Abstract: A method is disclosed which comprises accessing a detector model that is trained in parallel with an operator model and an attacker model using a reinforcement learning technique based on iteratively simulating scenarios of operation of an environment to generate training data and learning weights of the models based on the simulated training data. The simulating of a scenario is based on the last learned weights of the models. The method further comprises, during operation of the environment, applying the detector model to an operator action, a prior observation of state of the environment from prior to taking the operator action, and a current observation of the environment from after taking the operator action, to detect whether an attack on the environment has occurred.