Does Demand Response Increase Vulnerability to Cyber Attacks by Adversarial Data Modifications?

# Does Demand Response Increase Vulnerability to Cyber Attacks by Adversarial Data Modifications?
Source: [https://arxiv.org/html/2607.06632](https://arxiv.org/html/2607.06632)
Clemens Kortmann Process Systems Engineering \(AVT\.SVT\) RWTH Aachen University clemens\.kortmann@rwth\-aachen\.de &Eike Cramer Department of Chemical Engineering Sargent Centre for Process Systems Engineering University College London eike\.cramer@alumni\.tu\-berlin\.de Corresponding author

###### Abstract

Adversarial attacks are crafted data manipulations that aim to deteriorate the outcomes of prediction or decision\-making algorithms\. In the energy systems literature, adversarial attacks have been studied with a focus on problems regarding the electricity grid\. Such problems include forecasting and grid state estimation, where adversarial attacks are also known as false data injection attacks\. Only few studies have analyzed the potential impact that adversarial attacks have on the demand side\. We analyze how manipulated price forecasts impact the decision\-making in industrial demand response\. To this end, we design adversarial attacks that aim to deteriorate the output of electricity price forecasting models and solve scheduling optimization problems of energy\-intensive production processes using the distorted price forecasts\. We make use of a generalized process model to investigate the vulnerability to adversarial attacks for a range of production scheduling problems with different levels of process flexibility\. We find that adversarial attacks can erode the profits gained from demand response\. However, when perturbations are limited in extent \(so that they are hard to detect by the human user\), demand response preserves about 90% of its financial advantage compared to steady\-state process operation\. Further, we find that the impact of adversarial attacks on demand response does not only depend on the magnitude of the perturbations but rather on the orientation of the adversarial perturbations\. Therefore, we argue that attack analyses should explicitly incorporate the sensitivities of scheduling optimization models into the attack design to enable more rigorous assessments of decision\-making under adversarial attacks\.

## 1Introduction

The volatility of renewable energy sources introduces fluctuations in energy generation\. Demand response \(DR\) encompasses the management of flexible electricity demand and is expected to help balancing supply and demand while posing economic benefits to electricity consumers\[[1](https://arxiv.org/html/2607.06632#bib.bib1)\]\. We focus on non\-dispatchable DR, which is to shift production in time to optimize resource costs based on electricity price signals while ensuring safe operation and meeting product demands\. In this regard, DR requires forecasting algorithms to provide accurate predictions of volatile system parameters like generation, demand, or prices to determine optimal operating decisions\[[2](https://arxiv.org/html/2607.06632#bib.bib2)\]\.

Due to their increasing accuracy, neural network\-based forecasting models are superseeding traditional statistical forecasting approaches\[[3](https://arxiv.org/html/2607.06632#bib.bib3)\]\. However, their high number of parameters and poor extrapolation abilities can make neural networks prone to adversarial attacks\[[4](https://arxiv.org/html/2607.06632#bib.bib4)\]\. Adversarial attacks are crafted data manipulations that cause a model to produce erroneous outputs while remaining hard to distinguish from benign data\. In energy systems literature, adversarial attacks are also known as false data injection attacks\[[5](https://arxiv.org/html/2607.06632#bib.bib5)\]\. While the terms adversarial attacks and false data injection attacks are often used interchangeably, the term adversarial attacks originates from machine learning \(ML\) literature\[[4](https://arxiv.org/html/2607.06632#bib.bib4)\]while false data injection attacks were originally introduced in the context of grid state estimation\[[5](https://arxiv.org/html/2607.06632#bib.bib5)\]\. For the sake of clarity, we use the term adversarial attack in this paper\. Adversarial attacks can cause malicious effects in energy systems and are therefore a major concern regarding future energy systems with interconnected devices and autonomous decision\-making algorithms\[[6](https://arxiv.org/html/2607.06632#bib.bib6)\]\. Adversarial attacks can manipulate locational marginal prices in energy markets\[[7](https://arxiv.org/html/2607.06632#bib.bib7),[8](https://arxiv.org/html/2607.06632#bib.bib8)\]and compromise state estimation algorithms in the electricity grid\[[9](https://arxiv.org/html/2607.06632#bib.bib9)\]\. Due to the possible negative impacts of adversarial attacks, a plethora of methods for the detection of adversarial attacks has been proposed\[[10](https://arxiv.org/html/2607.06632#bib.bib10)\]\.

Adversarial attacks on ML models in energy systems have attracted considerable research attention in recent years\. In seminal work, Chen et al\.\[[11](https://arxiv.org/html/2607.06632#bib.bib11)\]demonstrated the susceptibility of ML models in energy systems to adversarial attacks\. The authors show case studies in power quality classification and building load foreacasting and observe significant decreases in ML model performance under adversarial attacks\. Rahman et al\.\[[12](https://arxiv.org/html/2607.06632#bib.bib12)\]review forecasting algorithms in energy systems and their resilience to cyber attacks\. The authors identify six application areas of forecasting algorithms in energy grids, namely load forecasting, generation forecasting, forecasting in transmission and distribution, forecasting in energy markets, critical event forecasting, and forecasting in attack detection\. Chen et al\.\[[13](https://arxiv.org/html/2607.06632#bib.bib13)\]investigate adversarial attacks on load forecasting models in power systems and find that black\-box adversarial attacks can have significant negative effects on forecasting performance and power system operations\. Ruan et al\.\[[14](https://arxiv.org/html/2607.06632#bib.bib14)\]explore the vulnerability of photovoltaic \(PV\) and wind power forecasting algorithms\. They also analyze resulting degradations and impacts on optimal power flow problems\. Their results reveal high economic losses as well as potential instabilities in the power grid as a consequence of manipulated forecasts\. Tang et al\.\[[15](https://arxiv.org/html/2607.06632#bib.bib15)\]study adversarial attacks on solar power forecasts and find that gradient\-based attack schemes are able to cause strong deviations in the forecasting of solar intensity\. The authors further show that adversarial training enhances the forecasting robustness while reducing forecasting accuracy\. The effect that adversarial training enhances robustness while reducing accuracy was also found by Heinrich et al\.\[[16](https://arxiv.org/html/2607.06632#bib.bib16)\], who investigate adversarial attacks and adversarial training for wind power forecasts\. The problem of wind power forecasting was further investigated by Yang et al\.\[[17](https://arxiv.org/html/2607.06632#bib.bib17)\], who find that wind forecasting models are especially prone to adversarial attacks in times of high wind speeds\. Chen et al\.\[[18](https://arxiv.org/html/2607.06632#bib.bib18)\]propose an adversarial attack on power system inertia forecasting\. They find that adversarial attacks on inertia forecasting can significantly increase power system operation costs\. These studies reveal the potential threat of adversarial attacks on forecasting algorithms in energy systems\.

While many studies investigate adversarial attacks on power, load, and generation forecasting, the area of manipulated energy price forecasting \(EPF\) remains rather unexplored\[[12](https://arxiv.org/html/2607.06632#bib.bib12)\], albeit being crucial for use cases like industrial DR and many others\. Industrial DR deals with energy\-flexible production in the process industries\[[19](https://arxiv.org/html/2607.06632#bib.bib19)\]\. The process industries are a major consumer of electricity and a therefore a major actor in DR\. The role of the process industries in the electricity market is becoming more significant due to an increase in electrolysis processes and electric heating, as electrification of industrial processes is a major aspect in reducing industrial carbon emissions and increase energy system sustainability\[[20](https://arxiv.org/html/2607.06632#bib.bib20)\]\.

The economic potential of industrial DR has been studied in a range of research articles\. For example, Brée et al\.\[[21](https://arxiv.org/html/2607.06632#bib.bib21)\]and Otashu and Baldea\[[22](https://arxiv.org/html/2607.06632#bib.bib22)\]find substantial economic potential for the energy\-flexible operation of chlor\-alkali production processes\. Röben et al\.\[[23](https://arxiv.org/html/2607.06632#bib.bib23)\]study DR strategies for copper electrolysis, while Schäfer\[[24](https://arxiv.org/html/2607.06632#bib.bib24)\]identify economic benefits of industrial DR for aluminum electrolysis\. Besides electrolysis processes, Yang et al\.\[[25](https://arxiv.org/html/2607.06632#bib.bib25)\]as well as Caspari et al\.\[[26](https://arxiv.org/html/2607.06632#bib.bib26)\], amongst others, investigate the DR potential of air separation units\. Hadera et al\.\[[27](https://arxiv.org/html/2607.06632#bib.bib27)\]investigate the DR potential of steel production\. Furthermore, a range of sucessful industrial implementations of DR has been reported\[[19](https://arxiv.org/html/2607.06632#bib.bib19)\]\.

DR schedules the internal production based on external data, as DR relies on accurate electricity price forecasting \(EPF\)\. The dependence on external data makes DR potentially prone to adversarial attacks, as the attacks may take place independently of the internal production scheduling\. In our previous work\[[28](https://arxiv.org/html/2607.06632#bib.bib28)\], we show that adversarial attacks can lead to significant economic losses in DR activities\. Our investigation shows that adversarial attacks on the EPF models have the potential to deteriorate the scheduling decisions in DR, even in cases without explicit knowledge of the underlying EPF and scheduling optimization models\. The work in\[[28](https://arxiv.org/html/2607.06632#bib.bib28)\]is the first to investigate adversarial attacks in the context of industrial DR as well as arbitrage electricity trading with battery energy storages systems \(BESS\)\.

Research on data manipulations in process operations is mainly carried out on the control level, see, e\.g\.,\[[29](https://arxiv.org/html/2607.06632#bib.bib29)\]\. We refer to the review article by Parker et al\.\[[30](https://arxiv.org/html/2607.06632#bib.bib30)\]for an overview of cybersecurity aspects of process control\. In separate lines of work, other authors investigate the impact of adversarial attacks on decision\-making frameworks on energy system level or for residential DR\. For example, adversarial attacks on load forecasting models can lead to pronounced negative impacts on energy system operations in the form of economic losses as well as disruptions and blackouts\[[13](https://arxiv.org/html/2607.06632#bib.bib13),[18](https://arxiv.org/html/2607.06632#bib.bib18)\]\. Similarly, such effects can also result from adversarial attacks on PV and wind power forecasting\[[14](https://arxiv.org/html/2607.06632#bib.bib14)\]\. For a discussion of adversarial attacks and defenses in the context of residential DR, the reader is referred to\[[31](https://arxiv.org/html/2607.06632#bib.bib31)\]\. While these studies investigate the downstream effects of adversarial attacks on DR, an understanding and detailed investigation of the contributing factors to vulnerabilities in industrial DR is still missing\. As industrial DR must preserve feasibility of the production process at all times, the optimization of production schedules is subject to a set of operational constraints\. However, it is an open question to what extend different levels of process flexibility influence the vulnerability of DR to adversarial attacks\.

While EPF models are commonly trained on established regression metrics like Mean Squared Error \(MSE\) and Mean Absolute Error \(MAE\), these metrics are not necessarily a descriptive metric for the decision quality in DR\[[32](https://arxiv.org/html/2607.06632#bib.bib32)\]\. As a consequence, from a demand side perspective, the actual value of an electricity price forecast does not only depend on forecasting accuracy but also on the mathematical properties of the decision problem that the forecasts are utilized for\. For example, Zareipour et al\.\[[33](https://arxiv.org/html/2607.06632#bib.bib33)\]show that demand side loads in the process industries have different sensitivities to forecasting errors than municipal water\-plants\. Based on these findings, we expect that also the impact of adversarial attacks on industrial DR problems depends on the properties of the different demand side processes\.

This article investigates how different levels of process flexibility in industrial DR influence the vulnerability of the coupled system of EPF and DR to adversarial attacks in terms of economic losses\. In order to enable comparisons beyond single processes, we make use of a generalized process model \(GPM\)\[[34](https://arxiv.org/html/2607.06632#bib.bib34),[35](https://arxiv.org/html/2607.06632#bib.bib35)\], which can be adjusted to resemble an abstract representation of a range of industrial processes\. We systematically vary the process flexibility of the GPM to investigate the impact of adversarial attacks on process scheduling optimization problems\. In addition, we conduct simulations for process configurations that emulate the operational constraints of a range of energy\-intensive electrolysis processes\.

We progress with our analysis as follows\. In Section[2](https://arxiv.org/html/2607.06632#S2), we introduce the basics of adversarial attacks, DR, and the GPM and outline the different elements of our simulations\. In Section[3](https://arxiv.org/html/2607.06632#S3), we present and discuss our numerical results\. In Section[4](https://arxiv.org/html/2607.06632#S4), we present the results for adversarial attacks on four illustrative electrolysis processes\. We give the conclusions and outlook of our paper in Section[5](https://arxiv.org/html/2607.06632#S5)\.

## 2Attack scheme on industrial demand response

![Refer to caption](https://arxiv.org/html/2607.06632v1/x1.png)Figure 1:Overall structure of the adversarial attacks on EPF and DR\.Our investigation consists of three main parts, namely the EPF, the adversarial attack design, and the DR scheduling optimization, see Figure[1](https://arxiv.org/html/2607.06632#S2.F1)\. In Section[2\.1](https://arxiv.org/html/2607.06632#S2.SS1), we briefly describe the forecasting problem and the ML model we employ for EPF\. In Section[2\.2](https://arxiv.org/html/2607.06632#S2.SS2), we present our adversarial attack methodology on the two\-step process of energy\-price forecasting and DR scheduling optimization\. In Section[2\.3](https://arxiv.org/html/2607.06632#S2.SS3), we revisit the generalized process model and describe its emulation of different operational process characteristics of industrial DR\.

### 2\.1Electricity price forecasting

EPF for day\-ahead prices provides crucial market price predictions for decision\-making in electricity markets\[[36](https://arxiv.org/html/2607.06632#bib.bib36)\]\. The electricity prices result from an interplay of electricity generation and demand, where the generation is increasingly fluctuating with a rising share of renewable electricity in the grid\. Consequently, wind and solar generation together with demand have been shown to be key determinants of the price formation in modern day\-ahead markets, as they determine the residual loads\[[37](https://arxiv.org/html/2607.06632#bib.bib37)\]\. Due to the challenges in EPF introduced by the volatility of renewable generation, a wide range of methods has been proposed for EPF\[[3](https://arxiv.org/html/2607.06632#bib.bib3)\]\.

We use a convolutional neural network \(CNN\) for EPF as these have shown accurate forecasting performance compared to other deep learning models\[[38](https://arxiv.org/html/2607.06632#bib.bib38)\]\. Similar to our previous work\[[28](https://arxiv.org/html/2607.06632#bib.bib28)\]and based on a study by Trebbien et al\.\[[37](https://arxiv.org/html/2607.06632#bib.bib37)\], we use as input features the day\-ahead load forecast𝐖𝐋𝐨𝐚𝐝DA\\mathbf\{W\}^\{\\mathrm\{DA\}\}\_\{\\mathbf\{Load\}\}, the day\-ahead onshore and offshore wind generation forecasts𝐖𝐖𝐢𝐧𝐝,𝐨𝐧DA\\mathbf\{W\}^\{\\mathrm\{DA\}\}\_\{\\mathbf\{Wind,on\}\}and𝐖𝐖𝐢𝐧𝐝,𝐨𝐟𝐟DA\\mathbf\{W\}^\{\\mathrm\{DA\}\}\_\{\\mathbf\{Wind,off\}\}, the day\-ahead PV forecast𝐖𝐏𝐕DA\\mathbf\{W\}^\{\\mathrm\{DA\}\}\_\{\\mathbf\{PV\}\}, and the day\-ahead price of the day before𝐏t−1​d​a​yDA\\mathbf\{P\}^\{\\mathrm\{DA\}\}\_\{t\-1\\mathrm\{day\}\}\. The model simultaneously predicts the full price vector for all time steps of a day\. This approach aims at better learning the structural relations within the daily price profiles, as this structural relations are crucial for the decision\-making in the scheduling optimization problems\. Further, this structure aligns with the simultaneous determinaton of electricity prices on the German day\-ahead market\.

We train our model for EPF on the German day\-ahead electricity market with electricity price data for 2023 and 2024 obtained from the ENTSO\-E transparency platform\[[39](https://arxiv.org/html/2607.06632#bib.bib39)\]\. We put aside the data for November 2024, which we solely use as test data\. From the remaining data, we randomly choose 10% per epoch as validation data\. Note that in 2023 and 2024 the day\-ahead market used to trade in hourly time intervals while it switched to trading intervals for every quarter of an hour beginning October 2025\.

The CNN model consists of two convolutional layers and one linear layer, see Table[1](https://arxiv.org/html/2607.06632#S2.T1)\. The resulting model has 374\.000 parameters\. We train the model with early stopping, an early stopping patience of 25 epochs and a maximum number of 100 epochs\. Further, we use the adam optimizer with a learning rate of5⋅10−45\\cdot 10^\{\-4\}, and a batch size of 32\. The model is trained usingpytorch\[[40](https://arxiv.org/html/2607.06632#bib.bib40)\]\. Data pre\- and postprocessing is done inscikit\-learn\[[41](https://arxiv.org/html/2607.06632#bib.bib41)\]\.

Table 1:Structure of the CNN model used for EPF\.
### 2\.2Adversarial Attacks

Adversarial attacks are deliberately crafted data modifications that aim to manipulate the output of ML models\. At the same time, adversarial attacks should be imperceptible to the human user to remain undetected\. Originally, the investigations of adversarial attacks were concerned with classification problems, see, e\.g\.,\[[4](https://arxiv.org/html/2607.06632#bib.bib4),[42](https://arxiv.org/html/2607.06632#bib.bib42)\]\. However, adversarial attacks can also be applied to regression problems\[[43](https://arxiv.org/html/2607.06632#bib.bib43)\]\. Adversarial attacks can be categorized into poisoning and evasion attacks, where poisoning attacks are applied during the training phase while evasion attacks manipulate the inputs of already trained ML models\[[44](https://arxiv.org/html/2607.06632#bib.bib44)\]\. This study is concerned with evasion attacks, i\.e\., the attacks are applied to models that are already trained, and we use the term adversarial attacks to refer to evasion attacks throughout this work\.

The goal of an adversarial attack can be to either drag the model output away from the true target output or to drag the output towards a specific target output\[[42](https://arxiv.org/html/2607.06632#bib.bib42)\]\. The first is usually referred to as untargeted attack while the latter is referred to as targeted attack\. For a trained ML model𝐟​\(⋅\)\\mathbf\{f\}\(\\mathbf\{\\cdot\}\)with inputs𝐱\\mathbf\{x\}and outputs𝐲=𝐟​\(𝐱\)\\mathbf\{y\}=\\mathbf\{f\}\(\\mathbf\{x\}\), adversarial attacks deal with the design of adversarial noiseΔ​𝐱\\Delta\\mathbf\{x\}such that the ML model produces a deteriorated output𝐲~\\tilde\{\\mathbf\{y\}\}, i\.e\.,𝐲~=𝐟​\(𝐱\+Δ​𝐱\)\\tilde\{\\mathbf\{y\}\}=\\mathbf\{f\}\(\\mathbf\{x\}\+\\Delta\\mathbf\{x\}\)\.

In the untargeted case, the attacker aims to maximize the deviation between a true target𝐲∗\\mathbf\{y^\{\*\}\}and the output produced by the attacked ML model𝐲~=𝐟​\(𝐱\+Δ​𝐱\)\\tilde\{\\mathbf\{y\}\}=\\mathbf\{f\}\(\\mathbf\{x\}\+\\Delta\\mathbf\{x\}\), i\.e\.,

maxΔ​𝐱​ℒ​\(𝐱\+𝚫​𝐱,𝐲∗\)\\displaystyle\\underset\{\\Delta\\mathbf\{x\}\}\{\\max\}~\\mathcal\{L\}\(\\mathbf\{x\}\+\\mathbf\{\\Delta\}\\mathbf\{x\},\\mathbf\{y^\{\*\}\}\)=∑t=1T\(yt∗−𝐟​\(𝐱\+Δ​𝐱\)t\)2\\displaystyle=\\sum\_\{t=1\}^\{T\}\\left\(y^\{\*\}\_\{t\}\-\\mathbf\{f\}\(\\mathbf\{x\}\+\\Delta\\mathbf\{x\}\)\_\{t\}\\right\)^\{2\}\(UA\)s\.t\.\\displaystyle\\mathrm\{s\.t\.\}‖Δ​𝐱‖p≤ε,\\displaystyle\|\|\\Delta\\mathbf\{x\}\|\|\_\{p\}\\leq\\varepsilon,
where the inequality contraint restricts a p\-norm of the adversarial noise to a small numberε\\varepsilon, i\.e\., the magnitude of the adversarial noise is restricted such that the perturbations of the input features cannot become arbitrarily large\.

In the targeted case, the attacker aims to minimize the distance between the output of the model and a specified target output𝐲^\\hat\{\\mathbf\{y\}\}, i\.e\.,

minΔ​𝐱​ℒ​\(𝐱\+𝚫​𝐱,𝐲^\)\\displaystyle\\underset\{\\Delta\\mathbf\{x\}\}\{\\min\}~\\mathcal\{L\}\(\\mathbf\{x\}\+\\mathbf\{\\Delta\}\\mathbf\{x\},\\hat\{\\mathbf\{y\}\}\)=∑t=1T\(y^t−𝐟​\(𝐱\+Δ​𝐱\)t\)2\\displaystyle=\\sum\_\{t=1\}^\{T\}\\left\(\\hat\{y\}\_\{t\}\-\\mathbf\{f\}\(\\mathbf\{x\}\+\\Delta\\mathbf\{x\}\)\_\{t\}\\right\)^\{2\}\(TA\)s\.t\.\\displaystyle\\mathrm\{s\.t\.\}‖Δ​𝐱‖p≤ε,\\displaystyle\|\|\\Delta\\mathbf\{x\}\|\|\_\{p\}\\leq\\varepsilon,
Again, the purpose of the inequality is to restrict a p\-norm of the adversarial noise to a small numberε\\varepsilon\.

An established algorithm for computing the adversarial noiseΔ​𝐱\\Delta\\mathbf\{x\}is the fast gradient sign method \(FGSM\)\[[4](https://arxiv.org/html/2607.06632#bib.bib4)\]\. FGSM computes the adversarial noiseΔ​𝐱\\Delta\\mathbf\{x\}by taking a single step in the direction of the sign of the gradient to solve the optimization problem of the adversarial attack\. FGSM is known to produce rather spiky adversarial noise which is relatively easy to identify\. To produce more stealthy attacks, we compute the adversarial noise by means of the basic iterative method \(BIM\)\[[42](https://arxiv.org/html/2607.06632#bib.bib42)\]\. The BIM generates adversarial examples by adding repeated gradient steps, such that it can be seen as an iterative version of FGSM\. While the iterative updating scheme in BIM makes the attack slightly more expensive, it can produce adversarial examples that are both more powerful and more stealthy than adversarial examples generated by FGSM\.

The untargeted attack aims to drag the model output away from the true target𝐲∗\\mathbf\{y^\{\*\}\}\. However, the true target𝐲∗\\mathbf\{y^\{\*\}\}is unknown in regression tasks\. We therefore create a proxy of the true target by using the model output plus a small injection of white\-noiseϵ∼𝒩​\(0,σ2\)\\epsilon\\sim\\mathcal\{N\}\(0,\\sigma^\{2\}\), i\.e\.,𝐲∗≈𝐟​\(𝐱\)\+ϵ\\mathbf\{y^\{\*\}\}\\approx\\mathbf\{f\}\(\\mathbf\{x\}\)\+\\epsilon\. As the untargeted attack is a maximization problem, the gradient step needs to be an*ascent*step\. Consider an initial input𝐱~\(0\)=𝐱\\tilde\{\\mathbf\{x\}\}^\{\(0\)\}=\\mathbf\{x\}and a number of iterationsM∈ℕM\\in\\mathbb\{N\}\. For the untargeted attack, the adversarial input𝐱~\\tilde\{\\mathbf\{x\}\}is computed iteratively form=0,1,…,M−1m=0,1,\.\.\.,M\-1via

𝐱~\(m\+1\)=Clip𝐱,ε​\(𝐱~\(m\)\+α⋅sign​\(∇𝐱ℒ​\(𝐱~\(m\),𝐟​\(𝐱\)\+ϵ\)\)\),\\tilde\{\\mathbf\{x\}\}^\{\(m\+1\)\}=\\mathrm\{Clip\}\_\{\\mathbf\{x\},\\varepsilon\}\\bigl\(\\tilde\{\\mathbf\{x\}\}^\{\(m\)\}\+\\alpha\\cdot\\mathrm\{sign\}\(\\nabla\_\{\\mathbf\{x\}\}\\mathcal\{L\}\(\\tilde\{\\mathbf\{x\}\}^\{\(m\)\},\\mathbf\{f\}\(\\mathbf\{x\}\)\+\\epsilon\)\)\\bigr\),\(1\)with a step sizeα\>0\\alpha\>0and a projection

Clip𝐱,ε​\(𝐱~\)=min⁡\(𝐱\+ε,max⁡\(𝐱−ε,𝐱~\)\)\\mathrm\{Clip\}\_\{\\mathbf\{x\},\\varepsilon\}\(\\tilde\{\\mathbf\{x\}\}\)=\\min\(\\mathbf\{x\}\+\\varepsilon,\\max\(\\mathbf\{x\}\-\\varepsilon,\\tilde\{\\mathbf\{x\}\}\)\)\(2\)
that makes each iteration satisfy the inequality constraint in Problem \([UA](https://arxiv.org/html/2607.06632#S2.Ex1)\)\. After the last iteration, we set𝐱~=𝐱~\(M\)\\tilde\{\\mathbf\{x\}\}=\\tilde\{\\mathbf\{x\}\}^\{\(M\)\}\.

For the targeted attack, the iteration scheme in Equation \([1](https://arxiv.org/html/2607.06632#S2.E1)\) is adapted to

𝐱~\(m\+1\)=Clip𝐱,ε​\(𝐱~\(m\)−α⋅sign​\(∇𝐱ℒ​\(𝐱~\(m\),𝐲^\)\)\)\.\\tilde\{\\mathbf\{x\}\}^\{\(m\+1\)\}=\\mathrm\{Clip\}\_\{\\mathbf\{x\},\\varepsilon\}\\bigl\(\\tilde\{\\mathbf\{x\}\}^\{\(m\)\}\-\\alpha\\cdot\\mathrm\{sign\}\(\\nabla\_\{\\mathbf\{x\}\}\\mathcal\{L\}\(\\tilde\{\\mathbf\{x\}\}^\{\(m\)\},\\hat\{\\mathbf\{y\}\}\)\)\\bigr\)\.\(3\)
For both the untargeted and the targeted attack, we run the BIM algorithm withMM= 10 iterations and setα=4​ε3​M\\alpha=\\frac\{4\\varepsilon\}\{3M\}based on literature values from image manipulation\[[42](https://arxiv.org/html/2607.06632#bib.bib42)\]\. Note that BIM does not actually solve the Problems \([UA](https://arxiv.org/html/2607.06632#S2.Ex1)\) and \([TA](https://arxiv.org/html/2607.06632#S2.Ex2)\) but takes a number of steps towards the solution of the problem\.

To construct a target vector𝐲^\\hat\{\\mathbf\{y\}\}for the targeted attack, we propose amirrorheuristic, that is, we design the attack to drag the EPF model output towards a price profile mirrored around the mean value of the considered day\. The intuition behind this is to fool the process scheduling into buying electricity at hours where the price is actually high\. Mathematically, we express the target vector as

𝐲^=μ𝐲−3⋅\(𝐲−μ𝐲\),\\displaystyle\\hat\{\\mathbf\{y\}\}=\\mu\_\{\\mathbf\{y\}\}\-3\\cdot\(\\mathbf\{y\}\-\\mu\_\{\\mathbf\{y\}\}\),\(4\)
whereμ𝐲\\mu\_\{\\mathbf\{y\}\}denotes the mean price of the price prediction of the current day\. Further, we multiply the profile with a factor of three to amplify the price signal\. As we compute the target vector only based on the predictions of the forecasting model, it can be computed independently of the true prices𝐲∗\\mathbf\{y\}^\{\*\}

As a last step, we remove possible manipulations of PV forecasts during night hours that can be introduced by the BIM\. As solar generation during night hours is unphysical, it would make the adversarial noise easy to detect\. Further, we set negative values for PV forecasts, offshore wind generation, onshore wind generation, and load to zero, as these are unphysical as well\. By removing these adversarial noise patterns in PV forecasts, we make the attacks more stealthy\.

In constrast to our previous paper\[[28](https://arxiv.org/html/2607.06632#bib.bib28)\], we focus on white\-box attacks as our main goal is to understand how adversarial attacks impact the decisions made in the DR optimization problem\. We note that the attacks could also indirectly result from attacks on generation and load forecasts studied in other works\[[12](https://arxiv.org/html/2607.06632#bib.bib12)\], as the features of our EPF model are themselves forecasted by ML models, e\.g\., load and generation forecasts\.

### 2\.3Generalized Process Model

The purpose of industrial DR is to flexibly adjust electricity consumption of production processes in order to generate economic benefits from time\-varying electricity prices on the electricity markets\. To this end, methods from constrained numerical optimization have proven effective for DR as they provide the possibility to optimize the production schedule while satisfying operational process constraints\[[1](https://arxiv.org/html/2607.06632#bib.bib1)\]\. In order to assess the DR potential of a wide range of industrial processes, different authors have proposed generalized mathematical models of production processes\[[45](https://arxiv.org/html/2607.06632#bib.bib45),[46](https://arxiv.org/html/2607.06632#bib.bib46),[34](https://arxiv.org/html/2607.06632#bib.bib34),[35](https://arxiv.org/html/2607.06632#bib.bib35)\]\. Many energy\-intensive processes with the possibility of load shifting and onsite product storage can be seen as “grid\-level storage batteries”\[[47](https://arxiv.org/html/2607.06632#bib.bib47)\]\. The mathematical modeling of such components for DR is a field of active study with early works already starting in the 1980s\[[48](https://arxiv.org/html/2607.06632#bib.bib48),[49](https://arxiv.org/html/2607.06632#bib.bib49)\]\. A wide range of such grid\-level storage batteries processes can be modeled with the GPM\[[34](https://arxiv.org/html/2607.06632#bib.bib34),[35](https://arxiv.org/html/2607.06632#bib.bib35)\]\. The GPM consists of general building blocks like storage capacities, ramping constraints, and possible production ranges\. Schäfer et al\.\[[34](https://arxiv.org/html/2607.06632#bib.bib34)\]introduce the GPM to study and discuss the interdependencies of economic and sustainability objectives in industrial DR for participation in day\-ahead markets\. Germscheid et al\.\[[35](https://arxiv.org/html/2607.06632#bib.bib35)\]use an extended version of the GPM to investigate the economic potential of industrial DR in intraday markets\. They further use the model to emulate three industrial electrolysis processes and find that participation in intraday markets can substantially increase the economic potential of industrial DR\.

In constrast to Germscheid et al\.\[[35](https://arxiv.org/html/2607.06632#bib.bib35)\], we only consider trading on the day\-ahead market and not on the intraday market\. We formulate the GPM as a quasi\-steady\-state process with an hourly discretization scheme and time stepst∈1,…,Tt\\in\{1,\.\.\.,T\},T=24T=24and a duration per time step ofΔ​t=1​h\\Delta\\mathrm\{t\}=1\\mathrm\{h\}\. The flexibility of a process in the GPM is characterized by its nominal power intakePnomP\_\{\\mathrm\{nom\}\}, its process oversizingθadd\\theta\_\{\\mathrm\{add\}\}, its minimal part\-loadθmin\\theta\_\{\\min\}, its product storage capacitySS, its ramping limitRR, its efficiency lossζ\\zeta, and its maximum down\-timeτoff\\tau\_\{\\mathrm\{off\}\}, see Table[2](https://arxiv.org/html/2607.06632#S2.T2)\. Depending on the values of these parameters, there exist three different configurations of the GPM\. The first formulation resembles an ideal storage\-type consumer without efficiency losses and without the possibility of intermittent production shutdown\. A second configuration considers the possibility of production shutdowns, and a third considers efficiency losses in the production dependent on the operation point\. In the following, we present the modeling equations of the three different process configurations\.

Table 2:Parameters of the generalized process model\. The parametersθadd\\theta\_\{\\mathrm\{add\}\},θmin\\theta\_\{\\min\},SS,RR, andζ\\zetaare given as a multiple of the nominal power intakePnomP\_\{\\mathrm\{nom\}\}\. Table adapted from\[[35](https://arxiv.org/html/2607.06632#bib.bib35)\]\.The ideal storage\-type consumer is represented by Eqs\. \([1](https://arxiv.org/html/2607.06632#S2.Ex3)\)\-\([7](https://arxiv.org/html/2607.06632#S2.Ex9)\), whereptp\_\{t\}represents the power intake at timett\. The variablertr\_\{t\}represents the effective production rate at time t, andltl\_\{t\}represents the fill level of the storage tank at time t\. Eq\. \([1](https://arxiv.org/html/2607.06632#S2.Ex3)\) restricts the maximum and minimum power intake of the process\. Eq\. \([2](https://arxiv.org/html/2607.06632#S2.Ex4)\) restricts the total production per day to the equivalent of a production amount in steady\-state operation\. As the ideal storage type customer does not account for efficiency losses, the effective production rate equals the nominal power intake, see Eq\. \([3](https://arxiv.org/html/2607.06632#S2.Ex5)\)\. Eq\. \([4](https://arxiv.org/html/2607.06632#S2.Ex6)\) enforces the ramping limits of the process\. Eq\. \([5](https://arxiv.org/html/2607.06632#S2.Ex7)\) defines the change in the storage tank level by the difference of a fixed production amount per hour and the effective production rate\. The upper and lower bound of the storage level are given by Eq\. \([6](https://arxiv.org/html/2607.06632#S2.Ex8)\)\. The initial and final storage tank level are constrained to be at 50% capacity in order to enforce cyclic behavior, see Eq\. \([7](https://arxiv.org/html/2607.06632#S2.Ex9)\)\. Note that Eq\. \([5](https://arxiv.org/html/2607.06632#S2.Ex7)\) and Eq\. \([7](https://arxiv.org/html/2607.06632#S2.Ex9)\) implicitly enforce Eq\. \([3](https://arxiv.org/html/2607.06632#S2.Ex5)\) but are added for the potential case of a process without storage capacities\[[35](https://arxiv.org/html/2607.06632#bib.bib35)\]\.

Pnom​θmin\\displaystyle P\_\{\\mathrm\{nom\}\}\\theta\_\{\\min\}≤pt≤Pnom​\(1\+θadd\),\\displaystyle\\leq p\_\{t\}\\leq P\_\{\\mathrm\{nom\}\}\\left\(1\+\\theta\_\{\\mathrm\{add\}\}\\right\),∀t∈\{1,…,T\},\\displaystyle\\forall t\\in\\\{1,\\dots,T\\\},\(1\)Pnom​T\\displaystyle P\_\{\\mathrm\{nom\}\}T=∑t=1Trt,\\displaystyle=\\sum\_\{t=1\}^\{T\}r\_\{t\},\(2\)rt\\displaystyle r\_\{t\}=pt,\\displaystyle=p\_\{t\},∀t∈\{1,…,T\},\\displaystyle\\forall t\\in\\\{1,\\dots,T\\\},\(3\)−Pnom​R\\displaystyle\-P\_\{\\mathrm\{nom\}\}R≤pt\+1−ptΔ​t≤Pnom​R,\\displaystyle\\leq\\frac\{p\_\{t\+1\}\-p\_\{t\}\}\{\\Delta t\}\\leq P\_\{\\mathrm\{nom\}\}R,∀t∈\{1,…,T−1\},\\displaystyle\\forall t\\in\\\{1,\\dots,T\-1\\\},\(4\)lt\+1\\displaystyle l\_\{t\+1\}=lt\+\(rt−Pnom\)​Δ​t,\\displaystyle=l\_\{t\}\+\(r\_\{t\}\-P\_\{\\mathrm\{nom\}\}\)\\Delta t,∀t∈\{1,…,T\},\\displaystyle\\forall t\\in\\\{1,\\dots,T\\\},\(5\)0\\displaystyle 0≤lt≤Pnom​S,\\displaystyle\\leq l\_\{t\}\\leq P\_\{\\mathrm\{nom\}\}S,∀t∈\{1,…,T\},\\displaystyle\\forall t\\in\\\{1,\\dots,T\\\},\(6\)l1\\displaystyle l\_\{1\}=lT\+1=0\.5​Pnom​S,\\displaystyle=l\_\{T\+1\}=0\.5P\_\{\\mathrm\{nom\}\}S,\(7\)
For a process with the possibility of process shutdowns during hours with peak prices, Eqs\. \([13](https://arxiv.org/html/2607.06632#S2.Ex11)\)\-\([15](https://arxiv.org/html/2607.06632#S2.Ex15)\) can be added to describe the shutdown of the process\. Herein,τo​f​f\\tau\_\{off\}denotes the maximum allowed number of consecutive shutdown hours andτ¯o​f​f=τo​f​f/h\\bar\{\\tau\}\_\{off\}=\\tau\_\{off\}/hdenotes the corresponding index\. Eq\. \([13](https://arxiv.org/html/2607.06632#S2.Ex11)\) enforces thatτo​f​f\\tau\_\{off\}is not violated and Eqs\. \([14](https://arxiv.org/html/2607.06632#S2.Ex13)\),\([15](https://arxiv.org/html/2607.06632#S2.Ex15)\) describe the binary logic that allows the shutdown possibilities\. Therein, the binary variableγt\\gamma\_\{t\}describes whether the process is being shutdown or not\. The binary variableszon,tz\_\{\\mathrm\{on\},t\}andzoff,tz\_\{\\mathrm\{off\},t\}indicate a transition from off to on and from on to off, respectively\. Eqs\. \([16](https://arxiv.org/html/2607.06632#S2.Ex17)\)\-\([18](https://arxiv.org/html/2607.06632#S2.Ex21)\) replace the constraints Eqs\. \([1](https://arxiv.org/html/2607.06632#S2.Ex3)\) and \([4](https://arxiv.org/html/2607.06632#S2.Ex6)\) to combine the process ramping and operating limits with the shutdown opportunities\.

γt\+τ¯off\\displaystyle\\gamma\_\{t\+\{\\bar\{\\tau\}\_\{\\mathrm\{off\}\}\}\}≥zoff,t,\\displaystyle\\geq z\_\{\\mathrm\{off\},t\},∀t∈\{1,…,T−τ¯off\},\\displaystyle\\forall t\\in\\\{1,\\ldots,T\-\\bar\{\\tau\}\_\{\\mathrm\{off\}\}\\\},\(13\)zon,t−zoff,t\\displaystyle z\_\{\\mathrm\{on\},t\}\-z\_\{\\mathrm\{off\},t\}=γt\+1−γt,\\displaystyle=\\gamma\_\{t\+1\}\-\\gamma\_\{t\},∀t∈\{1,…,T−1\},\\displaystyle\\forall t\\in\\\{1,\\ldots,T\-1\\\},\(14\)zon,t\+zoff,t\\displaystyle z\_\{\\mathrm\{on\},t\}\+z\_\{\\mathrm\{off\},t\}≤1,\\displaystyle\\leq 1,∀t∈\{1,…,T\},\\displaystyle\\forall t\\in\\\{1,\\ldots,T\\\},\(15\)−γt\+1​Pnom​R−\(1−γt\+1\)​Pnom​θminΔ​t\\displaystyle\-\\gamma\_\{t\+1\}P\_\{\\mathrm\{nom\}\}R\-\\bigl\(1\-\\gamma\_\{t\+1\}\\bigr\)\\frac\{P\_\{\\mathrm\{nom\}\}\\theta\_\{\\min\}\}\{\\Delta t\}≤pt\+1−ptΔ​t,\\displaystyle\\leq\\frac\{p\_\{t\+1\}\-p\_\{t\}\}\{\\Delta t\},∀t∈\{1,…,T−1\},\\displaystyle\\forall t\\in\\\{1,\\ldots,T\-1\\\},\(16\)γt​Pnom​R\+\(1−γt\)​Pnom​θminΔ​t\\displaystyle\\gamma\_\{t\}P\_\{\\mathrm\{nom\}\}R\+\\bigl\(1\-\\gamma\_\{t\}\\bigr\)\\frac\{P\_\{\\mathrm\{nom\}\}\\theta\_\{\\min\}\}\{\\Delta t\}≥pt\+1−ptΔ​t,\\displaystyle\\geq\\frac\{p\_\{t\+1\}\-p\_\{t\}\}\{\\Delta t\},∀t∈\{1,…,T−1\},\\displaystyle\\forall t\\in\\\{1,\\ldots,T\-1\\\},\(17\)γt​Pnom​θmin≤ps,t\\displaystyle\\gamma\_\{t\}P\_\{\\mathrm\{nom\}\}\\theta\_\{\\min\}\\leq p\_\{s,t\}≤γt​Pnom​\(1\+θadd\),\\displaystyle\\leq\\gamma\_\{t\}P\_\{\\mathrm\{nom\}\}\(1\+\\theta\_\{\\mathrm\{add\}\}\),∀t∈\{1,…,T\}\.\\displaystyle\\forall t\\in\\\{1,\\ldots,T\\\}\.\(18\)
In order to model efficiency losses, we consider different formulations dependent on the characteristics of the process\. We give further details on the modeling of efficiency losses in the description of the case studies\.

The scheduling objective is to minimize the electricity costs of the process, that is,∑t=1TPtDA​pt\\sum\_\{t=1\}^\{T\}P\_\{t\}^\{\\mathrm\{DA\}\}p\_\{t\}\. Therein, the price vector𝐏DA\\mathbf\{P\}^\{\\mathrm\{DA\}\}is the output of the EPF model, i\.e\.,𝐏DA=𝐟​\(𝐱\)\\mathbf\{P\}^\{\\mathrm\{DA\}\}=\\mathbf\{f\}\(\\mathbf\{x\}\)\. To compute the actual costs under the true price realizations, we compute the actual costs as∑t=1TPtDA∗​pt\\sum\_\{t=1\}^\{T\}P\_\{t\}^\{\\mathrm\{DA\}^\{\*\}\}p\_\{t\}, with true price realizations𝐏DA∗\\mathbf\{P\}^\{\\mathrm\{DA\}^\{\*\}\}\.

To evaluate a potential interplay between process flexibility and vulnerability to adversarial attacks, we systematically vary the process oversizing and therefore the flexibility of an illustrative flexible process\. This illustrative process is characterized by a nominal power intakePnom=1\.0​MWP\_\{\\mathrm\{nom\}\}=1\.0~\\mathrm\{MW\}, a minimal part loadθmin=0\.5\\theta\_\{\\mathrm\{min\}\}=0\.5, a product storage capacityS=3​hS=3~\\mathrm\{h\}, a ramping limit per hourR=1\.00R=1\.00, an efficiency lossζ=0\\zeta=0, and a maximum consecutive down timeτoff=0​h\\tau\_\{\\mathrm\{off\}\}=0~\\mathrm\{h\}\. All models are implemented in Pyomo\[[50](https://arxiv.org/html/2607.06632#bib.bib50)\]and solved via Gurobi\[[51](https://arxiv.org/html/2607.06632#bib.bib51)\]\.

## 3Impact analysis of adversarial attacks on industrial demand response

We investigate the impact of adversarial attacks on the two\-step process of EPF and scheduling optimization\. In Section[3\.1](https://arxiv.org/html/2607.06632#S3.SS1), we investigate the impact of adversarial attacks on the output of the electricity price forecasting model\. In Section[3\.2](https://arxiv.org/html/2607.06632#S3.SS2), we discuss how these perturbed outputs impact DR scheduling optimization problems\. In Section[3\.3](https://arxiv.org/html/2607.06632#S3.SS3), we analyze the interplay of financial losses in DR under adversarial attacks to changes in the optimal basis of DR scheduling problems\. In Section[3\.4](https://arxiv.org/html/2607.06632#S3.SS4), we further analyze the interplay between process flexibility and the impact of adversarial attacks on DR\. Finally, in Section[3\.5](https://arxiv.org/html/2607.06632#S3.SS5), we discuss seasonal effects in the impact of adversarial attacks on DR\. All numerical experiments are carried out on a 4th Generation Intel\(R\) Xeon\(R\) Platinum 8468 Processor with 2\.10 GHz on a Rocky Linux 9 operating system\.

### 3\.1Impact of adversarial attacks on electricity price forecast

We start our analysis with a brief presentation of the training results of the EPF model\. The model reaches its lowest validation loss after 14 epochs\. We use early stopping to stop further training after a patience of 25 epochs and restore the model weights from epoch 14\. With these weights, the EPF model reaches an MSE of 0\.11 on both the training set and on the test month of November 2024\. We use this model configuration in all remaining analyses of this work\.

We now turn to a comparison of the impact of the adversarial attacks on the output of the EPF model\. Our goal herein is to compare the magnitude of errors induced by the different attack heuristics, i\.e\., targeted and untargeted attacks\. To this end, we compare the MSE and MAE of price forecasts under the influence of adversarial attacks in relation to the price forecasts in the case without attacks\. Note that we only compare forecasted profiles with each other and do not compare the forecasts to the true realizations\. This is because we want to analyze the deviations induced by the adversarial attacks and not the absolute predictive performance of the models\.

Our results show that both attacks induce significant deviations from the original forecasting outputs, see Figure[2](https://arxiv.org/html/2607.06632#S3.F2)\. With both attack heuristics, both the MSE and the MAE grow with increasing attack rates\. Further, the untargeted attack induces two to three times larger deviations than the mirror attack in both metrics\.

![Refer to caption](https://arxiv.org/html/2607.06632v1/x2.png)Figure 2:Cumulated error metrics between the benign forecasts and the attacked forecasts for November 2025\.We explain the difference in severity with the different design heuristics of the two attacks\. The mirror attack aims at mirroring the price profile around the mean price of the day\. Therefore, the mean of the perturbed price profiles remains close to the unperturbed price profiles\. In contrast, the untargeted attack can increase the prediction error by shifting the whole price profile to lower or higher price regimes, inducing significantly larger error metrics than the mirror attack\. We illustrate this behavior by showing two exemplary manipulated forecasts under an extreme attack rate ofε=1\.0\\varepsilon=1\.0, i\.e\., in the order of one standard deviation, to showcase the different results of the attacks, see Figure[3](https://arxiv.org/html/2607.06632#S3.F3)\. While the untargeted attack produces a price profile that is completely shifted to a lower price regime, the mirror attack produces a price profile that approximately mirrors the original price profile around the mean price\.

![Refer to caption](https://arxiv.org/html/2607.06632v1/x3.png)Figure 3:Comparison of electricity profiles resulting from the targeted and untargeted attack heuristics for November 29, 2024\. In both cases, we apply an extreme attack rate ofε=1\.0\\varepsilon=1\.0and compare it to the case without attack, i\.e\.,ε=0\.0\\varepsilon=0\.0\. Gray dashed lines indicate the mean of the forecast of the day\.![Refer to caption](https://arxiv.org/html/2607.06632v1/x4.png)\(a\)
![Refer to caption](https://arxiv.org/html/2607.06632v1/x5.png)\(b\)

Figure 4:Comparison of feature perturbations resulting from the targeted and untargeted attack heuristics for November 29, 2024\. Note that we have filtered unphysical perturbations\. \(a\) Result for the mirror attack\. \(b\) Result for the untargeted attack\.While the adversarial attacks aim at pronounced negative impact in decision\-making, the attacks should remain stealthy\. We visualize the adversarial perturbations in the features of the forecasting model in Figure[4](https://arxiv.org/html/2607.06632#S3.F4)\. The figure shows the perturbed features for both attack heuristics and for different attack rates for November 29, 2024\. Note that we filtered the perturbations for the features in such a way that all negative values for the PV forecast, the offshore wind production forecast, the onshore wind generation forecast, am=nd the load are replaced by a value of zero\. Negative values for these features are physically impossible and corresponding perturbations are therefore trivial to detect\.

Both mirror and untargeted attack induce the largest perturbations in the day\-ahead PV forecast𝐖PVDA\\mathbf\{W\}^\{\\text\{DA\}\}\_\{\\textbf\{PV\}\}and in the day\-ahead wind onshore forecast𝐖Wind, onDA\\mathbf\{W\}^\{\\text\{DA\}\}\_\{\\textbf\{Wind, on\}\}\. We note that the untargeted attack tends to cause negative values for the PV forecast such that the filtering of negative values can remove a large portion of the perturbations stemming from the untargeted attack in some cases\.

When comparing the perturbations for different attack rates we see that the attacks become increasingly easy to detect with larger attack rates\. For attack rates exceeding an attack rate of 0\.1, the attacked features significantly deviate from the original data, such that these large deviations are comparably easy to identify by the human user\. Therefore, we mark an attack rate of 0\.1 as the maximum attack rate under which the attacks can still remain unrecognized\.

For completeness, we also show the perturbations stemming from an attack rate of 0\.5\. These perturbations are easy to detect due to their jumps, for example in the wind onshore forecasts𝐖Wind, onDA\\mathbf\{W\}^\{\\text\{DA\}\}\_\{\\textbf\{Wind, on\}\}\.

In conclusion, the untargeted attack produces more pronounced forecasting errors while the mirror attack leads to price profiles that are closer to the original output in terms of MSE and MAE\. For both attack heuristics, we refer to an attack rate of 0\.1 as the maximum attack rate under which the attacks can still remain stealthy\.

### 3\.2Variation of process flexibility

We investigate the costs of process operation under adversarial attacks by means of the relative costs compared to steady\-state process operation\. We vary the flexibility of the process by a structured variation of the process oversizingθadd\\theta\_\{\\mathrm\{add\}\}\. For all investigated process configurations, we compute the process electricity costs under attack rates ranging from 0\.0 to 0\.5 discretized by steps of size 0\.025 for the mirror attack heuristic as well as the untargeted attack heuristic\. We simulate price forecasts and process optimization for the test data from November 2024 and report results as the cumulated costs over the complete month\.

We simulate the process electricity costs compared to steady\-state operation for a range ofθadd\\theta\_\{\\mathrm\{add\}\}from 0\.05 to 0\.50\. The results without attacks, i\.e\., with an attack rate of 0\.0, show that an increase in process oversizing leads to increased process flexibility\. Consequently, the relative costs compared to steady\-state operation are the lowest with a process oversizing of 50%, see Figure[5](https://arxiv.org/html/2607.06632#S3.F5)\. With an oversizing of 5%, the process allows for only 3\.2% savings, while with 50% oversizing, up to 8\.3% of electricity costs can be saved\.

![Refer to caption](https://arxiv.org/html/2607.06632v1/x6.png)Figure 5:Relative costs of processes with different process overzising\. costs of 100% are equal to the costs in case of steady\-state operation\. The black dashed line indicates the maximal attack rate that we still refer to as stealthy\. The process is characterized by a nominal power intakePnom=1\.0​MWP\_\{\\mathrm\{nom\}\}=1\.0~\\mathrm\{MW\}, a minimal part loadθmin=0\.5\\theta\_\{\\mathrm\{min\}\}=0\.5, a product storage capacityS=3​hS=3~\\mathrm\{h\}, a ramping limit per hourR=1\.00R=1\.00, an efficiency lossζ=0\\zeta=0, and a maximum consecutive down timeτoff=0​h\\tau\_\{\\mathrm\{off\}\}=0~\\mathrm\{h\}\.For all considered process configurations, the electricity costs increase with increasing attack ratesε\\varepsilon\. In the case of the mirror attack, the costs increase moderately up to the threshold at the attack rate of 0\.1\. For higher attack rates, the process costs approach the costs of steady\-state operation\. At the maximum atack rate of 0\.5, the processes with the largest oversizing equal steady\-state process costs\. Also, the effect of process flexibility is inverted, i\.e\., higher flexibility leads to higher losses for attack rates above 0\.35\. The more flexible the process is, the more its operation schedule is being adapted to the perturbed electricity price forecasts\.

For the untargeted attack, the impact of adversarial attacks on the process schedule is significantly lower than for the mirror attack\. Even with the maximum attack rate ofε\\varepsilon=0\.5, the process costs with DR are significantly lower than the steady\-state costs, i\.e\., performing DR remains economically beneficial even under severely deteriorated electricity price forecasts\. For attack rates up to 0\.1, the costs are almost invariant to the adversarial attacks\. This is the case for all considered process configurations\.

The impact of the two different adversarial attack heuristics on decision\-making is inverted to their impact on EPF\. While the untargeted attack leads to more pronounced errors in EPF than the mirror attack, it is vice versa for the decision\-making, where the mirror attack induces significantly higher costs than the untargeted attack\.

### 3\.3Changes in the optimal basis of the optimization problem

We explain the difference in the impacts of untargeted and mirror attack by the following intuition\. The GPM in its considered configuration without shutdown opportunities constitutes a linear program \(LP\)\. The feasible set of an LP consititutes a convex polytope\. The electricity price forecast determines the parameters in the objective function of the DR optimization problem\. Therefore, changes in electricity price predictions resulting from adversarial attacks only influence the objective function of the LP scheduling problem while the feasible region of the LP remains unaffected by the adversarial attacks\. If an LP has a unique solution, this solution lies at a vertex of the feasible polytope of the LP\[[52](https://arxiv.org/html/2607.06632#bib.bib52)\]\. In this sense, the adversarial attacks need to shift the optimum of the LP to a different vertex of the feasible polytope of the problem\.

Changes of the cost vector within a critical region affect the optimal objective value but not the optimal solution point\. Only changes beyond a critical region change the optimal solution of the scheduling optimization problem as the changes need to be sufficient to shift the optimal solution to a different vertex of the feasible polytope\. The untargeted attack tends to increase the forecasting error by shifting the complete electricity price vector to higher or lower price regimes\. As a simple scaling of the objective function of an LP does not change its optimal solution, the shift of the price profile as induced by the untargeted attack induces less significant changes in the solution of the LP\. In contrast, the mirror attack induces changes in the orientation of the electricity price vector\. Consequently, the mirror attack leads to higher economic losses compared to the untargeted attack when the scheduling decisions are evaluated under the true price realizations\.

To further illustrate the impact of adversarial attacks on the solution of the LP, we analyze the changes in the optimal basis of the process scheduling problem that are induced by the adversarial attacks\. Based on our intuition, we expect that the costs in the scheduling problem are positively correlated with the changes in the optimal basis of the problem\. That is, an increase in process costs comes with an increase in changes in the optimal basis of the optimal scheduling solution\.

We define the changes in the optimal basis as the share of exchanged variables in the basis at the optimal solution in percent\. We note that the formulation of the GPM can exhibit redundant constraints and variables\. Redundant variables or constraints can have side effects on the changes in the optimal basis, for example multiple variables changing their basis status at once\. To avoid such side effects, we analyze the changes in the optimal basis after an intial presolve routine of the solver Gurobi\[[51](https://arxiv.org/html/2607.06632#bib.bib51)\]\. The presolved model consists of 18 variables and 41 constraints\.

We observe that the changes in the optimal basis are indeed positively correlated with the attack rate, see Figure[6](https://arxiv.org/html/2607.06632#S3.F6)\. Therein, we plot the changes in the optimal basis for attack rates ranging from 0\.0 to 0\.5, i\.e\., for the same simulations as shown in Figure[5](https://arxiv.org/html/2607.06632#S3.F5)\. We refer to the basis that stems from a price forecast without adverarial attack as the default solution and optimal basis, that is, we do not assume perfect foresight of electricity prices in the default solution\.

![Refer to caption](https://arxiv.org/html/2607.06632v1/x7.png)Figure 6:Changes in the optimal basis of the process scheduling optimization problem compared to the case without adversarial attack for processes with different process oversizing\. The process is characterized by a nominal power intakePnom=1\.0​MWP\_\{\\mathrm\{nom\}\}=1\.0~\\mathrm\{MW\}, a minimal part loadθmin=0\.5\\theta\_\{\\mathrm\{min\}\}=0\.5, a product storage capacityS=3​hS=3~\\mathrm\{h\}, a ramping limit per hourR=1\.00R=1\.00, an efficiency lossζ=0\\zeta=0, and a maximum consecutive down timeτoff=0​h\\tau\_\{\\mathrm\{off\}\}=0~\\mathrm\{h\}\. The black dashed line indicates the maximal attack rate that we still refer to as stealthy\.We make three main observations with regards to the changes in the optimal basis\. First, the changes in the optimal basis increase with increasing attack ratesε\\varepsilon, both for the mirror attack and for the untargeted attack\. Second, we observe that for processes with a large process flexibility, the changes in the optimal basis is larger than for processes with less process flexibility, in this case, with less process oversizing\. For example, the changes in the optimal basis are approx\. 45 % for an attack rate of 0\.5 and an oversizing of 0\.50, while it is only 5 % for the same attack rate and an oversizing of 0\.05\. Third, we observe that the mirror attack induces more changes in the optimal basis than the untargeted attack which is in line with the economic effects of the adversarial attacks as shown before in Figure[5](https://arxiv.org/html/2607.06632#S3.F5)\.

The observation that the untargeted attack induces large errors in the electricity price forecasts but less errors in the decision\-making is in line with the finding that MSE and MAE alone are not necessarily descriptive measures of the resulting decision quality, see\[[33](https://arxiv.org/html/2607.06632#bib.bib33)\]\. Instead, we outline that the specific geometric properties of the LP optimization problem lead to the result that the mirror attack induces significantly larger deviations in the decision\-making outcome than the untargeted attack\. Thereby, we can conclude that in order to design effective attacks on industrial DR, the sensitvities of the optimization problem need to be taken into account, as we have already implicitly done in the design of he mirror attack\.

### 3\.4Comparison of relative cost savings for different process configurations

So far, we have observed that higher process flexibility increases both the absolute economic losses under adversarial attacks and also the changes in the optimal basis under adversarial attacks\. Further, we have observed that flexible processes have higher potential for cost savings compared to steady\-state process operation, cf\. Figure[5](https://arxiv.org/html/2607.06632#S3.F5)\. Based on these findings, we now aim to investigate whether the increases in costs stemming from the adversarial attacks are also larger in relative terms, i\.e\., how much of the cost savings in DR is retained under adversarial attacks\. We define the relative cost savings under an attack rateε\\varepsilonas

RelativeCostSavings​\(ε\)=costssteady−state−costs​\(ε\)costssteady−state−costsε=0\.0,\\mathrm\{RelativeCostSavings\(\\varepsilon\)\}=\\frac\{\{\\mathrm\{costs\_\{steady\-state\}\}\-\\mathrm\{costs\}\(\\varepsilon\)\}\}\{\\mathrm\{costs\_\{steady\-state\}\}\-\\mathrm\{costs\}\_\{\\varepsilon=0\.0\}\},\(5\)
wherecostssteady−state\\mathrm\{costs\_\{steady\-state\}\}denotes the costs for steady\-state process operation,costs​\(ε\)\\mathrm\{costs\}\(\\varepsilon\)denotes the costs under an attack rateε\\varepsilon, andcostsε=0\.0\\mathrm\{costs\}\_\{\\varepsilon=0\.0\}denotes the costs for DR without adversarial attacks, i\.e\., with an attack rate of 0\.0\.

The results show that the impact of adversarial attacks on the relative cost savings is almost invariant to process flexibility, see Figure[7](https://arxiv.org/html/2607.06632#S3.F7), where all differnet levels of process flexibility show a similar decrease in relative cost savings under adversarial attacks\. For high attack rates beyond 0\.25, the decrease in savings begins to show a distinct behavior, with more flexible processes showing slightly higher losses than less flexible processes, a result that can be similarly observed for the absolute decrease in costs, cf\. Figure[7](https://arxiv.org/html/2607.06632#S3.F7)\.

For the untargeted attack, all processes retain 90 to 95 % of savings up to an attack rate of 0\.1\. Notably, for the untargeted attack, all processes retain more than 70% of relative cost savings even in the case of the largest attack rates, while with the mirror attack, the same attack rate completely erodes the financial benefits of DR\.

![Refer to caption](https://arxiv.org/html/2607.06632v1/x8.png)Figure 7:Relative cost savings compared to steady\-state process operation with different process oversizings\. The process is characterized by a nominal power intakePnom=1\.0​MWP\_\{\\mathrm\{nom\}\}=1\.0~\\mathrm\{MW\}, a minimal part loadθmin=0\.5\\theta\_\{\\mathrm\{min\}\}=0\.5, a product storage capacityS=3​hS=3~\\mathrm\{h\}, a ramping limit per hourR=1\.00R=1\.00, an efficiency lossζ=0\\zeta=0, and a maximum consecutive down timeτoff=0​h\\tau\_\{\\mathrm\{off\}\}=0~\\mathrm\{h\}\. The black dashed line indicates the maximal attack rate that we still refer to as stealthy\.Overall, the results show that DR optimization problems are largely robust against adversarial attacks of reasonable magnitude\. While an increase in process flexibility leads to a larger absolute decrease in cost savings, the relative savings in DR compared to steady\-state operation are largely invariant to the process flexibility\. Further, while mirror attacks lead to less pronounced errors in electricity price forecasting, they lead to significantly larger errors in decision\-making\.

### 3\.5Analysis of seasonal effects

We have so far anaylzed simulations for test data from November 2024\. As electricity price profiles follow seasonal trends, we investigate the impacts of adversarial attacks over the course of the year 2024\. For this comparison, we choose the process model with the largest process oversizing of 50 %\. For each month, we retrain the price forecasting model with the corresponsing month as test set\. Then, we first compute the relative costs compared to steady\-state, that is, the same quantity as in Figure[5](https://arxiv.org/html/2607.06632#S3.F5)\. For an attack rate of 0\.0, this quantity serves as a measure of the economic potential of DR for the corresponding month, see the grey bars in Figure[8](https://arxiv.org/html/2607.06632#S3.F8)\. Second, we compute the relative cost savings, that is, the same quantity as in Figure[7](https://arxiv.org/html/2607.06632#S3.F7), for the mirror attack\. For an attack rate of 0\.5, this quantity serves as a measure for the potential maximum impact of the adversarial attacks on the costs of the process, see the pink bars in Figure[8](https://arxiv.org/html/2607.06632#S3.F8)\.

The comparison of these two quantities reveals a clear seasonal trend\. As the potential for DR is higher in summer months, the relative costs are lower during summer months and higher during winter months\. Consequently, the financial benefits of DR in summer are larger than in winter\.

![Refer to caption](https://arxiv.org/html/2607.06632v1/x9.png)Figure 8:Comparison of MSE on the test set and the relative costs savings for November 2024\. The relative cost savings are computed with the mirror attack\. The process is characterized by a nominal power intakePnom=1\.0​MWP\_\{\\mathrm\{nom\}\}=1\.0~\\mathrm\{MW\}, an oversizing ofθa​d​d=0\.5\\theta\_\{add\}=0\.5, a minimal part loadθmin=0\.5\\theta\_\{\\mathrm\{min\}\}=0\.5, a product storage capacityS=3​hS=3~\\mathrm\{h\}, a ramping limit per hourR=1\.00R=1\.00, an efficiency lossζ=0\\zeta=0, and a maximum consecutive down timeτoff=0​h\\tau\_\{\\mathrm\{off\}\}=0~\\mathrm\{h\}\.In contrast, the relative cost savings under attack show the opposite trend\. During summer months, the financial benefits of DR remain even under the highest attack rate of 0\.5, while for winter months, the relative cost savings reach values around zero under an attack rate of 0\.5\.

The shape and orientation of the price profile during summer months is significantly influenced by the high production of solar energy\. Therefore, the mirror attack struggles to invert the orientation of the price profile such that the DR scheduling problem finds solutions that perform significantly worse than under the unperturbed price predictions\.

These findings reveal that the impact of adversarial attacks has a strong seasonal component\. During summer, DR offers high financial benefit and is relatively robust against adversarial attacks\. In contrast, during winter months, the potential of DR is lower and also, the impact of adversarial attacks is more pronouced\.

## 4Impact of adversarial attacks on four illustrative process case studies

We apply our adversarial attack scheme to four GPM configurations that emulate the flexibility of different electrolysis processes\. In Section[4\.1](https://arxiv.org/html/2607.06632#S4.SS1), we first analyze the different properties and potentials for DR of the four considered processes\. Then, we analyze the impact of the adversarial attacks in Section[4\.2](https://arxiv.org/html/2607.06632#S4.SS2)\. Lastly, we investigate the influence of non\-convexities on the impact of the adversarial attacks in Section[4\.3](https://arxiv.org/html/2607.06632#S4.SS3)\.

### 4\.1Process case studies

We consider four electrolysis processes, namely, an aluminum electrolysis process\[[24](https://arxiv.org/html/2607.06632#bib.bib24)\], a copper electrolysis process\[[23](https://arxiv.org/html/2607.06632#bib.bib23)\], a chlor\-alkali electrolysis process\[[21](https://arxiv.org/html/2607.06632#bib.bib21)\], and a PEM water electrolysis process\[[53](https://arxiv.org/html/2607.06632#bib.bib53)\]\. The parametrizations of the considered processes are given in Table[3](https://arxiv.org/html/2607.06632#S4.T3)\.

Table 3:Parameters of the four process case studies\. The parametersθadd\\theta\_\{\\mathrm\{add\}\},θmin\\theta\_\{\\min\},SS,RR, andζ\\zetaare given as a multiple of the nominal power intakePnomP\_\{\\mathrm\{nom\}\}\. The parameters for the first three electrolysis processes are taken from\[[35](https://arxiv.org/html/2607.06632#bib.bib35)\]\. Details on the modeling of the PEM process are presented in Section[4\.1](https://arxiv.org/html/2607.06632#S4.SS1)\. For details on the efficiency modeling of the chlor\-alkali\-process and the aluminum electrolysis process, see\[[35](https://arxiv.org/html/2607.06632#bib.bib35)\]\.For the first three electrolysis processes, the parametrizations are taken from\[[35](https://arxiv.org/html/2607.06632#bib.bib35)\]\. For the PEM water electrolysis process, we derive the parameters from a paper by Mucci et al\.\[[53](https://arxiv.org/html/2607.06632#bib.bib53)\]\. We use the optimization results from Table A\.9 therein, which are computed for volatile electricity price scenarios\. The value of the hydrogen vessel volume is5430​m35430\\mathrm\{m^\{3\}\}\. We determine the maximum storage capacity for a maximum storage pressure of 140 bar\. Therefore, the maximum mass of stored hydrogenMH2​\(t\)M\_\{\\mathrm\{H\}\_\{2\}\}\(t\)is

MH2​\(t\)≈V⋅0\.073​kgm3​bar⋅\(140​bar−75​bar\)\.\\displaystyle M\_\{\\mathrm\{H\}\_\{2\}\}\(t\)\\approx V\\cdot 0\.073~\\frac\{\\mathrm\{kg\}\}\{\\mathrm\{m\}^\{3\}~\\mathrm\{bar\}\}\\cdot\\left\(140~\\mathrm\{bar\}\-75~\\mathrm\{bar\}\\right\)\.\(6\)
With a nominal production rate of1\.11​th1\.11~\\frac\{\\mathrm\{t\}\}\{h\}, we get a storage capacity of 23\.2 hours for our GPM\. We do not model the methanol plant but instead assume that it requires a constant outlet flow rate of hydrogen at the nominal production rate of1\.11​th1\.11~\\frac\{\\mathrm\{t\}\}\{h\}\. We add the possibility of process shutdowns but with an unrestricted duration\. For the efficiency losses, we fit a piecewise linear function with help of scikit\-learn\[[41](https://arxiv.org/html/2607.06632#bib.bib41)\]consisting of two linear pieces\. For more information on the ,linearization the reader is referred to the original article\[[53](https://arxiv.org/html/2607.06632#bib.bib53)\]\. As in the original article, we set the nominal power intake to 100 MW and the minimal part\-load to 0\.2625\. We set the ramping limit to 1\.25 times the nominal power intake, which means that the process can be ramped in its full operating range within a single time step\.

The four considered processes exhibit different mathematical properties\. All four processes have different definitions of efficiency losses\. Further, the PEM water electrolysis process allows for temporary shutdowns, and consequently, the process model is a mixed\-integer linear program \(MILP\) and therefore non\-convex\. Due to their different levels of flexibility, the four processes exhibit different potentials for financial savings in DR\. We show the electricity costs and savings of the processes in the test month of November 2024 in Table[4](https://arxiv.org/html/2607.06632#S4.T4)\. We compute the costs and savings using forecasts from our EPF model, i\.e\., we do not assume perfect price foresight here\. Due to their different nominal power intake, the processes show different electricity costs in steady\-state operation and DR\. With potential savings of about 11 %, the PEM water electrolysis process shows the highest economic potential for DR, while the aluminum electrolysis process only achieves about 4 % savings\. Overall, the four processes have different levels of flexibility, different mathematical properties, and different economic potential for DR\.

Table 4:Cost savings for the four investigated processes\. All costs are cumulated over the test month November 2024\.
### 4\.2Economic impact of adversarial attacks on DR

Along the lines of the analysis in Section[3](https://arxiv.org/html/2607.06632#S3), we investigate whether DR retains relative savings compared to steady\-state operation under the influence of adversarial attacks, cf\. Eq\. \([5](https://arxiv.org/html/2607.06632#S3.E5)\)\. The results for the four considered processes are shown in Figure[9](https://arxiv.org/html/2607.06632#S4.F9)\. Similar to the results before, it can be seen that the mirror attack induces more pronounced losses than the untargeted attack\. For the untargeted attack, all processes retain almost 100 % of their cost savings under an atttack rate of 0\.1 and more than 60 % cost savings even under the largest attack rate ofε\\varepsilon=0\.5\. For the mirror attack, all considered processes retain more than 90 % savings for attack rates ofε≤0\.1\\varepsilon\\leq 0\.1\. For larger attack rates, the aluminum process shows a slightly steeper decrease in savings, turning savings into losses for attack rates larger than 0\.375\. In that case, the adversarial attacks make the DR result in financial losses compared to steady\-state production\.

![Refer to caption](https://arxiv.org/html/2607.06632v1/x10.png)Figure 9:Relative cost savings compared to steady\-state process operation for different electrolysis processes under adversarial attacks\. The black dashed line indicates the maximal attack rate that we still refer to as stealthy\.We show the absolute increases in electricity costs for different attack rates of the mirror attack in Table[5](https://arxiv.org/html/2607.06632#S4.T5)\. For a rather small attack rate of 0\.05, the costs of the chlor\-alkali process with a nominal power intake of 2\.34 MW only increase by 100 €, while for the PEM process with a nominal power intake of 100 MW, the costs already increase by 10\.100 €\. For an attack rate of 0\.1, which we refer to as the maximal stealthy attack rate, the increase in costs for the chlor\-alkali process is only 600 €, while for the PEM process, it is already 40\.900 €\. These results show that while the adversarial attacks have only small relative impact on the electricity costs, these effects can have large absolute impact if the electricity costs of a process are considerably large, as is the case for the PEM process\. For the maximal attack rate of 0\.5, we would even have an increase in costs for the PEM electrolyzer of alomst 800\.000 €per month\. However, we note that these attack rates are hardly feasible due to the significant perturbations in the forecasting features\.

Table 5:Increase in electricity costs for different attack rates of the mirror attack\. All costs are cumulated over the test month November 2024\.The overall trends in the relation of cost savings and attack rates remain the same as for the illustrative process configurations in Section[3](https://arxiv.org/html/2607.06632#S3)\. For resonable attack rates, the adversarial attack do not erase the economic benefits from DR compared to steady\-state process operation\. However, the increase in electricity costs can cumulate to a large amount if the process has a large nominal power intake and therefore high electricity costs\.

### 4\.3Effects of non\-convexity of the scheduling problem

In contrast to the other scheduling problems, the PEM water electrolysis model constitutes an MILP\. The integer variables of the MILP make the problem non\-convex\. Therefore, the feasible set of an MILP is not a convex polytope as it is the case for LPs, see the discussion in Section[3\.3](https://arxiv.org/html/2607.06632#S3.SS3)\. To gain insights into the changes that the adversarial attacks induce in the solution of the MILP scheduling problem, we conduct an analysis similar to the analysis of the LP’s optimal basis variables\. In this regard, we count the number of changes in the binary variables at the optimal solution under adversarial attacks\.

![Refer to caption](https://arxiv.org/html/2607.06632v1/x11.png)Figure 10:Changes in the integer decisions of the MILP scheduling problem of the PEM water electrolysis process compared to the case without adversarial attack\. The plot shows average values for November 2024\. The black dashed line indicates the maximal attack rate that we still refer to as stealthy\.We show the results in Figure[10](https://arxiv.org/html/2607.06632#S4.F10)\. The trend in the number of changes of integer variables behaves similar to the trend in the continuous variables of the LP problems\. That is, the number of changes increases with larger attack rates\. For the mirror attack, more than 10 % of the integer variables change their value under adversarial attacks, while for the untargeted attack, only about 7 % of the integer decision change under the largest attack rate of 0\.5\.

The Figure shows the changes as the average of changes per day as an average value over the month November 2024\. We observe that while some days show multiple changes in the integer decisions, some days do not show any changes in the integer decisions under adversarial attacks\. We note that we compare the number of changes in the integer variables for the original model formulation without presolve routines\. Consequently, some of the integer variables in the MILP model might be redundant or forced to a specific value by some of the constraints\. In contrast, in the analysis in Section[3\.3](https://arxiv.org/html/2607.06632#S3.SS3), we had analyzed a presolved version of the model formulation\.

Overall, the trend in the changes of integer variables in the MILP scheduling problem is similar to the trend in the continuous variables of the LP scheduling problems\. Therefore, we do not find a particular influence of the nonconvexity of the problem on the vulnerability to adversarial attacks\.

## 5Conclusions

We investigate the potential vulnerability of industrial DR to adversarial attacks\. To this end, we apply evasion attacks to deteriorate the predictions of electricity price forecasting models\. We analyze the economic effects of scheduling decisions parametrized by deteriorated electricity price forecasts and compare these economic effects for different levels of process flexibility and different process configurations that resemble a range of electrolysis processes\.

We find that for all investigated process examples, DR retains more than 90 % cost savings compared to steady\-state production under stealthy adversarial attacks\. To erode the financial advantages of DR, the adversarial attacks in our work need to be of such a large magnitude that they are easy to detect by the human user\. While processes with an increased process flexibility have potentially higher absolute financial losses under adversarial attacks, they behave similarly to less flexible processes in terms of the impact of adversarial attacks on the relative relative cost advantages gained from DR compared to steady\-state operation\. In addition, we find that large errors in forecasting accuracy do not necessarily lead to large economic losses in the DR scheduling problems\. Consequently, we identify targeted attack heuristics as more potent than untargeted attack heuristics, as the targeted attacks are designed with the properties of the scheduling problem in mind\.

Our results show that while DR relies on externally provided market data and forecasts, adversarial attacks have only limited impact on the decisions made in DR, while the forecasting models themselves show pronounced forecasting errors under adversarial attacks\. Further, the impact of adversarial attacks is larger in winter months than in summer months\.

We note that all adversarial attacks in this work are white\-box attacks in terms of the electricity price forecasting model\. In practical scenarios, it is difficult to obtain explicit knowledge of the model weights from the perspective of the adversary\. Therefore, the attacker will often have to rely on black\-box attacks\[[28](https://arxiv.org/html/2607.06632#bib.bib28)\], which are generally less potent than white\-box attacks\.

While we have made extensive analyses in terms of different attack designs and process configurations, we see several lines for future work\. First, we have only investigated adversarial attacks in the day\-ahead market\. Therefore, future work should investigate further markets, particularly intraday markets\. Second, we deem automated anomaly detection methods for adversarial attacks promising to detect adversarial attacks, especially for large attack rates\. Third, the discrepancy between results for the untargeted and the targeted attack heuristics suggest that more sophisticated targeted attack designs might be capable of inducing more significant financial losses than the rather simple mirror heuristic applied in this work\.

## Data availability

The training data for the electricity price forecasting models are publicly available on the Entso\-E Transparency Platform \(https:// transparency\.entsoe\.eu/, ENTSO\-E Transparency Platform \(2026\)\)\. This work uses the day\-ahead residual load forecasts, i\.e\., wind power generation, solar power generation, and load, and the day\-ahead electricity prices for the BZN\|DE\-LU bidding zone in 2023 and 2024\. Other research data or code will be made available upon request\.

## Acknowledgements

Funded by the Deutsche Forschungsgemeinschaft \(DFG, German Research Foundation\) – 546226379\. This work was also performed as part of the Helmholtz School for Data Science in Life, Earth and Energy \(HDS\-LEE\)\. Simulations were performed with computing resources granted by RWTH Aachen University\.

We sincerely thank Alexander Mitsos for his valuable feedback on the manuscript\.

## Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper\.

## CRediT authorship contribution statement

Clemens Kortmann: Conceptualization, Data curation, Formal analysis, Methodology, Software, Visualization, Writing \- Original draft\.Eike Cramer: Conceptualization, Funding acquisition, Methodology, Supervision, Writing \- Review and Editing\.

## Nomenclature

## References

- \[1\]Q\. Zhang, I\. E\. Grossmann, Enterprise\-wide optimization for industrial demand side management: Fundamentals, advances, and perspectives, Chemical Engineering Research and Design 116 \(2016\) 114–131\.[doi:10\.1016/j\.cherd\.2016\.10\.006](https://doi.org/10.1016/j.cherd.2016.10.006)\.
- \[2\]Lennart Merkert, Iiro Harjunkoski, Alf Isaksson, Simo Säynevirta, Antti Saarela, Guido Sand,[Scheduling and energy – industrial challenges and opportunities](https://www.sciencedirect.com/science/article/pii/S0098135414001768), Computers & Chemical Engineering 72 \(2015\) 183–198\.[doi:10\.1016/j\.compchemeng\.2014\.05\.024](https://doi.org/10.1016/j.compchemeng.2014.05.024)\. URL[https://www\.sciencedirect\.com/science/article/pii/S0098135414001768](https://www.sciencedirect.com/science/article/pii/S0098135414001768)
- \[3\]J\. Lago, G\. Marcjasz, B\. de Schutter, R\. Weron, Forecasting day\-ahead electricity prices: A review of state\-of\-the\-art algorithms, best practices and an open\-access benchmark, Applied Energy 293 \(2021\) 116983\.[doi:10\.1016/j\.apenergy\.2021\.116983](https://doi.org/10.1016/j.apenergy.2021.116983)\.
- \[4\]I\. Goodfellow, J\. Shlens, C\. Szegedy, Explaining and harnessing adversarial examples, in: 3rd International Conference on Learning Representations, ICLR 2015 \- Conference Track Proceedings, 2015, pp\. 1–11\.
- \[5\]Y\. Liu, P\. Ning, M\. K\. Reiter, False data injection attacks against state estimation in electric power grids, ACM Trans\. Inf\. Syst\. Secur\. 14 \(1\) \(2011\)\.[doi:10\.1145/1952982\.1952995](https://doi.org/10.1145/1952982.1952995)\.
- \[6\]Jingbo Hao, Yang Tao,[Adversarial attacks on deep learning models in smart grids](https://www.sciencedirect.com/science/article/pii/S2352484721011707), Energy Reports 8 \(2022\) 123–129\.[doi:10\.1016/j\.egyr\.2021\.11\.026](https://doi.org/10.1016/j.egyr.2021.11.026)\. URL[https://www\.sciencedirect\.com/science/article/pii/S2352484721011707](https://www.sciencedirect.com/science/article/pii/S2352484721011707)
- \[7\]G\. O\. Alsharif, C\. Anagnostopoulos, A\. K\. Marnerides, Energy market manipulation via false\-data injection attacks: A review, IEEE Access 13 \(2025\) 42559–42573\.[doi:10\.1109/ACCESS\.2025\.3548914](https://doi.org/10.1109/ACCESS.2025.3548914)\.
- \[8\]I\. Zografopoulos, N\. D\. Hatziargyriou, C\. Konstantinou, Distributed energy resources cybersecurity outlook: Vulnerabilities, attacks, impacts, and mitigations, IEEE Systems Journal 17 \(4\) \(2023\) 6695–6709\.[doi:10\.1109/JSYST\.2023\.3305757](https://doi.org/10.1109/JSYST.2023.3305757)\.
- \[9\]J\. Tian, B\. Wang, J\. Li, C\. Konstantinou, Adversarial attack and defense methods for neural network based state estimation in smart grid, IET Renewable Power Generation 16 \(16\) \(2022\) 3507–3518\.[doi:10\.1049/rpg2\.12334](https://doi.org/10.1049/rpg2.12334)\.
- \[10\]L\. Cui, Y\. Qu, L\. Gao, G\. Xie, S\. Yu, Detecting false data attacks using machine learning techniques in smart grid: A survey, Journal of Network and Computer Applications 170 \(2020\) 102808\.[doi:10\.1016/j\.jnca\.2020\.102808](https://doi.org/10.1016/j.jnca.2020.102808)\.
- \[11\]Y\. Chen, Y\. Tan, D\. Deka, Is machine learning in power systems vulnerable?, in: 2018 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids \(SmartGridComm\), 2018, pp\. 1–6\.[doi:10\.1109/SmartGridComm\.2018\.8587547](https://doi.org/10.1109/SmartGridComm.2018.8587547)\.
- \[12\]M\.A\. Rahman, Md\. Rashidul Islam, Md\. Alamgir Hossain, M\.S\. Rana, M\.J\. Hossain, Evan MacA\. Gray,[Resiliency of forecasting methods in different application areas of smart grids: A review and future prospects](https://www.sciencedirect.com/science/article/pii/S0952197624009436), Engineering Applications of Artificial Intelligence 135 \(2024\) 108785\.[doi:10\.1016/j\.engappai\.2024\.108785](https://doi.org/10.1016/j.engappai.2024.108785)\. URL[https://www\.sciencedirect\.com/science/article/pii/S0952197624009436](https://www.sciencedirect.com/science/article/pii/S0952197624009436)
- \[13\]Y\. Chen, Y\. Tan, B\. Zhang, Exploiting vulnerabilities of load forecasting through adversarial attacks, in: Proceedings of the Tenth ACM International Conference on Future Energy Systems, e\-Energy ’19, Association for Computing Machinery, New York, NY, USA, 2019, pp\. 1–11\.[doi:10\.1145/3307772\.3328314](https://doi.org/10.1145/3307772.3328314)\.
- \[14\]J\. Ruan, Q\. Wang, S\. Chen, H\. Lyu, G\. Liang, J\. Zhao, Z\. Y\. Dong, On vulnerability of renewable energy forecasting: Adversarial learning attacks, IEEE Transactions on Industrial Informatics 20 \(3\) \(2024\) 3650–3663\.[doi:10\.1109/TII\.2023\.3313526](https://doi.org/10.1109/TII.2023.3313526)\.
- \[15\]N\. Tang, S\. Mao, R\. M\. Nelms, Adversarial attacks to solar power forecast, in: 2021 IEEE Global Communications Conference \(GLOBECOM\), IEEE, 2021, pp\. 1–6\.[doi:10\.1109/GLOBECOM46510\.2021\.9685910](https://doi.org/10.1109/GLOBECOM46510.2021.9685910)\.
- \[16\]R\. Heinrich, C\. Scholz, S\. Vogt, M\. Lehna, Targeted adversarial attacks on wind power forecasts, Machine Learning 113 \(2\) \(2024\) 863–889\.[doi:10\.1007/s10994\-023\-06396\-9](https://doi.org/10.1007/s10994-023-06396-9)\.
- \[17\]L\. Yang, G\. Liang, Y\. Yang, J\. Ruan, P\. Yu, C\. Yang, Adversarial false data injection attacks on deep learning\-based short\-term wind speed forecasting, IET Renewable Power Generation 18 \(7\) \(2024\) 1370–1379\.[doi:10\.1049/rpg2\.12853](https://doi.org/10.1049/rpg2.12853)\.
- \[18\]Y\. Chen, M\. Sun, Z\. Chu, S\. Camal, G\. Kariniotakis, F\. Teng, Vulnerability and impact of machine learning\-based inertia forecasting under cost\-oriented data integrity attack, IEEE Transactions on Smart Grid 14 \(3\) \(2023\) 2275–2287\.[doi:10\.1109/TSG\.2022\.3207517](https://doi.org/10.1109/TSG.2022.3207517)\.
- \[19\]T\. Samad, S\. Kiliccote,[Smart grid technologies and applications for the industrial sector](https://www.sciencedirect.com/science/article/pii/S0098135412002347), Computers & Chemical Engineering 47 \(2012\) 76–84\.[doi:10\.1016/j\.compchemeng\.2012\.07\.006](https://doi.org/10.1016/j.compchemeng.2012.07.006)\. URL[https://www\.sciencedirect\.com/science/article/pii/S0098135412002347](https://www.sciencedirect.com/science/article/pii/S0098135412002347)
- \[20\]E\. Scholtz, A\. Oudalov, I\. Harjunkoski, Power systems of the future, Computers & Chemical Engineering 180 \(2024\) 108460\.[doi:10\.1016/j\.compchemeng\.2023\.108460](https://doi.org/10.1016/j.compchemeng.2023.108460)\.
- \[21\]L\. C\. Brée, K\. Perrey, A\. Bulan, A\. Mitsos, Demand side management and operational mode switching in chlorine production, AIChE Journal 65 \(7\) \(2019\)\.[doi:10\.1002/aic\.16352](https://doi.org/10.1002/aic.16352)\.
- \[22\]J\. I\. Otashu, M\. Baldea,[Demand response\-oriented dynamic modeling and operational optimization of membrane\-based chlor\-alkali plants](https://www.sciencedirect.com/science/article/pii/S0098135418304411), Computers & Chemical Engineering 121 \(2019\) 396–408\.[doi:10\.1016/j\.compchemeng\.2018\.08\.030](https://doi.org/10.1016/j.compchemeng.2018.08.030)\. URL[https://www\.sciencedirect\.com/science/article/pii/S0098135418304411](https://www.sciencedirect.com/science/article/pii/S0098135418304411)
- \[23\]F\. T\. C\. Röben, D\. Liu, M\. A\. Reuter, M\. Dahmen, A\. Bardow, The demand response potential in copper production, Journal of cleaner production 362 \(2022\) 132221\.
- \[24\]P\. Schäfer, H\. G\. Westerholt, A\. M\. Schweidtmann, S\. Ilieva, A\. Mitsos, Model\-based bidding strategies on the primary balancing market for energy\-intense processes, Computers & Chemical Engineering 120 \(2019\) 4–14\.[doi:10\.1016/j\.compchemeng\.2018\.09\.026](https://doi.org/10.1016/j.compchemeng.2018.09.026)\.
- \[25\]Q\. Zhang, I\. E\. Grossmann, C\. F\. Heuberger, A\. Sundaramoorthy, J\. M\. Pinto, Air separation with cryogenic energy storage: Optimal scheduling considering electric energy and reserve markets, AIChE Journal 61 \(5\) \(2015\) 1547–1558\.[doi:10\.1002/aic\.14730](https://doi.org/10.1002/aic.14730)\.
- \[26\]A\. Caspari, C\. Offermanns, P\. Schäfer, A\. Mhamdi, A\. Mitsos, A flexible air separation process: 2\. optimal operation using economic model predictive control, AIChE Journal 65 \(11\) \(2019\) e16721\.[doi:10\.1002/aic\.16721](https://doi.org/10.1002/aic.16721)\.
- \[27\]Hubert Hadera, Iiro Harjunkoski, Guido Sand, Ignacio E\. Grossmann, Sebastian Engell,[Optimization of steel production scheduling with complex time\-sensitive electricity cost](https://www.sciencedirect.com/science/article/pii/S0098135415000472), Computers & Chemical Engineering 76 \(2015\) 117–136\.[doi:10\.1016/j\.compchemeng\.2015\.02\.004](https://doi.org/10.1016/j.compchemeng.2015.02.004)\. URL[https://www\.sciencedirect\.com/science/article/pii/S0098135415000472](https://www.sciencedirect.com/science/article/pii/S0098135415000472)
- \[28\]E\. Cramer, J\. Gao, A black\-box adversarial attack on demand side management, Computers & Chemical Engineering 186 \(2024\) 108681\.[doi:10\.1016/j\.compchemeng\.2024\.108681](https://doi.org/10.1016/j.compchemeng.2024.108681)\.
- \[29\]X\. Ye, W\. Tang, Process resilience under optimal data injection attacks, AIChE Journal \(2025\)\.[doi:10\.1002/aic\.18896](https://doi.org/10.1002/aic.18896)\.
- \[30\]S\. Parker, Z\. Wu, P\. D\. Christofides, Cybersecurity in process control, operations, and supply chain, Computers & Chemical Engineering 171 \(2023\) 108169\.[doi:10\.1016/j\.compchemeng\.2023\.108169](https://doi.org/10.1016/j.compchemeng.2023.108169)\.
- \[31\]G\. Zhang, B\. Sikdar, A novel adversarial fdi attack and defense mechanism for smart grid demand\-response mechanisms, IEEE Transactions on Industrial Cyber\-Physical Systems 2 \(2024\) 380–390\.[doi:10\.1109/TICPS\.2024\.3448380](https://doi.org/10.1109/TICPS.2024.3448380)\.
- \[32\]K\. Maciejowska, A\. Lipiecki, B\. Uniejewski,[Statistical and economic evaluation of forecasts in electricity markets: Beyond rmse and mae](https://www.sciencedirect.com/science/article/pii/S0196890426003778), Energy Conversion and Management 356 \(2026\) 121408\.[doi:10\.1016/j\.enconman\.2026\.121408](https://doi.org/10.1016/j.enconman.2026.121408)\. URL[https://www\.sciencedirect\.com/science/article/pii/S0196890426003778](https://www.sciencedirect.com/science/article/pii/S0196890426003778)
- \[33\]H\. Zareipour, C\. A\. Canizares, K\. Bhattacharya, Economic impact of electricity market price forecasting errors: A demand\-side analysis, IEEE Transactions on Power Systems 25 \(1\) \(2009\) 254–262\.
- \[34\]P\. Schäfer, T\. M\. Daun, A\. Mitsos, Do investments in flexibility enhance sustainability? a simulative study considering the german electricity sector, AIChE Journal 66 \(11\) \(2020\)\.[doi:10\.1002/aic\.17010](https://doi.org/10.1002/aic.17010)\.
- \[35\]S\. H\. M\. Germscheid, A\. Mitsos, M\. Dahmen, Demand response potential of industrial processes considering uncertain short–term electricity prices, AIChE Journal 68 \(11\) \(2022\)\.[doi:10\.1002/aic\.17828](https://doi.org/10.1002/aic.17828)\.
- \[36\]J\. Nowotarski, R\. Weron,[On the importance of the long\-term seasonal component in day\-ahead electricity price forecasting](https://www.sciencedirect.com/science/article/pii/S014098831630127X), Energy Economics 57 \(2016\) 228–235\.[doi:10\.1016/j\.eneco\.2016\.05\.009](https://doi.org/10.1016/j.eneco.2016.05.009)\. URL[https://www\.sciencedirect\.com/science/article/pii/S014098831630127X](https://www.sciencedirect.com/science/article/pii/S014098831630127X)
- \[37\]J\. Trebbien, L\. Rydin Gorjão, A\. Praktiknjo, B\. Schäfer, D\. Witthaut, Understanding electricity prices beyond the merit order principle using explainable ai, Energy and AI 13 \(2023\) 100250\.[doi:10\.1016/j\.egyai\.2023\.100250](https://doi.org/10.1016/j.egyai.2023.100250)\.
- \[38\]R\. Zhang, G\. Li, Z\. Ma, A deep learning based hybrid framework for day\-ahead electricity price forecasting, IEEE Access 8 \(2020\) 143423–143436\.[doi:10\.1109/ACCESS\.2020\.3014241](https://doi.org/10.1109/ACCESS.2020.3014241)\.
- \[39\]ENTSO\-E transparency platform,[Entso\-e transparency platform](https://transparency.entsoe.eu/)\(2026\)\. URL[https://transparency\.entsoe\.eu/](https://transparency.entsoe.eu/)
- \[40\]A\. Paszke, S\. Gross, F\. Massa, A\. Lerer, J\. Bradbury, G\. Chanan, T\. Killeen, Z\. Lin, N\. Gimelshein, L\. Antiga, et al\., Pytorch: An imperative style, high\-performance deep learning library, Advances in neural information processing systems 32 \(2019\)\.
- \[41\]F\. Pedregosa, G\. Varoquaux, A\. Gramfort, V\. Michel, B\. Thirion, O\. Grisel, M\. Blondel, P\. Prettenhofer, R\. Weiss, V\. Dubourg, J\. Vanderplas, A\. Passos, D\. Cournapeau, M\. Brucher, M\. Perrot, E\. Duchesnay, Scikit\-learn: Machine learning in python, Journal of Machine Learning Research 12 \(2011\) 2825–2830\.
- \[42\]A\. Kurakin, I\. Goodfellow, S\. Bengio,[Adversarial examples in the physical world](http://arxiv.org/pdf/1607.02533), in: R\. V\. Yampolskiy \(Ed\.\), Artificial Intelligence Safety and Security, Chapman & Hall/CRC artificial intelligence and robotics series, Chapman and Hall/CRC, First edition\. \| Boca Raton, FL : CRC Press/Taylor & Francis Group, 2018\., 2018\. URL[http://arxiv\.org/pdf/1607\.02533](http://arxiv.org/pdf/1607.02533)
- \[43\]Kavya Gupta, Beatrice Pesquet\-Popescu, Fateh Kaakai, Jean\-Christophe Pesquet, Fragkiskos D\. Malliaros,[An adversarial attacker for neural networks in regression problems](https://centralesupelec.hal.science/hal-03527640/), 2021\. URL[https://centralesupelec\.hal\.science/hal\-03527640/](https://centralesupelec.hal.science/hal-03527640/)
- \[44\]B\. Biggio, I\. Corona, D\. Maiorca, B\. Nelson, N\. Šrndić, P\. Laskov, G\. Giacinto, F\. Roli, Evasion attacks against machine learning at test time, in: D\. Hutchison, T\. Kanade, J\. Kittler, J\. M\. Kleinberg, F\. Mattern, J\. C\. Mitchell, M\. Naor, O\. Nierstrasz, C\. Pandu Rangan, B\. Steffen, M\. Sudan, D\. Terzopoulos, D\. Tygar, M\. Y\. Vardi, G\. Weikum, C\. Salinesi, M\. C\. Norrie, Ó\. Pastor \(Eds\.\), Advanced information systems engineering, Vol\. 7908 of Lecture Notes in Computer Science, Springer, New York, 2013, pp\. 387–402\.[doi:10\.1007/978\-3\-642\-40994\-3\{\\textunderscore\}25](https://doi.org/10.1007/978-3-642-40994-3_25)\.
- \[45\]L\. Barth, N\. Ludwig, E\. Mengelkamp, P\. Staudt, A comprehensive modelling framework for demand side flexibility in smart grids, Computer Science\-Research and Development 33 \(1\) \(2018\) 13–23\.
- \[46\]N\. Wanapinit, J\. Thomsen, C\. Kost, A\. Weidlich, An milp model for evaluating the optimal operation and flexibility potential of end\-users, Applied Energy 282 \(2021\) 116183\.
- \[47\]Joannah I\. Otashu, Michael Baldea,[Grid\-level “battery” operation of chemical processes and demand\-side participation in short\-term electricity markets](https://www.sciencedirect.com/science/article/pii/S0306261918303647), Applied Energy 220 \(2018\) 562–575\.[doi:10\.1016/j\.apenergy\.2018\.03\.034](https://doi.org/10.1016/j.apenergy.2018.03.034)\. URL[https://www\.sciencedirect\.com/science/article/pii/S0306261918303647](https://www.sciencedirect.com/science/article/pii/S0306261918303647)
- \[48\]B\. Daryanian, R\. E\. Bohn, R\. D\. Tabors, Optimal demand\-side response to electricity spot prices for storage\-type customers, IEEE Transactions on Power Systems 4 \(3\) \(2002\) 897–903\.
- \[49\]C\. W\. Gellings, The concept of demand\-side management for electric utilities, Proceedings of the IEEE 73 \(10\) \(1985\) 1468–1470\.[doi:10\.1109/PROC\.1985\.13318](https://doi.org/10.1109/PROC.1985.13318)\.
- \[50\]M\. L\. Bynum, G\. A\. Hackebeil, W\. E\. Hart, C\. D\. Laird, B\. L\. Nicholson, J\. D\. Siirola, J\.\-P\. Watson, D\. L\. Woodruff, Pyomo — Optimization Modeling in Python, Vol\. 67, Springer International Publishing, Cham, 2021\.[doi:10\.1007/978\-3\-030\-68928\-5](https://doi.org/10.1007/978-3-030-68928-5)\.
- \[51\]L\. L\. Gurobi Optimization,[Gurobi optimizer refereance manual](https://www.gurobi.com/)\. URL[https://www\.gurobi\.com/](https://www.gurobi.com/)
- \[52\]J\. Nocedal, S\. J\. Wright, Numerical optimization, Springer, 2006\.
- \[53\]S\. Mucci, A\. Mitsos, D\. Bongartz,[Cost\-optimal power\-to\-methanol: Flexible operation or intermediate storage?](https://www.sciencedirect.com/science/article/pii/S2352152X2302011X), Journal of Energy Storage 72 \(2023\) 108614\.[doi:10\.1016/j\.est\.2023\.108614](https://doi.org/10.1016/j.est.2023.108614)\. URL[https://www\.sciencedirect\.com/science/article/pii/S2352152X2302011X](https://www.sciencedirect.com/science/article/pii/S2352152X2302011X)