One Vertex Attack on Graph Neural Networks-based Spatiotemporal Forecasting

1 INTRODUCTION . Spatiotemporal traffic forecasting has been a long-standing research topic and a fundamental application in intelligent transportation systems ( ITS ) . For instance , with better prediction of future traffic states , navigation apps can help drivers avoid traffic congestion , and traffic signals can manage traffic flows to increase network capacity . Essentially , traffic forecasting can be modeled as a multivariate time series prediction problem for a network of connected sensors based on the topology of road networks . Given the complex spatial and temporal patterns governed by traffic dynamics and road network structure ( Roddick & Spiliopoulou , 1999 ) , recent studies have developed various Graph Neural Networks-based traffic forecasting models ( Yu et al. , 2018 ; Wu et al. , 2019 ; Li et al. , 2017 ; Guo et al. , 2019 ) . These deep learning models have achieved superior performance compared with traditional multivariate time series forecasting models such as vector autoregression ( VAR ) . However , recent research has shown that deep learning frameworks are very vulnerable to carefully designed attacks ( Kurakin et al. , 2016b ; Goodfellow et al. , 2014 ; Papernot et al. , 2016a ; Tramèr et al. , 2017 ; Kurakin et al. , 2016a ) . This raises a critical concern about the application of spatiotemporal GNNbased models for real-world traffic forecasting , in which robustness and reliability are of ultimate importance . For example , with a vulnerable forecasting model , a hacker can manipulate the predicted traffic states . Feeding these manipulated values into the downstream application can cause severe problems such as traffic congestion and even city-scale breakdown . However , it remains unclear how vulnerable these GNN-based spatiotemporal forecasting models are . Particularly , previous adversarial works can not be directly applied to fool GNN-based spatiotemporal forecasting models because of their causality and spatiotemporal mechanism , which is detailed in Section 2 . The goal of this paper is to understand and examine the vulnerability and robustness of GNN-based spatiotemporal forecasting models . In doing so , we design a One Vertex Attack ( OVA ) framework to break these forecasting models by manipulating only one vertex in the graph . We first propose a universal attack method against spatiotemporal GNNs by applying the inverse estimation to avoid using future ground truth . Then , we utilize the genetic algorithm , whose evaluation function is composed of the proposed universal attack method , to locate the “ weakest ” vertex . Here the weakest vertex refers to the vertex where attacking it will cause maximum damage to the forecasting models . Finally , we generate perturbations by solving an optimization problem . It should be noted that poisoning all vertices even multiple vertices in real-world applications is impossible , because the large scale of graph . For instance , the graph of traffic forecasting applications generally covers 1000 square kilometers , and it is unrealistic to organize Harker vehicles to poison all vertices in such a large scale road network . Hence , the proposed one-vertex attack is a realistic solution to evaluate the robustness and vulnerability of spatiotemporal forecasting models deployed in real-world applications . To prove the effectiveness of the proposed OVA method , we test it in two spatiotemporal traffic datasets with three different Spatiotemporal GNNs . The proposed method can cause at least 15 % accuracy drop , and there are about 10 % vertices severely impacted with the boundary of speed variation limited to 15km/h . The contribution of this paper can be summarized as follows . • First , to the best of our knowledge , this is the first study on attacking Spatiotemporal GNNs by poisoning only one vertex . • Second , we proposed a novel OVA method that is able to find the weakest vertex and generate optimal adversarial perturbations . • Third , we empirically study the effectiveness of the proposed method with multiple experiments on real-world datasets . 2 RELATED WORK . Adversarial Attacks against Time Series Analysis . Some previous works ( Chen et al. , 2019 ; Zhou et al. , 2019 ; Alfeld et al. , 2016 ; Karim et al. , 2019 ) proposed adversarial attack methods against Autoregressive models or time series classification models . The above works only consider univariate time series . Different from these works , we focus on complex spatiotemporal domains . The input of spatiotemporal GNNs is the temporal dynamic graph rather than regular matrices or sequences . We take the spatial correlation into consideration while the above works didn ’ t . Adversarial Attacks against Graph Neural Networks . Many studies ( Dai et al. , 2018 ; Zugner & Gunnemann , 2019 ; Chang et al. , 2020 ; Tang et al. , 2020 ) utilized Reinforcement Learning ( RL ) , meta learning , or genetic algorithm to fool GNNs in node , edge , and graph classification domains by tuning the graph topology . All these studies involve no temporal variation in their graphs , and they mainly focus on the spatial pattern . These can not be applied to fool spatiotemporal forecasting models because of the lack of temporal correlation . Particularly , attacking spatiotemporal forecasing models deployed in real-world applications by graph topology-based attack methods ( Zugner & Gunnemann , 2019 ; Chang et al. , 2020 ) are unrealistic , because tuning the graph topology represents tuning the sensor network that collects spatiotemporal data continuously and any modification on sensors can be easily sensed by the sensor network manager . Adversarial Attacks against Recurrent Neural Network . Recent studies ( Rosenberg et al. , 2019 ; Papernot et al. , 2016b ; Hu & Tan , 2017 ) demonstrated RNN classifiers were vulnerable to adversarial sequences . These adversarial works require the ground truth to compute adversarial sequences . Because of the forecasting applications ’ causality , the future ground truth is unavailable . Besides , these works focus on regular vectors or matrices , rather than irregular graphs . Hence these adversarial sequence generation models can not be directly applied to attack spatiotemporal GNN-based forecasting models . One Pixel Attack for Fooling Deep Neural Networks . Su et al . ( 2019 ) utilized Differential Evolution ( DE ) to generate the perturbation to poison one pixel in images , and then fool CNNs . Similar to one pixel attack , we only poison one vertex in graphs . However , images are regular-structured , and Su et al . ( 2019 ) consider no temporal variation . In addition , one pixel attack requires the ground truth to compute perturbations . In forecasting applications , the ground truth is the future traffic state , and it is inaccessible . The above features prevents one pixel attack from poisoning spatiotemporal forecasting models . 3 METHODOLOGY . 3.1 SPATIOTEMPORAL SEQUENCE FORECASTING AND SPATIOTEMPORAL GNNS . Because of the impossibility of deploying sensors as a regular grid in real-world applications , the form of spatiotemporal data is generally irregular . Consequently , to better mine the spatial information , the spatiotemporal sequence is represented as a temporally varied graph rather than a regular grid . The spatiotemporal sequence can be represented as Gt = { Vt , E , W } , where E is the set of edges in the graph , W is the weighted adjacency matrix whose every element describe the spatial relationship between different variates , Vt = { v1 , t , . . . , vn , t } is the set of condition values ( e.g . traffic speed and traffic volume ) collected from sensors on timestamp t , and n is the number of sensors ( Shuman et al. , 2013 ) . Multistep spatiotemporal sequence forecasting can be formulated as Equation 1 . Previous conditions from timestamp t−N + 1 to t are fed into a forecasting model F that outputs predictions of future conditions from t + 1 to t + M . In general , M ≤ N . The above process is customarily called sequence-to-sequence ( seq2seq ) forecasting . { G∗t+M , ... , G∗t+1 } = F ( { Gt , ... , Gt−N+1 } ) ( 1 ) where G∗i denotes the prediction of the condition on timestamp i . Most state-of-art spatiotemporal sequence forecasting models output a single future condition , which will be in turn fed as input into the model to forecast the next condition . This process is named as the recursive multistep forecasting , which can be represented as Equation 2 . G∗t+1 = F ( { Gt , Gt−1 , ... , Gt−N+1 } ) G∗t+2 = F ( { G∗t+1 , Gt , ... , Gt−N+2 } ) ... G∗t+M = F ( { G∗t+M−1 , G∗t+M−2 , ... , Gt−N+M } ) ( 2 ) Most state-of-art forecasting models , F , are constructed based on spatiotemporal GNNs ( Li et al. , 2017 ; Wu et al. , 2019 ; Yu et al. , 2018 ; Guo et al. , 2019 ) . Spatiotemporal GNNs are composed of both spatial layers and temporal layers . In general , gated linear unit ( GLU ) or Gated-CNN ( Bai et al. , 2018 ) works as the temporal layer to capture the temporal patterns embedded in the spatiotemporal sequence , and the Graph-CNN ( Shuman et al. , 2013 ; Bruna et al. , 2014 ) works as spatial layers to capture the spatial patterns . In this paper , we focus on adversarial studies towards recursive multistep spatiotemporal sequence forecasting . Our studies can be easily extended to seq2seq multistep forecasting . 3.2 UNIVERSAL ADVERSARIAL ATTACK AGAINST SPATIOTEMPORAL GNNS . In this section , we point out the form of adversarial attack against the spatiotemporal forecasting , and outline the gap between attacking spatiotemporal GNNs and attacking CNNs or GNNs . Then we propose the inverse estimation to fill the gap . Finally , we design the universal adversarial attack against spatiotemporal GNNs . 3.2.1 ADVERSARIAL ATTACKS AGAINST SPATIOTEMPORAL FORECASTING . Adversarial attacking against recursive multistep forecasting can be formed as Equation 3 . The goal is to mislead spatiotemporal GNNs to generate false forecasting by adding perturbations . F ( { Gt , ... , Gt−N+1 } + { ρt , ... , ρt−N+1 } ) 6= Gt+1 s.t . ‖ρi‖p ≤ ξ ∀ i ∈ { t , ... t−N + 1 } ( 3 ) where ρi denotes perturbations on timestamp i , ‖·‖p denotes ` p-norm , and ξ denotes the pre-defined constant to constrain the perturbation scale . In real-world traffic applications , ξ control the hacker ’ s driving behavior to balance the attack performance and detection avoidance . Because of spatiotemporal sequence ’ s causality , we can not access the future condition that works as the ground truth of forecasting models . In other words , Gt+1 in Equation 3 is not available on timestamp t. Previous adversarial studies against CNNs , RNNs , and GNNs ( Dai et al. , 2018 ; Papernot et al. , 2016b ; Kurakin et al. , 2016b ; Alfeld et al. , 2016 ) almost all involve the ground truth in the perturbation computation . In fooling spatiotemporal GNNs as Equation 3 , the ground truth , Gt+1 , is still inevitable . As we mentioned above , the future condition is unavailable , and thus we can not generate adversarial perturbations directly as Equation 3 . 3.2.2 INVERSE ESTIMATION . We propose Inverse Estimation to avoid using the future ground truth in fooling spatiotemporal GNNs . First , Equation 3 is transformed to Equation 4 , which represents our goal is to fool spatiotemporal GNNs to generate opposite forecasting . arg min { ρt , ... , ρt−N+1 } ‖F ( { Gt , ... , Gt−N+1 } + { ρt , ... , ρt−N+1 } ) −G̃t+1‖2+α· t∑ i=t−N+1 max ( 0 , ρ2i−ξ ) ( 4 ) where G̃t+1 denotes the opposite condition of Gt+1 , α denotes the penalty factor . The constrain in Equation 3 is replaced with a regularization term in Equation 4 to constrain the perturbation scale . The penalty factor α is set as 100 to make sure the scale penalty term is much larger than the first term in Equation 4 so that the scale of the computed perturbation is strictly forced . The above idea is similar to targeted attacks ( Akhtar & Mian , 2018 ) . However , classical targeted attacks still utilize the ground truth in perturbation computations . To use no future information , the opposite of future condition , G̃t+1 , is estimated by computing the opposite of the most recent condition , which is represented as Equation 5 . G̃t+1 ← G̃t = { Ṽt , E , W } ( 5 ) where Ṽt = { ṽ1 , t , ... , ṽn , t } denotes a collection of condition values opposite to these collected from sensors . Take the traffic condition for instance , when the condition is “ congested/low speed ” , its opposite is “ free/high speed ” , and vice versa . ṽi , t , the opposite of vi , t , is computed as Equation 6. ṽi , t = { max ( V ) , vi , t < mid min ( V ) , vi , t ≥ mid ( 6 ) where mid , max ( V ) , and min ( V ) represent the mean , maximum , and minimum value of the spatiotemporal dataset , respectively . Inverse Estimation outperforms directly estimating the future ground truth . The error of the estimation on the opposite of ground truth is smaller than errors of any direct estimation . To validate the above assumption , we carry out a test on PeMS dataset . We compare the proposed inverse estimation with three types of ground truth estimation methods , namely estimating by the most recent traffic condition ( MR ) , spatiotemporal graph convolution neural network ( STGCN ) , and AutoRegressive Integrated Moving Average ( ARIMA ) . The experiment result is shown as Table 1 . The proposed Inverse Estimation ’ s performance , including mean absolute error ( MAE ) , mean absolute percent error ( MAPE ) , root mean square error ( RMSE ) , and perfect estimation ratio ( PER ) , is better than others ’ . It should be noted 99.56 % IE ’ s estimations are exactly equal to the opposite of ground truth .

Summary: This paper studies the problem of attacking graph neural networks for spatio-temporal prediction problems (e.g., traffic speed prediction). The input of the problem is a spatio-temporal sequence represented as graphs at time t-N+1 to t, where a graph neural network is trained to predict the graph sequence for time t+1 to t+M. The aim is to add perturbations to the input graph sequence, such that the predicted graph sequence varies from the ground truth as much as possible.