论文标题
对时空交通预测模型的实际对抗性攻击
Practical Adversarial Attacks on Spatiotemporal Traffic Forecasting Models
论文作者
论文摘要
基于机器学习的流量预测模型利用复杂的时空自动相关性提供了对全市交通状态的准确预测。但是，现有方法假设一个可靠且公正的预测环境，野外并不总是可用的。在这项工作中，我们研究了时空交通预测模型的脆弱性，并提出了实用的对抗性时空攻击框架。具体而言，提出了一种迭代梯度指导的节点显着性方法，而不是同时攻击所有地理分布的数据源，以识别受害者节点的时间依赖性集。此外，我们设计了一个基于时尚的时尚方案，以在扰动约束下生成实用值的对抗性交通状态。同时，从理论上讲，我们证明了对抗性流量预测攻击的最差性能。在两个现实世界中的数据集上进行了广泛的实验表明，所提出的两步框架可在各种高级时空预测模型上实现高达$ 67.8 \％$的性能退化。值得注意的是，我们还表明，对我们提出的攻击进行的对抗训练可以显着提高时空交通预测模型的鲁棒性。我们的代码可在\ url {https://github.com/luckyfan-cs/astfa}中获得。
Machine learning based traffic forecasting models leverage sophisticated spatiotemporal auto-correlations to provide accurate predictions of city-wide traffic states. However, existing methods assume a reliable and unbiased forecasting environment, which is not always available in the wild. In this work, we investigate the vulnerability of spatiotemporal traffic forecasting models and propose a practical adversarial spatiotemporal attack framework. Specifically, instead of simultaneously attacking all geo-distributed data sources, an iterative gradient-guided node saliency method is proposed to identify the time-dependent set of victim nodes. Furthermore, we devise a spatiotemporal gradient descent based scheme to generate real-valued adversarial traffic states under a perturbation constraint. Meanwhile, we theoretically demonstrate the worst performance bound of adversarial traffic forecasting attacks. Extensive experiments on two real-world datasets show that the proposed two-step framework achieves up to $67.8\%$ performance degradation on various advanced spatiotemporal forecasting models. Remarkably, we also show that adversarial training with our proposed attacks can significantly improve the robustness of spatiotemporal traffic forecasting models. Our code is available in \url{https://github.com/luckyfan-cs/ASTFA}.
