近年来，工业过程故障分类系统主要是由数据驱动的，得益于大量的数据模式，基于深度神经网络的模型显著地提高了故障分类的准确性。但是，这些数据驱动模型容易受到对抗攻击，因此，在样本上的微小扰动会导致模型提供错误的故障预测。最近的研究已经证明了机器学习模型的脆弱性以及对抗样本的广泛存在。本文针对安全、关键的工业故障分类系统提出了一种具有极端约束的黑盒攻击方法：只扰动一个变量来制作对抗样本。此外，为了将对抗样本隐藏在可视化空间中，本文使用了雅可比矩阵来引导扰动变量的选择，使降维空间中的对抗样本对人眼不可见。利用单变量攻击（OVA）方法，文本探究了不同工业变量和故障类别的脆弱性，有助于理解故障分类系统的几何特征。基于攻击方法，文本还提出了相应的对抗训练防御方法，该方法能够有效地防御单变量攻击，并提高分类器的预测精度。在实验中，将本文所提出的方法在田纳西-伊士曼过程（TEP）和钢板（SP）故障数据集上进行了测试。本文探索了变量和故障类别的脆弱相关性，并验证了各种分类器和数据集的单变量攻击和防御方法的有效性。对于工业故障分类系统，单变量攻击方法的攻击成功率接近（在TEP上）甚至高于（在SP 上）目前最有效的一阶白盒攻击方法（该方法需要对所有变量进行扰动）。

Recently developed fault classification methods for industrial processes are mainly data-driven. Notably, models based on deep neural networks have significantly improved fault classification accuracy owing to the inclusion of a large number of data patterns. However, these data-driven models are vulnerable to adversarial attacks; thus, small perturbations on the samples can cause the models to provide incorrect fault predictions. Several recent studies have demonstrated the vulnerability of machine learning methods and the existence of adversarial samples. This paper proposes a black-box attack method with an extreme constraint for a safe-critical industrial fault classification system: Only one variable can be perturbed to craft adversarial samples. Moreover, to hide the adversarial samples in the visualization space, a Jacobian matrix is used to guide the perturbed variable selection, making the adversarial samples in the dimensional reduction space invisible to the human eye. Using the one-variable attack (OVA) method, we explore the vulnerability of industrial variables and fault types, which can help understand the geometric characteristics of fault classification systems. Based on the attack method, a corresponding adversarial training defense method is also proposed, which efficiently defends against an OVA and improves the prediction accuracy of the classifiers. In experiments, the proposed method was tested on two datasets from the Tennessee–Eastman process (TEP) and Steel Plates (SP). We explore the vulnerability and correlation within variables and faults and verify the effectiveness of OVAs and defenses for various classifiers and datasets. For industrial fault classification systems, the attack success rate of our method is close to (on TEP) or even higher than (on SP) the current most effective first-order white-box attack method, which requires perturbation of all variables.