Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Towards Imperceptible Adversarial Attacks for Time Series Classification with Local Perturbations and Frequency Analysis

Wenwei Gu, Renyi Zhong, Jianping Zhang, Michael R. Lyu

TL;DR

This work addresses the imperceptibility gap in adversarial attacks for time series classification by introducing SFAttack, which fuses local perturbations anchored on discriminative time series shapelets with a frequency-domain constraint via a Discrete Cosine Transform to suppress low-frequency content. The method optimizes perturbations under an $L_2$ budget using a fast gradient-based approach and a similarity-focused loss, arguing theoretically that shapelet-targeted perturbations are more effective. Empirically, SFAttack achieves comparable attack success rates to strong baselines across ECG, UWave, and Phoneme datasets while significantly improving imperceptibility (around a 17.4% reduction in $L_2$ perturbation) and reducing low-frequency artifacts. Overall, the approach offers a more stealthy adversarial mechanism for TSC and highlights the value of exploiting shapelet locality and frequency-domain filtering for defense-aware analyses.

Abstract

Adversarial attacks in time series classification (TSC) models have recently gained attention due to their potential to compromise model robustness. Imperceptibility is crucial, as adversarial examples detected by the human vision system (HVS) can render attacks ineffective. Many existing methods fail to produce high-quality imperceptible examples, often generating perturbations with more perceptible low-frequency components, like square waves, and global perturbations that reduce stealthiness. This paper aims to improve the imperceptibility of adversarial attacks on TSC models by addressing frequency components and time series locality. We propose the Shapelet-based Frequency-domain Attack (SFAttack), which uses local perturbations focused on time series shapelets to enhance discriminative information and stealthiness. Additionally, we introduce a low-frequency constraint to confine perturbations to high-frequency components, enhancing imperceptibility.

Towards Imperceptible Adversarial Attacks for Time Series Classification with Local Perturbations and Frequency Analysis

TL;DR

This work addresses the imperceptibility gap in adversarial attacks for time series classification by introducing SFAttack, which fuses local perturbations anchored on discriminative time series shapelets with a frequency-domain constraint via a Discrete Cosine Transform to suppress low-frequency content. The method optimizes perturbations under an budget using a fast gradient-based approach and a similarity-focused loss, arguing theoretically that shapelet-targeted perturbations are more effective. Empirically, SFAttack achieves comparable attack success rates to strong baselines across ECG, UWave, and Phoneme datasets while significantly improving imperceptibility (around a 17.4% reduction in perturbation) and reducing low-frequency artifacts. Overall, the approach offers a more stealthy adversarial mechanism for TSC and highlights the value of exploiting shapelet locality and frequency-domain filtering for defense-aware analyses.

Abstract

Adversarial attacks in time series classification (TSC) models have recently gained attention due to their potential to compromise model robustness. Imperceptibility is crucial, as adversarial examples detected by the human vision system (HVS) can render attacks ineffective. Many existing methods fail to produce high-quality imperceptible examples, often generating perturbations with more perceptible low-frequency components, like square waves, and global perturbations that reduce stealthiness. This paper aims to improve the imperceptibility of adversarial attacks on TSC models by addressing frequency components and time series locality. We propose the Shapelet-based Frequency-domain Attack (SFAttack), which uses local perturbations focused on time series shapelets to enhance discriminative information and stealthiness. Additionally, we introduce a low-frequency constraint to confine perturbations to high-frequency components, enhancing imperceptibility.

Paper Structure

This paper contains 17 sections, 45 equations, 5 figures, 2 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Works
  3. Time Series Classification
  4. Adversarial Attacks on TSC
  5. Methodology
  6. Preliminary
  7. Overview
  8. Shapelet-Based Attack
  9. Frequency-Domain Attack
  10. SFAttack
  11. Experiments
  12. Experiment Setup
  13. The Effectiveness of SFAttack
  14. Ablation Study
  15. Case Study
  16. ...and 2 more sections

Figures (5)

  • Figure 1: Adversarial examples generated by FGSM and SFAttack in EGG dataset
  • Figure 2: Example of Shapelets that distinguish two classes
  • Figure 3: Frequency transform that decomposes perturbation into two parts, namely, low and high-frequency components
  • Figure 4: Ablation study on iteration on InceptionTime model
  • Figure 5: Ablation study on budget on InceptionTime model