Practical Adversarial Attacks on Spatiotemporal Traffic Forecasting Models
Abstract
Machine learning based traffic forecasting models leverage sophisticated spatiotemporal auto-correlations to provide accurate predictions of city-wide traffic states.
However, existing methods assume a reliable and unbiased forecasting environment, which is not always available in the wild.
In this work, we investigate the vulnerability of spatiotemporal traffic forecasting models and propose a practical adversarial spatiotemporal attack framework.
Specifically, instead of simultaneously attacking all geo-distributed data sources, an iterative gradient-guided node saliency method is proposed to identify the time-dependent set of victim nodes.
Furthermore, we devise a spatiotemporal gradient descent based scheme to generate real-valued adversarial traffic states under a perturbation constraint.
Meanwhile, we theoretically demonstrate the worst performance bound of adversarial traffic forecasting attacks.
Extensive experiments on two real-world datasets show that the proposed two-step framework achieves up to 67 .
8% performance degradation on various advanced spatiotemporal forecasting models.
Remarkably, we also show that adversarial training with our proposed attacks can significantly improve the robustness of spatiotemporal traffic forecasting models.
Our code is available in https://github.com/usail-hkust/Adv-ST .
Introduction
Machine learned spatiotemporal forecasting models have been widely adopted in modern Intelligent
Transportation Systems (ITS) to provide accurate and timely prediction of traffic dynamics, e g. , traffic flow [1], traffic speed [2, 3], and the estimated time of arrival [4, 5].
Despite fruitful progress in improving the forecasting accuracy and utility [6], little attention has been paid to the robustness of spatiotemporal forecasting models.
For example, Figure 1 demonstrates that injecting slight adversarial perturbations on a few randomly selected nodes can significantly degrade the traffic
[Figure]
forecasting accuracy of the whole system.
Therefore, this paper investigates the vulnerability of traffic forecasting models against adversarial attacks.
In recent years, adversarial attacks have been extensively studied in various application domains, such as computer vision and natural language processing [7].
However, two major challenges prevent applying existing adversarial attack strategies to spatiotemporal traffic forecasting.
First, the traffic forecasting system makes predictions by exploiting signals from geo-distributed data sources ( e.g. , hundreds of roadway sensors and thousands of in-vehicle GPS devices).
It is expensive and impractical to manipulate all data sources to inject adversarial perturbations simultaneously.
Furthermore, state-of-the-art traffic forecasting models propagate local traffic states through the traffic network for more accurate prediction [5].
Attacking a few arbitrary data sources will result in node-varying effects on the whole system.
How to identify the subset of salient victim nodes with a limited attack budget to maximize the attack effect is the first challenge.
Second, unlike most existing adversarial attack strategies that focus on time-invariant label classification [8, 9], the adversarial attack against traffic forecasting aims to disrupt the target model to make biased predictions of continuous traffic states.
How to generate real-valued adversarial examples without access to the ground truth of future traffic states is another challenge.
To this end, in this paper, we propose a practical adversarial spatiotemporal attack framework that can disrupt the forecasting models to derive biased city-wide traffic predictions.
Specifically, we first devise an iterative gradient-guided method to estimate node saliency, which helps to identify a small time-dependent set of victim nodes.
Moreover, a spatiotemporal gradient descent scheme is proposed to guide the attack direction and generate real-valued adversarial traffic states under a human imperceptible perturbation constraint.
The proposed attack framework is agnostic to forecasting model architecture and is generalizable to various attack settings, i.e. , white-box attack, grey-box attack, and black-box attack.
Meanwhile, we theoretically analyze the worst performance guarantees of adversarial traffic forecasting attacks.
We prove the adversarial robustness of spatiotemporal traffic forecasting models is related to the number of victim nodes, the maximum perturbation bound, and the maximum degree of the traffic network.
Extensive experimental studies on two real-world traffic datasets demonstrate the attack effectiveness of the proposed framework on state-of-the-art spatiotemporal forecasting models.
We show that attacking 10% nodes in the traffic system can break down the global forecasting Mean Average
Error (MAE) from 1 . 975 to 6 . 1329 .
Moreover, the adversarial attack can induce 68 .
65% , and 56 .
67% performance degradation under the extended white-box and black-box attack settings, respectively.
Finally, we also show that incorporating adversarial examples we generated with adversarial training can significantly improve the robustness of spatiotemporal traffic forecasting models.
Background and problem statement
In this section, we first introduce some basics of spatiotemporal traffic forecasting and adversarial attack, then formally define the problem we aim to address.
2. Spatiotemporal traffic forecasting
Let G t
=
( V , E ) denote a traffic network at time step t , where V is a set of n nodes ( e.g. , regions, road segments, roadway sensors, etc. )
and E is a set of edges.
The construction of G t can be categorized into two types, (1) prior-based, which pre-define G t based on metrics such as geographical proximity and similarity [10], and (2) learning-based, which automatically learns G t in an end-toend way [2].
Note the G t can be static or time-evolving depending on the forecasting model.
We denote X t = ( x 1 ,t , x 2 ,t , · · · , x n,t ) as the spatiotemporal features associated to G t , where x i,t ∈ R c represents the c -dimensional time-varying traffic conditions ( e.g. , traffic volume, traffic speed) and contextual features ( e.g. , weather, surrounding POIs) of node v i ∈ V at t .
The spatiotemporal traffic forecasting problem aims to predict traffic states for all v i ∈ V over the next τ time steps,
[Equation]
where H t − T +1:
t = { ( X t − T +1 , G t − T +1 ) , . . .
, ( X t , G t ) } denotes the traffic states contains input features and the traffic network in previous T time steps, f θ ( · ) is the spatiotemporal traffic forecasting model parameterized by θ , and ˆY t +1:
t + τ = { ˆY t +1 , ˆY t +2 , · · · , ˆY t + τ } is the estimated traffic conditions of interest of V from time step t +1 to t
+ τ .
We denote Y t +1:
t + τ = { Y t +1 , Y t +2 , · · · , Y t + τ } as the ground truth of H t − T +1: t .
Note the above formulation is consistent with the state-of-the-art Graph Neural Network (GNN) based spatiotemporal traffic forecasting models [2, 10, 11, 12], and is also generalizable to other variants such as Convolutional Neural Network (CNN) based approaches [13].
2. Adversarial attack
Given a machine learning model, adversarial attack aims to mislead the model to derive biased predictions by generating the optimal adversarial example
[Equation]
where x ′ is the adversarial example with maximum bound ε under L p norm to guarantee the perturbation is imperceptible to human, and y is the ground truth of clean example x .
Various gradient-based methods have been proposed to generate adversarial examples, such as FGSM [14], PGD [8], MIM [9], etc.
For instance, the adversarial example x ′ =
x + ε sign ( ∇ x L CE ( x, y ; θ )) in FGSM, where sign ( · ) is the Signum function and L CE ( · ) is the cross entropy loss.
Note the adversarial attack happened in the testing stage, and the attackers cannot manipulate the forecasting model or its output.
On the benign testing set, the forecasting model can perform well.
Based on the amount of information the attacker can access in the testing stage, the adversarial attack can be categorized into three classes.
White-box attack .
The attacker can fully access the target model, including the model architecture, the model parameters, gradients, model outputs, the input traffic states, and the corresponding labels.
Grey-box attack .
The attacker can partially access the system, including the target model and the input traffic states, but without the labels.
Black-box attack .
The attacker can only access the input traffic states, query the outputs of the target model or leverage a surrogate model to craft the adversarial examples.
2. Adversarial attack against spatiotemporal traffic forecasting
This work aims to apply adversarial attacks to spatiotemporal traffic forecasting models.
We first define the adversarial traffic state as follow,
[Equation]
where S t ∈ { 0 , 1 } n × n is a diagonal matrix with i
th diagonal element indicating whether node i is a victim node, and X ′ t is the perturbed spatiotemporal feature named adversarial spatiotemporal feature.
We restrict the adversarial traffic state by the victim node budget η and the perturbation budget ε .
Note that following the definition of adversarial attack, we leave the topology of G t immutable as we regard the adjacency relationship as a part of the model parameter that may be automatically learned in an end-to-end way.
Attack goal .
The attacker aims to craft adversarial traffic states to fool the spatiotemporal forecasting model to derive biased predictions.
Formally, given a spatiotemporal forecasting model f θ ( · ) , the adversarial attack against spatiotemporal traffic forecasting is defined as
[Equation]
where T test and T train denote the set of time steps of all testing and training samples, respectively.
L ( · ) is the loss function measuring the distance between the predicted traffic states and ground truth, and θ ∗ is optimal parameters learned during the training stage.
Since the ground truth ( i.e. , future traffic states) under the spatiotemporal traffic forecasting setting is unavailable at run-time, the practical adversarial spatiotemporal attack primarily falls into the greybox attack setting.
However, investigating white-box attacks is still beneficial to help us understand how adversarial attack works and can help improve the robustness of spatiotemporal traffic forecasting models ( e.g. , apply adversarial training).
We discuss how to extend our proposed adversarial attack framework to white-box and black-box settings in Section 3.2.
Methodology
In this section, we introduce the practical adversarial spatiotemporal attack framework in detail.
Specifically, our framework consists of two steps: (1) identify the time-dependent victim nodes, and (2) attack with the adversarial traffic state.
3. Identify time-dependent victim nodes
One unique characteristic that distinguishes attacking spatiotemporal forecasting from conventional classification tasks is the inaccessibility of ground truth at the test phase.
Therefore, we first construct future traffic states’ surrogate label to guide the attack direction,
[Equation]
where g ϕ ( · ) is a generalized function ( e.g. , tanh( · ) , sin ( · ) , f θ ( · )) , δ t +1: t + τ are random variables sampled from a probability distribution π ( δ t +1: t + τ ) to increase the diversity of the attack direction.
In our implementation, we derive ϕ based on the pre-trained forecasting model parameter θ ∗ , and δ t +1:
t + τ ∼ U ( − ε/ 10 , ε/ 10) .
In the real-world production [5], the forecasting models are usually updated in an online fashion ( e.g. , per hours).
Therefore, we estimate the missing latest traffic states based on previous input data, ˜ H t
= g φ ( H t − 1 ) , where g φ ( · ) is the estimation function parameterized by φ .
For simplicity, we directly obtain φ from the pre-trained traffic forecasting model f
θ ∗ ( · ) .
With the surrogate traffic state label ˜Y t +1: t + τ , we derive the time-dependent node saliency (TDNS) for each node as
[Equation]
where L ( f θ ( ˜ H t − T +1: t ) , ˜Y t +1: t + τ ) is the loss function and σ is the activation function.
Intuitively,
M t reveals the node-wise loss impact with the same degree of perturbations.
Note depending on the time step t , M t may vary.
A similar idea also has been adopted to identify static pixel saliency for image classification [15].
More in detail, the loss function L ( f θ ( ˜ H t − T
+1: t ) , ˜Y t +1: t + τ ) in Equation 6 is updated by the iterative gradient-based adversarial method [8],
[Equation]
where H ′ ( i ) t − T +1: t is adversarial traffic states at i -th iteration, α is the step size, and clip X ′ t − T +1 ,ε ( · ) is the project operation which clips the spatiotemporal feature with maximum perturbation bound ε .
Note H ′ (0)
t − T +1: t = ˜
H t − T +1: t .
For each batch of data (cid:110) ( ˜ H t − T +1: t , ˜Y t +1: t + τ ) ( j ) (cid:111) γ j =1 , the time-dependent node saliency gradient is derived by
[Equation]
where γ is the batch size.
We use the RELU activation function to compute the non-negative saliency score for each time step,
[Equation]
Finally, we obtain the set of victim node S t based on M t , s
[Equation]
i
[Equation]
i
[Equation]
if
[Equation]
∈ Top ( M
[Equation]
k
[Equation]
otherwise , (10) where s ( i,i ) ,t denotes the i -th diagonal element of S t , and Top ( · ) is a 0-1 indicator function returning if v i is the top- k salient node at time step t .
3. Attack with adversarial traffic state
Based on the time-dependent victim set, we conduct adversarial attacks to spatiotemporal traffic forecasting models.
Specifically, we first generate perturbed adversarial traffic features based on gradient descent methods.
Take the widely used Projected Gradient Descent (PGD) [8] for illustration, we construct Spatiotemporal Projected Gradient Descent (STPGD) as below,
[Equation]
where H ′ ( i − 1) t − T +1: t is the adversarial traffic state at i − 1 -th iteration in the iterative gradient descent, α is the step size, and clip X ′ t − T
+1: t ,ε ( · ) is the operation to bound adversarial features in a ε ball.
Note X ′ (0) t = ˜X t .
Instead of perturbing all nodes as in vanilla PGD, we only inject perturbations on selected victim nodes in S t .
Similarly, we can generate perturbed adversarial traffic features by extending other gradient based methods, such as MIM [9].
In the testing phase, we can inject the adversarial traffic states
H ′ t − T +1:
t =
H t − T +1: t + △ H ′ t − T
+1: t to apply adversarial attack, where △ H ′ t
+ H t
= { ( X ′ t − X t ) · S t + X t , G t } ∈ H ′
t − T +1: t and △ H ′ t =
(cid:110) (( X ′ t − X t ) · S t , 0) :
∥ S t ∥ 0 ≤ η, ∥ ( X ′ t − X t ) · S t ∥ p ≤ ε (cid:111) ∈ △ H ′
t − T +1: t .
The details of the adversarial spatiotemporal attack framework under the grey-box setting is in algorithm 1.
The overall adversarial spatiotemporal attack can be easily extended to the white-box and black-box settings, which are detailed below.
White-
box
attack .
Since the adversaries can fully access the data and labels under the white-box setting, we directly use the real ground truth traffic states to guide the generation of adversarial traffic states.
The detailed algorithm is introduced in Appendix A.1.
Black-box attack .
The most restrictive black-box setting assumes limited accessibility to the target model and labels.
Therefore, we first employ a surrogate model, which can be learned from the training data or by querying the traffic forecasting service [16, 17].
Then we generate adversarial traffic states based on the surrogate model to attack the targeted traffic forecasting model.
Please refer to Appendix A.2 for more details.
We conclude this section with the theoretical upper bound analysis of the proposed adversarial attack strategy.
In particular, we demonstrate the attack performance against the spatiotemporal traffic forecasting model is related to the number of chosen victim nodes, the budget of adversarial perturbations, as well as the traffic network topology.
Theorem 1 Let Z ( L ) =
f θ ( H t − T +1: t ) and Z ′ ( L ) =
f θ ( H ′ t − T +1: t ) be the L -th layer embeddings of the forecasting model, the upper bound of the adversarial loss satisfies
[Equation]
where λ denotes maximum weight bound in all layers of the forecasting model, β denotes parameter of the activation function in f θ ( · ) , C denotes the maximum degree of G .
η and ε are the budget of number of victim nodes and perturbations, respectively.
Proof .
Please refer to Appendix B.
Result:
Perturbed Adversarial traffic states H
′ t − T +1: t . /
* Step 1:
Identify time-dependent victim nodes */ 1 Estimate current traffic state ˜
H t − N +1: t by function g φ ( · ) ; 2 Construct future traffic state’s surrogate labels ˜Y t +1:
t + τ by Equation 5 ; 3 Compute the time-dependent node saliency M t with ˜ H t − T +1:
t and ˜Y t +1:
t + τ by Equation 6-9; 4 Obtain the victim node set S t by Equations 10 ; / *
Step 2: Attack with adversarial traffic state
adversarial state H ′
t − T + t = ˜
H t − T +
) t − T +1: t =
( X ′ ( i ) t − T +1: t − ˜X t − T
+1: t ) · S t , 0) ; 9 end 10 Return H ′
t − T +1:
t =
H t − T +1: t + △ H ′ t − T
+1: t .
Experiments 4. Experimental setup
Datasets .
We use two popular real-world datasets to demonstrate the effectiveness of the proposed adversarial attack framework.
(1) PEMS-BAY [18] traffic dataset is derived from the California
Transportation Agencies (CalTrans) Performance Measurement System (PeMS) ranging from January 1, 2017 to May 31, 2017.
325 traffic sensors in the Bay Area collect traffic data every 5 minutes.
METR-LA [19] is a traffic speed dataset collected from 207 Los Angeles County roadway sensors.
The traffic speed is recorded every 5 minutes and ranges from March 1, 2012 to June 30, 2012.
For evaluation, all datasets are chronologically ordered, we take the first 70% for training, the following 10% for validation, and the rest 20% for testing.
The statistics of the two datasets are reported in
Appendix C.
Baselines .
In the current literature, few studies can be directly applied to the real-valued traffic forecasting attack setting.
To guarantee the fairness of comparison, we construct two-step baselines as below.
For victim node identification, we adopt random selection and use the topology-based methods ( i.e. , node degree and betweenness centrality [20]) to select victim nodes.
We also employ
PageRank (PR) [21] as the baseline to decide the set of victim nodes.
For adversarial traffic state generation, we adopt two widely used iterative gradient-based methods, PGD [8] and MIM [9], to generate adversarial perturbations.
In summary, we construct eight two-step baselines, PGDRandom, PGD-PR, PGD-Centrality, PGD-Degree, MIM-Random, MIM-PR, MIM-Centrality, and
MIM-Degree.
For instance, PGD-PR indicates first identifying victim nodes with PageRank and then applying adversarial noises with PGD.
Depending on the adversarial perturbation method, we compare two variants of our proposed framework, namely STPGD-TDNS and STMIM-TDNS.
[Table] [Table]
[Table] [Table]
Target model .
To evaluate the generalization ability of the proposed adversarial attack framework, we adopt the state-of-the-art spatiotemporal traffic forecasting model, GraphWaveNet (Gwnet) [2], as the target model.
Evaluation results on more target models are reported in Appendix F.
Evaluation metrics .
Our evaluation focus on both the global and local effect of adversarial attacks on spatiotemporal models,
[Equation]
where L ( · ) is a user-defined loss function.
Different from the majority target of adversarial attacks that are classification models ( e.g. , adversarial accuracy), traffic forecasting is defined as a regression task.
Therefore, we adopt Mean Average Error (MAE) [22] and Root Mean Square Error (RMSE) [23] for evaluation.
More specifically, we define Global MAE (G-MAE), Local MAE (L-MAE),
Global
RMSE (G-RMSE), Local RMSE (L-RMSE) to evaluate the effect of adversarial attacks on traffic forecasting.
Please refer to Appendix D for detailed definitions of four metrics.
Implementation details .
All experiments are implemented with PyTorch and performed on a Linux server with 4 RTX 3090 GPUs.
The traffic speed is normalized to [0 , 1] .
The input length T and output length τ are set to 12 .
We select 10% nodes from the whole nodes as the victim nodes, and ε is set to 0 .
The batch size γ is set to 64 .
The iteration K is set to 5 , and the step size α is set to 0 .
4. Overall attack performance
Table 1 reports the overall attack performance of our proposed approach against the original forecasting model and eight baselines with respect to four metrics.
Note larger value indicates better attack performance and worse forecasting accuracy.
Specifically, we can make the following observations.
First, the adversarial attack can significantly degrade the traffic forecasting performance.
For example, our approach achieves (67 .
79% , 62 . 31%) and (19 . 88% , 14 .
55%) global performance degradation compared with the original forecasting results on PeMS-BAY and METR-LA dataset, respectively.
Second, our approach achieves the best attack performance against all baselines.
In particular,
STPGD-TDNS achieves (15 .
80% , 15 . 39%) global performance improvement and (23 .
19%) local performance improvement on the PeMS-BAY dataset.
Similarly, STMIM-TDNS achieves (2 . 44% , 2 .
%) global performance improvement and (11 .
70%) local performance improvement on the METR-LA dataset.
Moreover, we observe STPGD-TDNS and STMIM-TDNS, two variants of our framework, respectively achieve the best attack performance on PeMS-BAY and
METR-LA datasets, which further validate the superiority of our framework for flexibly integrate different adversarial perturbation methods.
Overall, our adversarial attack framework successfully disrupts the traffic forecasting model to make biased predictions.
4. Ablation study
Then we conduct ablation study on our adversarial attack framework.
Due to page limit, we report the result of STPGD-TDNS on the PeMS-BAY dataset.
We consider two variants of our approach: (1) w/o
TDNS that randomly choose victim nodes to attack, and (2) w/o STPGD that apply vanilla PGD noise to selected victim nodes.
As reported in Table 2, we observe (3 . 91% , 6 .
and
[Table]
[Figure]
[Table]
[Figure]
19% , 32 . 97%) attack performance degradation on four metrics by removing our proposed TDNS and STPGD module, respectively.
The above results demonstrate the effectiveness of the two-step framework.
Moreover, we observe that the STPGD module plays a more important role in the adversarial spatiotemporal attack.
4. Parameter sensitivity
We further study the parameter sensitivity of the proposed framework, including the number of victim nodes η , the perturbation budget ε , and the batch size γ .
Due to page limit, we report the result of
G-RMSE on the PeMS-BAY dataset.
We observe similar results by using other metrics and on the
METR-LA dataset.
Each time we vary a parameter, we set other parameters to their default values.
Effect of η .
First, we vary the number of victim nodes from 0% to 40% .
As reported in Figure 2 (a),
Our approach achieves the best attack performance with a limited victim node budget, and the advantage decrease when the attack can be applied to more nodes.
Effect of ε .
Second, we vary the perturbation budget from 0% to 90% .
As shown in Figure 2 (b), the G-RMSE first increase and then slightly decrease.
This is perhaps because the clip function in
Equation 11 weakens the diversity of attack noises.
Effect of γ .
Finally, we vary the batch size from 8 to 128 , as illustrated in Figure 2 (c).
We observe the adversarial attack is relatively stable to the batch size.
However, too large batch size reduces the attack performance, which may induce over smooth of Equation 8.
4. Extended analysis under different attack settings
Table 3 reports the overall attack performance of our proposed approach against the original forecasting model and four PGD-based baselines under the white-box and black-box attack settings.
For the white-box attack, since the attacker can fully access the data and model, we re-train the forecasting model without requiring estimating the latest traffic states.
For the black-box attack, we adopt STAWNET [12] as the surrogate model.
The experimental results are summarized in
Table 3.
First, we observe adversarial attacks significantly degrade the performance of the traffic forecasting model under both white-box and black-box settings.
For examples, our approach achieves ((68 .
12%) and (56 .
67% , 50 . 78%) global performance degradation compared with the vanilla forecasting model under white-box and black-box attack.
Moreover, our approach consistently achieves the best attack performance against baselines.
To be more specific, our approach yield (4 .
61% , 9 . 13%) and (1 .
70% , 3 . 28%) global performance improvement under the white-box setting and black-box setting, respectively.
In addition, we observe higher attack effectiveness under
[Table] [Table]
the white-box setting and lower attack effectiveness under the black-box setting compared to the grey-box setting.
This makes sense as the white-box setting can fully access the data and label, while the black-box has more restrictive data accessibility and relies on the surrogate model to apply adversarial spatiotemporal attack.
4. Defense adversarial spatiotemporal attacks
Finally, we study the defense of adversarial spatiotemporal attacks.
One primary goal of our study is to help improve the robustness of spatiotemporal forecasting models.
Therefore, we propose to incorporate the adversarial training scheme for traffic forecasting models with our adversarial traffic states, denoted by AT-TNDS .
We compare it with (1) conventional adversarial training ( AT ) [8] and (2) Mixup [24] with our adversarial traffic states.
Note that we also tried other strategies, such as adding L 2 regularization, etc. , which fail to defend the adversarial spatiotemporal attack.
The other state-of-the-art adversarial training methods, such as TRADE [25], cannot be directly applied in regression tasks.
Please refer to Appendix E for more training details.
The results in G-MAE on the PeMS-BAY are reported in Table 4.
Overall, we observe AT or Mixup can successfully resist the adversarial spatiotemporal attack, and AT-TDNS that combines the adversarial training scheme with our adversarial traffic states achieves the best defensive performance.
The above results indicate the defensibility of adversarial spatiotemporal attacks, which should be further investigated to deliver a more reliable spatiotemporal forecasting service in the future.
Related work
Spatiotemporal traffic forecasting .
In recent years, the deep learning based traffic forecasting model has been extensively studied due to its superiority in jointly modeling temporal and spatial dependencies [10, 11, 6, 26, 2, 12, 27, 28].
To name a few, STGCN [10] applied graph convolution and gated causal convolution to capture the spatiotemporal information in the traffic domain, ASTGCN [11] proposed a spatial-temporal attention network for capturing dynamic spatiotemporal correlations.
As another example, GraphWaveNet [2] adaptively captures latent spatial dependency without requiring prior knowledge of the graph structure.
The key objective of the above mentioned models is more accurate traffic forecasting.
The vulnerability of spatiotemporal traffic forecasting models remains an under explored problem.
Adversarial attack .
Deep neural networks have been proven vulnerable to adversarial examples [8, 14].
As an emerging direction, various adversarial attack strategies on graph-structured data have been proposed, including both target-attack and non-target attack [29, 30].
However, existing efforts on adversarial attacks mainly focus on classification tasks with static label [9, 24].
Only a few works study the vulnerability of GCN based spatiotemporal forecasting models under query-based attack [31] and generate adversarial examples based on evolutionary algorithms [32].
In this paper, we study the gradient based adversarial attack method against spatiotemporal traffic forecasting models, which is model-agnostic and generalizable to various attack settings, i.e. , white-box attack, grey-box attack, and black-box attack.
Conclusion
This paper showed the vulnerability of spatiotemporal traffic forecasting models under adversarial attacks.
We proposed a practical adversarial spatiotemporal attack framework, which is agnostic to forecasting model architectures and is generalizable to various attack settings.
To be specific, we first constructed an iterative gradient guided node saliency method to identify a small time-dependent set of victim nodes.
Then, we proposed a spatiotemporal gradient descent based scheme to generate realvalued adversarial traffic states by flexibly leveraging various adversarial perturbation methods.
The theoretical analysis demonstrated the upper bound of the proposed two-step framework under human imperceptible victim node selection budget and perturbation budget constraints.
Finally, extensive experimental results on real-world datasets verify the effectiveness of the proposed framework.
The reported results will inspire further studies on the vulnerability of spatiotemporal forecasting models, as well as practical defending strategies for resisting adversarial attacks that can be deployed in real-world ITS systems.
Acknowledgments and Disclosure of Funding
This work is supported by the National Natural Science Foundation of China under Grant
No.62102110, and Foshan HKUST Projects (FSUST21-FYTRI01A, FSUST21-FYTRI02A).
Checklist
For all authors... (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?
[Yes] (b) Did you describe the limitations of your work?
[Yes] (c) Did you discuss any potential negative societal impacts of your work?
[N/A] (d) Have you read the ethics review guidelines and ensured that your paper conforms to them?
[Yes] 2.
If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?
[Yes] (b) Did you include complete proofs of all theoretical results?
[Yes] 3.
If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
[Yes] (b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
[Yes] (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[Yes] (d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?
[Yes] 4.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?
[Yes] (b) Did you mention the license of the assets?
[Yes] (c) Did you include any new assets either in the supplemental material or as a URL?
[Yes] (d) Did you discuss whether and how consent was obtained from people whose data you’re using/curating?
[Yes]
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content?
[Yes] 5.
If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?
[N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?
[N/A] (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?
[N/A]
A
Adversarial spatiotemporal attack under different settings
A. Adversarial spatiotemporal attack under the white-box setting
Since the adversaries can fully access the data and label under the white-box setting, we directly use the real ground truth traffic states to generate the adversarial traffic states, as detailed in algorithm 2.
Algorithm 2:
Input: Previous traffic data, pre-trained spatiotemporal model f θ ∗ ( · ) , pre-trained traffic state prediction model g φ ( · ) , maximum perturbation budget ε , victim node budget η , and iterations K .
Result:
Perturbed adversarial traffic states H
′ t − T +1: t . /
* Step
Identify time-dependent victim nodes */ 1 Compute the time-dependent node saliency M t with H t − T +1: t and Y t +1:
t + τ by Equations 6-9; 2 Obtain the victim node set S t by Equation 10 ; /
* Step 2:
Attack with adversarial traffic state
*/ 3 Initialize adversarial traffic state H ′ (0) t − T +1:
t =
H t − T +1: t ; 4 for i = 1 to K do
Generate perturbed adversarial features X ′ ( i ) t − T +1: t by Equation 11; △ H ′ ( i ) t − T +1:
t = (( X ′ ( i ) t − T +1: t − X ( i ) t − T +1: t ) · S t , 0) ; 7 end 8 Return H ′
t − T +1:
t =
H t − T +1: t + △ H ′ t − T
+1: t .
A. Adversarial spatiotemporal attack under the black-box setting
The most restrictive black-box setting assumes limited accessibility to the target model and labels.
Therefore, we first employ a surrogate model, which can be learned on the training data or query the traffic forecasting service [16, 17].
Then we generate adversarial traffic states based on the surrogate model to attack the target model.
In details, we use a surrogate model to generate the adversarial traffic states based on algorithm 1, the generated adversarial traffic states can be used to attack the target model.
B Proof
In this section, we show the details of the proof.
First, we recall the assumptions as follows: let the k -th layer embedding of spatiotemporal traffic models is
[Equation]
where Z ( k +1)
i ( Z ( 0 )
=
H t − T +1: t ) represents the embedding of node v i in k + 1 -th layer of the spatiotemporal forecasting model.
M ( k ) i
=
Z ( k ) i W ( k ) , where W ( k ) denotes the weight matrix for k -th layer of the forecasting model.
σ is an activation function, such as the sigmoid function, relu function, etc.
e ij is the weight value used to aggregate node j ’s neighbors.
N i represents the index used to keep track of node j ’s neighbors.
Let λ denotes maximum weight bound in all layers of the forecasting model, where max k (cid:13)(cid:13) W ( k ) (cid:13)(cid:13) 2 ≤ λ, ∀ k ∈ { 1 , · · · , L } .
We denote that the maximum degree in graph G is C .
Assumption 1 The activation function σ used in spatiotemporal traffic forecasting model is locally
Lipschitz continuous as,
[Equation]
where β denotes parameter of the activation function in f θ ( · ) .
[Table] [Table]
Remarks .
Assumption 1 provides a more general activation function assumption.
This assumption is met by the ReLU, sigmoid, tanh function [10, 11, 2] etc.
We also noticed that [31] also analyzes traffic forecasting loss under query-based attack.
Our theorem is different in that we first give the worst performance bound of an adversarial traffic forecasting attack
[Table]
but [31] does not provide the worst performance bound.
Second, our theorem is more general because we do not specify a specific activation function.
C Data statistics
We conclude the data statistics for two-real world datasets in Table
[Table]
[Table]
The Global MAE (G-MAE), Local MAE (L-MAE), Global RMSE (G-RMSE), Local RMSE (LRMSE) are defined in Equations 16a-17b.
[Equation]
where m represents the number of samples in test sets, and n denotes the number of nodes.
E Defense adversarial traffic states
Given a spatiotemporal forecasting model f θ ( · ) , the adversarial training in spatiotemporal traffic forecasting is defined as
[Equation]
where L ( · ) is the loss function measuring the distance between the predicted traffic states and ground truth, and θ is parameters learned during the training stage.
T train denote the set of time steps of all training samples.
We use strategies that include (1) adversarial training (AT) [8].
We use adversarial training with the PGD-Random adversarial attack method to generate the adversarial samples under white-box setting.
(2) Mixup [24].
We randomly sample the clean and adversarial samples to train the forecasting model.
The adversarial sample are also generated by PGD-Random method under white-box setting.
We use adversarial sampels generated by our method STPGD-TDNS under white-box setting to train the model.
F Further experiments F. Experiments on other models
The other spatiotemporal traffic forecasting models are summarized as follows.
(1) STGCN [10] applies graph convolution and gated causal convolution to capture the spatiotemporal information in the traffic domain.
(2) To overcome the spatiotemporal forecasting problem, ASTGCN [11] presented a spatial-temporal attention method for capturing dynamic spatiotemporal correlations.
MTGNN [33] created a self-learned node embedding for forecasting traffic conditions that is also not dependent on a pre-defined graph.
We report the evaluation results on other target models in Tables 6-8.
By carefully selecting victim nodes, the attacker can achieve more effective attack performance with less attack budget.
In particular,
STPGD-TDNS achieves (62.23.80%, 55.86%) global performance improvement and (66.95.35%, 59.25%) local performance improvement on the PeMS-BAY dataset for MTGNN.
F. Ablation study under white-box setting
Since selecting a few set as the victim nodes is important to attack traffic forecasting model, we conduct further ablation study to evaluate the method TDNS under the white-box setting.
Tablereports the overall results on Gwnet under white-box attack.
[Table]
[Table] [Table]
[Table] [Table]
F. Experiments at different time intervals
We conduct further experiments at different time intervals, including 5 minutes, 10 minutes,minutes, 30 minutes
[Table]
and 45 minutes.
We report the results at different time intervals compared with other baselines in Tables 11-15.
Overall, as the time interval increases, the forecasting and adversarial attack performances decrease, as reported in Table 10.
For example, the G-MAE increases from 3.9458 to 6.1329 from a time interval of 5 minutes to a time interval of 60 minutes, with the attack performance degradation from 75.93% to 67.80%.
One possible reason is that as the time interval increases, the forecasting error of the spatiotemporal model will increase.
It is more challenging for the adversarial attack methods to estimate the target label to generate effective adversarial examples.
[Table] [Table]
[Table] [Table]
[Table] [Table]