HydroJEV tests fast, agreement-gated triage for water-network alarms

A water-network alarm leaves operators with several possible causes: a cyberattack, a hydraulic fault, a legitimate change in operation or a faulty sensor. HydroJEV tests whether a fast model can handle part of that attribution workload before a slower language-model reviewer examines the remaining cases.
Tianwei Mu and colleagues build the study around Jev, a service that returns probabilities over fixed answer options. Their proposed cascade accepts a benign Jev verdict only when a separate rule tree agrees. Other cases go to the reviewer. This agreement condition is central to interpreting the reported reduction in review calls.

Turning an alarm into comparable evidence

The benchmark uses stochastic EPANET simulations of the C-Town water distribution network. Each evaluated window contains six hours of SCADA evidence. The simulations distinguish the true hydraulic state from the reported historian, allowing the researchers to introduce telemetry manipulation and instrument faults as well as physical changes.
The four labels describe mechanisms. A cyberattack involves concealed manipulation or control behavior inconsistent with independent evidence. A physical fault changes the hydraulics while measurements remain mutually consistent. A normal transient is legitimate operation outside nominal conditions. A sensor fault is an instrument reporting incorrectly.
All methods receive the same structured evidence. It includes control configuration, consistency checks and residuals against a hydraulic digital twin. The authors also scan inputs for class and mechanism names to avoid handing models an explicit answer through the evidence wording.

Fast screening still requires a gate

Jev answers a single-choice question with an additional insufficient-evidence option. The researchers correct its probabilities using a prior estimated from unlabeled development windows. Training-free here means no task-label training for the Jev screen; the system still depends on a pretrained service, development data and engineered evidence.
The LLM cascade accepts only normal-transient or sensor-fault verdicts confirmed by the rule tree. A failed Jev call always goes to review. This design recognizes that dismissing a genuine attack or hydraulic fault as harmless would be a costly mistake.
The paper reports that this gated screening approach spared the reviewer roughly a third of evaluated windows on fresh sealed sets without reducing macro-F1 in those comparisons. Its transfer experiments apply the frozen screen to two additional simulated networks. These are benchmark results, rather than evidence of safe unattended operation in a utility control room.

The supervised baseline has a real advantage

Jev reaches performance comparable to the hand-written rule tree in the reported attribution tests. The differences between those methods are not statistically significant on the individual in-distribution rounds.
A supervised logistic-regression classifier trained on labeled examples of the evaluated subtypes performs better in distribution. The study's stronger finding concerns leaving a subtype out of that classifier's training labels: under that condition, its performance falls while Jev retains its existing predictions.
This is a specific generalization comparison. The retained results also show that entirely new event families remain difficult, and the fully supervised classifier is more accurate on those sets overall. The paper therefore does not establish that label-free screening is generally more accurate than supervised learning.

Timing and accuracy need separate interpretation

The authors distinguish service-reported Jev compute time from client wall-clock time. They time selected reviewer calls one request at a time to avoid including client-side queueing, while treating timings collected under concurrent load as descriptive. The one-second framing should retain that measurement context.
Macro-F1 averages class-level precision and recall; it does not guarantee that every attack receives review. For operational assessment, the important questions include which dangerous windows are accepted as benign, whether the checks remain calibrated for the actual network, and how the reviewer handles deferred cases. HydroJEV provides a controlled screen-and-review experiment, with a clear agreement gate to test, rather than a replacement for incident-response judgment.