault detection, renewable energy integration, and market optimization [13,14,15]. AI techniques such as machine learning (ML), deep learning, reinforcement learning (RL), and federated learning (FL) are increasingly embedded in energy management systems, supervisory control and data acquisition (SCADA) platforms, and distributed control frameworks [16,17,18].

However, these same AI capabilities introduce new attack surfaces and adversarial risks. Malicious actors can exploit AI’s data dependencies, model vulnerabilities, and control influence to launch AI-augmented cyber-physical attacks [19,20]. Techniques such as adversarial machine learning [21], model poisoning, backdoor insertion, and reinforcement learning-based attack policy optimization have emerged as credible threats. These attacks can mislead detection systems, manipulate grid control actions, and cause widespread disruptions [22,23].

1.2. From Static Defense to Dynamic Adversarial Co-Evolution

Traditional security strategies in power systems have largely focused on static defenses, such as cryptographic protocols, access control mechanisms, and rule-based anomaly detection. While these methods are essential, they often assume a static threat model, where known vulnerabilities are patched, and known attack patterns are detected [24,25].

In contrast, modern adversaries leverage dynamic, adaptive, and AI-driven strategies [26]. They continuously observe system behavior, learn detection patterns, and evolve attack techniques to bypass defenses. This creates a co-evolutionary arms race, where attackers and defenders engage in continuous strategy adaptation and counter-adaptation [27,28,29,30,31,32,33,34,35,36,37,38].

For example, a defender may deploy a machine learning-based anomaly detector, only to find that an attacker uses generative adversarial networks (GANs) to craft undetectable attack patterns. In response, the defender might improve detection with adversarial training, prompting the attacker to shift to model poisoning or federated learning attacks [39,40]. This adversarial dynamic demands defense strategies that evolve as quickly as the threats they face.

Recognizing this challenge, this review proposes to redefine the cybersecurity paradigm for Power CPS. Rather than viewing defense as a static barrier, we advocate for dynamic, co-evolutionary security frameworks that continuously adapt to adversarial strategies, leveraging AI not only as a target of attacks but as a strategic defense enabler.

1.3. Contributions and Structure of This Review

This review aims to fill critical gaps in the existing literature by:

• Characterizing the emerging class of AI-augmented cyber-physical threats, including adversarial ML, RL-based attacks, and coordinated multi-agent strategies.
• Analyzing the limitations of current AI-based defense mechanisms, particularly their vulnerability to adversarial manipulation and their lack of adaptive resilience.
• Proposing co-evolutionary defense frameworks, integrating adversarial game theory, digital twins, and human-in-the-loop mechanisms to counter evolving threats.
• Identifying research gaps, including theoretical, experimental, and organizational challenges in realizing dynamic, adaptive cyber-physical security for energy systems.

The remainder of this review is organized as follows. Section 2 analyzes the evolution of adversarial threats in AI-enabled Power CPS, moving beyond traditional attack models. Section 3 reviews the current state of AI-based defense capabilities and their limitations. Section 4 shifts focus to the offensive use of AI, exploring how adversaries leverage AI to craft advanced attack strategies. Section 5 introduces co-evolutionary defense frameworks that integrate adaptive learning, game-theoretic reasoning, and human oversight. Section 6 outlines future research directions and collaboration needs. Finally, Section 7 concludes the review with key insights and a call to action for advancing dynamic, co-evolutionary security paradigms in Power CPS.

2. Adversarial Threat Evolution in AI-Enabled Power CPS

The integration of AI into Power CPS has enabled transformative operational improvements, yet it has simultaneously amplified the sophistication, stealth, and impact potential of cyber-physical attacks [41,42,43]. This section systematically analyzes how adversarial threat models have evolved—from conventional cyber-physical exploits to multi-agent, AI-enhanced, and game-theoretically optimized attack strategies—posing unprecedented challenges to grid security and resilience.

2.1. Traditional Cyber-Physical Attacks Revisited

Early cyber-physical attacks on power systems predominantly targeted three interrelated domains: the cyber layer, the physical infrastructure, and their cyber-physical interactions [44]. At the cyber level, attackers exploited vulnerabilities SCADA systems, energy management systems, and substation automation platforms [45]. Techniques such as network intrusions, denial-of-service (DoS) attacks, and credential theft were commonly employed to gain unauthorized access, disrupt communication flows, or escalate privileges within control networks [46,47].

On the physical side, adversaries focused on direct manipulation of sensors and actuators. Sensor tampering or data injection could mislead state estimation algorithms, while malicious control of physical components—such as remotely opening breakers—could cause service interruptions or equipment damage. Although physical access posed a higher logistical barrier, the consequences of successful intrusions were often severe [48].

Most critically, attackers began exploiting the interplay between cyber and physical domains through cyber-physical interaction exploits [49,50,51]. One of the most notable techniques was the False Data Injection Attack (FDIA), wherein adversaries manipulated measurement data in a way that remained physically plausible, thereby evading traditional bad data detection mechanisms [52]. Replay attacks also gained prominence, wherein previously recorded valid data was resent to mislead control systems and conceal ongoing intrusions [53,54,55].

Despite their impact, these early attacks were typically static, manually orchestrated, and reliant on pre-identified system weaknesses. Their success hinged on the attacker’s system knowledge and timing precision, which limited their scalability and adaptability. As a result, traditional cyber-physical threats, while disruptive, lacked the dynamic learning and strategic sophistication exhibited by today’s AI-enhanced adversaries [56].

2.2. The Emergence of AI-Augmented Attacks

As AI technologies are increasingly integrated into power grid operations and defense, adversaries have begun to exploit these same tools to develop more adaptive, stealthy, and intelligent cyber-physical attacks [57,58,59]. AI-augmented threats rely on data-driven modeling to understand system behavior, identify detection blind spots, and optimize attack timing and impact under operational constraints. Among the most significant developments in this domain is the rise of adversarial machine learning. By targeting machine learning models used for anomaly detection or forecasting, attackers can craft inputs that evade detection yet induce unsafe system states [60,61]. Poisoning attacks, for instance, involve contaminating training datasets to impair model performance, while backdoor attacks embed hidden triggers that cause misclassifications when activated under specific conditions [62,63,64].

Reinforcement learning (RL) further amplifies attack sophistication by enabling adversaries to train agents that learn optimal attack policies through interaction with simulated environments [65]. These agents can identify the most disruptive moments to launch false data injection attacks (FDIAs), sequentially manipulate control points to induce cascading failures, or exploit feedback loops by learning how system controls respond to perturbations. In parallel, GANs empower attackers to produce highly realistic yet falsified sensor data [66]. These synthetic signals are carefully crafted to mimic legitimate system behavior, allowing attacks to bypass traditional AI-based detectors through statistical camouflage [67].

The decentralized nature of federated learning (FL)—intended to protect data privacy by distributing model training across edge entities—also introduces new vulnerabilities [68,69,70]. Adversaries can poison model updates, conduct Sybil attacks by impersonating multiple benign nodes, or even infer sensitive data from model parameters shared during the aggregation process [71,72]. The same mechanisms that FL relies on to enable collaboration can thus be weaponized to undermine global model integrity [73].

2.3. Multi-Agent, Multi-Stage, and Coordinated Threat Dynamics

In addition to individual AI-enhanced attacks, modern adversaries increasingly adopt coordinated strategies that span multiple agents, stages, and system layers [74]. These multi-agent threats involve distributed entities working in concert to simultaneously compromise cyber and physical infrastructure, synchronize attacks across geographically dispersed assets, and exploit operational interdependencies between market dynamics, control hierarchies, and communication protocols. Such coordinated behavior enables system-wide disruption while minimizing the risk of early detection [75,76].

These campaigns often unfold in carefully planned stages. Initially, attackers engage in reconnaissance to gather information about system topology, data flows, and defensive mechanisms. This is followed by privilege escalation through credential theft or exploitation of software vulnerabilities, allowing adversaries to gain access to critical nodes. Once entrenched, they may engage in stealthy manipulation—gradually introducing false data or altering control signals to destabilize the system. At the peak of the campaign, coordinated actions aim to maximize operational impact, such as triggering cascading outages or disrupting electricity market prices. Even after achieving their primary objectives, attackers may persist within the system, erasing traces of compromise and maintaining access for future operations [77,78].

These attack strategies often traverse multiple layers—cyber infrastructure, physical assets, market mechanisms, and human operators—forming cross-layer threats that are exceedingly difficult to detect [79]. Signals indicating an attack may be weak or fragmented across disparate domains, requiring defenders to perform real-time correlation across system components, time scales, and organizational boundaries. The rise of such coordinated, AI-driven, and cross-domain adversaries underscores the inadequacy of static or isolated defense mechanisms and reinforces the need for holistic, adaptive, and intelligence-driven security architectures [80,81,82].

2.4. Summary of Evolving Adversarial Dynamics

To highlight the escalating sophistication of threats facing Power CPS, Table 1 contrasts traditional cyber-physical attacks with emerging AI-enhanced adversarial strategies across key dimensions.

This emerging landscape underscores the urgent need for defense paradigms that move beyond static detection. Defenders must anticipate adversarial learning, coordinated attack policies, and game-theoretic behavior that continuously evolve in response to deployed defenses [83].

3. AI for Defense: Current Capabilities and Limitations

While AI-augmented attacks present unprecedented threats, the same technological advancements can also be harnessed to enhance defense. Power CPS increasingly adopt AI to detect anomalies, orchestrate coordinated responses, and learn optimal defense policies [84,85]. However, these defenses are not without limitations. This section critically reviews the current state of AI-based defense mechanisms, including anomaly detection, RLfor defense, FL for distributed coordination, and the inherent challenges of interpretability, robustness, and adaptability.

3.1. Machine Learning-Based Anomaly Detection

AI-powered anomaly detection has emerged as one of the most widely adopted defense strategies in Power CPS [86,87,88]. By learning from historical and real-time operational data, ML models are capable of identifying deviations that may signal cyber-physical intrusions. These approaches include supervised learning methods such as support vector machines, random forests, and neural networks, which rely on labeled attack and benign samples to learn decision boundaries [89,90]. Unsupervised methods, on the other hand, such as clustering and density-based techniques like k-means and DBSCAN, attempt to flag outliers in unlabeled data distributions. Semi-supervised models bridge the two by learning from normal operational data and detecting deviations from it. These techniques eliminate the need for extensive rule-based programming and can scale to complex systems, making them particularly effective in detecting known patterns of abnormal behavior [91,92,93].

However, ML-based anomaly detectors are not without significant limitations. Grid operations are inherently dynamic and diverse, often triggering false positives that can overwhelm system operators and erode trust in automated alerts [94,95]. In addition, attackers can exploit these models by training surrogate systems that reveal detection blind spots, enabling the generation of adversarial inputs that bypass the detectors. The heavy dependence of ML models on the representativeness of training data also limits their generalization to unseen scenarios [96,97,98]. Most critically, the black-box nature of many ML architectures hinders interpretability, leaving operators without insights into why a particular alert was generated—thus complicating decision-making and response prioritization [99].

3.2. Reinforcement Learning for Autonomous Defense

RLoffers a promising pathway toward adaptive, self-learning defense mechanisms in Power CPS [100,101,102]. By interacting with a simulated environment, RL agents can learn optimal policies through trial-and-error feedback. This capacity allows them to dynamically tune anomaly detection thresholds based on evolving system conditions, orchestrate automated mitigation strategies such as rerouting power flows or isolating compromised nodes, and balance defense actions with system performance goals to minimize service disruption [103,104]. The ability of RL to adapt over time makes it especially attractive in confronting previously unseen or evolving attack tactics [105].

Nevertheless, RL-based defenses introduce new and serious risks. The effectiveness of learned policies is often limited by the realism of the training environment, and a significant simulation-to-reality gap can arise when deployed in actual grid settings [106]. Moreover, RL systems typically require a large number of iterations to converge on effective policies, which may not be practical in rapidly evolving threat landscapes [107]. These systems are also vulnerable to adversarial manipulation—attackers can poison the training environment or guide the learning process toward ineffective or even harmful behaviors. Perhaps most concerning is the lack of human oversight; fully autonomous RL agents, if not carefully constrained, may take actions that compromise system safety or contradict operator intentions, especially in high-stakes scenarios [108,109,110].

3.3. Federated Learning and Collaborative Defense

FL has emerged as an attractive approach for distributed defense coordination, particularly in privacy-sensitive and geographically dispersed grid environments [111,112]. In FL, individual nodes such as substations or microgrids train local models on their own data and share only model updates with a central aggregator. This decentralized framework supports privacy preservation by keeping raw data local, enhances scalability by enabling parallel learning across heterogeneous devices, and improves context-specific detection by tailoring models to localized operational characteristics [113,114,115].

Yet, despite these advantages, FL introduces several unique vulnerabilities. Malicious participants can submit corrupted model updates, a strategy known as model poisoning, which can degrade the accuracy and robustness of the global model [116]. Additionally, an attacker may launch Sybil attacks by posing as multiple legitimate nodes, thereby dominating the aggregation process and steering the learning trajectory toward compromised outcomes [117,118]. The iterative exchange of model updates also incurs significant communication overhead, particularly in large-scale or latency-sensitive deployments. Compounding these issues is the limited explainability of the resulting aggregated models, which often function as complex ensembles that are difficult for operators to interpret or audit—thus undermining trust and real-time validation [119,120,121].

3.4. Challenges in Interpretability, Robustness, and Adaptation

Across all AI-based defense strategies, systemic challenges persist in the domains of interpretability, robustness, and adaptability [122,123,124]. Many machine learning and deep learning models operate as opaque black boxes, offering little transparency into how or why certain predictions are made [125,126]. This lack of interpretability impairs operator confidence and hinders the adoption of human-in-the-loop defense architectures, where timely and informed decision-making is critical [127,128,129].

Equally problematic is the vulnerability of AI defenses to adversarial manipulation. Sophisticated attackers can craft inputs specifically designed to exploit model blind spots (evasion attacks), corrupt the training process via poisoned data or manipulated updates (model poisoning), or embed hidden triggers that activate malicious behavior under specific conditions (backdoor attacks) [130,131]. These threats erode the reliability of AI defenses and expose systems to subtle, long-term degradation in security performance [132,133,134].

Furthermore, most existing AI models are static in nature, trained on historical data and incapable of adapting to rapidly changing attack landscapes [135]. Overfitting to past scenarios renders these models ineffective against novel threats. While continual learning and online adaptation frameworks have been proposed, their deployment in operational Power CPS remains limited due to concerns over stability, system compatibility, and the lack of well-established safety guarantees [136,137,138].

To evaluate the current landscape of intelligent defense approaches in Power CPS, Table 2 summarizes representative AI-driven strategies, along with their strengths and inherent limitations.

In summary, while AI offers promising capabilities for enhancing Power CPS defense, these mechanisms are not inherently resilient to the very adversarial tactics they aim to counter. Without co-evolutionary adaptation, explainability, and human oversight, AI-based defenses risk being outpaced by dynamic, AI-augmented attackers [139,140].

4. Adversarial AI for Attack Strategy Evolution

As defenders increasingly rely on AI to secure Power CPS, adversaries have also begun leveraging AI to accelerate, optimize, and evolve their offensive strategies [141,142,143]. This section explores how attackers exploit advanced AI techniques—such as GANs, Reinforcement Learning (RL), model poisoning, and federated learning manipulation—to craft stealthy, adaptive, and highly impactful cyber-physical attacks.

4.1. GANs for Stealthy Attack Crafting

GANs represent a powerful tool for adversaries seeking to craft stealthy and evasive attack strategies [144,145]. A typical GAN architecture involves two neural networks—the generator and the discriminator—engaged in a minimax competition. The generator aims to produce synthetic data indistinguishable from real observations, while the discriminator attempts to distinguish genuine data from fake inputs [146]. Through this adversarial training loop, GANs can learn to generate highly realistic data patterns that mimic legitimate system behavior [147,148,149].

In the context of Power CPS, attackers can exploit GANs to generate falsified measurement data—such as voltage, current, or frequency readings—that conform to physical laws while steering the system toward unsafe operating states [150]. These data streams may pass unnoticed through conventional validation checks or anomaly detectors. Furthermore, by learning the statistical distribution of normal operations, GANs can craft attack signatures that are camouflaged within routine noise, thereby reducing the likelihood of detection [151,152,153]. Such techniques are especially effective in evading ML-based defenses, as the generated data targets specific weaknesses in model generalization.

However, the use of GANs in cyber-physical attacks also presents challenges. Training effective models requires access to high-quality system data, which may not always be available to the attacker [154,155,156]. Overfitting to specific system states can limit a GAN’s ability to generalize under dynamic conditions. Moreover, defenders may employ advanced countermeasures—such as multi-source data fusion, temporal consistency checks, or physics-aware anomaly detection—to expose GAN-generated anomalies [157,158,159]. These open questions highlight the evolving arms race between generative deception and intelligent detection [160].

4.2. Reinforcement Learning-Based Attack Policy Optimization

Adversarial RLenables attackers to develop sophisticated, sequentially optimized attack strategies by interacting with a simulated representation of the target system [161,162,163]. In this framework, the attacker is modeled as an intelligent agent that explores the system’s response space and exploits learned policies to maximize disruption while minimizing the risk of detection. By defining custom reward functions—such as maximizing power imbalances, inducing cascading failures, or manipulating market dynamics—RL agents can autonomously discover highly effective attack trajectories [164,165].

Such agents can learn to time false data injection attacks to coincide with vulnerable operational windows, such as peak loads or renewable variability [166]. They can also coordinate actions across multiple control points to exploit system interdependencies and trigger cascading failures [167]. Additionally, adversaries may adapt their strategies in response to observed defense behaviors, creating a dynamic co-evolution in which the attacker continuously refines its policy to stay ahead of the defender [168,169,170].

Yet, despite their power, RL-based attacks are constrained by practical limitations. Training effective attack policies requires access to high-fidelity simulators that accurately capture the cyber-physical dynamics of real-world systems [171]. Even with such simulators, policies developed in virtual environments may not transfer reliably to live systems due to noise, latency, or model inaccuracies [172]. Furthermore, the computational overhead and domain expertise required to train robust RL agents can be substantial. These barriers make RL-based attacks feasible primarily for well-resourced adversaries but also underscore the growing need for adaptive, simulation-informed defense planning [173,174].

4.3. Model Poisoning and Backdoor Attacks on AI Defenses

Model poisoning and backdoor attacks represent insidious threats that compromise the integrity of AI-based defense mechanisms [175]. In model poisoning, attackers subtly inject malicious data into the training process, biasing the learned model to misclassify targeted attack patterns as normal behavior [176,177]. In FL settings, this can be achieved by submitting corrupted model updates during aggregation, degrading the global model’s performance across the network [178].

Backdoor attacks take this one step further by embedding hidden triggers into the model itself [179,180]. When these specific inputs are encountered, the model behaves incorrectly—either ignoring malicious activity or raising false alarms for benign behavior [181]. For example, a compromised reinforcement learning controller might operate normally under most conditions but misbehave catastrophically when it receives a particular control signal. Similarly, a poisoned anomaly detector may consistently overlook threats targeting specific substations or assets [182,183].

Detecting and mitigating these threats remains a significant challenge. Backdoors and poisoned models often appear benign under standard evaluation protocols, and their activation patterns may remain dormant until explicitly triggered [184,185]. Although defensive techniques such as robust aggregation, differential privacy, or adversarial training can offer partial protection, they are far from foolproof. The covert nature of these attacks—and their compatibility with collaborative learning paradigms like FL—makes them especially dangerous in distributed Power CPS environments [186].

4.4. Exploiting Federated Learning in Distributed Defense

Federated learning, while beneficial for preserving data privacy and enabling decentralized collaboration, presents a fertile ground for adversarial exploitation [187,188]. Attackers can leverage the very principles that make FL attractive to subvert model integrity and leak sensitive operational insights [189,190,191]. One prominent strategy is the Sybil attack, in which a single adversary creates multiple identities to dominate the model aggregation process, thereby skewing the global model’s behavior in favor of the attacker’s goals.

Another subtle method is model drift manipulation, where malicious clients incrementally introduce degradation into the global model over successive training rounds. This gradual erosion of accuracy may go unnoticed until significant damage has already occurred [192,193]. Additionally, attackers may analyze shared model updates to infer private information about other nodes, raising serious concerns about privacy leakage [194].

For instance, a compromised FL aggregator could tamper with aggregation logic to prioritize malicious updates, extract operational trends from model patterns, or inject misleading updates from fake clients to destabilize the overall learning process. These exploits highlight the urgent need for resilient defenses tailored to the distributed nature of FL [195,196].

Mitigation strategies include secure aggregation protocols such as Byzantine-resilient methods, which can tolerate a bounded number of adversarial clients without compromising the model [197]. Enforcing strong client authentication mechanisms helps prevent Sybil-based infiltration, while anomaly detection algorithms applied to model updates can identify suspicious contributions. Nevertheless, implementing these defenses at scale remains an open research challenge, especially when balancing privacy, scalability, and real-time response [198,199,200].

The emergence of adversarial AI techniques poses significant threats to Power CPS by enhancing the stealth, coordination, and effectiveness of cyber-physical attacks. Table 3 outlines key adversarial AI methods, their offensive capabilities, and corresponding defense implications.

The growing use of AI by attackers highlights the need for co-evolutionary defense frameworks that anticipate and counter these strategies. The next section will introduce such frameworks, leveraging adversarial game theory, digital twin-based co-simulation, and human-in-the-loop adaptation to build dynamic and resilient security architectures.

5. Co-Evolutionary Defense Frameworks

Given the dynamic and evolving nature of AI-augmented cyber-physical attacks, Power CPS require defense paradigms that continuously adapt to adversarial strategies [201,202,203]. Static defense models quickly become obsolete as attackers evolve their techniques. In response, this section introduces co-evolutionary defense frameworks, where defenders leverage game-theoretic reasoning, digital twin-based simulation platforms, and human-in-the-loop decision support to engage in ongoing strategy refinement and resilience validation.

5.1. Adversarial Game Theory for Cyber-Physical Defense Design

Game theory offers a rigorous mathematical framework to analyze strategic interactions between adversaries and defenders in Power CPS environments [205,206,207]. It enables defenders to anticipate how attackers might adapt their strategies in response to deployed defenses and to proactively design countermeasures that are robust even under worst-case assumptions [208]. Importantly, game-theoretic models can help balance defense investments against operational costs and risk exposure, supporting more informed and strategic resource allocation [209,210].

Various forms of adversarial games have been applied to power system security. In static games, attackers and defenders select their strategies simultaneously, offering insights into one-shot interactions under complete information [211]. Sequential games extend this framework by modeling turn-based interactions, reflecting more realistic attack-defense-response cycles [212,213]. Repeated games capture long-term engagements where both sides adapt their strategies over time. Bayesian games, on the other hand, incorporate uncertainty about the opponent’s capabilities, goals, or knowledge, better reflecting real-world asymmetries [214,215].

These models have found concrete application in Power CPS through resource allocation games—optimizing the placement of scarce monitoring or encryption tools—and timing games that identify optimal moments for deploying defenses or triggering attacks. Information disclosure games have also emerged, evaluating the trade-offs between transparency and security risk when revealing system status to external stakeholders [216].

Despite their promise, applying game theory to real-world CPS defense is not without challenges. Modeling high-dimensional, multi-agent systems with realistic assumptions is computationally intensive, and deriving stable equilibria can be intractable [217]. Moreover, the simplifications required to make game models analytically solvable often fail to capture the full behavioral complexity of adaptive, intelligent adversaries [218,219,220].

5.2. Digital Twins and Co-Simulation Platforms for Dynamic Validation

Digital twins offer a transformative capability for dynamic security validation by creating real-time, high-fidelity digital representations of physical power systems [221,222,223]. In the context of cyber-physical defense, digital twins can concurrently simulate physical grid dynamics, cyber layer behaviors, and even human operator responses under varying attack scenarios. This comprehensive representation allows for detailed exploration of how AI-augmented attacks propagate and how defense strategies might adapt in response [224].

A key advantage of digital twins lies in their capacity to facilitate co-evolutionary strategy testing in a safe and controlled environment [225]. Unlike traditional static testbeds, digital twins can model dynamic changes over time, allowing defenders to simulate and refine adaptive strategies before deploying them in operational systems. Moreover, these simulations provide valuable insights into the trade-offs between defense effectiveness and system performance, enabling more precise operational impact assessments [226].

To achieve this, co-simulation platforms integrate multiple domain-specific simulation engines, allowing for the synchronized modeling of cyber operations, physical infrastructure, market behaviors, and human decision-making. This multi-layer integration is critical for analyzing cross-domain interactions, training operators in realistic environments, and coordinating defense across diverse subsystems [227,228].

However, large-scale co-simulation comes with significant implementation challenges. Achieving scalability requires high computational capacity, and maintaining model fidelity is essential to avoid overlooking critical dynamics. Synchronizing heterogeneous simulation platforms—each with its own time resolution, data structures, and communication protocols—adds another layer of technical complexity that must be addressed to ensure reliable system behavior emulation [229,230].

5.3. Adaptive Defense Mechanisms with Human-in-the-Loop

While AI has demonstrated great promise in automating defensive tasks, human oversight remains indispensable in Power CPS defense [231,232,233]. Operators play a critical role in interpreting ambiguous alerts, making context-aware decisions during high-stakes situations, and managing trade-offs between security, reliability, and economic performance. Incorporating human-in-the-loop (HITL) mechanisms into adaptive defense systems ensures that automation remains aligned with operational priorities and ethical standards [234,235].

Key enablers of HITL defenses include explainable AI (XAI), which provides human-understandable justifications for AI-generated alerts or decisions. Such interpretability enhances operator trust and facilitates more effective decision-making [236]. Visualization interfaces, such as operator-centered dashboards, are also essential in distilling complex, multi-domain information into cognitively digestible formats. Interactive decision support tools further allow human operators to simulate the consequences of various defensive actions before execution, improving situational awareness and response precision [237,238].

Additionally, adaptive defense architectures can incorporate human feedback directly into learning loops. For example, operators can annotate AI decisions as correct or flawed, which in turn refines the underlying models and improves future performance. However, achieving the right balance between automation and oversight remains a nuanced challenge [239]. Fully autonomous systems risk initiating unsafe or suboptimal responses without human validation, while overreliance on human review can lead to slow reaction times in time-critical scenarios. Hybrid frameworks that automate routine responses while escalating complex cases to human operators offer a promising path forward [240].

5.4. Metrics for Evaluating Co-Evolutionary Resilience

Traditional performance metrics—such as accuracy or detection rates—are insufficient to assess the effectiveness of adaptive cyber-physical defense systems [241]. Co-evolutionary resilience requires a broader set of evaluation metrics that capture not only the ability to detect attacks, but also to adapt over time, preserve operational continuity, and maintain user trust [242].

One critical metric is defense adaptability, which reflects how well a system can modify its detection or response strategies in reaction to changing adversarial behavior [243]. Operational continuity, or the system’s ability to deliver essential services under attack, is equally important—especially for mission-critical infrastructures. Cost-effectiveness metrics help evaluate whether the benefits of a given defense strategy justify the required investment in terms of resources, manpower, or downtime. Finally, metrics for explainability and trust gauge how transparent and reliable the defense system is from an operator’s perspective, which is crucial for long-term human-AI collaboration [244].

Simulation-based benchmarks provide practical means to evaluate these dimensions. Co-evolution curves, for instance, visualize the shifting performance of both attackers and defenders over time, offering insight into their dynamic interplay. Time-to-compromise versus time-to-response metrics quantify the temporal efficiency of threat detection and mitigation. Service degradation profiles, meanwhile, capture the operational impact of sustained attacks under various defense configurations. Together, these metrics offer a holistic view of system resilience and inform the development of next-generation adaptive security architectures [245].

To counter sophisticated adversarial threats in Power CPS, advanced defense components are being integrated across technical and human dimensions. Table 4 summarizes key components, their core capabilities, and the challenges they face in deployment and validation.

In summary, co-evolutionary defense frameworks provide a holistic, dynamic, and adaptive approach to securing Power CPS. By anticipating adversarial learning, validating strategies in realistic simulations, and integrating human expertise, these frameworks offer a promising path toward long-term resilience against AI-augmented cyber-physical threats.

6. Research Gaps and Future Directions

While the concept of co-evolutionary cyber-physical defense provides a promising framework for safeguarding Power CPS, its realization remains largely theoretical. Bridging the gap between research and real-world deployment requires addressing several unresolved theoretical, experimental, organizational, and policy challenges [246]. This section identifies key research gaps and proposes future directions to advance practical, scalable, and trustworthy co-evolutionary defense for AI-enabled Power CPS.

6.1. Theoretical Gaps in Adversarial Dynamics Modeling

Despite growing interest in co-evolutionary cyber defense, the theoretical foundations for modeling attacker-defender dynamics in Power CPS remain underdeveloped [247]. A major limitation in existing literature is the prevalent assumption of static or one-sided adaptation, which overlooks the bidirectional learning process that characterizes modern adversarial engagements. In reality, attackers and defenders iteratively refine their strategies in response to each other’s actions, necessitating the formalization of game-theoretic models that explicitly capture long-term strategy evolution. Such models must go beyond traditional equilibria and incorporate continuous adaptation, strategic uncertainty, and incomplete information [248,249].

Moreover, current models often treat attackers and defenders as isolated agents, failing to account for coordination among multiple adversarial or defensive actors [250]. In practice, both sides may involve distributed agents operating across cyber, physical, and market layers. Extending existing frameworks to multi-agent settings is essential for capturing the true complexity of cyber-physical interactions. Additionally, theoretical models rarely account for human behavior, which plays a central role in both defense operations and attacker deception. Incorporating cognitive factors such as bias, fatigue, and varying expertise into strategic modeling can enhance realism and improve the applicability of theoretical insights.

Another key gap lies in the use of overly simplistic reward and cost functions. Many models are optimized for narrow objectives such as maximizing detection accuracy or minimizing attack success probability, without considering operational trade-offs or stakeholder-specific priorities [251]. Realistic frameworks must incorporate multi-objective optimization that balances system resilience, service continuity, security investment, and adversary incentives. Accounting for both economic motivations and resource constraints on both sides will be critical for building models that are not only theoretically rigorous but also operationally relevant [252].

6.2. Experimental Gaps in Large-Scale, Realistic Testing

A major barrier to the practical advancement of co-evolutionary defense strategies is the lack of high-fidelity experimental validation [253]. Most proposed techniques are evaluated within small-scale testbeds or idealized simulations that fail to capture the operational complexity of real-world Power CPS environments. In particular, these simplified settings often ignore the interdependencies between cyber, physical, and market layers, neglect the role of human operator behavior, and exclude cross-sectoral influences from related infrastructures such as telecommunications or logistics.

To bridge this gap, there is an urgent need to develop modular, scalable, and open-access cyber-physical testbeds that enable realistic evaluation of attack-defense interactions [254]. These platforms should integrate digital twins, adversarial agents, and dynamic control systems to faithfully replicate the conditions under which co-evolutionary strategies must operate. Only by stress-testing defense mechanisms in such environments can researchers identify failure modes, validate adaptability, and assess resilience under operational constraints [255].

In addition to testbed limitations, progress is also hindered by a lack of standardized datasets and benchmarking protocols. Few publicly available datasets capture AI-driven attack scenarios or the evolution of coordinated cyber-physical campaigns. Without access to shared benchmarks, it becomes difficult to compare different strategies or reproduce key findings. Community-driven initiatives to curate, anonymize, and share realistic data—alongside agreed-upon evaluation frameworks—are essential to advance the field with scientific rigor and transparency.

6.3. Organizational and Policy Challenges in Adaptive Defense Adoption

Even as co-evolutionary defense frameworks mature in theory and experimentation, their practical adoption faces considerable organizational resistance. Many utility operators and regulatory bodies remain hesitant to deploy dynamic or AI-driven defenses, instead favoring static, proven technologies that align with existing compliance requirements. This conservatism is driven by risk aversion in mission-critical environments, where the cost of unanticipated behavior is high, and by regulatory regimes that emphasize checklist-style verification over adaptive performance [256].

Overcoming this institutional inertia requires both technical demonstration and policy innovation. Pilot deployments and field trials must be conducted to showcase the operational advantages of adaptive security mechanisms—particularly in detecting advanced persistent threats or mitigating multi-stage campaigns. In parallel, regulatory frameworks need to evolve to recognize and certify AI-based security solutions, potentially through sandbox environments or tiered certification models that incentivize gradual adoption.

Another persistent obstacle is the fragmentation of defense responsibilities across sectors, regions, and stakeholders [257]. AI-augmented attacks increasingly target interconnected infrastructures, yet current defense efforts remain siloed between electric utilities, telecom providers, transportation agencies, and other actors. Likewise, cross-border coordination among national grid operators and international regulators remains limited. Future research must address governance mechanisms that facilitate shared threat intelligence, coordinated response exercises, and joint development of secure architectures across both sectoral and geographic boundaries.

6.4. Toward Fully Autonomous but Human-Supervised Defense Ecosystems

As the complexity and velocity of cyber-physical threats continue to increase, fully autonomous defense agents are being explored as a means of enabling rapid, scalable, and real-time responses. These agents could continuously monitor system states, execute mitigation strategies, and learn from unfolding attack patterns with minimal human intervention [258]. However, while promising in theory, fully autonomous systems introduce their own risks—including unintended behavior due to misinterpreted inputs, opaque decision-making processes, and a lack of accountability in critical scenarios.

To mitigate these risks, future architectures must embrace hybrid defense ecosystems that blend automation with human oversight. In such frameworks, AI agents can manage routine or time-sensitive tasks, such as isolating compromised nodes or rerouting communication paths, while reserving high-stakes or ambiguous decisions for human operators [259]. This division of labor ensures both responsiveness and accountability, particularly when system stability or public safety is at risk. Feedback loops that allow human input to inform AI retraining—and vice versa—will be essential to maintaining alignment between human intent and machine behavior over time [260].

Developing such systems also requires new research into human-AI teaming. Key questions include how to optimize task allocation between humans and machines, how to design interfaces that provide intuitive and actionable explanations of AI reasoning, and how to train operators to effectively interact with adaptive, learning-enabled systems. Without thoughtful integration of human cognition, ethical reasoning, and transparent design, autonomous security systems may remain untrusted, underutilized, or even dangerous when deployed at scale [261].

Despite advancements in federated and AI-driven defense strategies, several critical gaps remain across theoretical, experimental, organizational, and human-integration dimensions. Table 5 outlines these gaps and highlights promising directions for future research and implementation.

In summary, realizing co-evolutionary cyber-physical defense requires multi-disciplinary research, operational validation, and cross-sector collaboration. The next and final section will conclude this review with a synthesis of key insights and a strategic call to action.

7. Conclusion

The integration of AI into Power CPS has fundamentally reshaped both the capabilities and the vulnerabilities of modern energy infrastructure. This review has systematically examined how adversaries exploit AI techniques—such as Generative Adversarial Networks, Reinforcement Learning, and federated learning manipulation—to craft adaptive and stealthy attacks. In response, it has evaluated the limitations of current AI-based defenses and proposed a co-evolutionary defense paradigm that incorporates game-theoretic reasoning, digital twin-based validation, and human-in-the-loop adaptability. Key research challenges were identified across theoretical modeling, experimental testing, organizational readiness, and human-AI collaboration, offering a comprehensive roadmap for advancing resilient Power CPS security.

Looking ahead, building secure and trustworthy Power CPS requires coordinated action across disciplines, sectors, and policy domains. Future efforts should focus on developing scalable testbeds, fostering international research collaboration, and embedding explainable AI into operational workflows. By embracing dynamic, co-evolutionary defense architectures, the energy sector can move beyond static protection models and proactively safeguard critical infrastructures against evolving cyber-physical threats.