TSFAdv: Frequency-Guided Black-Box Adversarial Attacks on Time Series Forecasting

While deep neural network-based long-term time series forecasting (LTSF) has become indispensable for critical infrastructures such as smart grids and IoT platforms, the deployment of these models as black-box APIs introduces severe security vulnerabilities that remain largely underexplored. In this paper, we propose TSFAdv, a query-efficient adversarial framework for LTSF models. The framework systematically analyzes model sensitivity to spectral perturbations in both magnitude and phase of the frequency domain. By embedding frequency-domain priors into Natural Evolution Strategies, we achieve sensitivity-guided gradient estimation that improves perturbation efficacy without violating practical query constraints. To overcome ambiguities inherent to point-wise regression metrics, we adopt a trajectory-level evaluation protocol based on Dynamic Time Warping (DTW) and Slope Misalignment Error (SME), enabling the capture of complex geometric and directional deviations. Extensive experiments across seven state-of-the-art architectures demonstrate that TSFAdv achieves substantial performance gains, with median DTW improvements of 38.78\% and median SME improvements of 26.47\% under 200-query budget. These findings reveal that existing defense mechanisms are ineffective against frequency-domain manipulation, underscoring an urgent necessity for robust LTSF models.

AI-powered forecasting systems are widely used in critical applications like power grids and weather prediction. However, these systems can be vulnerable to subtle manipulations of their input data, a threat that remains largely unexplored. In this paper, we study how an attacker can fool a forecasting model by making small, carefully designed changes to the input, without knowing anything about how the model works internally. We discover that these models are particularly sensitive to certain patterns in the frequency domain, similar to how sounds have different frequencies. By exploiting these hidden weaknesses, our method can mislead forecasting models using far fewer queries than existing approaches. We also propose new ways to measure how badly a forecast is distorted. Our findings show that current defenses are ineffective against this type of attack, highlighting the urgent need for more robust forecasting systems.