Revisiting the Adversarial Robustness of Graph-Based Traffic Forecasting

2026-07-29

AI Summary

This work addresses the vulnerability of existing graph neural network–based traffic forecasting models to localized, physically plausible adversarial attacks—a threat poorly captured by conventional norm-based constraints. Recognizing that real-world adversaries can only manipulate a limited number of sensors, the study introduces, for the first time, a localized physics-aware adversarial attack setting. To counter this threat, the authors propose a novel detect-and-mitigate paradigm: a learnable physics-informed detector is designed to identify anomalies, and its output is integrated as an additional feature into a fixed-structure prediction model. The entire system is jointly trained for end-to-end robustness. Evaluated across 15 model–dataset combinations, this approach outperforms specialized adversarial training in 13 cases, demonstrates superior generalization against unseen attacks, and incurs negligible performance degradation on clean data.

Abstract

Traffic forecasting by graph-based AI is a critical component of intelligent transportation systems, motivating security research on robustness to malicious sensor readings. We argue that prior robustness evaluations are largely shaped by unrealistic threat models and untargeted objectives, so both attacks and defenses must be revisited. We study a practical adversary with limited model knowledge and the ability to monitor and manipulate only a few road sensors. More importantly, practical attacks can be localized to specific links or routes, causing incorrect estimated arrival times or unnecessary rerouting while leaving the broader network largely unaffected. This targeted setting remains underexplored, and defenses such as adversarial training do not transfer well from the norm-bounded attacks they train on to structurally different, physics-aware attacks that mimic genuine congestion. We therefore reframe robustness as a detection problem, introducing a learned physics-informed detector whose output is fed to a hardened forecaster as an input feature and trained against adaptive attacks with the forecaster fixed. We evaluate across a variety of model architectures and benchmarks. The physics-aware attack multiplies target-link error several-fold while the network-wide error barely moves, and adversarial training, tuned to norm-bounded perturbations, barely dents it. Our detection--mitigation defense improves even on adversarial training hardened against the physics-aware attack itself, on $13$ of $15$ model--dataset settings and by the widest margin on a held-out attack, at near-zero clean cost. The results emphasize the need to examine abstracted AI adversarial attacks under application-specific constraints to assess their true security impacts.

Problem

• adversarial robustness
• graph-based traffic forecasting
• targeted attacks
• physics-aware attacks
• intelligent transportation systems

Innovation

• physics-aware attack
• adversarial robustness
• graph-based traffic forecasting
• anomaly detection
• targeted adversarial attack