An LLM-Based Agentic Pipeline for Generator-Level Adversarial Evaluation of Smart Grid IDSs - Quincozes, Camilla B.; Mundt, Guilherme C.; Rankin, Ian; Quincozes, Silvio E.; Severo, Paulo S.; Mossé, Daniel (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais do XXVI Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg.2026.29283, 2026)
Intrusion Detection Systems (IDSs) for Smart Grids are often evaluated using fixed datasets, which may hide weaknesses against variations of known attacks. This paper proposes an agentic pipeline for parametric adversarial evaluation of IDSs in IEC-61850 environments. The pipeline integrates the ERENO synthetic dataset generator, a Random Forest-based IDS, and Large Language Model (LLM)-based agents that iteratively modify parameters of Masquerade attack scenarios. Instead of perturbing samples directly, the approach operates at the dataset-generation level by changing attack configuration files. We analyze both traditional metrics (e.g., F1-score and recall) and execution indicators (e.g., skipped iterations, failed executions, and degenerate-variant flags). Our results indicate that the proposed LLM-guided agentic architecture can generate attack variants that decrease the intrusion detection performance (e.g., by increasing false negatives).