On the Adversarial Robustness of Hydrological Models

Abstract The evaluation of hydrological models is essential for both model selection and reliability assessment. However, comparing predictions with observations alone is insufficient to fully characterize model behavior. This limitation is particularly relevant to deep learning (DL) models because of their complex internal structures. In risk‐averse operational settings, water managers require models whose reliability and failure modes have been carefully evaluated because unstable predictions can put critical infrastructure at risk. Motivated by the need to assess model reliability before operational deployment, we introduce and explore adversarial robustness analysis for hydrological modeling and evaluate whether small, targeted perturbations to meteorological forcings induce substantial changes in simulated discharge. We compare a physical‐conceptual model (HBV) with a deep learning‐based model (LSTM) across 1,347 German catchments using perturbations of varying magnitudes generated by the fast gradient sign method (FGSM). We find that FGSM perturbations generally reduce Kling–Gupta efficiency and increase mean squared error. However, widespread catastrophic failures under the specific FGSM perturbations are not observed, and LSTM generally exhibits less performance degradation than HBV. In the examined catchments, changes in the predicted hydrographs and time‐averaged internal model states often vary approximately linearly with perturbation magnitude, providing a compact summary of how errors grow under such perturbations. Similar patterns are observed along random perturbation directions in selected catchments, suggesting that, in those catchments, small input changes produce approximately proportional changes in model output. Overall, these findings characterize local predictive stability under controlled stress tests and motivate future studies of model robustness in real‐world operational settings.