PaperlayerView exact revision on arXiv

Source-linked AI summary

Predicting the Unpredictable: Reproducible BiLSTM Forecasting of Incident Counts in the Global Terrorism Database (GTD)

Oluwasegun Adegoke

arXiv:2510.15136v1cs.LG

TL;DR

Weekly terrorism counts are difficult to forecast amid sparse surges, geographic heterogeneity, and long temporal dependencies. This paper builds a reproducible BiLSTM evaluation and uses feature ablations to assess the contribution of input groups. Removing rolling statistics produces substantially higher RMSE and MAE in the reported ablation.

  • Problem

    Terrorism data feature structural breaks, sparse surges, geographic heterogeneity, and long dependencies that challenge standard time-series and regression approaches.

    Source: §1 · pp. 1–2

  • Method

    The paper develops a reproducible BiLSTM forecasting pipeline and systematically ablates temporal memory, geography, training history, spatial aggregation, and lag configuration.

    Source: §1 · p. 2

  • Results

    Removing rolling statistics raises error by +4.06 RMSE (+66.1%) and +1.56 MAE (+42.9%) versus baseline.

    Source: §5.4.2 · p. 19

  • Takeaways & Limitations

    Rolling statistics and geographic context deliver most of the reported predictive gain, while lag and casualty features have smaller, metric-dependent effects.

    Source: §5.4.2 · p. 19, Takeaways for practitioners · p. 19

    The results are conditioned on GTD 1970–2016, exclude the 1993 gap, and the model under-predicts extreme surges.

    Source: §6.4 · p. 20

Abstract

from arXiv · show

We study short-horizon forecasting of weekly terrorism incident counts using the Global Terrorism Database (GTD, 1970--2016). We build a reproducible pipeline with fixed time-based splits and evaluate a Bidirectional LSTM (BiLSTM) against strong classical anchors (seasonal-naive, linear/ARIMA) and a deep LSTM-Attention baseline. On the held-out test set, the BiLSTM attains RMSE 6.38, outperforming LSTM-Attention (9.19; +30.6\%) and a linear lag-regression baseline (+35.4\% RMSE gain), with parallel improvements in MAE and MAPE. Ablations varying temporal memory, training-history length, spatial grain, lookback size, and feature groups show that models trained on long historical data generalize best; a moderate lookback (20--30 weeks) provides strong context; and bidirectional encoding is critical for capturing both build-up and aftermath patterns within the window. Feature-group analysis indicates that short-horizon structure (lagged counts and rolling statistics) contributes most, with geographic and casualty features adding incremental lift. We release code, configs, and compact result tables, and provide a data/ethics statement documenting GTD licensing and research-only use. Overall, the study offers a transparent, baseline-beating reference for GTD incident forecasting.

1. INTRODUCTION

Terrorism forecasting is challenged by sparse surges, geographic heterogeneity, non-stationarity, and dependencies across time. The paper proposes a reproducible weekly BiLSTM evaluation and examines which data and modeling choices affect forecasting.

1. INTRODUCTION

  • Terrorism data combine structural breaks, long zero-incident periods and sudden surges, geographic heterogeneity, and long-range temporal dependencies.These properties challenge stationary classical time-series assumptions and standard regression approaches that may under-predict surges.Source: §1 · p. 1
  • The paper uses the GTD to forecast weekly counts at regional and country granularity, with chronological cutoffs intended to prevent look-ahead bias.The evaluation uses fixed time-based splits and considers seasonal-naive and ARIMA/SARIMA baselines.Source: §1 · p. 1
  • Classical models face stationarity, linearity, memory, and feature limitations, while many machine-learning methods fail to represent sequential dependencies.ARIMA/SARIMA are univariate and typically use limited memory; tree-based methods can underestimate surge periods.Source: §1 · p. 2
  • Bidirectional LSTMs process windows in both temporal directions, which the paper motivates as capturing attack build-up and aftermath patterns.LSTMs can incorporate multiple features at each time step, including counts, casualties, geography, and engineered statistics.Source: §1 · p. 2
  • The study develops a reproducible weekly BiLSTM forecaster and evaluates it against classical baselines, with ablations and robustness checks across temporal, geographic, and training conditions.It also releases code, configurations, and results with documentation of GTD licensing and ethical considerations.Source: §1 · p. 2

2. RELATED WORK

Prior terrorism forecasting work includes statistical models with limitations for non-stationarity, sparse counts, and long dependencies. Deep sequence models offer an alternative, but systematic BiLSTM evaluation for weekly GTD incident counts remains a gap addressed by this paper.

2.1 Traditional Terrorism Forecasting

  • Traditional approaches include ARIMA, count regressions, VAR, and Hawkes processes, but face limits in temporal dependence, nonlinearity, multivariate extension, or sparse-count handling.Across these approaches, the review identifies persistent constraints from stationarity assumptions, short-term memory, and long zero periods interrupted by surges.Source: §2.1 · p. 3

2.2 Deep Learning for Time Series

  • LSTMs use gating to retain relevant sequential context, while attention weights historical time steps and bidirectional processing represents both preceding and following observations.The review describes applications of these sequence methods across time-series domains and notes that bidirectionality can capture build-up and aftermath patterns in terrorism forecasting.Source: §2.2 · pp. 3–4

2.3 LSTMs in Security Applications

  • Few terrorism studies systematically forecast incident counts with LSTMs; prior deep-learning work more often addresses spatial risk or hotspots than temporal counts.The paper identifies a gap in comprehensive evaluation of bidirectional LSTMs for weekly GTD counts, including ablations of sequence length, bidirectionality, geography, and training history.Source: §2.3 · p. 4

3. DATA

The data section specifies the GTD snapshot, processing choices, aggregation targets, engineered inputs, evaluation splits, sequence construction, and research-use constraints.

3.1 Source and Snapshot

  • The study uses GTD incident records spanning 1970–2016 and does not redistribute raw records under the database’s research-only license.The snapshot was downloaded on October 8, 2023.Source: §3.1 · pp. 4–5

3.2 Data Preprocessing

  • Preprocessing filters invalid or duplicate events, standardizes location fields, excludes textual fields, imputes missing casualty values as zero, and winsorizes numeric outliers.Weeks in the documented 1993 data gap are excluded from training and evaluation windows.Source: §3.2 · p. 5

3.3 Target Variable definition

  • The target is the weekly incident count for a geographic unit, with separate region-level and country-level datasets.Regional aggregation has 12 units and country-level aggregation covers 190+ countries; the latter offers finer granularity with greater zero-inflation.Source: §3.3 · p. 5

3.4 Features Engineering and Splits

  • Feature vectors combine rolling count statistics, calendar encodings, and geographic indicators, and all models use fixed chronological train, validation, and test splits.The splits are 70%, 15%, and 15% of weeks; validation supports model selection, while held-out test metrics are macro-averaged across geographic units.Source: §3.4 · pp. 5–6

3.5 Normalization and Scaling

  • Numeric features are standardized using training-set statistics, while categorical region and country features are one-hot encoded without normalization.Using training-only statistics is intended to prevent validation or test information leakage.Source: §3.5 · p. 6

3.6 Sequence Construction

  • The forecasting input is a fixed-length sequence, typically 30 weeks, with 13 features; its target is the following week’s attack count.The 52-week feature warm-up period is excluded from loss calculations.Source: §3.6 · p. 6, §3.4 · p. 6

3.7 Data Consideration and Licensing

  • The study uses aggregated weekly counts, does not redistribute raw GTD records, and restricts the models to research rather than operational deployment without expert oversight.The authors also note reporting bias, coding inconsistencies, and distribution shift as dataset limitations.Source: §3.7 · p. 7

4. METHODOLOGY

The paper formulates weekly incident-count forecasting as a one-step-ahead task from geographic histories and covariates, then compares LSTM architectures under a reproducible training setup. Its BiLSTM outperforms LSTM-Attention on the reported test RMSE.

4.1 Problem Definition

  • Forecasting uses a lookback window of length L to predict the next week’s incident count for a geography.Inputs concatenate lagged counts, rolling statistics, calendar encodings, and geographic indicators; the split is chronological at 70%/15%/15%, with train-only standardization and identical evaluation windows.Source: §4.1 · p. 7

4.2.1 Architecture

  • The LSTM-Attention baseline encodes an input window into hidden states, weights time steps with additive attention, and maps the resulting context to a one-step-ahead forecast.Dropout is applied between recurrent blocks and before the output head.Source: §4.2.1 · p. 7

4.2.2 Objective & Training

  • The LSTM-Attention model is trained to minimize mean squared error, with validation-based checkpointing, early stopping, and learning-rate reduction.The stated training procedure uses Adam, batch size 32, up to 50 epochs, and dropout rate 0.2.Source: §4.2.2 · p. 8

4.2.3 Hyperparameters

  • The LSTM-Attention configuration uses a 30-week, 13-feature input and two stacked LSTM layers with 64 and 32 units, followed by a dense output head.Its additive attention architecture has approximately 28,000 parameters; the BiLSTM has 36,673 parameters.Source: §4.2.3 · pp. 8–9
  • RMSE 6.38 for the BiLSTM versus 9.19 for LSTM-Attention; the paper attributes the difference to bidirectional processing capturing temporal patterns that attention over unidirectional states cannot fully replicate.The BiLSTM uses two 32-unit bidirectional layers without attention, while LSTM-Attention uses two differently sized layers and is more parameter-efficient.Source: §4.2.3 · p. 9

4.3 Bidirectional LSTM

The section presents a two-layer BiLSTM that combines forward and backward context to forecast weekly incident counts. It reports lower test RMSE than LSTM-Attention and describes the training and architecture choices behind the model.

4.3.1 Architecture

  • Forward and backward representations capture build-up signals and aftermath dynamics within the lookback window.The model concatenates both directional hidden states; d denotes the number of LSTM units per direction.Source: §4.3.1 · p. 10
  • The architecture stacks two bidirectional LSTM layers, followed by dense regression layers, with 30 weeks and 16 features as input.Each bidirectional layer has 32 units per direction, and dropout is applied after each layer.Source: §4.3.1 · p. 10, §4.3.3 · p. 11

4.3.2 Objective & Training

  • Training converges in about 25–35 epochs and takes roughly 45 minutes on a Mac M2 16GB; bidirectional processing roughly doubles per-epoch cost versus unidirectional LSTMs.Dropout at rate 0.2 is applied after each bidirectional layer for regularization.Source: §4.3.2 · p. 11

4.3.3 Hyperparameters

  • The design uses uniform 32-unit directional layers and no attention; validation results favored two layers, while 20-week lookbacks were optimal with marginal differences.A single-layer bidirectional model had validation RMSE 7.12; adding attention to the bidirectional model yielded RMSE 6.52, compared with 6.38 for the simpler model on test.Source: §4.3.3 · pp. 11–12
  • 30.6% lower RMSE than LSTM-Attention (6.38 vs 9.19), despite the BiLSTM’s simpler architecture without attention.The comparison is reported for the held-out test set.Source: §4.3.1 · p. 10, §4.3.3 · p. 12

4.4 Baselines

The section defines classical forecasting comparators spanning seasonal-naïve, linear regression, and SARIMA approaches. All baselines share the LSTM models’ data splits and evaluation protocol, and the authors state an expected performance ranking.

4.4 Baselines

  • All three baselines use the same 70/15/15 train, validation, and test splits as the LSTM models for fair comparison.The baselines represent seasonal-naïve forecasting, engineered-feature linear regression, and SARIMA.Source: §4.4 · p. 12

4.4.1 Seasonal Naïve

  • Seasonal naïve predicts each week from the corresponding week one year earlier, assuming perfect 52-week periodicity.It requires no training and does not adapt to recent trends or structural breaks.Source: §4.4.1 · pp. 12–13

4.4.2 Linear Regression

  • Linear regression uses all engineered features to test whether simple linear relationships suffice, but treats predictions independently without sequential modeling.The baseline is computationally efficient and provides interpretable coefficients.Source: §4.4.2 · p. 13

4.4.3 Seasonal ARIMA (SARIMA)

  • SARIMA uses auto-ARIMA to select regional model orders by training-set AIC and typically identifies SARIMA(1,0,1)(1,0,1)_52.It is univariate, assumes stationary residuals, and typically has 10–20 lags of effective memory.Source: §4.4.3 · p. 13

4.4.4 Baseline Summary

  • The authors expect the BiLSTM to perform best, followed by LSTM-Attention, Linear Regression, SARIMA, and Seasonal Naïve.Source: §4.4.4 · p. 13

4.5 Ablation Design

The ablation design isolates data configuration, feature importance, and architecture choices within the BiLSTM framework. This block focuses on whether longer training histories improve forecasting compared with recent-only histories.

4.5 Ablation Design

  • Ablations vary data configuration, feature groups, and architecture within the best-performing BiLSTM framework to isolate design choices.Source: §4.5 · p. 13

Historical Data Span

  • The history-span experiment compares identical BiLSTMs trained on 46 years (1970–2016), 10 years (2006–2016), or 5 years (2011–2016).The comparison asks whether older history helps or recent patterns suffice.Source: Historical Data Span · p. 14
  • All history-span models use 70/15/15 temporal splits within their respective windows and are evaluated on the same 2010–2016 test period.Source: Historical Data Span · p. 14

Sequence Length

The section lays out controlled ablations of lookback length, feature groups, architecture, and experimental protocol. These designs vary selected inputs or model components while holding other conditions fixed where specified.

Sequence Length

  • Lookback experiments compare 20-, 30-, and 40-week sequences under the same feature pipeline, training procedure, and hyperparameters.The authors hypothesize that moderate 20–30-week windows balance context against computational cost and overfitting risk.Source: Sequence Length · p. 14

4.5.2 Feature Importance

  • Feature ablations remove one group at a time from the BiLSTM, including lag, rolling-statistic, temporal, casualty, or geographic features.The design measures performance degradation relative to the full baseline; Table 4 is identified as the feature-ablation configurations table.Source: §4.5.2 · p. 14, Table 4 · p. 14

4.5.3 Architecture Comparison

  • Architecture comparisons use unidirectional LSTM, LSTM-Attention, and BiLSTM models, holding the 16-feature input, 30-week sequence, training data, and evaluation protocol constant.The architectural mechanism is the only stated difference among the three models.Source: §4.5.3 · p. 15

4.5.4 Experimental Protocols

  • Ablation protocols fix random seeds and the 2010–2016 test set, select checkpoints by validation RMSE, and avoid repeated test-set evaluation or test-based tuning.Configurations, hyperparameters, and results are documented in an open-source repository.Source: §4.5.4 · p. 15

5. RESULTS

Section 5 reports forecasting results using a fixed chronological evaluation protocol and four complementary metrics.

5. RESULTS

  • The results section covers evaluation setup, baseline performance, deep-learning comparisons, ablations, and robustness checks.Source: §5 · pp. 15–16

Evaluation Protocol

  • Training uses 1970–2003, validation uses 2003–2010 for model selection, and the 2010–2016 test period is reserved for final reporting.Source: Evaluation Protocol · p. 16

Metrics

  • The study reports four complementary metrics, though this passage does not name them.Source: Metrics · p. 16

3. MSE: 1

The experiments compare baselines and deep models, then examine feature and data-history choices; the BiLSTM leads the main model comparison.

3. MSE: 1

  • Paired t-tests compare per-region RMSE across 12 regions at α=0.05; metrics are macro-averaged across regions, and experiments use fixed seed 42.Source: §3 · p. 16

5.2 Baseline performance

  • Linear Regression is the strongest classical baseline at RMSE 9.89, ahead of Seasonal Naive (+0.8%), Moving Average (+2.0%), and SARIMA (+16.5%).Source: §5.2 · p. 16, Table 5 · p. 16

5.3 Main comparison: LSTM-Attn vs BiLSTM vs baselines

  • RMSE 6.38 for BiLSTM is 35.4% lower than Linear Regression’s 9.89; BiLSTM also records MAE 3.94 and R² 0.540.Source: §5.3 · p. 17

Historical Data Span

  • Table 7 examines how historical training-data span affects BiLSTM performance, while Table 8 examines sequence length; these passages give no cell values.Source: Table 7 · p. 18, Table 8 · p. 18

5.4.2 Feature Importance Ablations

  • Removing rolling statistics raises RMSE by 4.06 (+66.1%) and lowers R² from 0.574 to -0.174; removing geographic features raises RMSE by 0.541 (+8.8%).Source: §5.4.2 · p. 19, Table 9 · p. 19

Takeaways for practitioners

  • The authors recommend retaining rolling statistics and geographic features, while treating lag and casualty features as metric-dependent options and retuning after changes.Source: Takeaways for practitioners · p. 19

Statistical significance

  • Per-region paired tests should treat rolling-statistics and geography removals as significant degradations; lag and casualty effects are small and typically not significant.Source: Statistical significance · p. 19

6. DISCUSSION

The discussion attributes model gains to temporal memory and structured context, while outlining portability, data-scope, and use boundaries.

6.1 What the model learned

  • Long historical training, a 20–30-week lookback, bidirectional encoding, rolling statistics, and geographic context are identified as important to performance.Source: §6.1 · pp. 19–20

6.2 Why classical models fall short

  • Classical anchors suit annual cycles and short-lag autocorrelation but assume approximate stationarity, and SARIMA is typically univariate for sparse, bursty, shock-driven counts.Source: §6.2 · p. 20

6.3 Generalization and portability

  • The auditable pipeline uses weekly counts and compact calendar/geographic features with chronological splits; post-2016 use is an out-of-distribution evaluation requiring refreshed tuning and baseline comparisons.Source: §6.3 · p. 20

6.4 Limitations

  • This is forecasting rather than causal analysis, uses GTD 1970–2016 with the documented 1993 gap excluded, under-predicts extreme surges, and omits exogenous drivers and text signals.Source: §6.4 · p. 20

6.5 Implications and ethics

  • Weekly regional or country forecasts may support staffing, readiness, and scenario testing, but not tactical targeting; operational use calls for domain review, shift monitoring, and safeguards against feedback loops.Source: §6.5 · p. 20

OPEN RESEARCH

  • The study reports publicly available data and makes its model code freely available online.Source: OPEN RESEARCH · p. 20
Loading 2510.15136v1…