Lightweight Defense Against Adversarial Attacks in Time Series Classification

Australia); Yi Han (Independent Researcher

REVIEW 3 major objections 6 minor 24 references

Lightweight Defense Against Adversarial Attacks in Time Series Classification

T0 review · 3 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Training six augmented time-series models and averaging their outputs defends against white-box adversarial attacks better than PGD-based adversarial training, while using about 29.37% of the training time on InceptionTime.

desk verdict A cheap augmentation-ensemble defense for time series is plausibly useful, but the robustness comparison may be inflated by weak attacks, and the theoretical section should not be trusted. read the letter →

arxiv 2505.02073 v1 pith:6TV3LQAH submitted 2025-05-04 cs.LG cs.AI

Yi Han (Independent Researcher , Australia) This is my paper · ORCID

classification cs.LGcs.AI

keywords timeseriesclassificationadversarialdefensedataaugmentationensemblelearningrobustnessPGDtrainingUCRarchivewhite-boxattacks

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes replacing computationally expensive adversarial training with data augmentation as a lightweight defense for time series classifiers. Five augmentation layers—jitter, random zeroing, segment zeroing, Gaussian noise, and Gaussian smoothing—are applied during training. The main claim is that a six-model ensemble trained with these augmentations plus an unaugmented model, averaged at test time, is more robust to six white-box gradient attacks than PGD-based adversarial training and also improves natural accuracy. The argument is backed by a gradient-alignment analysis, a bias-variance argument, and experiments on two architectures and the UCR archive; on InceptionTime the ensemble uses about 29.37 percent of the training time of adversarial training.

What carries the argument

The key machinery is the augmentation layer placed before the model during training, combined with ensemble averaging in AD. Each base model uses one of five stochastic transforms—jitter, random zero masking, segment zero masking, Gaussian noise, or Gaussian kernel smoothing—that randomizes inputs at every forward pass; the theoretical backbone is Theorem 3.1, which uses a linearization to show that the gradient of the augmented model no longer aligns with the attack perturbation, shrinking the output change caused by a small $\delta$, and Theorem 3.2, which shows that averaging base models reduces output variance while keeping bias unchanged. Together these mechanisms convert data augmentation from an accuracy tool into a cheap robustness defense.

What would settle it

Re-run the AD versus AT comparison with a PGD attacker that differentiates through the full stochastic augmentation ensemble, tries multiple restarts and epsilon values above 0.1, and tunes per-attack hyperparameters; if AD's robust accuracy no longer exceeds AT, the claimed advantage is specific to the non-adaptive setting.

Watch

Extended reading notes

Core claim

The central discovery is the Average Defence (AD) method: six copies of the same TSC architecture are trained independently, five with a different randomized data augmentation layer and one without augmentation, and their outputs are averaged at inference. This ensemble matches or beats PGD-based adversarial training in robust accuracy against FGSM, BIM, GM, SWAP, PGD, and C&W attacks, while also raising natural accuracy above the unaugmented model (e.g., NA from 0.823 to 0.839 on InceptionTime and from 0.807 to 0.856 on ResNet18 in the selected UCR subset). The paper claims this works because the randomized augmentation breaks the alignment between the model's input gradient and the attack perturbation, reducing the effect of small perturbations, and because averaging reduces variance without increasing bias, lowering overall classification error. This is presented as a practical alternative to adversarial training for time series data, with the empirical advantage quantified as a training time reduction to 29.37% of AT on InceptionTime.

Load-bearing premise

The comparison assumes a non-adaptive white-box attacker with perturbations capped at $\pm 0.1$ and hand-picked attack settings; if a realistic attacker adapts to the ensemble or uses stronger perturbations, the reported robustness advantage over adversarial training may not hold.

Editorial extensions

If this is right

AD gives higher robust accuracy than PGD-based AT on most attack and architecture combinations tested, so practitioners can get comparable or better white-box robustness with far less compute.
AD also improves natural accuracy and F1 on the tested UCR datasets, meaning robustness gains do not come at the cost of clean performance.
The five single augmentation methods and the shuffled SD method provide a range of cost-robustness trade-offs, with SD being the cheapest defense and DD sitting between SD and AD in cost.
Because AD trains each base model independently with the same architecture, it can be deployed on existing TSC models without modifying the classifier.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The variance-reduction mechanism suggests AD's margin should grow as the six base models become more decorrelated; choosing augmentations deliberately for gradient diversity could push both accuracy and robustness further.
Because the ensemble is architecture-agnostic and cheap to train, the same recipe could be applied to large pre-trained time-series models, where full adversarial training is often too expensive.
The fixed budget of $\pm 0.1$ means the ranking under larger budgets, other threat models, or black-box transfer attacks remains untested and could differ.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know before spending time on this: the empirical claim that a six-model augmentation ensemble (AD) beats PGD-based adversarial training on time series is plausible but not yet proven, because the white-box attacks aren't shown to be adaptive to the stochastic augmentation; and the theoretical section should be ignored—Theorem 3.1 is not a valid proof.

What the paper does well: it runs a clean comparison of several standard augmentations (jitter, random zeroing, segment zeroing, Gaussian noise, smoothing) as defenses, then combines them into SD (random augmentation per forward pass) and AD (ensemble of six). On the UCR archive, with InceptionTime and ResNet18, AD reports higher natural accuracy than the undefended model (0.839 vs 0.823 NA) and robustness above PGD-AT on most of the six attacks, at 29% of the training time. That's a concrete, useful benchmark for TSC defense, and the code is public.

The soft spots are real. The attack evaluation is the load-bearing one. The augmentations are stochastic, and the paper gives no indication that the PGD/BIM/C&W attacks were run with expectation over transformations (EOT) or any adaptive procedure that backpropagates through the random masks. Standard attacks can be fooled by gradient masking, so the RA numbers in Tables 2–3 may overstate AD's robustness. The fact that the conclusion only mentions black-box attacks as future work, not adaptive white-box, is a red flag. Also, there are no error bars or standard deviations on RA, and the augmentation hyperparameters are hand-picked with no sensitivity analysis. For ResNet18, the subset of UCR datasets is not specified, which hurts reproducibility.

The theory is worse than weak. Theorem 3.1's derivation is dimensionally inconsistent (e.g., Eq. (4) sets δ equal to a normalized gradient; Eq. (6) has a vector product where a scalar is needed). It does not establish that the ensemble is robust. Theorem 3.2 applies the regression bias-variance decomposition to classification accuracy, which is a heuristic, not a proof. The variance-reduction intuition is fine, but calling it a theorem overstates it.

Who is this for? Researchers working on TSC robustness who want a cheap alternative to adversarial training. The empirical comparison is worth seeing, but I wouldn't cite the theoretical claims. With a serious revision—replacing the theory with a careful discussion, adding adaptive attacks and error bars, specifying the ResNet18 setup—this could be a solid short paper. As is, it deserves a serious referee, not a desk reject, because the question is timely and the empirical core is potentially useful.

My recommendation: engage with it, but treat the robustness numbers as provisional until the adaptive-attack evaluation is redone.

Referee Report

3 major / 6 minor

Summary. The paper proposes five stochastic data-augmentation layers for time series classification (Jitter, RandomZero, SegmentZero, Gaussian Noise, Smooth Time Series) and combines them into two defense methods: Shuffle Defence (SD), which applies a randomly chosen augmentation per forward pass, and Average Defence (AD), an ensemble of six models each trained with one augmentation and averaged at test time. The authors report on UCR benchmark data with InceptionTime and ResNet18 that AD improves both natural accuracy and robust accuracy under six white-box attacks relative to PGD-based adversarial training, while using about 29.37% of the training time of AT. They also present Theorems 3.1 and 3.2 as theoretical support for the robustness and accuracy benefits of the methods.

Significance. If the empirical claims hold, the paper would offer a practical lightweight alternative to adversarial training for time series classification, with public code, comparison against six white-box attacks, and explicit training-time measurements. The computational-cost comparison is a useful contribution, and the idea of using augmentation ensembles as a defense is worth investigating. However, the central claim is currently not fully supported because the attack evaluation for the stochastic ensemble is underspecified, and the theoretical sections contain invalid derivations. The paper's significance therefore depends on whether the reported robust-accuracy numbers survive an adaptive white-box evaluation.

major comments (3)

[Section 4.3, Tables 2 and 3] The attack protocol for evaluating AD is not specified. AD is a stochastic ensemble whose base models each contain a randomized augmentation layer, but the paper does not state whether the white-box attacks are optimized against the ensemble's averaged output, against a single random realization of the augmentation layers, or with expectation over transformations (EOT). If gradients are computed through only one realization, the reported RA values can reflect obfuscated gradients rather than genuine robustness, so the abstract's and Section 5's claim that AD outperforms PGD-based AT is not established. The conclusion's statement that only black-box evaluation is left for future work is therefore incomplete; adaptive white-box evaluation is required.
[Section 3, Theorem 3.1, Eqs. (2)-(6)] The proof of Theorem 3.1 is not mathematically valid. Equation (2) applies a Taylor expansion to a stochastic augmentation layer A_t, yet no argument justifies differentiability or a first-order approximation of a random mask-based operation. Equation (4) identifies the perturbation delta with a normalized gradient, which is dimensionally inconsistent because the left side is a vector in R^k while the right side is a gradient vector divided by f, and it is not the maximizer defined by Eq. (1). Equation (5) then combines gradient vectors and a Jacobian in a way that is not algebraically coherent. Consequently, Theorem 3.1 does not provide the theoretical validation claimed in the contributions and in Section 6.
[Section 3, Theorem 3.2, Eq. (10)] The proof of Theorem 3.2 applies the regression bias-variance decomposition for squared error to classification accuracy. Reducing the variance of real-valued outputs does not directly imply higher 0/1 classification accuracy, and no argument connects the variance of softmax outputs to expected classification error. The statement should be presented as a heuristic or replaced by a formal analysis of classification risk, rather than asserted as a theorem.

minor comments (6)

[Section 2.2, Algorithm 1] The notation 'm = T_i m_i' for combining segment masks is unclear; it should specify whether the masks are multiplied elementwise or combined by some other operation.
[Section 5, Tables 2 and 3] The paper states that NA and F1 were measured five times and averaged, but no standard deviations or confidence intervals are reported, making it difficult to judge whether the natural-accuracy improvements of AD over None and AT are significant.
[Section 4.3, attack settings] The attack hyperparameters are reported, but the relationship between the fixed perturbation bound ±0.1 and the scale of the individual UCR datasets is not discussed; a perturbation that is stealthy for one dataset may be large or small for another.
[Section 4.3, Table 3] The subset of UCR datasets used for the ResNet18 experiments is not enumerated, which limits reproducibility; the authors should list the selected datasets.
[Section 4.2] The text says 'three models were selected' but only InceptionTime and ResNet18 are described and used; this appears to be an inconsistency.
[Throughout] There are several typographical and reference errors, including 'Asadulla et al.' in Section 1 (the reference list cites Galib and Bashyal), 'benifits' in Section 1, and 'intel core' in Section 4.3; these should be corrected.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: AD's defense and accuracy claims rest on direct empirical comparisons, not on fitted outputs or self-citation.

full rationale

The paper's central claim, that the AD ensemble gives higher robust accuracy than PGD-based AT at lower training cost, is established by the benchmark measurements in Tables 2 and 3, not by a derivation from fitted constants. The augmentation hyperparameters and attack parameters in Section 4.3 are fixed experimental settings; no parameter is fitted to the RA values in the tables, and no equation defines RA in terms of those hyperparameters by construction. Theorem 3.2 restates the standard bias-variance decomposition for ensembles, and although it is not novel, it is not used to define AD's accuracy; the measured NA and F1 values provide the actual evidence. Theorem 3.1 contains mathematically unsupported steps (e.g., Eqs. (4) and (6) are dimensionally inconsistent), but that is a correctness or validity concern, not circularity: its conclusion is not obtained by substituting the desired result into its assumptions. The paper is single-authored and does not rely on a self-citation chain, an imported uniqueness theorem, or a cited ansatz that already assumes the target result. The absence of adaptive black-box evaluation and sensitivity analysis is a methodological limitation, but it does not make the reported comparisons true by definition.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The methods rest on hand-tuned augmentation hyperparameters and attack settings. The theoretical proofs employ unproven linearity and gradient proportionality assumptions, treating the augmentation layer as differentiable despite the use of hard zero masks. No new entities are introduced.

free parameters (6)

Jitter parameters = p=0.75, noise_level=1
Hand-selected in Section 4.3; no sensitivity analysis, and the central robustness results depend on them.
RandomZero probability = p=0.5
Hand-selected; affects defense performance.
SegmentZero parameters = total_zero_length=0.25, max_segment_length=0.05
Hand-selected fractions of series length.
Gaussian Noise sigma = sigma=0.3
Hand-selected noise level.
Smooth kernel parameters = kernel_size=10, sigma=5
Hand-selected smoothing kernel.
Attack perturbation budget = epsilon=0.1, step sizes 0.0005 etc.
Attack hyperparameters chosen to mimic stealthy attacks; comparison conclusions depend on this budget.

assumptions (4)

domain assumption The augmentation layer has a linear response to small perturbations, allowing a first-order Taylor expansion.
Assumed in the proof of Theorem 3.1 (Eq. 2) without justification; augmentation layers like zero masking are not differentiable and do not satisfy linearity.
domain assumption The attack perturbation is proportional to the gradient of the model output (Eq. 4).
This is not generally true for PGD/BIM/C&W; it is an unproven assertion used to derive Eq. (5).
standard math Bias-variance decomposition applies to classification error.
Theorem 3.2 uses Eq. (10), but the bias-variance decomposition is only valid for squared error regression, not for 0-1 classification loss.
domain assumption Base models in the ensemble are independent enough that averaging reduces variance.
Standard ensemble argument, but classification accuracy improvement does not follow from variance reduction alone.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Lightweight Defense Against Adversarial Attacks in Time Series Classification." pith.science (2026). https://pith.science/paper/6TV3LQAH

@misc{pith2026250502073,
  author       = {Pith},
  title        = {Pith review of: Lightweight Defense Against Adversarial Attacks in Time Series Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6TV3LQAH}},
  note         = {Machine review of arXiv:2505.02073}
}

read the original abstract

As time series classification (TSC) gains prominence, ensuring robust TSC models against adversarial attacks is crucial. While adversarial defense is well-studied in Computer Vision (CV), the TSC field has primarily relied on adversarial training (AT), which is computationally expensive. In this paper, five data augmentation-based defense methods tailored for time series are developed, with the most computationally intensive method among them increasing the computational resources by only 14.07% compared to the original TSC model. Moreover, the deployment process for these methods is straightforward. By leveraging these advantages of our methods, we create two combined methods. One of these methods is an ensemble of all the proposed techniques, which not only provides better defense performance than PGD-based AT but also enhances the generalization ability of TSC models. Moreover, the computational resources required for our ensemble are less than one-third of those required for PGD-based AT. These methods advance robust TSC in data mining. Furthermore, as foundation models are increasingly explored for time series feature learning, our work provides insights into integrating data augmentation-based adversarial defense with large-scale pre-trained models in future research.

Figures

Figures reproduced from arXiv: 2505.02073 by the authors.

**Figure 2.** Schematic diagram of AD [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Illustration of AD reduces variance. Each of the six graphs depicts the [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

24 extracted references · 19 canonical work pages

[1]

IEEE Access9, 155161–155196 (2021)

Akhtar, N., Mian, A., Kardan, N., Shah, M.: Advances in adversarial attacks and defenses in computer vision: A survey. IEEE Access9, 155161–155196 (2021)

work page 2021
[2]

In: IEEE Symposium on Security and Privacy (SP)

Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: IEEE Symposium on Security and Privacy (SP). pp. 39–57. IEEE (2017)

work page 2017
[3]

Journal of Intelligent Information Sys- tems 62(1), 27–56 (2024)

Corizzo, R., Rosen, J.: Stock market prediction with time series data and news headlines: a stacking ensemble approach. Journal of Intelligent Information Sys- tems 62(1), 27–56 (2024)

work page 2024
[4]

IEEE/CAA Journal of Automatica Sinica6(6), 1293–1305 (2019)

Dau, H.A., Bagnall, A., Kamgar, K., Yeh, C.C.M., Zhu, Y., Gharghabi, S., Keogh, E.: The ucr time series archive. IEEE/CAA Journal of Automatica Sinica6(6), 1293–1305 (2019)

work page 2019
[5]

Advances in Neural Information Processing Systems36 (2023)

Deng, Y., Mu, T.: Understanding and improving ensemble adversarial defense. Advances in Neural Information Processing Systems36 (2023)

work page 2023
[6]

In: Proceedings of the AAAI Conference on Artificial Intelligence

Ding, D., Zhang, M., Feng, F., Huang, Y., Jiang, E., Yang, M.: Black-box adver- sarial attack on time series classification. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 37, pp. 7358–7368 (2023)

work page 2023
[7]

In: IEEE International Conference on Knowledge Graph (ICKG)

Dong, C.G., Zheng, L.N., Chen, W., Zhang, W.E., Yue, L.: Swap: Exploiting second-ranked logits for adversarial attacks on time series. In: IEEE International Conference on Knowledge Graph (ICKG). pp. 117–125. IEEE (2023)

work page 2023
[8]

arXiv preprint arXiv:2301.03703 (2023)

Galib, A.H., Bashyal, B.: On the susceptibility and robustness of time series models through adversarial attack and defense. arXiv preprint arXiv:2301.03703 (2023)

arXiv 2023

Show all 24 references

[9]

arXiv preprint arXiv:1412.6572 (2014)

Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

2014 arXiv
[10]

Springer, New York, NY, USA, 2 edn

Hastie, T., Tibshirani, R., Friedman, J.: The Elements of Statistical Learning: Data Mining, Inference, and Prediction. Springer, New York, NY, USA, 2 edn. (2009)

2009
[11]

He,K.,Zhang,X.,Ren,S.,Sun,J.:Deepresiduallearningforimagerecognition.In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 770–778 (2016)

2016
[12]

Pattern Analysis and Applications24(1), 343–366 (2021)

Hewage, P., Trovati, M., Pereira, E., Behera, A.: Deep learning-based effective fine-grained weather forecasting model. Pattern Analysis and Applications24(1), 343–366 (2021)

2021
[13]

Data Mining and Knowledge Discovery34(6), 1936–1962 (2020)

Ismail Fawaz, H., Lucas, B., Forestier, G., Pelletier, C., Schmidt, D.F., Weber, J., Petitjean, F.: Inceptiontime: Finding alexnet for time series classification. Data Mining and Knowledge Discovery34(6), 1936–1962 (2020)

2020
[14]

PLOS ONE16(7), e0254841 (2021)

Iwana, B.K., Uchida, S.: An empirical survey of data augmentation for time series classification with neural networks. PLOS ONE16(7), e0254841 (2021)

2021
[15]

IEEE Transactions on Image Processing 31, 4417–4430 (2022)

Jia, X., Zhang, Y., Wu, B., Wang, J., Cao, X.: Boosting fast adversarial training with learnable adversarial initialization. IEEE Transactions on Image Processing 31, 4417–4430 (2022)

2022
[16]

In: International Conference on In- telligent Sensors, Sensor Networks and Information Processing

Ko, M.H., West, G., Venkatesh, S., Kumar, M.: Online context recognition in mul- tisensor systems using dynamic time warping. In: International Conference on In- telligent Sensors, Sensor Networks and Information Processing. pp. 283–288. IEEE (2005)

2005
[17]

arXiv preprint arXiv:1706.06083 (2017)

Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

2017 arXiv
[18]

In: IEEE Symposium on Security and Privacy (SP)

Papernot, N., McDaniel, P., Wu, X., Jha, S., Swami, A.: Distillation as a defense to adversarial perturbations against deep neural networks. In: IEEE Symposium on Security and Privacy (SP). pp. 582–597. IEEE (2016) Lightweight Defense in TSC 13

2016
[19]

In: International Workshop on Advanced Analytics and Learning on Temporal Data

Pialla, G., Devanne, M., Weber, J., Idoumghar, L., Forestier, G.: Data augmen- tation for time series classification with deep learning models. In: International Workshop on Advanced Analytics and Learning on Temporal Data. pp. 117–132. Springer International Publishing (2022)

2022
[20]

In: Pacific- Asia Conference on Knowledge Discovery and Data Mining

Pialla, G., Fawaz, H.I., Devanne, M., Weber, J., Idoumghar, L., Muller, P.A., Forestier, G.: Smooth perturbations for time series adversarial attacks. In: Pacific- Asia Conference on Knowledge Discovery and Data Mining. pp. 485–496. Springer International Publishing, Cham (2022)

2022
[21]

In: International Joint Con- ference on Neural Networks (IJCNN)

Rathore, P., Basak, A., Nistala, S.H., Runkana, V.: Untargeted, targeted and uni- versal adversarial attacks and defenses on time series. In: International Joint Con- ference on Neural Networks (IJCNN). pp. 1–8. IEEE (2020)

2020
[22]

In: Australasian Joint Conference on Artificial Intelligence

Shen, S., Chen, W., Xu, M.: What leads to arrhythmia: Active causal representa- tion learning of ecg classification. In: Australasian Joint Conference on Artificial Intelligence. Springer International Publishing, Cham (2022)

2022
[23]

arXiv preprint arXiv:1709.03423 (2017)

Strauss, T., Hanselmann, M., Junginger, A., Ulmer, H.: Ensemble methods as a defense to adversarial perturbations against deep neural networks. arXiv preprint arXiv:1709.03423 (2017)

2017 arXiv
[24]

In: International Confer- ence, ICA3PP

Zeng, Y., Qiu, H., Memmi, G., Qiu, M.: A data augmentation-based defense method against adversarial attacks in neural networks. In: International Confer- ence, ICA3PP. pp. 274–289. Algorithms and Architectures for Parallel Processing, Springer International Publishing (2020)

2020

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

IEEE Access9, 155161–155196 (2021)

Akhtar, N., Mian, A., Kardan, N., Shah, M.: Advances in adversarial attacks and defenses in computer vision: A survey. IEEE Access9, 155161–155196 (2021)

work page 2021

[2] [2]

In: IEEE Symposium on Security and Privacy (SP)

Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: IEEE Symposium on Security and Privacy (SP). pp. 39–57. IEEE (2017)

work page 2017

[3] [3]

Journal of Intelligent Information Sys- tems 62(1), 27–56 (2024)

Corizzo, R., Rosen, J.: Stock market prediction with time series data and news headlines: a stacking ensemble approach. Journal of Intelligent Information Sys- tems 62(1), 27–56 (2024)

work page 2024

[4] [4]

IEEE/CAA Journal of Automatica Sinica6(6), 1293–1305 (2019)

Dau, H.A., Bagnall, A., Kamgar, K., Yeh, C.C.M., Zhu, Y., Gharghabi, S., Keogh, E.: The ucr time series archive. IEEE/CAA Journal of Automatica Sinica6(6), 1293–1305 (2019)

work page 2019

[5] [5]

Advances in Neural Information Processing Systems36 (2023)

Deng, Y., Mu, T.: Understanding and improving ensemble adversarial defense. Advances in Neural Information Processing Systems36 (2023)

work page 2023

[6] [6]

In: Proceedings of the AAAI Conference on Artificial Intelligence

Ding, D., Zhang, M., Feng, F., Huang, Y., Jiang, E., Yang, M.: Black-box adver- sarial attack on time series classification. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 37, pp. 7358–7368 (2023)

work page 2023

[7] [7]

In: IEEE International Conference on Knowledge Graph (ICKG)

Dong, C.G., Zheng, L.N., Chen, W., Zhang, W.E., Yue, L.: Swap: Exploiting second-ranked logits for adversarial attacks on time series. In: IEEE International Conference on Knowledge Graph (ICKG). pp. 117–125. IEEE (2023)

work page 2023

[8] [8]

arXiv preprint arXiv:2301.03703 (2023)

Galib, A.H., Bashyal, B.: On the susceptibility and robustness of time series models through adversarial attack and defense. arXiv preprint arXiv:2301.03703 (2023)

arXiv 2023