FABLE: A Localized, Targeted Adversarial Attack on Weather Forecasting Models
Pith reviewed 2026-05-22 14:01 UTC · model grok-4.3
The pith
FABLE uses wavelet decomposition to create localized adversarial inputs that steer deep learning weather forecasts to targeted outcomes.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
FABLE performs a 3D discrete wavelet decomposition to disentangle the spatial and temporal components of the data. By regulating the magnitude of adversarial perturbations across different components, FABLE produces adversarial inputs that remain closely aligned with the original inputs while steering the DLWF models toward generating the targeted forecast outcomes. Experimental results on real-world weather datasets demonstrate the effectiveness of FABLE over baseline methods across various metrics.
What carries the argument
3D discrete wavelet decomposition that separates spatial and temporal components, combined with separate control over perturbation magnitudes in each component to enable targeted steering of model outputs.
If this is right
- Adversarial inputs can achieve specific forecast targets while staying closely aligned with original weather data.
- The approach works without access to the internal details of the DLWF model being attacked.
- Localized control via wavelets improves attack success compared with standard perturbation methods on these models.
- DLWF models may need new robustness techniques focused on multi-scale spatial-temporal features.
Where Pith is reading between the lines
- Similar wavelet-based localization could be tested on other spatio-temporal forecasting tasks such as traffic or energy prediction.
- Operational weather systems might incorporate wavelet-domain checks to detect subtle input manipulations.
- The separation of components suggests a path to more interpretable robustness testing in environmental deep learning models.
Load-bearing premise
Regulating perturbation magnitudes separately across wavelet components will reliably produce targeted forecast changes without requiring model-specific knowledge or breaking the physical plausibility of the input data.
What would settle it
Running FABLE on a DLWF model with a chosen target forecast and finding that the output forecast does not shift to the target or that the perturbed input shows clear physical inconsistencies with real weather patterns.
Figures
read the original abstract
Deep learning-based weather forecasting (DLWF) models have recently demonstrated significant performance gains over gold-standard physics-based simulation tools. However, these models are potentially vulnerable to adversarial attacks, which raises concerns about their trustworthiness. In this paper, we investigate the feasibility and challenges of applying existing adversarial attack methods to DLWF models and propose a novel framework called FABLE (Forecast Alteration By Localized targeted advErsarial attack) to address them. FABLE performs a 3D discrete wavelet decomposition to disentangle the spatial and temporal components of the data. By regulating the magnitude of adversarial perturbations across different components, FABLE produces adversarial inputs that remain closely aligned with the original inputs while steering the DLWF models toward generating the targeted forecast outcomes. Experimental results on real-world weather datasets demonstrate the effectiveness of FABLE over baseline methods across various metrics.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript introduces FABLE, a framework for localized targeted adversarial attacks on deep learning-based weather forecasting (DLWF) models. It performs 3D discrete wavelet decomposition to disentangle spatial and temporal components of input data, then regulates the magnitude of perturbations separately across these components to generate adversarial examples that remain close to the originals while steering the DLWF model outputs toward specified target forecasts. The authors report that experiments on real-world weather datasets demonstrate FABLE's effectiveness relative to baseline attack methods across multiple metrics.
Significance. If the empirical claims hold after addressing the points below, the work is significant because DLWF models are increasingly competitive with physics-based simulators yet their robustness has received limited attention. The wavelet-based localization offers a structured way to control perturbations that may better respect the multi-scale nature of meteorological fields than generic L_p attacks. The manuscript earns credit for conducting the evaluation on real-world datasets rather than synthetic data alone.
major comments (2)
- [§3.2] §3.2 (FABLE framework): the central mechanism of independently bounding perturbation magnitudes per wavelet component is presented as sufficient to produce targeted forecast changes while preserving physical plausibility, yet the text provides no description of post-inverse-transform verification for meteorological constraints (e.g., non-negative precipitation, approximate mass conservation). This assumption is load-bearing for the claim that the generated inputs remain physically realistic.
- [§4] §4 (Experimental setup) and Table 1: the superiority over baselines is asserted across metrics, but the section does not report error bars, the number of random seeds, or the precise implementation details (e.g., whether baselines were re-implemented with the same wavelet preprocessing or used their original code). Without these, the quantitative advantage cannot be assessed reliably.
minor comments (2)
- [Abstract] The abstract would be strengthened by including at least one concrete quantitative result (e.g., a success rate or perturbation norm) rather than the qualitative statement of effectiveness.
- [§3.1] Notation for the 3D discrete wavelet coefficients and the per-component magnitude bounds should be introduced with an explicit equation or table to avoid ambiguity when reading the perturbation regulation step.
Simulated Author's Rebuttal
We thank the referee for their constructive and detailed feedback on our manuscript. We address each major comment point by point below, indicating the revisions we plan to incorporate to strengthen the work.
read point-by-point responses
-
Referee: [§3.2] §3.2 (FABLE framework): the central mechanism of independently bounding perturbation magnitudes per wavelet component is presented as sufficient to produce targeted forecast changes while preserving physical plausibility, yet the text provides no description of post-inverse-transform verification for meteorological constraints (e.g., non-negative precipitation, approximate mass conservation). This assumption is load-bearing for the claim that the generated inputs remain physically realistic.
Authors: We agree that the manuscript does not include an explicit description of post-inverse-transform verification for meteorological constraints. While the 3D wavelet decomposition and per-component magnitude bounding are intended to produce localized, small perturbations that remain close to the original inputs (thereby implicitly respecting physical properties such as non-negativity in precipitation fields), we acknowledge that this is not sufficient without verification. In the revised manuscript we will add a dedicated paragraph in §3.2 that describes the post-processing checks performed after the inverse transform, including clipping of negative precipitation values to zero and a simple mass-conservation diagnostic on integrated fields, along with any observed impact on attack success rates. revision: yes
-
Referee: [§4] §4 (Experimental setup) and Table 1: the superiority over baselines is asserted across metrics, but the section does not report error bars, the number of random seeds, or the precise implementation details (e.g., whether baselines were re-implemented with the same wavelet preprocessing or used their original code). Without these, the quantitative advantage cannot be assessed reliably.
Authors: We concur that the absence of error bars, seed counts, and baseline implementation details limits the interpretability of Table 1. The experiments were run with multiple random seeds and the baselines were re-implemented from their original public code but evaluated on the identical real-world datasets and preprocessing pipeline (without forcing wavelet decomposition onto methods that do not use it). In the revision we will (i) add error bars (standard deviation across seeds) to all metrics in Table 1, (ii) state that results are averaged over five independent random seeds, and (iii) expand the implementation subsection to clarify exactly how each baseline was obtained and executed. revision: yes
Circularity Check
No circularity: FABLE is an empirical method proposal validated by experiments
full rationale
The paper proposes FABLE, a framework that applies 3D discrete wavelet decomposition to weather data and regulates perturbation magnitudes across components to create targeted adversarial inputs for DLWF models. All central claims rest on experimental results comparing FABLE to baselines across metrics on real-world datasets. No equations, derivations, or first-principles results are presented that reduce by construction to fitted parameters, self-defined quantities, or self-citation chains. The method is self-contained as a practical attack design whose success is measured externally rather than tautologically.
Axiom & Free-Parameter Ledger
free parameters (1)
- per-component perturbation magnitude bounds
axioms (1)
- domain assumption 3D discrete wavelet decomposition cleanly separates spatial and temporal frequency components in weather data without significant information loss for the forecasting task.
Lean theorems connected to this paper
-
IndisputableMonolith/Foundation/AlexanderDuality.leanalexander_duality_circle_linking echoes?
echoesECHOES: this paper passage has the same mathematical shape or conceptual pattern as the Recognition theorem, but is not a direct formal dependency.
FABLE performs a 3D discrete wavelet decomposition... yields 8 frequency sub-bands—1 low-frequency component (LLL), 6 mixed-frequency components... and 1 high-frequency component (HHH).
-
IndisputableMonolith/Cost/FunctionalEquation.leanwashburn_uniqueness_aczel unclear?
unclearRelation between the paper passage and the cited Recognition theorem.
By regulating the magnitude of adversarial perturbations across different components... larger magnitudes of perturbations on high-frequency components
What do these tags mean?
- matches
- The paper's claim is directly supported by a theorem in the formal canon.
- supports
- The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
- extends
- The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
- uses
- The paper appears to rely on the theorem as machinery.
- contradicts
- The paper's claim conflicts with a theorem or certificate in the canon.
- unclear
- Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.
Forward citations
Cited by 2 Pith papers
-
Guided Diffusion Sampling for Precipitation Forecast Interventions
Gradient-guided diffusion sampling reduces extreme precipitation forecasts in data-driven weather models while producing more physically plausible changes than adversarial perturbations.
-
Adversarial Attacks on Downstream Weather Forecasting Models: Application to Tropical Cyclone Trajectory Prediction
Cyc-Attack uses a differentiable surrogate for TC detection, a skewness-aware loss, and gradient weighting to perturb DLWF inputs and steer downstream TC trajectory predictions toward specified targets with higher suc...
Reference graph
Works this paper leans on
-
[1]
Earthformer: exploring space-time transformers for earth system forecasting,
Z. Gao, X. Shi, H. Wang, Y . Zhu, Y . B. Wang, M. Li, and D.-Y . Yeung, “Earthformer: exploring space-time transformers for earth system forecasting,”Advances in Neural Information Processing Systems, vol. 35, pp. 25 390–25 403, 2022
work page 2022
-
[2]
Conditional local convolution for spatio-temporal meteorological forecasting,
H. Lin, Z. Gao, Y . Xu, L. Wu, L. Li, and S. Z. Li, “Conditional local convolution for spatio-temporal meteorological forecasting,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, no. 7, 2022, pp. 7470–7478
work page 2022
-
[3]
Learning skillful medium-range global weather forecasting,
R. Lam, A. Sanchez-Gonzalez, M. Willson, P. Wirnsberger, M. Fortunato, F. Alet, S. Ravuri, T. Ewalds, Z. Eaton-Rosen, W. Huet al., “Learning skillful medium-range global weather forecasting,”Science, vol. 382, no. 6677, pp. 1416–1421, 2023
work page 2023
-
[4]
Accurate medium- range global weather forecasting with 3d neural networks,
K. Bi, L. Xie, H. Zhang, X. Chen, X. Gu, and Q. Tian, “Accurate medium- range global weather forecasting with 3d neural networks,”Nature, vol. 619, no. 7970, pp. 533–538, 2023
work page 2023
-
[5]
Adversarial Attacks and Defences: A Survey
A. Chakraborty, M. Alam, V . Dey, A. Chattopadhyay, and D. Mukhopad- hyay, “Adversarial attacks and defences: a survey,”ArXiv Preprint ArXiv:1810.00069, 2018
work page internal anchor Pith review Pith/arXiv arXiv 2018
-
[6]
Targeted adversarial attacks on wind power forecasts,
R. Heinrich, C. Scholz, S. V ogt, and M. Lehna, “Targeted adversarial attacks on wind power forecasts,”Machine Learning, vol. 113, no. 2, pp. 863–889, 2024
work page 2024
-
[7]
K. E. Mitchell, D. Lohmann, P. R. Houser, E. F. Wood, J. C. Schaake, A. Robock, B. A. Cosgrove, J. Sheffield, Q. Duan, L. Luoet al., “The multi-institution north american land data assimilation system (nldas): Utilizing multiple gcip products and partners in a continental distributed hydrological modeling system,”Journal of Geophysical Research: Atmospher...
work page 2004
-
[8]
Explaining and Harnessing Adversarial Examples
I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”ArXiv Preprint ArXiv:1412.6572, 2014
work page internal anchor Pith review Pith/arXiv arXiv 2014
-
[9]
Towards Deep Learning Models Resistant to Adversarial Attacks
A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,”ArXiv Preprint ArXiv:1706.06083, 2017
work page internal anchor Pith review Pith/arXiv arXiv 2017
-
[10]
J. C ˆot´e, S. Gravel, A. M ´ethot, A. Patoine, M. Roch, and A. Staniforth, “The operational cmc–mrb global environmental multiscale (gem) model. part i: Design considerations and formulation,”Monthly Weather Review, vol. 126, no. 6, pp. 1373–1395, 1998
work page 1998
-
[11]
A description of the advanced research wrf version 3,
W. C. Skamarock, J. B. Klemp, J. Dudhia, D. O. Gill, D. M. Barker, M. G. Duda, X.-Y . Huang, W. Wang, J. G. Powerset al., “A description of the advanced research wrf version 3,”NCAR Technical Note, vol. 475, no. 125, pp. 10–5065, 2008
work page 2008
-
[12]
H. Hersbach, B. Bell, P. Berrisford, S. Hirahara, A. Hor ´anyi, J. Mu ˜noz- Sabater, J. Nicolas, C. Peubey, R. Radu, D. Scheperset al., “The era5 global reanalysis,”Quarterly Journal of the Royal Meteorological Society, vol. 146, no. 730, pp. 1999–2049, 2020
work page 1999
-
[13]
Probabilistic weather forecasting with machine learning,
I. Price, A. Sanchez-Gonzalez, F. Alet, T. R. Andersson, A. El-Kadi, D. Masters, T. Ewalds, J. Stott, S. Mohamed, P. Battagliaet al., “Probabilistic weather forecasting with machine learning,”Nature, vol. 637, no. 8044, pp. 84–90, 2025
work page 2025
-
[14]
Spatiotemporal vision transformer for short time weather forecasting,
A. Bojesomo, H. Al-Marzouqi, and P. Liatsis, “Spatiotemporal vision transformer for short time weather forecasting,” in2021 IEEE Interna- tional Conference on Big Data (Big Data). IEEE, 2021, pp. 5741–5746
work page 2021
-
[15]
Spatiotemporal swin-transformer network for short time weather fore- casting
A. Bojesomo, H. Al-Marzouqi, P. Liatsis, G. Cong, and M. Ramanath, “Spatiotemporal swin-transformer network for short time weather fore- casting.” inCIKM Workshops, 2021
work page 2021
-
[16]
A. Bojesomo, H. AlMarzouqi, and P. Liatsis, “A novel transformer network with shifted window cross-attention for spatiotemporal weather forecasting,”IEEE Journal of Selected Topics in Applied Earth Observa- tions and Remote Sensing, 2023
work page 2023
-
[17]
Deep- extrema: a deep learning approach for forecasting block maxima in time series data,
A. H. Galib, A. McDonald, T. Wilson, L. Luo, and P.-N. Tan, “Deep- extrema: a deep learning approach for forecasting block maxima in time series data,”In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI, 2022
work page 2022
-
[18]
Boosting adversarial attacks with momentum,
Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018, pp. 9185–9193
work page 2018
-
[19]
Practical adversarial attacks on spa- tiotemporal traffic forecasting models,
F. Liu, H. Liu, and W. Jiang, “Practical adversarial attacks on spa- tiotemporal traffic forecasting models,”Advances in Neural Information Processing Systems, vol. 35, pp. 19 035–19 047, 2022
work page 2022
-
[20]
Imperceptible adversarial attack via invertible neural networks,
Z. Chen, Z. Wang, J.-J. Huang, W. Zhao, X. Liu, and D. Guan, “Imperceptible adversarial attack via invertible neural networks,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 1, 2023, pp. 414–424
work page 2023
-
[21]
Efficient robustness assessment via adversarial spatial-temporal focus on videos,
X. Wei, S. Wang, and H. Yan, “Efficient robustness assessment via adversarial spatial-temporal focus on videos,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 9, pp. 10 898– 10 912, 2023
work page 2023
-
[22]
G. Wu, Y . Xu, J. Li, Z. Shi, and X. Liu, “Imperceptible adversarial attack with multi-granular spatio-temporal attention for video action recognition,”IEEE Internet of Things Journal, 2023
work page 2023
-
[23]
A gradient-based wind power forecasting attack method considering point and direction selection,
R. Jiao, Z. Han, X. Liu, C. Zhou, and M. Du, “A gradient-based wind power forecasting attack method considering point and direction selection,” IEEE Transactions on Smart Grid, 2023
work page 2023
-
[24]
On vulnerability of renewable energy forecasting: adversarial learning attacks,
J. Ruan, Q. Wang, S. Chen, H. Lyu, G. Liang, J. Zhao, and Z. Y . Dong, “On vulnerability of renewable energy forecasting: adversarial learning attacks,”IEEE Transactions on Industrial Informatics, 2023
work page 2023
-
[25]
Adversarial diffusion attacks on graph-based traffic prediction models,
L. Zhu, K. Feng, Z. Pu, and W. Ma, “Adversarial diffusion attacks on graph-based traffic prediction models,”IEEE Internet of Things Journal, 2023
work page 2023
-
[26]
Evaluating adversarial attacks on federated learning for temperature forecasting,
K. Chichifoi, F. Merizzi, and M. Colajanni, “Evaluating adversarial attacks on federated learning for temperature forecasting,”arXiv preprint arXiv:2512.13207, 2025
-
[27]
Adversarial observations in weather forecasting,
E. Imgrund, T. Eisenhofer, and K. Rieck, “Adversarial observations in weather forecasting,” inProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, 2025, pp. 3579– 3590
work page 2025
-
[28]
Forecasting fails: Unveiling evasion attacks in weather prediction models,
H. Arif, P.-Y . Chen, A. Gittens, J. Diffenderfer, and B. Kailkhura, “Forecasting fails: Unveiling evasion attacks in weather prediction models,” arXiv preprint arXiv:2512.08832, 2025
-
[29]
Notes on continuous stochastic phenomena,
P. A. Moran, “Notes on continuous stochastic phenomena,”Biometrika, vol. 37, no. 1/2, pp. 17–23, 1950
work page 1950
-
[30]
P. J. Brockwell and R. A. Davis,Introduction to time series and forecasting. Springer, 2002
work page 2002
-
[31]
J. Pathak, S. Subramanian, P. Harrington, S. Raja, A. Chattopadhyay, M. Mardani, T. Kurth, D. Hall, Z. Li, K. Azizzadenesheliet al., “Fourcastnet: A global data-driven high-resolution weather model using adaptive fourier neural operators,”arXiv preprint arXiv:2202.11214, 2022
work page internal anchor Pith review Pith/arXiv arXiv 2022
-
[32]
A foundation model for the earth system,
C. Bodnar, W. P. Bruinsma, A. Lucic, M. Stanley, A. Allen, J. Brandstetter, P. Garvan, M. Riechert, J. A. Weyn, H. Donget al., “A foundation model for the earth system,”Nature, pp. 1–8, 2025
work page 2025
-
[33]
Prithvi wxc: Foundation model for weather and climate.arXiv preprint arXiv:2409.13598, 2024
J. Schmude, S. Roy, W. Trojak, J. Jakubik, D. S. Civitarese, S. Singh, J. Kuehnert, K. Ankur, A. Gupta, C. E. Phillipset al., “Prithvi wxc: Foun- dation model for weather and climate,”arXiv preprint arXiv:2409.13598, 2024
-
[34]
Lower bounds on adversarial robustness from optimal transport,
A. N. Bhagoji, D. Cullina, and P. Mittal, “Lower bounds on adversarial robustness from optimal transport,”Advances in Neural Information Processing Systems, vol. 32, 2019
work page 2019
-
[35]
On Evaluating Adversarial Robustness
N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, A. Madry, and A. Kurakin, “On evaluating adversarial robustness,”arXiv preprint arXiv:1902.06705, 2019
work page internal anchor Pith review Pith/arXiv arXiv 1902
-
[36]
Towards the worst-case robustness of large language models,
H. Chen, Y . Dong, Z. Wei, H. Su, and J. Zhu, “Towards the worst-case robustness of large language models,”arXiv preprint arXiv:2501.19040, 2025
-
[37]
L. Debnath and F. A. Shah,Wavelet transforms and their applications. Springer, 2015, vol. 434
work page 2015
-
[38]
Adam: A Method for Stochastic Optimization
D. P. Kingma, “Adam: a method for stochastic optimization,”ArXiv Preprint ArXiv:1412.6980, 2014
work page internal anchor Pith review Pith/arXiv arXiv 2014
-
[39]
H. Abdi and L. J. Williams, “Principal component analysis,”Wiley interdisciplinary reviews: computational statistics, vol. 2, no. 4, pp. 433–459, 2010
work page 2010
-
[40]
F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in2008 eighth ieee international conference on data mining. IEEE, 2008, pp. 413–422
work page 2008
-
[41]
Lof: identifying density-based local outliers,
M. M. Breunig, H.-P. Kriegel, R. T. Ng, and J. Sander, “Lof: identifying density-based local outliers,” inProceedings of the 2000 ACM SIGMOD international conference on Management of data, 2000, pp. 93–104
work page 2000
-
[42]
Regularizing autoencoders with wavelet transform for sequence anomaly detection,
Y . Yao, J. Ma, and Y . Ye, “Regularizing autoencoders with wavelet transform for sequence anomaly detection,”Pattern Recognition, vol. 134, p. 109084, 2023. 13 APPENDIXA HAARWAVELETTRANSFORM Section III-B presents the decomposition of a one- dimensional signal using the discrete wavelet transform with the Haar wavelet basis. In this section, we extend th...
work page 2023
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.