A Practical Framework for Securing AI-Driven Decision Loops in Industrial Control Systems

The increasing integration of Artificial Intelligence (AI) and Machine Learning (ML) into Industrial Control Systems (ICS) enables dynamic optimization of energy consumption, process efficiency, and predictive maintenance. However, the transition from AI-assisted advisory systems to autonomous closed-loop control introduces a critical cyber-physical security vulnerability: an AI-generated control action may be computationally optimal within its learned model while simultaneously violating underlying physical, thermodynamic, or operational constraints. Conventional Operational Technology (OT) security mechanisms focus predominantly on network boundary defense, message encryption, entity authentication, and device integrity; they do not evaluate the physical feasibility or safety semantics of AI-recommended set-points prior to execution. This paper proposes a practical, layered framework for securing AI-driven decision loops in ICS by treating AI outputs strictly as conditionally trusted inputs. The framework integrates source telemetry integrity screening, out-of-distribution (OOD) detection, Physics-Informed Validation (PIV), deterministic controller-level bounded enforcement, and risk-stratified human oversight. A discrete-time state-space formulation predicts the transient plant response to candidate AI control actions, while deterministic logic within the Programmable Logic Controller (PLC) enforces absolute operational boundaries and slew-rate limits. The architecture is evaluated on a high-fidelity chilled-water plant simulation under normal and adversarial set-point injection attacks. In the unvalidated baseline, malicious recommendations produce 30 consecutive intervals outside the safe operating envelope with severe 7.0°C step disturbances. In contrast, the proposed PIV and bounded-control architecture completely eliminates unsafe excursions while constraining set-point changes to ≤0.5°C per interval. The results demonstrate that decoupling probabilistic AI inference from deterministic physics-based OT enforcement establishes an indispensable defense-in-depth safety barrier for industrial cyber-physical infrastructure.