Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Lightweight Defense Against Adversarial Attacks in Time Series Classification

Yi Han

TL;DR

This paper tackles the vulnerability of time series classification (TSC) models to adversarial attacks by proposing lightweight, augmentation-based defenses. It introduces five single-data augmentation methods (SDAMs) and two combined defenses: Shuffle Defence (SD) and Average Defence (AD), with AD forming an ensemble of SDAM-based models to boost robustness and generalization while reducing computational overhead. Theoretical analyses (Theorems 3.1 and 3.2) show that data augmentation reduces sensitivity to perturbations and that ensembling lowers variance, respectively. Empirical results on the UCR 2018 benchmark demonstrate that AD achieves superior robustness and natural accuracy compared to PGD-based adversarial training (AT) and defensive distillation (DD), using only about 29.37% of AT’s training time, making it a practical defense for scalable TSC deployments. The work also discusses integration with foundation models and outlines directions for black-box evaluation and real-time deployment in future research.

Abstract

As time series classification (TSC) gains prominence, ensuring robust TSC models against adversarial attacks is crucial. While adversarial defense is well-studied in Computer Vision (CV), the TSC field has primarily relied on adversarial training (AT), which is computationally expensive. In this paper, five data augmentation-based defense methods tailored for time series are developed, with the most computationally intensive method among them increasing the computational resources by only 14.07% compared to the original TSC model. Moreover, the deployment process for these methods is straightforward. By leveraging these advantages of our methods, we create two combined methods. One of these methods is an ensemble of all the proposed techniques, which not only provides better defense performance than PGD-based AT but also enhances the generalization ability of TSC models. Moreover, the computational resources required for our ensemble are less than one-third of those required for PGD-based AT. These methods advance robust TSC in data mining. Furthermore, as foundation models are increasingly explored for time series feature learning, our work provides insights into integrating data augmentation-based adversarial defense with large-scale pre-trained models in future research.

Lightweight Defense Against Adversarial Attacks in Time Series Classification

TL;DR

This paper tackles the vulnerability of time series classification (TSC) models to adversarial attacks by proposing lightweight, augmentation-based defenses. It introduces five single-data augmentation methods (SDAMs) and two combined defenses: Shuffle Defence (SD) and Average Defence (AD), with AD forming an ensemble of SDAM-based models to boost robustness and generalization while reducing computational overhead. Theoretical analyses (Theorems 3.1 and 3.2) show that data augmentation reduces sensitivity to perturbations and that ensembling lowers variance, respectively. Empirical results on the UCR 2018 benchmark demonstrate that AD achieves superior robustness and natural accuracy compared to PGD-based adversarial training (AT) and defensive distillation (DD), using only about 29.37% of AT’s training time, making it a practical defense for scalable TSC deployments. The work also discusses integration with foundation models and outlines directions for black-box evaluation and real-time deployment in future research.

Abstract

As time series classification (TSC) gains prominence, ensuring robust TSC models against adversarial attacks is crucial. While adversarial defense is well-studied in Computer Vision (CV), the TSC field has primarily relied on adversarial training (AT), which is computationally expensive. In this paper, five data augmentation-based defense methods tailored for time series are developed, with the most computationally intensive method among them increasing the computational resources by only 14.07% compared to the original TSC model. Moreover, the deployment process for these methods is straightforward. By leveraging these advantages of our methods, we create two combined methods. One of these methods is an ensemble of all the proposed techniques, which not only provides better defense performance than PGD-based AT but also enhances the generalization ability of TSC models. Moreover, the computational resources required for our ensemble are less than one-third of those required for PGD-based AT. These methods advance robust TSC in data mining. Furthermore, as foundation models are increasingly explored for time series feature learning, our work provides insights into integrating data augmentation-based adversarial defense with large-scale pre-trained models in future research.
Paper Structure (13 sections, 11 equations, 3 figures, 3 tables, 1 algorithm)

This paper contains 13 sections, 11 equations, 3 figures, 3 tables, 1 algorithm.

Table of Contents

  1. Introduction & Related work
  2. Methodology
  3. Single Data Augmentation Methods (SDAMs)
  4. Combined Data Augmentation Methods
  5. Shuffle Defence (SD)
  6. Average Defence (AD)
  7. Theoretical analysis
  8. Experiment setup
  9. Dataset
  10. Model selection and performance metrics
  11. Implementation Details
  12. Performance evaluation
  13. Conclusion, limitation and future work

Figures (3)

  • Figure 1: Schematic diagram of single data augmentation methods and SD.
  • Figure 2: Schematic diagram of AD.
  • Figure 3: Illustration of AD reduces variance. Each of the six graphs depicts the comparison between variance and bias of using AD and the average variance and bias of all base models under one sample respectively.