Gandhinagar, Sep 23: In February 2021, an unidentified attacker remotely accessed the control system of a water treatment plant in Oldsmar, Florida. They attempted to raise the level of sodium hydroxide, a caustic chemical used to balance water pH, to nearly a hundred times its safe concentration. The presence of such high levels of sodium hydroxide could have proved lethal had it reached the town’s water supply. The attack was not caught by any automated security system. It was noticed only because a plant operator happened to see his computer’s mouse cursor moving on its own and reversed the command in time.
This incident sits at the heart of a project built by two undergraduate students at the Indian Institute of Technology Gandhinagar, who set out to design a system capable of automatically detecting such attacks, without depending on chance or human vigilance alone. Ms Miloni Thakkar, a third-year student of Computer Science and Engineering, and Ms Mitwa Goswami, a third-year student of Electrical Engineering, won the Second Prize at the Intel Cup, the international Undergraduate Electronic Design Contest 2026, held at Shanghai Jiao Tong University. Their team was recognised for TrustGate, an artificial intelligence-based cybersecurity system designed to detect attacks on industrial control systems, such as those used in water treatment plants, power grids, and manufacturing facilities.
Teams competing at the international round were required to build a working system on Intel’s DK-2500, which served as the hardware platform for running and testing their AI-based security system, submit a detailed technical report, and defend their work live before an expert judging panel that included Dr Song Jiqiang, Vice President of Intel Labs and Director of the Intel China Research Institute.
Miloni and Mitwa were mentored by Dr Sameer Kulkarni, Assistant Professor in the Department of Computer Science and Engineering, and Electrical Engineering at IITGN.
Speaking about their experience, Mitwa expressed,
“Miloni had always been curious about cybersecurity. So when we were exploring ideas to build on together, it came up naturally as one of the directions worth pursuing. Once we started digging into industrial control systems, it became clear this was a space where AI wasn’t just a nice-to-have addition. It was genuinely necessary to solve the problem, since detecting attacks that manifest physically, not just in network traffic, needed a model that could reason across both.”
Most industrial control systems running critical infrastructure are decades old and were not originally designed with cybersecurity in mind, the students explained. Conventional industrial control system security tools largely monitor network traffic and can flag unauthorised access, unusual activity, or known malware. What such tools typically cannot determine is whether a command that appears entirely legitimate at the protocol level is, in fact, physically dangerous given the current state of the plant.
This is precisely why a network-only security tool could not have caught the Florida incident, since the command itself did not look suspicious; only its physical consequence would have. “TrustGate closes that gap by understanding both the cyber and physical sides of an attack together,” said Miloni, “This matters well beyond the competition, because these are the systems that keep basic services like clean water running, and their failure can cost a lot in terms of money and health.”
The students chose to focus on water treatment infrastructure partly because of the clarity of its stakes and partly for a practical research reason. The team needed a well-established environment in which they could test and validate their approach, which led them to the SWaT dataset. One of the most widely used benchmarks in Industrial Control System security research, SWaT is based on a real, scaled-down, six-stage water treatment testbed maintained by the iTrust Centre at the Singapore University of Technology and Design. It allows researchers to study both network traffic and physical sensor data during normal operations as well as staged cyberattacks. Its extensive use across published research gave the team a credible and trusted benchmark, enabling them to evaluate their approach against an established body of work rather than starting with an unproven dataset.
At the core of TrustGate is a dual-stream Bi-directional Long Short-Term Memory model combined with what the students describe as ‘cross-modal attention.’ It is an architecture in which network traffic and physical sensor readings from plant equipment are analysed as two separate streams that actively inform each other, rather than being processed in isolation and combined only at the end.
“Think of it as two specialists working together instead of one generalist working alone,” explained Mitwa. “One part of the model studies network traffic patterns, while a separate part studies physical sensor readings from the plant. The key innovation is the cross-modal attention step. Instead of just adding the two specialists’ opinions together at the end, the model lets them actively consult each other, asking, for instance, whether the physical sensor data a few seconds before or after a suspicious network command supports that this is actually dangerous.”
This cross-checking, the students said, is what allows TrustGate to catch attacks that would not appear clearly suspicious in either data stream alone, including disguised, gradual manipulations designed specifically to avoid triggering an obvious alarm. When TrustGate detects such an anomaly, it does not merely raise a generic alert. It identifies the likely nature of the attack and the specific physical component responsible, and displays this on a live map of the plant.
“In a real plant, ‘something is wrong’ isn’t actionable on its own,” said Miloni. “What is important is for the operator to know where to look and what to shut down, in seconds and not minutes. TrustGate identifying the specific affected component is the difference between a useful alert and a paralysing one.” This was one of the most significant findings that emerged from ‘zero-shot’ testing, in which the system was evaluated on plant equipment it had never seen attacked during training.
Because critical infrastructure is often deliberately kept offline for safety, the students designed TrustGate to run entirely on embedded hardware rather than depend on cloud connectivity. “A cloud dependency would introduce a new attack surface and a single point of failure,” said Mitwa. “Running fully on-device means the system keeps working even if external connectivity is cut, which is exactly the scenario you’d worry about during a real attack.”
TrustGate uses TPM 2.0, which stands for Trusted Platform Module 2.0, a built-in security technology that helps protect sensitive encryption keys and verify the integrity of a computer system. It uses this to verify at boot that its code and hardware are untampered, while a self-healing watchdog auto-restarts any core process that hangs or crashes.
“If an attacker manages to compromise the security monitor itself, none of its alerts can be trusted anymore,” said Mitwa, who led the hardware integration, TPM attestation, and embedded Linux deployment for the project, while Miloni led the AI model architecture, training, ablation studies, and OpenVINO deployment.
Commenting on the project’s development, Prof Sameer Kulkarni, who mentored the team, said,
“When Miloni and Mitwa first approached the project, they were thinking about it primarily as a pattern-analysis problem, a model that would learn statistical patterns and produce an anomaly score. I pushed them to reconsider that fundamental approach. My role was never to give them the answers, but to keep asking the questions that would make them examine their assumptions more critically. The students took ownership of the exploration and development, and that was important to me.”
Presenting their work in English before a mostly Mandarin-speaking panel, under a strict 30-minute time limit, required the students to adapt their communication in real time. “We’d usually start with the precise technical term, but if we sensed any uncertainty on the panel’s faces, we’d immediately default to a simpler explanation of the underlying idea,” said Miloni. “One real lesson from that experience was learning to actually read the room while speaking, and adjusting on the spot; it’s a skill that’s stuck with us for life beyond that presentation.”
TrustGate remains a research prototype validated on a laboratory testbed rather than a live industrial deployment. The students say the system still needs testing on live plant data, support for more industrial protocols, and formal security certifications before it could be piloted with a real operator. It’s still in the research phase, with no industry or utility involvement yet. They believe the core idea of combining network and physical data like a digital twin could extend to other infrastructure, like power grids or oil and gas, though each would need its own adjustments.
“What’s next is to build up on this idea, and make the system more efficient, maybe even trying out other models or methods to test,” said Miloni, when asked about their future plans. Both students said the recognition in Shanghai had reinforced their intention to continue developing TrustGate rather than treat it as a one-time academic project. “We built this in a fairly short amount of time, and to successfully defend it at an international stage is something we are proud that we pushed ourselves to do,” said Mitwa. “It has further motivated us to keep working on this rather than treating it as a one-time project.”