The integration of Continual Learning (CL) pipelines in IoT and Cyber-Physical Systems (CPS) has introduced a "persistence paradox" where adaptation mechanisms are leveraged to embed permanent backdoors. Attackers exploit replay buffers, latent space representation reuse, and incremental weight manipulation to ensure malicious triggers survive multiple retraining cycles. These vectors specifically target Industrial IoT (IIoT) edge controllers and Smart Grid reinforcement learning agents, allowing dormant triggers to bypass anomaly detection and cause physical-world failures. Because these backdoors are integrated into the evolving learned baseline, traditional remediation strategies—including periodic weight resetting and model retraining—are rendered ineffective.

• Threat Model & Vulnerability Overview

  • Exploits CL mechanisms designed to manage concept drift and device heterogeneity in edge environments.
  • Establishes a "persistence paradox" where higher system adaptability increases the survivability of embedded malicious triggers.
  • Shifts the attack surface from one-time poisoning to a continuous, incremental implantation process.

• Technical Attack Vectors

  • Replay Buffer Poisoning: Injecting malicious samples into memory buffers used to prevent catastrophic forgetting, ensuring the backdoor is re-learned.
  • Representation Reuse: Manipulating latent space features during incremental updates to preserve trigger activation across tasks.
  • Incremental Weight Manipulation: Utilizing "slow-poisoning" techniques to modify model weights gradually, evading detection by anomaly sensors.
  • RL Policy Poisoning: Targeting policy updates in reinforcement learning agents to induce instability in Smart Grid controllers.

• Target Systems & Implementation

  • Primary Targets: IIoT edge controllers, CPS sensor-actuator loops, and adaptive IoT gateway models.
  • Critical Infrastructure: Smart Grids are particularly vulnerable due to high-frequency updates creating a continuous attack surface.
  • Tooling: The backdoorcpss23 GitHub framework provides a baseline for implementing and testing these CPS-specific backdoor attacks.

• Operational Impact & Defense Failures

  • Physical Risk: Ability to trigger catastrophic physical-world failures, such as power grid instability or actuator malfunctions.
  • Mitigation Gap: Traditional "washing out" techniques via retraining fail because the backdoor is encoded into the system's intelligence baseline.
  • Persistence Metrics: CL backdoors demonstrate significantly higher survivability rates across learning stages compared to static model poisoning.

• Conclusion & Strategic Implications

  • Adaptive AI in critical infrastructure requires a move away from periodic retraining toward continuous model integrity verification.
  • Future defenses must incorporate auditing of replay buffers and monitoring for latent space shifts.
  • Urgent need for formal backdoor analysis in high-security contexts to secure the evolving intelligence of CPS.