Adversarial Attacks on Downstream Weather Forecasting Models: Application to Tropical Cyclone Trajectory Prediction

## Abstract

Abstract Deep learning–based weather forecasting (DLWF) models leverage past weather observations to generate future forecasts, supporting a wide range of downstream tasks, including tropical cyclone (TC) trajectory prediction. In this paper, we investigate their vulnerability to adversarial attacks, where subtle perturbations to the upstream weather forecasts can alter the downstream TC trajectory predictions. Although research on adversarial attacks in DLWF models has grown recently, generating perturbed upstream forecasts that reliably steer downstream output toward attacker-specified trajectories remains a challenge. First, conventional TC detection systems are opaque, non-differentiable black boxes, making standard gradient-based attacks infeasible. Second, the extreme rarity of TC events leads to severe class imbalance problem, making it difficult to develop efficient attack methods that will produce the attacker’s target trajectories. Furthermore, maintaining physical consistency in adversarially generated forecasts presents another significant challenge. To overcome these limitations, we propose Cyc-Attack , a novel method that perturbs the upstream forecasts of DLWF models to generate adversarial trajectories. First, we pre-train a differentiable surrogate model to approximate the TC detector’s output, enabling the construction of gradient-based attacks. Cyc-Attack also employs skewness-aware loss function with kernel dilation strategy to address the imbalance problem. Finally, a distance-based gradient weighting scheme and regularization are used to constrain the perturbations and eliminate spurious trajectories to ensure the adversarial forecasts are realistic and not easily detectable. Our experimental results show that Cyc-Attack achieves higher targeted TC trajectory detection rates, lower false alarm rates, and stealthier perturbations than conventional gradient-based attack methods. Our code is available at https://github.com/dengy0111/Cyc-Attack .

## 1 Introduction

Recent progress in deep learning–based weather forecasting (DLWF) models (Gao et al., 2022; Lin et al., 2022; Lam et al., 2023; Bi et al., 2023) has yielded notable gains in predictive accuracy, often surpassing conventional numerical models. However, such models are vulnerable to adversarial attacks (Deng et al., 2025; Imgrund et al., 2025; Arif et al., 2025), in which subtle manipulation of the input data can lead to significant changes in the output forecasts at targeted locations. Specifying the desired weather conditions at the targeted locations is also non-trivial, as it requires considerable domain expertise to ensure that the manipulated forecasts remain physically realistic. Since the forecasts are typically used to guide downstream planning and decision-making, *adversarial targets are more naturally defined at the downstream level*—e.g., as an altered tropical cyclone trajectory forecast rather than a perturbed set of meteorological variables–— thereby allowing an attacker to specify the target without the need for extensive domain knowledge. These downstream targets can then be used to learn the corresponding adversarial forecasts to be generated by the DLWF models.

This paper investigates the feasibility of constructing adversarial weather forecasts for downstream applications. Specifically, we focus on tropical cyclone (TC) trajectory prediction (Wang et al., 2022), given both its significant socio-economic impacts—since 1980, TCs have caused more than $2.9 trillion in damages in the United States (^1^11Official public statistics from NOAA: [https://coast.noaa.gov/states/fast-facts/hurricane-costs.html](https://coast.noaa.gov/states/fast-facts/hurricane-costs.html))—and the limited prior research in this critical domain. For example, Figure [1](https://arxiv.org/html/2510.10140v1#S1.F1) illustrates a scenario in which an adversary manipulates the projected trajectory of Hurricane Irene, diverting it from its original path towards a region with extensive oil refinery infrastructure, with the intent of disrupting the energy market and profiting from the market instability. Such a manipulation could have left the densely populated U.S. East Coast under-prepared while causing costly planning and resource misallocation at the targeted region. This underscores the necessity of investigating the feasibility of adversarial attacks on TC trajectory predictions.

Figure: Figure 1: Adversarial manipulation of Hurricane Irene’s projected trajectory, generated using TempestExtremes software from the 10-day weather forecast of the *GraphCast* model, steering its original forecasted path (shown as blue line) towards a targeted region with extensive energy infrastructure (shown as red line).
Refer to caption: Fig/intro_v3.png

Generating realistic adversarial weather forecasts that alter the original TC trajectories is challenging due to the
complex, non-linear interactions among the atmosphere, ocean, and environment.
Over the years, researchers have developed various automated TC detection systems (Ullrich et al., 2021; Pérez-Alarcón et al., 2024; Yan et al., 2023) that leverage forecasted weather conditions generated by weather prediction models to detect and track movement of the storm. For instance, TempestExtremes (Ullrich et al., 2021) employs expert-defined rules to detect TC tracks from forecasted meteorological variables such as wind speed, mean sea level pressure (MSLP), and geopotential thickness.

While adversarial attacks on DLWF models is an active research area, their implications on downstream tasks remain largely unexplored, with several key challenges yet to be resolved. The first challenge is to design attack methods that can handle outputs generated by TC detection systems.
Given the black-box nature of such systems, this makes gradient-based methods, such as FGSM (Goodfellow et al., 2014), PGD (Madry et al., 2017), or CW Attack (Carlini & Wagner, 2017), infeasible. One possible strategy is to pre-train a surrogate model that approximates the output of the TC detection system, enabling the use of gradient-based approaches for generating adversarial input samples. However, this strategy introduces additional challenges when applied to TC trajectory prediction. In particular, the second challenge is handling the extreme class imbalance problem (Johnson & Khoshgoftaar, 2019) when training the surrogate model, as the number of locations experiencing a TC event at each time step is far fewer ($<0.01\%$) than those unaffected by the storm. Failure to address this challenge may lead to significant prediction errors when applying the TC detection system to the adversarial weather forecasts. Third, incorrect predictions by the surrogate model may cause gradient-based attack processes to end prematurely by falsely indicating that the target objective has been reached. The fourth challenge is to ensure that the adversarially generated forecasts are close to the original outputs generated by the DLWF models, while producing realistic TC trajectories that are free of conspicuous artifacts, e.g., zigzag paths, which could render the attack easily detectable.

To address these challenges, we introduce Cyc-Attack, a novel adversarial attack method for perturbing the forecasts of DLWF models to generate adversarial TC trajectories. First, we train a differentiable surrogate model to approximate the output of TC detection systems. Unlike gradient-free approaches, such as zeroth-order optimization (Berahas et al., 2022; Lian et al., 2016; Nesterov & Spokoiny, 2017; Chen et al., 2024), which typically require a large number of queries to the black-box, the surrogate enables the use of gradient-based approaches for efficient generation of adversarial forecasts. Next, to mitigate the severe class imbalance issue, we employ a skewness-aware loss function along with a kernel dilation strategy, guiding the surrogate model to better identify the true TC locations. The same strategy is also applied during adversarial forecast generation. Furthermore, to reduce the impact of surrogate model misprediction during adversarial forecast generation, we calibrate the false predictions by upweighting their gradient contributions to the loss, thereby ensuring the generation process does not terminate prematurely.
Finally, to ensure consistency with the original DLWF forecasts and avoid unrealistic TC trajectory paths, we apply distance-based gradient weighting scheme and regularization, which constrain perturbations and suppress irrelevant trajectory distortions.

## 2 Related Work

Modern weather forecasting operates on high-dimensional geospatio–temporal data characterized by multiscale dynamics and strong cross-variable couplings.
Beyond conventional numerical weather prediction (NWP) models (Côté et al., 1998; Skamarock et al., 2008; Hersbach et al., 2020) that solve the governing physical equations to produce forecasts, recent deep learning weather forecasting (DLWF) methods (Lam et al., 2023; Price et al., 2025; Gao et al., 2022; Bi et al., 2023)
have emerged as promising complements. These models learn complex spatiotemporal patterns directly from data and have demonstrated improved ability to represent the atmosphere’s inherently chaotic dynamics compared with conventional NWP.
Those upstream forecasts are then used for downstream tropical cyclone (TC) detection and tracking. A widely used open-source tool is TempestExtremes (Ullrich et al., 2021), which identifies TC candidates on individual snapshots (e.g., local minima in mean sea level pressure with warm-core signatures) and stitches those satisfying specified physical criteria (e.g., wind speed is beyond a threshold) into trajectories. Other automated TC trajectory detection tools include CyTrack (Pérez-Alarcón et al., 2024) and TROPHY (Yan et al., 2023).

Adversarial attacks craft subtle perturbations to input data to manipulate a model’s outputs. By attacker’s knowledge (Liu et al., 2022), such methods can be classified as white-box (full access to model architecture and parameters), gray-box (partial knowledge), or black-box (query access only). By objective (Heinrich et al., 2024), attacks are untargeted (any altered outcomes), semi-targeted (push outputs away from a subset of outcomes), or targeted (force a specific desired outcome).
Typical white-box methods include FGSM  (Goodfellow et al., 2014), a single gradient-sign step to perturb original inputs; PGD (Madry et al., 2017), which iteratively applies the gradient-sign steps within a $\ell_{\infty}$-norm ball; and the Carlini–Wagner (CW) attack (Carlini & Wagner, 2017), which solves an optimization problem to find minimally perturbed adversarial examples under $\ell_{0}/\ell_{2}/\ell_{\infty}$ metrics. Recently, several white-box methods (Deng et al., 2025; Imgrund et al., 2025; Arif et al., 2025) have demonstrated the feasibility of attacking DLWF models.
Black box attack methods generally fall into three categories.
First, surrogate/transfer attacks train a substitute or proxy model to approximate the black-box and then craft inputs that transfer across models for achieving the same attacking performance (Papernot & McDaniel, 2016; Papernot et al., 2017).
Second, zeroth-order (ZO) or gradient-free methods estimate descent directions from queries. Two standard estimators are coordinate-wise finite differences and randomized vector-wise schemes (e.g., NES-style). For example, DeepZero (Chen et al., 2024) scales ZO optimization via efficient coordinate-wise estimators, sparsity priors, and parallelism. Third, decision-based random-search (Brendel et al., 2018) methods operate with label-only feedback—e.g., Boundary Attack starts from an adversarial point and reduces the perturbation norm; HopSkipJump (Chen et al., 2020) follows the decision boundary using binary queries; and Square Attack (Andriushchenko et al., 2020) performs randomized, block-wise updates that are query-efficient and support targeted variants.
In this work, we adopt a surrogate-model strategy for crafting our attacks.

The severe class imbalance problem motivates the design of new loss functions, including
focal loss (Lin et al., 2017) that down-weights easier negative examples while focusing on harder examples; Tversky loss (Salehi et al., 2017) that tunes precision–recall trade-offs via asymmetric penalties; and IoU-surrogates such as Lovász-Softmax (Berman et al., 2018) for direct optimization of set similarity. In this paper, we employ a variation of focal loss to mitigate the class imbalance problem.

## 3 Problem statement

Figure: Figure 2: Adversarial attack on downstream tropical cyclone (TC) trajectory prediction.
Refer to caption: Fig/notation.png

Let $\mathcal{D}=(\mathbf{D}_{1},\mathbf{D}_{2},\cdots,\mathbf{D}_{T})$ denote a multivariate, gridded weather dataset, where $\mathbf{D}_{t}\in\mathbb{R}^{d\times r\times c}$ represents the observations of $d$ weather variables on a spatial grid of dimension $r\times c$ at time $t$. At each time step $t_{0}$, we define the predictor $\mathbf{X}(t_{0})=\{\mathbf{D}_{t_{0}-\alpha-1+\tau}\}_{\tau=1}^{\alpha+1}$, a window of $\alpha+1$ past observations up to $t_{0}$, and the target $\mathbf{Y}(t_{0})=\{\mathbf{D}_{t_{0}+\tau}\}_{\tau=1}^{\beta}$, a window of $\beta$ future observations. For brevity, we denote them as $\mathbf{X}$ and $\mathbf{Y}$, respectively. We consider a weather forecasting model $f$ that generates upstream predictions, $\mathbf{\hat{Y}}=f(\mathbf{X})$, for the future observations $\mathbf{Y}$. Based on the upstream forecasts $\mathbf{\hat{Y}}$, a downstream black box detector $g$ will produce a TC trajectory $\hat{\mathbf{Z}}=g(\mathbf{\hat{Y}})$, where $\hat{\mathbf{Z}}\in\{0,1\}^{\beta\times r\times c}$. Each entry $\hat{\mathbf{Z}}_{tij}=1$ indicates that location $(i,j)$ is experiencing a TC event at time $t$, while $\hat{\mathbf{Z}}_{tij}=0$ denotes otherwise.
Let $\hat{\mathbf{Z}}^{*}\in\{0,1\}^{\beta\times r\times c}$ be the attacker’s intended adversarial trajectory. We aim to generate adversarial upstream forecasts $\hat{\mathbf{Y}}^{\prime}\in\mathbb{R}^{\beta\times d\times r\times c}$ by perturbing $\hat{\mathbf{Y}}$ so that the black-box detector $g$ produces a TC trajectory $g(\hat{\mathbf{Y}}^{\prime})$ that closely matches $\hat{\mathbf{Z}}^{*}$, thereby altering the original downstream prediction $\hat{\mathbf{Z}}$.

To enable gradient-based attacks, we approximate the black-box detector $g$ with a probabilistic, differentiable surrogate model $\tilde{g}$. Given an upstream forecast $\hat{\mathbf{Y}}$, let $\hat{\mathbf{P}}=\tilde{g}(\hat{\mathbf{Y}})\in[0,1]^{\beta\times r\times c}$ be the surrogate model output, where $\hat{P}_{tij}$ is the probability that location $(i,j)$ at time $t$ is experiencing a TC event. The probabilities can be converted into binary predictions by thresholding at $0.5$, i.e., assigned to 1 if $\hat{P}_{tij}\geq 0.5$ and 0 otherwise. During pre-training, we seek to learn a surrogate model $\tilde{g}$ that produces TC trajectories closely approximating those of the black-box detector, i.e., $\tilde{g}(\hat{\mathbf{Y}})\approx g(\hat{\mathbf{Y}})$. The adversarial upstream forecast $\hat{\mathbf{Y}}^{\prime}$ can then be generated by applying a gradient-based attack algorithm $\mathcal{A}$ on the surrogate model output, i.e., $\hat{\mathbf{Y}}^{\prime}=\mathcal{A}(\tilde{g},\hat{\mathbf{Y}},\hat{\mathbf{Z}}^{*})$.

In this paper, we employ GraphCast (Lam et al., 2023), a leading DLWF model developed by Google DeepMind, as the forecasting model $f$ to generate the upstream forecasts $\hat{\mathbf{Y}}$. We then use TempestExtremes (Ullrich et al., 2021) as the downstream TC trajectory detector $g$ (see Appendix [A](https://arxiv.org/html/2510.10140v1#A1) for details). Nevertheless, due to the model-agnostic nature of the formulation, the proposed adversarial attack method is applicable to other DLWF models and TC trajectory detectors.

## 4 Cyc-Attack: Adversarial Attack on TC Trajectory Predictions

Our Cyc-Attack framework comprises of 2 main components: (1) a probabilistic, differentiable surrogate model trained to approximate the TC detection system and (2) an adversarial weather forecast generation module.
Given the original DLWF forecast $\hat{\mathbf{Y}}$, Cyc-Attack generates an adversarial upstream forecast $\hat{\mathbf{Y}}^{\prime}$ that, when processed by the TC detection system, produces a TC trajectory closely aligned with the adversary’s target trajectory, $\hat{\mathbf{Z}}^{*}$. The adversarial upstream forecast can then be fed into existing DLWF attack methods (Deng et al., 2025; Imgrund et al., 2025; Arif et al., 2025) to learn the adversarial input $\mathbf{X}^{\prime}$ that yields the manipulated forecast.

### 4.1 Surrogate Model Pre-training

To pre-train the surrogate model $\tilde{g}$ into approximating the black box model $g$, we consider a training data of the form $\{(\mathbf{\hat{Y}}_{t},\hat{\mathbf{Z}}_{t})\}$, where $\mathbf{\hat{Y}}_{t}\in\mathbb{R}^{d\times r\times c}$ and $\hat{\mathbf{Z}}_{t}\in\{0,1\}^{r\times c}$. The data (1) aligns with the outputs of many TC detectors such as TempestExtremes, which first identify a set of locations affected by the TC and then stitch them to form trajectories, (2) introduces flexibility by relying solely on spatial dimensions, allowing the surrogate model to operate across different forecast horizons without the need for re-training, and (3) enables the use of image segmentation models such as DeepLabV3+ (Chen et al., 2018) as surrogate model $\tilde{g}$, trained to fit $\hat{\mathbf{Z}}_{t}$ from $\mathbf{\hat{Y}}_{t}$, i.e., $\tilde{g}(\mathbf{\hat{Y}}_{t})\approx\hat{\mathbf{Z}}_{t}$.

Pre-training the surrogate model requires addressing the severe imbalance issue (Johnson & Khoshgoftaar, 2019), where TC-affected locations at each time step $t$ are extremely sparse relative to non-TC locations ($<0.01\%$). As a result, the surrogate model is biased towards the non-TC locations (i.e., majority class), leading to higher false negative rates.
To mitigate this issue, the surrogate model is trained to predict dilated regions around each TC-affected location rather than predicting each location $(i,j)$ strictly as TC ($\hat{Z}_{tij}=1$) or non-TC ($\hat{Z}_{tij}=0$).
The dilated TC region data $\mathbf{\hat{Z}}_{t}^{D}$ are generated from the original TC location data $\mathbf{\hat{Z}}_{t}$ using a truncated Gaussian kernel, where given $(i,j)$, we define a neighborhood $\Omega_{ij}=\{(p,q):(p-i)^{2}+(q-j)^{2}\leq R^{2}\}$:

$$ $\forall(p,q)\in\Omega_{ij}:\hat{Z}^{D}_{tpq}=\max\!\left\{\hat{Z}_{tpq},\;\hat{Z}_{tij}K_{\sigma,R}(p-i,\;q-j)\right\},$ (1) $$

where $K_{\sigma,R}(u,v)=\exp\!\big(-\tfrac{u^{2}+v^{2}}{2\sigma^{2}}\big)$ if $\sqrt{u^{2}+v^{2}}\leq R$, and 0 otherwise. Here, $\sigma$ is the kernel parameter and $R$ sets the maximum dilation radius. Intuitively, this process expands the TC locations to its nearby affected regions, producing soft labels $\hat{Z}_{t}^{D}\in[0,1]^{r\times c}$ instead of hard $\{0,1\}$ labels. If a data point resides within multiple neighborhoods, e.g., if it lies close to two distinct TC trajectories, we assign its dilated label by taking the minimum of the values induced by those neighborhoods.

To alleviate the class imbalanced issue, the surrogate model is trained on $\{(\mathbf{\hat{Y}}_{t},\hat{\mathbf{Z}}^{D}_{t})\}$ by minimizing the following skewness-aware loss, which is a variation of the focal loss (Lin et al., 2017):

$$ $\mathcal{L}_{\text{surrogate}}=-\frac{1}{\beta}\sum_{t=1}^{\beta}\sum_{p=1}^{r}\sum_{q=1}^{c}\Big[(1-\hat{P}_{tpq})^{2}\,\hat{Z}^{D}_{tpq}\log(\hat{P}_{tpq})+(\hat{P}_{tpq})^{2}(1-\hat{Z}^{D}_{tpq})\log(1-\hat{P}_{tpq})\Big],$ (2) $$

where $\hat{P}_{tpq}$ is the probability predicted by the surrogate $\tilde{g}$ that location $(p,q)$ at time $t$ lies within the dilated TC region with $\hat{Z}^{D}_{tpq}$ denotes the corresponding dilated ground-truth label.
Training is performed with the Adam optimizer (Kingma, 2014).

The focal loss alone (without kernel dilation) is insufficient because it can produced false positives scattered all over the map. However, by combining it with our kernel dilation strategy, we empirically show that the scattered false positives are substantially reduced (see Table [3](https://arxiv.org/html/2510.10140v1#S5.F3) and Figure [3](https://arxiv.org/html/2510.10140v1#S5.F3)). The remaining false positives are mostly concentrated as localized clusters around each true TC location. One explanation is that standard focal loss is commonly used in small object detection from images, where it emphasizes uncertain boundary pixels to refine localization. Without dilation, however, a TC location lacks meaningful boundary context, causing focal loss to highlight scattered noisy points instead. With dilation, local neighborhoods are restored around each TC location, enabling focal loss to capture boundary uncertainty within coherent regions rather than isolated noise.

### 4.2 Adversarial Weather Forecast Generation

Given the trajectory $\hat{\mathbf{Z}}$ generated from the original weather forecast $\hat{\mathbf{Y}}$, let $\hat{\mathbf{Z}}^{*}$ be the adversarial trajectory provided by an attacker. Our aim is to generate an adversarial upstream forecast $\hat{\mathbf{Y}}^{\prime}_{t}$ at each time step $t$ by perturbing $\hat{\mathbf{Y}}_{t}$ in such a way that $g(\hat{\mathbf{Y}}^{\prime}_{t})\approx\hat{\mathbf{Z}}^{*}_{t}$.
Projected Gradient Descent (PGD) (Madry et al., 2017) is a standard gradient-based attack, where given a differentiable loss $L(g(\hat{\mathbf{Y}}_{t}),\hat{\mathbf{Z}}_{t}^{*})$, it iteratively perturbs the original upstream forecast $\hat{\mathbf{Y}}_{t}$ by taking the following gradient steps to minimize the loss:
$\hat{\mathbf{Y}}_{t}^{\prime}=\hat{\mathbf{Y}}_{t}-\eta\,\mathrm{sign}(\nabla_{\hat{\mathbf{Y}}_{t}}L)$ where $\eta$ is the step size.
After each step, the perturbed input is clipped to ensure it stays within a small neighborhood (e.g. an $\ell_{\infty}$ ball of radius $\delta$) to remain close to the original forecast, i.e., $\|\hat{\mathbf{Y}}^{\prime}-\hat{\mathbf{Y}}\|_{\infty}\leq\delta$.
However, standard PGD attacks are insufficient for adversarial trajectory attacks due the following challenges.

First, we observe that using $\hat{\mathbf{Z}}^{*}_{t}$ directly to identify the targeted locations for perturbation often causes the attack algorithm to generate adversarial upstream forecast $\hat{\mathbf{Y}}^{\prime}_{t}$ that, when processed by the surrogate model $\tilde{g}(\cdot)$, yields trajectories with substantial false positive locations dispersed across the map, making the attack easier to be detected. This issue parallels the class imbalance problem described in the previous section. To address this, we adopt the same kernel dilation strategy of Equation ([1](https://arxiv.org/html/2510.10140v1#S4.E1)) to construct a dilated adversarial downstream target $\hat{\mathbf{Z}}_{t}^{*D}\in[0,1]^{r\times c}$ from $\hat{\mathbf{Z}}^{*}_{t}$.

Second, any misclassification by the surrogate model, at either the original or targeted trajectory locations, will distort adversarial forecast generation and cause premature termination of the attack algorithm. To illustrate, consider the case where the attacker aims to label a targeted location as TC-affected even though the original trajectory labels it as otherwise, i.e., $\hat{Z}^{*}_{tij}=1$ while $\hat{Z}_{tij}=0$. If the surrogate incorrectly predicts the location to be TC-affected, i.e., $\tilde{g}(\hat{\mathbf{Y}}_{tij})=1\neq\hat{Z}_{tij},$ the algorithm will refrain from perturbing the forecast at that location, mistakenly assuming the target has been achieved. A similar problem arises when $\hat{Z}^{*}_{tij}=1$ while $\hat{Z}_{tij}=0$.
To mitigate this issue, we introduce a calibration mask $\mathbf{M}\in\{0,1\}^{\beta\times r\times c}$ to identify the set of locations $\{(i,j)\}$ where the surrogate’s initial predictions $\tilde{g}(\hat{\mathbf{Y}}_{tij})$ incorrectly match the adversarial target $\hat{Z}^{\prime}_{tij}$ at time $t$:

$$ $M_{tij}=\mathbf{1}\!\big(\hat{Z}^{*}_{tij}\neq\hat{Z}_{tij}\big)\mathbf{1}\!\big(\tilde{g}(\hat{\mathbf{Y}}_{tij})=\hat{Z}^{\prime}_{tij}\big).$ (3) $$

As will be described below, the calibration mask is used to avoid premature termination, ensuring that perturbations proceed even when the surrogate’s initial prediction matches the adversarial target.

Third, while kernel dilation reduces scattered false positive locations, it expands the target region, thereby increasing the number of candidate locations that can be stitched by the TC detection system to form a TC trajectory. This leads to TC trajectories with zigzag paths as shown in Figure [5](https://arxiv.org/html/2510.10140v1#S5.F5), making them unrealistic and easily detectable. Thus, to improve stealthiness and realisticness, we constrain the perturbation on $\hat{\mathbf{Y}}$ by down-weighting the gradient update for locations far away from the original and targeted paths and up-weighting the penalty for such locations in the loss function. Specifically, let $\mathcal{S}_{t}=\{(i,j):\hat{Z}^{*}_{tij}=1\}$ be the set of target TC-affected locations at time $t$. For any location $(p,q)$, define its geodesic distance to nearest target location as
$d_{t}(p,q)=\min_{(i,j)\in\mathcal{S}_{t}}\arccos\!\big(\sin\phi_{p}\sin\phi_{i}+\cos\phi_{p}\cos\phi_{i}\cos(\lambda_{p}-\lambda_{j})\big)$ if $\mathcal{S}_{t}\neq\emptyset$, or 0 otherwise, where $(\phi_{i},\lambda_{j})$ denote the corresponding latitude-longitude of $(i,j)$. The geodesic distance to nearest target is used to compute the following two distance-based weights for each location $(p,q)$:

$$ $\displaystyle w^{\mathrm{grad}}_{tpq}$ $\displaystyle=\quad w^{\mathrm{reg}}_{tpq}=$ (4) $$

We use $w^{\mathrm{grad}}$ to modify the gradient update step of PGD as follows:

$$ $\hat{Y}_{tij}^{{}^{\prime}(k+1)}\;=\;\operatorname{Clip}_{\delta}\!\left(\hat{Y}_{tij}^{{}^{\prime}(k)}-\eta\cdot w_{tij}^{\mathrm{grad}}\cdot\operatorname{sign}\!\left(\frac{\partial\mathcal{L}_{\text{adv}}}{\partial\hat{Y}_{tij}^{{}^{\prime}(k)}}\right)\right),$ (5) $$

where $k$ is the iteration number, $\eta$ is the step size, $\operatorname{sign}(\cdot)$ denotes element-wise sign function and $\operatorname{Clip}_{\delta}(\cdot)$ projects the perturbed input onto the $\ell_{\infty}$-ball of radius $\delta$ around $\hat{Y}_{tij}$. In this scheme, the target locations always receive full gradient updates ($w^{\mathrm{grad}}_{tpq}=1$) while non-target locations are updated with exponentially decaying weights based on their distance to nearest target.
Additionally, the loss function is modified to incorporate the distance-based weight $w^{\mathrm{reg}}_{tpq}$ as follows:

$$ $\displaystyle\mathcal{L}_{\text{adv}}=-\frac{1}{\beta}\sum_{t=1}^{\beta}\sum_{i=1}^{r}\sum_{j=1}^{c}$ $\displaystyle\big[(1-\hat{P}_{tij}^{\prime})^{\gamma}\hat{Z}_{tij}^{*D}\log(\hat{P}_{tij}^{\prime})+\hat{P}_{tij}^{\prime\gamma}(1-\hat{Z}_{tij}^{*D})\log(1-\hat{P}_{tij}^{\prime})\big]$ $\displaystyle+\lambda\ \|w^{\mathrm{reg}}_{tij}(\hat{Y}_{tij}-\hat{Y}_{tij}^{\prime})\|_{2}^{2},$ (6) $$

where $\hat{P}_{tij}^{\prime}$ is the surrogate predicted probability for adversarial input $\hat{\mathbf{Y}}^{\prime}$, $\hat{Z}_{tij}^{*D}$ is the dilated adversarial target, $\beta$ is the number of time steps, and $\lambda$ is regularization hyperparameter. The focal loss parameter $\gamma$ depends on calibration mask $\mathbf{M}$: $\gamma=2$ if $M_{tij}=0$ and $\gamma=0$ if $M_{tij}=1$. The distance-based regularization with calibration mask ensures that non-targeted locations are penalized increasingly with distance while locations near the target incurs less penalties.

## 5 Experimental Evaluation

### 5.1 Experimental Setup

#### Datasets

We conducted our experiments using datasets from the following two sources: (1) IBTrACS (International Best Track Archive for Climate Stewardship), containing the latitude and longitude coordinates of historical TC tracks at $6$-hourly intervals, along with their intensity and other meteorological features. (2) ERA5 Reanalysis Data, which provides hourly global weather observations from 1979 to 2018 at $1^{\circ}\times 1^{\circ}$ spatial resolution.
We constructed two datasets, TC1 and TC2, from these sources.
TC1 contains 285 TCs recorded between January 1, 2019 to January 1, 2025, along with their corresponding weather data from ERA5 Renalysis. For each TC, trajectory information is retained for their first 14 time steps, with the initial 2 time steps used as input for the GraphCast model and the remaining 12 time steps reserved for forecasting. TC2 is a smaller dataset consisting of 10 major TCs selected for case studies. Each TC contains location information for 40 consecutive 6-hourly time steps and their associated ERA5 Reanalysis weather data. In this case, the GraphCast model predicts 38 future time steps from the first 2 time steps. For both datasets, TempestExtremes is applied to the GraphCast forecasts to generate downstream TC trajectories. These trajectories are then used to construct the adversarial downstream targets. See Appendix [B.1](https://arxiv.org/html/2510.10140v1#A2.SS1) for further details on the datasets and their pre-processing.

#### Baseline Methods

We compared the performance of Cyc-Attack against the following baseline methods: ALA (Ruan et al., 2023), which leverages Adam-based updates to attack DLWF models; TAAOWPF (Heinrich et al., 2024), which leverages PGD-based updates; AOWF (Imgrund et al., 2025), which adopts a cosine-scaled step-size schedule to anneal update magnitudes during iterative attacks. All attackers are implemented using a pre-trained DeepLabV3+ (Chen et al., 2018) surrogate model to mount attacks against the black-box TempestExtreme. For each attack, we run 1,000 iterations to ensure convergence. We use a gradient clipping threshold of $\delta=10.0$ on standardized values to allow sufficient perturbations to create or remove TC events; and the attack step size is set to $\eta=0.01$. More details on training and hyperparameter tuning are in Appendix [B.2](https://arxiv.org/html/2510.10140v1#A2.SS2).

#### Evaluation Metrics

We evaluated the performance of the competing methods in terms of the following criteria: (1) *Detection accuracy at individual TC-location level* by comparing adversarial target locations with the predicted locations obtained from adversarial upstream forecasts. The specific metrics used include true positive rate (TPR), true negative rate (TNR), false positive rate (FPR), and false negative rate (FNR). (2) *Detection accuracy at the TC-trajectory level* in terms of TC detection rate (DR) and TC false alarm rate (FAR). To compute these metrics, we first determine the number of overlapping locations between an adversarial target trajectory and its closest predicted trajectory derived from the adversarial upstream forecasts. Two locations are considered overlapping if their great-circle distance is less than $R=2$. An adversarial target trajectory is deemed successfully detected if at least 50% of its location points overlap with the corresponding predicted trajectory. If it shares 0 location points, the predicted trajectory is considered a false alarm.
(3) *Closeness* ($\delta_{C}$), which measures the $\ell_{1}$-norm between the original upstream forecast $\hat{\mathbf{Y}}$ and its adversarial counterpart $\hat{\mathbf{Y}}^{\prime}$. A smaller closeness value indicates a stealthier attack.

### 5.2 Experimental Results

#### Performance of the Surrogate Model

The surrogate model demonstrates strong overall skill, but its sensitivity depends on the dilation radius $R$. As shown in Table [3](https://arxiv.org/html/2510.10140v1#S5.F3), no dilation $R=0$ attains the highest recall (TPR $=0.9896$) but with elevated false alarms (FPR $=0.0067$) scattered throughout the map, whereas $R=1$ sharply reduces recall (TPR $=0.5865$). A moderate dilation ($R=2$) achieves a balanced trade-off (TPR $=0.8131$, FPR $=0.0002$), and $R=5$ recovers higher recall (TPR $=0.9394$) with only marginal increase in false positives. The example in Figure [3](https://arxiv.org/html/2510.10140v1#S5.F3) shows that kernel dilation helps to reduce scattered false positives by concentrating them into compact clusters surrounding the targeted locations.
For these reasons, we adopt a pre-trained surrogate with $R=2$ for subsequent experiments as it provides a compromise between sensitivity and specificity.

Figure: Table 1: Impact of dilation radius $R$ on the segmentation performance of the pre-trained DeepLabV3+ (Xception backbone) used as the surrogate model, evaluated on a test set of 684 global 1° maps ($180\times 360$ grid each) containing 578 TC and 41,701,822 non-TC locations.
Refer to caption: Fig/surrogate_different_radius.png

**Table 2: Comparison of different methods on TC1 and TC2 datasets in terms of their detection accuracies at location-level (FPR, FNR, TPR), trajectory-level (DR and FAR), and closeness ($\delta_{C}$). Cyc-Attack-$d$ and Cyc-Attack-$w$ denote variants of Cyc-Attack that omit the kernel-dilation strategy (Equation [1](https://arxiv.org/html/2510.10140v1#S4.E1)) and the weighting scheme (Equation [4](https://arxiv.org/html/2510.10140v1#S4.E4)), respectively. In the table, the best value for each metric is printed in bold. For all reported Cyc-Attack results, the dilation radius is set to $R=1$.**
| Method | Dataset TC1 | Dataset TC2 |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | FPR$\downarrow$ | FNR$\downarrow$ | TPR$\uparrow$ | DR$\uparrow$ | FAR$\downarrow$ | $\delta_{C}$$\downarrow$ | FPR$\downarrow$ | FNR$\downarrow$ | TPR$\uparrow$ | DR$\uparrow$ | FAR$\downarrow$ | $\delta_{C}$$\downarrow$ |
| ALA | 0.0001 | 0.8218 | 0.1782 | 0.3196 | 0.1393 | 0.0459 | 0.0007 | 0.7380 | 0.2620 | 0.2222 | 0.5925 | 0.0466 |
| TAAOWPF | 0.0002 | 0.8640 | 0.1360 | 0.1037 | 0.5990 | 0.1752 | 0.0045 | 0.7812 | 0.2188 | 0.0211 | 0.8802 | 0.1948 |
| AOWF | 0.0001 | 0.7971 | 0.2029 | 0.2977 | 0.1526 | 0.0449 | 0.0012 | 0.7067 | 0.2933 | 0.1000 | 0.7000 | 0.0499 |
| Cyc-Attack | 0.0001 | 0.7001 | 0.2999 | 0.5570 | 0.0536 | 0.0003 | 0.0004 | 0.4447 | 0.5553 | 0.7500 | 0.0833 | 0.0002 |
| Cyc-Attack-d | 0.0001 | 0.8476 | 0.1524 | 0.2803 | 0.0934 | 0.0003 | 0.0004 | 0.5962 | 0.4038 | 0.5000 | 0.2083 | 0.0002 |
| Cyc-Attack-w | 0.0002 | 0.8640 | 0.1360 | 0.1037 | 0.5990 | 0.1752 | 0.0006 | 0.6971 | 0.3029 | 0.0274 | 0.8901 | 0.2168 |

#### Performance Comparison of Adversarial Attack Methods

Cyc-Attack attains the most favorable trade-off among evaluated methods: it achieves the highest trajectory detection rate (DR) while maintaining low false-alarm rate (FAR) and one of the smallest perturbation magnitudes $\delta_{C}$, together with strong location-level performance (low FPR/FNR and high TPR). All the baselines (AOWF, ALA, TAAOWPF) underperformed relative to Cyc-Attack. They attain lower DR while incurring larger $\delta_{C}$ or producing fragmented, high-FAR detections (as evidenced in Table [2](https://arxiv.org/html/2510.10140v1#S5.T2) and Figure [4](https://arxiv.org/html/2510.10140v1#S5.F4)). The superior performance of Cyc-Attack can be explained as follows: the distance-weighting in Cyc-Attack concentrates perturbation strength near the adversarial target, which suppresses off-target perturbations and reduces false-positive trajectories, while kernel dilation focuses the loss and gradients within an expanded target neighborhood, improving spatial coherence of the induced forecast perturbation. Existing gradient-based attack methods lack these localized, distance-sensitive mechanisms and therefore either spread perturbations broadly (yielding false positives) or produce dispersed signals that background variability can deflect, preventing reliable alignment with the intended target trajectory. For ablation study, we considered 2 variations of our method–—Cyc-Attack-d (no dilation) and Cyc-Attack-w (no distance weighting). The results suggest a lower DR and/or higher FAR and larger $\delta_{C}$, which verifies the importance of incorporating kernel dilation and distance weighting to generate more realistic and accurate adversarial target trajectories.

Figure: Figure 4: Visualization of adversarial attacks. Top: Hurricane Delta (from 10/26/2020 to 11/05/2020); Bottom: Typhoon Haiyan (from 11/03/2013 to 11/13/2013). For each case, the left panel shows the original trajectory (blue) detected by TempestExtremes from upstream GraphCast forecasts and the adversarial target trajectory (red); the right panels show the produced by different baseline methods using the pretrained surrogate model.
Refer to caption: Fig/comparison_of_different_methods.png

Figure: Table 3: Results of applying 3 anomaly detection methods against adversarial upstream forecasts generated by different attack methods on TC dataset. Precision is the fraction of detected anomalies that are truly adversarial; Recall is the fraction of adversarial samples correctly detected; and F1-score is the harmonic mean of precision and recall. Smaller values imply higher attack effectiveness.
Refer to caption: Fig/adv_attack_different_radius.png

#### Detailed Analysis

(1) We examine the sensitivity of Cyc-Attack to dilation radius $R$ (Figure [5](https://arxiv.org/html/2510.10140v1#S5.F5)) and observe that larger radii produce more zigzags in adversarial trajectories, as the perturbation region extends beyond the target.
(2) We apply PCA-based anomaly detection (Abdi & Williams, 2010), Isolation Forest (IF) (Liu et al., 2008), and Local Outlier Factor (LOF) (Breunig et al., 2000) to determine how easily the generated adversarial upstream forecasts can be detected (Table [5](https://arxiv.org/html/2510.10140v1#S5.F5)). As generating extreme events such as TCs typically requires larger perturbations, they are easier to be detected. Nevertheless, Cyc-Attack is still harder to detect than the baselines.
(3) We further investigate the effect of the perturbation clipping threshold $\delta$ on both the efficacy and stealthiness of Cyc-Attack (Table [6](https://arxiv.org/html/2510.10140v1#S5.F6)). Our results indicate a pronounced trade-off: reducing $\delta$ improves the stealthiness of the generated adversarial examples against detectors, but it substantially degrades the attack’s ability to drive downstream predictions toward the adversarial target. Comprehensive experimental results are reported in Appendix [C](https://arxiv.org/html/2510.10140v1#A3).
(4) We examine if the adversarial upstream forecasts can be utilized by gradient-based methods (PGD) to generate adversarial upstream GraphCast input $\mathbf{X}^{\prime}$.
As shown in Figures [7](https://arxiv.org/html/2510.10140v1#S5.F7), [9](https://arxiv.org/html/2510.10140v1#S5.F9) and  [8](https://arxiv.org/html/2510.10140v1#S5.F8), perturbing original upstream inputs can feasibly alter downstream forecasts.
For Hurricane Delta (2020), we have already adopted our proposed framework to construct adversarial upstream forecasts that, when processed by TempestExtremes, yield adversarial downstream trajectories closely aligned with the adversarial target (Figure [5](https://arxiv.org/html/2510.10140v1#S5.F5)). The original trajectory is obtained by passing the original upstream inputs through GraphCast and TempestExtremes.
Building on the original upstream inputs, we apply the standard Projected Gradient Descent (PGD) attack (Madry et al., 2017) to generate adversarial upstream inputs that drive GraphCast to reproduce the adversarial upstream forecasts as closely as possible. The resulting adversarial upstream inputs are shown in Figure [7](https://arxiv.org/html/2510.10140v1#S5.F7). Passing them sequentially through GraphCast and TempestExtremes produces the adversarial downstream trajectory in Figure [8](https://arxiv.org/html/2510.10140v1#S5.F8).
Compared with the original trajectory, the adversarial downstream trajectory derived from the adversarial upstream inputs effectively removes the original path but does not fully replicate the adversarial target, unlike the adversarial downstream trajectory derived directly from TempestExtremes using the adversarial upstream forecasts. These results, obtained with standard PGD without task-specific tuning, primarily demonstrate the feasibility of the proposed adversarial pipeline. More targeted attack strategies for improved accuracy are left for future work. Finally, Figure [9](https://arxiv.org/html/2510.10140v1#S5.F9) visualizes the differences between the adversarial and original GraphCast forecasts.
More supplementary experimental results are provided in Appendix [C](https://arxiv.org/html/2510.10140v1#A3).

Figure: Figure 6: Effect of the perturbation clipping threshold $\delta$ on Cyc-Attack’s adversarial downstream predictions and the stealthiness of the corresponding adversarial upstream forecasts with respect to different detectors. The results are based on dataset TC2, with all other hyperparameters consistent with the experimental setup.
Refer to caption: Fig/delta_vs_detection_performance.png

Figure: Figure 7: Perturbations (right) were added to the original GraphCast wind-speed inputs (left, knot) 6 and 12 hours before the starting date of Hurricane Delta on 10/26/2020. The resulting adversarial upstream inputs (middle, generated by the standard PGD (Madry et al., 2017)) aim to lead GraphCast to generate forecasts that produced the manipulated downstream TC trajectory shown in Figure [5](https://arxiv.org/html/2510.10140v1#S5.F5) for $R=1$.
Refer to caption: Fig/Attack_graphcast_case_study.png

Figure: Figure 8: For hurricane Delta (2020), the left panel shows the original GraphCast forecast trajectory (blue) and the adversarial target trajectory (red). The middle panel presents the adversarial downstream trajectory obtained by running TempestExtremes on the adversarial upstream forecasts. The right panel shows the trajectory produced by running GraphCast and TempestExtremes end-to-end, based on the adversarial upstream inputs illustrated in Figure [7](https://arxiv.org/html/2510.10140v1#S5.F7).
Refer to caption: Fig/Attack_graphcast_case_study_downstream_predictions.png

Figure: Figure 9: Difference (right) between the original GraphCast wind-speed forecasts (left, in knots) and the adversarial forecasts (middle, in knots) produced from the constructed adversarial upstream inputs shown in Figure [7](https://arxiv.org/html/2510.10140v1#S5.F7), at time steps 1, 19, and 38 during Hurricane Delta (26 Oct 2020). The adversarial upstream forecasts (middle) aim to lead TempestExtremes to generate adversarial predictions that are close to the adversarial target displayed in Figure [5](https://arxiv.org/html/2510.10140v1#S5.F5) for $R=1$.
Refer to caption: Fig/Attack_graphcast_case_study_upstream_forecast.png

## 6 Discussion and Ethics Statement

This work demonstrates the feasibility of adversarially perturbing upstream DLWF forecasts to steer downstream TC trajectory predictions toward an attacker’s chosen target. This result underscores the sensitivity of downstream applications to subtle and imperceptible changes in upstream forecasts. In practice, upstream forecast providers and downstream users are often separate entities, making the integrity and validation of shared data essential. Our work does not target a specific operational system. The goal is to highlight potential vulnerabilities and motivate the development of more robust DLWF models as well as security-aware practices across the forecasting pipeline.

## 7 Conclusions

This paper presents Cyc-Attack, a novel adversarial attack method for manipulating weather forecasts generated by DLWF models to alter the trajectory paths produced by TC detection systems.
Cyc-Attack trains a differentiable surrogate model to enable gradient-based attacks, incorporates a skewness-aware loss with kernel dilation to address class imbalance, and applies distance-based weighting with regularization to ensure perturbations remain realistic and imperceptible. These design choices overcome key limitations of standard adversarial attack approaches under this scenario, allowing Cyc-Attack to outperform various baselines with higher targeted TC detection rates and lower false-alarm rates while producing stealthier perturbations. Future work includes developing strategies to robustify the DLWF models against such adversarial attacks.

## References

- Abdi & Williams (2010)
Hervé Abdi and Lynne J Williams.
Principal component analysis.
*Wiley interdisciplinary reviews: computational statistics*, 2(4):433–459, 2010.
- Akiba et al. (2019)
Takuya Akiba, Shotaro Sano, Toshihiko Yanase, Takeru Ohta, and Masanori Koyama.
Optuna: A next-generation hyperparameter optimization framework.
In *Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining*, pp. 2623–2631, 2019.
- Andriushchenko et al. (2020)
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein.
Square attack: A query-efficient black-box adversarial attack via random search.
In *European Conference on Computer Vision (ECCV)*, 2020.
- Arif et al. (2025)
Huzaifa Arif, Pin-Yu Chen, Alex Gittens, James Diffenderfer, and Bhavya Kailkhura.
Forecasting fails: Unveiling evasion attacks in weather prediction models.
2025.
- Berahas et al. (2022)
Albert S Berahas, Liyuan Cao, Krzysztof Choromanski, and Katya Scheinberg.
A theoretical and empirical comparison of gradient approximations in derivative-free optimization.
*Foundations of Computational Mathematics*, 22(2):507–560, 2022.
- Berman et al. (2018)
Maxim Berman, Amal Rannen Triki, and Matthew B Blaschko.
The lovász-softmax loss: A tractable surrogate for the optimization of the intersection-over-union measure in neural networks.
In *IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)*, 2018.
- Bi et al. (2023)
Kaifeng Bi, Lingxi Xie, Hengheng Zhang, Xin Chen, Xiaotao Gu, and Qi Tian.
Accurate medium-range global weather forecasting with 3d neural networks.
*Nature*, 619(7970):533–538, 2023.
- Brendel et al. (2018)
Wieland Brendel, Jonas Rauber, and Matthias Bethge.
Decision-based adversarial attacks: Reliable attacks against black-box machine learning models.
In *International Conference on Learning Representations (ICLR)*, 2018.
- Breunig et al. (2000)
Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and Jörg Sander.
Lof: identifying density-based local outliers.
In *Proceedings of the 2000 ACM SIGMOD international conference on Management of data*, pp. 93–104, 2000.
- Carlini & Wagner (2017)
Nicholas Carlini and David Wagner.
Towards evaluating the robustness of neural networks.
In *2017 ieee symposium on security and privacy (sp)*, pp. 39–57. Ieee, 2017.
- Chen et al. (2024)
Aochuan Chen, Yimeng Zhang, Jinghan Jia, James Diffenderfer, Jiancheng Liu, Konstantinos Parasyris, Yihua Zhang, Zheng Zhang, Bhavya Kailkhura, and Sijia Liu.
Deepzero: Scaling up zeroth-order optimization for deep model training.
In *International Conference on Learning Representations (ICLR)*, 2024.
- Chen et al. (2020)
Jianbo Chen, Michael I Jordan, Martin J Wainwright, et al.
Hopskipjumpattack: A query-efficient decision-based attack.
In *IEEE Symposium on Security and Privacy (S&P)*, 2020.
- Chen et al. (2018)
Liang-Chieh Chen, Yukun Zhu, George Papandreou, Florian Schroff, and Hartwig Adam.
Encoder-decoder with atrous separable convolution for semantic image segmentation.
In *Proceedings of the European conference on computer vision (ECCV)*, pp. 801–818, 2018.
- Côté et al. (1998)
Jean Côté, Sylvie Gravel, André Méthot, Alain Patoine, Michel Roch, and Andrew Staniforth.
The operational cmc–mrb global environmental multiscale (gem) model. part i: Design considerations and formulation.
*Monthly Weather Review*, 126(6):1373–1395, 1998.
- Deng et al. (2025)
Yue Deng, Asadullah Hill Galib, Xin Lan, Pang-Ning Tan, and Lifeng Luo.
Fable: A localized, targeted adversarial attack on weather forecasting models.
*arXiv preprint arXiv:2505.12167*, 2025.
- Gao et al. (2022)
Zhihan Gao, Xingjian Shi, Hao Wang, Yi Zhu, Yuyang Bernie Wang, Mu Li, and Dit-Yan Yeung.
Earthformer: exploring space-time transformers for earth system forecasting.
*Advances in Neural Information Processing Systems*, 35:25390–25403, 2022.
- Goodfellow et al. (2014)
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.
Explaining and harnessing adversarial examples.
*ArXiv Preprint ArXiv:1412.6572*, 2014.
- Heinrich et al. (2024)
René Heinrich, Christoph Scholz, Stephan Vogt, and Malte Lehna.
Targeted adversarial attacks on wind power forecasts.
*Machine Learning*, 113(2):863–889, 2024.
- Hersbach et al. (2020)
Hans Hersbach, Bill Bell, Paul Berrisford, Shoji Hirahara, András Horányi, Joaquín Muñoz-Sabater, Julien Nicolas, Carole Peubey, Raluca Radu, Dinand Schepers, et al.
The era5 global reanalysis.
*Quarterly Journal of the Royal Meteorological Society*, 146(730):1999–2049, 2020.
- Imgrund et al. (2025)
Erik Imgrund, Thorsten Eisenhofer, and Konrad Rieck.
Adversarial observations in weather forecasting.
*arXiv preprint arXiv:2504.15942*, 2025.
- Johnson & Khoshgoftaar (2019)
Justin M Johnson and Taghi M Khoshgoftaar.
Survey on deep learning with class imbalance.
*Journal of big data*, 6(1):1–54, 2019.
- Kingma (2014)
Diederik P Kingma.
Adam: a method for stochastic optimization.
*ArXiv Preprint ArXiv:1412.6980*, 2014.
- Lam et al. (2023)
Remi Lam, Alvaro Sanchez-Gonzalez, Matthew Willson, Peter Wirnsberger, Meire Fortunato, Ferran Alet, Suman Ravuri, Timo Ewalds, Zach Eaton-Rosen, Weihua Hu, et al.
Learning skillful medium-range global weather forecasting.
*Science*, 382(6677):1416–1421, 2023.
- Lian et al. (2016)
Xiangru Lian, Huan Zhang, Cho-Jui Hsieh, Yijun Huang, and Ji Liu.
A comprehensive linear speedup analysis for asynchronous stochastic parallel optimization from zeroth-order to first-order.
*Advances in neural information processing systems*, 29, 2016.
- Lin et al. (2022)
Haitao Lin, Zhangyang Gao, Yongjie Xu, Lirong Wu, Ling Li, and Stan Z Li.
Conditional local convolution for spatio-temporal meteorological forecasting.
In *Proceedings of the AAAI Conference on Artificial Intelligence*, volume 36, pp. 7470–7478, 2022.
- Lin et al. (2017)
Tsung-Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár.
Focal loss for dense object detection.
In *Proceedings of the IEEE international conference on computer vision*, pp. 2980–2988, 2017.
- Liu et al. (2022)
Fan Liu, Hao Liu, and Wenzhao Jiang.
Practical adversarial attacks on spatiotemporal traffic forecasting models.
*Advances in Neural Information Processing Systems*, 35:19035–19047, 2022.
- Liu et al. (2008)
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou.
Isolation forest.
In *2008 eighth ieee international conference on data mining*, pp. 413–422. IEEE, 2008.
- Madry et al. (2017)
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.
Towards deep learning models resistant to adversarial attacks.
*ArXiv Preprint ArXiv:1706.06083*, 2017.
- Nesterov & Spokoiny (2017)
Yurii Nesterov and Vladimir Spokoiny.
Random gradient-free minimization of convex functions.
*Foundations of Computational Mathematics*, 17(2):527–566, 2017.
- Papernot & McDaniel (2016)
Nicolas Papernot and Patrick McDaniel.
Transferability in machine learning: from phenomena to black-box attacks using adversarial samples.
*arXiv preprint arXiv:1605.07277*, 2016.
- Papernot et al. (2017)
Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow.
Practical black-box attacks against machine learning.
In *ACM Asia Conference on Computer and Communications Security (AsiaCCS)*, 2017.
- Pérez-Alarcón et al. (2024)
Albenis Pérez-Alarcón, Patricia Coll-Hidalgo, Ricardo M Trigo, Raquel Nieto, and Luis Gimeno.
Cytrack: An open-source and user-friendly python toolbox for detecting and tracking cyclones.
*Environmental Modelling & Software*, 176:106027, 2024.
- Price et al. (2025)
Ilan Price, Alvaro Sanchez-Gonzalez, Ferran Alet, Tom R Andersson, Andrew El-Kadi, Dominic Masters, Timo Ewalds, Jacklynn Stott, Shakir Mohamed, Peter Battaglia, et al.
Probabilistic weather forecasting with machine learning.
*Nature*, 637(8044):84–90, 2025.
- Ruan et al. (2023)
Jiaqi Ruan, Qihan Wang, Sicheng Chen, Hanrui Lyu, Gaoqi Liang, Junhua Zhao, and Zhao Yang Dong.
On vulnerability of renewable energy forecasting: adversarial learning attacks.
*IEEE Transactions on Industrial Informatics*, 2023.
- Salehi et al. (2017)
Sadegh Aliakbar Salehi, Deniz Erdogmus, and Ali Gholipour.
Tversky loss function for image segmentation using 3d fully convolutional deep networks.
*arXiv preprint arXiv:1706.05721*, 2017.
- Skamarock et al. (2008)
William C Skamarock, Joseph B Klemp, Jimy Dudhia, David O Gill, Dale M Barker, Michael G Duda, Xiang-Yu Huang, Wei Wang, Jordan G Powers, et al.
A description of the advanced research wrf version 3.
*NCAR Technical Note*, 475(125):10–5065, 2008.
- Ullrich et al. (2021)
Paul A Ullrich, Colin M Zarzycki, Elizabeth E McClenny, Marielle C Pinheiro, Alyssa M Stansfield, and Kevin A Reed.
Tempestextremes v2. 1: A community framework for feature detection, tracking, and analysis in large datasets.
*Geoscientific Model Development*, 14(8):5023–5048, 2021.
- Wang et al. (2022)
Zhen Wang, Jun Zhao, Hong Huang, and Xuezhong Wang.
A review on the application of machine learning methods in tropical cyclone forecasting.
*Frontiers in Earth Science*, 10:902596, 2022.
- Yan et al. (2023)
Lin Yan, Hanqi Guo, Thomas Peterka, Bei Wang, and Jiali Wang.
Trophy: A topologically robust physics-informed tracking framework for tropical cyclones.
*IEEE Transactions on Visualization and Computer Graphics*, 30(1):1249–1259, 2023.

## Appendix A TempestExtremes Software for TC trajectory prediction

TempestExtremes (Ullrich et al., 2021), which is a black-box software built on physical rules for TC trajectory detection, operates in two stages: (1) the first stage is to identify candidate locations as local minima in mean sea level pressure (MSL) that are not within $6^{\circ}$ of a deeper MSL minimum, enclosed by a 200 hPa closed contour within a $5.5^{\circ}$ radius; and co-located with maxima in the geopotential thickness field computed as the difference in geopotential height between 300 and 500 hPa (Z300–Z500), where the maxima are enclosed by a $58.8$ m^2s^–2 closed contour within a $6.5^{\circ}$ radius, allowing stronger peaks within $1.0^{\circ}$. The variables associated with each candidate location, including mean sea level pressure, elevation, and the maximum regional 10-meter wind speed, are also the output of the first stage.
(2) The second stage is to stitch these candidate locations into trajectories constrained by a maximum $8^{\circ}$ step distance, a maximum $24$-hour gap, a minimum $54$-hour lifetime, and at least 10 time steps with 10-meter wind speed no less than 10 m/s, elevation not exceeding 150 m, and latitude between $-50^{\circ}$ and $50^{\circ}$.

In short, the input to TempestExtremes includes the weather variables mean sea level pressure, 10-meter wind speed, elevation, and geopotential thickness, and the final output includes the TC trajectories consisting of stitched candidate locations within a time period.

## Appendix B Details on experimental settings

### B.1 Datasets and Preprocessing

Three pre-trained checkpoints of the GraphCast model (Lam et al., 2023) have been released by Google DeepMind.
They differ in data sources (ERA5 or ERA5+HRES), spatial resolution ($0.25^{\circ}$ or $1.0^{\circ}$), the number of pressure levels ($37$ or $13$), mesh configurations (2to6 or 2to5), and whether precipitation is used only as an output or as both input and output. Given the model-agnostic nature of adversarial attacks, it is not constrained by the specific architecture of the attacked model.
In this study, we used the checkpoint trained on ERA5, with $1.0^{\circ}$ resolution, $13$ pressure levels, mesh 2to5, and precipitation included as both input and output(^2^22The selected checkpoint is ”GraphCast_small - ERA5 1979-2015 - resolution 1.0 - pressure levels 13 - mesh 2to5 - precipitation input and output.npz”.).

The input ERA5 data
of the GraphCast model includes:
(1) five single-level variables — 2-meter temperature (K), mean sea level pressure (Pa), 10-meter u-component of wind (m/s), 10-meter v-component of wind (m/s), and total precipitation (m);
(2) six multi-level variables — temperature (K), geopotential (m^2/s^2), u-component of wind (m/s), v-component of wind (m/s), vertical velocity (Pa/s), and specific humidity (kg/kg), provided at thirteen pressure levels (50, 100, 150, 200, 250, 300, 400, 500, 600, 700, 850, 925, and 1000 hPa);
(3) three forcing variables — total-of-atmosphere incident solar radiation (J/m^2), land-sea mask (unitless), and surface geopotential (m^2/s^2);
and (4) four post-calculated variables — sine and cosine of year progress, and sine and cosine of day progress, which are derived from timestamps and are unitless.

The output data of the GraphCast model includes the five single-level variables and six multi-level variables described above. All data are provided at a $6$-hour temporal resolution, corresponding to 00Z, 06Z, 12Z, and 18Z each day, with $2$ time steps used as input to the GraphCast model, and $1$, $4$, $12$, $20$, or $50$ time steps used as forecast outputs.
The input and output data are not standardized, as there is a built-in standardization process within the GraphCast model. Besides, the hourly precipitation values in ERA5 data are aggregated over six-hour windows.

The input to the TempestExtremes (Ullrich et al., 2021) includes the weather variables mean sea level pressure, 10-meter wind speed, elevation, and geopotential thickness. Among these variables, wind speed and geopotential thickness are not directly available in the GraphCast forecast output, but can be derived. Wind speed is computed using the square root of the sum of squares of the u- and v-component winds, while geopotential thickness is obtained by taking the difference between the geopotential heights at 300 hPa and 500 hPa (i.e., Z300-Z500). Additionally, elevation can be approximated by dividing the surface geopotential by 9.08665, where the surface geopotential is obtained from external datasets.

### B.2 Implementation Details of Pretraining the surroate model

Serving as a proxy for the black-box TempestExtremes software, the surrogate models’ input data are aligned with that of TempestExtremes. This input consists of weather variables—mean sea level pressure, geopotential thickness, 10-meter wind speed, and elevation—extracted from the constructed ground truth ERA5 dataset across $12$ time steps within the forecast window of the GraphCast model. All training inputs are standardized using the variable-wise mean and standard deviation computed from our collected dataset. The output corresponds to a dilated region centered at the trajectory locations detected by the black-box TempestExtremes software at each of the $12$ time steps, covering a $r$-hop neighborhood around each trajectory location. For training, we randomly partition the input–output pairs into training, validation, and test sets using a $0.6{:}0.2{:}0.2$ split, resulting in $2052$ training samples, $684$ validation samples, and $684$ test samples after discarding any pairs containing undetected nodes.

We use the Adam optimizer (Kingma, 2014), and perform hyperparameter tuning using Optuna (Akiba et al., 2019),
an automatic optimization framework. A total of $30$ trials are conducted to search for optimal values of the following hyperparameters: learning rate in the range $[1\text{e}{-5},1\text{e}{-2}]$, $\beta_{1}$ in $[0.5,0.99]$, $\beta_{2}$ in $[0.9,0.9999]$, weight decay in $[1\text{e}^{-6},1\text{e}^{-3}]$, convolution stride size from the set $\{1,2,3,4,6,8\}$, and number of epochs in the range $[10,100]$ for training the DeepLabV3+ model. For each trial, the model achieving the best validation performance is retained. The optimal hyperparameters—learning rate = $5.92\times 10^{-4}$, $\beta_{1}=0.9101$, $\beta_{2}=0.9119$, weight decay = $6.48\times 10^{-6}$, stride size = $1$, and number of epochs = $77$—were identified in trial 1, yielding a best validation loss of $16.72$.

The pre-trained surrogate model produces outputs by taking the same inputs as the TempestExtremes software. However, unlike TempestExtremes, the surrogate model does not output additional variables associated with each detected location, such as mean sea level pressure, elevation, and the regional maximum 10-meter wind speed.
For each location detected by the surrogate models, the variables mean sea level pressure and elevation are directly taken from the corresponding weather data at that node. The maximum regional 10-meter wind speed, in contrast, is constructed manually. Let $\lambda_{i_{0}j_{0}}$ and $\phi_{i_{0}j_{0}}$ denote the longitude and latitude, respectively, of a candidate location $(i_{0},j_{0})$, in degrees; and let $w_{i_{0}j_{0}}$ denote the 10-meter wind speed at $(i_{0},j_{0})$. A candidate location is considered missing if $w_{i_{0}j_{0}}=\operatorname{NaN}$ or if $|w_{i_{0}j_{0}}-10^{20}|<10^{-6}$. The maximum regional 10-meter wind speed is constructed as follows. (i) For each candidate location $(i_{0},j_{0})$, map its coordinates $(\lambda_{i_{0}j_{0}},\phi_{i_{0}j_{0}})$ to $(\Lambda_{i_{0}j_{0}},\Phi_{i_{0}j_{0}})$ in radians as
$\Lambda_{i_{0}j_{0}}=\left(\frac{\lambda_{i_{0}j_{0}}}{180}\pi\right)\bmod(2\pi),\quad\Phi_{i_{0}j_{0}}=\frac{\phi_{i_{0}j_{0}}}{180}\pi,$
where $\Lambda_{i_{0}j_{0}}\in[0,2\pi)$.
(ii) For each candidate location $(i_{0},j_{0})$, compute the central angle $\Delta\sigma_{ij}$ in radians between $(i_{0},j_{0})$ and any point $(i,j)$ as
$\Delta\sigma_{ij}=\arccos(c_{ij}),$
where
$c_{ij}=\sin\Phi_{i_{0}j_{0}}\sin\Phi_{ij}+\cos\Phi_{i_{0}j_{0}}\cos\Phi_{ij}\cos(\Lambda_{ij}-\Lambda_{i_{0}j_{0}}),$
with $c_{ij}$ clipped to the interval $[-1,1]$ such that $\Delta\sigma_{ij}$ is clipped to the interval $[0,\pi]$. The corresponding great-circle distance between $(i,j)$ and $(i_{0},j_{0})$ is then computed as
$D_{ij}=\frac{180}{\pi}\Delta\sigma_{ij}.$
(iii) For the candidate location $(i_{0},j_{0})$, define the set of neighboring nodes located along eight directions (N, NE, E, SE, S, SW, W, NW) and within a great-circle distance of $2$ as
$\mathcal{S}_{(i_{0},j_{0})}=\left\{(i,j)\ \middle|\ D_{ij}\leq 2;\ w_{ij}\text{ is not missing}\right\}.$
(iv) If $\mathcal{S}_{(i_{0},j_{0})}$ is nonempty, define the maximum regional 10-meter wind speed at candidate location $(i_{0},j_{0})$ as $\max_{(i,j)\in\mathcal{S}_{(i_{0},j_{0})}}w_{ij}$; otherwise, it is defined as $w_{i_{0}j_{0}}$.

Notice that due to subtle differences in floating-point precision between Python (used in the reconstruction process above) and C++ (used in TempestExtremes), discrepancies may occur near the threshold distance $D_{ij}=2.0$. Specifically, some neighbors identified by TempestExtremes as within $D_{ij}=2.0-\epsilon$ may be computed as $D_{ij}=2.0+\epsilon$ in Python, and thus excluded, and vice versa, where $\epsilon$ is a very small error. To resolve this, we uniformly set the threshold to $D_{ij}=2.0+\epsilon$ with $\epsilon=10^{-8}$ in both implementations. This ensures that the computed maximum regional 10-meter wind speed exactly matches each from TempestExtremes.

### B.3 Implementation details of constructing adversarial targets

We propose a strategy for constructing adversarial downstream targets. Given the original downstream prediction $\hat{\mathbf{Z}}\in\{0,1\}^{\beta\times r\times c}$, we treat each contained trajectory as a sequential path $\hat{\mathbf{p}}=\{\hat{\mathbf{p}}_{\tau}\in\mathbb{R}^{2}\mid\tau=1,\dots,\beta\}$, where $\hat{\mathbf{p}}_{\tau}=(\lambda_{\tau},\phi_{\tau})$ denotes the longitude and latitude (in degrees) at time step $\tau$. Our goal is to construct an adversarial trajectory $\hat{\mathbf{p}}^{\prime}=\{\hat{\mathbf{p}}^{\prime}_{\tau}\in\mathbb{R}^{2}\mid\tau=1,\dots,\beta\}$ that preserves the temporal step length of the corresponding original one while progressively deviating in direction. Then, the constructed adversarial trajectory will be converted into adversarial downstream targets $\mathbf{\hat{Z}}^{*}\in\{0,1\}^{\beta\times r\times c}$.

In detail, the adversarial trajectory $\hat{\mathbf{p}}^{\prime}$ begins at the same origin as the original trajectory $\hat{\mathbf{p}}$, i.e., $\hat{\mathbf{p}}^{\prime}_{1}=\hat{\mathbf{p}}_{1}$. For each subsequent step $\tau>1$, we compute the great-circle distance $\hat{d}_{\tau}$ between $\hat{\mathbf{p}}_{\tau-1}$ and $\hat{\mathbf{p}}_{\tau}$ using the spherical law of cosines by

$$ $\cos\Delta\sigma_{\tau}=\sin\Phi_{\tau-1}\sin\Phi_{\tau}+\cos\Phi_{\tau-1}\cos\Phi_{\tau}\cos(\Lambda_{\tau}-\Lambda_{\tau-1}),$ $$

$$ $\hat{d}_{\tau}=R\cdot\arccos\big(\operatorname{min}(\max(\cos\Delta\sigma_{\tau},-1),1)\big),$ $$

where $(\Lambda_{\tau},\Phi_{\tau})$ and $(\Lambda_{\tau-1},\Phi_{\tau-1})$ are the radian representations of the coordinates, and $R$ is the Earth’s radius in kilometers.

Let $\mathcal{M}=\{\bm{\delta}_{j}\in\mathbb{R}^{2}\mid j=1,\dots,8\}$ denote the set of 8-connected compass direction unit vectors on the 2D plane. Each direction $\bm{\delta}_{j}$ corresponds to a compass bearing $\theta_{j}\in[0^{\circ},360^{\circ})$. At each time step, we sample a direction index $j^{*}$ according to a probability distribution derived from angular deviation from the original path.

To quantify directional deviation, we first define the cosine similarity between the original displacement vector and each candidate direction. Let $\hat{\mathbf{v}}_{\tau}=\hat{\mathbf{p}}_{\tau}-\hat{\mathbf{p}}_{\tau-1}$ be the original vector, and let $\hat{\mathbf{v}}^{\prime}_{\tau-1}=\hat{\mathbf{p}}^{\prime}_{\tau-1}-\hat{\mathbf{p}}^{\prime}_{\tau-2}$ be the previous adversarial displacement when $\tau>2$. We compute

$$ $\cos\theta_{j}^{\text{orig}}=\frac{\hat{\mathbf{v}}_{\tau}^{\top}\bm{\delta}_{j}}{\|\hat{\mathbf{v}}_{\tau}\|},\quad\cos\theta_{j}^{\text{adv}}=\frac{{\hat{\mathbf{v}}^{\prime\top}_{\tau-1}}\bm{\delta}_{j}}{\|{\hat{\mathbf{v}}^{\prime}_{\tau-1}}\|},$ $$

which measures the deviation magnitude from the current original step and the coherence with the prior adversarial step, respectively. Then, we assign a score $s_{j}$ to each direction $\delta_{j}$ by

$$ $s_{j}=\gamma_{1}\cdot\exp(-\cos\theta_{j}^{\text{orig}})+\gamma_{2}\cdot\exp(\cos\theta_{j}^{\text{adv}}).$ $$

These scores are normalized into probabilities $P_{j}=s_{j}/\sum_{\ell=1}^{8}s_{\ell}$, and the direction $j^{*}$ with the highest probability is selected.

To ensure smooth and plausible deviation, we compute a blended unit direction vector by summing the original direction $\hat{\mathbf{v}}_{\tau}$ and the selected direction $\bm{\delta}_{j^{*}}$ by

$$ $\mathbf{u}_{\tau}=\frac{\hat{\mathbf{v}}_{\tau}+\bm{\delta}_{j^{*}}}{\|\hat{\mathbf{v}}_{\tau}+\bm{\delta}_{j^{*}}\|},$ $$

and then convert it to a compass bearing $\theta_{\tau}$ by

$$ $\theta_{\tau}=\operatorname{atan2}(u_{\tau,0},u_{\tau,1}),$ $$

converted to degrees in $[0^{\circ},360^{\circ})$.

The next adversarial trajectory location is obtained by projecting from the previous position $\hat{\mathbf{p}}^{\prime}_{\tau-1}=(\lambda_{\tau-1}^{\prime},\phi_{\tau-1}’)$ a geodesic distance $\hat{d}_{\tau}$ along bearing $\theta_{\tau}$, using the following great-circle formulas

$$ $\phi_{\tau}^{\prime}=\arcsin\left(\sin\phi_{\tau-1}^{\prime}\cos\frac{\hat{d}_{\tau}}{R}+\cos\phi_{\tau-1}^{\prime}\sin\frac{\hat{d}_{\tau}}{R}\cos\theta_{\tau}\right),$ $$

$$ $\lambda_{\tau}^{\prime}=\lambda_{\tau-1}^{\prime}+\arctan 2\left(\sin\theta_{\tau}\sin\frac{\hat{d}_{\tau}}{R}\cos\phi_{\tau-1}^{\prime},\cos\frac{\hat{d}_{\tau}}{R}-\sin\phi_{\tau-1}^{\prime}\sin\phi_{\tau}^{\prime}\right),$ $$

where all angles are in radians and $R$ is the Earth’s radius in kilometers. By iterating this process from $\tau=2$ to $\beta$, we obtain an adversarial trajectory $\hat{\mathbf{p}}^{\prime}=\{\hat{\mathbf{p}}^{\prime}_{\tau}\in\mathbb{R}^{2}\mid\tau=1,\dots,\beta\}$ that preserves geodesic step lengths while progressively deviating in direction from the original path $\hat{\mathbf{p}}=\{\hat{\mathbf{p}}_{\tau}\in\mathbb{R}^{2}\mid\tau=1,\dots,\beta\}$.

For each original downstream prediction $\mathbf{\hat{Z}}$, if it contains at least one detected trajectory, it will be included in our pool of valid samples for constructing adversarial targets. Otherwise, it will be discarded.
As a result, among all $285$ samples, we retain $149$ valid samples.
For each valid sample, if it contains $N$ detected trajectories, we construct $N$ adversarial samples by targeting one trajectory at a time, while keeping the other $N{-}1$ trajectories unchanged.
This yields $N$ adversarial versions per valid sample, with one adversarial trajectory constructed in each.

Finally, we construct each adversarial downstream $\mathbf{\hat{Z}}^{*}\in\mathbb{R}^{\beta\times r\times c}$ from the original one $\mathbf{\hat{Z}}\in\mathbb{R}^{\beta\times r\times c}$ by replacing the trajectory locations along the original predicted trajectory with those along the constructed adversarial trajectory, while leaving all others unchanged.

## Appendix C Supplementary experimental results

Figure [10](https://arxiv.org/html/2510.10140v1#A3.F10) provides supplementary results illustrating the sensitivity of Cyc-Attack to the choice of dilation radius. These results are consistent with the conclusions presented in the main text: as the dilation radius increases, the generated adversarial predicted trajectories exhibit more pronounced zigzagging, and, to a certain extent, induce an increased number of false-positive trajectories.
Figure [11](https://arxiv.org/html/2510.10140v1#A3.F11) provides supplementary visualizations for comparing the performance of different adversarial attack methods, which aligns with the main text: Cyc-Attack attains a higher detection rate (TPR), more accurately shifts predictions to the adversarial target while suppressing the original trajectory, and yields fewer false alarms (lower FPR).
On dataset TC2, we conduct a systematic study of the influence of the perturbation clipping threshold $\delta$ on the effectiveness of Cyc-Attack and, concurrently, on the stealthiness of the generated adversarial examples against different detectors. Results are reported in Table [4](https://arxiv.org/html/2510.10140v1#A3.T4) and Table [5](https://arxiv.org/html/2510.10140v1#A3.T5). Specifically, we vary $\delta$ while keeping all other experimental settings identical to those in the experimental setup, summarize attack-level metrics (FPR, FNR, TPR, DR, FAR) in Table [4](https://arxiv.org/html/2510.10140v1#A3.T4), and present detector responses (precision, recall, F1-score) in Table [5](https://arxiv.org/html/2510.10140v1#A3.T5), thereby offering a quantitative assessment of both attack potency and detection evasion.

Figure: Figure 10: Cyclone Maria (09/16/2017–09/26/2017), Cyclone Haiyan (11/03/2013–11/13/2013), and Cyclone Nargis (04/27/2008–05/07/2008), shown from top to bottom. The description follows Figure [5](https://arxiv.org/html/2510.10140v1#S5.F5).
Refer to caption: Fig/supplemenraty_adv_attack_different_radius.png

Figure: Figure 11: Cyclone Maria (09/16/2017–09/26/2017) and Cyclone Nargis (04/27/2008–05/07/2008), shown from top to bottom. The description follows Figure [4](https://arxiv.org/html/2510.10140v1#S5.F4).
Refer to caption: Fig/comparison_of_different_methods_more.png

**Table 4: Effect of perturbation clipping threshold $\delta$ on the performance of Cyc-Attack on the dataset TC2, with other parameters consistent with the experimental setup.**
| $\delta$ | FPR$\downarrow$ | FNR$\downarrow$ | TPR$\uparrow$ | DR$\uparrow$ | FAR$\downarrow$ | $\bm{\delta_{c}}$ |
| --- | --- | --- | --- | --- | --- | --- |
| 10.0 | 0.0004 | 0.4447 | 0.5553 | 0.7500 | 0.0833 | 0.0002 |
| 5.0 | 0.0004 | 0.4591 | 0.5409 | 0.4642 | 0.2500 | 0.0002 |
| 2.5 | 0.0004 | 0.4808 | 0.5192 | 0.5000 | 0.2692 | 0.0002 |
| 1.0 | 0.0004 | 0.6418 | 0.3582 | 0.4347 | 0.1739 | 0.0001 |
| 0.5 | 0.0004 | 0.6611 | 0.3389 | 0.2608 | 0.2608 | 0.0001 |
| 0.3 | 0.0004 | 0.6779 | 0.3221 | 0.1428 | 0.1904 | 0.0000 |

**Table 5: Performance of different detectors under varying perturbation clipping threshold $\delta$ based on Cyc-Attack on the dataset TC2, with other hyperparameters consistent with the experimental setup.**
| Detector | $\delta$ | Precision$\uparrow$ | Recall$\uparrow$ | F1-score$\uparrow$ |
| --- | --- | --- | --- | --- |
| PCA-based anomaly detection | 10.0 | 0.9793 | 0.8711 | 0.9220 |
| 5.0 | 0.9939 | 0.8526 | 0.9178 |  |
| 2.5 | 0.9909 | 0.8553 | 0.9181 |  |
| 1.0 | 0.9877 | 0.8447 | 0.9106 |  |
| 0.5 | 0.9907 | 0.8368 | 0.9073 |  |
| 0.3 | 0.9840 | 0.6474 | 0.7810 |  |
| Isolation Forest (IF) | 10.0 | 1.0000 | 0.8447 | 0.9158 |
| 5.0 | 1.0000 | 0.8342 | 0.9096 |  |
| 2.5 | 1.0000 | 0.8342 | 0.9096 |  |
| 1.0 | 1.0000 | 0.6816 | 0.8106 |  |
| 0.5 | 1.0000 | 0.3447 | 0.5127 |  |
| 0.3 | 0.9773 | 0.1132 | 0.2028 |  |
| Local Outlier Factor (LOF) | 10.0 | 0.9970 | 0.8605 | 0.9237 |
| 5.0 | 0.9970 | 0.8605 | 0.9237 |  |
| 2.5 | 0.9970 | 0.8605 | 0.9237 |  |
| 1.0 | 0.9970 | 0.8605 | 0.9237 |  |
| 0.5 | 0.9969 | 0.8579 | 0.9222 |  |
| 0.3 | 0.9968 | 0.8184 | 0.8988 |  |

## Peer Reviews

confidence: 5
contribution: 1
initial_rating: 2
presentation: 3
questions: The most interesting aspect of this submission lies in its attempt to integrate time series forecasting models with downstream decision-making systems within an adversarial framework. However, the current implementation appears to manipulate intermediate prediction values rather than the raw inputs to the forecasting models, which weakens the conceptual alignment between the attack formulation and the intended end-to-end adversarial setting.

**Which to attack (three options)**  

I can identify how to compute Y' as in Equation 5, but I cannot find how to compute X', even though it is mentioned in Figure 2. You must choose and state one threat model clearly in the paper:

- **(1) Raw-input attack (recommended):** attacker perturbs the raw observations \(X\) that are fed into the forecasting model. This is the most realistic end-to-end setting (sensor spoofing, data-assimilation tampering).  
- **(2) Output/forecast attack:** attacker perturbs the published forecast \(Y\) directly (e.g., intercept/modify forecast products). This is a valid but different threat model and must be justified operationally.  
- **(3) Joint attack:** attacker can perturb both \(X\) and \(Y\). If used, consistency between \(X'\) and \(Y'\) must be enforced.
soundness: 1
strengths: **i.** The research topic is interesting and important. While adversarial attacks have been extensively studied in static domains such as image and text classification, their impact on dynamic applications like time series forecasting remains underexplored. 

**ii.** The paper is easy-to-follow. 

**iii.** The setting that integrates time series forecasting with a downstream tropical cyclone (TC) detection system is interesting and well-motivated, as it reflects a more realistic and application-driven scenario.
summary: This submission focuses on adversarial attacks against weather forecasting models. It identifies three key research challenges: the black-box constraints of tropical cyclone (TC) detection systems, the sparsity of TC events, and the need to maintain physical consistency in the generated perturbations. To address these challenges, the paper proposes Cyc-Attack, a surrogate model–based black-box adversarial attack framework designed to effectively evaluate and exploit the vulnerabilities of TC forecasting systems.
weaknesses: **i.** The research gaps are not accurately identified. Specifically, the third and fourth “challenges” mentioned in the paper should not be considered unsolved research problems. For example, ensuring that adversarial perturbations are imperceptible and realistic is a fundamental property of adversarial examples, not a unique challenge. Similarly, developing a precise surrogate model is an inherent prerequisite for any surrogate model–based black-box attack, rather than a novel research gap. The paper should better clarify which aspects of these challenges are truly new or unexplored in the context of adversarial studies on weather forecasting models.

**ii.** The motivation for adopting a surrogate model–based transfer attack is not sufficiently supported. Prior studies, such as [1] (multi-query) and [2] (one-query), have already proposed zero-order optimization–based black-box attacks for time series forecasting models. Although the manuscript claims that such methods require queries to the black-box system, it does not clearly explain why constructing a surrogate model is preferable to directly querying the true system. This justification is particularly important because the sparsity of tropical cyclone events can significantly degrade the similarity between the surrogate and the target systems, potentially limiting the transferability and practical effectiveness of the proposed approach.

**iii.** The attack pipeline is conceptually unclear. More importantly, the pipeline shown in Figure 2 does not align with the formulation described in Section 4. In this setup, the weather forecast serves as an intermediate output between the deep-learning-based forecasting model and the downstream tropical cyclone (TC) detection system. However, the paper defines the attack as manipulating the prediction \(Y\) rather than the input \(X\), which is inconsistent. If the attack manipulates the forecast output \(Y\) as described in Section 4, then the forecasting model becomes unnecessary, since one could directly perturb \(Y\) before passing it to the TC detector. Conversely, if the attack perturbs the input \(X\) as shown in Figure 2, then the optimization should compute and update \(X'\) instead of \(Y'\) in Section 4. This inconsistency makes the attack pipeline difficult to interpret and weakens the overall clarity of the experimental design.

**iv.** The technical contribution is relatively marginal. The submission trains a surrogate model to perform a transfer-based black-box attack, with the primary challenge attributed to data imbalance. However, neither the use of surrogate model–based attacks nor the approach to address imbalance represents a novel contribution. Both have been well-studied in prior literature, and the manuscript does not provide sufficient methodological innovation or theoretical advancement beyond existing work.

**v.** The experimental evaluation involves only one tropical cyclone (TC) detection system, which limits the assessment of the proposed method’s generalization capability. Without testing on multiple detection systems or model architectures, it remains unclear whether the surrogate model trained in this study can generalize effectively to other TC detection frameworks or forecasting setups.












**References**

[1] Zhu, Lyuyi, et al. "Adversarial diffusion attacks on graph-based traffic prediction models." IEEE Internet of Things Journal 11.1 (2023): 1481-1495.

[2] Liu, Fuqiang, et al. "Adversarial Vulnerabilities in Large Language Models for Time Series Forecasting." International Conference on Artificial Intelligence and Statistics. PMLR, 2025.

---

confidence: 3
contribution: 3
initial_rating: 8
presentation: 4
questions: Please see weaknesses.
soundness: 3
strengths: 1. Overall the paper is well-written and easy to follow. The algorithm design is also technically sound.
2. The paper extends adversarial robustness analysis from general DLWF models to downstream applications like TC trajectory prediction, which is societally relevant and technically distinct from prior pixel-level attacks.
3. The study uses real-world datasets (ERA5, IBTrACS) and provides thorough quantitative comparisons, ablations, and visualization (e.g., Hurricane Delta, Typhoon Haiyan). Metrics at both location and trajectory levels are carefully defined.
summary: This paper studies the vulnerability of deep learning–based weather forecasting systems to adversarial attacks, focusing on the downstream task of tropical cyclone trajectory prediction. Overall it is a timely and well-executed study on adversarial vulnerabilities in downstream weather forecasting pipelines. The method is well-motivated and empirically validated. While the evaluation scope and realism analysis could be expanded, the work is technically sound, clearly written, and potentially impactful for both the adversarial ML and climate science communities.
weaknesses: 1. While the authors constrain perturbations via distance weighting, physical realism is not formally validated. The “stealthiness” metric is purely statistical (ℓ1 distance).
2. It seems that the defenses discussed in the paper are more of detections rather than technques that can make the forecasting models more robust to attacks. Would appreciate more discussions on the defense side.

---

confidence: 3
contribution: 3
initial_rating: 6
presentation: 2
questions: 1、In Section 5.2, when R=0, FPR is 0.0067 and TPR is 0.9896; when R=2, FPR drops to 0.0002, but TPR decreases significantly to 0.8131. Why is the reduction in FPR from 0.0067 to 0.0002 considered more important than the drop in TPR from 0.9896 to 0.8131? Has the risk trade-off between false alarms and missed detections been evaluated in the context of meteorological early warning systems? Is this choice supported by domain expertise or operational requirements?
2、In the first row of Figure 4, the adversarial trajectories generated by baseline methods (e.g., ALA, TAAOWPF, AOWF) are not shown. Is this because these methods failed to produce complete and coherent trajectories, making visualization impossible? If so, does this indicate that these methods are ineffective at the trajectory level? The authors should clarify this in the text and, if possible, include their outputs in the appendix for a more comprehensive comparison.
soundness: 3
strengths: 1、The focus on tropical cyclone trajectory prediction provides a highly relevant and impactful setting for studying the vulnerabilities of deep learning weather forecasting models in downstream applications, offering valuable insights for improving real-world robustness.

2、The paper systematically addresses several critical challenges, including the non-differentiability of black-box TC detectors, severe class imbalance, premature attack termination due to surrogate model errors, and the generation of unrealistic zigzag trajectories, demonstrating technical depth and completeness.
summary: This paper proposes Cyc-Attack, a novel adversarial attack method that perturbs the outputs of upstream weather forecasting models to manipulate downstream tropical cyclone trajectory predictions. The method effectively addresses challenges such as data sparsity and extreme class imbalance through the use of a differentiable surrogate model, skewness-aware loss, kernel dilation, and distance-based gradient weighting, enabling successful attacks in black-box settings while generating realistic and stealthy adversarial trajectories.
weaknesses: 1、Several critical choices, especially in experimental design and parameter selection, lack in-depth justification, which affects the clarity and persuasiveness of the paper. Specific issues are listed below under "Questions."

---

confidence: 3
contribution: 2
initial_rating: 4
presentation: 3
questions: Please refer to the weakness part.
soundness: 2
strengths: 1. It is the first work to demonstrate how to attack a downstream weather application (cyclone tracking) by perturbing upstream forecasts.

2.  The method outperforms several baselines in terms of both attack success rate (higher trajectory detection rate) and stealth (lower false alarm rate and smaller perturbations).
summary: This paper introduces Cyc-Attack, an adversarial attack method that manipulates deep learning-based weather forecasts to alter downstream tropical cyclone trajectory predictions. The paper focuses on addressing the black-box nature of cyclone detectors and the extreme class imbalance issue by employing a differentiable surrogate model, a skewness-aware loss with kernel dilation, and distance-based gradient weighting to generate stealthy and effective perturbations.
weaknesses: 1.  The attack's effectiveness may highly rely on the accuracy of the pre-trained surrogate model in approximating the black-box detector; inaccuracies here could degrade performance.

2. The process involves pre-training a surrogate model and running an iterative, gradient-based attack, which can be computationally expensive

3. The technical contribution of the paper is a little limited as adversarial attack on time series problems has been well studied. 

4. The real-world impact of the proposed method is not very clear since how an attacker can add the perturbation in practice is not very clear.


Decision: Reject