Improving the Efficiency of Adversarial Attacks on the TGC-LSTM Traffic Prediction Model

Abstract

This paper examines the robustness of the TGC-LSTM urban traffic forecasting model to black-box adversarial evasion attacks and proposes an accelerated version of this attack based on a trainable convolutional network. The TGC-LSTM architecture is considered as the target model. This paper describes an implementation of the single-point 1VITA attack, in which a perturbation is found without access to the target model's gradients using differential evolution (DE), which is consistent with the idea of a sparse attack on time series predictive models. Next, a training set is constructed from the identified 1VITA examples, and an auxiliary convolutional network is trained on it, predicting the input window sensitivity map and the perturbation magnitude map. This paper proposes a fully two-dimensional architecture consisting of three Conv2d + ReLU layers and two independent 1×1 output heads, corresponding to a time × sensors matrix input. On 50 identical test examples, the pure model achieved MAE = 2.8699, RMSE = 4.2018, and MAPE = 7.0519. The single-point 1VITA attack degraded the prediction only slightly to RMSE = 4.2284 and MAPE = 7.1013, but required an average of 314 queries and 2.6985 seconds per example. The proposed accelerated LBA_S mode yielded significantly more severe performance degradation: MAE = 15.6818, RMSE = 17.0757, and MAPE = 31.1117, with an average cost of 15 queries and 0.1009 seconds per example. For the TGC-LSTM model, the vulnerability is weak at the level of a single change in a single value in the input window, but becomes significant if the attack uses a richer perturbation structure and relies on a learned map of sensitive coordinates. In practice, this means that the robustness analysis of graph traffic forecasting models cannot be limited to the simplest single-point attacks. Theoretically, this shows that even an interpretable and physically motivated spatiotemporal architecture retains a significant attack surface if the adversary is able to accumulate and reuse information about typical adversarial examples.