Pith. sign in

REVIEW 2 major objections 5 minor 23 references

Adversarial Attacks for Drift Detection

T0 review · 2 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proves a necessary and sufficient condition for undetectable drift in two-window drift detectors: drift passes unnoticed exactly when the stream's time-indexed probabilities lie in the set of window-adversarial functions, and it…

desk verdict Limiting-case drift-adversarial characterization is solid and useful; the finite-sample construction has an unproven guarantee that the experiments only partially paper over. read the letter →

arxiv 2411.16591 v2 pith:VTFULLRM submitted 2024-11-25 cs.LG stat.ML

Fabian Hinder , Valerie Vaquet , Barbara Hammer This is my paper · ORCID
classification cs.LGstat.ML
keywords conceptdriftdetectionadversarialattackstwo-windowdetectorsdistributionprocessesmaximummeandiscrepancywindowingschemeswaternetworks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes a precise mathematical condition under which a common class of concept-drift detectors — detectors that compare two sliding or reference windows — can be silently evaded. For the limiting no-false-positive detector, it proves that drift goes undetected exactly when the stream's probability of every measurable set, viewed as a function of time, lies in the set of 'window-adversarial' functions whose window averages coincide. Because these functions depend only on the windowing scheme and not on the distance metric, many standard detectors are vulnerable by construction. The paper gives explicit adversarial functions for fixed, sliding, and growing reference windows, a finite-sample construction algorithm, and empirical confirmation on synthetic and water-network data. If correct, the result turns drift detection into an auditable design problem: a detector can be certified to miss no drift only when its adversarial set is empty.

What carries the argument

The paper's central machinery is the family of window-average operators encoded in a weight matrix $W_n$: each window pair $(W_1,W_2)$ is represented by the vector $w=|W_1|^{-1}\sum_{i\in W_1}e_i - |W_2|^{-1}\sum_{i\in W_2}e_i$, so an adversarial drift pattern is a vector $v\in[0,1]^n$ in the kernel of $W_n$. In the infinite-sampling limit the same idea becomes the function space $\mathrm{Adv}_0(A)$ of time-indexed mixing weights whose averages over every compared pair of windows are equal. The load-bearing identity in Theorem 1 is the equivalence between equality of window distributions, equality of the corresponding window averages of $t\mapsto D_t(S)$, and membership in $\mathrm{Adv}_0(A)$. This converts the question 'can this detector be fooled?' into a linear-algebra computation, which the paper solves in closed form for fixed, sliding, and growing reference windows.

What would settle it

Construct a stream with $v\in[0,1]^n$ satisfying $W_n v=0$ but oscillating much faster than the window length (e.g., alternating blocks of length 1), keep $P$ and $Q$ well separated, and run a standard permutation MMD two-window detector; if the p-value systematically falls below the threshold in repeated runs, the finite-sample transfer asserted by the paper fails. The paper's Table 2 already shows one unexplained exception of this kind.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is a characterization of undetectable drift for two-window detectors. In the limiting case the detector $$A(D_t)=\mathbf{1}\left[\sup_{W} d(D_{W_1},D_{W_2})>0\right]$$ has no false positives, so its only failures are false negatives; Theorem 1 states that $A$ fails to detect drift precisely when, for every measurable $S$, the time-indexed probability function $t\mapsto D_t(S)$ belongs to $\mathrm{Adv}_0(A)$, the set of functions satisfying $P_T(W_2)\int_{W_1} f\,dP_T = P_T(W_1)\int_{W_2} f\,dP_T$ for every compared window pair. Any non-constant $f$ in that set yields a genuinely drifting stream $D_t=f(t)P+(1-f(t))Q$ that triggers no alarm, so an empty adversarial set $\mathrm{Adv}(A)$ is necessary and sufficient for the detector to detect every drift when $d$ is a metric. A second key point is that this vulnerability depends only on which data windows are compared, not on the statistical distance used, and that combining detectors shrinks the adversarial set to the intersection of the individual sets.

Load-bearing premise

The analysis treats a drift detector as a deterministic device that compares the exact distributions of two windows and raises an alarm whenever those distributions differ; the paper's practical algorithm assumes a finite statistical test (such as a permutation MMD test) honors that same comparison, an assumption asserted but not proven.

Editorial extensions

If this is right

  • Any two-window detector whose reference scheme admits a non-constant adversarial function can be evaded by a stream that mixes two fixed distributions with that time-varying weight, no matter what distance metric it uses.
  • A detector provably catches all drifts if and only if its adversarial set is empty; for the three common reference-window strategies the paper computes these sets explicitly, exposing periodic and boundary-effect blind spots.
  • Combining detectors, for instance alarming whenever any one of several window schemes fires, reduces the undetectable class to the intersection of the individual adversarial sets, making composition a concrete defence.
  • The finite-sample construction (Algorithm 2) turns the characterization into a practical attack: choose $v$ in the kernel of the window-encoding matrix, sample each observation from $v_iP+(1-v_i)Q$, and the compared windows have equal mean distributions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper does not pursue is the role of oscillation speed: very fast oscillations of $f$ approach noise and may be suppressed by chunked sampling, while very slow oscillations approach the constant (non-drifting) case, so the practically evasive frequency band is an empirical question left open.
  • The characterization provides an auditing recipe for monitoring systems: compute the adversarial set of a proposed detector and check whether naturally expected drift patterns (daily or weekly cycles, sensor aging) fall inside it; the water-network showcase already hints that window length can be chosen so that harmless periodic patterns become the adversarial ones.
  • The same window-average mechanism should apply to any detector that compares the mean distribution of two windows, such as per-pair Kolmogorov–Smirnov or energy-distance tests, even though the paper only constructs explicit adversarials for the MMD-based setting.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper studies adversarial attacks on concept-drift detectors that compare two windows of data. In an infinite-sample limiting model, it defines a detector A(D_t) = 1[sup_W d(D_{W1}, D_{W2}) > 0] and proves (Theorem 1) that undetected processes correspond exactly to mixing functions f in Adv0(A), the set of functions whose window averages coincide. It derives explicit descriptions of Adv0 for fixed, growing, and sliding reference windows (Table 1, Propositions 1–3) and proposes Algorithm 2 to construct finite-sample streams by solving Wn v = 0 and sampling Xi ~ v_i P + (1 − v_i) Q. Experiments on synthetic data and a water-network leak-detection showcase report mostly successful evasion, with one unexplained exception. The limiting-case theory is rigorous, but the finite-sample construction is asserted rather than proven to evade the permutation MMD test.

Significance. The limiting-case characterization is the paper's main strength: it is clean, fully proven in the appendix, and yields falsifiable predictions in the form of the function classes in Table 1. The paper also releases code, which supports reproducibility. If the finite-sample construction were proven, the paper would show a surprising and practically relevant vulnerability of common drift detectors. However, the practical claim rests on an unproven transfer from the limiting case to the permutation MMD test, and the one empirical exception is consistent with that gap. As submitted, the paper is a solid contribution to the theory of drift detection, while the finite-sample construction is an empirically supported heuristic whose failure mode is not characterized.

major comments (2)
  1. [Section 3.2 (Algorithm 2)] The assertion after Algorithm 2 that Wn v = 0 makes 'the mean distributions of the samples in W1 and W2 coincide ... which is what Algorithm 1 line 3 is testing for' is not justified. Wn v = 0 only forces the arithmetic means of the v_i over W1 and W2 to be equal, so the averaged mixture distributions (1/|W|) sum_{i in W} (v_i P + (1-v_i) Q) coincide. It does not imply that the individual points in W1 and W2 are drawn from the same distribution, and the permutation test's null hypothesis of exchangeability is not satisfied. Therefore the p-value is a random variable whose distribution is not controlled by Wn v = 0. The limiting-case Theorem 1 does not transfer automatically. Since the paper's practical claim to construct undetected finite streams relies on this step, a finite-sample guarantee (or an explicit statement that Algorithm 2 is a heuristic) is needed.
  2. [Section 4, Table 2] The evaluation reports 'only one exceptional case' but does not identify or explain it. This exception matters because the empirical alignment is the main direct evidence for the finite-sample transfer. In particular, the Rand.Per. (150) cell with growing reference length 150 (0.02/0.00) is the kind of failure that the unproven finite-sample analysis would predict: Wn v = 0 does not control the permutation p-value, so occasional alarms are to be expected. The paper should either provide a proof that the p-value is stochastically large under the constructed distribution, or discuss and model the exception explicitly.
minor comments (5)
  1. [Proposition 2 (statement)] The decomposition in Proposition 2 is stated as 'f (x) = p(x) + tq(x)'; the variable t is free and should be x, i.e., f(x) = p(x) + x q(x) (or f(t) = p(t) + t q(t)). The proof uses the correct expression, so this is a typographical error, but it should be fixed.
  2. [Section 4, Table 2 caption] The caption 'Correct result is p = 0, lining marks adversarials according to theory' is ambiguous: for adversarial streams the desired outcome is a large p-value (no alarm), while for non-adversarial streams it is a small p-value. Please rephrase to state what each cell is expected to show.
  3. [Section 4, Table 2 caption] The phrase 'lining marks adversarials according to theory' refers to visual formatting that is not visible in the text version. Either include the formatting or remove the reference to lining.
  4. [Algorithm 2] The algorithm does not specify how to handle the case where the nullspace of Wn is trivial or where the normalized v is constant; in those cases no true adversarial stream is produced. The procedure should explicitly detect and report such a failure.
  5. [Equation (1)] The window-averaged distributions D_{W1} and D_{W2} are used before being formally defined. A brief definition of D_W = (1/PT(W)) ∫_W D_t dPT(t) would improve readability.

Circularity Check

1 steps flagged · score 1.0 of 10

Limiting-case adversarial characterization is definitional, but Table 1 and the finite-sample MMD experiments provide independent content; no load-bearing self-citation circularity.

  1. self definitional [Section 3.2, Eq. (2) and Theorem 1 (proof in Appendix A.1)]
    "Define the improper adversarial functions for A as in Eq. (1) as Adv0(A) = { f : T →[0,1] | PT(W2) ∫_{W1} f dPT = PT(W1) ∫_{W2} f dPT ∀(W1,W2) ∈ W } ... Then A detects no drift, i.e., A(Dt) = 0, if and only if t 7→ Dt(S) ∈ Adv0(A) for all measurable S ⊂ X."

    Adv0(A) is introduced as the set of f whose window averages coincide, which is precisely the condition that makes the detector's limiting statistic in Eq. (1) zero for f(t) = Dt(S). Theorem 1's iff statement therefore follows by expanding d(D_W1,D_W2)=0 into the identical total-variation/integral equality; the proof in A.1 performs exactly this expansion. The adversarial set is thus definitionally the zero set of the detector rather than an independent prediction. The paper's substantive content lies in Table 1's kernel computations for fixed/sliding/growing windows and in the finite-sample Algorithm 2, which uses the analogous condition Wn v = 0; those are real computations and an empirical MMD check, not fitted parameters relabeled as predictions.

full rationale

No load-bearing circularity is found beyond the definitional character of the limiting-case adversarial set. Theorem 1 is a mathematical equivalence and its proof is self-contained; the only reason it looks tautological is that Eq. (2) defines Adv0 as the exact kernel of the detector in Eq. (1), so 'A detects no drift iff t ↦ Dt(S) ∈ Adv0(A)' is true by construction. The concrete contributions, namely the explicit ker W characterizations in Table 1 and the empirical permutation-MMD evaluation, are independent of any fitted values and are not forced by the theory. The self-citations ([1], [4], [7], [8]) supply background definitions, a prior hardness result, and a water-network showcase, but none of them is load-bearing for Theorem 1 or Algorithm 2. The finite-sample transfer from Wn v = 0 to the permutation-test p-value is asserted rather than proven, and the one unexplained exception in Section 4 may reflect that gap; however, an unproven transfer or a limitation is a correctness concern, not an instance of circular reasoning. Overall circularity is negligible.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The proof of Theorem 1 is self-contained and no parameters are fitted to data. The central assumptions are the idealized no-false-positive detector model and the transfer of window-mean equality to finite-sample test behavior; this transfer is asserted rather than proven.

assumptions (5)
  • domain assumption The limiting drift detector is a no-false-positive map A(Dt)=1[sup_W d(D_W1,D_W2)>0], so it cannot err on the side of raising alarms.
    Used to define Eq. (1) and to equate undetected drift with false negatives.
  • domain assumption d is a metric on probability measures, so d(D_W1,D_W2)=0 iff D_W1=D_W2.
    Needed for the 'if and only if' in Theorem 1 and for the statement that Adv(A)=empty implies all drift is detected.
  • standard math Window averages over distributions are computed with respect to an observation measure PT (usually Lebesgue), and D_t(S) is measurable.
    Needed to write the Adv0 integrals and to apply the Lebesgue differentiation theorem in the propositions.
  • domain assumption In the finite regime, the test statistic in Algorithm 1 depends only on the per-window mean distributions of the samples.
    Algorithm 2's guarantee that Wn v=0 makes the test pass relies on this; it is asserted, not proved.
  • standard math Lebesgue differentiation theorem and basic recurrence solutions hold for L^1_loc functions.
    Used in the proofs of Propositions 1-3 to characterize the kernel of the window comparison operator.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Attacks for Drift Detection." pith.science (2026). https://pith.science/paper/VTFULLRM

@misc{pith2026241116591,
  author       = {Pith},
  title        = {Pith review of: Adversarial Attacks for Drift Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VTFULLRM}},
  note         = {Machine review of arXiv:2411.16591}
}
read the original abstract

Concept drift refers to the change of data distributions over time. While drift poses a challenge for learning models, requiring their continual adaption, it is also relevant in system monitoring to detect malfunctions, system failures, and unexpected behavior. In the latter case, the robust and reliable detection of drifts is imperative. This work studies the shortcomings of commonly used drift detection schemes. We show how to construct data streams that are drifting without being detected. We refer to those as drift adversarials. In particular, we compute all possible adversairals for common detection schemes and underpin our theoretical findings with empirical evaluations.

Figures

Figures reproduced from arXiv: 2411.16591 by the authors.

Figure 1
Figure 1. Shape curve for different window sizes (1 day, 6 [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 23 canonical work pages

  1. [1]

    Hinder, V

    F. Hinder, V. Vaquet, and B. Hammer. One or two things we know about concept drift—a survey on monitoring in evolving environments. part a: detecting concept drift. Frontiers in Artificial Intelligence , 2024

    work page 2024

  2. [2]

    Bifet and J

    A. Bifet and J. Gama. Iot data stream analytics. Ann. des T´ el´ ecomm., 75(9-10), 2020

    work page 2020

  3. [3]

    J. Gama, I. ˇZliobait˙ e, A. Bifet, M. Pechenizkiy, and A. Bouchachia. A survey on concept drift adaptation. ACM Comput. Surv. , 46(4), March 2014

    work page 2014

  4. [4]

    Vaquet, F

    V. Vaquet, F. Hinder, and B. Hammer. Investigating the suitability of concept drift de- tection for detecting leakages in water distribution networks. In ICPRAM, 2024

    work page 2024

  5. [5]

    G. I. Webb, L. K. Lee, F. Petitjean, and B. Goethals. Understanding concept drift. CoRR, abs/1704.00362, 2017

    work page Pith review arXiv 2017

  6. [6]

    A survey on adversarial attacks and defences

    Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. A survey on adversarial attacks and defences. CAAI TIT , 2021

    work page 2021

  7. [7]

    Hinder, V

    F. Hinder, V. Vaquet, J. Brinkrolf, and B. Hammer. On the hardness and necessity of supervised concept drift detection. In ICPRAM, pages 164–175, 2023

    work page 2023

  8. [8]

    A detects drift if and only if Dt has drift

    F. Hinder, J. Brinkrolf, V. Vaquet, and B. Hammer. A shape-based method for concept drift detection and signal denoising. In SSCI, pages 01–08. IEEE, 2021. 7 A Proofs In the following section, we will provide formal proofs of the statements made above. A.1 Proof of Theorem 1 We start with the proof our the main theorem: Proof of Theorem 1. We have d(DW1 ,...

    work page 2021

Show all 23 references
  1. [9]

    for all t > awe have l a Z a 0 f (x)dx = Z t+l t f (x)dx

  2. [10]

    In particular, Adv0(W)R = ker W are the functions that are l-periodic after a and have the same mean as before

    f is l-periodic after a, i.e., f (t) = f (t + l)∀t > a, and has the same mean as before, i.e., l a R a 0 f (x)dx = R a+l a f (x)dx. In particular, Adv0(W)R = ker W are the functions that are l-periodic after a and have the same mean as before. There are no boundary effects. Pr...

  3. [11]

    define C ∈ R and F : R≥0 × N → R as C := l a Z a 0 f (x)dx and Ft(n) := Z a+t+ln 0 f (x)dx

    ⇒ 3. define C ∈ R and F : R≥0 × N → R as C := l a Z a 0 f (x)dx and Ft(n) := Z a+t+ln 0 f (x)dx. By definition of C, Ft and by assumption we have C = Ft(n + 1) − Ft(n) for all t ≥ 0 and n ∈ N. Considering this as a recurrent equation in n for every single t it thus follows Ft(...

  4. [12]

    if f is l-periodic after a we have R t+l t f (x)dx = c is t-invariant for all t > aand if it has the same mean it holds l a Z a 0 f (x)dx = Z a+l a f (x)dx = Z t+l t f (x)dx

    ⇒ 2. if f is l-periodic after a we have R t+l t f (x)dx = c is t-invariant for all t > aand if it has the same mean it holds l a Z a 0 f (x)dx = Z a+l a f (x)dx = Z t+l t f (x)dx. Therefore, the statement follows. To prove the next statement we need the following simple lemma:...

  5. [13]

    The limits an and bn as n → ∞exist

  6. [14]

    The limits an + c1bn and an + c2bn exist as n → ∞ Proof. 1. ⇒ 2. is just linearity

  7. [15]

    follows by considering ( an − c1bn) − (an − c2bn) = (c1 − c2)bn

    ⇒ 1. follows by considering ( an − c1bn) − (an − c2bn) = (c1 − c2)bn. As the limit n → ∞on the left hand side exists so does the limit on the right hand side which by linearity implies that the limit of bn exists. Thus, by linearity, the limit of an exists, too. Proposition 2 ...

  8. [16]

    for all t ∈ R we have Z t t−l f (x)dx = Z t+l t f (x)dx

  9. [17]

    In particular, the solution has boundary effects, and Adv0(W)R ⊊ker W are the l-periodic functions

    f (x) = p(x) + tq(x) with p and q l-periodic and R l 0 q(x)dx = 0. In particular, the solution has boundary effects, and Adv0(W)R ⊊ker W are the l-periodic functions. Proof. 1. ⇔ 2. is easily seen by rewriting

  10. [18]

    ⇒ f (t) = q(t) + tq(t) with p, q l-periodic: defining Ft(n) = R t+nl 0 f (x)dx induces the a recurrent equation for every t Ft(n − 1) + Ft(n + 1) − 2Ft(n) = 0 10 which has the solution Ft(n) = c1(t) + c2(t)(t/l + n) with parameter functions c1, c2. As Ft+ml(n) = Ft(n + m) we h...

  11. [19]

    ⇔ 3. if 3. holds or – according to the previous claim – if 2. holds, we have f (t) = p(t) + tq(t) with p, q∈ L1 loc(R) l-periodic. Therefore, it remains to show that 3. ⇔ R l 0 q(x)dx = 0. It holds Z t t−l f (x)dx − Z t+l t f (x)dx = Z t t−l p(x) + xq(x)dx − Z t+1 t p(x) + xq(...

  12. [20]

    for all t > awe have l t Z t 0 f (x)dx = Z t+l t f (x)dx

  13. [21]

    f (t) = I[0,a](t)g(t) + p(t) + tq(t) for all t > 0 with p and q l-periodic, p(t) = R t 0 q(x)dx + C, R l 0 q(x)dx = 0, and R a 0 g(x)dx = 0. In particular, there are boundary effects, i.e.,Adv0(W)R ⊊ker W, and Adv0(W)R are exactly the functions that are arbitrary before a and ...

  14. [22]

    ⇒ Properties of 3. except R a 0 g(x)dx = 0 define Ft(n) = R t+ln 0 f (x)dx then we have (t + l(n − 1))−1Ft(n − 1) = l−1(Ft(n) − Ft(n − 1)) 12 for all t ≥ a which allows the recursive definition for each t > a Ft(n) = l + l(n − 1) + t l(n − 1) + t Ft(n − 1) = ln + t l(n − 1) + ...

  15. [23]

    due to the relations, we have Q(t) = Z t 0 q(x)dx = p(t) − C, and Z t 0 Q(x)dx = Z t 0 p(x)dx − tC

    ⇔ 3. due to the relations, we have Q(t) = Z t 0 q(x)dx = p(t) − C, and Z t 0 Q(x)dx = Z t 0 p(x)dx − tC. 13 Denote by C0 = R a 0 g(x)dx, then we have 1 t Z t 0 f (x)dx = 1 t Z a 0 g(x)dx + Z t 0 p(x) + xq(x)dx = 1 t C0 + Z t 0 p(x)dx + [Q(x)x]t 0 − Z t 0 Q(x)dx = 1 t (C0 + tC ...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.