Pith. sign in

REVIEW 2 major objections 4 minor 30 references

This paper argues that an attacker can simultaneously force a time series classifier to a chosen wrong label and keep its explanation consistent with a reference rationale, so explanation stability is not a trustworthy signal of decision ro

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 05:16 UTC pith:35PYZC2F

load-bearing objection TSEF is a genuinely new structured dual-target attack with solid empirical support; just don't let the 'passes an audit' claim run ahead of the data. the 2 major comments →

arxiv 2602.02763 v3 pith:35PYZC2F submitted 2026-02-02 cs.LG

Exposing Vulnerabilities in Explanation for Time Series Classifiers via Dual-Target Attacks

Bohan Wang , Zewen Liu , Lu Lin , Hui Liu , Li Xiong , Ming Jin , Wei Jin This is my paper
classification cs.LG
keywords adversarial attackstime series classificationsaliency mapsexplainable AIdual-target attackexplanation robustnessfrequency-domain perturbationtrustworthy machine learning
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to show that in interpretable time series systems, a stable explanation is not evidence that a prediction is sound. It introduces TSEF, an attack that simultaneously forces a frozen classifier toward a chosen incorrect label and steers the accompanying explanation toward a reference rationale. Across several datasets and explanation mechanisms, TSEF achieves targeted misclassification while keeping explanation alignment high, unlike prediction-only attacks whose explanations drift. Because explanation drift is often treated as an alarm for auditors, the authors conclude that auditing protocols must evaluate predictor and explainer as a coupled system rather than relying on consistency checks alone.

Core claim

The central discovery is a concrete failure mode: an adversary with white-box access can decouple what a classifier predicts from why it appears to predict it. TSEF parameterizes the perturbation as a temporal vulnerability mask, which localizes sparse connected windows, and a frequency perturbation filter, which edits the signal's spectral content within those windows. This two-stage structure resolves a high-dimensional paradox: unconstrained ℓ∞ updates spread attribution across many coordinates, producing diffuse explanations that cannot match a sparse reference, whereas restricting edits to compact temporal regions and making them spectrally coherent keeps attribution concentrated. The a

What carries the argument

The paper's key mechanism is a two-stage decomposition of the perturbation. A temporal vulnerability mask learns where to suppress the signal, regularized to be sparse and connected and updated with amplitude-invariant sign steps. A frequency perturbation filter learns how to alter the selected segment: a multiplicative mask in the Fourier domain, with adaptive scaling to satisfy the ℓ∞ budget and energy-invariant sign updates. The theoretical anchor is a theorem showing that a dense ℓ∞ sign step creates off-window attribution at least proportional to the number of coordinates outside the target window; TSEF avoids this growth by not editing outside a small support. Together these components

Load-bearing premise

The load-bearing premise is that off-window attribution gradients have a non-negligible expected magnitude (Assumption B.1) and the interval condition β₀ ≤ γ²/(8L) holds; if an explainer's gradients vanish outside the reference window, the theoretical dispersion argument fails, though the empirical attack results do not rest on it.

What would settle it

Measure off-target attribution after a single dense sign step on an explainer trained with hard-masking regularization; the theorem predicts it grows linearly with the number of coordinates outside the reference window. If it does not, or if TSEF fails when off-window gradients are suppressed, the dispersion mechanism rather than spectral coherence is the load-bearing cause.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Explanation-based audits that check only temporal consistency of saliency maps can be bypassed; stability is not sufficient evidence of robustness.
  • Robustness evaluation for trustworthy time series systems should include coupled metrics that measure prediction and explanation jointly under adversarial optimization.
  • Deployers of monitoring and fault-detection systems should treat clean-looking explanations under perturbation as suspect, not exonerating.
  • Defenses need to constrain predictor and explainer jointly, for example through coupling-aware training or detection of structured spectral edits.
  • The attack can serve as a stress-test harness for comparing explainers by how easily they can be made deceptive.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the high-dimensional dispersion theorem is load-bearing, then explainers that enforce hard masking outside salient regions should resist cover-up attacks; this suggests a testable defensive direction the paper does not explore.
  • TSEF's perturbations are concentrated in time and band-limited in frequency, so an auditor could look for exactly those signatures as a detection heuristic, a direction the paper leaves implicit.
  • The reported trade-off between classification strength and explanation alignment implies attackers can choose a stealth-oriented operating point, so audits should be stress-tested at several attack strengths rather than only the maximum.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper studies adversarial manipulation of the joint prediction–explanation output of time series classifiers. It proposes TSEF (Time Series Explanation Fooler), which learns a temporal vulnerability mask to localize an editable window and a frequency-domain filter to apply a pattern-consistent spectral edit, optimized against a dual objective of targeted misclassification and explanation alignment. The attack is evaluated across six datasets, three explainers, and several baselines (PGD, BlackTreeS, SFAttack, ADV2, random/noise perturbations), with an ablation study and visualizations. The authors claim that dense ℓ∞ attacks disperse attribution mass outside a desired reference region (Theorem 4.1), and that TSEF can flip predictions while keeping explanations consistent enough to evade explanation-based auditing, concluding that explanation stability is a misleading proxy for decision robustness.

Significance. If substantiated, the paper would provide an important caution for explanation-based auditing of time series systems and motivate coupling-aware robustness evaluations. The empirical design is broad: multiple datasets and explainers, standard deviations on the reported metrics, ablations of the two attack components, and an explicit white-box threat model. TSEF consistently improves explanation alignment over PGD and ADV2 at comparable attack success rates in most reported cells, which is a concrete and reproducible-sounding contribution. However, the headline audit-bypass claim is not calibrated against any actual audit procedure or clean-explanation baseline, and the theoretical motivation rests on unverified regularity assumptions. These gaps are fixable, but they currently block full acceptance of the paper's strongest conclusion.

major comments (2)
  1. [§5.2, Table 1] The central claim that TSEF leaves explanations 'consistent enough to pass an explanation-based audit' is not measured. No audit decision rule is defined, and no clean-explanation alignment baseline is reported for the same reference A′. AUPRC/AUP/AUR are relative attack-comparison metrics; RANDOM achieves AUPRC 0.786 on LOWVAR/TIMEX++ with ASR only 0.014, so high AUPRC alone cannot certify audit-bypass. To make the claim load-bearing, the paper should specify an auditor (e.g., a threshold on alignment or a temporal-coherence detector), report the clean alignment distribution, and report evasion/detection rates for TSEF versus baselines under that auditor.
  2. [§4.1, Appendix B, Theorem 4.1] Theorem 4.1 depends on Assumption B.1: off-window expected absolute directional attribution gradient ≥ γ on η(d−|Ω|) coordinates, plus the interval non-emptiness condition β0 ≤ γ²/(8L). The paper justifies these with a statistical-improbability heuristic rather than verification for TIMEX/TIMEX++/IG or the transformer classifier used in experiments. For an explainer with hard masking on Ωc, the dense-update attribution spread would not follow. Since this theorem motivates the structured design and the 'high-dimensional paradox', either verify Assumption B.1 empirically on the actual explainers or present the theorem strictly as a conditional regularity statement and adjust the motivation accordingly. The empirical TSEF results do not depend on the theorem, so this is not fatal to the core experiments.
minor comments (4)
  1. [§1, footnote 1] The introduction says the authors 'release a modular testbed', but the footnote states 'Code is available upon request'. Please clarify the availability status; a public repository would strengthen reproducibility.
  2. [Figure 3] The visual claim that TSEF yields 'sharp and concentrated' heatmaps is based on a single sample. Consider reporting aggregate visual-quality statistics (e.g., average alignment over a held-out set) or additional examples.
  3. [§5.1 vs Appendix E] Section 5.1 says the target label y′ is 'randomly chosen' from remaining classes, but Appendix E states that for Epilepsy the attack targets non-seizure only. Please reconcile the target sampling description.
  4. [Table 3] The real-world experiments in Table 3 omit the RANDOM, LOCALG, and GLOBALG baselines that appear in Table 1. Since those baselines help calibrate the meaning of high AUPRC, include them or justify their absence.

Circularity Check

0 steps flagged

No significant circularity: empirical attack results are measured, theory is conditional on stated assumptions, and self-citations are not load-bearing.

full rationale

The paper's central claim is an empirical attack result: TSEF optimizes a dual-target objective (Eq. 4 and the outer attack loss in Section 4.2) against frozen classifiers and explainers, and the reported ASR/F1/AUPRC/AUP/AUR values in Tables 1 and 3 are measurements on test instances, not quantities obtained by fitting constants and then renaming them as predictions. The theoretical component (Theorem 4.1) is explicitly conditional on stated regularity assumptions (Assumption B.1: off-window directional sensitivity; Assumption B.2: curvature bound; Assumption B.3: bounded clean background; and the interval non-emptiness condition beta_0 <= gamma^2/(8L)). The proof is a Taylor-expansion argument from those assumptions; it does not define its conclusion as an input. The use of TIMEX++ (Liu et al., 2024b, with overlapping author Z. Liu) is as one attacked explainer, not as evidence supporting the paper's own claims, and the vulnerability is also demonstrated on the external TIMEX (Queen et al., 2023) and Integrated Gradients, so there is no load-bearing self-citation chain. The only mildly self-referential element is the no-ground-truth setup in Section 5.4, where the reference rationale A' is defined as the interpreter's own top-10% clean saliency and the attack optimizes d(H_E(X~), A'); this is the attack's objective rather than a prediction derived from it, and comparisons against PGD/ADV2 under the same target remain informative. Any overreach in the statement that the explanation is 'consistent enough to pass an explanation-based audit' is an uncalibrated interpretive step about auditors, not a circular derivation.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

The central empirical claim is mostly self-contained: it measures attack success and explanation alignment against frozen, externally defined models. The load-bearing assumptions concentrate in the theoretical motivation (Theorem 4.1), where key regularity constants are asserted rather than estimated, and in the definition of reference rationales for datasets without ground truths. Tuned loss weights and the perturbation budget are method hyperparameters. Nothing in the paper reduces a prediction to a fitted value, and no new physical or ontological entities are introduced.

free parameters (4)
  • attack loss weights λcls and λexp = tuned per dataset on validation splits; values not fully reported (λcls swept 0.01–1.0 in Appendix G.3)
    Balances targeted misclassification vs. explanation alignment in the TSEF objective (Alg. 1, Appendix F). The sensitivity analysis shows attack behavior depends strongly on λcls, so the reported trade-off numbers are partly a function of this tuned weight.
  • reference top-k% threshold (k=10%) = 10%
    For PAM and Epilepsy, which lack ground-truth rationales, the reference A′ is the interpreter's top-10% salient features on the clean input (Section 5.4); all reported AUPRC/AUP/AUR are measured against this chosen subset, so the choice of k directly shapes the results.
  • perturbation budget ε with instance-wise scaling = 0.1 (scaled by max−min per instance)
    The ℓ∞ budget is a hand-chosen constant; larger budgets trivially increase ASR, and the instance-wise scaling in Algorithm 1 (line 2) is a normalization choice that affects feasibility across datasets of different amplitude.
  • Theorem 4.1 regularity constants γ, L, β0, η (c=ηγ/2) = not determined; asserted to exist with β0 ≤ γ²/(8L)
    The high-dimensional-paradox bound holds only if these constants satisfy ε ∈ [4β0/γ, γ/(2L)]; the paper states the non-emptiness condition is "plausible in our setting" (Appendix B) without estimating or verifying it for the specific explainers and classifier used.
axioms (5)
  • ad hoc to paper The explainer HE and classifier f are differentiable, and off-window attribution gradients have expected absolute directional derivative ≥ γ on a constant fraction η(d−|Ω|) of coordinates (Assumption B.1)
    The white-box attack optimizes through the explainer, and Theorem 4.1 requires off-window directional sensitivity bounded away from zero; this is justified by a "statistically improbable" cancellation heuristic, not derived or verified for TIMEX/TIMEX++/IG (Appendix B).
  • domain assumption A single norm-bounded perturbation can simultaneously satisfy f(X̃)=y′ and d(HE(X̃), A′) small
    The dual-target objective (Eq. 4) assumes these two goals are jointly achievable under the budget; this is exactly the empirical claim being tested, not a guaranteed property of classifiers or explainers.
  • domain assumption Reference templates A′ exist and are meaningful: ground-truth masks (synthetics, ECG QRS) or clean top-10% explanations of the same interpreter
    The attack's explanation target is exogenous in the synthetic/ECG experiments and defined from the very explainer being attacked in the PAM/Epilepsy setting (Sections 5.1, 5.4, Appendix E).
  • standard math Standard mathematical tools: Taylor's theorem with Lagrange remainder, variational mutual-information upper bound, Wirtinger calculus, Concrete/Gumbel-Sigmoid reparameterization, DFT linearity
    Used in the proof of Theorem 4.1 (Appendix B), the MI bound (D.1), the amplitude-invariance and energy-invariance propositions (D.2, D.3), and the mask/filter parameterization.
  • ad hoc to paper The interval non-emptiness condition β0 ≤ γ²/(8L) holds
    Stated as "plausible in our setting" (Appendix B, after Eq. 15); it is a joint restriction on the very quantities Assumptions B.1–B.3 assert to exist, and no estimate is provided for any evaluated explainer.

pith-pipeline@v1.3.0-alltime-deepseek · 30562 in / 23318 out tokens · 234270 ms · 2026-08-03T05:16:27.590094+00:00 · methodology

0 comments
read the original abstract

Interpretable time series deep learning systems are often assessed by checking temporal consistency on explanations, implicitly treating this as evidence of robustness. We show that this assumption can fail: Predictions and explanations can be adversarially decoupled, enabling targeted misclassification while the explanation remains plausible and consistent with a chosen reference rationale. We propose TSEF (Time Series Explanation Fooler), a dual-target attack that jointly manipulates the classifier and explainer outputs. In contrast to single-objective misclassification attacks that disrupt explanation and spread attribution mass broadly, TSEF achieves targeted prediction changes while keeping explanations consistent with the reference. Across multiple datasets and explainer backbones, our results consistently reveal that explanation stability is a misleading proxy for decision robustness and motivate coupling-aware robustness evaluations for trustworthy time series tasks.

Figures

Figures reproduced from arXiv: 2602.02763 by Bohan Wang, Hui Liu, Li Xiong, Lu Lin, Ming Jin, Wei Jin, Zewen Liu.

Figure 1
Figure 1. Figure 1: Targeted manipulation of prediction and explanation on an ECG sample. Top (Target Setup): The input is correctly classified as Normal (yˆ = 0). The green band defines the reference explanation A′ that the attacker aims to fabricate. Bottom (TSEF Attack): The proposed TSEF attack successfully flips the model’s prediction to Abnormal (yˆ = 1). Crucially, the resulting explana￾tion (generated by TIMEX++ (Liu … view at source ↗
Figure 2
Figure 2. Figure 2: Overview of TSEF: TVM learns Mt to localize vulnerable temporal windows (visualized as a single window here for clarity), and FPF perturbs the masked signal in the frequency domain via Mf . However, the scaling in Eq. (2) highlights high-dimensional difficulty in time series: the classification term encourages changes spread across many coordinates (i.e, time steps and channels), while matching a localized… view at source ↗
Figure 3
Figure 3. Figure 3: Targeted manipulation of prediction and explanation on a LOWVAR sample. Rows correspond to TIMEX++, TIMEX, and Integrated Gradients (IG). Left: Clean input with prediction yˆ = 0; the dark green window marks the reference explanation region. Middle: TSEF flips the prediction to the target class (yˆ = 1) while keeping the explanation concentrated on the same target region. Right: Standard PGD also attains y… view at source ↗
Figure 4
Figure 4. Figure 4: Sensitivity to the classification weight λcls. We sweep λcls (with the explanation weight fixed, λexp = 1) on LOWVAR (top) and SEQCOMB-MV (bottom). Left: explanation-targeting metrics (AUPRC/AUP/AUR) decrease as λcls increases. Right: prediction￾targeting metrics (ASR/F1) improve, revealing a clear trade-off between prediction success and explanation alignment. 23 [PITH_FULL_IMAGE:figures/full_fig_p023_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

30 extracted references · 16 linked inside Pith

  1. [1]

    Ground-truth explanations correspond to the low-variance subsequences on the appropriate sensor

    Unlike anomaly-based datasets, the predictive region here is not obviously different in amplitude from the background, making it a more challenging explanation task. Ground-truth explanations correspond to the low-variance subsequences on the appropriate sensor. E.2. Real-world datasets We also evaluate on three real-world time series classification bench...

    2023

  2. [2]

    A survey of the state of explain- able ai for natural language processing.arXiv preprint arXiv:2010.00711,

    Danilevsky, M., Qian, K., Aharonov, R., Katsis, Y ., Kawas, B., and Sen, P. A survey of the state of explain- able ai for natural language processing.arXiv preprint arXiv:2010.00711,

    Pith/arXiv arXiv 2010

  3. [9]

    The complex gradient operator and the cr-calculus.arXiv preprint arXiv:0906.4835,

    Kreutz-Delgado, K. The complex gradient operator and the cr-calculus.arXiv preprint arXiv:0906.4835,

    Pith/arXiv arXiv

  4. [11]

    K., Rooke, C., Smith, J., Zuberi, S., and V olkovs, M

    Leung, K. K., Rooke, C., Smith, J., Zuberi, S., and V olkovs, M. Temporal dependencies in feature importance for time series prediction. InThe Eleventh International Conference on Learning Representations. Li, J., Pang, M., Dong, Y ., Jia, J., and Wang, B. Graph neural network explanations are fragile.arXiv preprint arXiv:2406.03193,

    Pith/arXiv arXiv

  5. [12]

    N., Hasson, H., and Huan, L

    Liu, L., Park, Y ., Hoang, T. N., Hasson, H., and Huan, L. Robust multivariate time-series forecasting: Adversar- ial attacks and defense mechanisms. InThe Eleventh International Conference on Learning Representations, 2023a. URL https://openreview.net/forum? id=ctmLBs8lITa. Liu, Y ., Hu, T., Zhang, H., Wu, H., Wang, S., Ma, L., and Long, M. itransformer:...

    Pith/arXiv arXiv

  6. [15]

    Mode, G. R. and Hoque, K. A. Adversarial examples in deep learning for multivariate time series regression. In 2020 ieee applied imagery pattern recognition workshop (aipr), pp. 1–10. IEEE,

    2020

  7. [17]

    B., Gudelek, M

    Sezer, O. B., Gudelek, M. U., and Ozbayoglu, A. M. Fi- nancial time series forecasting with deep learning: A systematic literature review: 2005–2019.Applied soft computing, 90:106181,

    2005

  8. [18]

    Xai methods for neural time series classification: A brief review.arXiv preprint arXiv:2108.08009,

    ˇSimi´c, I., Sabol, V ., and Veas, E. Xai methods for neural time series classification: A brief review.arXiv preprint arXiv:2108.08009,

    Pith/arXiv arXiv

  9. [19]

    Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199,

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199,

    Pith/arXiv arXiv

  10. [20]

    Alo-vc: Any-to-any low-latency one-shot voice conversion.arXiv preprint arXiv:2306.01100,

    Wang, B., Ronssin, D., and Cernak, M. Alo-vc: Any-to-any low-latency one-shot voice conversion.arXiv preprint arXiv:2306.01100,

    Pith/arXiv arXiv

  11. [21]

    Related Work Details This appendix complements the concise Related Work in the main paper by providing additional context and representative references

    11 Exposing Vulnerabilities in Explanation for Time Series Classifiers via Dual-Target Attacks A. Related Work Details This appendix complements the concise Related Work in the main paper by providing additional context and representative references. We organize the discussion around three threads: (i) time series explainers, (ii) adversarial attacks on t...

    2020

  12. [22]

    The increasing deployment of deep models in high-stakes applications has made human-understandable explanations a key requirement for trustworthy decision making

    etc. The increasing deployment of deep models in high-stakes applications has made human-understandable explanations a key requirement for trustworthy decision making. While the broader XAI literature is dominated by vision and language settings (Danilevsky et al., 2020; Madsen et al., 2022; Bodria et al., 2023; Linardatos et al., 2020; Samek et al., 2021...

    2020

  13. [23]

    encourages consistency between explainer and model latent representations, and TIMEX++ (Liu et al., 2024b) further generates label-preserving temporal patterns via an information-theoretic objective that minimizes mutual information with the original series while maximizing mutual information with the prediction.Our work is complementary but security-focu...

    2014

  14. [24]

    Explainer robustness in other domains.Compared to time series, explainer robustness has been more extensively studied in vision and NLP

    evaluates and ranks explainers by injecting random Gaussian noise into the regions they identify as discriminative; more informative explanations should induce a larger drop in predictive accuracy when those regions are perturbed.Key limitation across these lines:existing time series attacks predominantly target predictions (without controlling post-attac...

    2019

  15. [25]

    vulnerable

    For each coordinate i, let Ai(X) denote thei-th attribution entry. Assumptions (formalized).We make the following local regularity assumptions along the dense update direction. Let the directional derivative ofA i atXalongδbe DδAi(X) :=∇A i(X)⊤δ. Assumption B.1(Off-window directional sensitivity).There exist constants η∈(0,1) , γ >0 and a set U ⊆Ωc with |...

    2017

  16. [26]

    Sinceα freq >0and(1−tanh 2)>0, the partial derivative ∂Mf ∂Θf is a strictly positive scalar

    By the chain rule: ∂Jatk ∂Θf = ∂Jatk ∂Mf · ∂Mf ∂Θf = ∂Jatk ∂Mf · αfreq ·(1−tanh 2(Θf )) | {z } >0 . Sinceα freq >0and(1−tanh 2)>0, the partial derivative ∂Mf ∂Θf is a strictly positive scalar. Therefore, sign ∂Jatk ∂Θf = sign ∂Jatk ∂Mf . This proves that the energy-invariant property of the filter-space gradient directly governs the update direction of th...

    2023

  17. [29]

    It contains continuous recordings of daily activities from 9 subjects measured by multiple sensors

    is a human activity recognition benchmark with wearable inertial measurement units. It contains continuous recordings of daily activities from 9 subjects measured by multiple sensors. Following Queen et al. (2023), we discard the ninth subject due to the short recording length, segment the remaining multivariate time series into windows of 600 time steps ...

    2023

  18. [30]

    For a fair comparison, we use the same time-series explanation- alignment loss (i.e., the same target definition and distance metric) as in TSEF

    by optimizing a weighted objective L=λ clsLcls +λ expLexp, where Lcls is the targeted classification loss and Lexp measures the discrepancy between the adversarial explanation and the reference explanation. For a fair comparison, we use the same time-series explanation- alignment loss (i.e., the same target definition and distance metric) as in TSEF. We s...

    2024

  19. [2001]

    non-seizure

    consists of single-channel EEG recordings from 500 subjects. For each subject, brain activity is recorded for 23.6 seconds and sampled at 178 Hz. The continuous signals are then partitioned and shuffled into 11,500 non-overlapping 1-second segments to weaken subject-specific correlations. The original annotations contain five categories: eyes open, eyes c...

    2023

  20. [2009]

    Crafting papers on machine learning

    Langley, P. Crafting papers on machine learning. In Langley, P. (ed.),Proceedings of the 17th International Conference on Machine Learning (ICML 2000), pp. 1207–1216, Stan- ford, CA,

    2000

  21. [2012]

    Explainable artificial intelli- gence (xai) on timeseries data: A survey.arXiv preprint arXiv:2104.00950,

    Rojat, T., Puget, R., Filliat, D., Del Ser, J., Gelin, R., and D´ıaz-Rodr´ıguez, N. Explainable artificial intelli- gence (xai) on timeseries data: A survey.arXiv preprint arXiv:2104.00950,

    Pith/arXiv arXiv

  22. [2014]

    Targeted attacks on timeseries forecasting.arXiv preprint arXiv:2301.11544,

    Govindarajulu, Y ., Amballa, A., Kulkarni, P., and Parmar, M. Targeted attacks on timeseries forecasting.arXiv preprint arXiv:2301.11544,

    Pith/arXiv arXiv

  23. [2016]

    Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083,

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083,

    Pith/arXiv arXiv

  24. [2017]

    J., Mnih, A., and Teh, Y

    Maddison, C. J., Mnih, A., and Teh, Y . W. The concrete distribution: A continuous relaxation of discrete random variables.arXiv preprint arXiv:1611.00712,

    Pith/arXiv arXiv

  25. [2020]

    Shapex: Shapelet-driven post hoc explanations for time series classification models

    Huang, B., Jin, M., Liang, Y ., Barthelemy, J., Cheng, D., Wen, Q., Liu, C., and Pan, S. Shapex: Shapelet-driven post hoc explanations for time series classification models. arXiv preprint arXiv:2510.20084,

    arXiv

  26. [2021]

    Adversarial attacks and defences: A survey.arXiv preprint arXiv:1810.00069,

    Chakraborty, A., Alam, M., Dey, V ., Chattopadhyay, A., and Mukhopadhyay, D. Adversarial attacks and defences: A survey.arXiv preprint arXiv:1810.00069,

    Pith/arXiv arXiv

  27. [2022]

    Categorical repa- rameterization with gumbel-softmax.arXiv preprint arXiv:1611.01144,

    Jang, E., Gu, S., and Poole, B. Categorical repa- rameterization with gumbel-softmax.arXiv preprint arXiv:1611.01144,

    Pith/arXiv arXiv

  28. [2023]

    Gu, W., Zhong, R., Zhang, J., and Lyu, M. R. Towards imperceptible adversarial attacks for time series classi- fication with local perturbations and frequency analysis. arXiv preprint arXiv:2503.19519,

    Pith/arXiv arXiv

  29. [2024]

    J., Shlens, J., and Szegedy, C

    Goodfellow, I. J., Shlens, J., and Szegedy, C. Explain- ing and harnessing adversarial examples.arXiv preprint arXiv:1412.6572,

    Pith/arXiv arXiv

  30. [2025]

    Adversarial attacks on multivariate time series.arXiv preprint arXiv:2004.00410,

    Harford, S., Karim, F., and Darabi, H. Adversarial attacks on multivariate time series.arXiv preprint arXiv:2004.00410,

    Pith/arXiv arXiv 2004