Availability Adversarial Attack and Countermeasures for Deep Learning-based Load Forecasting

Load forecasting plays an essential role in the operation and control of the power system. With more distributed resources embedded in the grid, accurate load forecasting also benefits the demand-side response. Plenty of researches have been done for load forecasting, both deterministic and probabilistic [1]. Regression-based models and their variants dominates the long-term forecasting while machine learning algorithms, such as artificial neural network (ANN) gains more attention for short-term forecasting due to its efficiency on feature extraction [2]. For instance, feedforward neural network is applied in [3]. In addition, long short-term memory (LSTM) and convolutional neural net (CNN) are used to remember temporal information, which can result in state-of-the-art accuracy [4].

The concept of adversarial attack against deep neural network was firstly discovered by Szegedy et al. [5] where it has been shown that a small amount of perturbation on the image pixels can result in wrong classification. To generate the attack, fast gradient sign method (FGSM) was proposed by assuming the local linearity of the loss surface [6]. Although the FGSM can reduce the computational burden, it can only produces sub-optimal attack vectors. Projected gradient descent (PGD) extends the idea of FGSM in which the attack vector is solved in a multistep manner to approach the global optima [7]. In addition, the most effective approach to combating adversarial attacks is to minimize the loss of adversarial examples generated at each epoch, which is named adversarial training [7].

Recently, adversarial attacks on time series, especially the load forecasting applications, have gained more attention [8]. Starting from the linear model, Luo et al. compares four load forecasting algorithms that can easily fail under data integrity attacks [9]. The authors then introduce regularization to address the challenge [10]. However, the integrity attacks considered in [9, 10] are not specifically designed by the forecasting model. In [11], a robust linear regression for data availability attack is proposed through min-max optimization. In the deep learning era, a cost-oriented integrity attack is established to maximize operational cost [12]. In [13], the robustness of the deep load forecasting model is guaranteed through Bayesian inference.

We observe that the integrity attack is the main source of adversarial attacks in deep learning-based load forecasting models, and the availability attack is only considered for linear models. Considering a ‘man-in-the-middle’ scenario, availability attack is much cheaper than integrity attack as the attacker does not need to manipulate the data and repackage the packets [14]. Meanwhile, missing data are more common, as measurements can be temporally unavailable due to equipment failure. To fill this research gap, first, we design the availability adversarial attack targeting on piecewise linear neural network (PLNN). The optimality of the attack is guaranteed by reformulating the PLNN into mixed integer linear programming (MILP). Second, an adversarial training algorithm is proposed that considers both clean and attack accuracy to improve the robustness of the PLNN. In the simulation, we compare the performance of the availability adversarial attack with its integrity counterpart and demonstrate the effectiveness of the proposed adversarial training algorithm in a realistic load forecasting task.

Referring to the loss function (1), the objective of the adversarial attack is to increase the forecast error by perturbing $\bm{\delta}$ on the input $\bm{x}_{n}$ subject to a predefined $l_{p}$ ball $\|\cdot\|_{p}$. After obtaining the trained model $\bm{\theta}^{*}$, the integrity adversarial attack on $(\bm{x}_{n},y_{n})$ can be written as

Projected gradient descent (PGD)¹¹1Though the objective of (4) is to maximize the loss; it is common to name it descent in the literature. can be used to solve (4). At each iteration, normalized gradient ascents are operated and the resulting data $\bm{x}_{n}+\bm{\delta}$ is clamped by the norm ball [7].

Although PGD has proven to be efficient, it is hard to obtain the global optima due to the non-convexity of the neural network. To approach the global optimality, multi-run strategy can be applied. However, it is possible to find global optima for small sized neural network under certain structure. Firstly, since the square loss in (4) is convex, to formulate a convex problem, we can maximize and minimize the forecast values. Second, $l_{\infty}$-norm is considered in which each feature can be maximally injected by $\epsilon$. Referring to (3), (4) can be rewritten as:

The optimization problem (5) is non-convex due to the maximization constraint caused by ReLU. However, it can be easily transformed into an MILP using the big-M method. Specifically, (5) is equivalent to [16]:

where $\bm{v}_{i}$ is the auxiliary integer variable related to the ReLU activation functions; $\bm{u}_{i}$ and $\bm{l}_{i}$ are the upper and lower bounds for the output of the $i$-th layer, i.e., $\bm{l}_{i}\leq\bm{W}_{i}\bm{z}_{i}+\bm{b}_{i}\leq\bm{u}_{i},i=1,\cdots,d-1$, which are designed by the user. All the inequality constraints in (6) are element-wise. If the inequality is satisfied for some optimal solution $\bm{z}_{i}=\bm{z}_{i}^{*},i=1,\cdots,d-1$ of (5), then the optimal solution of (6) is also an optimal solution of (5) [17]. A detailed conversion from (5) to (6) can be found in [18].

The integrity attack with the MILP reformulation has been well studied in the literature. However, it requires the attackers not only hijack the sensor measurements from the remote server, but also have the ability to manipulate their values and send them back to the operator. Compared to the integrity attack, the availability attack is much cheaper, as it only requires the attackers to block measurements [14].

First, the temporal information, such as month, date and time, cannot be attacked as it can be easily obtained and verified by the operator. Therefore, only K1-K6 features are prone to attack (flexible feature, indexed by $\mathcal{I}_{flex}$) while the temporal feature is fixed (indexed by $\mathcal{I}_{fix}$). Second, once the K1-K6 features are blocked, the operator can have different choices to impute the missing value(s). In detail, defining an integer vector $\bm{m}\in\{0,1\}^{|\mathcal{I}_{flex}|}$ and vector $\bm{c}\in\mathbb{R}^{p}$, the imputed input data can be represented as $\bm{z}_{1}=\text{diag}([\bm{m},\bm{1}])\cdot\bm{x}+\text{diag}([\bm{1}-\bm{m},\bm{0}])\cdot\bm{c}$ where $\bm{1}$ and $\bm{0}$ are all one and zero vectors with proper dimensions²²2Without losing generality, we assume that the flexible features are concatenated in front of the fixed features.. The imputed vector $\bm{c}$ reflects the operator’s choice to compensate for the missing features. When $\bm{m}(i)=0$, this feature is unavailable and $\bm{z}_{1}(i)=\bm{c}(i)$. For simplicity, $\bm{c}$ can be chosen as $\bm{0}$ or the average value $\frac{1}{N}\sum_{n}\bm{x}_{n}$ in this paper.

Similarly to (5), the optimal availability adversarial attack can be obtained by solving the following optimization problem:

in which the last constraint represents the attacker’s budget. For example, at most $\beta$ number of features can be blocked.

Using the same big-M technique in (6), (7) can also be reformulated as MILP:

The user-defined layer output bounds $\bm{u}_{i}$ and $\bm{l}_{i}$ are essential to solve (7). First, the solution of (8) may be sub-optimal to (7) if the bounds do not cover the output of layer $i$ at the optimal value of (7). Second, if the bounds are too large, the MILP can be slow to converge. To inform proper bounds on the output of each linear layer, convex bound propagation can be applied as follows. First, define $\bm{l}_{0}=\bm{u}_{0}=\bm{x}$. Then the initial bounds on $\bm{z}_{1}$ can be defined as follows:

Considering (3), the bounds on the output of each layer before the last can be propagated by

for $i=0,\cdots,d-2$. By the above formulation, there should be at least two layers in the network. Otherwise, the ANN will become a linear regression.

Fig. 1 compares the MPE deviation on the clean model under the availability adversarial attacks. In each of the box plot, the box represents the inter-quartile range (IQR) extending from the first quartile to the third of the data. The median of the data is indicated by the orange line. The whiskers cover the whole range of data. First, increasing the attack budget $\beta$ can increase the output deviations. However, this trend is not significant when $\beta\geq 3$. The output deviations with zero imputation $\bm{c}=0$ is more intense than average imputation as no feature information can be extracted. Second, different data can have different vulnerabilities on the availability attack. For example, some samples can maintain the output with MPE=0 while others are altered significantly.

To better see the dependency of attack performance on the attack budget $\beta$, Fig. 2 records the number of actual missing features under AVAI(min, mean, $\beta$) attack (corresponding to Fig. 1(d)). First, it is clearly shown that a small proportion of data cannot be attacked regardless of the choices of $\beta$, which results in MPE=0. These data points are least sensitive to AVAI(min, mean, $\beta$) attack, as blocking any subset of their features can only increase the load forecast. Second, most of the actual missing numbers locate at 3 even when $\beta=6$. This further implies that in most cases, blocking more features may not result in a stronger attack, although increasing $\beta$ can have more flexibility to allocate the attack position.

Fig. 3 records the MPE of integrity adversarial attacks solved by MILP (6). The median MPEs of availability attacks with $\beta=6$ are also plotted as a reference. When maximizing the load forecast (Fig. 3(a)), availability attacks can give output deviations comparable to integrity attacks when $\epsilon$ is small, e.g. with $\epsilon=0.1$. However, when $\epsilon$ increases, the MPE of the integrity attack is much higher than the availability attacks. When minimizing the load forecast (Fig. 3(b)), AVAI(min, mean, 6) can persistently outperform integrity attacks. Since the input features are scaled into $[0,1]$, it is not realistic to have $\epsilon$ larger than 0.2. Meanwhile, as it is is much cheaper than the integrity attack, the availability attack is a promising attack strategy for the attacker. However, how to balance the cost and impact of this attack is unsolved and we will leave it for future work.

Solving the MILP can be time consuming, especially when the number of integer variables is large. The computational time of both availability attacks are summarized in Table I. As adversarial training requires solving the optimal availability attacks, faster computation is beneficial to efficient training. Recall that the size of the dataset is 32k, which requires half hour to train single epoch. After using parallel computation, the computational time is significantly reduced to 1.7 min/epoch, which is acceptable for a real-time application.

Adversarial training is implemented in this section. Since there are two imputation strategies discussed in this paper, the performances are reported on both models trained adversarially with $\bm{c}=0$ and $\bm{c}=\text{mean}$. In addition, the attack budget is set to $\beta=6$ in adversarial training.

First, the MAPEs on the clean samples for both clean model and adversarial model are summarized in Table II. Adversarial training can inevitably deteriorate the performance of the model in clean samples by 1.0%. As $\bm{c}=0$ is a stronger attack attempt than $\bm{c}=\text{mean}$, model trained on AVAI(mode, 0, 6) has higher MAPE than it trained on AVAI(mode, mean, 6).

Second, the MPE on the adversarially attacked samples under different training situations are summarized in Fig. 4. After the adversarial training, the MPEs are reduced by more than 50% in general. The stronger adversarial training situation with $\bm{c}=0$ can have better robustness, but sacrifices more in clean accuracy (Table II). It is interesting to observe that the model trained with $\bm{c}=0$ can also have better performance on AVAI(mode, mean, 6) than the model trained directly with $\bm{c}=\text{mean}$. Moreover, the performance of model trained with $\bm{c}=0$ has slightly higher MPEs than the model trained with $\bm{c}=\text{mean}$. Referring to (14), both AVAI(max, $\bm{c}$, 6) and AVAI(min, $\bm{c}$, 6) attacks contribute equally to the adversarial loss function. Therefore, the gradient descent tries to balance them during the training, although the AVAI(min, 0, 6) is much stronger than AVAI(max, 0, 6). To solve the problem, the hyperparameters can be set to $\beta_{max}>1>\beta_{min}>0$ in (14).