Decoupling Cyber Sabotage in Industrial Telemetry from Mechanical Faults Using Gradient-Based Forensic Edge XAI

Industrial Internet of Things (IIoT) systems increasingly rely on Deep Learning (DL) models for predictive maintenance; however, these models lack the capability to distinguish between naturally occurring mechanical faults and intentional cyber-induced telemetry manipulation. This ambiguity introduces significant operational risk, as anomalous events requiring mechanical intervention may be indistinguishable from adversarial sabotage. This paper proposes Grad-Forensics, a low-latency forensic interpretation framework that decouples cyber sabotage from mechanical faults using post-inference gradient analysis. Unlike perturbation-based explainability methods such as SHAP and LIME, which incur substantial computational overhead, the proposed approach estimates feature sensitivity with a single backward pass through the deployed model. A normalized Gradient Entropy metric is introduced to characterize the intent of anomalies by capturing structural differences between sparse, physically causal responses and high-entropy adversarial perturbations. The framework was deployed on a Raspberry Pi 4 edge gateway and evaluated using the ToN-IoT industrial telemetry dataset with synthetically generated adversarial manipulation scenarios. Experimental results demonstrate a 153× reduction in explanation latency compared to KernelSHAP, achieving a mean time-to-explain of 16 ms while attaining 94.2% forensic classification accuracy. These findings demonstrate that gradient-based forensic interpretation enables real-time differentiation of anomaly intent under strict edge-computing constraints, supporting reliable maintenance triage and operational decision-making in industrial environments.