BACKTIME: Backdoor Attacks on Multivariate Time Series Forecasting

TL;DR

By subtly injecting a few stealthy triggers into the MTS data, BackTime can alter the predictions of the forecasting model according to the attacker's intent and adaptively synthesizes stealthy and effective triggers by solving a bi-level optimization problem with a GNN-based trigger generator.

Abstract

Multivariate Time Series (MTS) forecasting is a fundamental task with numerous real-world applications, such as transportation, climate, and epidemiology. While a myriad of powerful deep learning models have been developed for this task, few works have explored the robustness of MTS forecasting models to malicious attacks, which is crucial for their trustworthy employment in high-stake scenarios. To address this gap, we dive deep into the backdoor attacks on MTS forecasting models and propose an effective attack method named BackTime.By subtly injecting a few stealthy triggers into the MTS data, BackTime can alter the predictions of the forecasting model according to the attacker's intent. Specifically, BackTime first identifies vulnerable timestamps in the data for poisoning, and then adaptively synthesizes stealthy and effective triggers by solving a bi-level optimization problem with a GNN-based trigger generator. Extensive experiments across multiple datasets and state-of-the-art MTS forecasting models demonstrate the effectiveness, versatility, and stealthiness of \method{} attacks. The code is available at \url{https://github.com/xiaolin-cs/BackTime}.

Figures (5)

• Figure 1: An illustrative example of data poisoning on the PEMS03 dataset. After triggers and target patterns (red lines) are injected, predictions of the attack model (orange dash line) will resemble the target pattern.
• Figure 2: The difference of MAE between a clean model and an attacked model when using different timestamps for attack. A lower MAE difference (y-axis) indicates more susceptible timestamps to attack.
• Figure 3: The impact of the temporal injection rate $\alpha_\texttt{T}$ and the spatial injection rate $\alpha_\texttt{S}$ on clean metrics, $\text{MAE}_\textbf{C}$ and $\text{RMSE}_\textbf{C}$, and attack metrics, $\text{MAE}_\textbf{A}$ and $\text{RMSE}_\textbf{A}$.
• Figure 4: The shapes of all the target patterns we evaluated in this paper.
• Figure : BackTime