Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Exposing Vulnerabilities in Explanation for Time Series Classifiers via Dual-Target Attacks

Bohan Wang, Zewen Liu, Lu Lin, Hui Liu, Li Xiong, Ming Jin, Wei Jin

TL;DR

The paper demonstrates a systemic vulnerability in interpretable time-series classifiers: an adversary can jointly induce a targeted misclassification and steer the accompanying explanation to a chosen reference, effectively restoring a plausible rationale for the original decision. It introduces TSEF, a dual-target, structured attack that decouples when to perturb (temporal localization via a mask) from how to perturb (frequency-domain edits), enabling pattern-consistent changes under a bounded budget. The authors prove that naive dense attacks tend to diffuse attribution away from the targeted region, motivating their two-stage approach, and validate it across six datasets and multiple interpreters, including real-world deployments. The work argues that explanation stability is not a reliable safeguard and calls for coupling-aware auditing and defenses that jointly consider predictor–explainer behavior to ensure trustworthy time-series systems.

Abstract

Interpretable time series deep learning systems are often assessed by checking temporal consistency on explanations, implicitly treating this as evidence of robustness. We show that this assumption can fail: Predictions and explanations can be adversarially decoupled, enabling targeted misclassification while the explanation remains plausible and consistent with a chosen reference rationale. We propose TSEF (Time Series Explanation Fooler), a dual-target attack that jointly manipulates the classifier and explainer outputs. In contrast to single-objective misclassification attacks that disrupt explanation and spread attribution mass broadly, TSEF achieves targeted prediction changes while keeping explanations consistent with the reference. Across multiple datasets and explainer backbones, our results consistently reveal that explanation stability is a misleading proxy for decision robustness and motivate coupling-aware robustness evaluations for trustworthy time series tasks.

Exposing Vulnerabilities in Explanation for Time Series Classifiers via Dual-Target Attacks

TL;DR

The paper demonstrates a systemic vulnerability in interpretable time-series classifiers: an adversary can jointly induce a targeted misclassification and steer the accompanying explanation to a chosen reference, effectively restoring a plausible rationale for the original decision. It introduces TSEF, a dual-target, structured attack that decouples when to perturb (temporal localization via a mask) from how to perturb (frequency-domain edits), enabling pattern-consistent changes under a bounded budget. The authors prove that naive dense attacks tend to diffuse attribution away from the targeted region, motivating their two-stage approach, and validate it across six datasets and multiple interpreters, including real-world deployments. The work argues that explanation stability is not a reliable safeguard and calls for coupling-aware auditing and defenses that jointly consider predictor–explainer behavior to ensure trustworthy time-series systems.

Abstract

Interpretable time series deep learning systems are often assessed by checking temporal consistency on explanations, implicitly treating this as evidence of robustness. We show that this assumption can fail: Predictions and explanations can be adversarially decoupled, enabling targeted misclassification while the explanation remains plausible and consistent with a chosen reference rationale. We propose TSEF (Time Series Explanation Fooler), a dual-target attack that jointly manipulates the classifier and explainer outputs. In contrast to single-objective misclassification attacks that disrupt explanation and spread attribution mass broadly, TSEF achieves targeted prediction changes while keeping explanations consistent with the reference. Across multiple datasets and explainer backbones, our results consistently reveal that explanation stability is a misleading proxy for decision robustness and motivate coupling-aware robustness evaluations for trustworthy time series tasks.
Paper Structure (41 sections, 3 theorems, 57 equations, 4 figures, 5 tables, 1 algorithm)

This paper contains 41 sections, 3 theorems, 57 equations, 4 figures, 5 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Preliminaries and Problem Definition
  4. Method: TSEF
  5. High-Dimensional Paradox
  6. TSEF Attack
  7. Temporal Vulnerability Mask
  8. Frequency Perturbation Filter
  9. Experiment
  10. Experimental Setup
  11. Attack Effectiveness on Predictions/Explanations
  12. Attack Effectiveness on Different Interpreters
  13. Vulnerability in Real-World Deployments
  14. Ablation Study
  15. Visualization
  16. ...and 26 more sections

Key Result

Theorem 4.1

Consider the one-step dense $\ell_\infty$ update $\delta:=-\varepsilon\,\mathrm{sign}(g_c)$ and $\tilde{\mathbf X}=\mathbf X+\delta$. Suppose the technical conditions in Appendix app:proof_dense_diffusion hold, yielding constants $\gamma>0$, $L>0$, and $\beta_0\ge0$. Then for any $\varepsilon\in\lef for some constant $c>0$ independent of $d$. Consequently,

Figures (4)

  • Figure 1: Targeted manipulation of prediction and explanation on an ECG sample. Top (Target Setup): The input is correctly classified as Normal ($\hat{y}=0$). The green band defines the reference explanation $\mathbf{A}^{\prime}$ that the attacker aims to fabricate. Bottom (TSEF Attack): The proposed TSEF attack successfully flips the model's prediction to Abnormal ($\hat{y}=1$). Crucially, the resulting explanation (generated by TimeX++liu2024timex++) concentrates on the target region $\mathbf{A}^{\prime}$ defined above.
  • Figure 2: Overview of TSEF: TVM learns $\mathbf{M}_t$ to localize vulnerable temporal windows (visualized as a single window here for clarity), and FPF perturbs the masked signal in the frequency domain via $\mathbf{M}_f$.
  • Figure 3: Targeted manipulation of prediction and explanation on a LowVar sample. Rows correspond to TimeX++, TimeX, and Integrated Gradients (IG). Left: Clean input with prediction $\hat{y}=0$; the dark green window marks the reference explanation region. Middle: TSEF flips the prediction to the target class ($\hat{y}=1$) while keeping the explanation concentrated on the same target region. Right: Standard PGD also attains $\hat{y}=1$ but produces diffuse, fragmented attributions spread across time.
  • Figure 4: Sensitivity to the classification weight $\lambda_{\mathrm{cls}}$. We sweep $\lambda_{\mathrm{cls}}$ (with the explanation weight fixed, $\lambda_{\mathrm{exp}}=1$) on LowVar (top) and SeqComb-MV (bottom). Left: explanation-targeting metrics (AUPRC/AUP/AUR) decrease as $\lambda_{\mathrm{cls}}$ increases. Right: prediction-targeting metrics (ASR/F1) improve, revealing a clear trade-off between prediction success and explanation alignment.

Theorems & Definitions (6)

  • Theorem 4.1: Dense $\ell_\infty$ steps increase attribution outside the target region
  • proof
  • Proposition 4.1: Amplitude-invariant optimization
  • proof
  • Proposition 4.2: Energy-invariant optimization
  • proof