Does Demand Response Increase Vulnerability to Cyber Attacks by Adversarial Data Modifications?

Technical Summary: Does Demand Response Increase Vulnerability to Cyber Attacks by Adversarial Data Modifications?

Problem Statement
Demand Response (DR) in industrial process industries relies on accurate electricity price forecasting (EPF) to optimize production schedules and reduce costs. While neural network-based forecasting models offer high accuracy, they are susceptible to adversarial attacks—subtle, crafted data manipulations that degrade model outputs while remaining difficult to detect. Although adversarial attacks on grid state estimation and load forecasting are well-studied, their impact on the decision-making processes of industrial DR remains under-explored. Specifically, it is unclear how manipulated price forecasts affect scheduling optimization, how different levels of process flexibility influence vulnerability, and whether the economic benefits of DR can be eroded by such attacks without being easily detected by human operators.

Methodology
The authors propose a framework to evaluate the vulnerability of industrial DR to adversarial attacks through a two-step process: EPF and DR scheduling optimization.

1. Electricity Price Forecasting (EPF): A Convolutional Neural Network (CNN) is trained on German day-ahead electricity market data (2023–2024) to predict hourly prices. The model utilizes inputs including day-ahead load, wind (onshore/offshore), and PV forecasts, as well as the previous day's prices.
2. Adversarial Attack Design: The study employs evasion attacks on the trained EPF model using the Basic Iterative Method (BIM). Two attack heuristics are compared:
   • Untargeted Attack (UA): Aims to maximize the deviation between the model output and the true target (approximated by the model output plus white noise).
   • Targeted (Mirror) Attack (TA): Aims to drag the forecast output toward a specific target vector. The target is constructed by mirroring the predicted price profile around the daily mean and amplifying the signal, intending to trick the scheduler into buying electricity during high-price periods.
   • Stealth Constraints: Attacks are constrained by an $L_\infty$ norm ($\epsilon$) to limit perturbation magnitude. Unphysical perturbations (e.g., negative solar generation at night) are filtered out to maintain stealth.
3. Generalized Process Model (GPM): To assess vulnerability across various industrial scenarios, the authors utilize a GPM representing energy-intensive processes (specifically electrolysis). The model includes constraints for nominal power intake, oversizing ($\theta_{add}$), minimal part-load, storage capacity, ramping limits, and efficiency losses. The scheduling objective is to minimize electricity costs based on the (potentially perturbed) price forecasts.
4. Case Studies: The framework is applied to a generalized process with varying flexibility levels and four specific electrolysis configurations: Aluminum, Copper, Chlor-alkali, and PEM water electrolysis.

Key Results

• Forecasting vs. Decision Impact: There is a decoupling between forecasting accuracy and decision-making quality. The untargeted attack induces significantly larger errors in the price forecast (higher MSE/MAE) compared to the mirror attack. However, the mirror attack causes substantially greater economic losses in the DR scheduling optimization. This is because the mirror attack alters the orientation of the price vector, shifting the optimal solution to a different vertex of the feasible polytope, whereas the untargeted attack often scales the price vector, which may not change the optimal basis of the linear program.
• Process Flexibility: Increasing process flexibility (e.g., higher oversizing) increases the absolute economic losses under attack but does not significantly alter the relative cost savings retained compared to steady-state operation. Even under severe attack rates, flexible processes retain approximately 90% of their financial advantage over steady-state operation, provided the attacks remain within "stealthy" bounds ($\epsilon \leq 0.1$).
• Attack Magnitude and Detectability: To completely erode the financial benefits of DR, attacks must exceed the stealth threshold ($\epsilon > 0.1$), where perturbations become easily detectable by human users due to significant deviations in input features.
• Seasonal Effects: The impact of attacks is seasonal. DR is more robust against attacks in summer months, where high solar production creates distinct price profiles that are harder to invert via the mirror heuristic. In winter months, DR potential is lower, and the relative impact of attacks is more pronounced.
• Non-Convexity: The study finds that the non-convexity introduced by mixed-integer variables (in processes allowing shutdowns, like PEM) does not fundamentally change the vulnerability trend compared to linear programs; the number of changes in integer variables correlates positively with attack rates similarly to continuous variables.

Significance and Claims
The paper argues that while industrial DR relies on external data and is theoretically vulnerable to adversarial manipulation, its practical financial benefits are robust against stealthy attacks. The authors claim that:

1. Robustness: DR preserves about 90% of its financial advantage over steady-state operation even when price forecasts are manipulated within limits that are hard for humans to detect.
2. Attack Design Sensitivity: The vulnerability of DR is not solely a function of prediction error magnitude but depends critically on the orientation of the adversarial perturbations relative to the optimization problem's sensitivities. Targeted attacks designed with knowledge of the scheduling problem's structure (like the mirror attack) are more potent than untargeted attacks.
3. Methodological Shift: The authors conclude that future attack analyses must explicitly incorporate the sensitivities of scheduling optimization models into the attack design to provide rigorous assessments of decision-making under adversarial conditions.
4. Limitations: The study focuses on white-box attacks on day-ahead markets. The authors note that in practice, attackers may only have access to black-box attacks, which are generally less potent, and that intraday markets were not investigated.

The paper does not claim that DR is immune to cyber threats, but rather that the specific economic benefits of DR are resilient to the specific class of stealthy adversarial attacks tested, and that the magnitude of errors required to negate these benefits would likely trigger human detection.