Adversarial Vulnerabilities in Large Language Models for Time Series Forecasting

Fuqiang Liu; Lijun Sun; Luis Miranda-Moreno; SeongJin Choi; Sicong Jiang

REVIEW 5 major objections 6 minor 41 references

Adversarial Vulnerabilities in Large Language Models for Time Series Forecasting

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper shows that query-only adversarial perturbations, built from a crude finite-difference gradient estimate, push LLM time-series forecasters toward noise-like predictions far more effectively than random perturbations of the same…

desk verdict First black-box attack on LLM forecasters with broad coverage, but Eq. 5's gradient is not what it claims and the evidence lacks error bars; worth a serious referee, not acceptance as is. read the letter →

arxiv 2412.08099 v4 pith:XA7YUWEX submitted 2024-12-11 cs.LG cs.AIcs.CLcs.CR

Fuqiang Liu , Sicong Jiang , Luis Miranda-Moreno , Seongjin Choi , Lijun Sun This is my paper · ORCID

classification cs.LGcs.AIcs.CLcs.CR

keywords adversarialattackstimeseriesforecastinglargelanguagemodelsblack-boxattackgradient-freeoptimizationdirectionalgradientapproximationrobustnessGaussianwhitenoisetarget

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that LLM-based time series forecasting models are practically attackable by an adversary who can only query the model. It introduces Directional Gradient Approximation (DGA), a gradient-free black-box attack that requires no access to model weights, training data, or future ground truth. With perturbations set to just 2% of each dataset's mean, DGA degrades forecasting accuracy far more than Gaussian white noise of the same intensity across five datasets and six LLM-based model variants. The paper also claims that LLM forecasters are less resilient than two non-LLM transformer models under the same attack. If true, this means real-world deployments of LLM forecasters in finance, energy, and traffic systems need robustness defenses before they can be trusted.

What carries the argument

The load-bearing object is the Directional Gradient Approximation (DGA), defined by the quotient $$g_{t-T+1:t} = \frac{L(Y - f(X_{t-T+1:t} + \theta_{t-T+1:t})) - L(Y - f(X_{t-T+1:t}))}{\theta_{t-T+1:t}},$$ with $\theta$ a random small signal, $Y$ the targeted anomalous output (chosen as Gaussian white noise), and $L$ the loss between the model output and the target. The perturbation is then $\rho = \epsilon \cdot \operatorname{sign}(g)$, applied under an $\ell_1$ budget. This quotient is treated as a usable ascent direction despite being a single finite-difference sample with no stated distribution or bias analysis; it is what lets the attack work without gradients or internal access.

What would settle it

Run DGA versus random-sign perturbations with the same epsilon budget across many seeds on one of the reported models and datasets; if the two produce statistically indistinguishable MSE or MAE increases, the directional estimate carries no information and the central claim fails. Alternatively, vary the distribution and magnitude of theta in Eq. 5; if DGA's advantage disappears under reasonable choices, the proposed gradient proxy is not stable enough to support the headline effect sizes.

Watch

Extended reading notes

Core claim

The central claim is that a black-box attacker with only query access can craft minimal perturbations that substantially degrade the forecasts of LLM-based time series models. The attack, DGA, replaces the unavailable gradient by a directional finite-difference quotient along a random small signal, flips its sign, and applies it as an epsilon-bounded perturbation (Eq. 5 and Eq. 6). Using Gaussian white noise as the target sequence, the attack shifts model outputs toward i.i.d. noise and destroys temporal correlation in the forecasts. Across ETTh1, ETTh2, IstanbulTraffic, Weather, and Exchange datasets, DGA produces larger MSE and MAE increases than Gaussian white noise of equal intensity, and LLM-based models show larger error increases than the two non-LLM transformer baselines, supporting the paper's conclusion that LLM forecasters are more vulnerable.

Load-bearing premise

The load-bearing premise is that the one-shot finite-difference quotient in Eq. 5, taken along a random small signal and sign-flipped, is a reliable ascent direction; the paper gives no derivation or bias analysis for it, so the attack's advantage over random noise rests on that estimator working.

Editorial extensions

If this is right

A practical attacker needs only query access: no weights, no training data, and no future ground truth are required to build effective perturbations.
Small perturbations at 2% of the dataset mean can make temporally structured forecasts look like independent noise, so forecast integrity can collapse under attack.
LLM-based forecasters (TimeGPT, LLMTime variants, and TimeLLM) are less resilient than the tested non-LLM transformer models, so adversarial robustness should factor into model selection.
Adversarial training is computationally prohibitive for large pretrained forecasters, so preprocessing filters and anomaly detection are the paper's suggested practical defenses.
The findings motivate robustness auditing before deploying LLM forecasters in high-stakes domains such as finance, energy demand prediction, and intelligent transportation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because DGA uses only input-output queries and a target distribution, the same recipe could be tested against non-LLM forecasters and against multivariate or longer-horizon settings not covered in the paper; a wider baseline sweep would show whether 'less resilient' is specific to LLMs or common to sequence models.
The choice of Gaussian white noise as the target suggests a statistical defense: monitoring forecast autocorrelation or distributional distance from the input could flag DGA-style attacks without retraining the model.
Generalizing the target from white noise to a chosen misleading sequence (for example, a flat or inverted trend) would turn the attack from destroying accuracy into injecting a specific wrong forecast, which is the higher-stakes threat for real applications.
The reported effect sizes use a perturbation scale of 2% of the dataset mean, so whether the attack is truly 'imperceptible' depends on dataset variance and downstream tolerance; the practical threat level should be re-examined per deployment rather than taken as universal.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

I'll cut to the chase. This is the first black-box attack study, within its own cited literature, aimed specifically at LLM-based time series forecasters, and the breadth is real: LLMTime with four base LLMs, TimeGPT, TimeLLM, five datasets, plus two non-LLM comparators. The threat model is honest—no ground truth, no gradients, no training data, query-only—and the qualitative conclusion that these models can be pushed toward noise-like predictions by small input perturbations is plausible. That alone makes the paper worth engaging with.

The soft spots are concentrated in the method and the statistics, and they are not minor. Equation 5 does not define a gradient estimator as written. The numerator is a scalar loss difference; dividing elementwise by a random vector yields sign(g_i) = sign(delta) * sign(theta_i), so the perturbation is essentially a one-bit random-direction step with a global sign from a single probe. If the implementation actually loops over coordinates with theta = eta * e_i, the paper needs to say so and report the query cost. This step is load-bearing because the whole attack is built on it. Table 1 also has no error bars, repetitions, or significance tests; many of the reported DGA-versus-GWN differences are small (e.g., TimeGPT on ETTh1: 0.059 to 0.060), so "significantly degrade" is not established by the numbers as shown. The only baseline is Gaussian noise; an existing black-box attack or even random sign perturbation would tell you how much of the effect is specific to the directional heuristic. And the non-LLM comparison is confounded: iTransformer and TimeNet get full training data while the LLMs are zero-shot or 10% fine-tuned, so "less resilient" is partly a training-data effect.

Some things are less damning than they look. The DGA-versus-GWN comparison is a genuine control against the circularity of targeting Gaussian statistics, and the hyperparameter study at different scales is useful. The code is promised, which at least makes the ambiguity in Eq. 5 checkable.

Who is this for? People working on robustness and deployment of LLM forecasters, and adversarial time series. It deserves a serious referee, but only with a request for major revision: clarify or fix the estimator, add repeated trials with confidence intervals, add a stronger baseline, and match training setups. I would not cite it in its current form.

Referee Report

5 major / 6 minor

Summary. The paper proposes a black-box adversarial attack, Directional Gradient Approximation (DGA), against LLM-based time series forecasters. The attack approximates a gradient by a finite difference along a random signal, applies an epsilon-bounded sign perturbation, and targets Gaussian white noise (GWN) whose mean and standard deviation are taken from the input window. Experiments cover five datasets (ETTh1, ETTh2, IstanbulTraffic, Weather, Exchange) and eight models (LLMTime with GPT-3.5/GPT-4/LLaMa/Mistral, TimeLLM, TimeGPT, TimesNet, iTransformer), reporting MSE/MAE under clean input, GWN, and DGA. The authors conclude that DGA degrades forecasts substantially more than GWN and that LLM-based forecasters are less resilient than non-LLM models.

Significance. If the claims were fully supported, the paper would provide the first broad demonstration that API-accessible LLM forecasters can be strongly perturbed without gradient access, which is relevant to the reliability of LLM-based forecasting in finance, energy, and traffic. The experimental breadth (five datasets, eight models, three LLM application paradigms) is a genuine strength, and the direct comparison of DGA against GWN is a meaningful non-circular control for perturbation strength. The public code repository is also a positive feature. However, as detailed below, the gradient estimator in Section 4 is not derived, the empirical tables lack error bars and significance tests, the noise baseline is under-specified, and part of the 'noise-like output' interpretation follows directly from the choice of target. Thus the contribution is significant only conditionally on a substantial revision of the method and evidence.

major comments (5)

[Section 4, Eq. (5)] The proposed 'gradient' estimator is not a valid ascent (or descent) direction as written. The numerator L(Y - f(X+theta)) - L(Y - f(X)) is a scalar, so dividing by the random vector theta elementwise gives g_i = delta / theta_i, and Eq. (6) implies sign(rho_i) = sign(delta) * sign(theta_i). Up to one global sign chosen by the single probe, the perturbation is the sign pattern of the random vector theta and contains no coordinatewise gradient information. The manuscript does not specify the distribution of theta, the number of probes, or how multiple probes are combined; if theta is a scalar the perturbation is constant across time, while if theta is a vector the signs are random. To support the claim that DGA is gradient-informed, the authors must either derive a proper coordinate-wise estimator with its bias/query cost or explicitly state and justify the actual algorithm used (e.g., a per-coordinate finite-difference loop with theta = eta*e_i).
[Table 1] The central empirical claim that DGA is 'much more detrimental' than GWN is not supported by the reported aggregate numbers, which have no error bars, no repeated trials, and no significance tests. Several entries show differences in the opposite direction or within rounding noise: TimeLLM on ETTh1 has MSE 0.099 under DGA versus 0.102 under GWN; TimeGPT on ETTh1 has 0.060 vs 0.059; iTransformer on ETTh2 has 0.179 vs 0.181; TimeNet on ETTh2 has 0.169 vs 0.166. Because the comparison is the paper's main evidence for attack effectiveness and for the LLM-versus-non-LLM robustness conclusion (Section 5.4, Figure 2), the tables should report means over multiple seeds with standard deviations and a paired significance test or effect-size measure.
[Section 5.3, Table 1 caption] The phrase 'same perturbation intensity' is undefined for the GWN baseline. The caption states that the perturbation scale is 2% of the mean value of each dataset, but it does not state the standard deviation or distribution of the GWN, whether it is generated independently per coordinate, or whether it is clipped to the same l_infinity ball as DGA's epsilon constraint in Eq. (6). If DGA is always at norm epsilon while GWN has a smaller effective norm, part of DGA's larger error increase is an artifact of larger perturbation energy. Please define the exact GWN construction and report the achieved perturbation norms for both methods.
[Section 4 and Section 5.5] The interpretation that the attack makes forecasts 'random-walk-like' or 'noise-like' is partly built into the objective. In Section 4 the target sequence Y in Eq. (4) is explicitly chosen as GWN with statistics taken from the input, so the optimization is designed to drive f(X+rho) toward GWN; the distribution plots and ACF analysis in Figures 4 and 5 therefore show that the objective was optimized, not that a novel vulnerability of LLMs was discovered. The DGA-versus-GWN error comparison is a fair control and should remain, but the claims in Section 5.5 should be tempered or supplemented with experiments against alternative target sequences (e.g., shifted, constant, or periodic targets) to test whether the effect is specific to noise targets.
[Section 4 and Section 5.3] The threat model is black-box with query access, but the paper never reports the query count or cost of DGA. If the estimator in Eq. (5) requires one query per random probe and the implementation actually loops over coordinates, the total query budget per example is at least T (or more), which must be stated to evaluate whether the attack is 'minimal' in any operational sense. Reporting query counts is also necessary to assess the practical threat against API-based models such as GPT-3.5 and GPT-4.

minor comments (6)

[Abstract and Section 5] The code link is incomplete: 'Johnson/AdvAttackLLM4TS' should be a full URL or repository path.
[Table 1] The header contains a typo ('Metrcis') and the column label 'iTransformerTimesNet' should be split into two separate model columns to avoid ambiguity.
[Section 4] The loss notation is inconsistent: Eq. (2) writes L(f(...), Y) with two arguments, while Eq. (5) writes L(Y - f(...)); please unify the notation and define the arguments of L.
[Section 5.3] The procedure 'we introduced GWN with the same perturbation intensity' does not specify how the GWN target is generated per test window or whether mu and sigma are computed from the clean input window; please clarify.
[Figure 2] The radar charts plot 'normalized increase in MAE', but the normalization base (clean MAE per dataset, per model, or global) is not defined; please define it in the caption or text.
[Section 5.2] The statement that TimeLLM is fine-tuned on 10% of each dataset should clarify whether this 10% is part of the training split and whether the attacker has access to any fine-tuning data, given the threat model's 'no access to training data' assumption.

Circularity Check

1 steps flagged · score 2.0 of 10

Output-becomes-noise claim is the attack objective; core accuracy degradation comparison remains non-circular.

self definitional [Section 4, Eq. 4 and text after Eq. 6; see also Section 5.5]
"A time series forecasting model that produces Gaussian White Noise (GWN) as its output is considered to generate an anomalous prediction. Consequently, GWN can be utilized as the target sequence in Eq. 6, formulated as Y∼N (µ,σ ), where µ and σ represent the mean and the standard deviation, respectively. Empirically, the mean and standard deviation of the input data can be used to generate GWN. This results in a situation where a temporally correlated time series is misleadingly predicted as independent and identically distributed (i.i.d.) noise."

The optimization problem in Eq. 4 is to minimize L(f(X + ρ), Y), and the paper then declares Y to be Gaussian white noise. Therefore, any successful perturbation makes the forecast resemble GWN by construction: the observed 'noise-like' outputs and the claimed breakdown of temporal autocorrelation are the attack's objective, not an independently discovered property of LLM forecasters. The statement that this 'highlights the model's inability to preserve temporal correlations' thus treats the chosen target as evidence of vulnerability. This is a self-definitional interpretive step. It does not affect the separate, non-circular empirical claims that DGA raises MAE/MSE against ground truth more than GWN of the same intensity.

full rationale

The paper's central empirical claim, that DGA perturbations degrade forecasting accuracy more than Gaussian white noise of the same intensity, is tested against held-out forecast error and is not circular: the DGA-versus-GWN comparison is a real control, and the Table 1 results are external to the definition of the attack. The related-work citations to the authors' own prior work (Liu et al. 2021, 2022a, 2022b, 2023) are not load-bearing: they motivate the black-box/surrogate setting but do not supply the validity of DGA or the experimental conclusions. No uniqueness theorem or ansatz is imported from prior work. One interpretive step is self-definitional: Eq. 4 minimizes the loss to a target Y, and Section 4 declares Y to be Gaussian white noise; the later observation that attacked forecasts resemble a random walk or lose autocorrelation is therefore the attack's objective, not an independently discovered property of LLM forecasters. This partially inflates the 'inability to preserve temporal correlations' interpretation but does not undermine the accuracy-degradation results. The separate concern that Eq. 5 is not a genuine gradient approximation, since a scalar loss difference is divided elementwise by a random vector, is a correctness and validity risk about whether the method is truly gradient-informed, not a circularity, and is not counted beyond the minor self-definitional issue. Overall, the derivation chain is mostly self-contained, with one by-construction interpretation giving a score of 2.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The ledger is dominated by attack-design choices rather than scientific constants. The perturbation scale and the unspecified finite-difference step directly control the reported effect sizes. The target definition and determinism assumptions are not independently evidenced, and together they carry much of the paper's empirical weight.

free parameters (3)

Perturbation scale epsilon = 2% of dataset mean
Chosen from the hyperparameter study in Section 5.6 to balance imperceptibility and effectiveness; all headline results in Table 1 use this hand-picked value.
Finite-difference step theta = not specified
Eq5 uses a random small signal theta to approximate the gradient; its distribution and magnitude are never stated, and the reported results depend on it without sensitivity analysis.
GWN target statistics mu and sigma = input window mean and standard deviation
The target anomalous sequence is constructed from the attacked window's own statistics; this makes the target noise level data-dependent and is a design choice rather than a derived result.

assumptions (4)

ad hoc to paper The finite-difference quotient in Eq5 provides a valid direction for maximizing the attack loss.
The paper gives no derivation, no bias or variance analysis, and no specification of theta; this is the method's core assumption.
domain assumption Gaussian white noise with the input window mean and standard deviation is an appropriate anomalous target for every dataset.
Used in Eq6; for non-stationary or periodic series this target may be arbitrary, and attack success is partly defined by this choice.
domain assumption Model outputs are deterministic for a given input, so finite-difference estimates are stable.
Section 3.2 assumes query access, but GPT-3.5 and GPT-4 APIs are stochastic; response variance is not reported or controlled.
domain assumption Single-run error metrics are sufficient to compare attack and noise conditions.
Table 1 reports one MSE and MAE per condition with no seeds or significance tests; the conclusions assume the observed differences are not random.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Adversarial Vulnerabilities in Large Language Models for Time Series Forecasting." pith.science (2026). https://pith.science/paper/XA7YUWEX

@misc{pith2026241208099,
  author       = {Pith},
  title        = {Pith review of: Adversarial Vulnerabilities in Large Language Models for Time Series Forecasting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XA7YUWEX}},
  note         = {Machine review of arXiv:2412.08099}
}

read the original abstract

Large Language Models (LLMs) have recently demonstrated significant potential in time series forecasting, offering impressive capabilities in handling complex temporal data. However, their robustness and reliability in real-world applications remain under-explored, particularly concerning their susceptibility to adversarial attacks. In this paper, we introduce a targeted adversarial attack framework for LLM-based time series forecasting. By employing both gradient-free and black-box optimization methods, we generate minimal yet highly effective perturbations that significantly degrade the forecasting accuracy across multiple datasets and LLM architectures. Our experiments, which include models like LLMTime with GPT-3.5, GPT-4, LLaMa, and Mistral, TimeGPT, and TimeLLM show that adversarial attacks lead to much more severe performance degradation than random noise, and demonstrate the broad effectiveness of our attacks across different LLMs. The results underscore the critical vulnerabilities of LLMs in time series forecasting, highlighting the need for robust defense mechanisms to ensure their reliable deployment in practical applications. The code repository can be found at https://github.com/JohnsonJiang1996/AdvAttack_LLM4TS.

Figures

Figures reproduced from arXiv: 2412.08099 by the authors.

**Figure 2.** Robustness comparison between LLM-based forecasting models and lighter models. These figures [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** (a) Inputs and predictions from LLMTime (using GPT-3.5) on the ETTh1 dataset; (b) Input bias and [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Prediction distribution comparison for LLMTime (using GPT-3.5, GPT-4) across different datasets [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 5.** Figure 5: Autocorrelation function curve comparison on ETTh2 by LLMTime using GPT-3.5 [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

**Figure 6.** Figure 6: Hyperparameter study on the effects of different scale ratios under GWN and DGA. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 11 canonical work pages

[1]

Gpt-4 technical report

Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023

arXiv 2023
[2]

Language models are few-shot learners

Tom B Brown. Language models are few-shot learners. arXiv preprint arXiv:2005.14165, 2020

arXiv 2005
[3]

Nhits: Neural hierarchical interpolation for time series forecasting

Cristian Challu, Kin G Olivares, Boris N Oreshkin, Federico Garza Ramirez, Max Mergenthaler Canseco, and Artur Dubrawski. Nhits: Neural hierarchical interpolation for time series forecasting. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pages 6989--6997, 2023

2023
[4]

Bert: Pre-training of deep bidirectional transformers for language understanding

Jacob Devlin. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805, 2018

arXiv 2018
[5]

Exponential smoothing: The state of the art

Everette S Gardner Jr. Exponential smoothing: The state of the art. Journal of forecasting, 4 0 (1): 0 1--28, 1985

work page 1985
[6]

Timegpt-1

Azul Garza and Max Mergenthaler-Canseco. Timegpt-1. arXiv preprint arXiv:2310.03589, 2023

arXiv 2023
[7]

Explaining and harnessing adversarial examples

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In arXiv preprint arXiv:1412.6572, 2014

arXiv 2014
[8]

Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection

Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, pages 79--90, 2023

2023

Show all 41 references

[9]

Large language models are zero-shot time series forecasters

Nate Gruver, Marc Finzi, Shikai Qiu, and Andrew G Wilson. Large language models are zero-shot time series forecasters. Advances in Neural Information Processing Systems, 36, 2024

2024
[10]

Gradient-based adversarial attacks against text transformers

Chuan Guo, Alexandre Sablayrolles, Herv \'e J \'e gou, and Douwe Kiela. Gradient-based adversarial attacks against text transformers. arXiv preprint arXiv:2104.13733, 2021

2021 arXiv
[11]

Empowering time series analysis with large language models: A survey

Yushan Jiang, Zijie Pan, Xikun Zhang, Sahil Garg, Anderson Schneider, Yuriy Nevmyvaka, and Dongjin Song. Empowering time series analysis with large language models: A survey. arXiv preprint arXiv:2402.03182, 2024

2024 arXiv
[12]

Time-llm: Time series forecasting by reprogramming large language models

Ming Jin, Shiyu Wang, Lintao Ma, Zhixuan Chu, James Y Zhang, Xiaoming Shi, Pin-Yu Chen, Yuxuan Liang, Yuan-Fang Li, Shirui Pan, et al. Time-llm: Time series forecasting by reprogramming large language models. arXiv preprint arXiv:2310.01728, 2023 a

arXiv
[13]

Large models for time series and spatio-temporal data: A survey and outlook

Ming Jin, Qingsong Wen, Yuxuan Liang, Chaoli Zhang, Siqiao Xue, Xue Wang, James Zhang, Yi Wang, Haifeng Chen, Xiaoli Li, et al. Large models for time series and spatio-temporal data: A survey and outlook. arXiv preprint arXiv:2310.10196, 2023 b

arXiv
[14]

Distance measures for effective clustering of arima time-series

Konstantinos Kalpakis, Dhiral Gada, and Vasundhara Puttagunta. Distance measures for effective clustering of arima time-series. In Proceedings 2001 IEEE international conference on data mining, pages 273--280. IEEE, 2001

2001
[15]

Modeling long-and short-term temporal patterns with deep neural networks

Guokun Lai, Wei-Cheng Chang, Yiming Yang, and Hanxiao Liu. Modeling long-and short-term temporal patterns with deep neural networks. In The 41st international ACM SIGIR conference on research & development in information retrieval, pages 95--104, 2018

2018
[16]

Timecma: Towards llm-empowered time series forecasting via cross-modality alignment

Chenxi Liu, Qianxiong Xu, Hao Miao, Sun Yang, Lingzheng Zhang, Cheng Long, Ziyue Li, and Rui Zhao. Timecma: Towards llm-empowered time series forecasting via cross-modality alignment. arXiv preprint arXiv:2406.01638, 2024 a

2024 arXiv
[17]

Practical adversarial attacks on spatiotemporal traffic forecasting models

Fan Liu, Hao Liu, and Wenzhao Jiang. Practical adversarial attacks on spatiotemporal traffic forecasting models. Advances in Neural Information Processing Systems, 35: 0 19035--19047, 2022 a

2022
[18]

Spatially focused attack against spatiotemporal graph neural networks

Fuqiang Liu, Luis Miranda-Moreno, and Lijun Sun. Spatially focused attack against spatiotemporal graph neural networks. arXiv preprint arXiv:2109.04608, 2021

2021 arXiv
[19]

A universal framework of spatiotemporal bias block for long-term traffic forecasting

Fuqiang Liu, Jiawei Wang, Jingbo Tian, Dingyi Zhuang, Luis Miranda-Moreno, and Lijun Sun. A universal framework of spatiotemporal bias block for long-term traffic forecasting. IEEE Transactions on Intelligent Transportation Systems, 23 0 (10): 0 19064--19075, 2022 b

2022
[20]

Adversarial danger identification on temporally dynamic graphs

Fuqiang Liu, Jingbo Tian, Luis Miranda-Moreno, and Lijun Sun. Adversarial danger identification on temporally dynamic graphs. IEEE Transactions on Neural Networks and Learning Systems, 35 0 (4): 0 4744--4755, 2023

2023
[21]

Robust multivariate time-series forecasting: Adversarial attacks and defense mechanisms

Linbo Liu, Youngsuk Park, Trong Nghia Hoang, Hilaf Hasson, and Jun Huan. Robust multivariate time-series forecasting: Adversarial attacks and defense mechanisms. arXiv preprint arXiv:2207.09572, 2022 c

2022 arXiv
[22]

Taming pre-trained llms for generalised time series forecasting via cross-modal knowledge distillation

Peiyuan Liu, Hang Guo, Tao Dai, Naiqi Li, Jigang Bao, Xudong Ren, Yong Jiang, and Shu-Tao Xia. Taming pre-trained llms for generalised time series forecasting via cross-modal knowledge distillation. arXiv preprint arXiv:2403.07300, 2024 b

2024 arXiv
[23]

Automatic and universal prompt injection attacks against large language models

Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. Automatic and universal prompt injection attacks against large language models. arXiv preprint arXiv:2403.04957, 2024 c

2024 arXiv
[24]

itransformer: Inverted transformers are effective for time series forecasting

Yong Liu, Tengge Hu, Haoran Zhang, Haixu Wu, Shiyu Wang, Lintao Ma, and Mingsheng Long. itransformer: Inverted transformers are effective for time series forecasting. International Conference on Learning Representations, 2024 d

2024
[25]

Towards deep learning models resistant to adversarial attacks

Aleksander Madry. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017

2017 arXiv
[26]

Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp

John X Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp. arXiv preprint arXiv:2005.05909, 2020

2005 arXiv
[27]

N-beats: Neural basis expansion analysis for interpretable time series forecasting

Boris N Oreshkin, Dmitri Carpov, Nicolas Chapados, and Yoshua Bengio. N-beats: Neural basis expansion analysis for interpretable time series forecasting. arXiv preprint arXiv:1905.10437, 2019

1905 arXiv
[28]

Deepar: Probabilistic forecasting with autoregressive recurrent networks

David Salinas, Valentin Flunkert, Jan Gasthaus, and Tim Januschowski. Deepar: Probabilistic forecasting with autoregressive recurrent networks. International journal of forecasting, 36 0 (3): 0 1181--1191, 2020

2020
[29]

Soft prompt threats: Attacking safety alignment and unlearning in open-source llms through the embedding space

Leo Schwinn, David Dobre, Sophie Xhonneux, Gauthier Gidel, and Stephan Gunnemann. Soft prompt threats: Attacking safety alignment and unlearning in open-source llms through the embedding space. arXiv preprint arXiv:2402.09063, 2024

2024 arXiv
[30]

Robustness of llms to perturbations in text

Ayush Singh, Navpreet Singh, and Shubham Vatsal. Robustness of llms to perturbations in text. arXiv preprint arXiv:2407.08989, 2024

2024
[31]

Are language models actually useful for time series forecasting? arXiv preprint arXiv:2406.16964, 2024

Mingtian Tan, Mike A Merrill, Vinayak Gupta, Tim Althoff, and Thomas Hartvigsen. Are language models actually useful for time series forecasting? arXiv preprint arXiv:2406.16964, 2024

2024 arXiv
[32]

Llama: Open and efficient foundation language models

Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth \'e e Lacroix, Baptiste Rozi \`e re, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023

2023 arXiv
[33]

Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36, 2024

Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36, 2024

2024
[34]

Transferable adversarial attacks for image and video object detection

Xingxing Wei, Siyuan Liang, Ning Chen, and Xiaochun Cao. Transferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1811.12641, 2018

2018 arXiv
[35]

Autoformer: Decomposition transformers with auto-correlation for long-term series forecasting

Haixu Wu, Jiehui Xu, Jianmin Wang, and Mingsheng Long. Autoformer: Decomposition transformers with auto-correlation for long-term series forecasting. Advances in neural information processing systems, 34: 0 22419--22430, 2021

2021
[36]

Timesnet: Temporal 2d-variation modeling for general time series analysis

Haixu Wu, Tengge Hu, Yong Liu, Hang Zhou, Jianmin Wang, and Mingsheng Long. Timesnet: Temporal 2d-variation modeling for general time series analysis. International Conference on Learning Representations, 2023

2023
[37]

Adversarial attacks and defenses in images, graphs and text: A review

Han Xu, Yao Ma, Hao-Chen Liu, Debayan Deb, Hui Liu, Ji-Liang Tang, and Anil K Jain. Adversarial attacks and defenses in images, graphs and text: A review. International journal of automation and computing, 17: 0 151--178, 2020

2020
[38]

Trojllm: A black-box trojan prompt attack on large language models

Jiaqi Xue, Mengxin Zheng, Ting Hua, Yilin Shen, Yepeng Liu, Ladislau B \"o l \"o ni, and Qian Lou. Trojllm: A black-box trojan prompt attack on large language models. Advances in Neural Information Processing Systems, 36, 2024

2024
[39]

Don't listen to me: Understanding and exploring jailbreak prompts of large language models

Zhiyuan Yu, Xiaogeng Liu, Shunning Liang, Zach Cameron, Chaowei Xiao, and Ning Zhang. Don't listen to me: Understanding and exploring jailbreak prompts of large language models. arXiv preprint arXiv:2403.17336, 2024

2024 arXiv
[40]

Informer: Beyond efficient transformer for long sequence time-series forecasting

Haoyi Zhou, Shanghang Zhang, Jieqi Peng, Shuai Zhang, Jianxin Li, Hui Xiong, and Wancai Zhang. Informer: Beyond efficient transformer for long sequence time-series forecasting. In Proceedings of the AAAI conference on artificial intelligence, volume 35, pages 11106--11115, 2021

2021
[41]

Fedformer: Frequency enhanced decomposed transformer for long-term series forecasting

Tian Zhou, Ziqing Ma, Qingsong Wen, Xue Wang, Liang Sun, and Rong Jin. Fedformer: Frequency enhanced decomposed transformer for long-term series forecasting. In International conference on machine learning, pages 27268--27286. PMLR, 2022

2022

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Gpt-4 technical report

Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023

arXiv 2023

[2] [2]

Language models are few-shot learners

Tom B Brown. Language models are few-shot learners. arXiv preprint arXiv:2005.14165, 2020

arXiv 2005

[3] [3]

Nhits: Neural hierarchical interpolation for time series forecasting

Cristian Challu, Kin G Olivares, Boris N Oreshkin, Federico Garza Ramirez, Max Mergenthaler Canseco, and Artur Dubrawski. Nhits: Neural hierarchical interpolation for time series forecasting. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pages 6989--6997, 2023

2023

[4] [4]

Bert: Pre-training of deep bidirectional transformers for language understanding

Jacob Devlin. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805, 2018

arXiv 2018

[5] [5]

Exponential smoothing: The state of the art

Everette S Gardner Jr. Exponential smoothing: The state of the art. Journal of forecasting, 4 0 (1): 0 1--28, 1985

work page 1985

[6] [6]

Timegpt-1

Azul Garza and Max Mergenthaler-Canseco. Timegpt-1. arXiv preprint arXiv:2310.03589, 2023

arXiv 2023

[7] [7]

Explaining and harnessing adversarial examples

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In arXiv preprint arXiv:1412.6572, 2014

arXiv 2014

[8] [8]

Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection

Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, pages 79--90, 2023

2023