Correlation Analysis of Adversarial Attack in Time Series Classification

In time series classification, an adversarial attack refers to a malicious attempt to introduce slight perturbations to a time series $x\in\mathbb{R}^{d}$ to produce a closely related series $x^{\prime}=x+r$ ($x^{\prime}\in\mathbb{R}^{d}$) with the goal of altering the predicted label. This can be mathematically characterized by the equation:

Here, $f(x)$ represents the predicted probability distribution over the labels for the input $x$ and perturbation $r$ is intentionally small in magnitude relative to $x$ as indicated by their norms. In GM based methods, including SWAP, the perturbed logits and the target logits are used as the main part of loss function to measure the difference between the two distributions.

There are main stream of adversarial attacks: White-Box and Black-Box. White-Box attacks, where the attacker has access to the model’s architecture, dataset, and parameters, facilitate gradient-based strategies. In contrast, Black-Box attacks operate with limited information, making them more challenging. Most of attacking methods are developed as the white-box attacks targeting image classification task to examine the trustworthiness of model. Goodfellow et al. [8] introduced the Fast Gradient Sign Method (FGSM), a straightforward approach that generates perturbations by moving in the gradient direction with a small scalar. Madry et al. [7] expanded on this with Projected Gradient Descent (PGD), an iterative version of FGSM. Similarly, Kurakrin et al. [16] proposed the Basic Iterative Method (BIM), to seek perturbations that maximize the loss for a input data while the noise amplitude is clipped under a threshold ($\epsilon$) to conceal the obvious perturbations. Carlini et al. [18] framed the attack as an optimization problem aiming to minimize the distance (e.g. $\mathcal{L}_{2}$ norm) between original sample and adversarial sample upon a successful attack (C&W method). Notably, SWAP highlights the use of KL-divergence and the strategic selection of labels to challenge the original prediction effectively [17]. This targeted label approach, as evidenced in preliminary experiments, yields higher ASR compared to random target selection methods like PGD.

On the defense side, Papernot et al. [19] introduced a distillation-based approach to transfer knowledge from a complex network to simpler ones, enhancing resilience to adversarial attacks and improving generalization against adversarial samples. Madry et al. [7] developed an adversarial training method, framing it as a min-max optimization problem that integrates both adversarial and original samples during training to enhance model robustness. Expanding on this, Kannan et al. [20] employed a logit pairing technique to minimize the difference in logits between original and adversarial samples, adding a regularizer to the training process. Similarly, Ma et al. [21] approached defense by minimizing empirical risk through adversarial training, introducing a second-order adversarial regularizer based on a Taylor series expansion for robustness improvement. Additionally, Sammangouei et al. [22] utilized a Wasserstein GAN framework for adversarial training, aiming to reconstruct original images from adversarial samples by minimizing reconstruction errors.

Figure 3 elucidates the structure of our comprehensive attack and defense framework. During the forward propagation process, an input data first traverses a defense layer, where it encounters three paths: direct passage without any augmentation; application of Gaussian filtering for smoothing; or the introduction of white noise before being forwarded to the neural network. For conventional classification tasks, a neural network typically consists of an encoder, a fully connected layer, and a softmax layer. In this paper, we explore five distinct models, each representing a different mainstream neural network architecture, with specifics to be detailed later. Following the passage through the fully connected layer, the cross-entropy between the predicted and actual labels is computed and backpropagated. In adversarial attacks, the objective is to minimize the cross-entropy between the predicted distribution and a desired distribution $P$, a concept derived from the[17] paper, which involves swapping labels of the highest and second-highest probabilities. During back propagation, rather than updating the model $f$, the perturbation $r$ is adjusted, and the modified input $x+r$ is fed back into the network. This architectural design allows us to examine the efficacy and drawbacks of various attack and defense strategies, as well as assess different models. The results of these experiments are detailed in the following section.

We begin our discussion with Table 1, where we evaluate five adversarial attack methods: PGD, SWAP, SWAP($\mathcal{L}^{2}$), COS, and FFT, across five neural network architectures to assess the universality of our results. Notably, the FFT approach, which increases the frequency component $r$, consistently achieves higher ASR and lower MSD in the majority of cases. Conversely, the SWAP($\mathcal{L}^{2}$) regularization method exhibits a significant decline in ASR when MSD values are low, suggesting potential limitations in its effectiveness. Meanwhile, the efficacy of COS regularization remains less evident, possibly due to suboptimal parameter settings, highlighting an avenue for further experimentation.

Our custom implementation of SWAP notably outperforms the Classic Gradient Method (PGD), affirming the validity of the SWAP approach and reinforcing the reliability of our experimental outcomes. This study deliberately omits comparisons with other methods, focusing instead on validating our hypothesis: that perturbed $x$ focus on local correlation (higher-frequency) enhances attack success. This is further substantiated by introducing regularization to SWAP (as opposed to PGD), allowing for controlled variable analysis. Our observations reveal that PGD can lead to unstable ASR values across multi-label datasets, attributing to its decision-space directionality. In contrast, SWAP demonstrates remarkable stability, underscoring the strategic advantage of our chosen methodology.

In Figure 4, we evaluate the efficacy and subtleties of five adversarial attack methodologies. This figure meticulously contrasts the Attack Success Rate (ASR) and Mean Success Distance (MSD) across these methods. A data point positioned above the $y=x$ line in the ASR comparison signifies superior performance of the corresponding Y-axis method over its X-axis counterpart. Conversely, for the MSD comparison, a point below the $y=x$ line indicates a more effective minimization of perturbation by the Y-axis method. Specifically, the comparisons between SWAP and PGD (GM) across subfigures (a) and (e) indicate SWAP has its superiority in ASR across numerous datasets without a significant reduction in MSD, hinting at the influence of target label chosen on the results. Moreover, the slight advantage of COS over SWAP in ASR, as shown in subfigures (c) and (g), alongside almost identical MSD values, underscores the potential unrealized potential of COS regularization, necessitating further experimental validations. The FFT method, as evaluated in subfigures (d) and (h), not only surpasses SWAP in ASR across the majority of datasets but also demonstrates a lower MSD, aligning with our initial hypothesis regarding the effectiveness of higher-frequency perturbations. Our observation reveals that FFT, by emphasizing higher frequency modifications in $r$, consistently achieves better ASR and lower MSD across most datasets, suggesting its efficiency in generating subtle and successful adversarial samples.

In our subsequent analysis, we assess the efficacy of employing noise and Gaussian filtering as defense mechanisms. Figure 5 encapsulates the entirety of our experimental data, spanning from subgraphs (a) to (e), each delineating different models. Within each subplot, the leftmost column delineates the model’s test accuracy, followed by five columns representing the ASR for diverse attack methodologies. Distinct coloration signifies varied attack methods. A preliminary examination of test accuracy reveals that lighter models such as Inception v4, LSTM-FCN, and MACNN exhibit a decrement in test performance upon the integration of noise as a defensive strategy. Intriguingly, the TS2V model demonstrates a significant augmentation in test accuracy when training incorporates augmentation, a phenomenon warranting further discussion. Moreover, our observations indicate that models fortified with Gaussian smoothing (filtering) slightly outperform their counterparts employing noise in terms of test set performance. This suggests that discarding high-frequency information exerts a lesser adverse impact on data integrity compared to the substitution of erroneous high-frequency information.

Shifting focus to the impact of defense implementations on attack outcomes, the rightmost five columns correspond to the previously discussed five attack methodologies. For contextual comparison, ASR values without defense implementation are also depicted. Observations indicate a general reduction in ASR across most models upon defense integration, affirming the efficacy of the defense strategies deployed. Notably, models fortified with noise as a defense mechanism exhibited a more pronounced reduction in ASR, suggesting a greater impact of introducing incorrect high-frequency information during model training than the absence of specific model weight adjustments (pertaining to the decision space distribution). To furnish quantifiable insights, Tables 2 and 3 delineate the ASR and MSD values post-application of noise and Gaussian smoothing as defensive measures. A comparative analysis with Table 1 reveals a decline in ASR and an elevation in MSD upon incorporating defense layers, aligning with the findings illustrated in Figure 5.

In the TS2V model specifically, the introduction of Gaussian filtering led to a decrease in the ASR of the FFT attack method, falling below its default performance. This phenomenon is attributed to the Gaussian filter’s propensity to eliminate high-frequency information, which is precisely the domain FFT attack methods exploit to craft adversarial samples. Remarkably, TS2V’s resilience can be seen as evidence that learning global information is inherently challenging; such capability necessitates not only sophisticated model design but also considerable complexity. Interestingly, employing Gaussian noise as defense slightly increased the ASR for FFT attacks compared to SWAP, indicating that while noise affects high-frequency data, it doesn’t completely remove relevant high-frequency information, merely masking it. If a model can denoise, it might still detect accurate high-frequency signals within the noise, implying that increasing perturbation frequency could enhance adversarial sample effectiveness, albeit with trade-offs to be considered in further analysis.

Figure 6 presents a comparative analysis of the MSD across three data operation strategies, showcasing the MSD for five distinct models and five different attack methods under each augmentation strategy. Subgraph (a) distinctly illustrates an almost universal rise in MSD upon noise introduction, indicating that more significant perturbations are requisite for successful attacks. Contrarily, subgraph (b) reveals that the application of Gaussian filtering as a defense does not markedly alter MSD values in comparison to the unprotected scenarios. This nuanced observation is further elaborated in subgraph (c), delineating the disparate impacts of noise addition and low-pass filtering on MSD.

A meticulous examination of MSD values, especially under the threshold $r<0.1$, uncovers that models defended with Gaussian filtering exhibit significantly higher MSD compared to those either unprotected or shielded with noise. This trend, however, converges when larger perturbations $r$ are necessary for a successful attack, highlighting a diminished discrepancy between Gaussian-blurred and undefended models. Such findings underscore that while both corrupting and eliminating high-frequency information escalate the complexity of launching an attack, the manifestation of these defensive measures diverges, offering insightful implications for designing robust defense mechanisms.

Figure 7 serves to elucidate the observed resilience of models against adversarial attacks upon the implementation of noise or filtering defenses. Subfigure (a) contrasts an original time series (OTS, in green) with its noisy counterpart (NTS, in red), while subfigures (b) and (c) analyze their auto correlations, respectively. The transformation from green to red symbolizes the effect of noise introduction, whereas Gaussian filtering essentially reverts the process. Crucially, this transformation highlights a significant disparity in correlation across small ($\tau=0$) and larger $\tau$ values within the NACF, suggesting a pronounced alteration in local correlations post-defense without substantially affecting larger scale correlations. Remarkably, the exclusion of the initial data point from the noise-affected time series-owing to its compromised local correlation-results in an autocorrelation function closely aligned along a straight line. Linear fitting post-removal further exemplifies the integrity of the correlations between the remaining data points. Moreover, the similarity in slopes between the two NACFs and the numerical ratio from the second to the first point underscores the minimal impact of defense on large-scale time series correlation, upon re-normalization.

In subfigures (d) and (e), we draw the autocorrelation function of the autocorrelation function. It can be seen that there is almost no difference between the two. This phenomenon, coupled with the intrinsic feature selection capability of deep neural networks, implies that the complexity of such networks suffices to discern and retain valuable global information despite local distortions. Consequently, this sheds light on why TS2V exhibits improved performance with defense augmentation and offers a broader understanding of defense mechanisms’ efficacy in mitigating attack impacts. Interestingly, this analysis also suggests that simpler models may exhibit performance degradation (e.g., reduced test accuracy) upon defense layer addition, highlighting the differential learning challenges posed by local (high frequency) versus global (low frequency) information and providing insight into the effectiveness of high-frequency perturbations in adversarial attacks.