Adversarial Attacks on Deep Neural Networks for Time Series Classification

Hassan Ismail Fawaz; Germain Forestier; Jonathan Weber; Lhassane Idoumghar; Pierre-Alain Muller

Source-linked AI summary

Adversarial Attacks on Deep Neural Networks for Time Series Classification

Hassan Ismail Fawaz, Germain Forestier, Jonathan Weber, Lhassane Idoumghar, Pierre-Alain Muller

arXiv:1903.07054v2Mar 17, 2019cs.LGcs.CRstat.ML

TL;DR

The paper addresses the limited study of adversarial vulnerabilities in deep time-series classifiers, which are increasingly used in sensitive applications. It adapts image-based attacks to time series and evaluates them across the UCR archive. The results show that state-of-the-art time-series networks are vulnerable, with attack effectiveness and computational cost differing between methods.

Problem
Adversarial attacks had not been thoroughly explored for time series classifiers, despite deep networks being used in sensitive applications.
Method
The paper transfers and adapts image-based attacks and evaluates them with ResNet across the UCR archive.
Results
Across 85 UCR datasets, FGSM and BIM reduced model accuracy by 43.2% and 56.89%, respectively.
Takeaways & Limitations
Deep networks for time-series data are vulnerable to adversarial attacks, with implications for sensitive applications such as food safety, vehicle sensors, and electricity consumption.

Abstract

from arXiv · show

Time Series Classification (TSC) problems are encountered in many real life data mining tasks ranging from medicine and security to human activity recognition and food safety. With the recent success of deep neural networks in various domains such as computer vision and natural language processing, researchers started adopting these techniques for solving time series data mining problems. However, to the best of our knowledge, no previous work has considered the vulnerability of deep learning models to adversarial time series examples, which could potentially make them unreliable in situations where the decision taken by the classifier is crucial such as in medicine and security. For computer vision problems, such attacks have been shown to be very easy to perform by altering the image and adding an imperceptible amount of noise to trick the network into wrongly classifying the input image. Following this line of work, we propose to leverage existing adversarial attack mechanisms to add a special noise to the input time series in order to decrease the network's confidence when classifying instances at test time. Our results reveal that current state-of-the-art deep learning time series classifiers are vulnerable to adversarial attacks which can have major consequences in multiple domains such as food safety and quality assurance.

I. INTRODUCTION

Deep neural networks are increasingly used for time series classification, but adversarial attacks remain underexplored despite risks in sensitive applications. This paper adapts image-based attacks to time series and studies their effects across UCR datasets and real-world use cases.

Adversarial attacks have been studied extensively for images but not thoroughly explored for time series classification.
Small perturbations can change a coffee spectrograph classification from Robusta to the more valuable Arabica beans.The example illustrates a potential food-control deception affecting consumers.
The paper transfers and adapts image-based adversarial attacks to time series data.
The study empirically evaluates these methods on all 85 datasets in the UCR archive.
It also identifies real-world use cases and open research issues concerning adversarial time series.
The paper provides an open-source framework and adversarial time series for each UCR dataset.

II. BACKGROUND

The background defines time series, datasets, TSC, deep learning models, loss functions, and adversarial examples as the paper’s foundational concepts.

A time series X = [x1, x2, ..., xT] is an ordered set of real values with length T.
A dataset D consists of time-series and one-hot label pairs (Xi, Yi).
TSC trains a classifier to map possible inputs to a probability distribution over class labels.
A deep learning model f maps time-series inputs to predicted class outputs, while Jf denotes its loss function.
An adversarial example is a perturbed version of an original time series whose predicted label differs from the original prediction.

A. Deep learning for time series classification

Deep learning has achieved strong results in time series classification, motivating study of its adversarial vulnerability. Existing attack research is mainly image-focused, while TSC evidence remains limited.

Deep CNNs have been adapted to temporal data and shown state-of-the-art performance for time series classification.
Deep CNNs are used in sensitive applications including medical risk prediction, disease sub-typing, and power-consumption monitoring.
Adversarial-example research began in image recognition and includes fast gradient-based and more costly iterative attacks.
Figure 2 illustrates adding imperceptible FGSM noise to perturb a TwoLeadECG classification.
Prior TSC attack work fooled a soft KNN-DTW classifier on one simulated dataset, leaving state-of-the-art classifiers and broader validation insufficiently studied.
The paper formulates adversarial generation as a box-constrained optimization that minimizes perturbation while changing the classification.

III. ADVERSARIAL ATTACKS FOR TIME SERIES

The adversarial-attack experiments use a ResNet architecture and two attack methods to generate adversarial time-series examples.

The experiments describe ResNet and apply two attack methods to generate adversarial time-series examples.

A. Residual Network

The paper uses ResNet as the TSC attack target because of its strong performance and robustness, while adapting gradient-based image attacks to time series inputs. FGSM perturbs each time series using a gradient-sign update whose magnitude is controlled by ϵ.

ResNet was selected for its robustness, state-of-the-art TSC performance, and use in critical domains such as malware detection.
The adopted ResNet receives a length-T time series and outputs a probability distribution over K classes.
FGSM generates an adversarial time series by adding a gradient-sign perturbation to the original input.
The perturbation magnitude ϵ controls the size of the FGSM modification.

C. Basic Iterative Method

BIM extends FGSM into an iterative attack that repeatedly applies small perturbations while constraining the result near the original time series. The experiments generated these perturbations on test instances without using test labels and released reproducibility resources.

BIM applies FGSM-like updates multiple times with a small step size and clips each result to an ϵ-neighborhood of the original series.
The iterative attack takes an iteration count I, perturbation bound ϵ, step size α, an original series X, and its label ˆY as inputs.
BIM outputs a perturbed time series X′ after iteratively updating the original input.
The attacks perturb only test instances without using test labels, following the computer-vision attack setting.
The authors provide source code, raw results, pretrained models, and perturbed series for each UCR dataset to support verification and robustness testing.

B. Results on the whole UCR archive

Across the UCR archive, FGSM and BIM generally reduced ResNet accuracy, with BIM producing the larger average reduction. Robustness was associated with synthetic datasets and shorter time series, while FGSM was faster than BIM.

43.2% and 56.89% were the average ResNet accuracy reductions produced by FGSM and BIM, respectively, across 85 UCR datasets.
Both attacks reduced ResNet’s accuracy on all datasets except DiatomSizeReduction, whose original accuracy was 30% because of overfitting.
BIM reduced accuracy significantly more than FGSM according to a Wilcoxon signed-rank test with p-value ≤10^-15.
FGSM enables real-time adversarial-series generation, whereas BIM is time-consuming and requires multiple iterations.
Shorter series and several synthetic datasets were harder for both attacks to fool, with ItalyPowerDemand having sequence length T = 24.

C. Multi-Dimensional Scaling

MDS uses pairwise distances between original and perturbed time-series representations to visualize how attacks redistribute test instances. The analysis uses Euclidean distances between GAP-layer vectors, but the resulting space is highly simplified.

C. Multi-Dimensional Scaling: MDS places original and perturbed time series in a lower-dimensional space while preserving pairwise distances as closely as possible.Euclidean distance is used to construct the similarity information supplied to MDS.
C. Multi-Dimensional Scaling: On Ham, BIM perturbed the test set while accuracy fell from 80% to 21%.
C. Multi-Dimensional Scaling: The representations are 128-dimensional GAP vectors produced by averaging the final convolutional feature maps over time.These vectors are used as inputs to the softmax linear classifier and for distance calculations.
C. Multi-Dimensional Scaling: MDS should be interpreted cautiously because each time series is represented as a single point in a highly simplified data space.

D. Attacks on food quality and safety

The paper frames adversarial attacks as a food-quality and safety risk because perturbed spectrographs can obscure adulteration or provenance. Experiments illustrate substantial accuracy losses and movement of examples toward competing classes or decision frontiers.

D. Attacks on food quality and safety: Adversarial perturbations could make adulterated beef appear pure by modifying spectrographs used to classify four beef classes.The Beef dataset includes pure and adulterated beef with varying adulterants.
D. Attacks on food quality and safety: Ham attacks could hide food provenance, with perturbed spectrograms pushed toward the other class.
D. Attacks on food quality and safety: Coffee attacks could make Robusta spectrograms resemble Arabica, pushing instances toward class frontiers under FGSM.Arabica beans are described as more highly valued than Robusta beans.
D. Attacks on food quality and safety: For FordA, model accuracy decreased by 57.9% with FGSM and 70.2% with BIM.
D. Attacks on food quality and safety: On FordA, BIM reduced accuracy to almost 0.0%, whereas FGSM failed to fool the network for larger perturbation values.BIM applies smaller perturbations iteratively, while FGSM adds the full perturbation amount at each data point.

F. Attacks on electricity consumption

The electricity-consumption case examines whether attacks can alter household or seasonal demand signals used for monitoring and classification. ItalyPowerDemand is especially challenging because its series are short and require larger perturbations to induce misclassification.

F. Attacks on electricity consumption: Smart-meter data record household electricity use for monitoring, billing, and analysis through regular measurements and communication with suppliers.
F. Attacks on electricity consumption: SmallKitchenAppliances contains 720-point daily readings from 251 households collected over a month.The dataset comes from the Powering the Nation study.
F. Attacks on electricity consumption: ItalyPowerDemand distinguishes winter from summer months using twelve monthly Italian power-demand series.Its series length is T = 24, the shortest in the UCR archive, so larger perturbation ϵ is needed for misclassification.

G. Transferability of adversarial examples

The transferability experiment tests whether perturbations generated against ResNet also degrade a separate FCN classifier. The results support black-box transfer and motivate defenses and broader testing beyond deep models.

G. Transferability of adversarial examples: Perturbed test sets generated with FGSM and BIM on ResNet were evaluated on FCN models trained on the same training set.
G. Transferability of adversarial examples: Because attackers lack access to FCN parameters yet still fool it, the transfer is characterized as a black-box attack.
G. Transferability of adversarial examples: Reactive defenses detect perturbed instances, whereas proactive defenses improve robustness without generating adversarial examples.Adversarial training is identified as a straightforward proactive method, while detectors can themselves be targeted.
G. Transferability of adversarial examples: The paper concludes that adversarial perturbations reduce ResNet accuracy on the UCR benchmark and may have serious consequences in critical real-life systems.
G. Transferability of adversarial examples: Future work will investigate countermeasures, transferability to non-deep-learning classifiers, and additional attacks for identifying vulnerable TSC models.