Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

TrojanTime: Backdoor Attacks on Time Series Classification

T0 review · 4 major / 6 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A pretrained time series classifier can be backdoored using only an external arbitrary dataset, with no access to or knowledge of the original training data.

desk verdict Novel data-free backdoor setting for time series, but the reported experiments are too inconsistent to support the central claim. read the letter →

arxiv 2502.00646 v1 pith:DOTXVQYJ submitted 2025-02-02 cs.CR cs.AIcs.LG

Chang Dong , Zechao Sun , Guangdong Bai , Shuying Piao , Weitong Chen , Wei Emma Zhang This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords backdoorattacktimeseriesclassificationdata-freeadversarialdatasynthesislogitsalignmentbatchnormalizationfreezingunlearningdefenseUCRbenchmark
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a backdoor can be planted in a pretrained time series classifier without any access to its training data. Instead of poisoning the original dataset, the attacker runs targeted PGD adversarial attacks on an unrelated external time series dataset, producing a pseudo-dataset whose representations cover the model's class structure, then continues training the benign model on this pseudo-dataset plus a triggered version that all carry the target label. Two mechanisms—aligning current logits with the pretrained model's logits and freezing batch-norm statistics—keep the model's clean accuracy from collapsing while the trigger mapping is learned. Across five trigger types and four architectures on UCR datasets, average attack success for the fixed trigger reaches 86.3% with a 7.9-point clean-accuracy drop. The paper also proposes an unlearning defense that identifies highly active rear-layer samples and fine-tunes them away, reducing attack success while roughly preserving clean accuracy.

What carries the argument

The machinery is the adversarially synthesized pseudo-dataset combined with a two-term training objective. A PGD (projected gradient descent) attack is run on each sample of the external dataset $D'$ against every class of the model's output head, producing adversarial samples $x_{\mathrm{adv}}$ whose pre-trained logits $y_{\mathrm{adv}}$ are stored. During backdoor training, the loss $L = L_{\mathrm{MSE}} + \lambda L_{\mathrm{CE}}$ is minimized: $L_{\mathrm{MSE}}$ enforces that the updated model's logits on $x_{\mathrm{adv}}$ stay close to $y_{\mathrm{adv}}$, while $L_{\mathrm{CE}}$ trains the triggered version $T(x_{\mathrm{adv}})$ to predict the target class $k$. Freezing batch-normalization layers keeps the model's learned statistics unchanged, which the paper argues prevents concept drift and strengthens the trigger-neuron association.

What would settle it

Train a benign time series model on a UCR dataset such as ECG5000, then run TrojanTime with a deliberately unrelated external dataset whose classes do not overlap the training classes and whose representations barely overlap the original manifold; if clean accuracy stays near the benign level and attack success stays near 100%, the central claim is supported, whereas a sharp clean-accuracy collapse or a low attack success rate would refute it.

Watch

Extended reading notes

Core claim

TrojanTime's central claim is that a benign pre-trained time series classifier can be backdoored using only an external arbitrary time series dataset $D'$, with no access to or knowledge of the original training data $D_{\mathrm{train}}$. The attacker first resizes or interpolates $D'$ to match the model's input dimension, then applies unconstrained PGD targeted at each of the model's classes to produce an adversarial pseudo-dataset $D_{\mathrm{adv}}$ whose representations spread across the model's class structure. A trigger is applied to $D_{\mathrm{adv}}$ to build a poisoned set $D_{\mathrm{bd}}$ in which every sample carries the attacker's target label $k$. The model is then continued-trained on $D_{\mathrm{adv}}$ and $D_{\mathrm{bd}}$ with the loss $L = L_{\mathrm{MSE}} + \lambda L_{\mathrm{CE}}$, where the MSE term aligns the logits of adversarial samples with their pre-trained outputs and the cross-entropy term maps triggered samples to $k$; batch-norm statistics from the benign model are frozen. On the UCR datasets with five trigger types and four architectures, the fixed masking trigger reaches 86.3% average attack success rate while clean accuracy drops by 7.9 percentage points, and the random trigger reaches 90.3% average attack success rate with a larger clean-accuracy cost.

Load-bearing premise

The method assumes that adversarial samples generated from an arbitrary external dataset produce representations that cover the unknown original training distribution closely enough to keep clean accuracy high while the trigger mapping is learned.

Editorial extensions

If this is right

  • A pretrained model posted to an online repository becomes a viable attack target even if the attacker never sees the training data, so model sharing alone is not enough to protect a time series deployment.
  • Because clean accuracy is largely preserved, routine validation on clean data will not reveal the backdoor; detection must look at neuron or feature behavior rather than overall accuracy.
  • Masking-style triggers (fixed and random) are the strongest under TrojanTime, so defenses and deployment safeguards should prioritize detecting patch-like distortions over blended noise.
  • The ablation indicates that all three design choices—adversarial synthesis, logits alignment, and frozen batch norm—are necessary; removing any one degrades either clean accuracy or attack success.
  • The proposed rear-layer unlearning defense brings average attack success rate down substantially while keeping clean accuracy near its original level, providing a mitigation that does not require retraining from scratch.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's T-SNE evidence suggests, but does not quantify, that $D_{\mathrm{adv}}$ covers the original class manifold; a direct test would be measuring representation overlap between $D_{\mathrm{adv}}$ and held-out training classes for several choices of external dataset $D'$.
  • If the attack works for any arbitrary external dataset, then the same recipe could extend to sequential models beyond classification, such as forecasting or regression heads, where logits alignment would become alignment of the output distribution.
  • The defense's reliance on rear-layer channel norms implies a natural counter-move: a trigger designed to keep rear-layer norms close to clean samples, or to activate earlier layers, could evade the unlearning step; the paper does not explore that evasion.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes TrojanTime, a backdoor attack against pre-trained time series classifiers that requires no access to the training data. In the first stage, an attacker runs PGD targeted adversarial attacks on an external dataset D′ to create a pseudo-dataset D_adv, recording the benign model's logits as soft targets. In the second stage, the benign model is continually trained on D_adv and on a poisoned version D_bd, using a logits-alignment term (Eq. 3) and frozen BatchNorm layers to preserve clean accuracy and strengthen the trigger association. The paper evaluates the attack on four UCR datasets, four architectures, and five triggers, and also proposes a defensive unlearning method that identifies backdoored samples by their high response norms in rear layers and unlearns them. The central claim is that a model-only attacker can embed a trigger-to-target mapping while maintaining clean accuracy.

Significance. The paper addresses a genuinely important and under-studied problem: backdoor attacks on time series classifiers without access to the training data. The two-stage design—generating adversarial pseudo-data from an external dataset and combining logits alignment with BatchNorm freezing to mitigate concept drift—is a creative and plausible mechanism, and the paper is honest about the limitations of naive training (Figure 2d-2e). The defense based on response-norm unlearning is also a practical contribution if properly validated. However, the current manuscript provides no code or data, leaves the external dataset D′ unspecified, and contains internally contradictory accuracy numbers for identical configurations. These issues are load-bearing because the central claim is empirical: that clean accuracy is maintained while the backdoor is embedded. At present the paper does not provide falsifiable, reproducible evidence for that claim.

major comments (4)
  1. [Section 3.2, Table 1; Section 3.3, Table 2] For the fixed trigger on the Coffee dataset with the LSTMFCN architecture, Table 1 reports CA=100.0 and ASR=84.6, while Table 2 reports CA=46.4 and ASR=100.0 for exactly the same configuration. Similarly, for BirdChicken with InceptionTime and the fixed trigger, Table 1 reports CA=90.0 while Table 2 reports CA=95.0. Since no random seed or protocol difference is described, at least one of these tables is incorrect. The central claim that TrojanTime maintains clean accuracy is therefore not supported by the paper's own reported data.
  2. [Section 3.1; Algorithm 1] The external dataset D′ used for pseudo-data synthesis is never named or described for any experiment. The entire method depends on the assumption that adversarial pseudo-samples generated from D′ cover the latent space of the unknown training set (Section 2.2, Figure 2c), and the only support for this assumption is a qualitative T-SNE plot for ECG5000 with InceptionTime. Without specifying D′, the results cannot be reproduced, and one cannot rule out that the reported CA/ASR values depend on a particular unreported choice of D′. The paper should report D′ for each experiment, or better, vary D′ and quantify overlap.
  3. [Section 2.2, Eqs. (2)-(5)] The attack loss directly minimizes the cross-entropy between the model's output on poisoned pseudo-samples and the target label k, so the reported ASR is by construction a measure of how well the model fits the training objective on D_adv, not an independent predictive result. The non-trivial claim is that clean accuracy on the true test distribution is preserved, and that claim is precisely what the Table 1/Table 2 contradiction fails to establish. To support the central claim, the authors need to show that clean accuracy is maintained on a held-out test set with a properly specified D′ and consistent hyperparameters.
  4. [Section 2.3, Defense Design; Table 3] The defense's detection threshold r and the unlearning penalty schedule for alpha appear to be chosen post hoc based on the artifacts of the specific attack under evaluation. The paper states that '5% of r% is already effective' but does not report the exact r used in Table 3 nor provide any sensitivity analysis of the defense to r and alpha. Moreover, the defense is not evaluated against a trigger type not seen during selection of these hyperparameters. As a result, the defense evaluation is circular and cannot be distinguished from overfitting to the attack configuration.
minor comments (6)
  1. [Table 1] Table 1's header is malformed: the column labels 'Dataset Trigger - Powerline5 ...' do not clearly indicate the benign-accuracy column, making the table hard to parse.
  2. [Section 3.1; Algorithm 1] Section 3.1 says 'unconstrained PGD50' but Algorithm 1 does not specify the number of PGD iterations or the perturbation budget; the implementation details should be aligned with the algorithm pseudocode.
  3. [Section 3.4] The claim that defense failures are due to 'insufficient number of training samples (~20)' is not tied to any specific dataset; please identify the dataset and its training-set size.
  4. [References] References [27] and [28] are identical entries; please correct the duplicate.
  5. [Abstract; Section 2.1] The text uses 'T rojanTime' with a spurious space in the abstract, and there is a typo 'Prliminary' in Section 2.1.
  6. [Figure 2] The caption of Figure 2 defines markers 'D_left' and 'D_right' but subfigures (a)-(f) use different set pairs; please revise for clarity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: TrojanTime's reported ASR and CA are held-out benchmark measures, not quantities forced by the training objective.

full rationale

The central attack pipeline is not circular. The training objective (Eqs. 2 and 4) minimizes cross-entropy on poisoned adversarial pseudo-samples T(xadv) generated from the external dataset D', whereas the reported ASR is measured on triggered samples from the held-out UCR test sets of the unknown original distribution. The trigger-to-target mapping must therefore transfer from Dadv to the unseen test distribution, so a high ASR is an empirical generalization result rather than a by-construction consequence of the loss. Clean accuracy is likewise not forced: logits alignment (Eq. 3) and batch-norm freezing are regularizers that use the benign model's own outputs, but the paper's own Fig. 2f shows that an arbitrary D' may occupy only a small part of the target distribution, so preserving held-out CA is an unguaranteed empirical outcome. The defense's top-r selection is post hoc and the paper does not specify whether the selection set overlaps the evaluation set, which is a methodological transparency concern rather than demonstrated circularity. Self-citations in the reference list are background only and are not load-bearing; no uniqueness theorem or ansatz is imported from the authors' prior work. The strongest legitimate concerns are missing support (D' is never identified, and coverage evidence is qualitative T-SNE only in Fig. 2c) and internal numerical inconsistencies for identical fixed-trigger settings (e.g., Coffee/LSTMFCN: CA/ASR 100/84.6 in Table 1 vs 46.4/100 in Table 2). These are correctness risks, not circular reductions.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The central claim rests on several unverified domain assumptions: adversarial synthesis on an arbitrary dataset yields training-distribution-like samples, original model logits are stable anchors, batch norm freezing localizes trigger learning, and rear-layer response norms separate poisoned inputs. No theoretical bounds are given. The free parameters (lambda, alpha, r, PGD steps, epochs, lr) are chosen manually without sensitivity analysis, and the external dataset D' is not identified, limiting reproducibility.

free parameters (7)
  • lambda (logits alignment vs backdoor loss trade-off) = 1
    Set as default; no sensitivity analysis is provided.
  • alpha (defense unlearning penalty) = linearly decreased from 10 to 1
    Chosen manually for the defense; no ablation on the schedule.
  • r (top response-norm percentage for backdoor detection) = 5%
    Authors state 5% is effective when the poisoning ratio is 10%, which is a post hoc choice.
  • PGD steps for dataset synthesis = 50
    Unconstrained PGD50 with step size 0.01; no comparison with other step counts.
  • backdoor training epochs = 1000
    Used for backdoor training; defense uses 20 epochs. No early stopping or sensitivity analysis.
  • learning rate = 1e-4
    Adam optimizer; fixed.
  • external dataset D' choice = unspecified
    The paper never identifies which arbitrary external dataset is used; results may depend on this choice.
assumptions (4)
  • domain assumption PGD target adversarial attacks on an arbitrary external dataset D' produce samples whose representations overlap the original training distribution.
    Section 2.2, Figure 2c; this is the core premise of the pseudo-dataset and is only shown qualitatively.
  • domain assumption The pre-trained benign model's logits are reliable anchors that, when used as regression targets, prevent concept drift.
    Equation (3); assumes the original model outputs are stable and informative.
  • domain assumption Freezing BatchNorm preserves the benign model's statistics and forces trigger learning into the weights.
    Section 2.2, BatchNorm Freezing; no theoretical or quantitative justification.
  • domain assumption Backdoored models show elevated response norms in rear layers for poisoned inputs.
    Section 2.3, Figure 3; observed only on their own successful attacks and used as the defense criterion.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TrojanTime: Backdoor Attacks on Time Series Classification." pith.science (2026). https://pith.science/paper/DOTXVQYJ

@misc{pith2026250200646,
  author       = {Pith},
  title        = {Pith review of: TrojanTime: Backdoor Attacks on Time Series Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DOTXVQYJ}},
  note         = {Machine review of arXiv:2502.00646}
}
read the original abstract

Time Series Classification (TSC) is highly vulnerable to backdoor attacks, posing significant security threats. Existing methods primarily focus on data poisoning during the training phase, designing sophisticated triggers to improve stealthiness and attack success rate (ASR). However, in practical scenarios, attackers often face restrictions in accessing training data. Moreover, it is a challenge for the model to maintain generalization ability on clean test data while remaining vulnerable to poisoned inputs when data is inaccessible. To address these challenges, we propose TrojanTime, a novel two-step training algorithm. In the first stage, we generate a pseudo-dataset using an external arbitrary dataset through target adversarial attacks. The clean model is then continually trained on this pseudo-dataset and its poisoned version. To ensure generalization ability, the second stage employs a carefully designed training strategy, combining logits alignment and batch norm freezing. We evaluate TrojanTime using five types of triggers across four TSC architectures in UCR benchmark datasets from diverse domains. The results demonstrate the effectiveness of TrojanTime in executing backdoor attacks while maintaining clean accuracy. Finally, to mitigate this threat, we propose a defensive unlearning strategy that effectively reduces the ASR while preserving clean accuracy.

Figures

Figures reproduced from arXiv: 2502.00646 by the authors.

Figure 1
Figure 1. The framework of TrojanTime. We provide a clear demonstration of the two-step training: 1) Data synthesis: after matching the dimensions of the introduced external dataset, PGD attack is applied to generate diverse adversar￾ial samples; 2) Backdoor training: logits alignment and BatchNorm freezing during the training process to ensure the generalization ability in clean samples. introducing a carefully designed trig… view at source ↗
Figure 2
Figure 2. T-SNE visualization of latent separability characteristic on ECG5000 of [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Output norm differences (value = |normbad−normclean|) of each channel by layer (dataset: Coffee model: InceptionTime). 2.3 Defense Design To mitigate the attack we proposed, we investigated a defensive learning method that does not require retraining the model from scratch. From the experiment, we observed a feature space disparity between backdoor samples and clean samples, which can be used to isolate the toxic sa… view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Trojan Horse Hunt in Time Series Forecasting for Space Operations

    cs.LG 2025-06 unverdicted novelty 6.0 of 10

    A new Kaggle competition asks teams to reverse engineer 45 hidden triggers in poisoned satellite-telemetry forecasting models.

Reference graph

Works this paper leans on

30 extracted references · 18 canonical work pages · cited by 1 Pith paper

  1. [1]

    Bai, S., Kolter, J.Z., Koltun, V.: An empirical evaluation of generic convo- lutional and recurrent networks for sequence modeling. arxiv. arXiv preprint arXiv:1803.01271 10 (2018)

    arXiv 2018

  2. [2]

    In: 2019 IEEE International Conference on Image Processing (ICIP)

    Barni, M., Kallas, K., Tondi, B.: A new backdoor attack in cnns by training set corruption without label poisoning. In: 2019 IEEE International Conference on Image Processing (ICIP). pp. 101–105. IEEE (2019)

    2019

  3. [3]

    Neural Networks136, 126–140 (2021)

    Chen, W., Shi, K.: Multi-scale attention convolutional neural network for time series classification. Neural Networks136, 126–140 (2021)

    work page 2021

  4. [4]

    Advances in Neural Information Processing Systems35, 9727– 9737 (2022)

    Chen, W., Wu, B., Wang, H.: Effective backdoor defense by exploiting sensitivity of poisoned samples. Advances in Neural Information Processing Systems35, 9727– 9737 (2022)

    work page 2022

  5. [5]

    In: Proceedings of the 37th Annual Computer Security Applications Con- ference

    Chen, X., Salem, A., Chen, D., Backes, M., Ma, S., Shen, Q., Wu, Z., Zhang, Y.: Badnl: Backdoor attacks against nlp models with semantic-preserving improve- ments. In: Proceedings of the 37th Annual Computer Security Applications Con- ference. pp. 554–569 (2021)

    work page 2021

  6. [6]

    arXiv preprint arXiv:1712.05526 (2017)

    Chen, X., Liu, C., Li, B., Lu, K., Song, D.: Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)

    arXiv 2017

  7. [7]

    IEEE/CAA Jour- nal of Automatica Sinica6(6), 1293–1305 (2019)

    Dau, H.A., Bagnall, A., Kamgar, K., Yeh, C.C.M., Zhu, Y., Gharghabi, S., Ratanamahatana, C.A., Keogh, E.: The ucr time series archive. IEEE/CAA Jour- nal of Automatica Sinica6(6), 1293–1305 (2019)

    2019

  8. [8]

    In: 2022 IEEE 38th International Conference on Data Engineering (ICDE)

    Ding, D., Zhang, M., Huang, Y., Pan, X., Feng, F., Jiang, E., Yang, M.: Towards backdoor attack on deep learning based time series classification. In: 2022 IEEE 38th International Conference on Data Engineering (ICDE). pp. 1274–1287. IEEE (2022) 12 Chang et al

    work page 2022

Show all 30 references
  1. [9]

    arXiv preprint arXiv:2409.02802 (2024)

    Dong, C., Li, Z., Zheng, L., Chen, W., Zhang, W.E.: Boosting certified ro- bustness for time series classification with efficient self-ensemble. arXiv preprint arXiv:2409.02802 (2024)

    2024 arXiv

  2. [10]

    In: 2023 IEEE Interna- tional Conference on Knowledge Graph (ICKG)

    Dong, C.G., Zheng, L.N., Chen, W., Zhang, W.E., Yue, L.: Swap: Exploiting second-ranked logits for adversarial attacks on time series. In: 2023 IEEE Interna- tional Conference on Knowledge Graph (ICKG). pp. 117–125. IEEE (2023)

    2023

  3. [11]

    arXiv preprint arXiv:1412.6572 (2014)

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    2014 arXiv

  4. [12]

    arXiv preprint arXiv:1708.06733 (2017)

    Gu, T., Dolan-Gavitt, B., Garg, S.: Badnets: Identifying vulnerabilities in the ma- chine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)

    2017 arXiv

  5. [13]

    arXiv preprint arXiv:2202.03423 (2022)

    Huang, K., Li, Y., Wu, B., Qin, Z., Ren, K.: Backdoor defense via decoupling the training process. arXiv preprint arXiv:2202.03423 (2022)

    2022 arXiv

  6. [14]

    Data Mining and Knowledge Discovery34(6), 1936–1962 (2020)

    Ismail Fawaz, H., Lucas, B., Forestier, G., Pelletier, C., Schmidt, D.F., Weber, J., Webb, G.I., Idoumghar, L., Muller, P.A., Petitjean, F.: Inceptiontime: Finding alexnet for time series classification. Data Mining and Knowledge Discovery34(6), 1936–1962 (2020)

    2020

  7. [15]

    In: 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)

    Jiang, Y., Ma, X., Erfani, S.M., Bailey, J.: Backdoor attacks on time series: A gen- erative approach. In: 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). pp. 392–403. IEEE (2023)

    2023

  8. [16]

    IEEE access6, 1662–1669 (2017)

    Karim, F., Majumdar, S., Darabi, H., Chen, S.: Lstm fully convolutional networks for time series classification. IEEE access6, 1662–1669 (2017)

    2017

  9. [17]

    Advances in Neural Information Processing Systems 34, 14900–14912 (2021)

    Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., Ma, X.: Anti-backdoor learning: Train- ing clean models on poisoned data. Advances in Neural Information Processing Systems 34, 14900–14912 (2021)

    2021

  10. [18]

    arXiv preprint arXiv:2408.01005 (2024)

    Liang, W., Li, Z., Chen, W.: Enhancing financial market predictions: Causality- driven feature selection. arXiv preprint arXiv:2408.01005 (2024)

    2024 arXiv

  11. [19]

    arXiv preprint arXiv:2405.20291 (2024)

    Lin, W., Liu, L., Wei, S., Li, J., Xiong, H.: Unveiling and mitigating backdoor vulnerabilities based on unlearning weight changes and backdoor activeness. arXiv preprint arXiv:2405.20291 (2024)

    2024 arXiv

  12. [20]

    In: International symposium on research in attacks, intrusions, and defenses

    Liu, K., Dolan-Gavitt, B., Garg, S.: Fine-pruning: Defending against backdoor- ing attacks on deep neural networks. In: International symposium on research in attacks, intrusions, and defenses. pp. 273–294. Springer (2018)

    2018

  13. [21]

    In: 25th Annual Network And Distributed System Security Symposium (NDSS 2018)

    Liu, Y., Ma, S., Aafer, Y., Lee, W.C., Zhai, J., Wang, W., Zhang, X.: Trojan- ing attack on neural networks. In: 25th Annual Network And Distributed System Security Symposium (NDSS 2018). Internet Soc (2018)

    2018

  14. [22]

    Advances in Neural Information Processing Systems33, 3454–3464 (2020)

    Nguyen, T.A., Tran, A.: Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems33, 3454–3464 (2020)

    2020

  15. [23]

    Remote Sensing11(5), 523 (2019)

    Pelletier, C., Webb, G.I., Petitjean, F.: Temporal convolutional neural network for the classification of satellite image time series. Remote Sensing11(5), 523 (2019)

    2019

  16. [24]

    Advances in neural information processing systems31 (2018)

    Shafahi, A., Huang, W.R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., Gold- stein, T.: Poison frogs! targeted clean-label poisoning attacks on neural networks. Advances in neural information processing systems31 (2018)

    2018

  17. [25]

    In: Australasian Joint Conference on Artificial Intelligence

    Shen, S., Chen, W., Xu, M.: What leads to arrhythmia: Active causal representa- tion learning of ecg classification. In: Australasian Joint Conference on Artificial Intelligence. pp. 501–515. Springer (2022)

    2022

  18. [26]

    In: European Conference on Computer Vision

    Wang, T., Yao, Y., Xu, F., An, S., Tong, H., Wang, T.: An invisible black-box backdoor attack through frequency domain. In: European Conference on Computer Vision. pp. 396–413. Springer (2022)

    2022

  19. [27]

    Advances in Neural Information Processing Systems34, 16913–16925 (2021) TrojanTime: Backdoor Attacks on Time Series Classification 13

    Wu, D., Wang, Y.: Adversarial neuron pruning purifies backdoored deep models. Advances in Neural Information Processing Systems34, 16913–16925 (2021) TrojanTime: Backdoor Attacks on Time Series Classification 13

    2021

  20. [28]

    Advances in Neural Information Processing Systems34, 16913–16925 (2021)

    Wu, D., Wang, Y.: Adversarial neuron pruning purifies backdoored deep models. Advances in Neural Information Processing Systems34, 16913–16925 (2021)

    2021

  21. [29]

    Yang, W., Lin, Y., Li, P., Zhou, J., Sun, X.: Rethinking stealthiness of backdoor attack against nlp models. In: Proceedings of the 59th Annual Meeting of the Asso- ciation for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing...

    2021

  22. [30]

    arXiv preprint arXiv:2110.03735 (2021)

    Zeng, Y., Chen, S., Park, W., Mao, Z.M., Jin, M., Jia, R.: Adversarial unlearning of backdoors via implicit hypergradient. arXiv preprint arXiv:2110.03735 (2021)

    2021 arXiv

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.