Practical Adversarial Attacks on Spatiotemporal Traffic Forecasting Models
Anonymous Author(s)
AffiliationAddress
Abstract
Machine learning based traffic forecasting models leverage sophisticated spatiotemporal auto-correlations to provide accurate predictions of city-wide traffic states.
However, existing methods assume a reliable and unbiased forecasting environment, which is not always available in the wild.
In this work, we investigate thevulnerability of spatiotemporal traffic forecasting models and propose a practicaladversarial spatiotemporal attack framework.
Specifically, instead of simultaneously attacking all geo-distributed data sources, an iterative gradient-guided nodesaliency method is proposed to identify the time-dependent set of victim nodes.
Furthermore, we devise a spatiotemporal gradient descent based scheme to generatereal-valued adversarial traffic states under a perturbation constraint.
Meanwhile,we theoretically demonstrate the worst performance bound of adversarial trafficforecasting attacks.
Extensive experiments on two real-world datasets show that theproposed two-step framework achieves up to 67 .
8% performance degradation onvarious advanced spatiotemporal forecasting models.
Remarkably, we also showthat adversarial training with our proposed attacks can significantly improve therobustness of spatiotemporal traffic forecasting models.
Our code is available inhttps://anonymous.4open.science/r/ASTFA-EA35 .
Introduction
Machine learned spatiotemporal forecasting models have been widely adopted in modern Intelligent
Transportation Systems (ITS) to provide accurate and timely prediction of traffic dynamics, e g. ,traffic flow [1], traffic speed [2], and the estimated time of arrival [3].
Despite fruitful progress inimproving the forecasting accuracy and utility [4], little attention has been paid to the robustnessof spatiotemporal forecasting models.
For example, Figure 1 demonstrates that injecting slightadversarial perturbations on a few randomly selected nodes can significantly degrade the trafficforecasting accuracy of the whole system.
Therefore, this paper investigates the vulnerability oftraffic forecasting models against adversarial attacks.
In recent years, adversarial attacks have been extensively studied in various application domains,such as computer vision and natural language processing [5].
However, two major challengesprevent applying existing adversarial attack strategies to spatiotemporal traffic forecasting.
First,the traffic forecasting system makes predictions by exploiting signals from geo-distributed datasources ( e.g. , hundreds of roadway sensors and thousands of in-vehicle GPS devices).
It is expensiveand impractical to manipulate all data sources to inject adversarial perturbations simultaneously.
Furthermore, state-of-the-art traffic forecasting models propagate local traffic states through thetraffic network for more accurate prediction [6].
Attacking a few arbitrary data sources will result innode-varying effects on the whole system.
How to identify the subset of salient victim nodes with alimited attack budget to maximize the attack effect is the first challenge.
Second, unlike most existingadversarial attack strategies that focus on time-invariant label classification [7, 8], the adversarial
[Figure]
attack against traffic forecasting aims to disrupt the target model to make biased predictions ofcontinuous traffic states.
How to generate real-valued adversarial examples without access to theground truth of future traffic states is another challenge.
To this end, in this paper, we propose a practical adversarial spatiotemporal attack framework thatcan disrupt the forecasting models to derive biased city-wide traffic predictions.
Specifically, wefirst devise an iterative gradient-guided method to estimate node saliency, which helps to identify asmall time-dependent set of victim nodes.
Moreover, a spatiotemporal gradient descent scheme isproposed to guide the attack direction and generate real-valued adversarial traffic states under a humanimperceptible perturbation constraint.
The proposed attack framework is agnostic to forecastingmodel architecture and is generalizable to various attack settings, i.e. , white-box attack, grey-boxattack, and black-box attack.
Meanwhile, we theoretically analyze the worst performance guaranteesof adversarial traffic forecasting attacks.
We prove the adversarial robustness of spatiotemporal trafficforecasting models is related to the number of victim nodes, the maximum perturbation bound, andthe maximum degree of the traffic network.
Extensive experimental studies on two real-world traffic datasets demonstrate the attack effectivenessof the proposed framework on state-of-the-art spatiotemporal forecasting models.
We show thatattacking 10% nodes in the traffic system can break down the global forecasting Mean Average
Error (MAE) from 1 . 975 to 6 . 1329 .
Moreover, the adversarial attack can induce 68 .
65% , and 56 .
67%performance degradation under the extended white-box and black-box attack settings, respectively.
Finally, we also show that incorporating adversarial examples we generated with adversarial trainingcan significantly improve the robustness of spatiotemporal traffic forecasting models.
Background and problem statement
In this section, we first introduce some basics of spatiotemporal traffic forecasting and adversarialattack, then formally define the problem we aim to address.
2. Spatiotemporal traffic forecasting
Let G t
=
( V , E ) denote a traffic network at time step t , where V is a set of n nodes ( e.g. , regions,road segments, roadway sensors, etc. )
and E is a set of edges.
The construction of G t can becategorized into two types, (1) prior-based, which pre-define G t based on metrics such as geographicalproximity and similarity [9], and (2) learning-based, which automatically learns G t in an end-toend way [2].
Note the G t can be static or time-evolving depending on the forecasting model.
Wedenote X t = ( x 1 ,t , x 2 ,t , · · · , x n,t ) as the spatiotemporal features associated to G t , where x i,t ∈ R c represents the c -dimensional time-varying traffic conditions ( e.g. , traffic volume, traffic speed) andcontextual features ( e.g. , weather, surrounding POIs) of node v i ∈ V at t .
The spatiotemporal trafficforecasting problem aims to predict traffic states for all v i ∈ V over the next τ time steps,
[Equation]
where H t − T +1:
t = { ( X t − T +1 , G t − T +1 ) , . . .
, ( X t , G t ) } denotes the traffic states contains inputfeatures and the traffic network in previous T time steps, f θ ( · ) is the spatiotemporal traffic forecastingmodel parameterized by θ , and ˆY t +1:
t + τ = { ˆY t +1 , ˆY t +2 , · · · , ˆY t + τ } is the estimated traffic conditions of interest of V from time step t +1 to t
+ τ .
We denote Y t +1:
t + τ = { Y t +1 , Y t +2 , · · · , Y t + τ }as the ground truth of H t − T +1: t .
Note the above formulation is consistent with the state-of-the-art Graph Neural Network (GNN) basedspatiotemporal traffic forecasting models [2, 9, 10, 11], and is also generalizable to other variantssuch as Convolutional Neural Network (CNN) based approaches [12].
2. Adversarial attack
Given a machine learning model, adversarial attack aims to mislead the model to derive biasedpredictions by generating the optimal adversarial example
[Equation]
(2) where x ′ is the adversarial example with maximum bound ε under L p norm to guarantee the perturbation is imperceptible to human, and y is the ground truth of clean example x .
Various gradient-basedmethods have been proposed to generate adversarial examples, such as FGSM [13], PGD [7], MIM [8],etc.
For instance, the adversarial example x ′ =
x + ε sign ( ∇ x L CE ( x, y ; θ )) in FGSM, where sign ( · )is the Signum function and L CE ( · ) is the cross entropy loss.
In general, the model parameter is fixed and the attacker can only provide crafted examples to foolthe model.
Based on the amount of information the attacker can access, the adversarial attack canbe categorized into three classes.
(1) White-box attack .
The attacker has full access to the system,including parameters and gradients of the target model, the input data, and the label.
(2) Grey-boxattack .
The attacker can partially access the system, including the target model and training inputdata, except the labels.
(3) Black-box attack .
The attacker can only access training input data butcannot access the target model and labels.
2. Adversarial attack against spatiotemporal traffic forecasting
This work aims to apply adversarial attacks to spatiotemporal traffic forecasting models.
We firstdefine the adversarial traffic state as follow,
[Equation]
[Equation]
where S t ∈ { 0 , 1 } n × n is a diagonal matrix with i
th diagonal element indicating whether node i is avictim node, and X ′ t is the perturbed spatiotemporal feature named adversarial spatiotemporal feature.
We restrict the adversarial traffic state by the victim node budget η and the perturbation budget ε .
Note that following the definition of adversarial attack, we leave the topology of G t immutable as weregard the adjacency relationship as a part of the model parameter that may be automatically learnedin an end-to-end way.
Given a spatiotemporal forecasting model f θ ( · ) , the adversarial attack against spatiotemporal trafficforecasting is defined as
[Equation]
where T test and T train denote the set of time steps of all testing and training samples, respectively.
L ( · ) is the loss function measuring the distance between the predicted traffic states and ground truth,and θ ∗ is optimal parameters learned during the training stage.
Since the ground truth ( i.e. , future traffic states) under the spatiotemporal traffic forecasting setting isunavailable at run-time, the practical adversarial spatiotemporal attack primarily falls into the greybox attack setting.
However, investigating white-box attacks is still beneficial to help us understandhow adversarial attack works and can help improve the robustness of spatiotemporal traffic forecastingmodels ( e.g. , apply adversarial training).
We discuss how to extend our proposed adversarial attackframework to white-box and black-box settings in Section 3.2.
Methodology
In this section, we introduce the practical adversarial spatiotemporal attack framework in detail.
Specifically, our framework consists of two steps: (1) identify the time-dependent victim nodes, and(2) attack with the adversarial traffic state.
3. Identify time-dependent victim nodes
One unique characteristic that distinguishes attacking spatiotemporal forecasting from conventionalclassification tasks is the inaccessibility of ground truth at the test phase.
Therefore, we first constructfuture traffic states’ surrogate label to guide the attack direction,
[Equation]
(5) where g ϕ ( · ) is a generalized function ( e.g. , tanh( · ) , sin ( · ) , f θ ( · ) ), δ t +1: t + τ are random variablessampled from a probability distribution π ( δ t +1: t + τ ) to increase the diversity of the attack direction.
In our implementation, we derive ϕ based on the pre-trained forecasting model parameter θ ∗ , andδ t +1: t + τ ∼ U ( − ε/ 10 , ε/ 10) .
In the real-world production [6], the forecasting models are usuallyupdated in an online fashion ( e.g. , per hours).
Therefore, we estimate the missing latest traffic statesbased on previous input data, ˜ H t
= g φ ( H t − 1 ) , where g φ ( · ) is the estimation function parameterizedby φ .
For simplicity, we directly obtain φ from the pre-trained traffic forecasting model f
θ ∗ ( · ) .
With the surrogate traffic state label ˜Y t +1: t + τ , we derive the time-dependent node saliency (TDNS)for each node as
[Equation]
where L adv ( f θ ( ˜ H t − T +1: t ) , ˜Y t +1: t + τ ) is the adversarial loss and σ is the activation function.
Intuitively, M t reveals the node-wise loss impact with the same degree of perturbations.
Note dependingon the time step t , M t may vary.
A similar idea also has been adopted to identify static pixel saliencyfor image classification [14].
More in detail, the adversarial loss L adv ( f θ ( ˜ H t − T
+1: t ) , ˜Y t +1: t + τ ) in Equation 6 is updated by theiterative gradient-based adversarial method [7],
[Equation]
(7) where H ′
( i ) t − T +1: t is adversarial traffic states at i -th iteration, α is the step size, and clip X ′ t − T +1 ,ε ( · )is the project operation which clips the spatiotemporal feature with maximum perturbation bound ε .
Note H ′ (0)
t − T +1: t
[Equation]
For each batch of data (cid:110) ( ˜ H t − T +1: t , ˜Y t +1: t + τ ) ( j ) (cid:111) γ j =1 , the time-dependent node saliency gradientis derived by
[Equation]
where γ is the batch size.
We use the RELU activation function to compute the non-negative saliencyscore for each time step,
[Equation]
Finally, we obtain the set of victim node S t based on M t , [Equation] [Equation] where s ( i,i ) ,t denotes the i -th diagonal element of S t , and Top ( · ) is a 0-1 indicator function returningif v i is the top- k salient node at time step t .
3. Attack with adversarial traffic state
Based on the time-dependent victim set, we conduct adversarial attacks to spatiotemporal trafficforecasting models.
Specifically, we first generate perturbed adversarial traffic features based ongradient descent methods.
Take the widely used Projected Gradient Descent (PGD) [7] for illustration,we construct Spatiotemporal Projected Gradient Descent (STPGD) as below,
[Equation]
where H ′ ( i − 1) t − T +1: t is the adversarial traffic state at i − 1 -th iteration in the iterative gradient descent,α is the step size, and clip X ′ t − T
+1: t ,ε ( · ) is the operation to bound adversarial features in a ε ball.
Note X ′ (0) t = ˜X t .
Instead of perturbing all nodes as in vanilla PGD, we only inject perturbationson selected victim nodes in S t .
Similarly, we can generate perturbed adversarial traffic features byextending other gradient based methods, such as MIM [8].
In the testing phase, we can inject the adversarial traffic states
H ′ t − T +1: t = H t − T +1: t + △ H ′ t − T
+1: t 158 to apply adversarial attack, where △ H ′ t
+ H t
= { ( X ′ t − X t ) · S t + X t , G t } ∈ H ′
t − T +1: t and△ H ′ t =
(cid:110)
(( X ′ t − can be easily extended to the white-box settings, detailed
White-box attack .
Since the adversaries can fully access the data and labels under the white-boxsetting, we directly use the real ground truth traffic states to guide the generation of adversarial trafficstates.
The detailed algorithm is introduced in Appendix A.1.
Black-box attack .
The most restrictive black-box setting assumes limited accessibility to the targetmodel and labels.
Therefore, we first employ a surrogate model, which can be learned from thetraining data or by querying the traffic forecasting service [15, 16].
Then we generate adversarialtraffic states based on the surrogate model to attack the targeted traffic forecasting model.
Please referto Appendix A.2 for more details.
We conclude this section with the theoretical upper bound analysis of the proposed adversarialattack strategy.
In particular, we demonstrate the attack performance against the spatiotemporaltraffic forecasting model is related to the number of chosen victim nodes, the budget of adversarialperturbations, as well as the traffic network topology.
Theorem 1 Let Z ( L ) =
f θ ( H t − T +1: t ) and Z ′ ( L ) =
f θ ( H ′ t − T +1: t ) be the L -th layer embeddingsof the forecasting model, the upper bound of the adversarial loss satisfies
[Equation]
where λ denotes maximum weight bound in all layers of the forecasting model, β denotes parameterof the activation function in f θ ( · ) , C denotes the maximum degree of G .
η and ε are the budget ofnumber of victim nodes and perturbations, respectively.
Proof .
Please refer to Appendix B.
Experiments
4. Experimental setup
Datasets .
We use two popular real-world datasets to demonstrate the effectiveness of the proposedadversarial attack framework.
(1) PEMS-BAY [17] traffic dataset is derived from the California
Transportation Agencies (CalTrans) Performance Measurement System (PeMS) ranging from January1, 2017 to May 31, 2017.
325 traffic sensors in the Bay Area collect traffic data every 5 minutes.
Input: Previous traffic data, pre-trained spatiotemporal model f θ ∗ ( · ) , pre-trained traffic state prediction model g φ ( · ) , maximum perturbation budget ε , victim node budget η , and iterations K .
Result:
Perturbed Adversarial traffic states H
′ t − T +1: t . /
* Step 1:
Identify time-dependent victim nodes */ 1 Estimate current traffic state ˜
H t − N +1: t by function g φ ( · ) ; 2 Construct future traffic state’s surrogate labels ˜Y t +1:
t + τ by Equation 5 ; 3 Compute the time-dependent node saliency M t with ˜ H t − T +1:
t and ˜Y t +1:
t + τ by Equation 6-9; 4 Obtain the victim node set S t by Equations 10 ; / * Step
2: Attack with adversarial traffic state
*/ 5 Initialize adversarial traffic state H ′ (0) t − T +1: t = ˜
H t − T +1: t ; 6 for i = 1 to K do
Generate perturbed adversarial features X ′ ( i ) t − T +1: t by Equation 11; △ H ′ ( i ) t − T +1:
t = (( X ′ ( i ) t − T +1: t − ˜X t − T
+1: t ) · S t , 0) ; 9 end 10 Return H ′
t − T +1:
t =
H t − T +1: t + △ H ′ t − T
+1: t .
METR-LA [18] is a traffic speed dataset collected from 207 Los Angeles County roadway sensors.
The traffic speed is recorded every 5 minutes and ranges from March 1, 2012 to June 30, 2012.
Forevaluation, all datasets are chronologically ordered, we take the first 70% for training, the following10% for validation, and the rest 20% for testing.
The statistics of the two datasets are reported in
Appendix C.
Baselines .
In the current literature, few studies can be directly applied to the real-valued trafficforecasting attack setting.
To guarantee the fairness of comparison, we construct two-step baselinesas below.
For victim node identification, we adopt random selection and use the topology-basedmethods ( i.e. , node degree and betweenness centrality [19]) to select victim nodes.
We also employ
PageRank (PR) [20] as the baseline to decide the set of victim nodes.
For adversarial traffic stategeneration, we adopt two widely used iterative gradient-based methods, PGD [7] and MIM [8],to generate adversarial perturbations.
In summary, we construct eight two-step baselines, PGDRandom, PGD-PR, PGD-Centrality, PGD-Degree, MIM-Random, MIM-PR, MIM-Centrality, and
MIM-Degree.
For instance, PGD-PR indicates first identifying victim nodes with PageRank andthen applying adversarial noises with PGD.
Depending on the adversarial perturbation method, wecompare two variants of our proposed framework, namely STPGD-TDNS and STMIM-TDNS.
Target model .
To evaluate the generalization ability of the proposed adversarial attack framework,we adopt the state-of-the-art spatiotemporal traffic forecasting model, GraphWaveNet (Gwnet) [2], asthe target model.
Evaluation results on more target models are reported in Appendix F.
Evaluation metrics .
Our evaluation focus on both the global and local effect of adversarial attackson spatiotemporal models,
[Equation]
where L ( · ) is a user-defined loss function.
Different from the majority target of adversarial attacks thatare classification models ( e.g. , adversarial accuracy), traffic forecasting is defined as a regression task.
Therefore, we adopt Mean Average Error (MAE) [21] and Root Mean Square Error (RMSE) [22]for evaluation.
More specifically, we define Global MAE (G-MAE), Local MAE (L-MAE),
Global
RMSE (G-RMSE), Local RMSE (L-RMSE) to evaluate the effect of adversarial attacks on trafficforecasting.
Please refer to Appendix D for detailed definitions of four metrics.
Implementation details .
All experiments are implemented with PyTorch and performed on a Linuxserver with 4 RTX 3090 GPUs.
The traffic speed is normalized to [0 , 1] .
The input length T and outputlength τ are set to 12 .
We select 10% nodes from the whole nodes as the victim nodes, and ε is set to0 .
The batch size γ is set to 64 .
The iteration K is set to 5 , and the step size α is set to 0 . [Table] [Table]
4. Overall attack performance
Table 1 reports the overall attack performance of our proposed approach against the original forecasting model and eight baselines with respect to four metrics.
Note larger value indicates better attackperformance and worse forecasting accuracy.
Specifically, we can make the following observations.
First, the adversarial attack can significantly degrade the traffic forecasting performance.
For example,our approach achieves (67 .
79% , 62 . 31%) and (19 . 88% , 14 .
55%) global performance degradationcompared with the original forecasting results on PeMS-BAY and METR-LA dataset, respectively.
Second, our approach achieves the best attack performance against all baselines.
In particular,
STPGD-TDNS achieves (15 .
80% , 15 . 39%) global performance improvement and (23 .
19%)local performance improvement on the PeMS-BAY dataset.
Similarly, STMIM-TDNS achieves(2 .
%) global performance improvement and (11 .
70%) local performance improvement on the METR-LA dataset.
Moreover, we observe STPGD-TDNS and STMIM-TDNS, twovariants of our framework, respectively achieve the best attack performance on PeMS-BAY and
METR-LA datasets, which further validate the superiority of our framework for flexibly integratedifferent adversarial perturbation methods.
Overall, our adversarial attack framework successfullydisrupts the traffic forecasting model to make biased predictions.
4. Ablation study
Then we conduct ablation study on our adversarial attack framework.
Due to page limit, we report theresult of STPGD-TDNS on the PeMS-BAY dataset.
We consider two variants of our approach: (1) w/o
TDNS that randomly choose victim nodes to attack, and (2) w/o STPGD that apply vanilla PGD noiseto selected victim nodes.
As reported in Table 2, we observe (3 . 91% , 6 .
and(33 .
19% , 32 . 97%) attack performance degradation on four metrics by removing ourproposed TDNS and STPGD module, respectively.
The above results demonstrate the effectivenessof the two-step framework.
Moreover, we observe that the STPGD module plays a more importantrole in the adversarial spatiotemporal attack.
4. Parameter sensitivity
We further study the parameter sensitivity of the proposed framework, including the number of victimnodes η , the perturbation budget ε , and the batch size γ .
Due to page limit, we report the result of
G-RMSE on the PeMS-BAY dataset.
We observe similar results by using other metrics and on the
METR-LA dataset.
Each time we vary a parameter, we set other parameters to their default values. [Figure] [Table]
Effect of η .
First, we vary the number of victim nodes from 0% to 40% .
As reported in Figure 2 (a),
Our approach achieves the best attack performance with a limited victim node budget, and theadvantage decrease when the attack can be applied to more nodes.
Effect of ε .
Second, we vary the perturbation budget from 0% to 90% .
As shown in Figure 2 (b),the G-RMSE first increase and then slightly decrease.
This is perhaps because the clip function in
Equation 11 weakens the diversity of attack noises.
Effect of γ .
Finally, we vary the batch size from 8 to 128 , as illustrated in Figure 2 (c).
We observethe adversarial attack is relatively stable to the batch size.
However, too large batch size reduces theattack performance, which may induce over smooth of Equation 8.
4. Extended analysis under different attack settings
Table 3 reports the overall attack performance of our proposed approach against the original forecasting model and four PGD-based baselines under the white-box and black-box attack settings.
For the white-box attack, since the attacker can fully access the data and model, we re-train theforecasting model without requiring estimating the latest traffic states.
For the black-box attack,we adopt STAWNET [11] as the surrogate model.
The experimental results are summarized in
Table 3.
First, we observe adversarial attacks significantly degrade the performance of the traffic forecasting model under both white-box and black-box settings.
For examples, our approachachieves ((68 .
12%) and (56 .
67% , 50 . 78%) global performance degradation compared withthe vanilla forecasting model under white-box and black-box attack.
Moreover, our approach consistently achieves the best attack performance against baselines.
To be more specific, our approachyield (4 . 61% , 9 . 13%) and (1 . 70% , 3 .
28%) global performance improvement under the white-boxsetting and black-box setting, respectively.
In addition, we observe higher attack effectiveness underthe white-box setting and lower attack effectiveness under the black-box setting compared to thegrey-box setting.
This makes sense as the white-box setting can fully access the data and label,while the black-box has more restrictive data accessibility and relies on the surrogate model to applyadversarial spatiotemporal attack.
4. Defense adversarial spatiotemporal attacks
Finally, we study the defense of adversarial spatiotemporal attacks.
One primary goal of our studyis to help improve the robustness of spatiotemporal forecasting models.
Therefore, we propose to [Table] incorporate the adversarial training scheme for traffic forecasting models with our adversarial trafficstates, denoted by AT-TNDS .
We compare it with (1) conventional adversarial training ( AT ) [7] and(2) Mixup [23] with our adversarial traffic states.
Note that we also tried other strategies, such asadding L 2 regularization, etc. , which fail to defend the adversarial spatiotemporal attack.
The otherstate-of-the-art adversarial training methods, such as TRADE [24], cannot be directly applied inregression tasks.
Please refer to Appendix E for more training details.
The results in G-MAE on the PeMS-BAY are reported in Table 4.
Overall, we observe AT or Mixup cansuccessfully resist the adversarial spatiotemporal attack, and AT-TDNS that combines the adversarialtraining scheme with our adversarial traffic states achieves the best defensive performance.
Theabove results indicate the defensibility of adversarial spatiotemporal attacks, which should be furtherinvestigated to deliver a more reliable spatiotemporal forecasting service in the future.
Related work
Spatiotemporal traffic forecasting .
In recent years, the deep learning based traffic forecastingmodel has been extensively studied due to its superiority in jointly modeling temporal and spatialdependencies [9, 10, 4, 25, 2, 11].
To name a few, STGCN [9] applied graph convolution and gatedcausal convolution to capture the spatiotemporal information in the traffic domain, ASTGCN [10]proposed a spatial-temporal attention network for capturing dynamic spatiotemporal correlations.
Asanother example, GraphWaveNet [2] adaptively captures latent spatial dependency without requiringprior knowledge of the graph structure.
The key objective of the above mentioned models is moreaccurate traffic forecasting.
The vulnerability of spatiotemporal traffic forecasting models remains anunder explored problem.
Adversarial attack .
Deep neural networks have been proven vulnerable to adversarial examples [7,13 ].
As an emerging direction, various adversarial attack strategies on graph-structured data havebeen proposed, including both target-attack and non-target attack [26, 27].
However, existing effortson adversarial attacks mainly focus on classification tasks with static label [8, 23].
Only a fewworks study the vulnerability of GCN based spatiotemporal forecasting models under query-basedattack [28] and generate adversarial examples based on evolutionary algorithms [29].
In this paper,we study the gradient based adversarial attack method against spatiotemporal traffic forecastingmodels, which is model-agnostic and generalizable to various attack settings, i.e. , white-box attack,grey-box attack, and black-box attack.
Conclusion
This paper showed the vulnerability of spatiotemporal traffic forecasting models under adversarialattacks.
We proposed a practical adversarial spatiotemporal attack framework, which is agnostic toforecasting model architectures and is generalizable to various attack settings.
To be specific, we firstconstructed an iterative gradient guided node saliency method to identify a small time-dependent setof victim nodes.
Then, we proposed a spatiotemporal gradient descent based scheme to generate realvalued adversarial traffic states by flexibly leveraging various adversarial perturbation methods.
Thetheoretical analysis demonstrated the upper bound of the proposed two-step framework under humanimperceptible victim node selection budget and perturbation budget constraints.
Finally, extensiveexperimental results on real-world datasets verify the effectiveness of the proposed framework.
Thereported results will inspire further studies on the vulnerability of spatiotemporal forecasting models,as well as practical defending strategies for resisting adversarial attacks that can be deployed inreal-world ITS systems. Checklist For all authors... (a) Do the main claims
made in the abstract and introduction accurately reflect the paper’scontributions and scope
[Yes
(b) Did you describe the
limitations of your work
[Yes]
(c) Did you discuss
any potential negative societal impacts of
your work?
[N/A]
(d) Have you read
the ethics review guidelines and ensured that your paper conforms tothem?
[Yes]
If you are including theoretical
results
(a) Did you state the full set of assumptions of all theoretical results?
[Yes]
(b) Did you include complete proofs of all theoretical results?
[Yes]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes]
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how theywere chosen)?
[Yes]
(c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[Yes]
(d) Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?
[Yes]
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes]
(b) Did you mention the license of the assets?
[Yes]
(c) Did you include any new assets either in the supplemental material or as a URL?
[Yes]
(d) Did you discuss whether and how consent was obtained from people whose data you’reusing/curating?
[Yes]
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[Yes]
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, ifapplicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amountspent on participant compensation?
[N/A]