The Dark Side of Digital Twins: Adversarial Attacks on AI-Driven Water Forecasting

Andres Caro; Mohammadhossein Homaei; Oscar Mogollon-Gutierrez; Victor Gonzalez Morales

REVIEW 5 major objections 4 minor 15 references

The Dark Side of Digital Twins: Adversarial Attacks on AI-Driven Water Forecasting

T0 review · 5 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Tiny data tweaks push water-forecast error to 35 percent

desk verdict A standard FGSM/PGD attack on LSTM water forecasting whose learning-automata twist is under-evaluated: the stealth claim rests only on epsilon fluctuation plots, with no detection experiment. read the letter →

arxiv 2504.20295 v1 pith:AU5E33DS submitted 2025-04-28 cs.LG cs.AIcs.CR

Mohammadhossein Homaei , Victor Gonzalez Morales , Oscar Mogollon-Gutierrez , Andres Caro This is my paper · ORCID

classification cs.LGcs.AIcs.CR

keywords digitaltwinswaterdistributionsystemsadversarialmachinelearningFGSMPGDLSTMforecastingautomatacybersecurity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that a digital twin for water distribution, built on LSTM networks that forecast consumption from daily water and temperature records, is seriously vulnerable to white-box adversarial attacks. It shows that FGSM and PGD perturbations raise the Mean Absolute Percentage Error from roughly 24-26% to over 35%, and proposes a Learning Automata (LA) and Random LA mechanism that dynamically chooses the perturbation size. The claimed benefit is stealth: by varying epsilon through reward and penalty updates, and by delaying poisoned inputs, the attack is supposedly harder to detect than a fixed-epsilon attack while remaining effective. A sympathetic reader should care because, if true, an attacker who can compute gradients through the forecasting model could quietly degrade the reliability of a critical water utility's predictions and mislead operators.

What carries the argument

The central objects are the FGSM and PGD attack formulas and the Learning Automata/Random Learning Automata epsilon-selection layer. FGSM adds the sign of the loss gradient scaled by epsilon to the input; PGD iterates this with clipping; the LA layer chooses epsilon from the set {0.0001, 0.0005, 0.001, 0.0025, 0.005} and updates action probabilities with rewards when MAPE stays in 30-50% and penalties when it exceeds 100%; RLA draws one or two epsilons per iteration and delays adversarial inputs by a fixed lag. The machinery's job is to make the perturbation schedule adaptive and non-monotonic, which the paper argues breaks the usual correlation between distortion size and detectability.

What would settle it

Run an existing anomaly detector, such as isolation forest or change-point detection, on the test-set inputs after an LA/RLA-FGSM attack and compare its detection rate against fixed-epsilon FGSM at the same mean perturbation budget; if the LA/RLA version is flagged at an equal or higher rate, the paper's stealth claim is refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that adding a Learning Automata layer to FGSM attacks on LSTM water-consumption forecasts makes the attacks both effective and harder to detect. The mechanism learns, from a fixed menu of epsilon values, which perturbation magnitudes keep MAPE in a 30-50% target band, punishing epsilons that push MAPE above 100%; Random LA goes further by selecting one or two epsilons per iteration and applying the poisoned input after a fixed delay. Experimental results show MAPE rising from 26% to over 35%, and the fluctuating epsilon trajectories are presented as evidence that the attack pattern is not monotonically detectable. If this is right, a white-box attacker with gradient access can substantially degrade forecasting accuracy while remaining visually inconspicuous.

Load-bearing premise

The load-bearing premise is that the visible fluctuation of the epsilon curve is enough to prove the attack is hard to detect, even though no actual detector, anomaly score, or statistical test is applied to the attacked inputs.

Editorial extensions

If this is right

LSTM-based water forecasting models in digital twins are not robust: even epsilon equals 0.01 causes MAPE to exceed 35%.
PGD is consistently stronger than FGSM at the same epsilon, especially at intermediate perturbation levels such as 0.005 and 0.008.
An attacker can tune epsilon with LA/RLA to keep forecast error in a chosen high range (30-50%) while varying perturbation magnitudes over time.
Delayed input poisoning is presented as a way to mask attack onset; if effective, defenses must inspect historical input sequences rather than only current samples.
The paper's own mitigation table implies that defending these systems requires adversarial training, real-time anomaly detection, and secure data pipelines.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The 'harder to detect' conclusion is inferred only from epsilon fluctuation plots; a concrete detector comparison would be needed to confirm it.
Because the LA reward function targets a 30-50% MAPE band, the attack is constrained not to maximize error, so a defender could potentially flag any forecast whose error sits suspiciously inside that band.
The delayed-input strategy suggests a testable extension: detect attacks by checking cross-correlation between past adversarial perturbations and current predictions, which the paper does not run.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

Here's my take on arXiv:2504.20295. The paper does two things: it demonstrates that FGSM and PGD attacks degrade LSTM water-consumption forecasts, and it adds a Learning Automata (LA) and Random LA mechanism to adaptively select the perturbation size. The first result is plausible and standard; the second is the new contribution, and its central claim—that these attacks are harder to detect—is unsupported. The evidence for stealth is visual inspection of epsilon fluctuation plots in Figures 4-7. No anomaly detector, change-point test, statistical test, or human study is run against the actual input sequences. The reward function explicitly keeps MAPE between 30% and 50%, so the reported 'over 35%' MAPE is an optimization target, not an independent outcome. This circularity undermines the abstract's headline result.

What is genuinely good: the paper gives a concrete description of the CAUCCES digital twin platform, the LSTM forecasting setup is standard, and the baseline vulnerability results are reported in clear tables. The LA-based epsilon selection is a legitimate extension of known attack tuning, though not a new attack class. The paper is written plainly and the baseline attack pipeline is understandable.

The soft spots are more than cosmetic. The abstract's baseline MAPE of 26% does not match the 24.4-25.0% baselines in Tables II and III. FGSM and PGD tables are nearly identical, which is suspicious since PGD should be stronger; it suggests the two attacks may not have been implemented distinctly or there is an error in the reporting. No error bars, code, or data are provided, and key hyperparameters (reward/penalty factors, delay length) are not reported. The delayed input strategy in Eq. (15) could introduce discontinuities that make the attack more detectable than fixed-epsilon FGSM, yet no evidence addresses this.

If the authors had run even a simple detector—a threshold on input perturbation norm, a residual-based anomaly score, anything—and shown that LA/RLA evades it better than fixed-epsilon attacks, the paper would be meaningful. As it stands, the main new claim is untested and the paper reads like a work-in-progress.

This does deserve a serious referee: the application domain is important and the paper is a coherent attempt. But I would not accept it without the detection experiment and consistency fixes, and I would not cite it in its current form.

Referee Report

5 major / 4 minor

Summary. The paper describes a digital twin platform for a Spanish water distribution network and an LSTM-based water consumption forecaster. It applies FGSM and PGD adversarial attacks and reports that larger perturbations degrade forecasting accuracy, as measured by MAE, RMSE, and MAPE. The claimed novel contribution is a Learning Automata (LA) and Random Learning Automata (RLA) mechanism that dynamically adjusts the perturbation size, with the abstract reporting that MAPE rises from 26% to over 35% and that the attacks become harder to detect. The paper also discusses mitigation strategies. The core contributions are the LA/RLA epsilon-selection schemes and the associated undetectability claims.

Significance. If the LA/RLA stealth claim were established, the paper would provide a concrete demonstration of a new attack-optimization mechanism in a critical infrastructure domain, which would be relevant for water utility cybersecurity. The standard FGSM/PGD vulnerability tables are useful baseline evidence, and the real-world deployment context adds some interest. However, the novelty resides entirely in the undetectability claim, and that claim is not supported by any detector comparison, statistical test, or detection baseline. In addition, the reported MAPE increase is built into the LA reward function rather than being an emergent or independently measured result. The paper therefore does not currently substantiate its central contribution; the standard FGSM/PGD results alone do not constitute a sufficient advance.

major comments (5)

[Section VI.B, VI.D, and VII.F; Figures 4-7] The central claim that the LA and RLA mechanisms make adversarial attacks 'harder to detect' is supported only by visual inspection of epsilon fluctuation plots. No anomaly detector, change-point test, statistical test, residual analysis, or human perception study is applied to the input sequences or forecasts, so the stealth claim is unfalsified. A concrete detection baseline (e.g., an anomaly score on input norms or forecast residuals) is needed before this claim can be evaluated.
[Section VI.B (Eqs. 4-5) and Section VII.D (Eqs. 8-9, 14)] The LA reward function explicitly rewards epsilon values that keep MAPE between 30% and 50% and penalizes MAPE above 100%. Consequently, the abstract's claim that MAPE rises 'from 26% to over 35%' is an optimization target of the reward mechanism, not an independent prediction of attack impact. This circularity applies to both the LA and RLA variants and undermines the quantitative headline result.
[Tables II and III and Section V] The PGD results in Table III are numerically nearly identical to the FGSM results in Table II at every epsilon value, yet the text states that PGD 'consistently leads to higher errors' and exhibits 'a steeper increase in RMSE and MAPE.' This discrepancy suggests that the PGD implementation is not actually iterative or that the comparison is not meaningful, weakening the PGD analysis and the claim that adaptive strategies amplify the effect.
[Section VII.C, Eq. (12)] The number of selected epsilon values is written as k~U{1,3}, but the accompanying text says the distribution selects 'either 1 or 2 epsilon values per iteration.' These are inconsistent, and the sampling distribution is not defined precisely enough to reproduce the RLA mechanism.
[Abstract and Table II] The abstract reports a baseline MAPE of 26% rising to over 35%, but Table II lists baselines of 24.419% and 25.032% and an FGSM eps=0.01 MAPE of 32.754% for the LSTM model. The numbers in the abstract do not match the tables, and no explanation or error bars are provided to resolve the discrepancy; this weakens the quantitative narrative of the paper.

minor comments (4)

[Sections VI.D and VII.F] Several figure references are incomplete: 'as shown in 4', 'as shown in 6', and similar instances should be 'Figure 4' and 'Figure 6' to match standard formatting.
[Algorithm 1 and Section III] Algorithm 1 is a generic LSTM training outline and does not specify the actual hyperparameters, data split proportions, sequence length, or number of epochs used in the experiments; adding exact values or a repository reference would improve reproducibility.
[Section IV] The assertion that perturbations are 'small enough to go unnoticed in the input data' is made without a quantitative perceptibility metric; defining such a metric would clarify the stealth discussion.
[Table I] Table I lists numerous digital twin projects but does not state the inclusion criteria or sources for the vulnerability classifications; clarifying the compilation method would increase the table's usefulness.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the LA/RLA MAPE band is a control objective, not a prediction, and the unsupported stealth claim is an evidentiary gap, not a circular reduction.

full rationale

The paper's core quantitative results are standard FGSM/PGD attacks applied to an LSTM water-forecasting model; Tables II and III come from the textbook formulas (Eqs. 1-2) and direct evaluation, so they are not derived from the claimed outputs. The LA/RLA mechanism (Eqs. 3-15) is a feedback controller: epsilon probabilities are updated using the empirically measured MAPE, and the observed MAPE is then a real outcome of the model under the selected epsilon, not a quantity defined to equal the reward band. Reporting that the controller keeps MAPE in a target band is an optimization result, not a circular prediction. The conclusion that fluctuating epsilon makes attacks 'harder to detect' (Sections VI.D and VII.F) is unsupported because no detector, anomaly score, or statistical test is run, but that is a missing-evidence problem rather than a circularity, since no equation or fitted value is reused as its own proof. The self-citations [3]-[5] support background definitions and do not carry the central derivation. Overall, no load-bearing step reduces to its own inputs.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The paper's central attack result depends on standard white-box FGSM/PGD and on hand-chosen hyperparameters (epsilon set, reward band, delay, and unspecified r and p). The stealth claim depends on an ad hoc equivalence between non-monotonic epsilon and undetectability. No new physical entities are introduced.

free parameters (5)

epsilon set for FGSM/PGD = 0.001, 0.005, 0.008, 0.01 in Tables II and III; LA set {0.0001, 0.0005, 0.001, 0.0025, 0.005}
Attack strength is a hand-chosen hyperparameter; all error metrics are conditional on it.
LA reward MAPE band = 30% < MAPE < 50%
Section VI.B rewards epsilon values whose attack MAPE falls in this band, so the reported result is selected for this range, not independently predicted.
LA reward and penalty factors r and p = not specified
Equations (4), (5), (8), (9), and (14) depend on these values; without them, the LA probability updates and the adaptive penalty are underspecified.
Delay length a = not specified
Equation (15) defines delayed poisoning with an unspecified a; the stealth claim depends on this delay.
LSTM hyperparameters = not specified
Algorithm 1 says to define number of units, learning rate, and epochs but never gives values, so the forecasting baseline cannot be reproduced.

assumptions (3)

domain assumption White-box threat model: the attacker has full access to the trained LSTM including gradients.
Section IV states FGSM and PGD are white-box methods; all results assume this access, so they do not apply to black-box or query-limited attackers.
standard math The loss function J is differentiable with respect to input features, so gradients can be computed through the LSTM.
Equations (1) and (2) require gradient computation; this is standard for neural networks with differentiable activations.
ad hoc to paper Undetectability can be inferred from the pattern of epsilon fluctuations without defining a detector.
Sections VI.D and VII.F conclude stealth from Figures 4-7; no formal detector or detection probability is specified, making the conclusion rest on this ad hoc observational criterion.

how reviews work

0 comments

Cite this review

Pith. "Pith review of The Dark Side of Digital Twins: Adversarial Attacks on AI-Driven Water Forecasting." pith.science (2026). https://pith.science/paper/AU5E33DS

@misc{pith2026250420295,
  author       = {Pith},
  title        = {Pith review of: The Dark Side of Digital Twins: Adversarial Attacks on AI-Driven Water Forecasting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AU5E33DS}},
  note         = {Machine review of arXiv:2504.20295}
}

read the original abstract

Digital twins (DTs) are improving water distribution systems by using real-time data, analytics, and prediction models to optimize operations. This paper presents a DT platform designed for a Spanish water supply network, utilizing Long Short-Term Memory (LSTM) networks to predict water consumption. However, machine learning models are vulnerable to adversarial attacks, such as the Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD). These attacks manipulate critical model parameters, injecting subtle distortions that degrade forecasting accuracy. To further exploit these vulnerabilities, we introduce a Learning Automata (LA) and Random LA-based approach that dynamically adjusts perturbations, making adversarial attacks more difficult to detect. Experimental results show that this approach significantly impacts prediction reliability, causing the Mean Absolute Percentage Error (MAPE) to rise from 26% to over 35%. Moreover, adaptive attack strategies amplify this effect, highlighting cybersecurity risks in AI-driven DTs. These findings emphasize the urgent need for robust defenses, including adversarial training, anomaly detection, and secure data pipelines.

Figures

Figures reproduced from arXiv: 2504.20295 by the authors.

**Figure 2.** DT Platform in the Water Distribution Networks [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Water consumption forecasting via LSTM for 6(top) and 18 [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Fluctuation of the epsilon variable along the iterations in an LA [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 5.** Figure 5: illustrates how an FGSM attack based on Learning Automata (LA) can remain imperceptible to a human observer. Unlike conventional perturbations that follow a monotonic increase in magnitude, the penalty and reward mechanism in LA introduces variability, preventing a …

**Figure 6.** Figure 6: Fluctuation of the epsilon variable along the iterations in a RLA [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

**Figure 7.** Figure 7: Hidden RLA-based FGSM Attack F. Experimental Results The FGSM attack based on Random Learning Automata (RLA) introduces a higher degree of unpredictability in the perturbation process. Unlike structured learning mechanisms, RLA selects ϵ values in a stochastic manner, …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

15 extracted references · 13 canonical work pages

[1]

Digital twins for wastewater treatment: A technical review,

A.-J. Wang, H. Li, Z. He, Y . Tao, H. Wang, M. Yang, D. Savic, G. T. Daigger, and N. Ren, “Digital twins for wastewater treatment: A technical review,” Engineering, vol. 36, p. 21–35, May 2024. [Online]. Available: http://dx.doi.org/10.1016/j.eng.2024.04.012

work page doi:10.1016/j.eng.2024.04.012 2024
[2]

Impact of digital transformation on carbon emissions reductions in the water industry,

H. Beji and M. Lade, “Impact of digital transformation on carbon emissions reductions in the water industry,” in Lecture Notes in Energy. Springer International Publishing, 2022, pp. 117–127

work page 2022
[3]

Digital transformation in the water distribution sys- tem based on the digital twins concept,

M. Homaei, A. J. Di Bartolo, M. ´Avila, ´Oscar Mogoll ´on-Guti´errez, and A. Caro, “Digital transformation in the water distribution sys- tem based on the digital twins concept,” 2024. [Online]. Available: https://arxiv.org/abs/2412.06694

arXiv 2024
[4]

M. H. Homaei, A. C. Lindo, J. C. S. N ´u˜nez, O. M. Guti ´errez, and J. A. D ´ıaz, Eds., The role of Artificial Intelligence in Digital Twin’s Cybersecurity. Editorial Universidad de Cantabria, Sep. 2022

work page 2022
[5]

A review of digital twins and their application in cybersecurity based on artificial intelligence,

M. Homaei, ´Oscar Mogoll ´on-Guti´errez, J. C. Sancho, M. ´Avila, and A. Caro, “A review of digital twins and their application in cybersecurity based on artificial intelligence,” Artificial Intelligence Review, vol. 57, no. 8, p. 201, Jul. 2024. [Online]. Available: https://doi.org/10.1007/s10462-024-10805-3

work page doi:10.1007/s10462-024-10805-3 2024
[6]

Universal fourier attack for time series,

E. Coda, B. Clymer, C. DeSmet, Y . Watkins, and M. Girard, “Universal fourier attack for time series,” IEEE Open Journal of Signal Processing, vol. 5, p. 858–866, 2024

work page 2024
[7]

AdaptEdge: Targeted universal adversarial attacks on time series data in smart grids,

S. U. Khan, M. Mynuddin, and M. Nabil, “AdaptEdge: Targeted universal adversarial attacks on time series data in smart grids,” IEEE Transactions on Smart Grid, vol. 15, no. 5, p. 5072–5086, Sep. 2024

work page 2024
[8]

Trojan attack and defense for deep learning-based navigation systems of unmanned aerial vehicles,

M. Mynuddin, S. U. Khan, R. Ahmari, L. Landivar, M. N. Mahmoud, and A. Homaifar, “Trojan attack and defense for deep learning-based navigation systems of unmanned aerial vehicles,” IEEE Access, vol. 12, p. 89887–89907, 2024

work page 2024

Show all 15 references

[9]

Towards deep learning models resistant to adversarial attacks,

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” 2019

2019
[10]

De- veloping an LSTM model to forecast the monthly water consumption according to the effects of the climatic factors in Yazd, Iran,

A. Niknam, H. K. Zare, H. Hosseininasab, and A. Mostafaeipour, “De- veloping an LSTM model to forecast the monthly water consumption according to the effects of the climatic factors in Yazd, Iran,” Journal of Engineering Research, vol. 11, no. 1, p. 100028, Mar. 2023

2023
[11]

River water temperature forecasting using a deep learning method,

R. Qiu, Y . Wang, B. Rhoads, D. Wang, W. Qiu, Y . Tao, and J. Wu, “River water temperature forecasting using a deep learning method,” Journal of Hydrology, vol. 595, p. 126016, Apr. 2021

2021
[12]

A digital twin of a water distribution system by using graph convolutional networks for pump speed-based state estimation,

C. A. Bonilla, A. Zanfei, B. Brentan, I. Montalvo, and J. Izquierdo, “A digital twin of a water distribution system by using graph convolutional networks for pump speed-based state estimation,” Water, vol. 14, no. 4, p. 514, Feb. 2022

2022
[13]

Graph neural networks for sensor placement: A proof of concept towards a digital twin of water distribution systems,

A. Menapace, A. Zanfei, M. Herrera, and B. Brentan, “Graph neural networks for sensor placement: A proof of concept towards a digital twin of water distribution systems,” Water, vol. 16, no. 13, p. 1835, Jun. 2024

2024
[14]

Ambling. Official Website,

Ambling Ingenier ´ıa y Servicios, S.L., “Ambling. Official Website,” 2025, accessed: March 20, 2025. [Online]. Available: https://www.ambling.es

2025
[15]

Rezvanian, A

A. Rezvanian, A. M. Saghiri, S. M. Vahidipour, M. Esnaashari, and M. R. Meybodi, Recent Advances in Learning Automata. Springer International Publishing, 2018

2018

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

Digital twins for wastewater treatment: A technical review,

A.-J. Wang, H. Li, Z. He, Y . Tao, H. Wang, M. Yang, D. Savic, G. T. Daigger, and N. Ren, “Digital twins for wastewater treatment: A technical review,” Engineering, vol. 36, p. 21–35, May 2024. [Online]. Available: http://dx.doi.org/10.1016/j.eng.2024.04.012

work page doi:10.1016/j.eng.2024.04.012 2024

[2] [2]

Impact of digital transformation on carbon emissions reductions in the water industry,

H. Beji and M. Lade, “Impact of digital transformation on carbon emissions reductions in the water industry,” in Lecture Notes in Energy. Springer International Publishing, 2022, pp. 117–127

work page 2022

[3] [3]

Digital transformation in the water distribution sys- tem based on the digital twins concept,

M. Homaei, A. J. Di Bartolo, M. ´Avila, ´Oscar Mogoll ´on-Guti´errez, and A. Caro, “Digital transformation in the water distribution sys- tem based on the digital twins concept,” 2024. [Online]. Available: https://arxiv.org/abs/2412.06694

arXiv 2024

[4] [4]

M. H. Homaei, A. C. Lindo, J. C. S. N ´u˜nez, O. M. Guti ´errez, and J. A. D ´ıaz, Eds., The role of Artificial Intelligence in Digital Twin’s Cybersecurity. Editorial Universidad de Cantabria, Sep. 2022

work page 2022

[5] [5]

A review of digital twins and their application in cybersecurity based on artificial intelligence,

M. Homaei, ´Oscar Mogoll ´on-Guti´errez, J. C. Sancho, M. ´Avila, and A. Caro, “A review of digital twins and their application in cybersecurity based on artificial intelligence,” Artificial Intelligence Review, vol. 57, no. 8, p. 201, Jul. 2024. [Online]. Available: https://doi.org/10.1007/s10462-024-10805-3

work page doi:10.1007/s10462-024-10805-3 2024

[6] [6]

Universal fourier attack for time series,

E. Coda, B. Clymer, C. DeSmet, Y . Watkins, and M. Girard, “Universal fourier attack for time series,” IEEE Open Journal of Signal Processing, vol. 5, p. 858–866, 2024

work page 2024

[7] [7]

AdaptEdge: Targeted universal adversarial attacks on time series data in smart grids,

S. U. Khan, M. Mynuddin, and M. Nabil, “AdaptEdge: Targeted universal adversarial attacks on time series data in smart grids,” IEEE Transactions on Smart Grid, vol. 15, no. 5, p. 5072–5086, Sep. 2024

work page 2024

[8] [8]

Trojan attack and defense for deep learning-based navigation systems of unmanned aerial vehicles,

M. Mynuddin, S. U. Khan, R. Ahmari, L. Landivar, M. N. Mahmoud, and A. Homaifar, “Trojan attack and defense for deep learning-based navigation systems of unmanned aerial vehicles,” IEEE Access, vol. 12, p. 89887–89907, 2024

work page 2024