Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Features (Extended Abstract)

1. [Aminikhanghahi et al., 2018] Samaneh Aminikhanghahi, Tinghui Wang, and Diane J Cook. Real-time change point detection with application to smart home time series data. IEEE Transactions on Knowledge and Data Engineering, 31(5):1010-1023, 2018.
2. [Athalye et al., 2018] Anish Athalye, Logan Engstrom, An- drew Ilyas, and Kevin Kwok. Synthesizing robust adver- sarial examples. In Proceedings of the 35th International Conference on Machine Learning (ICML, 2018.
3. [Bagnall et al., 2020] Anthony Bagnall, Jason Lines, William Vickers, and Eamonn Keogh. The UEA & UCR time series classification rep. www.timeseriesclassification.com, 2020. Accessed: 2020-01-01.
4. [Belkhouja and Doppa, 2020] Taha Belkhouja and Janard- han Rao Doppa. Analyzing deep learning for time-series data through adversarial lens in mobile and iot applica- tions. IEEE Transactions on Computer Aided Design of Integrated Circuits and Systems (TCAD), 39(11):3190- 3201, 2020.
5. [Belkhouja and Doppa, 2022] Taha Belkhouja and Janard- han Rao Doppa. Adversarial framework with certified robustness for time-series domain via statistical features. Journal of Artificial Intelligence Research, 73:1435-1471, 2022.
6. [Belkhouja et al., 2022] Taha Belkhouja, Yan Yan, and Ja- nardhan Rao Doppa. Training robust deep models for time-series domain: Novel algorithms and theoretical analysis. In AAAI Conference on Artificial Intelligence (AAAI), 2022.
7. [Belkhouja et al., 2023] Taha Belkhouja, Yan Yan, and Ja- nardhan Rao Doppa. Dynamic time warping based ad- versarial framework for time-series domain. IEEE Trans- actions on Pattern Analysis and Machine Intelligence (TPAMI), 2023.
8. [Carlini and Wagner, 2017] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy (SP), 2017.
9. [Chen and Gu, 2020] Jinghui Chen and Quanquan Gu. Rays: A ray searching method for hard-label adversarial attack. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2020.
10. [Chen et al., 2020] Jinghui Chen, Dongruo Zhou, Jinfeng Yi, and Quanquan Gu. A frank-wolfe framework for efficient and effective adversarial attacks. Proceedings of the AAAI Conference on Artificial Intelligence, 2020.
11. [Christ et al., 2016] Maximilian Christ, Andreas W Kempa- Liehr, and Michael Feindt. Distributed and parallel time series feature extraction for industrial big data applica- tions. arXiv preprint arXiv:1610.07717, 2016.
12. [Cohen et al., 2019] Jeremy M Cohen, Elan Rosenfeld, and J Zico Kolter. Certified adversarial robustness via random- ized smoothing. arXiv preprint arXiv:1902.02918, 2019.
13. [Drensky and Holtkamp, 2006] Vesselin Drensky and Ralf Holtkamp. Constants of formal derivatives of non- associative algebras, taylor expansions and applica- tions. Rendiconti del Circolo Matematico di Palermo, 55(3):369-384, 2006.
14. [Dua and Graff, 2017] Dheeru Dua and Casey Graff. UCI machine learning repository. http://archive.ics.uci.edu/ml, 2017. Accessed: 2020-01-01. Link
15. [Fawaz et al., 2019] Hassan Ismail Fawaz, Germain Forestier, Jonathan Weber, Lhassane Idoumghar, and Pierre-Alain Muller. Adversarial attacks on deep neural networks for time series classification. International Joint Conference on Neural Networks (IJCNN), 2019.
16. [Fulcher and Jones, 2014] Ben D Fulcher and Nick S Jones. Highly comparative feature-based time-series classifica- tion. IEEE Transactions on Knowledge and Data Engi- neering, 2014.
17. [Gao et al., 2018] Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. Black-box generation of adversarial text sequences to evade deep learning classifiers. In IEEE Se- curity and Privacy Workshops (SPW), pages 50-56, 2018.
18. [Ge and Ge, 2016] Li Ge and Li-Juan Ge. Feature extraction of time series classification based on multi-method inte- gration. Optik, 127(23):11070-11074, 2016.
19. [Hein and Andriushchenko, 2017] Matthias Hein and Maksym Andriushchenko. Formal guarantees on the robustness of a classifier against adversarial manipulation. In Advances in Neural Information Processing Systems, pages 2266-2276, 2017.
20. [Hosseini et al., 2017] Hossein Hosseini, Baicen Xiao, May- oore Jaiswal, and Radha Poovendran. On the limitation of convolutional neural networks in recognizing negative im- ages. In 16th International Conference on Machine Learn- ing and Applications (ICMLA). IEEE, 2017.
21. [Huang et al., 2017] Xiaowei Huang, Marta Kwiatkowska, Sen Wang, and Min Wu. Safety verification of deep neural networks. In International conference on computer aided verification, pages 3-29. Springer, 2017.
22. [Hussein et al., 2022] Dina Hussein, Taha Belkhouja, Gana- pati Bhat, and Janardhan Rao Doppa. Reliable machine learning for wearable activity monitoring: Novel algo- rithms and theoretical guarantees. In Proceedings of the 41st IEEE/ACM International Conference on Computer- Aided Design (ICCAD), pages 33:1-33:9. ACM, 2022.
23. [Ignatov, 2018] Andrey Ignatov. Real-time human activity recognition from accelerometer data using convolutional neural networks. Applied Soft Computing, 62:915-922, 2018.
24. [Karim et al., 2020] Fazle Karim, Somshubra Majumdar, and Houshang Darabi. Adversarial attacks on time series. IEEE Transactions on pattern analysis and machine intel- ligence, 2020.
25. [Kolter and Madry, 2018] Zico Kolter and Aleksander Madry. Tutorial adversarial robustness: Theory and practice. NeurIPS, 2018.
26. [Kurakin et al., 2016] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533, 2016.
27. [Kwapisz et al., 2011] Jennifer R Kwapisz, Gary M Weiss, and Samuel A Moore. Activity recognition using cell phone accelerometers. SigKDD Explorations Newsletter, 12(2):74-82, 2011.
28. [Laidlaw and Feizi, 2019] Cassidy Laidlaw and Soheil Feizi. Functional adversarial attacks. In Advances in Neural In- formation Processing Systems (Neur'IPS), pages 10408- 10418, 2019.
29. [Li et al., 2019] Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified adversarial robustness with ad- ditive noise. In Advances in Neural Information Process- ing Systems, pages 9459-9469, 2019.
30. [Luo et al., 2018] Yonghong Luo, Xiangrui Cai, Ying ZHANG, Jun Xu, and Yuan xiaojie. Multivariate time series imputation with generative adversarial networks. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, editors, Advances in Neural Information Processing Systems (NeurIPS). Cur- ran Associates, Inc., 2018.
31. [Luo et al., 2019] Yonghong Luo, Ying Zhang, Xiangrui Cai, and Xiaojie Yuan. E²gan: End-to-end generative ad- versarial network for multivariate time series imputation. In Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI-19, 2019. IJCAI
32. [Maaten and Hinton, 2008] Laurens van der Maaten and Ge- offrey Hinton. Visualizing data using t-sne. Journal of Machine Learning Research (JMLR), 9(Nov):2579-2605, 2008.
33. [Madry et al., 2017] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017.
34. [Montgomery et al., 2015] Douglas C Montgomery, Cheryl L Jennings, and Murat Kulahci. Introduction to time series analysis and forecasting. John Wiley & Sons, 2015.
35. [Moosavi-Dezfooli et al., 2017] Seyed-Mohsen Moosavi- Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Pro- ceedings of the IEEE conference on computer vision and pattern recognition (CVPR), 2017.
36. [Ozbayoglu et al., 2020] Ahmet Murat Ozbayoglu, Mehmet Ugur Gudelek, and Omer Berat Sezer. Deep learning for financial applications: A survey. arXiv preprint arXiv:2002.05786, 2020.
37. [Papernot et al., 2017] Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Anan- thram Swami. Practical black-box attacks against machine learning. In Proceedings of Asia Conference on Computer and Communications Security (ASIACCS). ACM, 2017.
38. [Raghunathan et al., 2018] Aditi Raghunathan, Jacob Stein- hardt, and Percy Liang. Certified defenses against adver- sarial examples. arXiv preprint arXiv:1801.09344, 2018.
39. [Samanta and Mehta, 2017] Suranjana Samanta and Sameep Mehta. Towards crafting text adversarial samples. arXiv preprint arXiv:1707.02812, 2017.
40. [Siddiqui et al., 2019] Shoaib Ahmed Siddiqui, Dominique Mercier, Mohsin Munir, Andreas Dengel, and Sheraz Ahmed. TSViz: Demystification of deep learning mod- els for time-series analysis. IEEE Access, 7:67027-67040, 2019.
41. [Tramèr et al., 2018] Florian Tramèr, Alex Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and de- fenses. International Conference on Learning Represen- tations (ICLR), 2018.
42. [Tramer et al., 2020] Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. arXiv preprint arXiv:2002.08347, 2020.
43. [Wang et al., 2017] Zhiguang Wang, Weizhong Yan, and Tim Oates. Time series classification from scratch with deep neural networks: A strong baseline. In International Joint Conference on Neural Networks (IJCNN). IEEE, 2017.
44. [Wang et al., 2019] William Yang Wang, Sameer Singh, and Jiwei Li. Deep adversarial learning for nlp. In Proceed- ings of the Conference of the NAACL: Tutorials, pages 1- 5, 2019.
45. [Xiao et al., 2018] Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spa- tially transformed adversarial examples. arXiv preprint arXiv:1801.02612, 2018.
46. [Zheng et al., 2017] Zibin Zheng, Yatao Yang, Xiangdong Niu, Hong-Ning Dai, and Yuren Zhou. Wide and deep con- volutional neural networks for electricity-theft detection to secure smart grids. IEEE Transactions on Industrial Infor- matics, 2017.

References were extracted automatically from the PDF and may contain errors.

Full text extracted automatically from the PDF; figures, tables and equations may differ. The PDF is the version of record.

1 Introduction

We are seeing a significant growth in the Internet of Things (IoT) and mobile applications which are based on predictive analytics over time-series data collected from various types of sensors [Belkhouja and Doppa, 2020]. Some important applications include smart home automation [Aminikhanghahi et al., 2018], mobile health [Ignatov, 2018], smart grid management [Zheng et al., 2017], and finance [Ozbayoglu et al., 2020]. Deep neural networks (DNNs) have shown great success in learning accurate predictive models from time-series data [Wang et al., 2017; Luo et al., 2019; Luo et al., 2018]. In spite of their success, very little is known about the adversarial robustness of DNNs for time-series domain. Most of the prior work on adversarial robustness for DNNs is focused on image domain [Kolter and Madry, 2018; Carlini and Wagner, 2017; Chen and Gu, 2020; Athalye et al., 2018; Hosseini et al., 2017; Xiao et al., 2018; Laidlaw and Feizi, 2019;

∗Originally published at the Journal of Artificial Intelligence Research (JAIR) [Belkhouja and Doppa, 2022]

Chen et al., 2020; Moosavi-Dezfooli et al., 2017] and natural language domain [Wang et al., 2019; Gao et al., 2018; Samanta and Mehta, 2017]. Adversarial perturbations are constructed by bounding an lp-norm and depend heavily on the input data space: they can be a small noise to individual pixels of an image or word substitutions in a sentence. Adversarial examples expose the brittleness of DNNs and motivate creation of training methods to improve model robustness.

Time-series domain poses unique challenges (e.g., sparse peaks, fast oscillations) that are not encountered in both image and natural language domains [Belkhouja et al., 2022; Belkhouja et al., 2023]. The standard approach of imposing an lp-norm bound is not applicable as it does not capture the true similarity between time-series signals [Hussein et al., 2022]. Consequently, lp-norm constrained perturbations [Fawaz et al., 2019; Kurakin et al., 2016; Karim et al., 2020; Siddiqui et al., 2019] can potentially create adversarial examples which correspond to a different class label. There is no prior work on filtering methods in the signal processing literature to automatically identify such invalid adversarial candidates. Hence, adversarial examples from prior methods based on lp-norm will confuse the learner when they are used to improve the robustness of DNNs via adversarial training [Tramer et al., 2020; Tram`er et al., 2018], i.e., augmenting the original training data with adversarial examples. In other words, the accuracy of DNNs can potentially degrade on realworld time-series data after adversarial training.

In this paper, we propose a novel framework referred to as Time-Series Attacks via STATistical Features (TSA-STAT) and provide certified bounds on robustness. TSA-STAT relies on three key ideas. First, we create adversarial examples by imposing constraints on statistical features of the clean timeseries signal. This is inspired by the observation that timeseries data are comprehensible using multiple statistical tools rather than the raw data [Ignatov, 2018; Christ et al., 2016; Ge and Ge, 2016]. The statistical constraints allow us to create valid adversarial examples that are more similar to the original time-series signal when compared to lp-norm constrained perturbations. Second, we employ polynomial transformations to create adversarial time-series examples. We theoretically prove that polynomial transformations expand the space of valid adversarial examples over traditional additive perturbations, i.e., identify blind spots of additive perturbations. Our experiments demonstrate that polynomial transformation based attacks are more effective (in terms of successfully fooling time-series DNNs) than those based on additive perturbations. Third, to create attacks of different types, we solve an appropriate optimization problem to identify the parameters of the polynomial transformation via gradient descent. Figure 1 provides a conceptual illustration of the TSA-STAT algorithm. Certifiable robustness [Raghunathan et al., 2018; Hein and Andriushchenko, 2017; Cohen et al., 2019; Li et al., 2019; Huang et al., 2017] studies DNN classifiers whose prediction for any input X is verifiably constant within some neighborhood around X, e.g., lp ball. We derive a certified bound for robustness of adversarial attacks using TSA-STAT. Our TSA-STAT framework provides certification guarantees that are applicable to DNNs for the time-series domain with different network structures.

The key contributions of this paper is the development, theoretical analysis, and experimental evaluation of the TSASTAT framework [Belkhouja and Doppa, 2022]. Specific contributions include:

• Development of a principled approach to create targeted adversarial examples for the time-series domain using statistical constraints and polynomial transformations with theoretical analysis proving that polynomial transformations expand the space of valid adversarial examples over additive perturbations.
• Derivation of a certified bound for adversarial robustness of TSA-STAT that is applicable to any deep model for time-series domain.
• Comprehensive experimental evaluation of TSA-STAT on diverse real-world datasets and comparison with state-of-the-art baselines that demonstrate the practical benefits of extending the space of valid adversarial examples over those from prior lp-norm based methods.

2 The TSA-STAT Framework

2.1 Key Elements

1. Statistical constraints. Time-series data is often analyzed using diverse statistical tools [Montgomery et al.,

2015]. Machine learning models have achieved good classification performance using statistical features of time-series data [Fulcher and Jones, 2014]. These prior studies motivate us to use statistical features of time-series data to develop adversarial algorithms. We propose a new definition to create adversarial examples for time-series signals. Let S m(X) = {S1(X), S2(X), · · · , Sm(X)} be the set of statistical features of a given time-series signal X (e.g., mean, standard deviation, kurtosis). We define an adversarial example Xadv derived from X as follows:

Formula not decoded

where ϵi is the bound for the ith statistical feature. Using this definition, we call to change the conventional lp distancebased neighborhood-similarity to one based on statistical features for creating valid adversarial examples. We conjecture that this definition is better suited for adversarial examples in time-series domain and our experiments support this claim.

1. Polynomial transformation-based attacks. To explore a larger space of valid adversarial examples when compared to traditional additive perturbations, we propose polynomial transformation based attacks. The aim of this approach is to find a transformation over the input space that creates effective adversarial attacks. Hence, we define polynomial transformation PT : Rn×T → Rn×T as follows:Xadv = PT (X) = PT (Xi,j) ∀(i, j) ∈ [n] × [T ] where X ∈ Rn×T is the input time-series signal and Xadv is the corresponding adversarial example. The key idea is to create a threat model that does not require calling back the deep model for every new adversarial attack. Our goal is to preserve dependencies between features of the input space by having a transformation PT (·) that depends on the input time-series X, unlike the standard additive perturbations. Inspired by power series [Drensky and Holtkamp, 2006], we approximate this transformation PT (·) using a polynomial representation with a chosen degree d:

Formula not decoded

where ak ∈ Rn×T denote the polynomial coefficients and O stands for Big O notation.

Theorem 1. For a given input space Rn×T and d ≥ 1, poly-

Formula not decoded

Formula not decoded

The above theorem states that polynomial transformations expand the space of valid adversarial examples and identify blind spots of additive perturbations. In other words, the theorem explains that some of the adversarial examples created using polynomial transformations are not possible using standard additive perturbations.

1. Optimization based adversarial attacks. To create powerful adversarial examples to fool the deep model Fθ(X), we need to find optimized coefficients ak, ∀ k=0 to d, of the polynomial transformation PT (X). Our approach minimizes a loss function L using gradient descent that has two elements:
2. Classification loss. To enforce an input signal X to be mis-classified to a target class yt (different from true class label y ∈ Y ), we employ the formulation of [Carlini and Wagner, 2017] to define a loss function:

Formula not decoded

where ρ < 0. This loss function will ensure that the adversarial example will be moving towards the space where it will be classified by the DNN as class yt with a confidence |ρ| using the output of the pre-softmax layer {Zy}y∈Y .

• Statistical loss. To preserve the similarity between an input and its adversarial example, we propose another loss function that controls the close proximity of statistical features in a given set S m. This loss function overcomes the impractical use of projection functions on the statistical feature space.

Formula not decoded

The final combined loss function L that we want to minimize to obtain coefficients ak of the polynomial transformation PT (·) is as follows:

L(PT ,X, S m)=βl ·Llabel (PT ,X)+βs ·Lstat (PT ,X, S m) (3) where βl and βs are hyper-parameters that can be used to change the trade-off between Llabel and Lstat . We note that experiments showed good results by simply using βl=βs=1.

2.2 Instantiations of TSA-STAT

Our goal is to create targeted adversarial attacks on a classifier Fθ. An adversarial example Xadv for a single-instance input

X is defined as Xadv = PT yt (X) = ∑dk=0 ak Xk s.t.:

Formula not decoded

where yt is the target class-label of the attack. This adversarial example is constructed by employing a gradient descent based optimizer to minimize the loss function in Equation 3 over {ak}0≤k≤d defining PT .

For black-box attacks where adversarial examples are created with no knowledge about the target deep model parameters θ, the attacker queries the target model to get the predicted label for any input time-series X. This allows the creation of a proxy deep model to mimic the behavior of the target model [Tramer et al., 2020; Papernot et al., 2017] and to be used to compute the adversarial examples. We can also employ TSA-STAT to create universal perturbations. A universal perturbation generates a single transformation that is applicable for any input X ∈ Rn×T . We introduce a targeted universal attack in this setting as:

Formula not decoded

where et represents the error probability of creating an adversarial example that Fθ would classify it with label y ̸= yt. Our proposed algorithm analyzes a given set of input timeseries signals to find coefficients {ak}0≤k≤d that would push the image of multiple inputs PT yt (X) to the decision boundary of a target class-label yt defined by the classifier Fθ.

3 Certificates for Adversarial Robustness

We propose a novel certification approach for adversarial robustness of the TSA-STAT framework. Given a time-series input X ∈ Rn×T and a classifier Fθ, our overall goal is to provide a certification bound δ on the ∥ · ∥∞-norm over the statistical features S m(X) of the time-series signal X. This bound will guarantee the robustness of classifier Fθ in predicting Fθ(Xadv) = Fθ(X) for any adversarial time-series Xadv such that ∑Si∈Sm ∥Si(Xadv) - Si(X)∥∞ ≤ δ.

To derive the certification bound that is suitable for a timeseries input X ∈ Rn×T and a classifier Fθ, we employ two different noise distributions to generate two different noise samples that we denote nP ∈ Rn×T and n0 ∈ Rn×T . nP ∼ N(µP , ·) is generated to mimic the perturbation characterizing the robustness of classifier Fθ for predicting the same label for perturbed time-series. n0 ∼ N(0, ·) is generated as an arbitrary noise needed for the computation of the certification bound. If both perturbations result in the same classifier prediction, we compute the tolerable perturbation's upper bound δ = max ∥µP ∥∞ as shown in Theorem 2.

Theorem 2. Let X ∈ Rn×T be an input time-series signal. Let nP ∼ N(µP ∈ Rn , ∑) and n0 ∼ N(0, ∑). Given a classifier Fθ : Rn×T → Y that produces a probability distribution (p1, · · · , pk) over k labels for Fθ(X + nP ) and another probability distribution (p01 , · · · , p0k ) for Fθ(X+n0). To guarantee that argmax pi pi = argmax p0i p0i , the following

condition must be satisfied:

Formula not decoded

Formula not decoded

where ∑(S) is the sum of all elements of ∑.

Lemma 1. If a certified bound δ is generated for the mean of an input signal X and a classifier Fθ, then certified bounds for other statistical features can be derived consequently.

4 Experiments and Results

We briefly summarize the main results from [Belkhouja and Doppa, 2022].

4.1 Experimental Setup

To evaluate the proposed TSA-STAT framework, [Belkhouja and Doppa, 2022] employed diverse uni-variate and multivariate time series benchmark datasets [Bagnall et al., 2020; Dua and Graff, 2017; Kwapisz et al., 2011]. For this extended abstract, we only show the performance over two datasets (WD and SC) noting that similar patterns are found on other datasets. Three different 1D-CNN architectures are used to create three deep models as target DNN classifiers: WB for white-box setting, and BB1 and BB2 for the black-box setting respectively. We employ models that are trained with clean data and others using augmented data from baselines attacks: Fast Gradient Sign method (FGS) [Fawaz et al., 2019], Carlini &Wagner (CW) [Carlini and Wagner, 2017], and Projected Gradient Descent (PGD) [Madry et al., 2017].

4.2 Results and Discussion

Spatial distribution of TSA-STAT outputs. We employ a t-Distributed Stochastic Neighbor Embedding (t-SNE) [Maaten and Hinton, 2008] technique to visualize the adversarial examples generated by TSA-STAT and PGD, an lpnorm based attack. Figure 2 illustrates a representative example of the spatial distribution between same-class data of HAPT dataset, and their respective adversarial examples using TSA-STAT and PGD. We can see that TSA-STAT succeeds in preserving the similarity between the original and adversarial example pairs, and in most cases, better than PGD.

Effectiveness of adversarial examples from TSA-STAT.

We show the effectiveness of generated adversarial examples to fool different deep models for time-series domain. We evaluate TSA-STAT using αEff ∈ [0, 1] (higher means better attacks) that measures the capability of targeted adversarial examples to fool a given classifier. Figure 3 shows the results for instance-specific and universal attacks under white-box and black-box settings on different deep models. Figure 4 shows the results of different deep models after adversarial training based on different methods including TSA-STAT.

These experiments summarize the effectiveness of adversarial examples from TSA-STAT and show that statistical features are well-justified for time-series data. If the standard lpnorm-based methods from the image domain were to be very effective for the time-series domain, 1) TSA-STAT's attacks would not be able to fool the models using baselines as a defense method, and 2) TSA-STAT's adversarial training would not outperform the baselines on clean accuracy.

4.3 Summary of Results

• The similarity measure based on statistical features is more effective for time-series data when compared to the standard lp-norm based algorithms.
• Adversarial attacks created by TSA-STAT are very effective in fooling DNNs for time-series classification tasks and evading adversarial training based DNNs using adversarial examples created by prior methods.
• TSA-STAT provides better true-label guarantees (examples belonging to the semantic space of true label) than prior methods and can compute certification guarantees for robust classification as stated in Theorem 2.

Acknowledgements

This research is supported in part by the AgAID AI Institute, supported by the NSF and USDA-NIFA award #2021-6702135344.

Machine-readable versions of this paper, for tools and AI agents:

• Markdown — metadata, abstract, full text and references
• JSON — metadata and structured references
• BibTeX