FABLE: A Localized, Targeted Adversarial Attack on Weather Forecasting Models

TL;DR

The paper tackles the vulnerability of deep learning–based weather forecasting to adversarial manipulation by formulating localized, targeted attacks with constraints on faithfulness, closeness, and geospatio-temporal realism. It introduces FABLE, which applies a level-one 3D Haar wavelet decomposition to perturb high-frequency components of the predictor input, optimizing a loss that ties forecasts to a target while keeping perturbations within an ε-ball and preserving autocorrelation structure. Empirical results on NLDAS and ERA5 datasets show FABLE achieves strong closeness and realism, often ranking near the top across datasets and weather models, and remains computationally efficient compared to baselines. The work highlights the importance of frequency-aware perturbations for stealthy, realistic attacks and suggests directions for extending wavelet-based adversaries to multivariate and physically constrained settings, with implications for assessing robustness of weather forecasting systems.

Abstract

Deep learning-based weather forecasting models have recently demonstrated significant performance improvements over gold-standard physics-based simulation tools. However, these models are vulnerable to adversarial attacks, which raises concerns about their trustworthiness. In this paper, we first investigate the feasibility of applying existing adversarial attack methods to weather forecasting models. We argue that a successful attack should (1) not modify significantly its original inputs, (2) be faithful, i.e., achieve the desired forecast at targeted locations with minimal changes to non-targeted locations, and (3) be geospatio-temporally realistic. However, balancing these criteria is a challenge as existing methods are not designed to preserve the geospatio-temporal dependencies of the original samples. To address this challenge, we propose a novel framework called FABLE (Forecast Alteration By Localized targeted advErsarial attack), which employs a 3D discrete wavelet decomposition to extract the varying components of the geospatio-temporal data. By regulating the magnitude of adversarial perturbations across different components, FABLE can generate adversarial inputs that maintain geospatio-temporal coherence while remaining faithful and closely aligned with the original inputs. Experimental results on multiple real-world datasets demonstrate the effectiveness of our framework over baseline methods across various metrics.

Figures (8)

• Figure 1: The left two panels show the original input data and its adversarial sample produced by the TAAOWPF adversarial attack method heinrich2024targeted for the NLDAS precipitation dataset. The right two panels show their corresponding original and adversarial forecasts generated by the CLCRN weather forecasting model lin2022conditional. The red circle indicates the targeted locations for forecast manipulation.
• Figure 2: Performance comparison of existing adversarial attack methods on NLDAS precipitation dataset in terms of faithfulness and closeness. Lower metric values indicate better performance.
• Figure 3: Impact of adversarial attack on spatial and temporal autocorrelations for NLDAS temperature dataset. On the left panel, the x-axis represents individual test samples on different days, while the y-axis represents Moran’s I values for the original predictor $\mathbf{X}$ as well as the adversarial samples $\mathbf{X}'$ generated by different attack methods. On the right panel, the x-axis represents different lags of temporal autocorrelation while the y-axis represents temporal autocorrelation values of $\mathbf{X}$ and $\mathbf{X}'$.
• Figure 4: Framework of FABLE. The original forecast $\mathbf{\hat{Y}}$ is produced by applying a weather forecasting model $g$ to the original input $\mathbf{X}$. Let $\mathbf{\hat{Y}'}$ be the adversarial target for $\mathbf{\hat{Y}}$. To generate an adversarial sample, $\mathbf{X}$ is first decomposed into its 3D Haar wavelet coefficients $\mathbf{C}$. The coefficients are iteratively updated to minimize the total loss to obtain $\mathbf{C}'$. The adversarial sample $\mathbf{X}'$ is obtained from $\mathbf{C}'$ using inverse wavelet decomposition, which is passed to $g$ to obtain its forecast, $g(\mathbf{\hat{X}'})$.
• Figure 5: Comparison of adversarial samples generated by existing attack methods and their corresponding forecasts. The first row shows the original predictor $X$, the original forecast $\hat{Y}$, and the perturbation magnitude $|\delta_{\hat{Y}}|$ used to generate the adversarial target. Subsequent rows show the adversarial predictors $X'$ generated from each baseline and its adversarial forecast $g(X')$. The leftmost column shows the perturbation magnitude $|\delta_X|$ on $X$ while the rightmost column shows the difference $|g(X')-\hat{Y}|$ on $\hat{Y}$. The maximum magnitude of perturbation on $X$ is set to $\epsilon=2.5$.

Theorems & Definitions (10)

• Theorem 1
• Remark 1
• Theorem 2
• Remark 2
• Theorem : Restatement of Theorem \ref{['upper_bound_comparison']}
• proof
• Corollary 1
• proof
• Theorem : Restatement of Theorem \ref{['thm:closeness']}
• proof