Generating adversarial inputs for a graph neural network model of AC power flow

Technical Summary: Generating Adversarial Inputs for a Graph Neural Network Model of AC Power Flow

Problem Statement
Neural network (NN) surrogate models, including Graph Neural Networks (GNNs) and Physics-Informed Neural Networks (PINNs), are increasingly used to approximate solutions to Alternating Current Power Flow (ACPF) equations. While these models offer fast online inference suitable for power transmission dispatch, they are known to lack robustness against adversarial perturbations. In safety-critical domains like electric power transmission, this lack of robustness poses a significant risk. The central question addressed by this work is: Given a specific surrogate model for AC power flow, can input points be identified that yield large errors between the surrogate's output and the "ground truth" solution of the ACPF equations?

Methodology
The authors formulate and solve two distinct types of optimization problems to generate adversarial input points for the CANOS-PF GNN model (a state-of-the-art architecture implemented via the PF∆ benchmark library) operating on the IEEE 14-bus test system.

1. Maximum-Error Problem (Problem 1): This optimization maximizes the difference between a specific coordinate of the neural network's output ($y_{NN}$) and the corresponding coordinate of the ACPF solution ($y_{PF}$). The problem is bounded by input constraints ($L \le x \le U$) representing physical limits on power injections and voltage magnitudes. The authors solve instances with both maximization and minimization objectives to capture both positive and negative error deviations.
2. Constrained-Error Problem (Problem 2): This optimization seeks the smallest input perturbation from a reference training point ($x_0$) required to satisfy specific adversarial constraints. The constraints enforce a minimum difference ($\delta$) between the NN prediction and the ACPF solution for a specific output variable (e.g., voltage magnitude). Specifically, the problem forces the NN to predict a value within a feasible bound (e.g., $y_{NN,i} \ge l_i$) while the true ACPF solution violates that bound by at least $\delta$ (e.g., $y_{PF,i} \le l_i - \delta$).

Experimental Setup

• Model: CANOS-PF GNN with approximately 7.5 million trainable parameters, trained on the PF∆ Task-1.1 dataset (48,600 points) using a combination of Mean Squared Error (MSE) and Power Balance Loss (PBL).
• System: IEEE 14-bus test grid from PGLib-OPF.
• Constraints: Loads on PQ buses and reference bus variables were fixed. Degrees of freedom were limited to net active power injections and voltage magnitudes at PV buses.
• Solver: Optimization was performed using JuMP and IPOPT, interfacing with PyTorch via a GPU-accelerated gray-box formulation (MathOptAI.jl).

Key Results

• Maximum Errors: The study successfully identified input points causing significant discrepancies. The largest observed errors were 3.7 per-unit (p.u.) in reactive power and 0.08 p.u. in voltage magnitude.
  • Analysis indicated that voltage magnitude errors were systematically larger when maximizing errors compared to minimizing them, suggesting the model struggles to approximate solutions accurately when the true power flow yields relatively low voltages.
• Minimal Perturbations: For the constrained-error problem, the authors found that adversarial constraints could be met with very small perturbations. The smallest perturbation required was 0.04 p.u. in voltage magnitude on a single bus.
  • In 64 out of 90 attempted instances, the optimization converged to primal-feasible points.
  • The "0-norm" (number of perturbed input variables) was low; in most converged cases, perturbing two or fewer input variables was sufficient to generate the adversarial outcome.
  • Selected adversarial cases often required setting voltage magnitudes on PV buses close to their lower bounds (0.94 p.u.), suggesting the model's training data may lack sufficient coverage near these operational limits.
• Computational Performance: Despite the complexity of differentiating a GNN with non-differentiable ReLU layers (which technically violates IPOPT assumptions), the solver converged on 74% of the attempted problems. However, solve times were relatively high (averaging 92 seconds for Problem 1 and 14 seconds for Problem 2), dominated by function and derivative evaluations of the embedded neural network.

Significance and Claims
The paper positions itself as a proof-of-concept demonstrating that adversarial points can be systematically identified for state-of-the-art neural network models of AC power flow. The authors do not claim to have broken the model in a way that would immediately compromise grid operations, but rather highlight the existence of significant discrepancies that could be critical for grid operators.

The primary contribution is the formulation of tractable optimization problems that reveal these vulnerabilities in a GNN surrogate. The results motivate three specific areas for future research:

1. The development of rigorous verification methods for AC power flow surrogates.
2. The creation of robust training methodologies to improve model resilience.
3. The application of these adversarial testing methods to larger networks and additional neural network architectures.

The authors note that their results are conservative, as they fixed loads and line parameters; allowing these to vary as degrees of freedom would likely yield even more severe adversarial points.