Adversarial Defensive Framework for State-of-Health Prediction of Lithium Batteries

Neural networks are subject to malicious data poisoning attacks affecting the ability of the model to make accurate predictions. The attacks are generated using adversarial techniques imperceptible to the human eye since they use minimal noise to alter features, which end up affecting boundary decisions of the prediction model. Predicting the state of health (SOH) of lithium-ion batteries in an adversarial context becomes a challenging task, especially if the model is expected to always predict at a very high accuracy level. Our article presents three novel contributions. The first contribution is an SOH prediction model that shows one of the best accuracy rates in the literature (
$R2 = {99.82\%}$
) and yet uses the simplest long short-term memory model configuration compared to literature. The second contribution is the implementation of three state-of-the-art adversarial data poisoning attacks at decision time, namely fast gradient method, momentum iterative method, and basic iterative method, and the assessment of their impact on the original prediction accuracy. Most of the literature uses the attacks in a classification context while we are applying it to a time-series prediction context. The third and most important contribution of this article is presenting a generic defense strategy combined with a feature engineering method that can be generalized to prevent any potential adversarial attack attempt on any prediction model in a time-series prediction context using the same suggested feature engineering approach as suggested in this article. The accuracy of the model is assessed using error estimators: root-mean-square error, mean absolute error, and
$R^{2}$
. The results show that adversarial data poisoning attacks are lethal to a time-series prediction model, and our proposed defense strategy is able to detect and flag the existence of malicious data using a support vector machine classifier with a very high confidence rate (
$\text{area under curve}=0.996$
), which allow our model to defend against any potential unseen adversarial attack.