Abstract: The automatic voltage regulator (AVR) plays a critical role in ensuring the stable operation of power systems by dynamically regulating the generator output voltage. However, the increasing integration of AVRs into cyber-physical environments has made them increasingly vulnerable to sophisticated cyber threats. Among these, zero-dynamics attacks represent a particularly insidious challenge. By carefully manipulating inputs to excite the system’s internal zero dynamics, an attacker can induce a divergence in the internal state while maintaining the output unchanged during the early stages to evade conventional anomaly detection techniques that rely solely on output deviations. This creates a critical security vulnerability, as such stealthy intrusions can persist undetected until the system becomes unstable or fails catastrophically. To address this issue, a zero-dynamics attack detection method based on state-driven neural network prediction tailored to AVR systems is proposed. A Luenberger observer is designed to estimate both internal and external states of the AVR system in real-time using only historical system inputs and outputs. The observer reconstructs latent system dynamics that are not directly measurable but are essential for capturing hidden instability under attack conditions. These estimated states, together with the current control inputs, are used to construct a comprehensive input state–output feature set. This multisource feature construction enables the model to capture the complex interactions between control inputs and internal dynamic evolution, which is particularly important for detecting unobservable attack trajectories. A feedforward neural network is trained on these features to learn the dynamic relationship between estimated states and the system output under normal conditions, ensuring that the predictor replicates the natural behavior of the AVR system across various operating points. To enhance the sensitivity of the model to internal state variations that do not immediately manifest in the output, a consistency loss function is incorporated during training. This loss penalizes discrepancies between the temporal variation of the predicted output and that of the estimated internal state, enforcing a correlation between internal disturbances and their delayed impact on observable outputs. As a result, the network is encouraged not only to minimize prediction error but also to internalize the response characteristics of the hidden state divergence to improve its responsiveness to early-stage anomalies. The model is initially trained offline using normal data to capture nominal dynamics and updated incrementally online via a sliding window mechanism to adapt to potential environmental changes, further enhancing the robustness of the prediction framework. During the detection phase, the trained neural predictor continues to forecast the system output. When a zero-dynamics attack is launched, although the actual output remains initially unchanged, the predicted output begins to deviate due to the divergence in the internal state, which the neural network is designed to capture. This deviation serves as an early warning indicator of abnormal behavior, preceding any measurable change in output. To provide a baseline for comparison, a parallel AVR system model operating under normal conditions is used to generate a baseline output trajectory for the precise assessment of deviations under attack. This dual-model structure improves the detection clarity and supports real-time diagnostics. Simulation experiments validate the effectiveness of the proposed method. The AVR model under test is subjected to both zero dynamics and enhanced zero-dynamics attack scenarios to examine detection performance. Results demonstrate that the approach can accurately capture the internal dynamic evolution of the AVR system and detect zero-dynamics attacks at an early stage. The method consistently shows earlier deviation in the predicted output compared to the measured output, confirming the hypothesis that the internal divergence precedes output abnormality. Compared with traditional output-only detection methods, the proposed method demonstrates superior sensitivity, robustness, and anticipatory capability in identifying stealthy attacks.