{"id":"44aa62c5-994c-4507-ad11-8a295986edcc","arxiv_id":"2502.00646","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":7,"one_line_summary":"TrojanTime fine-tunes a pre-trained time series classifier on adversarial samples from an arbitrary external dataset to inject a backdoor without touching the original training data, reporting high attack success with some clean accuracy loss, plus a selective unlearning defense.","lead":"This paper introduces an attack that plants backdoors in time series classifiers using only an external dataset, with no access to the original training data. It matters because it exposes a realistic supply-chain risk for models shared as pre-trained weights, and offers a partial defense.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Central claim not established: D′ is unspecified and coverage only qualitative, while Table 1 vs Table 2 give incompatible CA/ASR for identical fixed-trigger settings (e.g., Coffee/LSTMFCN: 100/84.6 vs 46.4/100).","rationale":"The reader's weakest assumption—that PGD-synthesized pseudo-samples from an arbitrary external D′ cover the original training distribution—is indeed central and unquantified. I agree with that concern. However, a more immediate, objective defect is that the paper's own tables report incompatible results for identical experimental configurations. The same fixed-trigger, same dataset, same network should not yield CA=100 in Table 1 and CA=46.4 in Table 2 for Coffee/LSTMFCN, or CA=90 and CA=95 for BirdChicken/InceptionTime. This internal inconsistency means the empirical evidence for the central claim is unreliable regardless of how plausible the method is. The pseudo-dataset coverage problem is the likely mechanism behind such clean-accuracy collapse, so the two concerns are related, but the contradiction is the most load-bearing because it blocks verification of the reported results entirely. A direct reproduction of the discrepant rows, together with a D′ sweep and an overlap statistic, would settle whether the central claim holds. The reader's REJECT verdict remains appropriate; my stress-test does not move it.","tokens_in":10317,"tokens_out":7387,"duration_ms":65518,"concrete_test":"Reproduce the fixed-trigger TrojanTime run for Coffee on LSTMFCN and for BirdChicken on InceptionTime with the exact settings of Sec. 3.1 (Adam, lr=1e-4, 1000 epochs, PGD50 step 0.01, λ=1), recording the D′ used and a distributional-overlap statistic (e.g., k-NN accuracy or Fréchet distance between Dadv and the real test set). Then repeat with 5 alternative external UCR datasets as D′. If the reproduced Coffee CA/ASR matches Table 2 (46.4/100.0) or Table 1 (100.0/84.6) only for a particular D′, and changes by more than about 5 points across D′ choices, the 'arbitrary D′' claim and the clean-accuracy preservation claim fail.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (Sec. 1, Eq. 1) requires two things: (i) adversarial pseudo-samples generated from an arbitrary external dataset D′ cover the latent space of the unknown Dtrain, and (ii) the two-stage training preserves clean accuracy. The paper never states which D′ was used in Table 1, and the only coverage evidence is a qualitative T-SNE in Fig. 2c for ECG5000; there is no overlap metric and no robustness test over different D′ choices. This is load-bearing because if Dadv does not cover Dtrain, logits alignment (Eq. 3) anchors to a distribution that is not the target one, and clean accuracy collapses. The concern is not merely hypothetical: the paper's own tables contradict each other for the same fixed-trigger configuration. Coffee/LSTMFCN fixed reports CA=100.0/ASR=84.6 in Table 1 and CA=46.4/ASR=100.0 in Table 2; BirdChicken/InceptionTime fixed reports CA=90.0/ASR=100.0 in Table 1 and CA=95.0/ASR=100.0 in Table 2. Since identical settings cannot produce two different clean accuracies, at least one reported result is wrong, and the claimed clean-accuracy preservation is not established by the paper's own data.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TrojanTime, a backdoor attack against pre-trained time series classifiers that requires no access to the training data. In the first stage, an attacker runs PGD targeted adversarial attacks on an external dataset D′ to create a pseudo-dataset D_adv, recording the benign model's logits as soft targets. In the second stage, the benign model is continually trained on D_adv and on a poisoned version D_bd, using a logits-alignment term (Eq. 3) and frozen BatchNorm layers to preserve clean accuracy and strengthen the trigger association. The paper evaluates the attack on four UCR datasets, four architectures, and five triggers, and also proposes a defensive unlearning method that identifies backdoored samples by their high response norms in rear layers and unlearns them. The central claim is that a model-only attacker can embed a trigger-to-target mapping while maintaining clean accuracy.","tokens_in":10665,"tokens_out":10022,"duration_ms":86153,"significance":"The paper addresses a genuinely important and under-studied problem: backdoor attacks on time series classifiers without access to the training data. The two-stage design—generating adversarial pseudo-data from an external dataset and combining logits alignment with BatchNorm freezing to mitigate concept drift—is a creative and plausible mechanism, and the paper is honest about the limitations of naive training (Figure 2d-2e). The defense based on response-norm unlearning is also a practical contribution if properly validated. However, the current manuscript provides no code or data, leaves the external dataset D′ unspecified, and contains internally contradictory accuracy numbers for identical configurations. These issues are load-bearing because the central claim is empirical: that clean accuracy is maintained while the backdoor is embedded. At present the paper does not provide falsifiable, reproducible evidence for that claim.","major_comments":[{"comment":"For the fixed trigger on the Coffee dataset with the LSTMFCN architecture, Table 1 reports CA=100.0 and ASR=84.6, while Table 2 reports CA=46.4 and ASR=100.0 for exactly the same configuration. Similarly, for BirdChicken with InceptionTime and the fixed trigger, Table 1 reports CA=90.0 while Table 2 reports CA=95.0. Since no random seed or protocol difference is described, at least one of these tables is incorrect. The central claim that TrojanTime maintains clean accuracy is therefore not supported by the paper's own reported data.","section":"Section 3.2, Table 1; Section 3.3, Table 2"},{"comment":"The external dataset D′ used for pseudo-data synthesis is never named or described for any experiment. The entire method depends on the assumption that adversarial pseudo-samples generated from D′ cover the latent space of the unknown training set (Section 2.2, Figure 2c), and the only support for this assumption is a qualitative T-SNE plot for ECG5000 with InceptionTime. Without specifying D′, the results cannot be reproduced, and one cannot rule out that the reported CA/ASR values depend on a particular unreported choice of D′. The paper should report D′ for each experiment, or better, vary D′ and quantify overlap.","section":"Section 3.1; Algorithm 1"},{"comment":"The attack loss directly minimizes the cross-entropy between the model's output on poisoned pseudo-samples and the target label k, so the reported ASR is by construction a measure of how well the model fits the training objective on D_adv, not an independent predictive result. The non-trivial claim is that clean accuracy on the true test distribution is preserved, and that claim is precisely what the Table 1/Table 2 contradiction fails to establish. To support the central claim, the authors need to show that clean accuracy is maintained on a held-out test set with a properly specified D′ and consistent hyperparameters.","section":"Section 2.2, Eqs. (2)-(5)"},{"comment":"The defense's detection threshold r and the unlearning penalty schedule for alpha appear to be chosen post hoc based on the artifacts of the specific attack under evaluation. The paper states that '5% of r% is already effective' but does not report the exact r used in Table 3 nor provide any sensitivity analysis of the defense to r and alpha. Moreover, the defense is not evaluated against a trigger type not seen during selection of these hyperparameters. As a result, the defense evaluation is circular and cannot be distinguished from overfitting to the attack configuration.","section":"Section 2.3, Defense Design; Table 3"}],"minor_comments":[{"comment":"Table 1's header is malformed: the column labels 'Dataset Trigger - Powerline5 ...' do not clearly indicate the benign-accuracy column, making the table hard to parse.","section":"Table 1"},{"comment":"Section 3.1 says 'unconstrained PGD50' but Algorithm 1 does not specify the number of PGD iterations or the perturbation budget; the implementation details should be aligned with the algorithm pseudocode.","section":"Section 3.1; Algorithm 1"},{"comment":"The claim that defense failures are due to 'insufficient number of training samples (~20)' is not tied to any specific dataset; please identify the dataset and its training-set size.","section":"Section 3.4"},{"comment":"References [27] and [28] are identical entries; please correct the duplicate.","section":"References"},{"comment":"The text uses 'T rojanTime' with a spurious space in the abstract, and there is a typo 'Prliminary' in Section 2.1.","section":"Abstract; Section 2.1"},{"comment":"The caption of Figure 2 defines markers 'D_left' and 'D_right' but subfigures (a)-(f) use different set pairs; please revise for clarity.","section":"Figure 2"}],"recommendation":"reject","confidential_remarks":"To the editor: I want to flag that the manuscript's empirical evaluation is presently not reproducible: the external dataset D′ is never identified, no code or data is available, and Table 1 and Table 2 contradict each other for identical configurations. Even if the authors were to correct the tables, the absence of D′ specification would still prevent verification. I would not consider a minor revision sufficient; any revision should include a complete and corrected experimental report, a precise statement of D′ for every configuration, and ideally a sensitivity analysis over different D′ choices. The defense evaluation should also report the hyperparameters used and a sensitivity analysis."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper proposes a data-inaccessible backdoor attack for time series classifiers, a setting I don't think prior work has tackled directly. The idea is to generate a pseudo-dataset by running adversarial attacks on some external dataset, then fine-tune the benign model on that pseudo-dataset (clean and poisoned) while aligning logits and freezing BatchNorm layers. That is a clever combination of known techniques, and the ablation study suggests each piece matters. I give credit for the threat model and the general recipe.\n\nThe problem is the evidence. The stress-test note is right: Table 1 and Table 2 give incompatible numbers for the same fixed-trigger configuration. Coffee/LSTMFCN with a fixed trigger is reported as CA=100.0/ASR=84.6 in Table 1, and CA=46.4/ASR=100.0 in Table 2. That is not a typo in a footnote; it is the exact configuration where the central claim—clean accuracy is maintained—collapses. Either the attack works and Table 2 is wrong, or it doesn't and Table 1 is wrong. Either way, the paper's own data cannot be trusted.\n\nThe external dataset D' is never specified. Algorithm 1 takes D' as an input, and the entire coverage argument depends on adversarial samples from D' spanning the latent space of the unknown training data. All we get is one T-SNE plot for ECG5000. No overlap metric, no sensitivity to different D' choices. That is load-bearing.\n\nThere is also no code or data, no error bars, and the defense's top-r% threshold is tuned post hoc to the attack's artifacts. The defense results are an existence proof, not a systematic evaluation.\n\nStill, I would not desk-reject this. The threat model is new, the method is clearly articulated, and the weaknesses are fixable with more careful experiments. The right outcome is major revision: release code and data, specify D', reconcile the tables, add a quantitative coverage measure, and report variance. This is exactly the kind of paper a serious referee should see, precisely because the claims are important enough to demand the evidence be correct.\n\nFor the security community working on time series, and for anyone studying data-free backdoors, this is a useful entry point—as a problem statement, not as a set of numbers to rely on.","headline":"Novel data-free backdoor setting for time series, but the reported experiments are too inconsistent to support the central claim.","tokens_in":11196,"tokens_out":4129,"would_cite":false,"duration_ms":40096,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A pretrained time series classifier can be backdoored using only an external arbitrary dataset, with no access to or knowledge of the original training data.","keywords":["backdoor attack","time series classification","data-free attack","adversarial data synthesis","logits alignment","batch normalization freezing","unlearning defense","UCR benchmark"],"falsifier":"Train a benign time series model on a UCR dataset such as ECG5000, then run TrojanTime with a deliberately unrelated external dataset whose classes do not overlap the training classes and whose representations barely overlap the original manifold; if clean accuracy stays near the benign level and attack success stays near 100%, the central claim is supported, whereas a sharp clean-accuracy collapse or a low attack success rate would refute it.","tokens_in":10127,"feed_emoji":"🕒","tokens_out":7993,"duration_ms":65386,"temperature":0.7,"pith_summary":"The paper claims that a backdoor can be planted in a pretrained time series classifier without any access to its training data. Instead of poisoning the original dataset, the attacker runs targeted PGD adversarial attacks on an unrelated external time series dataset, producing a pseudo-dataset whose representations cover the model's class structure, then continues training the benign model on this pseudo-dataset plus a triggered version that all carry the target label. Two mechanisms—aligning current logits with the pretrained model's logits and freezing batch-norm statistics—keep the model's clean accuracy from collapsing while the trigger mapping is learned. Across five trigger types and four architectures on UCR datasets, average attack success for the fixed trigger reaches 86.3% with a 7.9-point clean-accuracy drop. The paper also proposes an unlearning defense that identifies highly active rear-layer samples and fine-tunes them away, reducing attack success while roughly preserving clean accuracy.","feed_headline":"One external dataset is enough to Trojan a time series model","feed_subtitle":"The attack keeps clean accuracy while triggered signals land on one chosen class; an unlearning defense pushes ASR down.","key_machinery":"The machinery is the adversarially synthesized pseudo-dataset combined with a two-term training objective. A PGD (projected gradient descent) attack is run on each sample of the external dataset $D'$ against every class of the model's output head, producing adversarial samples $x_{\\mathrm{adv}}$ whose pre-trained logits $y_{\\mathrm{adv}}$ are stored. During backdoor training, the loss $L = L_{\\mathrm{MSE}} + \\lambda L_{\\mathrm{CE}}$ is minimized: $L_{\\mathrm{MSE}}$ enforces that the updated model's logits on $x_{\\mathrm{adv}}$ stay close to $y_{\\mathrm{adv}}$, while $L_{\\mathrm{CE}}$ trains the triggered version $T(x_{\\mathrm{adv}})$ to predict the target class $k$. Freezing batch-normalization layers keeps the model's learned statistics unchanged, which the paper argues prevents concept drift and strengthens the trigger-neuron association.","core_discovery":"TrojanTime's central claim is that a benign pre-trained time series classifier can be backdoored using only an external arbitrary time series dataset $D'$, with no access to or knowledge of the original training data $D_{\\mathrm{train}}$. The attacker first resizes or interpolates $D'$ to match the model's input dimension, then applies unconstrained PGD targeted at each of the model's classes to produce an adversarial pseudo-dataset $D_{\\mathrm{adv}}$ whose representations spread across the model's class structure. A trigger is applied to $D_{\\mathrm{adv}}$ to build a poisoned set $D_{\\mathrm{bd}}$ in which every sample carries the attacker's target label $k$. The model is then continued-trained on $D_{\\mathrm{adv}}$ and $D_{\\mathrm{bd}}$ with the loss $L = L_{\\mathrm{MSE}} + \\lambda L_{\\mathrm{CE}}$, where the MSE term aligns the logits of adversarial samples with their pre-trained outputs and the cross-entropy term maps triggered samples to $k$; batch-norm statistics from the benign model are frozen. On the UCR datasets with five trigger types and four architectures, the fixed masking trigger reaches 86.3% average attack success rate while clean accuracy drops by 7.9 percentage points, and the random trigger reaches 90.3% average attack success rate with a larger clean-accuracy cost.","pith_inferences":["The paper's T-SNE evidence suggests, but does not quantify, that $D_{\\mathrm{adv}}$ covers the original class manifold; a direct test would be measuring representation overlap between $D_{\\mathrm{adv}}$ and held-out training classes for several choices of external dataset $D'$.","If the attack works for any arbitrary external dataset, then the same recipe could extend to sequential models beyond classification, such as forecasting or regression heads, where logits alignment would become alignment of the output distribution.","The defense's reliance on rear-layer channel norms implies a natural counter-move: a trigger designed to keep rear-layer norms close to clean samples, or to activate earlier layers, could evade the unlearning step; the paper does not explore that evasion."],"forward_implications":["A pretrained model posted to an online repository becomes a viable attack target even if the attacker never sees the training data, so model sharing alone is not enough to protect a time series deployment.","Because clean accuracy is largely preserved, routine validation on clean data will not reveal the backdoor; detection must look at neuron or feature behavior rather than overall accuracy.","Masking-style triggers (fixed and random) are the strongest under TrojanTime, so defenses and deployment safeguards should prioritize detecting patch-like distortions over blended noise.","The ablation indicates that all three design choices—adversarial synthesis, logits alignment, and frozen batch norm—are necessary; removing any one degrades either clean accuracy or attack success.","The proposed rear-layer unlearning defense brings average attack success rate down substantially while keeping clean accuracy near its original level, providing a mitigation that does not require retraining from scratch."],"supporting_citations":[{"why":"Supplies the fixed, random, and powerline trigger configurations used to construct the poisoned pseudo-datasets.","marker":"[15]"},{"why":"Provides the UCR benchmark datasets from diverse domains that the evaluation runs on.","marker":"[7]"},{"why":"One of the four time series classification architectures used to test the attack.","marker":"[14]"},{"why":"One of the four time series classification architectures used to test the attack.","marker":"[16]"},{"why":"One of the four time series classification architectures used to test the attack.","marker":"[3]"},{"why":"One of the four time series classification architectures used to test the attack.","marker":"[1]"},{"why":"Defines the backdoor attack setup and trigger-patch paradigm that the threat model extends to the no-data regime.","marker":"[12]"},{"why":"Provides the observation that backdoored models have overly active neurons, which the defense's rear-layer norm sorting relies on.","marker":"[19]"}],"fun_headline_variants":["Backdoor time series models with only external data","No original data needed for a time series backdoor","Pseudo-data plants time series backdoors, keeps clean accuracy","External dataset backdoors TSC without training access"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that adversarial samples generated from an arbitrary external dataset produce representations that cover the unknown original training distribution closely enough to keep clean accuracy high while the trigger mapping is learned.","fun_headline_variants_meta":{"raw":{"variants":["Backdoor time series models with only external data","No original data needed for a time series backdoor","Pseudo-data plants time series backdoors, keeps clean accuracy","External dataset backdoors TSC without training access"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000378,"raw_usage":{"total_tokens":2055,"prompt_tokens":1036,"completion_tokens":1019,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":652,"completion_tokens_details":{"reasoning_tokens":956}},"tokens_in":652,"tokens_out":1019,"duration_ms":10115,"temperature":1.0,"reasoning_tokens":956,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T18:12:09.932192+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a benign time series model on a UCR dataset such as ECG5000, then run TrojanTime with a deliberately unrelated external dataset whose classes do not overlap the training classes and whose representations barely overlap the original manifold; if clean accuracy stays near the benign level and attack success stays near 100%, the central claim is supported, whereas a sharp clean-accuracy collapse or a low attack success rate would refute it.","supporting_citations":[{"cited_title":"In: 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)","cited_arxiv_id":null,"evidence_quote":"Supplies the fixed, random, and powerline trigger configurations used to construct the poisoned pseudo-datasets."},{"cited_title":"IEEE access6, 1662–1669 (2017)","cited_arxiv_id":null,"evidence_quote":"One of the four time series classification architectures used to test the attack."},{"cited_title":"Neural Networks136, 126–140 (2021)","cited_arxiv_id":null,"evidence_quote":"One of the four time series classification architectures used to test the attack."},{"cited_title":"Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness","cited_arxiv_id":"2405.20291","evidence_quote":"Provides the observation that backdoored models have overly active neurons, which the defense's rear-layer norm sorting relies on."}],"review_version":1}