Source-linked AI summary
When Temporal Perturbations Act Like Sensor Biases: Label-Free Auditing of Wearable Activity Recognizers
Qingyu Wu, Yuan Wei, Renju Liu, Hua Cheng
TL;DR
Wearable activity recognizers can make smooth perturbations appear temporal even when persistent offsets account for much of their effect. SpectrumAudit selects a waveform using unlabeled calibration windows from held-out subjects, then replays its DC and zero-mean components on the same frozen victim. Across 27 victims, selected waveforms cause substantial robust accuracy drops, and DC is more damaging than AC on most victims.
Problem
Attack success alone does not reveal whether a smooth, phase-robust waveform's effect comes from a persistent offset or time-varying content.
Source: §1 · p. 1Method
SpectrumAudit selects a phase-randomized full-window waveform on unlabeled calibration windows from held-out subjects, then replays its exact DC component and budget-constrained zero-mean residual on the same frozen victim.
Source: §1 · p. 1, §3.1 · p. 2, §3.2 · p. 2Results
Three-phase robust accuracy drops span 2.87–40.83 percentage points across 27 victims, and DC drops exceed AC drops on 24/27 victims.
Source: §4.2 · p. 3, §4.3 · p. 3Takeaways & Limitations
Across the evaluated task-trained HAR victims, selected failures are usually DC-dominated under the tested phases and peak budget, so smooth phase-robust perturbations alone do not establish temporal evidence.
Source: §5 · p. 4DC denotes a constant component in standardized model input, not an identified physical sensor bias.
Source: §4.3 · p. 4
Abstract
from arXiv · showhide
Wearable human-activity recognition (HAR) models operate across sensors, subjects, and backbones, yet a smooth waveform may appear temporal while exploiting a persistent sensor offset primarily. We introduce SpectrumAudit, a label-sealed audit that fits a phase-randomized full-window stimulus on calibration windows from subjects held out from training and testing. After selection, it replays its exact DC projection and budget-constrained zero-mean residual on the same frozen victim without refitting. Across 27 victims from three datasets and three backbones, the selected waveforms cause 2.87-40.83-point three-phase robust accuracy losses. Under this replay budget, DC is more damaging than AC on 24/27 victims and recovers at least 90% of the full drop on 22/27; all 5 failures occur on WISDM. In a held-out UTD-MHAD check, the selected waveform causes 13.49-pp accuracy and 11.68-pp macro-F1 losses, versus -0.66 pp for matched random changes. The audit diagnoses offset versus zero-mean variation under a common peak-budget cap. The code will be released upon acceptance.
1. INTRODUCTION
Wearable HAR models vary across sensors, subjects, and backbones, and smooth perturbations can appear temporal even when a persistent offset drives most of their effect. The paper introduces a label-sealed, subject-disjoint audit that selects a waveform before replaying its DC and zero-mean components on the same frozen victim.
Motivation
- Wearable HAR reliability depends on sensor modality, subject composition, and deployment protocol, despite improvements in transfer and label efficiency.Wearable foundation models also extend the field toward broader interfaces.Source: §1 · p. 1
- A smooth stimulus that survives phase shifts may appear temporal even when most of its effect comes from a persistent offset.Attack success alone does not reveal which waveform component produces the failure.Source: §1 · p. 1
Illustration
- The selected PAMAP2 waveform is nearly flat, with 99.8% DC energy, while the figure compares worst-phase drops for full, DC, and budget-constrained AC replay.The caption notes that the illustrated smooth signals have different dominant components.Source: Figure 1 · p. 1
Approach
- The audit selects waveforms on unlabeled calibration windows from held-out subjects, then replays their exact DC component and budget-constrained zero-mean residual without refitting.Signals with similar smooth appearance can have different dominant components.Source: §1 · p. 1
Contributions
- The audit spans three datasets, three backbone families, and three independently trained victim seeds per setting, separating component diagnosis from attack strength and between-victim variation.It pairs the select-then-project test with matched objective and access controls.Source: §1 · p. 1
2. RELATED WORK
Wearable HAR research spans diverse architectures and sensing settings, making a single-checkpoint evaluation inadequate and published attack results difficult to compare directly. The unresolved question is whether a selected waveform's temporal mean or zero-mean variation carries its effect.
HAR models
- HAR research has expanded from task-specific convolutional and recurrent classifiers to compact Transformers, self-supervised encoders, and cross-dataset learners.Pretraining and foundation encoders further extend transfer across sensors and model families.Source: §2 · p. 2
Attack protocols
- Wearable and biosignal attack studies vary in victim access, supervision, perturbation budget, and phase protocol, so they are not directly commensurate.The paper adapts objective and access principles to a common HAR protocol to compare protocol conditions, not rank published systems.Source: §2 · p. 2
Open question
- Whether a selected waveform's temporal mean or zero-mean variation carries its effect remains unresolved; the audit replays both components after selection on each victim.Source: §2 · p. 2
3. LABEL-SEALED AUDIT
The label-sealed audit selects a smooth full-window probe on unlabeled calibration data from held-out subjects, then attributes its effect through component replays on the same frozen victim. Matched controls vary objective and model access while preserving a common evaluation protocol.
3.1. Threat model and protocol
- The protocol assumes a frozen differentiable HAR classifier and evaluates 27 victims across PAMAP2, WISDM, and USC-HAD, three backbone families, and three seeds per setting.Calibration subjects are held out from training and testing; three-phase robust drop uses shifts 0, 42, and 85, not all 128.Source: §3.1 · p. 2
3.2. Probes and objectives
- The full-window probe retains DC during phase-randomized optimization, then replays the exact temporal mean and a budget-constrained zero-mean residual without refitting.The selector scores phase-wise divergence, prediction changes, and clean-pseudo-label probability drop; smoothness does not establish a temporal mechanism.Source: §3.2 · p. 2
3.3. Matched comparison controls
- Matched controls share the subject split, peak budget, and three-phase metric while varying waveform parameterization and model access; test labels remain sealed until candidates are frozen.The protocol contrasts random, pseudo-label, label-aware, and auxiliary-ensemble controls; label-aware fitting is outside the admissible audit.Source: §3.3 · p. 2
3. LABEL-SEALED AUDIT
- The select-then-project protocol fits and selects a waveform on unlabeled calibration windows before replaying full, exact DC, and zero-mean AC branches on the same victim.Calibration windows are split 75/25 for optimization and selection; test labels are reserved for the final report.Source: §3 · p. 2, Figure 2 · p. 3
4. EVALUATION
Across 27 frozen victims, post-selection component replays usually show greater three-phase robust accuracy loss from DC than from the budget-constrained AC residual. The evaluation also compares matched objectives, measures victim-level variation, and checks the phase protocol and the meaning of DC.
4.1. Matched objective and access controls
- On the nine-setting development grid, representation-aware and pseudo-label objectives yield mean drops of 23.98 and 23.94 pp, respectively, with a 3/3/3 ours/pseudo/tie split (p = 0.938).These results do not establish an attack-strength advantage; component replay tests the mechanism claim.Source: §4.1 · p. 3, Table 1 · p. 3
4.2. Across-victim variation
- Across 27 victims, three-phase robust accuracy drops span 2.87–40.83 pp and robust macro-F1 drops span 5.71–35.86 pp.The exploratory victim-level analyses are non-causal and do not support an architecture ranking.Source: §4.2 · p. 3
- On one UTD-MHAD FCN victim, the selected waveform causes 13.49-pp accuracy and 11.68-pp macro-F1 drops, versus a −0.66-pp accuracy change for a matched random waveform.The authors treat this single-victim result as a protocol check, not a population estimate.Source: §4.2 · p. 3
4.3. Component-level attribution
- DC exceeds AC on 24/27 victims and recovers at least 90% of the full drop on 22/27 under three-phase replay.AC is scaled down to budget on 14/27 victims; all five failures to reach 90% recovery occur on WISDM.Source: §4.3 · pp. 3–4, Figure 3 · p. 4
- The three-phase minimum exceeds the all-128-shift minimum by 0.31 pp on average and 1.59 pp at most.The reported component counts remain based on three-phase replays.Source: §4.3 · p. 4
- Here, DC means a constant component in standardized model input, not an identified physical sensor bias.The protocol targets differentiable, task-trained victims and sample-domain smoothness; physical sensing remains a next step.Source: §4.3 · p. 4
5. CONCLUSION
Across the evaluated task-trained HAR victims, component replays indicate that selected failures are usually DC-dominated rather than carried by zero-mean variation under the tested phases and peak budget. The authors argue that smooth, phase-robust perturbations need component-matched replay before being interpreted as temporal evidence.
5. CONCLUSION
- Across evaluated task-trained HAR victims, selected failures are usually DC-dominated rather than carried by zero-mean variation under the tested phases and peak budget.The protocol targets differentiable, task-trained victims and sample-domain smoothness; physical sensing, black-box transfer, and foundation-model backbones remain next steps.Source: §5 · p. 4
Compliance with Ethical Standards
The authors report using public wearable-sensor datasets and no new human or animal data.
Compliance with Ethical Standards
- The study uses public wearable-sensor datasets and collects no new human or animal data.GPT-5.6 assisted with language polishing, parts of the experimental code, and figure-generation/layout support; the authors report independently checking materials and compliance.Source: Compliance with Ethical Standards · p. 5