Abstract

**Machine learning-based intrusion detection systems (IDS) are critical for securing Industrial Internet of Things (IIoT) environments against sophisticated cyber threats. Most adversarial research against these systems perturbs the feature vector, the raw traffic that produces it, or the physical process values reported by field devices, and depends on gradient access, repeated queries to the deployed model, or a learned surrogate or generative model of the victim environment. A smaller line of work reshapes packet timing without querying the detector, but does so by making malicious traffic mimic a learned model of benign timing. Across these approaches, one assumption of industrial monitoring pipelines has received little attention: temporal synchronization. An IDS reconstructs operational state by aggregating distributed telemetry into sliding or tumbling windows, so its view depends not only on what is observed but on when each observation falls relative to a window boundary.** **This paper introduces the Phantom State Attack (PSA), which exploits that dependence under a passive, zero-query threat model. Rather than modifying packet contents, perturbing feature values, querying the classifier, or fitting any model of benign traffic, PSA injects bounded timing drift calibrated to the attack flows own observed inter-arrival variability, applying only the minimal displacement needed to move observations across the nearest aggregation-window boundary. The result is a reconstructed** _**phantom state**_ **that diverges from the process state that produced it.** **We evaluate PSA on two independent industrial datasets, ToNIoT and the CIC IIoT 2025 (DataSense) benchmark, against Random Forest, MLP, and XGBoost classifiers, measuring detection degradation, synchronization distortion, stealth against four synchronization-aware detectors, and attacker cost against a query-based baseline. PSA degrades detection on flows that carry enough packets for window-boundary redistribution to take effect, and leaves other categories almost unchanged, so its effect is conditional on target-flow traffic characteristics rather than uniform. A query-based baseline reaches higher raw attack success but needs many model queries per window, whereas PSA needs none, a categorical rather than incremental difference in required attacker capability. The results identify temporal aggregation as an attack surface in IIoT intrusion detection that is reachable under assumptions weaker than those of prior evasion techniques.**