## 1 Introduction  
Our critical national infrastructure (CNI) systems like those driving power generation and distribution, water treatment, electricity production, and other platforms are being increasingly digitized and controlled by the Internet of Things (IoT) [1]. The task of forecasting demand for CNI is fundamental and crucially important to run CNI smoothly and make sound operational decisions [2]. Demand specifies the number of goods and services that will be used or consumed in an economy at a given time. Cyber physical system (CPS)-based demand forecasting systems (CDFS) are ubiquitous in CNI [2] where sensor nodes are deployed in the environment to monitor the current demand for the services of CNI (e.g., traffic and electricity consumption) [3, 4, 5, 6, 7]. The sensors transmit their measurements at a regular interval to a base station through one or more intermediate nodes depending on the distance between the sensor and the base station. In the base station, the measurements of all sensors are aggregated using aggregate operators like average and sum. The forecasting model stored in the base station uses the values of the aggregate demand time series to develop an estimate of expected demand during a specified future period. The demand forecast is transmitted to the application layer to adjust the supply of the services of CNI such as electricity, water, gas, transportation, etc., to the forecasted demand. Inaccurate demand forecasts can create an imbalance of demand and supply which may have a devastating impact in terms of lives lost, infrastructure damage, and economic disruption [8; 9; 10]. The accuracy of demand forecasting depends on the reliability of the inputs to the forecasting model. In CPS, sensor nodes are deployed in remote areas without any physical protection [11]. Furthermore, sensors are resource-constrained tiny nodes, due to which the implementation of traditional cryptographic techniques is not possible [11]. Hence, sensor nodes are highly vulnerable to attacks, and attackers can easily tamper with the sensor node and compromise it [6; 12]. Once a sensor node is compromised, attackers can launch any form of attack they desire [13]. A false data injection attack (FDIA) is the worst possible attack that could be made on a forecasting system. In FDIAs, attackers modify the measurements of the compromised sensors to change the demand forecasts to their desired level [14; 15]. To resolve this issue, it is necessary to improve the resilience of CDFS to stealthy attacks. Resilience is twofold. Firstly, the CDFS must be robust against attacks (that is, be able to either prevent the attacks or detect them at a very early stage), and secondly, it should bounce back quickly to its baseline before the attack [4]. Recently, several resilient CDFS have been proposed that consider any drastic change in demand distribution as an attack [9; 16; 17; 18]. The problem with this approach is that the joint probability distribution of demand time series keeps changing naturally with time [2]. The approach often produces an extremely high false positive rate [9]. In addition, the attackers have figured out how to avoid detection. They launch collusion attacks in which the attacker takes control of multiple sensor nodes and alters the readings of those sensors slightly, such that the aggregate value of all sensors' readings is skewed towards the attacker's desired direction [19]. This aggregate measurement estimated at the time step \(t\) is incorporated into the training set. The demand forecasting models are adapted to recent history to make out-of-sample forecasts so that the machine learning forecasting system dynamically adapts to data distributions that evolve over time. Since the forecasting model is evolving toward false data, over time, the normal sensors are marked as compromised. They have an increasingly reduced influence on the model's evolution. This way, through careful selection of reported values, the attackers manage to shift the accepted value far away from the actual value.