Skip to main content An official website of the United States government Here's how you know Here's how you know Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Lock Locked padlock icon ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. Search Log in Dashboard Publications Account settings Log out Search… Search NCBI Primary site navigation Search Logged in as: Dashboard Publications Account settings Log in Search PMC Full-Text Archive Search in PMC Journal List User Guide PERMALINK Copy As a library, NLM provides access to scientific literature. Inclusion in an NLM database does not imply endorsement of, or agreement with, the contents by NLM or the National Institutes of Health. Learn more: PMC Disclaimer | PMC Copyright Notice Sensors (Basel) . 2026 Mar 26;26(7):2073. doi: 10.3390/s26072073 Search in PMC Search in PubMed View in NLM Catalog Add to search Momentum-Based Adversarial Attacks and Multi-Level Denoising Defenses in Deep Learning-Based Wind Power Forecasting Yangming Min Yangming Min 1 College of Electrical Engineering, Guizhou University, Guiyang 550025, China Conceptualization, Formal analysis, Methodology, Software, Writing – original draft, Visualization, Data curation Find articles by Yangming Min 1 , Congmei Jiang Congmei Jiang 1 College of Electrical Engineering, Guizhou University, Guiyang 550025, China 2 Guizhou University Survey and Design Institute Co., Ltd., Guiyang 550025, China Validation, Methodology, Resources, Supervision, Writing – review & editing, Funding acquisition Find articles by Congmei Jiang 1, 2, * , Kang Yang Kang Yang 1 College of Electrical Engineering, Guizhou University, Guiyang 550025, China Methodology, Formal analysis, Data curation, Visualization Find articles by Kang Yang 1 , Xiankui Wen Xiankui Wen 3 Electric Power Science Research Institute of Guizhou Power Grid Co., Ltd., Guiyang 550002, China Investigation, Project administration Find articles by Xiankui Wen 3 , Kexin Chen Kexin Chen 1 College of Electrical Engineering, Guizhou University, Guiyang 550025, China Software, Data curation Find articles by Kexin Chen 1 Editors: Fabio Viola , Ilsun You Author information Article notes Copyright and License information 1 College of Electrical Engineering, Guizhou University, Guiyang 550025, China 2 Guizhou University Survey and Design Institute Co., Ltd., Guiyang 550025, China 3 Electric Power Science Research Institute of Guizhou Power Grid Co., Ltd., Guiyang 550002, China * Correspondence: [email protected] Roles Yangming Min : Conceptualization, Formal analysis, Methodology, Software, Writing – original draft, Visualization, Data curation Congmei Jiang : Validation, Methodology, Resources, Supervision, Writing – review & editing, Funding acquisition Kang Yang : Methodology, Formal analysis, Data curation, Visualization Xiankui Wen : Investigation, Project administration Kexin Chen : Software, Data curation Fabio Viola : Academic Editor Ilsun You : Academic Editor Received 2025 Dec 30; Revised 2026 Jan 28; Accepted 2026 Feb 12; Collection date 2026 Apr. © 2026 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license . PMC Copyright notice PMCID: PMC13074835 PMID: 41977860 Abstract Deep learning (DL) techniques have significantly advanced wind power forecasting by enhancing accuracy. However, these DL models are vulnerable to adversarial attacks, which can lead to severely inaccurate forecasts. Existing studies in wind power forecasting have rarely addressed the stealthiness and effectiveness of adversarial attacks simultaneously, nor have they investigated defense strategies against multiple perturbation strengths or in black-box scenarios. To this end, we propose an attack algorithm for wind power forecasting, i.e., the momentum iterative fast gradient sign method (MI-FGSM). This algorithm generates adversarial samples by incorporating momentum into the iterative process and adding perturbations to the input samples along the gradient direction. To defend against such attacks under varying perturbation strengths, a defense model called multi-level iterative denoising autoencoder (MLI-DAE) is proposed. MLI-DAE is trained using adversarial samples with multiple perturbation levels to effectively restore attacked inputs to their clean forms. Experimental results under both white-box and black-box scenarios demonstrate that MI-FGSM induces significantly larger forecast errors with smaller perturbation magnitudes compared to FGSM. Furthermore, our proposed MLI-DAE effectively defends against multi-level perturbations without compromising the original forecast accuracy. Keywords: adversarial attack, deep learning, multi-level iterative denoising autoencoder, momentum iterative fast gradient sign method, wind power forecasting 1. Introduction Conventional power generation’s heavy reliance on fossil fuels leads to environmental pollution and resource depletion and exacerbates global warming [ 1 ]. To mitigate these detrimental impacts and facilitate the transition towards a sustainable power system, renewable power generation has emerged as a crucial alternative [ 2 ]. Among these, wind energy has emerged as a widely used, environmentally friendly renewable resource for large-scale power generation [ 3 ]. However, wind power generation is subject to various factors such as wind speed, wind direction, and temperature, resulting in considerable randomness and variability [ 4 , 5 ]. Therefore, accurate wind power forecasting is essential for power management and planning, effectively enhancing the economic and social benefits of power systems [ 6 , 7 ]. In recent years, driven by the ongoing advancement of artificial intelligence, a myriad of machine learning (ML) techniques has been extensively applied to wind power forecasting [ 8 ]. Traditional ML forecasting models, such as support vector machine regression (SVR) [ 9 ], random forest [ 10 ], and autoregressive integrated moving average (ARIMA) [ 11 ], have been widely employed. However, these conventional techniques tend to be relatively simple and heavily reliant on manually engineered features, which can limit their predictive accuracy when dealing with complex and nonlinear wind power data. Recently, deep learning (DL) has emerged as the mainstream of ML, owing to its exceptional capacity to handle nonlinear mappings [ 12 , 13 , 14 ]. This inherent ability to automatically extract correlations between input samples and wind power output often results in more accurate forecasts [ 15 ]. Deep learning-based models, such as Long Short-Term Memory Networks (LSTMs) [ 16 ], Convolutional Neural Networks (CNNs) [ 17 ], Recurrent Neural Networks (RNNs) [ 18 ], Bidirectional Long Short-Term Memory (Bi-LSTM) [ 19 ], and Gated Recurrent Units (GRUs) [ 20 ], have wide application in wind power forecasting. Although DNN-based forecasting models have achieved high accuracy, their nonlinear nature also makes them vulnerable to adversarial attacks [ 21 , 22 , 23 ]. Input data such as wind speed, wind direction, and ambient temperature are critical to accurate forecasts and are typically obtained via online weather forecast application programming interfaces (APIs) [ 22 ]. During transmission over communication networks, such data may be intercepted or tampered with, exposing potential attack surfaces for adversarial manipulation [ 23 ]. If the input data used for wind power forecasting are compromised by such attacks, the resulting perturbations can lead to degradation in forecasting accuracy, which may have real-world consequences, including inaccurate dispatching, increased reserve requirements, and reduced economic benefits for wind farm operators. In Ref. [ 24 ], the fast gradient sign method (FGSM) is employed to attack wind speed and wind direction data. The experimental results demonstrate that FGSM outperforms the civil attack (CA) in reducing forecast accuracy. In Ref. [ 25 ], the projected gradient descent method is utilized to perform non-directional, semi-directional and fully directional attacks on wind power data, and the advantages of various attack methods are extensively studied. In Ref. [ 26 ], an attack strategy targeting external-factor data is proposed. This approach employs an attack sample selection model to improve stealthiness by selectively filtering the attack samples and an attack direction judgment model to enhance the attack effectiveness by determining the correct attack direction. In Ref. [ 27 ], a new attack algorithm, called the adversarial learning attack, is proposed for wind power forecasting. This algorithm stably optimizes the meteorological data into its adversarial patterns, effectively degrading the forecast accuracy. Although existing studies have demonstrated that wind power forecasting models are vulnerable to adversarial attacks, most research has not simultaneously addressed both the effectiveness and the stealthiness of attacks. To ensure the safe application of DNNs in wind power forecasting, it is crucial to investigate the defense algorithms. The adversarial training (AT) [ 25 , 28 ] is an advanced defense algorithm that improves the robustness of DNNs by retraining them on a mixed set comprising both adversarial and clean samples. In Ref. [ 29 ], SSA is used to attack DNN to generate adversarial PQD signals, and then the DNN performs adversarial training through these signals. However, traditional adversarial training often performs poorly when dealing with a range of perturbation strengths and can even degrade the model’s original forecast accuracy. In Ref. [ 30 ], the iterative adversarial training (IAT) is proposed in PQD classification. This method employs multiple perturbation training defense models, significantly enhancing the model’s ability to defend against attacks of varying perturbation strengths. The DAE method performs preprocessing before the forecasting model, effectively mitigating the impact of attacks without significantly compromising the original forecast accuracy [ 31 ]. In Ref. [ 32 ], the DAE defense is employed for preprocessing, effectively safeguarding deep learning-based power allocation models from adversarial attacks in massive MIMO systems without compromising original forecast accuracy. However, DAE performs optimally only in defending against an attack with a single strength. In wind power forecasting, there is little research on defense algorithms. In Ref. [ 24 ], a preprocessing framework for wind power forecasting is proposed to defend against adversarial attacks in the white-box environment. This method mitigates attacks by identifying perturbations in input samples and replacing corrupted samples with corresponding forecasted values. In Ref. [ 25 ], the effectiveness of adversarial training is validated in the field of wind power forecasting, emphasizing its capacity to enhance model robustness in the white-box environment. Currently, research on adversarial defenses in wind power forecasting has yet to explore the effectiveness of attacks involving multiple perturbation strengths. Additionally, existing studies have not explored the defense issues in the black-box environments. Overall, research on adversarial attacks and defenses in wind power forecasting remains limited, and the security aspects of this field warrant further in-depth investigation. Although momentum-based attacks, such as the momentum iterative fast gradient sign method (MI-FGSM), have been extensively studied in other domains, their application to wind power forecasting, along with the associated challenges, has not yet been adequately explored. In addition, existing studies have rarely investigated preprocessing-based defense strategies or considered defenses under multiple perturbation levels. Therefore, we propose a momentum-based adversarial attack method tailored for wind power forecasting and introduce a novel multi-layer iterative denoising autoencoder (MLI-DAE) as a defense mechanism. The MI-FGSM attack incorporates momentum into gradient information to generate adversarial samples, which ensures the stable convergence of original clean samples into stealthy and destructive adversarial samples. The MLI-DAE operates on the principle of iterative training. It first generates adversarial samples using multiple perturbation strengths. These are then combined with clean samples and sequentially fed into a denoising autoencoder (DAE) for iterative refinement. When strategically placed as a preprocessing module before the wind power forecasting model, the trained MLI-DAE effectively mitigates adversarial attacks across varying perturbation strengths. The framework of the entire process is depicted in Figure 1 . When the wind power forecasting system is subjected to adversarial attacks, the generated adversarial input samples may mislead the forecasting model into producing inaccurate forecasts, potentially causing the control center to issue wrong instructions. However, by leveraging the preprocessing capabilities of the MLI-DAE, these adversarial input samples can be reconstructed into their clean forms. This step enables the control center to maintain correct decision-making and ensure operational integrity. The primary contributions of this paper are outlined as follows: We propose an MI-FGSM attack algorithm for wind power forecasting. Compared to FGSM, MI-FGSM produces smaller perturbations to input samples while causing more substantial degradation in forecast accuracy in both white-box and black-box environments. We propose an MLI-DAE defense algorithm against adversarial attacks in wind power forecasting. Compared to the advanced AT, MLI-DAE more effectively mitigates forecast errors caused by adversarial attacks with multi-level perturbation strengths, while better maintaining the original accuracy of the forecasting model. The adversarial defense performance is systematically evaluated under both white-box and black-box attack scenarios in wind power forecasting. The defense model trained in the white-box environment maintains strong effectiveness against black-box attacks with different perturbation strengths, highlighting its generalization capability across diverse attack settings. Figure 1. Open in a new tab Adversarial attack and defense in wind power forecasting system. The remainder of the paper is structured as follows: Section 2 presents a comprehensive description of the DL-based wind power forecasting model. In Section 3 , we analyze the attack environments and objectives and provide a detailed description of the proposed attack algorithm. Section 4 provides an overview of the proposed defense algorithm. In Section 5 , we validate the effectiveness of the proposed attack and defense algorithms through a series of experiments, with a detailed comparison to existing methods. Section 6 summarizes the main conclusions of this study. 2. DL-Based Wind Power Forecasting 2.1. Forecasting Task DL-based wind power forecasting models typically leverage historical wind power data and relevant external factors to predict future wind power output. The complete historical dataset is generally divided into a training set and a testing set. The training set is denoted as D t r = { ( x t − h , … , x t − 1 ) ; P t + k } t = h T t r , where x t − i ( 1 ≤ i ≤ h , where h stands for the length of historical data) denotes the input samples. Each input sample x t − i includes wind speed ( x t − i w s ), wind direction ( x t − i w d ), ambient temperature ( x t − i E t ), and historical wind power data ( P t − i ), etc. P t + k represents the wind power output values corresponding to the input samples. The test set D t = { ( x t − h , … , x t − 1 ) ; P t + k } t = T t r + h + 1 T t consists of similar sample sets, which are used to assess the forecasting performance of the models. During the training process, we denote the forecasting model as f θ , which learns the mapping from the past time instances X t = ( x t − h , … , x t − 1 ) to the future wind power value P t + k . The loss function during training is defined as follows: L ( X t ) = min θ 1 T t r − h + 1 ∑ t = h T t r ∣ f θ ( X t ) − P t + k ∣ (1) where T t r represents the number of training samples, and θ represents the model parameter set. Through repeated training, the θ can be optimized to minimize the loss function L ( X t ) , thus improving forecast accuracy. The optimization process is as follows: θ n = θ n − 1 − η · ∇ θ L ( X t ) (2) where η denotes the learning rate and ∇ θ L ( X t ) represents the gradient of the loss function. 2.2. Forecasting Model Accurate short-term wind power forecasting is essential for the stable and efficient operation of power systems. With the continuous advancement of DL technology, these algorithms have shown remarkable performance in exploring the nonlinear relationships between external factors and wind power outputs in depth [ 15 ]. Among them, LSTM stands out for its ability to effectively capture long-term dependencies within sequential data through its gating mechanisms, making it highly effective for processing time series data [ 16 ]. This type of model has been widely employed in wind power forecasting and has demonstrated excellent performance (e.g., [ 13 , 16 , 33 ]). Additionally, existing studies [ 25 , 26 ] have adopted LSTM to investigate adversarial security in wind power forecasting. Therefore, this work employs this mature and well-validated model to evaluate the performance of the proposed attack and defense strategies. As detailed in Table 1 , our specific forecasting model structure comprises an LSTM layer followed by multiple fully connected layers. Table 1. Structure of the forecasting model. Model Type Layer Units Activation Optimizer Forecasting model LSTM 64 Tanh Adam Dense 64 ReLU Dense 32 ReLU Dense 16 Tanh Dense 1 Linear Open in a new tab As shown in Figure 2 , the core of the LSTM layer is comprised of three distinct gating mechanisms: a forget gate, an input gate, and an output gate. With the tuning of the forget gate, the LSTM can efficiently retain and propagate information on long sequences, thus capturing long-term dependencies. Given the input data x t , the cell state c t processes the time series through the following process: i t = σ ( W i · [ h t − 1 , x t ] + b i ) o t = σ ( W o · [ h t − 1 , x t ] + b o ) f t = σ ( W f · [ h t − 1 , x t ] + b f ) c t = f t + i t · tanh ( W c · [ h t − 1 , x t ] + b c ) h t = o t · tanh ( c t ) (3) where i t denotes the state of the input gate, o t denotes the state of the output gate, and f t denotes the state of the forget gate. W i , W o and W f are the weight matrices of the three gates, and b i , b o and b f are the corresponding bias vectors. σ represents the sigmoid activation function, and h t denotes the hidden state. Figure 2. Open in a new tab Structure of the LSTM layer. 3. Attack Algorithms 3.1. Attack Environment and Objective Adversarial attacks are generally categorized into white-box and black-box attacks [ 34 , 35 ], depending on the attacker’s level of knowledge and access to the target system [ 36 ]. In a white-box attack setting, the attacker has full knowledge of the forecasting model, including its architecture and parameters, and generates adversarial perturbations accordingly. This setting typically represents the worst-case attack scenario and is relevant in situations such as insider attacks, compromised cloud-based forecasting services, or leakage of deployed forecasting models. Evaluating this scenario allows us to assess the upper bound of vulnerability of wind power forecasting systems. In contrast, in a black-box attack setting, the attacker has only limited knowledge of the target model, which more closely reflects realistic attack conditions in practical applications. In this case, the attacker may train a substitute model using accessible historical wind power data and meteorological information, and exploit the transferability of adversarial perturbations to indirectly influence the target model [ 37 ]. In this black-box setting, the attacker is assumed to have no access to the target model’s internal architecture, parameters, or gradient information, and adversarial perturbations are generated solely based on the substitute model without querying gradients or internal states of the target system. To improve the attack success rate, an RNN—which shares architectural similarities with the LSTM—is employed as the substitute model. This architecture consists of an RNN layer and multiple fully connected layers. The specific structural parameters of the substitute model are detailed in Table 2 . Evaluating both white-box and black-box scenarios allows us to assess model security under both worst-case and realistic threat models, thereby providing a more comprehensive security analysis framework. Table 2. Structure of the substitute model. Model Type Layer Units Activation Optimizer Substitute model RNN 64 Tanh Adam Dense 64 ReLU Dense 32 ReLU Dense 16 Tanh Dense 1 Linear Open in a new tab The objective of the attackers is to create adversarial samples X ^ t by introducing adversarial perturbations in the neighborhoods of the input samples X t under given constraints. The goal of this manipulation is to maliciously induce the forecasting model to increase or decrease its predicted wind power output. Formally, the generation of these adversarial samples can be framed as solving the following optimization problem: L ( X t ) = max X t γ · f ( X t ^ ) subject to X t ^ = X t + δ X t ∥ δ X t ∥ p ≤ ϵ (4) where δ X t represents the adversarial perturbation, and ϵ denotes the perturbation strength. The γ denotes the directional factor: when γ = − 1 , attackers aim to maliciously decrease the predicted wind power; when γ = 1 , the objective is to maliciously increase the forecasts. To ensure the generated adversarial samples remain stealthy and evade the anomaly detection system, the magnitude of the perturbation is constrained by its L p -norm, such that ∥ δ ∥ p ≤ ϵ , where p ∈ { 0 , 1 , ∞ } are commonly adopted norms in adversarial attacks [ 38 , 39 ]. In this study, the adversarial perturbation is generated over the entire input time series as a unified sequence rather than independently at each time step, allowing the temporal dependency structure learned by the forecasting model to be preserved in the perturbation pattern. 3.2. Fast Gradient Sign Method FGSM is a simple but effective attack algorithm that utilizes single-step gradient information to create adversarial samples. Its principle involves introducing a single-step perturbation to the input samples along the direction of the loss function’s gradient, constrained by the L ∞ norm, to induce obvious forecast errors. The computational procedure for this attack is formulated as follows: δ X t = ϵ · s i g n ( ∇ X t L ( X ^ t ) ) X ^ t = X t + δ X t s u b j e c t t o δ X t ∞ ≤ ϵ (5) where s i g n ( · ) represents the sign function, and · ∞ denotes the L ∞ norm. The L ∞ norm constraint ensures that each element of the input samples is perturbed independently with limited magnitude. However, due to its single-step optimization along a fixed direction, FGSM often suffers from limited attack effectiveness and insufficient stealthiness. 3.3. The Proposed Attack Algorithm MI-FGSM is an iterative optimization-based attack that integrates momentum into the gradient update process. This mechanism stabilizes the update direction and mitigates the risk of converging to suboptimal local extrema. By accumulating gradients over multiple iterations, MI-FGSM identifies more effective perturbation directions, resulting in highly threatening adversarial samples [ 40 ]. Beyond its general efficacy, the momentum mechanism is particularly advantageous for wind power time series data. Unlike pixel data in image tasks, wind power time-series are continuous and exhibit strong temporal dependencies, requiring adversarial perturbations to be highly stealthy and temporally smooth. The momentum accumulation step stabilizes the gradient path, effectively preventing the perturbation from introducing abrupt, high-frequency spikes—a common artifact of non-momentum iterative methods. This stabilization ensures that MI-FGSM generates powerful yet highly concealed adversarial samples that preserve the physical smoothness of the input data, thus evading anomaly detection systems tailored for temporal irregularities. Specifically, the algorithm first uses a momentum term g to accumulate gradient information from the previous n − 1 iterations and the current iteration. Then, a momentum decay factor μ stabilizes the optimization direction. During each iteration, the perturbation is updated using a step size ϵ / N , and the gradient is normalized using its L 1 norm. The detailed computational procedure is as follows: g n = μ · g n − 1 + ∇ X t L ( X ^ t , n ) ∥ ∇ X t L ( X ^ t , n ) ∥ 1 δ n = ϵ N · sign ( g n ) subject to ∥ δ n ∥ ∞ ≤ ϵ X t , n = X t , n − 1 + δ n (6) where N denotes the number of iterations and sign ( · ) represents the sign function. The L ∞ norm constraint indicates that each element of the input samples is perturbed independently with limited magnitude. The implementation of MI-FGSM is shown in Algorithm 1. The initialization of this algorithm includes g 0 = 0 and X ^ t , 0 = X t . After N iterations, the algorithm can generate the adversarial sample X ^ t , N . Algorithm 1: The MI-FGSM attack against wind power forecasting Input : Forecasting model: f θ , Testing set: D t , Momentum decay factor: μ , Attack iteration number: N , Original input samples: X t , Perturbation strength: ϵ , Step size for each attack iteration: α = ϵ / N . Output : Set of the adversarial input sample: X ^ T , Adversarial wind power forecasts: P ^ t . 1 Initialize: g 0 ← 0 , X ^ t , 0 ← X t ; 2 for t = T t r + h + 1 to T t do 3 X t ← { x t − h , … , x t − 1 } ; 4 P ˜ t ← f θ ( X t ) ; 5 for n = 0 to N do 6 Update the momentum by accumulating gradients: 7 g n = μ · g n − 1 + ∇ X t L ( X ^ t , n ) ∥ ∇ X t L ( X ^ t , n ) ∥ 1 ; 8 Calculate adversarial perturbations: 9 δ n = α · sign ( g n ) ; 10 Introduce perturbations to input samples: 11 X ^ t , n = X ^ t , n − 1 + δ n ; 12 end for ; 13 X ^ T . append ( X ^ t , N ) ; 14 end for ; 15 P ^ t ← f θ ( X ^ T ) ; 16 return Set of the adversarial input sample: X ^ T , Adversarial wind power forecasts: P ^ t ; Open in a new tab 4. Defense Algorithm 4.1. DAE Defense Algorithm To ensure the secure deployment of DL models, an effective strategy is to remove adversarial perturbations through preprocessing, thereby restoring the original, clean samples [ 31 ]. DAE is an enhanced form of autoencoders designed to reconstruct noise-corrupted data by employing a denoising preprocessing process. By training on noisy inputs, DAE can map adversarial samples (viewed as “noisy” inputs) back to their clean forms [ 41 ]. As illustrated in Figure 3 , a DAE consists of an encoder and a decoder, both of which are constructed using fully connected layers. The encoder compresses the input samples into a latent representation, mapping from R 2 K L to R z through the following nonlinear transformation: q = σ ( W 1 · X DAE + b 1 ) (7) where q ∈ R z denotes the latent representation of the input sample, σ denotes the activation function, W 1 represents the weight matrix, and b 1 represents the bias vector. X DAE represents the input of the DAE, defined as X DAE ← concatenate ( X ^ t , X t ) . This is because the DAE should accurately reconstruct the original input samples to preserve the original accuracy of the forecasting model. Consequently, all original samples must be included in the training set. Figure 3. Open in a new tab Architecture of DAE. The decoder subsequently reconstructs the data from the latent representation back to the original input space: R z → R 2 K L , involving the following process: X ˜ = σ ( W 2 · q + b 2 ) (8) where W 2 represents the weight matrix, b 2 represents the bias vector, and X ˜ ∈ R 2 K L represents the reconstructed data. During the training phase, DAE utilizes the Adam optimization algorithm to minimize the reconstruction error. This error reflects the difference between the reconstructed samples and the original samples, and is calculated as follows: L ( X ˜ ) = min D 1 n ∑ i = 0 n ( X target , i − X ˜ i ) 2 (9) where n denotes the size of the training dataset, and X target , i represents the expected clean output of the DAE, defined as X target ← concatenate ( X t , X t ) . 4.2. The Proposed Defense Algorithm DAE typically exhibits excellent defense performance against single-level noise [ 42 ]. However, attackers can generate adversarial samples with diverse perturbation strengths, which may degrade the mapping accuracy learned by DAE. Therefore, we propose a defense model against multi-level perturbation attacks in wind power forecasting, called MLI-DAE. By iteratively training the DAE using adversarial samples with different perturbation strengths, MLI-DAE can adapt to attacks across multiple perturbation levels. Theoretically, this multi-level iterative training scheme significantly enhances the model’s generalization ability by progressively exposing the DAE to a wide spectrum of adversarial perturbation. A standard DAE trained on a single perturbation strength focuses on correcting a narrow range of noise, resulting in limited robustness. In contrast, the sequential training on increasingly strong adversarial samples forces the DAE to learn a more robust and stable mapping function. This ensures the model effectively captures the underlying structure of the clean data, even when perturbations are large or previously unseen, leading to significantly improved generalization and reliable reconstruction against multi-level attacks. Deployed as a preprocessing stage before the wind power forecasting model, the trained MLI-DAE effectively mitigates the impact of adversarial attacks. The detailed training procedure for MLI-DAE is outlined in Algorithm 2. This approach involves generating adversarial samples with varying perturbation strengths, which are then sequentially used to train the DAE. Specifically, we employ a gradually increasing noise strategy to generate adversarial samples, which are utilized iteratively to refine the DAE’s training. The training set consists of X DAE and X target , denoted as X DAE ← concatenate ( X ^ t , X t ) and X target ← concatenate ( X t , X t ) . Algorithm 2: Training Process of the MLI-DAE defense Input : Original input samples: X t , Adversarial input samples: X ^ t , Initial perturbation level: ϵ 0 , Perturbation increment step: Δ ϵ , Number of perturbation levels: M , Learning rate: β , Training epochs: K . Output : DAE model parameter set: D ( W 1 , 2 , b 1 , 2 ) 1 Initialize: ϵ ← ϵ 0 ; 2 for m = 0 to M do 3 ( Create adversarial samples: 4 x ^ = attack ( x , ϵ = ϵ m ) ; 5 Construct training dataset: 6 X DAE ← concatenate ( X ^ t , X t ) ; 7 X target ← concatenate ( X t , X t ) ; 8 Train the DAE defense model: 9 for k = 1 to K do 10 ( Encoding process: 11 q = σ ( W 1 · X DAE + b 1 ) ; 12 Decoding process: 13 X ˜ = σ ( W 2 · q + b 2 ) ; 14 Update model parameters: 15 D k = D k − 1 − β · ∇ D L ( X ˜ ) ; 16 end 17 ( ϵ m + 1 = ϵ m + Δ ϵ ; 18 end ( 19 return D ( W 1 , 2 , b 1 , 2 ) ; Open in a new tab 5. Case Studies 5.1. Dataset Description and Experimental Setup This study uses the SDWPF dataset [ 43 ], provided by Longyuan Power Group Co., Ltd., which gained prominence during the Baidu KDD Cup 2022. The dataset comprises records from 134 wind turbines over a 245-day period, incorporating features such as temperature, wind speed, and wind direction. The data are recorded at a 10-min resolution. Based on previous research, to evaluate the performance of the proposed methods, a wind turbine is randomly selected to evaluate the performance of the proposed attack and defense methods. Of the entire dataset, 80% is used as the training set, while the remaining 20% serves as the testing set. To improve model training, the callback function is utilized to optimize both the learning rate and the number of training epochs. The learning rate is initially set to 0.01 and dynamically adjusted using a decay strategy: if the loss value does not decrease over five consecutive iterations, the learning rate is reduced to one-tenth of its current value. The number of training epochs is initially set to 80, with an early stopping strategy applied: if the loss value does not decrease for 10 consecutive iterations, training is terminated early. The Adam optimizer is used for all experiments. All model training is conducted using TensorFlow and Keras in the environment equipped with NVIDIA GeForce RTX 3050 GPUs (NVIDIA: Santa Clara, CA, USA). 5.2. Analysis of Key Factors in the Attack Algorithm The MI-FGSM attack algorithm generates adversarial samples by integrating a momentum optimization mechanism into the iterative attack process, where the decay factor μ serves as a critical parameter. When μ = 0 , MI-FGSM loses its momentum effect and degenerates into the regular iterative attack, which may lead to overfitting of the adversarial samples and consequently degrade the attack performance. Therefore, we implemented black-box and white-box attacks on the test set to determine the optimal value of the decay factor in both environments. The decay factor μ is incrementally varied from 0 to 2 with a step size of 0.1, the perturbation strength ϵ is set to { 0.01 , 0.06 , 0.12 , 0.16 , 0.21 } , and the number of attack iterations N is set to 60. Figure 4 illustrates the attack performance under different momentum decay factors, using the mean absolute percentage error (MAPE) as the evaluation metric. As shown in Figure 4 a, the MAPE of the forecasting model under white-box attacks reaches its peak at μ = 0.9 across various perturbation strengths. Figure 4 b shows the MAPE of the forecasting model under the MI-FGSM black-box attacks. Under different perturbation strengths, the MAPE reaches its maximum value when μ = 0.7 . Therefore, we set μ = 0.9 in the white-box environment and μ = 0.7 in the black-box environment. Figure 4. Open in a new tab Performance of the MI-FGSM attack algorithm under different momentum decay factors: ( a ) MAPE of the forecasting model under the MI-FGSM white-box attack; ( b ) MAPE of the forecasting model under the MI-FGSM black-box attack. 5.3. Experimental Analysis of MI-FGSM in White-Box Environment In the white-box environment, attackers leverage full knowledge of the forecasting model’s architecture and parameters to execute the MI-FGSM attack. To visualize the impact of MI-FGSM on wind power forecasting, we show the forecast results post-attack in Figure 5 . As shown in Figure 5 a, when γ = 1 , by injecting adversarial samples with perturbation strengths of { 0.12 , 0.21 } into the forecasting model, the forecasted values can be maliciously increased, causing the forecast curves to deviate upward from the original curve. This deviation becomes increasingly pronounced as the perturbation strength grows. Figure 5 b demonstrates the scenario where γ = − 1 ; attackers maliciously decrease the wind power forecasts by introducing perturbations with strengths of { − 0.21 , − 0.12 } . This causes the forecast curves to deviate downward from the original curve, with the deviation becoming more pronounced as the perturbation strength increases. Figure 5. Open in a new tab Wind power forecasting under the MI-FGSM white-box attacks: ( a ) The impact of MI-FGSM ( ϵ = { 0.12 , 0.21 } ) on forecast curves when γ = 1 ; ( b ) The impact of MI-FGSM ( ϵ = { − 0.21 , − 0.12 } ) on forecast curves when γ = − 1 . To demonstrate the superiority of MI-FGSM, we conduct a comparative analysis with the FGSM baseline. The experimental parameters are set as follows: (1) For FGSM, the perturbation strength ϵ is selected from { − 0.2 , − 0.15 , − 0.1 , − 0.05 , − 0.01 , 0.01 , 0.05 , 0.1 , 0.15 , 0.2 } . (2) For MI-FGSM, μ is set to 0.9, the number of iterations N is set to 60, and ϵ follows the same range as in FGSM. The performance of these attack algorithms is evaluated from two dimensions: attack strength and stealthiness. The attack strength assesses the extent of forecast accuracy degradation, whereas attack stealthiness quantifies the magnitude of perturbations introduced to the input samples. To evaluate attack strength, MAPE is employed to quantify forecast errors under attacks, as shown in Table 3 . The results demonstrate that MI-FGSM outperforms FGSM in terms of attack potency under the same attack directions and perturbation strengths. For example, at a perturbation strength of 0.21, MI-FGSM yields a MAPE of 49.05%, significantly higher than the 38.61% produced by FGSM. When the perturbation strength is − 0.21 , MI-FGSM achieves a MAPE of 40.26% compared to 32.37% for FGSM. Table 3. Impact of white-box attacks on forecast results. White-Box Attacks Directional Factor MAPE (%) No Attack ϵ = 0.01 ϵ = 0.06 ϵ = 0.12 ϵ = 0.16 ϵ = 0.21 MI-FGSM γ = 1 12.92 15.93 22.03 31.28 39.56 49.05 γ = − 1 12.92 13.87 18.57 26.19 34.69 40.72 FGSM γ = 1 12.92 15.72 19.84 28.02 33.39 38.61 γ = − 1 12.92 13.31 15.93 22.87 29.42 33.67 Open in a new tab Stealthiness is a critical metric for evaluating the superiority of adversarial attack algorithms. Since excessive perturbations are susceptible to detection by anomaly detection systems [ 29 , 30 ], we quantified the perturbation percentage applied to input samples. Table 4 presents the perturbation percentages for two key input features: wind speed (WS) and wind direction (WD). The results demonstrate that MI-FGSM exhibits superior stealthiness compared to FGSM under the same perturbation strength. For instance, when ϵ = 0.21 , the perturbation percentages for WS and WD under FGSM are 26.91% and 29.13%, respectively; in contrast, MI-FGSM yields significantly lower values of 20.81% and 23.05%. This is because, during each iteration, the momentum mechanism of MI-FGSM guides the perturbation along the optimal attack direction, resulting in a smaller overall disturbance than that of the single-step FGSM. Table 4. Perturbation percentage of input feature under white-box attack. White-Box Attacks Input Feature Perturbation Percentage (%) ϵ = 0.01 ϵ = 0.06 ϵ = 0.12 ϵ = 0.16 ϵ = 0.21 MI-FGSM WS 1.58 7.86 12.75 16.76 20.81 WD 1.89 8.53 13.67 18.31 23.05 FGSM WS 1.61 9.12 16.58 20.84 26.91 WD 1.93 9.84 17.53 22.26 29.13 Open in a new tab Based on the analysis and comparison of experimental results in the white-box environment, it can be concluded that MI-FGSM causes the forecast curve to deviate from the original, leading to a marked decline in forecast accuracy. Compared to FGSM, MI-FGSM results in more significant forecast errors while introducing smaller perturbations to the input samples. 5.4. Experimental Analysis of MI-FGSM in Black-Box Environment Black-box attacks are among the most realistic and likely scenarios in practical applications [ 31 ]. In the black-box environment, adversarial samples generated by a substitute forecasting model are employed to attack the target forecasting model. Figure 6 illustrates the forecasting curves under perturbations with strengths of { − 0.21 , − 0.12 , 0.12 , 0.21 } . As shown in Figure 6 a, when γ = 1 , the forecast curve shifts upward relative to the original, with deviations becoming more pronounced as the perturbation strength increases. Conversely, Figure 6 b demonstrates that when γ = − 1 , the forecast curve shifts downward, with deviations similarly amplifying alongside greater perturbation strengths. These findings indicate that MI-FGSM black-box attacks significantly deteriorate forecast accuracy, highlighting the strong transferability of the generated adversarial samples. Figure 6. Open in a new tab Wind power forecasting under the MI-FGSM black-box attacks: ( a ) The impact of MI-FGSM ( ϵ = { 0.12 , 0.21 } ) on forecast curves when γ = 1 ; ( b ) The impact of MI-FGSM ( ϵ = { − 0.21 , − 0.12 } ) on forecast curves when γ = − 1 . To facilitate a comparative analysis in the black-box environment, the parameter configurations are kept consistent with Section 5.2 , with the exception of the MI-FGSM momentum decay factor μ , which is set to 0.7. Table 5 summarizes the impact of MI-FGSM and FGSM on forecasting performance. It is evident that, under the same attack direction and perturbation strength, MI-FGSM more effectively reduces forecast errors. For instance, when ϵ is 0.20 , MI-FGSM results in a MAPE of 33.82%, compared to 29.12% for FGSM; similarly, at ϵ = − 0.20 , MI-FGSM yields a MAPE of 26.44%, whereas FGSM results in 23.63%. These findings indicate that MI-FGSM possesses superior transferability in black-box scenarios, potentially posing a severe threat to the forecasting systems. Furthermore, a comparison with Table 3 reveals that black-box attacks are notably less effective than white-box attacks under equivalent conditions. This is due to the differences in the training parameters and structure between the substitute model and the original model. Table 5. Impact of black-box attacks on forecast results. Black-Box Attacks Directional Factor MAPE (%) No Attack ϵ = 0.01 ϵ = 0.06 ϵ = 0.12 ϵ = 0.16 ϵ = 0.21 MI-FGSM γ = 1 12.92 13.76 16.63 20.41 27.18 33.82 γ = − 1 12.92 13.28 15.32 18.27 22.87 26.44 FGSM γ = 1 12.92 13.71 15.96 19.07 24.63 29.12 γ = − 1 12.92 13.23 14.95 17.64 20.79 23.63 Open in a new tab We further investigate the stealthiness of black-box attacks. Table 6 compares the perturbation percentages for WS and WD induced by MI-FGSM and FGSM. It is evident that MI-FGSM modifies the data to a lesser extent, demonstrating superior stealthiness. For instance, when ϵ = 0.21 , the perturbation percentages for WS and WD under FGSM are 33.81% and 36.48%, respectively; in contrast, MI-FGSM yields significantly lower values of 25.11% and 27.95%. Table 6. Perturbation percentage of input feature under black-box attack. Black-Box Attacks Input Feature Perturbation Percentage (%) ϵ = 0.01 ϵ = 0.06 ϵ = 0.12 ϵ = 0.16 ϵ = 0.21 MI-FGSM WS 1.67 9.49 16.31 20.59 25.11 WD 1.95 10.03 17.19 22.17 27.95 FGSM WS 1.72 10.22 19.97 26.23 33.81 WD 2.13 10.96 21.02 27.69 36.48 Open in a new tab Based on the analysis and comparison of experimental results in the black-box environment, it can be concluded that MI-FGSM exhibits excellent ability of adversarial sample migration, causing the forecast curves to deviate from the original curve. Compared to FGSM, MI-FGSM leads to a greater increase in forecast errors, indicating its stronger black-box transferability. Additionally, MI-FGSM generates smaller perturbations to input samples, highlighting its excellent stealthiness. 5.5. The Defense Performance of MLI-DAE in the White-Box Environment The procedure of the proposed MLI-DAE is shown in Algorithm 2. To evaluate the effectiveness of the MLI-DAE defense algorithm, we designed two training schemes, named MLI-DAE-5 and MLI-DAE-8, to select the optimal defense model. For MLI-DAE-5, the specific parameters are as follows: The training epoch K is set to 50, the learning rate δ is 0.001, the activation function is set to linear, and the optimizer is set to SGD. The iterative training process is repeated five times. In each iteration, adversarial samples generated by the MI-FGSM white-box attack are used for training, with the perturbation strength ϵ increasing from 0.01 to 0.21 in five steps (step size of 0.04). For MLI-DAE-8, the number of iteration training is increased to 8. By extending the number of training epochs and reducing the step size, the model can learn more comprehensive perturbation features. All other procedures remain consistent with those of MLI-DAE-5. To demonstrate the advantages of MLI-DAE against multi-level perturbations, a traditional DAE is trained as a baseline using MI-FGSM white-box samples with a perturbation strength of 0.12. The evaluation focused on two aspects: MLI-DAE’s efficacy in restoring forecast accuracy under attack and its ability to preserve the original forecast performance on clean data. Table 7 summarizes the effectiveness of various defense mechanisms in enhancing forecast accuracy. Due to space constraints and the high degree of similarity in defense performance across different attack directions, only the results for γ = 1 are reported. It is evident that the proposed MLI-DAE algorithm significantly mitigates forecast errors induced by MI-FGSM white-box attacks, demonstrating robust defensive capabilities. Compared to the traditional DAE, MLI-DAE consistently exhibits superior performance across all perturbation strengths, whereas the baseline DAE struggles to withstand multi-level adversarial samples. For example, when the perturbation strength is 0.21, MLI-DAE-5 and MLI-DAE-8 reduce the MAPE from 49.05% to 18.68% and 22.34%, respectively, while the traditional DAE only achieves a reduction to 29.11%. Consequently, MLI-DAE is a more suitable defense model for wind power forecasting. Notably, MLI-DAE-5 outperforms MLI-DAE-8 in error reduction across various perturbation strengths. This performance gap may stem from an overfitting issue of the latter scheme; the increased number of iterations and the simultaneous exposure to a wider variety of perturbation strengths may reduce the model’s generalization ability, leading to the slightly lower defense efficiency observed in MLI-DAE-8. Table 7. Impact of defense algorithms on forecast results in the white-box environments. Perturbation Strength Defense Algorithms No Defense MLI-DAE-5 MLI-DAE-8 DAE ϵ = 0 12.93% 13.33% 13.56% 14.04% ϵ = 0.01 15.93% 13.95% 13.75% 14.31% ϵ = 0.06 22.03% 14.45% 14.87% 14.93% ϵ = 0.12 31.28% 15.31% 16.01% 15.23% ϵ = 0.16 39.56% 16.58% 18.23% 22.46% ϵ = 0.21 49.05% 18.68% 22.34% 29.11% Open in a new tab To evaluate the impact of MLI-DAE and DAE on original forecast accuracy, the forecasting model equipped with defense algorithms is used to predict the original input samples, and the forecast errors are shown in Table 7 (row ϵ = 0 ). Following preprocessing by MLI-DAE-5 and MLI-DAE-8, the MAPE increased by only 0.40% and 0.63%, respectively, whereas the implementation of the traditional DAE led to a more significant MAPE increase of 1.11%. These results indicate that MLI-DAE more effectively retains the original forecast accuracy in the absence of perturbations compared to DAE. To provide an intuitive visualization of the defense efficacy of MLI-DAE-5, Figure 7 shows the forecast curves under the MI-FGSM white-box attack with a perturbation strength of 0.21. As observed, the attack causes a noticeable deviation in the forecast curves from the original curve. Through the preprocessing stage of MLI-DAE-5, the wind power forecasts, which are maliciously manipulated by MI-FGSM, are effectively restored. The result demonstrates that MLI-DAE can robustly defend against MI-FGSM white-box attacks. Figure 7. Open in a new tab Wind power forecast results with the MLI-DAE defense against the MI-FGSM white-box attack. Based on the analysis and comparison of experimental results in the white-box environment, it can be concluded that MLI-DAE possesses exceptional defense efficacy, effectively restoring the attacked forecast curve. Compared to DAE, MLI-DAE more effectively reduces the forecast errors caused by the MI-FGSM white-box attacks, while better preserving the original forecast accuracy. 5.6. The Defense Performance of MLI-DAE in the Black-Box Environment To evaluate the performance of the MLI-DAE defense algorithm in the black-box environment, we employed the MLI-DAE model trained in a white-box environment to resist black-box attacks. As illustrated in Table 8 , the MLI-DAE model, trained against MI-FGSM white-box perturbations, maintains remarkable efficacy against black-box attacks generated by the same strategy. Compared to DAE, the MLI-DAE also demonstrates superior defense capabilities across various perturbation levels. For instance, when the perturbation strength is 0.21, MLI-DAE-5 and MLI-DAE-8 reduce the MAPE from 33.82% to 24.42% and 27.79%, respectively, whereas DAE only reduces the MAPE to 32.15%. Furthermore, consistent with the white-box results, MLI-DAE-5 more significantly reduces the post-attack forecast errors than MLI-DAE-8, thereby offering better defense performance. However, as observed in Table 6 and Table 8 , the performance of the MLI-DAE decreases in the black-box environment compared to the white-box environment. This is because the MLI-DAE is trained in the white-box environment, while the adversarial samples generated by the MI-FGSM black-box attacks are not included in the training set, thereby reducing the performance of the MLI-DAE in the black-box environment. Table 8. Impact of defense algorithms on forecast results in the black-box environments. Perturbation Strength Defense Algorithms No Defense MLI-DAE-5 MLI-DAE-8 DAE ϵ = 0.01 13.76% 14.29% 14.84% 15.56% ϵ = 0.06 16.63% 15.37% 15.51% 16.14% ϵ = 0.12 20.41% 17.26% 19.52% 18.73% ϵ = 0.16 27.18% 20.77% 23.47% 25.27% ϵ = 0.21 33.82% 24.42% 27.79% 32.15% Open in a new tab To provide an intuitive visualization of the defense performance of MLI-DAE-5, Figure 8 illustrates the forecast curves under the MI-FGSM black-box attack with a perturbation strength of 0.21. The MLI-DAE-5 effectively restores the attacked forecast curves to be close to the original curve, demonstrating its effectiveness in the black-box environment. Figure 8. Open in a new tab Wind power forecast results with the MLI-DAE defense against the MI-FGSM black-box attack. Based on the analysis and comparison of experimental results in the black-box environment, it can be concluded that the MLI-DAE defense algorithm trained in the white-box environment can resist the MI-FGSM black-box attacks, effectively restoring the attacked forecast curve. Compared to DAE, MLI-DAE achieves a more substantial reduction in forecast errors across various perturbation magnitudes. These results highlight the excellent generalization capability of MLI-DAE in the black-box environment. 6. Conclusions In this study, an MI-FGSM attack algorithm and an MLI-DAE defense algorithm are proposed for wind power forecasting. The MI-FGSM attack algorithm utilizes the momentum optimization during attack iterations to generate stealthy, high-quality adversarial samples. The MLI-DAE defense algorithm employs an iteratively trained DAE as a preprocessor, effectively mapping adversarial examples back to their clean forms. The performance of both algorithms is evaluated through extensive experiments in both white-box and black-box environments. Experimental evaluations demonstrate that MI-FGSM causes the forecast curves to deviate upward or downward from the original curve, with the deviation becoming more pronounced as the perturbation strength increases. Compared to FGSM, MI-FGSM achieves greater degradation in forecast accuracy, induces smaller perturbations to input samples, and generates adversarial samples with stronger black-box transferability. In terms of defense, MLI-DAE effectively mitigates the impact of MI-FGSM attacks, significantly restoring the attacked forecast curves. Moreover, the MLI-DAE defense algorithm trained in the white-box environment also demonstrates strong resistance against black-box attacks, indicating its excellent generalizability in the black-box environment. Compared to DAE, MLI-DAE outperforms in reducing forecast errors caused by the MI-FGSM attacks, while hardly affecting the original forecast accuracy. In future work, we aim to investigate the detection algorithms for adversarial attacks in wind power forecasting, with the goal of developing a comprehensive system that includes attacks, detections, and defenses. Furthermore, a detailed analysis of the computational overhead and inference latency of the MLI-DAE defense is warranted to ensure its practical applicability in real-time forecasting environments. Author Contributions Conceptualization, Y.M.; methodology, Y.M., C.J., and K.Y.; software, Y.M. and X.W.; validation, C.J.; formal analysis, Y.M., K.Y., and X.W.; investigation, K.C.; resources, C.J.; data curation, Y.M., K.Y., and X.W.; writing—original draft preparation, Y.M.; writing—review and editing, C.J.; visualization, Y.M. and K.Y.; supervision, C.J.; project administration, K.C.; funding acquisition, C.J. All authors have read and agreed to the published version of the manuscript. Institutional Review Board Statement Not applicable. Informed Consent Statement Not applicable. Data Availability Statement The dataset used in this study is publicly available. The complete dataset can be accessed at: https://doi.org/10.1038/s41597-024-03427-5 . Conflicts of Interest Author Xiankui Wen was employed by the company Electric Power Science Research Institute of Guizhou Power Grid Co., Ltd., author Congmei Jiang was employed by the company Guizhou University Survey and Design Institute Co., Ltd. The remaining authors declare that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest. Funding Statement This work was supported by the Science and Technology Project of Guizhou Province under Grant QianKeHeJiChu MS[2026]157; the Scientific Research Foundation of Guizhou University under Grant GuiDaJiChu [2023]10; and the Innovation Fund of Guizhou University Institute of Engineering Investigation & Design Co., Ltd., under Grant GuiDaKanCha [2022]02. Footnotes Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. References 1. Suman A. Role of renewable energy technologies in climate change adaptation and mitigation: A brief review from nepal. Renew. Sustain. Energy Rev. 2021;151:111524. doi: 10.1016/j.rser.2021.111524. [ DOI ] [ Google Scholar ] 2. Boadu S., Otoo E. A comprehensive review on wind energy in africa: Challenges, benefits and recommendations. Renew. Sustain. Energy Rev. 2024;191:114035. doi: 10.1016/j.rser.2023.114035. [ DOI ] [ Google Scholar ] 3. Shahbazi R., Kouravand S., Hassan-Beygi R. Analysis of wind turbine usage in greenhouses: Wind resource assessment, distributed generation of electricity and environmental protection. Energy Sources Part A. 2023;45:7846–7866. doi: 10.1080/15567036.2019.1677810. [ DOI ] [ Google Scholar ] 4. Sun S., Du Z., Jin K., Li H., Wang S. Spatiotemporal wind power forecasting approach based on multi-factor extraction method and an indirect strategy. Appl. Energy. 2023;350:121749. doi: 10.1016/j.apenergy.2023.121749. [ DOI ] [ Google Scholar ] 5. Han S., He M., Zhao Z., Chen D., Xu B., Jurasz J., Liu F., Zheng H. Overcoming the uncertainty and volatility of wind power: Day-ahead scheduling of hydro-wind hybrid power generation system by coordinating power regulation and frequency response flexibility. Appl. Energy. 2023;333:120555. doi: 10.1016/j.apenergy.2022.120555. [ DOI ] [ Google Scholar ] 6. Muneeb M. Lstm input timestep optimization using simulated annealing for wind power predictions. PLoS ONE. 2022;17:e275649. doi: 10.1371/journal.pone.0275649. [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 7. Bashir T., Wang H., Tahir M., Zhang Y. Wind and solar power forecasting based on hybrid cnn-abilstm, cnn-transformer-mlp models. Renew. Energy. 2025;239:122055. doi: 10.1016/j.renene.2024.122055. [ DOI ] [ Google Scholar ] 8. Karaman Ö.A. Prediction of wind power with machine learning models. Appl. Sci. 2023;13:11455. doi: 10.3390/app132011455. [ DOI ] [ Google Scholar ] 9. Dowell J., Pinson P. Very-short-term probabilistic wind power forecasts by sparse vector autoregression. IEEE Trans. Smart Grid. 2015;7:763–770. doi: 10.1109/TSG.2015.2424078. [ DOI ] [ Google Scholar ] 10. Lahouar A., Slama J.B.H. Hour-ahead wind power forecast based on random forests. Renew. Energy. 2017;109:529–541. doi: 10.1016/j.renene.2017.03.064. [ DOI ] [ Google Scholar ] 11. Singh P.K., Singh N., Negi R. Ambient Communications and Computer Systems. Springer; Singapore: 2019. Wind power forecasting using hybrid arima-ann technique; pp. 209–220. [ Google Scholar ] 12. Zhang J., Zhao Z., Yan J., Cheng P. Ultra-short-term wind power forecasting based on cgan-cnn-lstm model supported by lidar. Sensors. 2023;23:4369. doi: 10.3390/s23094369. [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 13. Shahid F., Zameer A., Muneeb M. A novel genetic lstm model for wind power forecast. Energy. 2021;223:120069. doi: 10.1016/j.energy.2021.120069. [ DOI ] [ Google Scholar ] 14. Wu Q., Guan F., Lv C., Huang Y. Ultra-short-term multi-step wind power forecasting based on cnn-lstm. IET Renew. Power Gener. 2021;15:1019–1029. doi: 10.1049/rpg2.12085. [ DOI ] [ Google Scholar ] 15. Zhao Z., Yun S., Jia L., Guo J., Meng Y., He N., Li X., Shi J., Yang L. Hybrid vmd-cnn-gru-based model for short-term forecasting of wind power considering spatio-temporal features. Eng. Appl. Artif. Intell. 2023;121:105982. doi: 10.1016/j.engappai.2023.105982. [ DOI ] [ Google Scholar ] 16. Liu X., Zhou J. Short-term wind power forecasting based on multivariate/multi-step lstm with temporal feature attention mechanism. Appl. Soft Comput. 2024;150:111050. doi: 10.1016/j.asoc.2023.111050. [ DOI ] [ Google Scholar ] 17. Mulewa S., Parmar A., De A. A novel bagged-cnn architecture for short-term wind power forecasting. Int. J. Green Energy. 2024;21:2712–2723. doi: 10.1080/15435075.2024.2326052. [ DOI ] [ Google Scholar ] 18. Kisvari A., Lin Z., Liu X. Wind power forecasting–a data-driven method along with gated recurrent neural network. Renew. Energy. 2021;163:1895–1909. doi: 10.1016/j.renene.2020.10.119. [ DOI ] [ Google Scholar ] 19. Ahmadi M., Aly H., Khashei M. Enhancing power grid stability with a hybrid framework for wind power forecasting: Integrating kalman filtering, deep residual learning, and bidirectional lstm. Energy. 2025;334:137752. doi: 10.1016/j.energy.2025.137752. [ DOI ] [ Google Scholar ] 20. Xia M., Shao H., Ma X., de Silva C.W. A stacked gru-rnn-based approach for predicting renewable energy and electricity load for smart grid operation. IEEE Trans. Ind. Inform. 2021;17:7050–7059. doi: 10.1109/TII.2021.3056867. [ DOI ] [ Google Scholar ] 21. Akhtar N., Mian A. Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access. 2018;6:14410–14430. doi: 10.1109/ACCESS.2018.2807385. [ DOI ] [ Google Scholar ] 22. Chen Y., Tan Y., Zhang B. Proceedings of the Tenth ACM International Conference on Future Energy Systems. Association for Computing Machinery; New York, NY, USA: 2019. Exploiting vulnerabilities of load forecasting through adversarial attacks; pp. 1–11. [ Google Scholar ] 23. Ahmadi A., Nabipour M., Taheri S., Mohammadi-Ivatloo B., Vahidinasab V. A new false data injection attack detection model for cyberattack resilient energy forecasting. IEEE Trans. Ind. Inform. 2022;19:371–381. doi: 10.1109/TII.2022.3151748. [ DOI ] [ Google Scholar ] 24. Akter K., Rahman M.A., Islam M.R., Sheikh M.R.I., Hossain M.J. Attack-resilient framework for wind power forecasting against civil and adversarial attacks. Electr. Power Syst. Res. 2025;238:111065. doi: 10.1016/j.epsr.2024.111065. [ DOI ] [ Google Scholar ] 25. Heinrich R., Scholz C., Vogt S., Lehna M. Targeted adversarial attacks on wind power forecasts. Mach. Learn. 2024;113:863–889. doi: 10.1007/s10994-023-06396-9. [ DOI ] [ Google Scholar ] 26. Jiao R., Han Z., Liu X., Zhou C., Du M. A gradient-based wind power forecasting attack method considering point and direction selection. IEEE Trans. Smart Grid. 2023;15:3178–3192. doi: 10.1109/TSG.2023.3325390. [ DOI ] [ Google Scholar ] 27. Ruan J., Wang Q., Chen S., Lyu H., Liang G., Zhao J., Dong Z.Y. On vulnerability of renewable energy forecasting: Adversarial learning attacks. IEEE Trans. Ind. Inform. 2023;20:3650–3663. doi: 10.1109/TII.2023.3313526. [ DOI ] [ Google Scholar ] 28. Tian J., Wang B., Guo R., Wang Z., Cao K., Wang X. Adversarial attacks and defenses for deep-learning-based unmanned aerial vehicles. IEEE Internet Things J. 2021;9:22399–22409. doi: 10.1109/JIOT.2021.3111024. [ DOI ] [ Google Scholar ] 29. Tian J., Wang B., Li J., Wang Z. Adversarial attacks and defense for cnn based power quality recognition in smart grid. IEEE Trans. Netw. Sci. Eng. 2021;9:807–819. doi: 10.1109/TNSE.2021.3135565. [ DOI ] [ Google Scholar ] 30. Zhang L., Jiang C., Chai Z., He Y. Adversarial attack and training for deep neural network based power quality disturbance classification. Eng. Appl. Artif. Intell. 2024;127:107245. doi: 10.1016/j.engappai.2023.107245. [ DOI ] [ Google Scholar ] 31. Sahay R., Mahfuz R., El Gamal A. 2019 53rd Annual Conference on Information Sciences and Systems (CISS) IEEE; Piscataway, NJ, USA: 2019. Combatting adversarial attacks through denoising and dimensionality reduction: A cascaded autoencoder approach; pp. 1–6. [ Google Scholar ] 32. Sahay R., Zhang M., Love D.J., Brinton C.G. Defending adversarial attacks on deep learning-based power allocation in massive mimo using denoising autoencoders. IEEE Trans. Cogn. Commun. Netw. 2023;9:913–926. doi: 10.1109/TCCN.2023.3261307. [ DOI ] [ Google Scholar ] 33. Liu Z.H., Wang C.T., Wei H.L., Zeng B., Li M., Song X.P. A wavelet-lstm model for short-term wind power forecasting using wind farm scada data. Expert Syst. Appl. 2024;247:123237. doi: 10.1016/j.eswa.2024.123237. [ DOI ] [ Google Scholar ] 34. Ren K., Zheng T., Qin Z., Liu X. Adversarial attacks and defenses in deep learning. Engineering. 2020;6:346–360. doi: 10.1016/j.eng.2019.12.012. [ DOI ] [ Google Scholar ] 35. Guo C., Gardner J., You Y., Wilson A.G., Weinberger K. Simple black-box adversarial attacks; Proceedings of the International Conference on Machine Learning (ICML); Long Beach, CA, USA. 9–15 June 2019; pp. 2484–2493. [ Google Scholar ] 36. Carlini N., Wagner D. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP) IEEE; Piscataway, NJ, USA: 2017. Towards evaluating the robustness of neural networks; pp. 39–57. [ Google Scholar ] 37. Suryanto N., Kang H., Kim Y., Yun Y., Larasati H.T., Kim H. A distributed black-box adversarial attack based on multi-group particle swarm optimization. Sensors. 2020;20:7158. doi: 10.3390/s20247158. [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 38. Goodfellow I.J., Shlens J., Szegedy C. Explaining and harnessing adversarial examples. arXiv. 20141412.6572 [ Google Scholar ] 39. Kotyan S., Vargas D.V. Adversarial robustness assessment: Why in evaluation both l0 and l∞ attacks are necessary. PLoS ONE. 2022;17:e265723. doi: 10.1371/journal.pone.0265723. [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 40. Dong Y., Liao F., Pang T., Su H., Zhu J., Hu X., Li J. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) IEEE; Piscataway, NJ, USA: 2018. Boosting adversarial attacks with momentum; pp. 9185–9193. [ Google Scholar ] 41. Kwon H., Kim Y., Park K., Yoon H., Choi D. Multi-targeted adversarial example in evasion attack on deep neural network. IEEE Access. 2018;6:46084–46096. doi: 10.1109/ACCESS.2018.2866197. [ DOI ] [ Google Scholar ] 42. Zhang L., Jiang C., Pang A. Black-box attacks and defense for dnn-based power quality classification in smart grid. Energy Rep. 2022;8:12203–12214. doi: 10.1016/j.egyr.2022.09.032. [ DOI ] [ Google Scholar ] 43. Zhou J., Lu X., Xiao Y., Tang J., Su J., Li Y., Liu J., Lyu J., Ma Y., Dou D. Sdwpf: A dataset for spatial dynamic wind power forecasting over a large turbine array. Sci. Data. 2024;11:649. doi: 10.1038/s41597-024-03427-5. [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] Associated Data This section collects any data citations, data availability statements, or supplementary materials included in this article. Data Availability Statement The dataset used in this study is publicly available. The complete dataset can be accessed at: https://doi.org/10.1038/s41597-024-03427-5 . Articles from Sensors (Basel, Switzerland) are provided here courtesy of Multidisciplinary Digital Publishing Institute (MDPI) ACTIONS View on publisher site PDF (1.4 MB) Cite Collections Permalink PERMALINK Copy RESOURCES Similar articles Cited by other articles Links to NCBI Databases Cite Copy Download .nbib .nbib Format: AMA APA MLA NLM Add to Collections Create a new collection Add to an existing collection Name your collection * Choose a collection Unable to load your collection due to an error Please try again Add Cancel Follow NCBI NCBI on X (formerly known as Twitter) NCBI on Facebook NCBI on LinkedIn NCBI on GitHub NCBI RSS feed Connect with NLM NLM on X (formerly known as Twitter) NLM on Facebook NLM on YouTube National Library of Medicine 8600 Rockville Pike Bethesda, MD 20894 Web Policies FOIA HHS Vulnerability Disclosure Help Accessibility Careers NLM NIH HHS USA.gov Back to Top