This work reframe robustness as a detection problem, introducing a learned physics-informed detector whose output is fed to a hardened forecaster as an input feature and trained against adaptive attacks with the forecaster fixed and improves even on adversarial training hardened against the physics-aware attack itself.
Abstract
Traffic forecasting by graph-based AI is a critical component of intelligent transportation systems, motivating security research on robustness to malicious sensor readings. We argue that prior robustness evaluations are largely shaped by unrealistic threat models and untargeted objectives, so both attacks and defenses must be revisited. We study a practical adversary with limited model knowledge and the ability to monitor and manipulate only a few road sensors. More importantly, practical attacks can be localized to specific links or routes, causing incorrect estimated arrival times or unnecessary rerouting while leaving the broader network largely unaffected. This targeted setting remains underexplored, and defenses such as adversarial training do not transfer well from the norm-bounded attacks they train on to structurally different, physics-aware attacks that mimic genuine congestion. We therefore reframe robustness as a detection problem, introducing a learned physics-informed detector whose output is fed to a hardened forecaster as an input feature and trained against adaptive attacks with the forecaster fixed. We evaluate across a variety of model architectures and benchmarks. The physics-aware attack multiplies target-link error several-fold while the network-wide error barely moves, and adversarial training, tuned to norm-bounded perturbations, barely dents it. Our detection--mitigation defense improves even on adversarial training hardened against the physics-aware attack itself, on $13$ of $15$ model--dataset settings and by the widest margin on a held-out attack, at near-zero clean cost. The results emphasize the need to examine abstracted AI adversarial attacks under application-specific constraints to assess their true security impacts.
Large language models (LLMs) are increasingly explored as network intrusion detection classifiers, but their adversarial robustness under realistic attacker constraints remains unclear. We present a controllability-aware black-box transfer framework for LLM-based network traffic classifiers. The framework partitions flow features into directly controllable (DC), indirectly controllable (IC), and uncontrollable (UC) groups according to network communication semantics, then restricts perturbations to DC features while freezing IC/UC features. Using a shared XGBoost surrogate, we generate finite-difference PGD, greedy coordinate-wise, and NES adversarial examples and transfer them to seven LLM targets and two conventional ML targets across five IDS benchmarks from 1999 to 2022. Across 27 valid LLM configurations and over 500,000 adversarial examples, we find that LLM transfer vulnerability is substantial but dataset- and comparator-dependent. Compared with LightGBM, LLMs are more vulnerable on RT-IoT2022 and CIC-IDS-2018, comparable on NSL-KDD and UNSW-NB15, and less vulnerable on HIKARI-2021; compared with the averaged ML baseline, LLMs show higher ASR on all five datasets. We further observe a consistent cross-architecture transfer hierarchy: gradient- and score-based perturbations transfer more effectively than greedy perturbations across all 27 LLM cells and 9/10 ML cells. Cross-surrogate validation with tree, neural, and linear surrogates yields similar LLM ASR, reducing evidence that the findings are XGBoost-specific. Constraint violation rate is 0\% by construction.
In recent years, with the rapid development of autonomous driving technology, lightweight neural networks (LNNs) have been increasingly applied in-vehicle and edge computing devices. A growing number of studies have focused on deploying LNNs in resource-constrained environments to achieve real-time traffic sign recognition, obstacle detection, and other tasks. However, while LNNs maintain high inference efficiency, their robustness has become an increasingly important concern. Research has shown that adversarial attacks targeting traffic signs can significantly disrupt the predictions of LNNs, leading to misclassifications. To enhance the adversarial robustness of LNNs, we propose TRADES-JR, a TRADES loss function guided by Jacobian regularization. This approach simultaneously considers the prediction distribution differences between clean and adversarial samples while penalizing the Frobenius norm of the network output’s Jacobian with respect to the input. By constraining the sensitivity to input perturbations, our method enhances the adversarial robustness of LNNs. We evaluate the proposed algorithm on the GTSRB and TSRD datasets. The results demonstrate that our method significantly improves the adversarial robustness of LNNs under both white-box and black-box attacks. Therefore, this method enables LNNs to maintain robust and high-accuracy traffic sign recognition even in adversarial environments, thereby enhancing the reliability of the autonomous driving system.
YunKai Zhao, Shang Gao, Jieliang Zhao· Proceedings of the Instituti...· 0 citations
Financial transaction networks face a persistent threat from strategic adversarial drift, in which sophisticated actors manipulate graph structure to bypass detection. Conventional temporal graph neural networks tend to fail in this setting because they forget historical patterns when retrained and generalise poorly to novel structural perturbations. We address this gap with Game Theoretic Anticipatory Continual Graph Learning (GT-ACGL), a framework that casts fraud detection as a continuous Stackelberg game between a defender and an adaptive adversary. The framework combines three components: a bilevel anticipatory optimisation step that trains the defender against simulated future attacks, an Adversarial Motif Memory that retains topologically significant historical patterns without redundancy, and a predictive smoothing module that preserves temporal fidelity during high throughput batched training. We evaluate the approach on three large dynamic graph datasets. On the financial benchmark, Elliptic Temporal, GT-ACGL improves F1 by 11.0 percentage points over the strongest baseline under adaptive attack, with smaller but consistent gains on two behavioural interaction benchmarks. The framework also reduces the observed forgetting rate to below 6 percentage points and incurs only a
$$1.45\times$$
training overhead relative to a standard temporal graph network. By modelling the cost of evasion inside a Stackelberg training objective, GT-ACGL encourages decision boundaries that remain comparatively stable under strategic structural perturbation. These results are empirical observations on the studied benchmarks, obtained against the specified edge addition threat model realised by our own attack generator. They are not guarantees of equilibrium behaviour, of the economic infeasibility of attack, or of robustness to the full range of real world fraud adaptations.
Huijie Fan, Yanan Jiao, M. Wang et al.· Scientific Reports· 0 citations
Camera-based object detectors are vulnerable to physical adversarial attacks designed to suppress detections. While adversarial training and input purification offer some protection, they often overfit to specific attack distributions and fail on adaptive adversaries. This paper presents AdROD, an embedded, stochastic ensemble defense software designed for autonomous driving. AdROD employs {\em low-rank HyperNetworks}, which require only 1.6\% of the parameter footprint of standard HyperNetworks, to generate diverse detectors at a per-frame rate, making it impractical for attackers to obtain the deployed detectors in time. To further improve adversarial robustness, AdROD incorporates a novel \emph{functional diversity} mechanism, which couples stochastic weight updates with unique input-space transformations. We design two serving modes of AdROD that strike different trade-offs between robustness and runtime overhead: AdROD-I, a continuous protection mode for maximum resilience that leverages inter-detector disagreement to recover compromised detections, and AdROD-II, an on-demand mode triggered by kinematic discontinuities in object tracking. Through comprehensive evaluation with synthetic benchmarks, physically deployed adversarial patches, and end-to-end safety tests in the OpenCDA co-simulator, AdROD outperforms five baseline defenses and exhibits superior generalizability compared with the evaluated adversarial-training baselines, while maintaining real-time performance for safely stopping the vehicle at a stop sign instrumented with adversarial patches.
Yuting Wu, Dongfang Guo, Xiangzhong Luo et al.· 0 citations
Traffic sign recognition systems are critical for autonomous vehicle safety yet remain vulnerable to adversarial perturbations that exploit environmental conditions. Existing naturalistic attacks employ simplified approximations without modeling underlying physics, while defenses lack comprehensive evaluation across diverse architectures and attack types. This work formulates six physically-grounded adversarial attacks spanning naturalistic perturbations (shadow, light patch, obstruction) and weather conditions (fog, snow, frost), optimized via Prior-guided Bayesian Optimization for black-box scenarios. We evaluate nine architectures across three geographically diverse datasets, revealing that transformer-based models exhibit 20.0 percentage points (pp) lower average attack success rate than CNNs (41.5% vs 61.5%) with comparable clean accuracy across datasets. We introduce Robustness Score (RS) to quantify resilience across all attacks, with baseline ConvNeXt-Tiny achieving 60.9% RS compared to best CNN at 50.7%. DiffPure diffusion-based purification substantially improves robustness through test-time noise injection and reverse denoising, increasing RS by 29.8-37.3 pp. Post-defense, transformer architectures achieve 6-16% residual attack success rate compared to 15-39% for CNNs, with consistent effectiveness across datasets (variance ⪅ 2.1 pp). These findings establish that architectural choice critically impacts adversarial robustness and that diffusion-based purification provides practical test-time defense for deployed autonomous driving systems.
Mubarak A. Alanazi· International Conference on...· 0 citations
UA-EAD is proposed, an uncertainty-aware evidential adversarial defense that equips the detector with an evidential head yielding calibrated predictive uncertainty in a single forward pass, trains it with an uncertainty-weighted adversarial objective plus a consistency regularizer that concentrates robustness on the most uncertain, near-boundary flows, and uses the resulting uncertainty for selective prediction.
Jiawen Luo, Samuel Price· International Journal of Adv...· 0 citations
