arXiv: Automated Stealthy Wear-Out Attack on Digital Twins With Deep Reinforcement Learning

This publication describes a novel cyberattack method targeting digital twins—virtual replicas of physical systems—using deep reinforcement learning. The attack is designed to degrade system components stealthily over time, causing gradual wear and failure without immediate detection. This represents a new class of threat that exploits the trust placed in digital twin simulations for predictive maintenance and operational decision-making.

Organizations most affected are those in critical infrastructure sectors such as energy, manufacturing, transportation, and healthcare, where digital twins are used to monitor and control physical assets. Compliance teams in these sectors must recognize that existing cybersecurity frameworks may not adequately address attacks that manipulate digital twin behavior to cause physical harm. The EU AI Act and sector-specific regulations like NIS2 and the Cyber Resilience Act will likely require updated risk assessments.

Compliance teams should immediately review their digital twin deployment architectures to ensure they include anomaly detection for gradual performance degradation, not just sudden failures. They should also verify that their AI risk management processes under the EU AI Act cover reinforcement learning-based threats. Finally, teams should engage with technical security experts to model this attack vector in their own systems and update incident response plans accordingly.