Breaking Boundaries: Balancing Performance and Robustness in Deep Wireless Traffic Forecasting

TL;DR

The results indicate that the optimal model can retain up to 92.02% the performance of the original forecasting model in terms of Mean Squared Error on clean data, while being more robust than the standard adversarially trained models on perturbed data.

Abstract

Balancing the trade-off between accuracy and robustness is a long-standing challenge in time series forecasting. While most of existing robust algorithms have achieved certain suboptimal performance on clean data, sustaining the same performance level in the presence of data perturbations remains extremely hard. In this paper, we study a wide array of perturbation scenarios and propose novel defense mechanisms against adversarial attacks using real-world telecom data. We compare our strategy against two existing adversarial training algorithms under a range of maximal allowed perturbations, defined using $\ell_{\infty}$-norm, $\in [0.1,0.4]$. Our findings reveal that our hybrid strategy, which is composed of a classifier to detect adversarial examples, a denoiser to eliminate noise from the perturbed data samples, and a standard forecaster, achieves the best performance on both clean and perturbed data. Our optimal model can retain up to $92.02\%$ the performance of the original forecasting model in terms of Mean Squared Error (MSE) on clean data, while being more robust than the standard adversarially trained models on perturbed data. Its MSE is 2.71$\times$ and 2.51$\times$ lower than those of comparing methods on normal and perturbed data, respectively. In addition, the components of our models can be trained in parallel, resulting in better computational efficiency. Our results indicate that we can optimally balance the trade-off between the performance and robustness of forecasting models by improving the classifier and denoiser, even in the presence of sophisticated and destructive poisoning attacks.

Figures (2)

• Figure 1: Four components trained separately: $F_1$ is the forecaster trained only on normal samples $x_n$ and used for PGD attack $P$, which produces adversarial samples $x_p$. The classifier $C$ is trained on a mix of normal and poisoned samples, whereas the denoiser $D$ and the forecaster $F_2$ are trained on adversarial samples only.
• Figure 2: The four models and their composing components presented in Fig. \ref{['fig:module_training']}. $M_1$ and $M_2$ employ forecasters $F_1$ and $F_2$. $M_3$ utilizes classifier $C$ (adversarial sample detector) and denoiser $D$ (if perturbation detected), followed by forecaster $F_1$. $M_4$ uses classifier $C$ with $F_2$ (if perturbation detected), or with $F_1$ otherwise. $x_n$ and $x_p$ represent normal and perturbed sequences, respectively.