# Targeted Adversarial Attacks on Wind Power Forecasts

arXiv: https://arxiv.org/abs/2303.16633 · HTML: https://mlsanity.com/paper/2303.16633/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Builds on 27 of its 54 references that are in the map.
- First posted on arXiv 29 Mar 2023.

## Builds on (most cited first, 27 of 27)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Sequence to Sequence Learning with Neural Networks](https://mlsanity.com/paper/1409.3215/) (2014)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [Theoretically Principled Trade-off between Robustness and Accuracy](https://mlsanity.com/paper/1901.08573/) (2019)
- [Robustness May Be at Odds with Accuracy](https://mlsanity.com/paper/1805.12152/) (2018)
- [Hyperband: A Novel Bandit-Based Approach to Hyperparameter Optimization](https://mlsanity.com/paper/1603.06560/) (2016)
- [On Evaluating Adversarial Robustness](https://mlsanity.com/paper/1902.06705/) (2019)
- [Tune: A Research Platform for Distributed Model Selection and Training](https://mlsanity.com/paper/1807.05118/) (2018)
- [Adversarial Attacks and Defenses in Images, Graphs and Text: A Review](https://mlsanity.com/paper/1909.08072/) (2019)
- [On Detecting Adversarial Perturbations](https://mlsanity.com/paper/1702.04267/) (2017)
- [Adversarial Training Can Hurt Generalization](https://mlsanity.com/paper/1906.06032/) (2019)
- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Adversarial Attacks on Deep Neural Networks for Time Series Classification](https://mlsanity.com/paper/1903.07054/) (2019)
- [Adversarial Attacks on Time Series](https://mlsanity.com/paper/1902.10755/) (2019)
- [Untargeted, Targeted and Universal Adversarial Attacks and Defenses on Time Series](https://mlsanity.com/paper/2101.05639/) (2021)
- [Exploiting Vulnerabilities of Load Forecasting Through Adversarial Attacks](https://mlsanity.com/paper/1904.06606/) (2019)
- [Adversarial Attacks, Regression, and Numerical Stability Regularization](https://mlsanity.com/paper/1812.02885/) (2018)
- [Adversarial Attacks on Multivariate Time Series](https://mlsanity.com/paper/2004.00410/) (2020)
- [Evaluating the Cybersecurity Risk of Real World, Machine Learning Production Systems](https://mlsanity.com/paper/2107.01806/) (2021)
- [Attack on Grid Event Cause Analysis: An Adversarial Machine Learning Approach](https://mlsanity.com/paper/1911.08011/) (2019)
- [Fast Differentiable Clipping-Aware Normalization and Rescaling](https://mlsanity.com/paper/2007.07677/) (2020)
- [Estimating Solar and Wind Power Production using Computer Vision Deep Learning Techniques on Weather Maps](https://mlsanity.com/paper/2103.08727/) (2021)

## Built on by (most cited first, 9 of 9)

- [Increasing the Robustness of Model Predictions to Missing Sensors in Earth Observation](https://mlsanity.com/paper/2407.15512/) (2024)
- [Adversarial Observations in Weather Forecasting](https://mlsanity.com/paper/2504.15942/) (2025)
- [Impact Assessment of Missing Data in Model Predictions for Earth Observation Applications](https://mlsanity.com/paper/2403.14297/) (2024)
- [FABLE: A Localized, Targeted Adversarial Attack on Weather Forecasting Models](https://mlsanity.com/paper/2505.12167/) (2025)
- [Missing Data as Augmentation in the Earth Observation Domain: A Multi-View Learning Approach](https://mlsanity.com/paper/2501.01132/) (2025)
- [Adversarial Attacks on Downstream Weather Forecasting Models: Application to Tropical Cyclone Trajectory Prediction](https://mlsanity.com/paper/2510.10140/) (2025)
- [Temporally Unified Adversarial Perturbations for Time Series Forecasting](https://mlsanity.com/paper/2602.11940/) (2026)
- [Adversarial Training Improves Generalization Under Distribution Shifts in Bird Sound Classification](https://mlsanity.com/paper/2507.13727/) (2025)
- [Does Demand Response Increase Vulnerability to Cyber Attacks by Adversarial Data Modifications?](https://mlsanity.com/paper/2607.06632/) (2026)

## Abstract (arXiv)

In recent years, researchers proposed a variety of deep learning models for wind power forecasting. These models predict the wind power generation of wind farms or entire regions more accurately than traditional machine learning algorithms or physical models. However, latest research has shown that deep learning models can often be manipulated by adversarial attacks. Since wind power forecasts are essential for the stability of modern power systems, it is important to protect them from this threat. In this work, we investigate the vulnerability of two different forecasting models to targeted, semi-targeted, and untargeted adversarial attacks. We consider a Long Short-Term Memory (LSTM) network for predicting the power generation of individual wind farms and a Convolutional Neural Network (CNN) for forecasting the wind power generation throughout Germany. Moreover, we propose the Total Adversarial Robustness Score (TARS), an evaluation metric for quantifying the robustness of regression models to targeted and semi-targeted adversarial attacks. It assesses the impact of attacks on the model's performance, as well as the extent to which the attacker's goal was achieved, by assigning a score between 0 (very vulnerable) and 1 (very robust). In our experiments, the LSTM forecasting model was fairly robust and achieved a TARS value of over 0.78 for all adversarial attacks investigated. The CNN forecasting model only achieved TARS values below 0.10 when trained ordinarily, and was thus very vulnerable. Yet, its robustness could be significantly improved by adversarial training, which always resulted in a TARS above 0.46.