Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper studies adversarial attacks on multivariate forecasting models - a problem that has not been explored in prior work but is practically relevant due to the prevalence of these models in various real-world tasks. The authors first propose sparse, white-box deterministic indirect attacks that add adversarial perturbations to a time series different from the target series.  To make the attack hard to detect, probabilistic attacks. Next, the authors design two defenses in this setting based on randomized smoothing and mini-max optimization. Experimental evaluation is performed on a variety of datasets. The results show that probabilistic attacks are more effective than deterministic ones while the defenses enable more robustness against these attacks than no defense. 
strength_and_weaknesses: Strengths:

1. The threat model considered here is novel and interesting and may lead to more work in this area.

2. The paper is well-organized, easy to read, and accessible to a broad audience.

3. There is enough technical novelty in the design of probabilistic attacks and the formulation of mini-max defense for multivariate forecasting models for publication at ICLR.

4. The experimental evaluation supports the main claims made in the paper. I provide some suggestions below to make the evaluation more compelling.

Weaknesses:

1. The attacks assume an offline setting. It is not clear if the attacks work in an online setting where the time series data is generated on the fly. This is particularly relevant for stock market predictions.

clarity,_quality,_novelty_and_reproducibility: Clarity and Quality: The main claims and experiments in this paper are well-described. The authors should consider providing the runtime of running attacks and defenses. Further, they should also study the attack performance when time series other than {1} are attacked as well as in the case when multiple target series can be attacked. What is the value of the threshold for the perturbation at each coordinate in the experiments? It is also not clear if the randomized defense designed here is a certified one or only provides empirical protection. If its a certified defense, then what guarantees does it give?

Novelty: The high-level idea behind the deterministic attack presented here has been explored for images in https://arxiv.org/pdf/1909.05040v1.pdf. The algorithm for the differentiable probabilistic attack is new.  The randomized smoothing defense is a straightforward adaptation of RS for other domains while the formulation of the mini-max defense is novel.

Reproducibility: Sufficient details are provided. the authors do not mention if they will release the code of their attacks.
summary_of_the_review: In summary, this is a well-written paper that tackles an important but unexplored problem in the literature that should lead to more work in this area. The technical claims are novel and the contributions are supported by evaluation results. I believe that this paper is a good candidate for acceptance at ICLR.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: In this paper, authors introduced an optimization-based adversarial attack to in-direct attack the forecasting performance. In addition, the authors proposed an protection approach to protect the model from the proposed attack.
strength_and_weaknesses: Strength
1. The paper touches on an interesting paper on time series forecasting
2. The experiment is solid

Weakness
1. The high-level idea of the method is very similar to the classical techniques used in other closed research fields such as the time series of classification as [1]
2. Proposed method only evaluated on DeepAR and DeepVAR
3. Lacking of graphical examples of how time series in different noise-level looks like.

Detailed Comments that needs to be addressed by authors: See the summary of review.
clarity,_quality,_novelty_and_reproducibility: The paper is well-written. The solution is sort of similar to existing adversarial attacks bu only a few papers that are addressed the adversarial attack issue in time series forecasting. I did not find the source code attached to the manuscript.
summary_of_the_review: 1. The proposed approach was only tested with DeepAR and DeepVAR forecasting models. First of all, why only tested in DeepAR-based models, which is not the optimal solution in general? For example, is the proposed work also can protect the Deep State Space Model from attacking? How about other non-probabilistic forecasting models? For example, NBeats or Informer. 

2. The technique used here is very standard. While only limited work focuses on time series forecasting, a lot of work has been done in time series classification [1]. The high-level idea of formalizing the objective equation is very similar. The authors should mention what is the benefit of the novel loss function.

3. In the experiment, the model is evaluated on WQLoss. Why do we only use WQLoss? Intuitively, CRPS, RMSE, and MAE are all valid evaluation criteria. Besides, from Fig. 1, I personally do not see the attack as a success because it does not change a lot of the forecasting. You need to show what the forecasting with confidence interval looks like to justify your claim.
  
4. If using i.i.d based forecasting, what will happen for the in-direct attack?

* Thank you for the discussion. I believe the authors successfully resolve most of my concerns. I increase my score to 6.

5. The forecasting length is short compared with the long-term forecasting model. What is the performance of different lengths? Compared the performance of different lengths may be needed.

6. Mini-max Defense is specially designed for the proposed attack, but if the attack is not that aggressive, what somethings could happen?

7. Visually speaking, how are the noisy-added time series look under different noise-level? 

[1] Zhang T, Liu S, Wang Y, Fardad M. Generation of low distortion adversarial attacks via convex programming. In2019 IEEE International Conference on Data Mining (ICDM) 2019 Nov 8 (pp. 1486-1491). IEEE.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The submission studies adversarial attacks and defences in the context of multivariate probabilistic forecasting of time series. The threat model assumes that the attacker can perturb past values and that the sets of target series and perturbed series are distinct, with an additional sparsity contraint on the set of perturbed series.  
strength_and_weaknesses: I find the main claim to be well supported as the paper covers all aspects of adversarial attacks on multivariate probabilistic forecasting. I am mostly satisfied with the mathematical treatment and the experiments appear sound. 

I have ambivalent feelings about the description of related work. The paper clearly differentiates from prior attacks on probabilistic time series forecasting by its multivariate setting. However, the presented attack and defense algorithms seem to be somewhat incremental on prior work, which creates a novelty concern. 

 
clarity,_quality,_novelty_and_reproducibility: To elaborate on my concerns above:
- the threat model described in 3.1 seems directly taken from Dang-Nhu et al. (which you are already citing). In particular you are reusing the notation $\chi$ and $t$ which was introduced by this paper. This is fine but it would make sens to properly attribute this. 
- as far as I understand, the "mini-max" defence falls into the category of standard adversarial training? I'm concerned that this section is only citing GAN papers which are distantly related. Could you please comment of the novelty of this method and properly discuss related work?
-  My memories of randomised smoothing are somewhat distant but as far as I understand, theorem 4.1. is a rather standard and application-independent result? Are you able to explain what differences in the proof allow you to obtain a result valid for any $\delta$ and to apply the result to a multivariate setting?


I would also like to clarify some aspects of the contribution:
- In the deterministic attack (3.2), since the sparsity constraint can be solved analytically, would it make sense to apply to use projected gradient descent also for this and project at each optimisation step rather than just at the end?
- In your description of the probabilistic attack (3.3.), you are immediately factoring the distribution (last line of page 4). Not every distribution can be factored in this way. If you choose to make some kind of independence assumption in the modelling, you need to state it clearly.
- The math of the probabilistic attack (3.3) appear sound to me, but I find this section to be a bit terse in explanations 
    - In the final step of algorithm 4, you are simply drawing $\delta$ from the distribution. It is proven that *in expectation* this $\delta$ will have the desired level of sparsity, but this is a probabilistic guarantee. Do you actually check that the drawn perturbation is sparse? 
    - I feel like I'm lacking some context about this probabilistic relaxation of the sparsity constraint. Is there a body of related literature? This section doesn't mention any kind of related work
     - Algorithm 4 doesn't explain how you compute or approximate the outer expectation in equation (3.5). Does this build on the reparametrization in theorem 3.1? Is this a standard approach to reparametrizing discrete variables in a model? 
- In 5.2, you refer to increased $\kappa$ as "increased sparsity". Intuitively I would see this as "decreased sparsity"
summary_of_the_review: I find the topic of this paper very interesting and the main claim to be well supported. However I have many questions and concerns about the clarity and novelty of the different algorithms described in the paper. I think that some additional explanations and improvements are needed to pass the acceptance bar.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper adapts adversarial attack strategies to multivariate probabilistic forecasting models, focusing on attacks that might be difficult to detect. They also adapt defense mechanisms to adversarial attacks to the time-series forecasting setup and demonstrate how multivariate problems differ from univariate ones.
strength_and_weaknesses: The paper is well-written and motivated, covering many nuances of the problem at hand.
clarity,_quality,_novelty_and_reproducibility: The paper seems to demonstrate original ideas and is clearly and understandably written.
summary_of_the_review: The paper answers a natural research question on defending against adversarial attacks in time series forecasting problems. This is a natural and well-motivated problem that is quite clearly answered and hence a non-trivial contribution to the literature.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: Although we have mixed feelings regarding the novelty of this work with respect to the problem formulation and the actual design of the attacks and defense formulation, we do recognize the novelty of the threat model which has potential to arouse further research interests in this area. The main claims in the paper are also well supported. Nevertheless, the paper has room for improvement before final publication. We recommend the authors to consider our comments and suggestions thoroughly when revising their paper. Some potential longer-term extensions, such as generalizing from the offline to online setting, may also be discussed.

justification_for_why_not_higher_score: The work is good, but not good enough to deserve spotlight acceptance due to our mixed feelings regarding its technical novelty.

justification_for_why_not_lower_score: After the discussion period, all four reviewers are supportive of acceptance (6, 6, 6, 8) with sound justification. I can hardly go against their recommendation to reject the paper.
Decision: Accept: poster