# Black-box Adversarial Attacks on Network-wide Multi-step Traffic State Prediction Models

arXiv: https://arxiv.org/abs/2110.08712 · HTML: https://mlsanity.com/paper/2110.08712/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 44 references that are in the map.
- First posted on arXiv 17 Oct 2021.

## Builds on (most cited first, 15 of 15)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Adversarial Machine Learning at Scale](https://mlsanity.com/paper/1611.01236/) (2016)
- [Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples](https://mlsanity.com/paper/1605.07277/) (2016)
- [T-GCN: A Temporal Graph ConvolutionalNetwork for Traffic Prediction](https://mlsanity.com/paper/1811.05320/) (2018)
- [Time Series Classification from Scratch with Deep Neural Networks: A Strong Baseline](https://mlsanity.com/paper/1611.06455/) (2016)
- [Traffic Graph Convolutional Recurrent Neural Network: A Deep Learning Framework for Network-Scale Traffic Learning and Forecasting](https://mlsanity.com/paper/1802.07007/) (2018)
- [advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch](https://mlsanity.com/paper/1902.07623/) (2019)
- [Learning Traffic as Images: A Deep Convolutional Neural Network for Large-Scale Transportation Network Speed Prediction](https://mlsanity.com/paper/1701.04245/) (2017)
- [ADAPS: Autonomous Driving Via Principled Simulations](https://mlsanity.com/paper/1907.08874/) (2019)
- [Fooling OCR Systems with Adversarial Text Images](https://mlsanity.com/paper/1802.05385/) (2018)
- [Predicting Station-Level Bike-Sharing Demands Using Graph Convolutional Neural Network](https://mlsanity.com/paper/2004.08723/) (2020)
- [Spatial-temporal Analysis of COVID-19's Impact on Human Mobility: the Case of the United States](https://mlsanity.com/paper/2010.03707/) (2020)

## Built on by (most cited first, 7 of 7)

- [Can ChatGPT Enable ITS? The Case of Mixed Traffic Control via Reinforcement Learning](https://mlsanity.com/paper/2306.08094/) (2023)
- [Mixture-of-Personas Language Models for Population Simulation](https://mlsanity.com/paper/2504.05019/) (2025)
- [CARL: Congestion-Aware Reinforcement Learning for Imitation-based Perturbations in Mixed Traffic Control](https://mlsanity.com/paper/2404.00796/) (2024)
- [Exploring Transformer-Augmented LSTM for Temporal and Spatial Feature Learning in Trajectory Prediction](https://mlsanity.com/paper/2412.13419/) (2024)
- [Analyzing Behaviors of Mixed Traffic via Reinforcement Learning at Unsignalized Intersections](https://mlsanity.com/paper/2312.05325/) (2023)
- [Neighbor-Aware Reinforcement Learning for Mixed Traffic Optimization in Large-scale Networks](https://mlsanity.com/paper/2412.12622/) (2024)
- [LDGNet: A Lightweight Difference Guiding Network for Remote Sensing Change Detection](https://mlsanity.com/paper/2504.05062/) (2025)

## Abstract (arXiv)

Traffic state prediction is necessary for many Intelligent Transportation Systems applications. Recent developments of the topic have focused on network-wide, multi-step prediction, where state of the art performance is achieved via deep learning models, in particular, graph neural network-based models. While the prediction accuracy of deep learning models is high, these models' robustness has raised many safety concerns, given that imperceptible perturbations added to input can substantially degrade the model performance. In this work, we propose an adversarial attack framework by treating the prediction model as a black-box, i.e., assuming no knowledge of the model architecture, training data, and (hyper)parameters. However, we assume that the adversary can oracle the prediction model with any input and obtain corresponding output. Next, the adversary can train a substitute model using input-output pairs and generate adversarial signals based on the substitute model. To test the attack effectiveness, two state of the art, graph neural network-based models (GCGRNN and DCRNN) are examined. As a result, the adversary can degrade the target model's prediction accuracy up to 54%. In comparison, two conventional statistical models (linear regression and historical average) are also examined. While these two models do not produce high prediction accuracy, they are either influenced negligibly (less than 3%) or are immune to the adversary's attack.