Exposing the Invisible: Detecting Stealthy Parameter-Based Cyber-Attacks on Inverter Synchronization Loops

The increasing integration of Internet-of-Things (IoT) technologies for monitoring and control of inverter-based resources (IBRs) has expanded the attack surface, enabling stealthy manipulation of controller parameters through vulnerable supervisory control interfaces. Phase-locked loops (PLLs) emerge as prime targets, as they interact with all control loops and critically influence the dynamic response of grid-following (GFL) converters. This paper analyzes the underlying threat model to elucidate the mechanisms enabling such stealthy behavior and conducts a thorough stability and transient response analysis to characterize how PLL tampering can degrade system performance without necessarily destabilizing the system. The results reveal critical interactions among frequency estimation, control, and synchronization that can significantly reduce stability margins. To counter the stealthy nature of these attacks, a modified PLL is proposed that exposes gain variations through shifts in its equilibrium points while preserving conventional PLL performance. Experimental results validate the effectiveness of the proposed approach in detecting PLL cyber-attacks.