Pith. sign in

REVIEW 4 major objections 4 minor 33 references

Adversarially trained traffic forecasters are defeated by a congestion-shaped localized attack, and a physics-informed detection feature fed to the frozen forecaster outperforms adversarial training on 13 of 15 model-dataset settings.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 04:47 UTC pith:5WMLUE5J

load-bearing objection Worth engaging: strong threat-model contribution, but the detection-generalization claim rests on an unproven separation that needs a harder adaptive attacker. the 4 major comments →

arxiv 2607.27604 v1 pith:5WMLUE5J submitted 2026-07-30 cs.CR cs.AI

Revisiting the Adversarial Robustness of Graph-Based Traffic Forecasting

Qingzhao Zhang This is my paper
classification cs.CR cs.AI
keywords traffic forecastingadversarial robustnessgraph neural networksphysics-aware attacksadversarial trainingdetection-as-featurespatiotemporal forecastingadaptive attacks
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that prior robustness evaluations of graph-based traffic forecasting rest on an unrealistic threat model: norm-bounded perturbations, attacker-controlled node fractions, and network-wide error metrics. Under a practical adversary that controls a few sensors, observes a subset, and targets a local corridor with a congestion-shaped injection, adversarially trained forecasters degrade sharply at the targeted links while global error barely moves. The paper further finds that adversarial training is attack-specific: hardening against a norm-bounded attack can be worse than no defense against a physics-aware attack, and even hardening against the physics-aware attack itself is limited. The proposed defense, VetTraffic, uses a physics-informed detector to score each sensor's inconsistency with directed neighbor estimates and temporal smoothness, and feeds that suspicion signal as extra input features to a frozen adversarially trained forecaster. Evaluated against adaptive white-box attacks, VetTraffic improves on the strongest adversarial-training baseline on 13 of 15 model-dataset settings at no clean-accuracy cost, with the largest margins on a held-out wider attack.

Core claim

The paper's central discovery is that robustness for traffic forecasting is earned per threat, not inherited across attack shapes. Its physics-aware attack formulates a localized objective to drive the forecast toward a fabricated congested state, regularized by spatial-coherence and temporal-smoothness terms, so the injection looks like genuine congestion rather than bounded noise; this attack multiplies target-corridor error while the network-wide error barely moves. Against this attack, norm-bounded adversarial training is nearly useless and sometimes harmful. The paper then introduces VetTraffic, a detection-as-feature defense: a physics-informed detector flags nodes whose readings devia

What carries the argument

The load-bearing objects are the physics-aware attack objective (Eq. 3) and the VetTraffic detector-adapter pair. The attack minimizes the forecast's distance to a fabricated jam while penalizing ℓ1 sparsity, spatial inconsistency Rsp (deviation from the neighbor average), and temporal jerk Rtm (second differences), producing a coherent slowdown instead of a norm-bounded perturbation. The detector computes directed residuals rout = X − P_out X and rin = X − P_in X plus a jerk term, and emits a suspicion logit through directed message passing; a zero-initialized adapter fuses [X, suspicion, neighbor estimate, residuals] into the forecaster's input, so training starts identical to the AT basel

Load-bearing premise

The defense's advantage rests on the claim that any injection strong enough to shift a targeted forecast must register as a physics violation in the detector's residuals, so a physics-informed detector will always be able to flag an effective attack; the paper itself bounds the defense by how distinguishable a spoof is from genuine dynamics.

What would settle it

Construct an adaptive perturbation that (a) increases the target-corridor forecast error by a large margin while (b) keeping the injected readings close to the directed-neighbor estimate and temporally smooth, e.g., by treating the physics residuals as constraints or minimizing the detector's suspicion in the PGD loop, and show that detection AUC on the attack drops below chance; or, alternatively, collect real congestion/incident windows and show they trigger the detector at rates comparable to attacks.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Robustness evaluation for traffic forecasting should report localized target error alongside network-wide metrics, because attacks can hide in aggregate error.
  • Adversarial training is attack-specific: a defense hardened on one attack type can be worse than no defense on another, so evaluations should include structurally different held-out attacks.
  • Detection-as-feature is a viable complement to adversarial training: feeding a physics-suspicion signal to a frozen forecaster improves attack robustness without clean-accuracy cost.
  • A detection signal that learns physics-violation invariants generalizes to wider attack footprints, while hardening degrades as the attack drifts from training.
  • Threat models for sensor-based AI should use capability-based bounds (sensor range, spatial/temporal coherence) rather than inherited ℓ∞ norms.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same detection-as-feature recipe could apply to other graph-based spatiotemporal forecasting domains—energy, water, or network telemetry—where physics residuals can define a spoof signature.
  • An obvious next attack to try is a jointly optimized injection that suppresses detector residuals while moving the forecast; the paper's own bound is how discriminable a spoof is from genuine dynamics.
  • A testable extension is to stress VetTraffic on real incidents or infrastructure failures that produce congestion-like signatures, to measure false-flag rates beyond the clean low-speed quartile reported.
  • If the result holds, it suggests compute spent on per-attack adversarial training may be better invested in learning invariant physical consistency checks, since those transfer across attack shapes.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper argues that prior robustness evaluations of graph-based traffic forecasting rely on unrealistic threat models (large perturbed sets, global objectives, norm-ball constraints) and untargeted metrics. It proposes a five-axis threat model with limited knowledge, partial perturbation/observation, localized targets, and a capability-based realism bound, instantiated as a physics-aware attack (Eq. 3) that shapes sparse, coherent, congestion-like injections. It further proposes VetTraffic, a physics-informed detector whose suspicion signal is fed as an input feature to a frozen adversarially trained forecaster. The defense is evaluated against adaptive white-box attacks across five architectures and three benchmarks, claiming improvement over AT-physics on 13 of 15 model–dataset cells, with the largest margins on a held-out attack and no clean-accuracy cost.

Significance. If established, the paper would make a useful contribution: it identifies an important mismatch between existing global-metric, norm-bounded evaluations and localized operational threats, and it proposes a concrete detection-as-feature mitigation that is evaluated across a broad set of architectures and datasets. The black-box transfer matrix, component ablation, and adaptive white-box evaluation are significant strengths, and the paper is careful to frame limitations. However, the central empirical claim rests on a load-bearing separation between what the physics-aware attack can hide and what the physics-informed detector can flag; that separation is not yet convincingly demonstrated.

major comments (4)
  1. [§4.1, Eq. (3); §4.2(1); §5.2] The premise that 'an injection strong enough to move the forecast cannot stay unflagged' is load-bearing for Table 4, but the evidence is one adaptive run on GWNet/PEMS-BAY (11.9→13.6 vs AT-physics 14.2). Eq. (3) already minimizes Rsp and Rtm, the same neighborhood-consistency and temporal-smoothness operators used by the detector's rout, rin, and jerk terms. A stronger adversary can raise λ2/λ3, enlarge the halo, or optimize through the full pipeline with more restarts; no sensitivity sweep over these terms is reported, and no formal argument separates 'all effective injections violate physics' from 'this optimizer's injections did.' Limitations (i) concedes the gain is bounded by discriminability. The 13/15 result is therefore not yet established as a property of the defense rather than of the particular attack implementation.
  2. [§5.2, Tables 4–5; §4.2(3)] The abstract and §5.2 claim 'no clean-accuracy cost,' but no table reports clean (unattacked) MAE for Undef, RDAT, AT-physics, and VetTraffic. The zero-init adapter and keep-best selection are plausible mechanisms, but they do not by themselves show that the kept checkpoint never regressed on any of the 15 cells, and several Table 4 margins are small (e.g., STGCN/LA 26.4 vs 26.4). Report clean target-corridor and network-wide errors alongside attacked errors so the clean-cost claim is directly verifiable.
  3. [§5.2, Table 4; §5.2 'Main Results'] The central 13/15 claim and the 'widest margin on held-out' claim rest on single runs except for three seeded cells. Given small margins in several cells and the acknowledged single regression (STTN/LA, −0.9), multi-seed means with standard deviations or confidence intervals are needed; the statement 'std ≤ 0.4' covers only three cells, leaving the other twelve unquantified. Without this, the 13/15 count could be within run-to-run noise.
  4. [Abstract; §5.1; §5.3] The statement that 'the network-wide error barely moves' is asserted as a central motivation but never tabulated. Because the paper's critique of prior work is that global metrics hide localized attacks, the paper should report global MAE under the localized attack (and, ideally, for each defense) to substantiate the concealment claim and to show that VetTraffic does not purchase corridor robustness by degrading the network-wide metric. As written, this is an assertion rather than a reported result.
minor comments (4)
  1. [Page 1, author affiliation] Typo: 'The University of Arizoan' should read 'Arizona.'
  2. [§5.2, 'Adaptive attacker'] The step sweep '5.1 to 23.8 over 10–80' is reported only in text; a small figure or table would make the monotonicity claim easier to verify.
  3. [Table 3] The caption says best per row is bold, but in some rows tied values are both bold. Clarify the tie-breaking convention.
  4. [§4.1, Eq. (2)] The constraint notation 'Z_So = X_So' should explicitly define the indexing over observed nodes; minor but helpful for reproducibility.

Circularity Check

1 steps flagged

No definitional circularity, but the core evidence is partly self-referential: the detector and the attack share the same physics-residual operators, so the defense's success is partially an artifact of the attack's own objective rather than an independent validation.

specific steps
  1. self definitional [Section 4.1 Eq (3) vs Section 4.2 component (1)]
    "These residuals spike exactly where a node disagrees with traffic dynamics, the fingerprint of a spoofed sensor, and are the same structure the physics-aware attacker (Section 4.1) works to suppress: the attacker is physics-aware to hide, the detector physics-informed to reveal."

    The attack objective (Eq. 3) explicitly minimizes Rsp and Rtm, which are the same neighbor-consistency and temporal-smoothness residuals the detector uses as its input features. The detector is therefore not independently measuring a physical invariant; it is measuring the very quantities the attack was optimized to make small. The paper's claim that 'an injection strong enough to move the forecast cannot stay unflagged' is asserted as an empirical observation, but the only adaptive attack tested is one that minimizes the detector's own features. If a stronger adversary jointly optimizes the forecast shift and the residual suppression, the detector's signal is tied to the attack's penalty terms, not to an independent property. This is a self-definitional coupling: the defense is evaluated

full rationale

The paper's core contribution is the claim that VetTraffic improves over AT-physics on 13/15 cells and especially on a 'held-out' two-hop attack. The physics-aware attack is explicitly constructed to minimize Rsp and Rtm, and the detector is explicitly constructed from the same neighbor/temporal residuals (rout, rin, jerk). This shared operator structure means the detector is not an independent test of the attack's stealth; it is a re-measurement of the attack's own penalty terms. The adaptive attacker tested is only detector-aware in the sense that it can compute gradients through the detector, but the paper does not show a strong adversary that simultaneously suppresses the physics residuals while preserving the forecast shift. The 'held-out' attack is only a wider halo of the same attack family, not a structurally different attack, so it does not break the coupling. The paper even acknowledges in Limitations (i) that the gain is bounded by 'how discriminable a spoof is from genuine dynamics,' which is itself a restatement of the fact that the defense's value depends on the very separation the attack objective is designed to erode. Because the detection feature and the attack objective are built from the same operators, the 13/15 result is substantially a consequence of the attack's own design, not an independent validation of the defense.

Axiom & Free-Parameter Ledger

6 free parameters · 5 axioms · 0 invented entities

The central claim rests on hand-chosen attack and training parameters (lambda, yjam, K, steps, epsilon, unstated detector hyperparameters) and on domain assumptions about sensor physics, neighbor-predictability, and the unavoidability of detectable residuals. No new physical entities are introduced.

free parameters (6)
  • Physics-aware attack weights lambda = lambda1=0.02, lambda2=1.0, lambda3=0.3
    Hand-selected default in Eq. 3, used for all main attack/defense comparisons. The paper says they are varied as impacting factors but reports no grid or sensitivity table.
  • Fabricated congestion target yjam = not specified
    Drives the attack objective in Eq. 3; the low-speed target value is not given, so the attack magnitude is under-specified.
  • Target corridor size K = 5
    All attacks target a connected 5-node corridor; the defense comparisons depend on this localized setting.
  • Attack optimization steps = 40 PGD steps (30 for norm-bounded ablation)
    Default optimization budget; Fig. 3b shows saturation by 20-40, but the chosen value affects every reported number.
  • Norm-bounded budget epsilon = 0.5
    Used in the norm-bounded ablation and for the RDAT comparison; arbitrary but standard.
  • Detector/adapter hyperparameters = not reported
    Architecture, widths, learning rate, epochs, and batch size for the message-passing detector and zero-init adapter are not given; required for replication.
axioms (5)
  • domain assumption A node's reading is predictable from its graph neighbors.
    Stated in Section 2.1 ('assumes only that a node is predictable from its graph neighbors'); if false, the detector's residual features are not meaningful.
  • domain assumption A compromised inductive-loop sensor can report any physically valid value via electromagnetic injection.
    Threat model A5 (Section 3) cites references [29-33]; the realism of the attack rests on this hardware assumption.
  • domain assumption Any injection strong enough to move the target forecast is necessarily detectable by the physics residuals.
    Stated in Section 5.2 ('an injection strong enough to move the forecast cannot stay unflagged') and bounded by Limitations (i); this is the key discriminability premise for VetTraffic's gain.
  • ad hoc to paper The defender can label perturbed nodes when training the detector.
    Eq. 5 uses BCE over known attack masks; true for self-generated simulated attacks, but a training assumption that may not hold for real deployment.
  • standard math Standard graph and optimization machinery is valid (masked PGD, Laplacian harmonic extension, row-normalized adjacency).
    Used in Eqs. 2-4; standard results, no formal verification in the paper.

pith-pipeline@v1.3.0-daily-deepseek · 11944 in / 15419 out tokens · 172520 ms · 2026-08-01T04:47:51.891444+00:00 · methodology

0 comments
read the original abstract

Traffic forecasting by graph-based AI is a critical component of intelligent transportation systems, motivating security research on robustness to malicious sensor readings. We argue that prior robustness evaluations are largely shaped by unrealistic threat models and untargeted objectives, so both attacks and defenses must be revisited. We study a practical adversary with limited model knowledge and the ability to monitor and manipulate only a few road sensors. More importantly, practical attacks can be localized to specific links or routes, causing incorrect estimated arrival times or unnecessary rerouting while leaving the broader network largely unaffected. This targeted setting remains underexplored, and defenses such as adversarial training do not transfer well from the norm-bounded attacks they train on to structurally different, physics-aware attacks that mimic genuine congestion. We therefore reframe robustness as a detection problem, introducing a learned physics-informed detector whose output is fed to a hardened forecaster as an input feature and trained against adaptive attacks with the forecaster fixed. We evaluate across a variety of model architectures and benchmarks. The physics-aware attack multiplies target-link error several-fold while the network-wide error barely moves, and adversarial training, tuned to norm-bounded perturbations, barely dents it. Our detection--mitigation defense improves even on adversarial training hardened against the physics-aware attack itself, on $13$ of $15$ model--dataset settings and by the widest margin on a held-out attack, at near-zero clean cost. The results emphasize the need to examine abstracted AI adversarial attacks under application-specific constraints to assess their true security impacts.

Figures

Figures reproduced from arXiv: 2607.27604 by Qingzhao Zhang.

Figure 1
Figure 1. Figure 1: Attack overview: observe So, reconstruct the unobserved state, train a transferable surrogate, then perturb the controlled sensors Sa to bias the target route St. 4.1 Attack Design Realizing the threat model of Section 3 takes four steps ( [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: VetTraffic training stages. A physics-informed detector flags each sensor by its inconsistency with directed flow and temporal dynamics (suspicion heatmap s); a zero-init adapter feeds s into the forecaster f as an extra input feature. Stage 1 warm-starts f from AT-physics and freezes it (gray); Stage 2 trains the detector and adapter (blue). (2) Detection-as-feature via a zero-init adapter: Rather than ov… view at source ↗
Figure 3
Figure 3. Figure 3: Impacting factors of the localized attack (METR-LA), per model: target-MAE increase versus (a) budget [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Black-box transfer of the localized attack: target-MAE increase (%, log color) for every surrogate [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Case study on PEMS-BAY (GWNet), real sensor geography (numbers in text). [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

33 extracted references · 2 linked inside Pith

  1. [1]

    Spatio-temporal graph convolutional networks: a deep learning framework for traffic forecasting

    Bing Yu, Haoteng Yin, and Zhanxing Zhu. Spatio-temporal graph convolutional networks: a deep learning framework for traffic forecasting. InProceedings of the 27th International Joint Conference on Artificial Intelligence, pages 3634–3640, 2018

    2018

  2. [2]

    Diffusion convolutional recurrent neural network: Data-driven traffic forecasting

    Yaguang Li, Rose Yu, Cyrus Shahabi, and Yan Liu. Diffusion convolutional recurrent neural network: Data-driven traffic forecasting. InInternational Conference on Learning Representations, 2018

    2018

  3. [3]

    Graph wavenet for deep spatial- temporal graph modeling

    Zonghan Wu, Shirui Pan, Guodong Long, Jing Jiang, and Chengqi Zhang. Graph wavenet for deep spatial- temporal graph modeling. InProceedings of the 28th International Joint Conference on Artificial Intelligence, pages 1907–1913, 2019

    1907

  4. [4]

    Practical adversarial attacks on spatiotemporal traffic forecasting models

    Fan Liu, Hao Liu, and Wenzhao Jiang. Practical adversarial attacks on spatiotemporal traffic forecasting models. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors,Advances in Neural Information Processing Systems, volume 35, pages 19035–19047. Curran Associates, Inc., 2022

    2022

  5. [5]

    Adversarial diffusion attacks on graph-based traffic prediction models.IEEE Internet of Things Journal, 11(1):1481–1495, 2023

    Lyuyi Zhu, Kairui Feng, Ziyuan Pu, and Wei Ma. Adversarial diffusion attacks on graph-based traffic prediction models.IEEE Internet of Things Journal, 11(1):1481–1495, 2023

    2023

  6. [6]

    Robust spatiotemporal traffic forecasting with reinforced dynamic adversarial training

    Fan Liu, Weijia Zhang, and Hao Liu. Robust spatiotemporal traffic forecasting with reinforced dynamic adversarial training. InProceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 1417–1428, 2023

    2023

  7. [7]

    Disentangling adversarial robustness and generalization

    David Stutz, Matthias Hein, and Bernt Schiele. Disentangling adversarial robustness and generalization. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6976–6987, 2019

    2019

  8. [8]

    Adversarial examples are not easily detected: Bypassing ten detection methods

    Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. InProceedings of the 10th ACM Workshop on Artificial Intelligence and Security (AISec), 2017

    2017

  9. [9]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. InInternational Conference on Machine Learning (ICML), 2018

    2018

  10. [10]

    Attention based spatial-temporal graph convolutional networks for traffic flow forecasting

    Shengnan Guo, Youfang Lin, Ning Feng, Chao Song, and Huaiyu Wan. Attention based spatial-temporal graph convolutional networks for traffic flow forecasting. InProceedings of the AAAI conference on artificial intelligence, volume 33, pages 922–929, 2019

    2019

  11. [11]

    Gman: A graph multi-attention network for traffic prediction

    Chuanpan Zheng, Xiaoliang Fan, Cheng Wang, and Jianzhong Qi. Gman: A graph multi-attention network for traffic prediction. InProceedings of the AAAI conference on artificial intelligence, volume 34, pages 1234–1241, 2020

    2020

  12. [12]

    Spatial- temporal transformer networks for traffic flow forecasting.arXiv preprint arXiv:2001.02908, 2020

    Mingxing Xu, Wenrui Dai, Chunmiao Liu, Xing Gao, Weiyao Lin, Guo-Jun Qi, and Hongkai Xiong. Spatial- temporal transformer networks for traffic flow forecasting.arXiv preprint arXiv:2001.02908, 2020. 11 APREPRINT- JULY31, 2026

    Pith/arXiv arXiv 2001

  13. [13]

    Spatio- temporal adaptive embedding makes vanilla transformer sota for traffic forecasting

    Hangchen Liu, Zheng Dong, Renhe Jiang, Jiewen Deng, Jinliang Deng, Quanjun Chen, and Xuan Song. Spatio- temporal adaptive embedding makes vanilla transformer sota for traffic forecasting. InProceedings of the 32nd ACM international conference on information and knowledge management, pages 4125–4129, 2023

    2023

  14. [14]

    Adaptive graph convolutional recurrent network for traffic forecasting

    Lei Bai, Lina Yao, Can Li, Xianzhi Wang, and Can Wang. Adaptive graph convolutional recurrent network for traffic forecasting. volume 33, pages 17804–17815, 2020

    2020

  15. [15]

    Connecting the dots: Multivariate time series forecasting with graph neural networks

    Zonghan Wu, Shirui Pan, Guodong Long, Jing Jiang, Xiaojun Chang, and Chengqi Zhang. Connecting the dots: Multivariate time series forecasting with graph neural networks. InProceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pages 753–763, 2020

    2020

  16. [16]

    Spatiotemporal adaptive gated graph convolution network for urban traffic flow forecasting

    Bin Lu, Xiaoying Gan, Haiming Jin, Luoyi Fu, and Haisong Zhang. Spatiotemporal adaptive gated graph convolution network for urban traffic flow forecasting. InProceedings of the 29th ACM International conference on information & knowledge management, pages 1025–1034, 2020

    2020

  17. [17]

    Pdformer: Propagation delay-aware dynamic long-range transformer for traffic flow prediction

    Jiawei Jiang, Chengkai Han, Wayne Xin Zhao, and Jingyuan Wang. Pdformer: Propagation delay-aware dynamic long-range transformer for traffic flow prediction. InProceedings of the AAAI conference on artificial intelligence, volume 37, pages 4365–4373, 2023

    2023

  18. [18]

    Unist: A prompt-empowered universal model for urban spatio-temporal prediction

    Yuan Yuan, Jingtao Ding, Jie Feng, Depeng Jin, and Yong Li. Unist: A prompt-empowered universal model for urban spatio-temporal prediction. InProceedings of the 30th ACM SIGKDD conference on knowledge discovery and data mining, pages 4095–4106, 2024

    2024

  19. [19]

    Miranda-Moreno, and Lijun Sun

    Fuqiang Liu, Luis F. Miranda-Moreno, and Lijun Sun. Spatially focused attack against spatiotemporal graph neural networks.arXiv preprint arXiv:2109.04608, 2021

    Pith/arXiv arXiv 2021

  20. [20]

    Transferability in data poisoning attacks on spatiotemporal traffic forecasting models.Transportation Research Part C: Emerging Technologies, 2025

    Xin Wang, Feilong Wang, Yuan Hong, and Xuegang (Jeff) Ban. Transferability in data poisoning attacks on spatiotemporal traffic forecasting models.Transportation Research Part C: Emerging Technologies, 2025

    2025

  21. [21]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. InInternational Conference on Learning Representations (ICLR), 2018

    2018

  22. [22]

    Theoretically principled trade-off between robustness and accuracy

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. InInternational Conference on Machine Learning (ICML), 2019

    2019

  23. [23]

    GNNGuard: Defending graph neural networks against adversarial attacks

    Xiang Zhang and Marinka Zitnik. GNNGuard: Defending graph neural networks against adversarial attacks. In Advances in Neural Information Processing Systems (NeurIPS), 2020

    2020

  24. [24]

    Graph structure learning for robust graph neural networks

    Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, and Jiliang Tang. Graph structure learning for robust graph neural networks. InProceedings of the 26th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), 2020

    2020

  25. [25]

    MagNet: A two-pronged defense against adversarial examples

    Dongyu Meng and Hao Chen. MagNet: A two-pronged defense against adversarial examples. InProceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2017

    2017

  26. [26]

    Feature squeezing: Detecting adversarial examples in deep neural networks

    Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. InNetwork and Distributed System Security Symposium (NDSS), 2018

    2018

  27. [27]

    Detecting errors and imputing missing data for single-loop surveillance systems.Transportation Research Record, 1855(1):160–167, 2003

    Chao Chen, Jaimyoung Kwon, John Rice, Alexander Skabardonis, and Pravin Varaiya. Detecting errors and imputing missing data for single-loop surveillance systems.Transportation Research Record, 1855(1):160–167, 2003

    2003

  28. [28]

    Guillem Boquet, Antoni Morell, Javier Serrano, and José López Vicario. A variational autoencoder solution for road traffic forecasting systems: Missing data imputation, dimension reduction, model selection and anomaly detection.Transportation Research Part C: Emerging Technologies, 115:102622, 2020

    2020

  29. [29]

    Detection of electromagnetic interference attacks on sensor systems

    Youqian Zhang and Kasper Rasmussen. Detection of electromagnetic interference attacks on sensor systems. In IEEE Symposium on Security and Privacy (S&P), 2020

    2020

  30. [30]

    Trick or heat? manipulating critical temperature-based control systems using rectification attacks

    Yazhou Tu, Sara Rampazzi, Bin Hao, Angel Rodriguez, Kevin Fu, and Xiali Hei. Trick or heat? manipulating critical temperature-based control systems using rectification attacks. InACM SIGSAC Conference on Computer and Communications Security (CCS), 2019

    2019

  31. [31]

    Ghost talk: Mitigating EMI signal injection attacks against analog sensors

    Denis Foo Kune, John Backes, Shane S Clark, Daniel Kramer, Matthew Reynolds, Kevin Fu, Yongdae Kim, and Wenyuan Xu. Ghost talk: Mitigating EMI signal injection attacks against analog sensors. InIEEE Symposium on Security and Privacy (S&P), 2013

    2013

  32. [32]

    Morley Mao, and Henry X

    Qi Alfred Chen, Yucheng Yin, Yiheng Feng, Z. Morley Mao, and Henry X. Liu. Exposing congestion attack on emerging connected vehicle based traffic signal control. InNetwork and Distributed System Security Symposium (NDSS), 2018. 12 APREPRINT- JULY31, 2026

    2018

  33. [33]

    Google maps hacks, 2020

    Simon Weckert. Google maps hacks, 2020. Art intervention: 99 smartphones fabricated a live traffic jam on Google Maps. 13

    2020