On the Sensitivity of Deep Load Disaggregation to Adversarial Attacks

TL;DR

This paper demonstrates that deep load disaggregation models, especially Sequence-to-Point, are vulnerable to adversarial attacks like FGSM, significantly reducing their accuracy and raising security concerns in energy management systems.

Contribution

It is the first to analyze the susceptibility of CNN-based NILM models to adversarial noise, highlighting critical security vulnerabilities.

Findings

Sequence-to-Point model's F1-score drops by 20% under attack

Both models are vulnerable to FGSM perturbations

Adversarial noise can mislead load disaggregation significantly

Abstract

Non-intrusive Load Monitoring (NILM) algorithms, commonly referred to as load disaggregation algorithms, are fundamental tools for effective energy management. Despite the success of deep models in load disaggregation, they face various challenges, particularly those pertaining to privacy and security. This paper investigates the sensitivity of prominent deep NILM baselines to adversarial attacks, which have proven to be a significant threat in domains such as computer vision and speech recognition. Adversarial attacks entail the introduction of imperceptible noise into the input data with the aim of misleading the neural network into generating erroneous outputs. We investigate the Fast Gradient Sign Method (FGSM), a well-known adversarial attack, to perturb the input sequences fed into two commonly employed CNN-based NILM baselines: the Sequence-to-Sequence (S2S) and Sequence-to-Point (S2P) models. Our findings provide compelling evidence for the vulnerability of these models, particularly the S2P model which exhibits an average decline of 20\% in the F1-score even with small amounts of noise. Such weakness has the potential to generate profound implications for energy management systems in residential and industrial sectors reliant on NILM models.