REVISITING THE ADVERSARIAL ROBUSTNESS OF GRAPH-BASED TRAFFIC FORECASTING

Research Context and Problem

Traffic forecasting models, particularly spatiotemporal graph neural networks (ST-GNNs), are critical for modern transportation infrastructure. While prior research has explored their adversarial robustness, these studies often rely on unrealistic threat models—such as assuming an attacker can manipulate a large, unconstrained set of sensors globally. In practice, an adversary is more likely to target specific routes or corridors to cause localized disruptions, such as unnecessary rerouting, while remaining undetected by global performance metrics. Furthermore, existing defenses like adversarial training (AT) are often tuned to norm-bounded perturbations, making them ineffective against structurally sophisticated, physics-aware attacks that mimic genuine traffic congestion.

The Proposed Approach

To address these limitations, the author introduces a five-axis threat model that accounts for limited attacker knowledge, partial sensor observation, and localized objectives. The paper proposes a novel defense, VetTraffic, which treats robustness as a detection problem rather than a pure classification or hardening task.

VetTraffic consists of a physics-informed detector that evaluates sensor readings for inconsistencies with graph neighbors and directed traffic dynamics. Instead of simply discarding suspicious data, the detector provides a 'suspicion signal' that is fed into the forecaster as an additional input feature via a zero-initialized adapter. This allows the forecaster to learn how to discount unreliable sensors while retaining the raw data, effectively maintaining high performance on clean data while remaining resilient to targeted, physics-aware adversarial inputs.

Findings and Impact

The evaluation demonstrates that physics-aware attacks can significantly inflate errors on targeted links without affecting the broader network, rendering standard adversarial training largely ineffective. In contrast, VetTraffic consistently outperforms state-of-the-art adversarial training baselines across 13 of 15 model-dataset configurations. Because the detector learns to identify physics violations rather than specific attack patterns, it generalizes well to unseen, held-out attacks. The results highlight the necessity of evaluating AI security under application-specific constraints rather than relying on generic, image-domain adversarial benchmarks.