The power flexibility from smart buildings makes them suitable candidates for providing grid services. The building automation system (BAS) that employs model predictive control (MPC) for grid services relies heavily on sensor data gathered from IoT-based HVAC systems through communication networks. However

cyberattacks that tamper sensor values can compromise the accuracy and flexibility of HVAC system power adjustment. Existing studies on grid-interactive buildings mainly focus on the efficiency and flexibility of buildings’ participation in grid operations

whereas the security aspect is lacking. In this paper

we investigate the effects of cyberattacks on HVAC systems in grid-interactive buildings

specifically their power-tracking performance. We design a stochastic optimisation-based stealthy sensor attack and a corresponding defence strategy using a robust control framework. The attack and its defence are tested in a physical model of a test building with a single-chiller HVAC system. Simulation results demonstrate that minor falsifications caused by a stealthy sensor attack can significantly alter the power profile

leading to large power tracking errors. However

the robust control framework can reduce the power tracking error by over 70% under such attacks without filtering out compromised data.