## 3 Evasion Attacks and Threat Model
### Evasion and ET Attacks  
[PERSON] et al. [14] have proposed a continuous attack to emulate how a malicious consumer manipulates actual consumption readings to reduce electricity bills. The continuous attack function, denoted by \(f_{1}\), is modeled by Equation (1), where \(E_{b}\) is the benign (or actual) reading and \(\beta\) is a constant reduction factor (\(0<\beta<1\)).  
\[f_{1}(E_{b})=\beta\times E_{b} \tag{1}\]  
The objective of evasion attack algorithms is to manipulate malicious samples \(E_{m}\), generated by the continuous attack \(f_{1}\), by introducing slight perturbations to deceive ET detectors and classify them as benign. The following explains various algorithms used to create undetectable evasion samples, including gradient-based and optimization-based algorithms.  
Gradient-Based Algorithms. These attack algorithms generate evasion samples using the cost function gradient with respect to the ML model's input in both single-step and multi-step methods. FGSM [19] is a single-step attack. To generate an evasion sample, it modifies the input sample in the direction (sign) of the gradient to maximize the cost function of the correct class, as indicated by Equation (2). On the other hand, BIM [39] is a multi-step attack, modeled by Equation (3). It modifies the input sample like FGSM, then clips it after each step to keep the perturbation within acceptable limits, thereby generating an evasion sample. Here, the hyper-parameters (\(\epsilon\), \(\alpha\), and \(I\)) control the perturbation amount, \(y\) denotes the input sample's label, \(\theta\) denotes the ML model's parameters, \(J_{\theta}\) denotes ML model's cost function, and \(\
abla\) denotes ML model's gradient.  
\[E_{m}+\epsilon\cdot sign\Big{(}\
abla_{E_{m}}f_{\theta}(E_{m},y,\theta) \Big{)} \tag{2}\]  
\[clip_{(-\epsilon,+\epsilon)}\Big{(}E_{m_{i}}+\alpha\cdot sign\Big{(}\
abla_{ E_{m_{j}}}f_{\theta}(E_{m_{i}},y,\theta)\Big{)}\Big{)} \tag{3}\]  
Optimization-Based Algorithms. These attack algorithms solve an optimization problem to generate evasion samples. C&W [40] minimizes the changes that \(\delta\) made to a malicious sample to be classified as benign as indicated by Equation (4), where \(r>0\) represents a regularization parameter and \(Z[(E_{m})]\) represents the predicted probability (i.e., logits layer representation) that \(E_{m}\) belongs to input label \(y\) as malicious and target label \(t\) as benign. However, ZOO [41] operates under the constraint of lack of direct access to the gradients of the model and can only observe the model's output for a given input. It modifies the loss function \(f(E_{m},t)\) in Equation (4) such that it only depends on the output of the model \(F\) and the desired class label \(t\). Therefore, it computes an approximate gradient using a finite difference method instead of actual backpropagation on the targeted model and solves the optimization problem via zeroth-order optimization, as indicated by Equation (5). DeepFool [42] is an efficient optimization-based iterative method. It aims to identify the smallest perturbation \(\delta\) that is capable of inducing misclassification by shifting the input across the decision boundary at each iteration \(i\), as indicated by Equation (6). Unlike gradient-based attacks, optimization-based attacks require additional computational resources, making the generation of evasion samples more expensive.  
\[minimize_{\delta}\;D(E_{m},E_{m}+\delta)+r\cdot f(E_{m},t) \tag{4}\] \[f(E_{m},t)=max_{y\
eq t}[Z(E_{m})]_{y}-[Z(E_{m})]_{t}\]  
\[minimize_{\delta}\;D(E_{m},E_{m}+\delta)+r\cdot f(E_{m},t) \tag{5}\] \[f(E_{m},t)=max_{y\
eq t}[log(F(E_{m}))]_{y}-[log(F(E_{m}))]_{t}\]  
\[minimize_{\delta}\;||\delta||_{2} \tag{6}\] \[sign(f(E_{m_{i}}+\delta))\;\
eq sign(f(E_{m_{i-1}}))\]