Search papers, labs, and topics across Lattice.
This paper critically reassesses the adversarial robustness of graph-based traffic forecasting systems by introducing a practical adversarial model that manipulates a limited number of road sensors. The authors demonstrate that traditional robustness evaluations fail to account for localized attacks, which can significantly distort traffic predictions while leaving the overall network intact. By reframing robustness as a detection problem and employing a physics-informed detector, they achieve substantial improvements in forecasting accuracy against adaptive attacks, outperforming conventional adversarial training methods in most tested scenarios.
Localized attacks on traffic forecasting can multiply prediction errors several-fold, revealing the inadequacy of traditional robustness evaluations.
Traffic forecasting by graph-based AI is a critical component of intelligent transportation systems, motivating security research on robustness to malicious sensor readings. We argue that prior robustness evaluations are largely shaped by unrealistic threat models and untargeted objectives, so both attacks and defenses must be revisited. We study a practical adversary with limited model knowledge and the ability to monitor and manipulate only a few road sensors. More importantly, practical attacks can be localized to specific links or routes, causing incorrect estimated arrival times or unnecessary rerouting while leaving the broader network largely unaffected. This targeted setting remains underexplored, and defenses such as adversarial training do not transfer well from the norm-bounded attacks they train on to structurally different, physics-aware attacks that mimic genuine congestion. We therefore reframe robustness as a detection problem, introducing a learned physics-informed detector whose output is fed to a hardened forecaster as an input feature and trained against adaptive attacks with the forecaster fixed. We evaluate across a variety of model architectures and benchmarks. The physics-aware attack multiplies target-link error several-fold while the network-wide error barely moves, and adversarial training, tuned to norm-bounded perturbations, barely dents it. Our detection--mitigation defense improves even on adversarial training hardened against the physics-aware attack itself, on $13$ of $15$ model--dataset settings and by the widest margin on a held-out attack, at near-zero clean cost. The results emphasize the need to examine abstracted AI adversarial attacks under application-specific constraints to assess their true security impacts.
